389-commits June 2010

389-commits@lists.fedoraproject.org

3 participants
35 discussions

selinux/dirsrv.if
by Noriko Hosoi 29 Jun '10

29 Jun '10

selinux/dirsrv.if | 1 + 1 file changed, 1 insertion(+) New commits: commit 1a47871230d6cd088e08b8af42072e2560b423ec Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Jun 29 12:11:46 2010 -0700 609256 - Selinux: pwdhash fails if called via Admin Server CGI https://bugzilla.redhat.com/show_bug.cgi?id=609256 Description by nkinder(a)redhat.com: Our CGIs are very restricted in what they can access/run. Most of the CGIs are self contained programs (they may use libraries, which is fine). In this case, it looks like pwdhash-bin is called from the SELinux context used by CGIs (httpd_dirsrvadmin_script_t). The pwdhash-bin program then tries to load libslapd.so.0, which is labeled as dirsrv_lib_t. This should be allowed by our SELinux policy since we call this macro with the httpd_dirsrvadmin_script_t contex. What seems to be the issue here is that libslapd.so.0 is a symlink, not a regular file. SELinux considers this to be a class of "lnk_file", as can be seen in the raw AVC from /var/log/audit/audit. We need to expand the dirsrv_exec_lib macro to cover link_file. diff --git a/selinux/dirsrv.if b/selinux/dirsrv.if index 56eda43..ed88fb2 100644 --- a/selinux/dirsrv.if +++ b/selinux/dirsrv.if @@ -189,6 +189,7 @@ interface(`dirsrv_exec_lib',` allow $1 dirsrv_lib_t:dir search_dir_perms; allow $1 dirsrv_lib_t:file exec_file_perms; + allow $1 dirsrv_lib_t:link_file exec_file_perms; # Not all platforms include ioctl in exec_file_perms allow $1 dirsrv_lib_t:file ioctl; ')

1 0

ldap/servers
by Noriko Hosoi 25 Jun '10

25 Jun '10

ldap/servers/slapd/back-ldbm/back-ldbm.h | 3 ++ ldap/servers/slapd/back-ldbm/id2entry.c | 31 ++++++++++++++++++++++++- ldap/servers/slapd/back-ldbm/index.c | 31 ++++++++++++++++++++++++- ldap/servers/slapd/back-ldbm/ldbm_search.c | 3 +- ldap/servers/slapd/back-ldbm/proto-back-ldbm.h | 2 + 5 files changed, 67 insertions(+), 3 deletions(-) New commits: commit 7482698b041e4882b4d0ca66d06dfd833657b6f3 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Thu Jun 24 16:34:01 2010 -0700 578296 - Attribute type entrydn needs to be added when subtree rename switch is on https://bugzilla.redhat.com/show_bug.cgi?id=578296 Change Description: 1) ldbm_back_next_search_entry_ext (ldbm_search.c) When getting an entry from ID using id2entry_ext, pass a flag ID2ENTRY_ADD_ENTRYDN to add entrydn to the entry. 2) id2entry_ext (id2entry.c) Added id2entry_ext to handle the flag ID2ENTRY_ADD_ENTRYDN. If ID2ENTRY_ADD_ENTRYDN is set in the flags variable and entryrdn switch is enabled, entrydn is added to the entry. 3) index_read_ext (index.c) If entryrdn switch is on and the attribute type is entrydn and the search type is equality, then call entryrdn_index_read to get the ID directly. diff --git a/ldap/servers/slapd/back-ldbm/back-ldbm.h b/ldap/servers/slapd/back-ldbm/back-ldbm.h index 9efcd16..8a944c8 100644 --- a/ldap/servers/slapd/back-ldbm/back-ldbm.h +++ b/ldap/servers/slapd/back-ldbm/back-ldbm.h @@ -826,4 +826,7 @@ typedef struct _back_search_result_set /* whether we call fat lock or not [608146] */ #define SERIALLOCK(li) (li->li_fat_lock) + +/* id2entry_ext flags */ +#define ID2ENTRY_ADD_ENTRYDN 0x1 #endif /* _back_ldbm_h_ */ diff --git a/ldap/servers/slapd/back-ldbm/id2entry.c b/ldap/servers/slapd/back-ldbm/id2entry.c index 21f21fc..31d3b72 100644 --- a/ldap/servers/slapd/back-ldbm/id2entry.c +++ b/ldap/servers/slapd/back-ldbm/id2entry.c @@ -208,7 +208,7 @@ id2entry_delete( backend *be, struct backentry *e, back_txn *txn ) } struct backentry * -id2entry( backend *be, ID id, back_txn *txn, int *err ) +id2entry_ext( backend *be, ID id, back_txn *txn, int *err, int flags ) { ldbm_instance *inst = (ldbm_instance *) be->be_instance_info; DB *db = NULL; @@ -376,6 +376,29 @@ id2entry( backend *be, ID id, back_txn *txn, int *err ) } bail: + /* + * If return entry exists AND adding entrydn is requested AND + * entryrdn switch is on, add the entrydn value. + */ + if (e && e->ep_entry && (flags & ID2ENTRY_ADD_ENTRYDN) && + entryrdn_get_switch()) { + Slapi_Attr *eattr = NULL; + /* Check if entrydn is in the entry or not */ + if (slapi_entry_attr_find(e->ep_entry, "entrydn", &eattr)) { + /* entrydn does not exist in the entry */ + char *entrydn = NULL; + /* slapi_ch_strdup and slapi_dn_ignore_case never returns NULL */ + entrydn = slapi_ch_strdup(slapi_entry_get_dn_const(e->ep_entry)); + entrydn = slapi_dn_ignore_case(entrydn); + slapi_entry_attr_set_charptr (e->ep_entry, "entrydn", entrydn); + if (0 == slapi_entry_attr_find(e->ep_entry, "entrydn", &eattr)) { + /* now entrydn should exist in the entry */ + /* Set it to operational attribute */ + eattr->a_flags = SLAPI_ATTR_FLAG_OPATTR; + } + slapi_ch_free_string(&entrydn); + } + } slapi_ch_free( &(data.data) ); dblayer_release_id2entry( be, db ); @@ -385,3 +408,9 @@ bail: return( e ); } +struct backentry * +id2entry( backend *be, ID id, back_txn *txn, int *err ) +{ + return id2entry_ext(be, id, txn, err, 0); +} + diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c index f26e3d3..da22648 100644 --- a/ldap/servers/slapd/back-ldbm/index.c +++ b/ldap/servers/slapd/back-ldbm/index.c @@ -817,7 +817,7 @@ index_read_ext( DB *db = NULL; DB_TXN *db_txn = NULL; DBT key = {0}; - IDList *idl; + IDList *idl = NULL; char *prefix; char *tmpbuf = NULL; char buf[BUFSIZ]; @@ -850,6 +850,35 @@ index_read_ext( LDAPDebug( LDAP_DEBUG_ARGS, " indextype: \"%s\" indexmask: 0x%x\n", indextype, ai->ai_indexmask, 0 ); + /* If entryrdn switch is on AND the type is entrydn AND the prefix is '=', + * use the entryrdn index directly */ + if (entryrdn_get_switch() && (*prefix == '=') && + (0 == PL_strcasecmp(basetype, LDBM_ENTRYDN_STR))) { + int rc = 0; + ID id = 0; + Slapi_DN sdn = {0}; + + /* We don't need these values... */ + index_free_prefix( prefix ); + slapi_ch_free_string( &basetmp ); + if (NULL == val || NULL == val->bv_val) { + /* entrydn value was not given */ + return NULL; + } + slapi_sdn_init_dn_byval(&sdn, val->bv_val); + rc = entryrdn_index_read(be, &sdn, &id, txn); + slapi_sdn_done(&sdn); + if (rc) { /* failure */ + return NULL; + } else { /* success */ + rc = idl_append_extend(&idl, id); + if (rc) { /* failure */ + return NULL; + } + return idl; + } + } + if ( !is_indexed( indextype, ai->ai_indexmask, ai->ai_index_rules ) ) { idl = idl_allids( be ); if (unindexed != NULL) *unindexed = 1; diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c index db1bd92..9a4925f 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_search.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c @@ -1241,7 +1241,8 @@ ldbm_back_next_search_entry_ext( Slapi_PBlock *pb, int use_extension ) ++sr->sr_lookthroughcount; /* checked above */ /* get the entry */ - if ( (e = id2entry( be, id, NULL, &err )) == NULL ) + e = id2entry_ext( be, id, NULL, &err, ID2ENTRY_ADD_ENTRYDN ); + if ( e == NULL ) { if ( err != 0 && err != DB_NOTFOUND ) { diff --git a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h index 12361f4..5b77684 100644 --- a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h +++ b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h @@ -214,6 +214,8 @@ int id2entry_add( backend *be, struct backentry *e, back_txn *txn ); int id2entry_add_ext( backend *be, struct backentry *e, back_txn *txn, int encrypt ); int id2entry_delete( backend *be, struct backentry *e, back_txn *txn ); struct backentry * id2entry( backend *be, ID id, back_txn *txn, int *err ); +struct backentry * id2entry_ext( backend *be, ID id, back_txn *txn, int *err, int flags ); + /* * idl.c

1 0

ldap/admin
by Richard Allen Megginson 23 Jun '10

23 Jun '10

ldap/admin/src/scripts/91upgradednformat.pl | 7 +++++++ 1 file changed, 7 insertions(+) New commits: commit 7094777b00a7310ce966fd9e237b9cab69c9329a Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Fri Jun 18 14:24:05 2010 -0700 605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl https://bugzilla.redhat.com/show_bug.cgi?id=605827 Description: 70upgradednformat.pl does nothing if the server is up. The upgrade script is effective only when it's called in the Off- line mode. (cherry picked from commit a109da80a8eae4400b42a27bb5de604f9aee344d) diff --git a/ldap/admin/src/scripts/91upgradednformat.pl b/ldap/admin/src/scripts/91upgradednformat.pl index 1bed3cf..611f1e0 100644 --- a/ldap/admin/src/scripts/91upgradednformat.pl +++ b/ldap/admin/src/scripts/91upgradednformat.pl @@ -11,9 +11,16 @@ use File::Copy; # recursively copy the instance dir to the work dir (dnupgrade) # run upgradednformat w/o -N against the DB in the work dir # if it went ok, replace the original instance dir with the work dir. +# Note: This script does nothing if the server is up. sub runinst { my ($inf, $inst, $dseldif, $conn) = @_; + # First, check if the server is up or down. + if ($conn->isa("Mozilla::LDAP::Conn")) { + # The server is up, we do nothing. + return (); + } + my @errs; my $config = "cn=config";

1 0

Changes to 'refs/tags/Directory_Server_8_2_Candidate_20100623'
by Richard Allen Megginson 23 Jun '10

23 Jun '10

Changes since the dawn of time: David Boreham (68): Move AXIS and DSML jars to /s/b/c Makefile changes to allow building on Linux machines where uname reports four-part version Always use the internal regex functions : checkin lost in the AOL/RH move. Always use the internal regex functions: checkin lost in the AOL/RH move. Add password change extended operation support. Add support for password change extended operation. Always use the internal regex functions: checkin list in the AOL/RH move. Large stack size for 64-bit builds: checkin lost in AOL/RH move. Add support for password change extended operation. Add support for filesystem-based replica initialization. Add long hostname support for HP-UX Merge over new code: fractional replication, wan replication and windows sync plus associated UI Fix the HP build Additional schama for windows user sync New windows sync code Fix unicode conversion for passwords Merge password sync code from Bozeman Pass Change DSMLGW to work with Axis1.2rc3 Use axis 1.2rc3 Fix DSMLGW test failures Change password sync copyright notices, merge fixes to password sync code Merge fixes to DSMLGW post-axis-version-change Fix processing of base-64 encoded data Fixes for windows sync for NT4 Fix instability in re-try and backoff mechanism Fix RUV updating code Fix initial RUV logic and add support for Win2003 Take out old code that was #defined out remove redundant source file and associated Makefile line remove bogus logging fix bug#154261 Use separate attribute maps for NT4 and AD. Fix 155266 Fix mapping of seeAlso and secretary attributes Add new NT4 LDAP Service, used by windows sync Fix for 154837 : non-sync'ed group entries get backed out Fix mapping of street and streetAddress attrs Fix for 155141: bug in linked list code Fix mapping of street attribute, fix total update of previously sync'ed entries Fix handling of group membership, fix installer GUID, fix handling of entry description Change GUID for installer Fix for 155063: remove error messages due to entry parsing failure Fix for 64-bit bug in dirsync control parsing code Fix ruv update on skipped change Fix syncing of contained entries Fix the fact that if an operation fails in a total update, we immediately halt Fix schema for NT sync Fix display names in pass sync to say Fedora Fix display name to say Fedora... Fix various bad memory free bugs Merge fixes over Allow error on result side to propagate pack to sending side Fixes for windows sync Fix for #157020: convert unicode password to little-endian byte order Fix for #155591: treat an ruv with no min_csn as pristine Fix for 157021: server doesn't correctly process modifies to windows sync agreements Fix for #156449 : mangle 'street' attribute to defeat our schema aliasing it with 'streetaddress' Fix for #155588 : don't leak connections from the ldap connection pool Fixes for memory leaks in ntds Patches we apply to apache ds 0.9 Update packaging for ntds Fix Windows SSL replication in-order processing of operatations Change NT4 case to send plaintext passwords Fix ntds installer to allow repair and removal Fix for #157901 : FMR in windows sync agreement code Memory Leak Fixes for Apache DS Fix for #157895 : logon hours doesn't work Fix for 157919: perform fractional consumer check after acquiring the replica Fix for 158031: add default indices needed by Windows Sync Fix for #158253: add attributes to the exclusion list for fractional replication. Add an error string returned to clients if an illegal attribute is configured Endi S. Dewata (5): Uninitialized mutex in Retro Changelog Plugin. https://bugzilla.redhat.com/show_bug.cgi?id=554841 Resolves: bug 554841 Bug Description: Enabling Retro Changelog Plugin on a DS instance provisioned by Samba will crash slapd during startup. Branch: HEAD Fix Description: Apparently the retrocl_internal_lock is still NULL when it's used in retrocl_get_first_changenumber(). The solution is to initialize the lock in the retrocl_plugin_init(). Platforms tested: F12 i386 Bug 573375 - MODRDN operation not logged Bug 566043 - startpid file is only cleaned by initscript runs Bug 584109 - Slapd crashes while parsing DNA configuration Bug 542570 - Directory Server port number is not validated in the beginning. Nathan Kinder (333): Rebranding targets should checkout reltools automatically - nkinder(a)redhat.com Added rebranding data for RHDS - nkinder(a)redhat.com Cleaned up UI for rebranding - nkinder(a)redhat.com 146294 - changed dsgw to be brand agnostic - nkinder(a)redhat.com Fixed axis component pull and cleaned up tomcat references - nkinder(a)redhat.com 146201 - make directory express brand agnostic - nkinder(a)redhat.com 146735 - Fixed HP-UX patch typos - nkinder(a)redhat.com 146804 - Remove 7 day grace period from purging logic - nkinder(a)redhat.com 146804 - Added extra validity check for purge_csn - nkinder(a)redhat.com 147053 - remove dsrk dependency Added HP-UX makefiles 147044 - convert entry id to big endian before looking up in db 147368 - Made org chart brand agnostic Fixed PAM plugin for HP builds Updated nss, nspr, dbm, and jss component versions New net-snmp subagent 149951 - Updated source code copyrights Updated SNMP OIDs for Red Hat namespace Use new RHEL platform naming Pull svrcore from sbsintegration Pull DS Console as a component Fixed declaration syntax error Fixed missing symbol issues for Solaris ds_newinst Pull svrcore from sbc Fix db component pull Differentiate between internal and external components during branding Fixed BUILD_MODE flag to look in correct file Backed out accidental checkin of branded file Pick up new Axis component (1.2rc3) Updated copyright info Update copyrights for DSGW Copyright updates Fixed DOS style end of line chars Update location of ldapconsole component Remove un-needed Console SDK dependency Updated copyright info Updated copyright info Space in the makefile was causing findstring to fail on RHEL4 Pick up new perldap component Enable building of SNMP subagent Compilation and linking fixes for SNMP subagent Added 64-bit linker options for HP-UX and Solaris Update components and SNMP config changes Pick up new Admin Server component Ensure null termination of strings in SNMP code Fix swap space reporting on Linux Pick up new Admin Server and LDAP Console components Corrected ndd recommendations 153668 - Update dsktune for HP-UX Update dsktune version date Updated readme file plus new admin server Pick up new LDAP Console component Acceptance and ships fixes for RPMs Run acceptance in the background 154077 - Check for version 1.4.2.07 of JRE on HP-UX Pick up new Admin Server 154948 - Fixed fractional repl crash 155068 - Added license to source files Pick up new ldapconsole Created LICENSE and EXCEPTION files HP-UX IPF Porting changes Pick up new adminserver and ldapconsole components Removed ldaptags and Whos Online references Fixed licensing typo Fixed copyright block error 155460 - Remove crypt password storage from windows build Use OPL for online help docs 154041 - Added Fedora EULA Pick up new ldapconsole component Fixed whitespace issue in Makefile 155782 - Don't include CVS directories in source rpm Pick up new components Fix search scope for AD password sync - 159037 164017 - Attribute uniqueness plugin now only checks for conflicts in subtrees that the operation applies to 164843 - Modified indexing to deal with attribute subtypes 165862 - Needed to set BE_INDEX_EQUALITY flag when doing a delete of an entry. 166012 - Use of incorrect iterator in indexing code was causing illegal access of memory which sometimes resulted in crashing. Pull setuputil from sbsint, not sbc. 167441 - Added SHA2 hashed password storage support. 165228 - Don't have RPM auto-generate provides list 168309 - Removed setup wrappers used for Java packaging and added RPM dependency for java-1.4.2-ibm package. 168322 - Check size of hash needed before base64 encoding password hashes 169388 - Fixed attribute comparision helper function that was causing certain changes to not get synched. 169954 - Winsync initialization would hang with certain entries. Fixed improper use of ldap_get_next. 169954 - Moved illegal declaration to the top of code block 170321 - Increase winsync version to 1.0.1 170328 - Fixed modify type installation so it actually updates the registry 170558 - Add certutil, pk12util and missing dlls to PassSync.msi 170558 - Add certutil, pk12util and missing dlls to PassSync.msi 170135 - Improved passsync logging facilities 170556 - Make passsync obey backoff for retries when DS is down 170816 - Don't consume password changes if modify fails 170071 - Automatically add grouptype for new groups being synchd to NT4 163064 - It appears that Active Directory has a problem where it allows duplicate values for system-only multivalued attributes. This change just skips the dscorepropagationdata attibute when receiving a change from DirSync. Pull ldapconsole from integration area Changed cyrus-sasl rpm dependency to >=2.1.15 for RHEL3 compatibility Need to package online help files for external builds 174550 - Fixed error message typo 178867 - Enhanced password syntax checking Bug(s) fixed: 180744 Bug(s) fixed: 181032 Fix build-time issue of lib_dsadmin.so for x86_64 support Bug(s) fixed: 181827 184585 - SASL context needs to be disposed of and a new one created when re-binding 184585 - Adjusted the location of the connection lock when doing a sasl_rebind 185811 - Fixed windows build failures when compiling slapd_chown_if_not_owner function 185811 - Need to exclude pwd.h include on windows 185811 - Don't check localuser config on Windows 185811 - slapi_dn_find_parent needs to be added to libslapd.def for windows build to compile 185811 - Missing const qualifiers were causing Windows compiler errors 188931 - Use system Net-SNMP libraries on Linux systems 189176 - Fixed aci for directory administrators group. 16578 - Fixed off by one error in month in logconv.pl 190724 - Evaluate ACIs before checking password syntax 190724 - Array initialization needed to be changed to fix a HP-UX PA compilation error 202872 - Allow password modify extended operation when using SASL privacy layer 203043 - Support password generation when using the password modify extended operation 203043 - Optimizations in password generation Test for commits mailing list - ignore. 204355 - Remove winsync code from ldapserver tree 204410 - Pick up new ldapcsdk, nspr, and sasl components 204517 - Use new ber types throughout the server code. 204517 - Cleaned up usage of ber_printf to use new ber types 208058 - Copy decrypted SASL data starting from buffer offset instead of always copying from the beginning of the buffer. Related: 210736 Resolves: 211234 Resolves: 211386 Resolves: 211419 Resolves: 211554 Resolves: 211554 Resolves: 212038 Resolves: 212483 Related: 213352 Resolves: 214238 Related: 214238 Resolves: 214463 Resolves: 214682 Package libsasl in core libdir for old style build Resolves: 212112 Resolves: 217796 Resolves: 227754 Resolves: 228082 Resolves: 229095 Resolves: 229428 Resolves: 229428 Resolves: 230458 Resolves: 235143 Resolves: 236612 Resolves: 236612 Resolves: 240240 Resolves: 240583 Summary: Removed unused source files. Resolves: 251262 Resolves: 253582 Added sasl link to ldap-agent binary. Resolves: 253818 Resolves: 243221 Resolves: 207893 Resolves: 212671 Resolves: 207567 Resolves: 243227 Resolves: 242551 Resolves: 293541 Resolves: 294301 Removed online help docs now that they've been moved to directoryconsole. Resolves: 299361 Resolves: 304191 Resolves: 170560 Resolves: 238504 Resolves: 288521 Resolves: 158667 Resolves: 197997 Resolves: 219586 Resolves: 311851 Resolves: 311851 Resolves: 238517 Summary: Re-generated autotools build files. Resolves: 314791 Resolves: 282911 Resolves: 288321 Resolves: 268101 Resolves: 316281 Resolves: 176302 Resolves: 325281 Resolves: 238630 Resolves: 328741 Resolves: 335081 Resolves: 219587 Resolves: 338611 Resolves: 336871 Resolves: 188320 Resolves: 344631 Resolves: 429799 Resolves: 429793 Initial import of memberof plugin from FreeIPA (refactored from changeset 640:9c57bd91b32f if ipa-memberof.c). Resolves: 435730 Resolves: 438891 Resolves: 439097 Summary: Avoid adding a group as a memberOf itself. Resolves: 439907 Resolves: 440333 Resolves: 440474 Resolves: 439628 Resolves: 450107 Resolves: 443241 Resolves: 450746 Resolves: 450989 Resolves: 452169 Resolves: 452537 Resolves: 453011 Resolves: 454328 Resolves: 455913 Resolves: 456162 Resolves: 457260 Resolves: 456968 Resolves: 457329 Resolves: 457951 Resolves: 458135 Resolves: 462920 Resolves: 464188 Related: 207457 Related: 207457 Resolves: 207457 Resolves: 207457 Resolves: 207457 Resolves: 467931 Resolves: 452569 Resolves: 316241 Resolves: 207457 Resolves: 470393 Resolves: 470918 Resolves: 450046 Resolves: 454348 Resolves: 207457 Resolves: 216522 Resolves: 430321 Resolves: 387851 Resolves: 387851 Resolves: 220532 Resolves: 474254 Resolves: 445775 Resolves: 201332 Resolves: 250535 Resolves: 437049 Resolves: 430368 Resolves: 445305 Resolves: 467233 Resolves: 463776 Resolves: 437049 Resolves: 474621 Resolves:479065 Resolves: 381361 Resolves: 381361 Resolves: 472602 Resolves: 170461 Resolves: 174394 Resolves: 437900 Resolves: 253311 Resolves: 442474 Resolves: 184141 Resolves: 248924 Resolves: 204626 Resolves: 474945 Resolves: 480384 Resolves: 474945 Resolves: 470611 Resolves: 452007 Resolves: 463337 Resolves: 455629 Resolves: 455629 Resolves: 446697 Resolves: 245894 Resolves: 245894 Resolves: bug 487574 Resolves: bug 487725 Resolves: 487765 Resolves: bug 486400 Resolves: 445602 Resolves: 442474 Resolves: 496836 Added capability to validate syntax of values being added to the database. Also added numericstring syntax support. Generated autotools files for syntax validation feature. Auto-generate SLAPI docs - first pass. Add strict DN syntax enforcement option. Add require secure binds switch. Bug: 181465 - Handle spacing issues in objectClass SUP list. Add linked attributes plug-in. Bug: 509401 - dnaNextValue not updated when dnaMaxValue set to -1 Add additional standard syntaxes. Skip syntax check of encrypted attributes during import. Use LDAPv3 DN values in ns-newpwpolicy script. Change aci syntax to Directory String. Bug 514824: Fix double free in macro ACI code. Bug 514848: Make selfwrite ACI keyword with with Name And Optional UID syntax attributes. Bug 514955 - Make DNA handle multiple mods Add centralized start/stop/restart scipts. Allow anonymous access to be disabled. Add minimum SSF setting Add ssf bind rule to access control plug-in. Allow anonymous bind resource limits to be set. BZ 221905 - Add SMD5 password storage support. Bug 529258 - Make upgrade remove obsolete schema from 99user.ldif Make removeds.pl remove instance initconfig script Allow plugin execution order to be defined 387681 - Fix errors in mapping AD tombstones Bug 511112 - Eliminate fixed length array in password history code. Bug 497199 - Skip dirsync if disconnected during incremental update Bug 504817 - Handle LDAPv2 quoted RDN values correctly Bug 515329 - Correct attribute value inconsistency on replica Avoid freeing NULL trimmed passwords list Add bounds checking in DN unescape function Bug 195302 - Allow fine-grained password storage scheme to be set Bug 193297 - Call bind pre-op and post-op plug-ins for SASL binds Bug 201275 - Make SASL EXTERNAL bind obey account lock Bug 195302 - Fix crash regression from previous fix Bug 497556 - LDAPI connections cause TCP performance degradation Set unknown attribute syntax to Octet String. Bug 518084 - Fix out of order retro changelog entries Document SLAPI DN related functions. Add missing paran from fix for bug 518084 Bug 548537 - Fix memory leaks in DNA plugin Bug 553455 - fix segfault when changing a password Add Doxygen comments for SLAPI attr, value, and valueset functions. Bug 536703 - Don't send empty mod to AD for mapped DN values Bug 549554 - Trim single-valued attributes before sending to AD Add ldap-agent init script. Improve search for pcre header file Bug 434735 - Allow SASL ANONYMOUS mech to work Allow instance name to be parsed from start-slapd Bug 578863 - Password modify extop needs to send referrals on replicas Bug 592389 - Set anonymous resource limits properly Bug 601433 - Add man pages for start-dirsrv and related commands Bug 604263 - Fix memory leak when password change is rejected Noriko Hosoi (435): 1) added -p to mkdir built/<PLATFORM_OBJDIR> fixed packaging -- the path to reltools was incorrect Stop compiling/packaging presence plugin and its clients "ldaptags" and "online" from DS7.1. target name should not be identical to the directory name if you want to always execute the command line. replacing fversion(.c) with dirver(.pl); used on Windows only [146919] De-brand the Directory Server as "brandx" [bugzilla 149539] Use Cyrus SASL instead of our custom one [150809] slapi_ch_smprintf truncates strings when the given args are longer than 100 characters in total. Instead of getting nes-webapps_6_1.dtd from http://developer.netscape.com/products/servers/enterprise/dtds/, get it from the installed tree. On windows, snprintf needs underscore '_' at the beginning. Commented out functions which were removed in the source code clean up. Moved a part of PR_ASSERT after the variable is initialized. NSPR header file and the library are needed to use PL_strcatn. Replaced the variables for ds##[_en].jar and its path with the correct ones: Added LDAP_NOSSL_LINK for Windows build -- needed for admin/src/ds_newinst. [149539] Use Cyrus SASL instead of our custom one fix for breaking the build on HP-UX due to the previous check in. [Bug 146919] Directory Server rebranding [152645] dsmlgw acceptance test started to fail on 3/15/2005 [151835] dbscan grows up to 900MB+ and hangs with -i and -l <large value> options DOC: Internal version also does not package the guides. [152645] revert AXIS version to 1.2beta fixed a bug on the static variable introduced by the previous commit. 1) Updated "Last Updated" date. Revised the usage string. 1) clu dbscan test passes file type option(s) (-e -- entry file, -i -- index file, -c -- changelog file) for any type of files, which could sometimes crashes the command. To prevent it, introduced a simple file type checker and reset the file type if it does not match the real type. [Bug 153175] SSL 6.x -> 7.0 migration script problems [Bug 153306] dbscan of changelog files core dumps on Solairs 64 bit builds. [154068] RPM setup should run with the relative path as well as the absolute path [154288] usage cleanup [154766] Online help mentions "this ( 6.2 ) directory server [154775] Replica Settings page contains 4.0 and 4.1 supplier server. [154909] Fixed old copyright notice and removed the link to DocHome. [155066] Typo in properties editor online help; removed '.' [155140] SASL mapping modify online help not in correct format [155137] SASL mapping online help not in correct format [155133] Attribute Encryption, select encryption method, online help uses wrong font / mis-formatted. [155132] Attribute Encryption, Add, online help uses wrong font / mis-formatted. Don't pull net-snmp on Windows. [155628] Fractional Replication: modify does not issue notify; [155905] mrclone failure: race condition between force_checkpoint and dblayer_close Fix for the replication bug found in running reliability 16. [156623] Solaris/HP-UX setup can only be run from the SERVER ROOT [156759] dsgw/pb charset conversion problem [156758] bak2db loses index configuration when the overriden conf has some changes. [154189] Java Console hung during startup and only shows a grey splash screen [158263] Performance Counter, labels removed. Need to update online help to match Added testpreop_search to verify bug 147585 [147585] test plugin to verify the bug, the previous check in was not returning SUCCESS. [Bug 166632] dbscan: not to truncate the entry even if it is larger than BUFSIZ [Bug 164834] modify/replace allows multiple same valued attributes in an entry [160003] db2index.pl cannot find libldap50.so if only certain parameters are used [167264] Update branding script data to include the revision info [167478] setup script needs to check the DS instance [167679] modify upgradeServer to upgrade db2index.pl Fix for NT build failure: undefined symbols in index.c [167982] Service Pack framework [167982] Service Pack framework fixed internal build failure... [167982] Service Pack framework [172411] Use system SASL on RHEL Fixed the build: removed __attribute__ from the previous checkin. [172411] Use system SASL on RHEL [172411] Use system SASL on RHEL [172824] Link SASL library dynamically [173524] setup scripts retrieves incorrect adminid [173687] deadlock caused by error log rotation and logging [173687] deadlock caused by error log rotation and logging [173931] Error logs not deleted Fixed the solaris build (log.h); fixed an inappropriate comment [175063] entry with escaped characters fails to import and index [175063] entry with escaped characters fails to import and index [175897] filter'd search not returning matches after index added [170348] RSEARCH needs to be updated [174776] Multiple restores from a non-existant directory could wipe out database [164596] LDCLT distributed with Directory Server Added copyrights. [174774] Backup does not clear the backup directory prior to performing backup; Restore tries to restore all the fles from the backupdir Previous checkin cleaned up too much; restoring commit_good_database. [176293] repl_chain_on_update() logs a message for every modify operation [173871] added more precise error message for the dbcache allocation failure. [164596] LDCLT distributed with Directory Server [170348] RSEARCH needs to be updated Fixing nightly build Fixing the internal build (to build dsmlgw w/ ant, ant-launcher.jar is needed) Fixing Solaris build fixing the 64-bit Solaris build [183222] Directory Server hangs when running VLV search and update operations simultaneously. [185364] Can't update scripts (e.g., start-slapd) in the instance [185477] ldif2db allows entries without a parent to be imported [185477] ldif2db allows entries without a parent to be imported [185364] Can't update scripts (e.g., start-slapd) in the instance directory [186642] Directory Server Makefile updates for Internal build setup.inf, setup.res, silent.inf, unzip_wrapper.pl, LICENSE.txt, README.txt were missing from the tar-gz package file. [186642] Directory Server Makefile updates for Internal build (Comment #6) Previous checkin introduced this bug: a whitespace is inserted by putting a comment at the end of the macro assignment for Solaris JDK Version; moved the comment to one line above. Removed extra $(NS64TAG) from sh_release_config; $(NSCONFIG) contains _64. accidentally, overrode the change made on revision 1.42; backing off Moved the SMARTHEAP macro setting from slapd local Makefile to global nsconfig.mk so that the makefile used for packaging gets the info. [186642] Directory Server Makefile updates for Internal build Should keep all the components packaged in the 64-bit build in dist/<platform>_64_DBG.OBJ [189264] 6.11->6.21 upgrade, no db housekeeping threads pick up new adminutil, adminserver, and WinSync for INTERNAL_BUILD build fix for Solaris Studio11 compiler [191832] changing password sometimes crashes the server [Admin Server password always remembers initial password on (part 2)] [192901] DS returns an entry that does not match the filter [195258] Changes for the internal build [195258] Changes for the internal build; Comment#16 [203214] RHDS fails to start on HP-UX 11.23. [204563] Solaris build problem [204566] Adjustment for new LDAP C SDK (ber_get_next_buffer_ext) [206724] Replacing PR_SetNetAddr with PRLDAP_SET_PORT for IPv6 support Upgraded NSPR_RELDATE to v4.6.3-dstest. [206724] Processed: Replacing PR_SetNetAddr with PRLDAP_SET_PORT for IPv6 support [207427] parameterizing the hardcoded paths (Comment #15) [204808] spurious search timeouts [208672] parameterizing the hardcoded paths (phase 2. db, log, lock, pid, cert, and instance dir) Resolves: #204808 Resolves: #210947 Fixed the HP-UX and Solaris build failure introduced by the previous check-in. Resolves: #212098 Resolves: #212098 Resolves: #212098 Resolves: #210947 Fixed this problem on Solaris: Netscape Portable Runtime error -5977: ld.so.1: ns-slapd: fatal: libns-dshttpd72.so: open failed: No such file or directory Backed off the previous change for the non-Solaris platforms. Resolves: #199923 Resolves: #214840 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214728 Resolves: #214533 Resolves: #214533 Resolves: #214533 Resolves: #214533 Added -DIS_FHS; the old build only supports FHS. Auto-generated by autoheader; needs to be in CVS. Resolves: #215452 Resolves: #216512 Resolves: #216983 Resolves: #183222 Resolves: 158342 Resolves: #183222 Resolves: #202843 Resolves: #202843 Resolves: #202843 Resolves: #195305, #195307 Resolves: #195305 Resolves: 223861 Resolves: 223861 Replaced white spaces with a tab to fix "Makefile:125: *** missing separator" Replaced white spaces with a tab to fix "Makefile:150: *** missing separator" Resolves: 223861 Force to commit template-start-slapd.in and template-stop-slapd.in to make them younger than template-start-slapd and template-stop-slapd. Resolves: 229576 Resolves: 230673 Resolves: 230673 Resolves: 229280 Resolves: 231221 Resolves: 229513 Resolves: 232050 Resolves: 232050 The line to create db2bak.pl was missing... Resolves: 232746 Resolves: #233027 Resolves: #233027 Resolves: #233215 Resolves: #233027 Resolves: #232050 Resolves: 233027 Resolves: #233215 Resolves: #233215 Resolves: #233215 Resolves: #237040 Resolves: #237040 Resolves: #237040 Resolves: #237731 Resolves: #237731 Resolves: #237356 Resolves: #237356 Resolves: #237356 Resolves: #237356 Resolves: #237356 Resolves: #237356 Resolves: #237356 Resolves: #237356 Resolves: #239337 Resolves: #237731 Resolves: #243488 Resolves: #237356 Resolves: 237356 Summary: Move DS Admin Code into Admin Server (Comment #62) Resolves: #237356 Resolves: #244749 Resolves: #244749 Resolves: #245407 Resolves: #245407 Resolves: #244749 Resolves: #246690 Resolves: #247215 Resolves: #247215 Resolves: #247725 Resolves: #249722 Resolves: #249739 Resolves: #250347 Resolves: #250702 Resolves: #251090 Resolves: #253069 Resolves: #260341 Resolves: #260341 Resolves: #260341 Resolves: #273501 Resolves: #236256 Resolves: #240897 Resolves: #243820 Resolves: #171081 Resolves: #287961 Resolves: #241089 Fixed a typo I put in in the previous checkin. Resolves #222918 Resolves: #312811 Fixed the brand and version mistakenly put in the previous check-in. Resolves: #314851 Resolves: #196523 Resolves: #316281 Resolves: #304161 Resolves: #173873 Resolves: #193724 Resolves: #327091 Resolves: #188320 Resolves: #193724 Resolves #329951 Resolves: #336871 Resolves: #339031 Resolves: #188320 Resolves: #339791 Resolves: #193724 Resolves: #367671 Resolves: #383141 Resolves: #345671 Resolves: #371751 Resolves: #238649 Resolves: #316281 Resolves: #237040 Resolves: #229576 Resolves: #403351 Resolves: #231093 Resolves: #174776 Resolves: #403751 Resolves: #403751 Resolves: #428163 Resolves: 436397 Resolves: #428764 Resolves: #182621 (#443955) Resolves: #230673 Resolves: #436400 Resolves: #436390 Resolves: #436388 Resolves: #436390 Resolves: #436837 Resolves: #436837 Resolves: #436837 Resolves: #436837 (comment #9) Resolves: #436837 Resolves: #452328 Resolves: #437525 Resoves: #448831 Resolves: #450753 Resoves: #428929 Resolves: #447353 Resolves: #447353 Resolves: #436837 Resolves: #448831 Resolves: #456296 Resolves: #456752 Resolves: #428232 Resolves: #457156 Resolves: #457156 Resolves: #466702 reran autogen.sh (automake V1.9.6, autoconf V2.59) Resolves: 207457 Resolves: 207457 Resolves: #468248 Resolves: #468248 Resolves: #468248 Resolves: 207457 Fixed typos in the HP-UX code: slapi_counter_get => slapi_counter_get_value Fixing the build on Solaris (ldap_agent_bin-main.o) Resolves: #207457 Resolves: #469243 Resolves: #469243 Resolves: #462922 Resolves: #469792 Resolves: #459302 Resolves: #466702 Resolves: #463774 Resolves: #207457 Resolves: #471138 Resolves: #471998 Resolves: #470084 Resolves: #472457 Resolves: #430172 Resolves: #472999 Resolves: #430993 Resolves: #469800 Resolves: #474248 Resolves: #474237 Resolves: #240512 Resolves: #474729 Resolves: 459433 Resolves: #447353 Resolves: #475338 Resolves: #475899 Resolves: #430568 Resolves: #475899 Resolves: #178248 Resolves: #438139 Resolves: #436830 Resolves: #464854 Resolves: #460613 Resolves: #469800 Resolves: #208076 Resolves: #483167 Resolves: #483366 Resolves: #483668 Resolves: #484149 Resolves: #484311 Resoves: #484157 Resolves: #485321 Resolves: #464651 Resolves: #476261 Resolves: #488856 Resolves: #476096 Resolves: #489763 Resolves: #489625 Resolves: #490027 Resolves: #476096 Resolves: #491215 Resolves: #489360 Resolves: #492562 Resolves: #475338 Resolves: #475338 Add Simple Paged Results Use thread aware library for complex regex searches Initialize smods in ldmb_back_modify Compiler warnings and paged results on DSE 504383 PCRE breaks SASL Mapping 507460 Access log could mistakenly report notes=U for VLV searches 506137 ns-slapd hang while group aci performance testing 509269 Simple paged result crashes/hangs the server 509269 Simple paged result crashes/hangs the server 510147 clean up the replication log msg 513019 nsslapd-lookthroughlimit is not respected Entry USN 513170 NULL search result does not return sort control 513172 Simple Paged Results does not respect nsslapd-sizelimit Revert "513019 nsslapd-lookthroughlimit is not respected" Apply SYNTAX_DN to Name And Optional UID 514770 remove per-entry response control for GER and Paged Results GroupOfUniqueNames in template.ldif must have uniqueMember 513916 Server doesn't ignore paged control, if page size and server's estimate of total no of entries are same 509472 db2index all does not reindex all the db backends correctly 506786 Index maintenance mechanism causes wrong search results when 506786 Index maintenance mechanism causes wrong search results when 509472 db2index all does not reindex all the db backends correctly Plugin Default Config Entry 516089 RFE: ldclt utility should support new dereferencing control searches Add EntryUSN to the nsslapd-exclude-from-export list 518112 rhds 81 el53 64b ns-slapd seg fault 525007 ldif2db replaces existing modify/create name and timestamps ldclt: -e randombinddnfromfile fails with LDAP_UNWILLING_TO_PERFORM (53) 544089 - Referential Integrity Plugin does not take into account the attribute 247413 - Incorrect error on multiple identical value add 560827 - Admin Server templates: DistinguishName validation fails 548535 - memory leak in attrcrypt Fixing config_dir in DSUpdate.pm.in Fixing a memory leak in repl5_protocol.c Fixing a memory leak in dblayer.c Fixing a memory leak in idl_new.c Fixing a memory leak in dblayer.c Fixing a memory leak in ldbm_attr.c Initializing be_usn_counter in Slapi_Backend Fixing a typo in entrywsi.c Adding instancedir getter and setter to libglobs.c Fixing a wrong comment in log.c Adding DN syntax check API slapi_dn_syntax_check Fixing error logs in modrdn.c Check DN syntax in backend add, delete, modify and modrdn Fixing a memory leak in sasl_map.c 563365 - Error handling problems in the backend functions 565987 - redhat-ds-base fails to build due to undefined struct 527848 - make sure db upgrade to 4.7 and later works correctly 539618 - Replication bulk import reports Invalid read/write 548115 - memory leak in schema reload 555970 - missing read lock in the combination of cos and nsview 539618 - Replication bulk import reports Invalid read/write 570667 - MMR: simultaneous total updates on the masters cause 199923 - subtree search fails to find items under a db 572649 - DS8.2 crashes on RHEL 4 (corresponding to bob, ber_2 test case) 573060 - DN normalizer: ESC HEX HEX is not normalized ( 573896 - initializing subtree with invalid syntax crashes ns-slapd 515805 - Stop "initialize Database" crashes the server 548533 - memory leak in Repl_5_Inc_Protocol_new Fixing a syntax error Update to New DN Format 585905 - ACL with targattrfilters error crashes the server 574167 - An escaped space at the end of the RDN value is not 591336 - Implementing upgrade DN format tool 590931 - rhds81 import - hardcoded pages_limit for nsslapd-import-cache-autosize A bug fix made in commit 142d7ada626173de4937330be6776fabbebe9f60 Another bug fix made in commit 142d7ada626173de4937330be6776fabbebe9f60 Yet another bug fix made in commit 142d7ada626173de4937330be6776fabbebe9f60 A bug fix made in commit a5a9949fd16c6d268f0f2676f8bdbb926dc43539 Additional fix for 591336 - Implementing upgrade DN format tool 592497 - rhds82 - nsslapd-syntaxcheck seem to be on by default, need off 593453 - Creating password policy with ns-newpolicy.pl on Replicated 593110 - backup-restore does not ALWAYS work 593899 - adding specific ACI causes very large mem allocate request 588867 - entryusn plugin fails on solaris 593899 - adding specific ACI causes very large mem allocate request 595893 - Base DN in SASL mapping is not normalized 511112 - Password history limited to 25 values 597375 - Deleting LDBM database causes backup/restore problem 605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl 606920 - anonymous resource limit - nstimelimit - Pete Rowley (8): 172683: Search filter does not work on physical entries within views 173375: Problems with schema matching rules 177444: duplicate password policy oids in root DSE minor edits to remove references to cos in the example Distributed numeric assignment plugin - initial check in Add LDAPI corrected copyright statement fix defined out code to really be defined out Rich Megginson (492): Bug(s) fixed: 145179 remove references to ldapserver from makefiles; use BUILD_ROOT instead of MCOM_ROOT and NSROOT; BUILD_ROOT is now the ldapserver directory rather than its parent Whoops. Checked in some private stuff I had to work around vsftpd problems. Do not do the DIST step - we are not distributing this software built here RPM packaging - parameterize the pkg root directory using INSTDIR RPM packaging - does the old setup pre and post installation tasks RPM packaging - the ldapserver.spec file and the builddsrpm.sh script to do the prep work Derive ABS_INSTDIR directly from INSTDIR RPM packaging - set the flag to build java files - use serverroot/setup/setup insetad of serverroot/setup Bug: 147157 Bug(s) fixed: 147162 checkin first version of pam plugin PAM pass through auth plugin support added added Bug(s) fixed: 147585 Rename add_pwd_control to slapi_add_pwd_control Fixed problem with declaration after executable code. Do not build pam auth plugin on Windows If USING_VSFTPD is defined, some hacks around pulling components via ftp are used. fix Windows build issues get rid of adminutil dependency on core DS readding because otherwise Windows is horked removed strlist clean up sprintf usage and many other flawfinder issues; clean up compiler warnings on Linux; remove pam_passthru from DS 7.1 fix Windows build issues fix Windows build - use local functions instead of NSPR - fix compiler warnings fix Windows installer breakage - wrong argument to va_start - use fmt instead of s upgrade to SVRCORE 4.0 - the open source version This one is mostly strcpy/strcat checking, checking for null strings before strlen, removing some dead code, other odds and ends. use prefix instead of hardcoded ldapserver add link debugging for debug builds on linux add support for instance creation using open source core DS components use mtmalloc instead of SmartHeap on Solaris When creating a script, if the destination directory does not exist, just print a notice and skip that script. This is to allow the open source instance creator to skip creating the repl monitor script in admin/admin which does not yet exist. Fix snprintf into sizeof(char *) instead of actual buffer size This files contents have been merged into internal_buildpaths.mk, components.mk, and internal_comp_deps.mk was using wrong section add ability to build from open source components remove ns_usedb.mk put sh_ in front of smartheap component name Bug(s) fixed: 145179 Use v5.15 of ldapsdk Bug(s) fixed: 152030 1) remove fortezza stuff fixed spacing Bug(s) fixed: 151567 Bug(s) fixed: 151721 I got rid of ldapserver.spec. Instead, the spec file will be created on the fly. The only parameter passed in is the flavor - redhat or fedora. Everything else comes from the brandver.dat file. PLATFORM is derived from BUILD_ARCH in the usual Makefile way. So we could easily support Solaris or whatever else. The Makefile change is to allow you to produce the .spec file without having to build everything else. The change to reltools/brandver.pl allows us to change only the named files rather than every file in the .dat file. --macros seems not to work - using --define to define our macro on the command line Bug(s) fixed: 147886 fix brandDirectory breakage - skip redhat-ds.spec when branding Use setup -q to suppress tar output Bug(s) fixed: 153686 Make RPM binary name .opt.rpm or .dbg.rpm depending on build flavor make rpm name .flavor.rpm - flavor must be defined in rpmbuild Bug(s) fixed: 145179 setup/setup was being installed as setup/setup/setup Bug(s) fixed: 154064 Reviewed by Nathan (Thanks!) Check for last version removal in preun - only run uninstall if removing the last version Bug(s) fixed: 154235 Added more support for building from source, specifically support for Bug(s) fixed: 154431 Bug(s) fixed: 153955 Bug(s) fixed: 155087 Fix Solaris open source build breakage - reviewed by Noriko Change release to 2 Upgrade to ldapconsole 20050510 and ldap c sdk 5.16 Bug(s) fixed: 157377 Bump up ldapconsole version to 20050513 Bug(s) fixed: 157341 Change version of ad sync and nt4 sync to 0516 Correctly report in the repl agreement status attrs that the repl init failed when it failed due to attempting to do fractional replication to another master. Only check the read only status of the consumer for the fractional case if the acquire process has been successful thus far. remove full and optimize from the file names of the winsync components Bug: 158250 Bug(s) fixed: 158235 Bug(s) fixed: 158330 Bug(s) fixed: 158368 bug 158368 - remove nt group type as well Bug(s) fixed: 158549 Bug 160008 PAM is not thread safe. Therefore, we must put the code that accesses PAM Bug(s) fixed: 165600 Bug(s) fixed: 165640 Bug(s) fixed: 165827 Bug(s) fixed: 151678 Bug(s) fixed: 166229 Bug(s) fixed: 165641 Bug(s) fixed: 167453 upgrade winsync to 20050912 for bug 159037 and upgrade directory console to 20050913 for bug 167761 Bug(s) fixed: 169663 also checkin fix for 170350 onto trunk Bug(s) fixed: 171066 Bug(s) fixed: 171854 Bug(s) fixed: 171892 Bug(s) fixed: 172005 Bug(s) fixed: 172056 Bug(s) fixed: 166229, 166081 Bug(s) fixed: 172672 Bug(s) fixed: 172818 Reviewed by Nathan (Thanks!) set defaults to build java code, and use java, ant, and perl from PATH for external builds added a dependency on httpd add jar files back to the main package - even though the gpl and apl are not generally compatible, they are compatible for this specific case remove Requires for java - breaks non-RHEL platforms - we should either change the spec file to include the dependency only on RHEL, or just wait until gcj/classpath can run our stuff Fix the problem with the Admin Server console - error opening the encryption tab. The solution is to chown the alias directory to the admin server uid so that the security CGI can create the key/cert dbs in that directory. Fix two problems The DS console Configuration Encryption tab was giving an error. The error was due to the security CGI not being able to read the ds key/cert db files. They were owned by root instead of the server uid because they were being created by NSS_Initialize which was being called before the server did the setuid. Move ssl init on the secure socket into main with the rest of the nss/ssl init Move NSS/SSL initialization after the setuid so that key/cert/other nss 1) Move the import, export, etc. (non network server mode) code to after the NSS/SSL init. For example, import needs to hash passwords, export of encrypted attrs needs encryption. Cannot pass const strings into slapi_str2filter, since it can modify Bug(s) fixed: 175053 Bug(s) fixed: 175098 Bump version from 1.0 to 1.0.1 add the console-ld-libpath.patch for bug 174981 need to patch the console in both upgrade installation and regular installation the install is an upgrade if the %post argument is greater than 1, not greater than or equal to 1 Bug(s) fixed: 176302 Bug(s) fixed: 180515 Bug(s) fixed: 178479 Use NSS 3.11 and NSPR 4.6.1 - NSS 3.11 requires the new freebl lib at runtime, Wan-Teh pointed out that the platform specific freebl libs are needed _instead of_ libfreebl3, not _in addition to_. So, set the list of platform specific freebl libs and add them to the list of libs to package. Bug(s) fixed: 181587 The correct naming convention for RHEL is Bug(s) fixed: 181776 1) Fix moz objdir name for generic linux x86_64 Reviewed by Nathan (Thanks!) Don't attempt to package 32 bit NSS apps/libs with the 64 bit package on rhel/linux - assume everything is native 64 bit. Change version to 1.0.2 Still need the console ld libpath patch for startconsole Bug(s) fixed: 182613 Bug(s) fixed: 179135 Bug(s) fixed: 179137 Bug: 179810 Have to add back softokn3 to the link libs - dependent libs are linked directly against it and expect it to be present at link time. Some DSGW programs must not be linked with SSL, including the LDAP ssl library. On RHEL3, this causes a linker error, but appears to be fine on other platforms. So, just use the LDAP_NOSSL_LINK macro for those programs, and use the LDAPLINK macro for the other programs. added patch file for upgrading from 1.0.1 - fixes the use of admpw for basic auth Added admserv-conf-admpw.patch to fix the use of admpw for basic auth in the actual config file Bug(s) fixed: 179723 Make the build/pull work like the adminserver does with respect to console. Otherwise, dsbuild with recent code no longer works. Bug(s) fixed: 186280 Bug(s) fixed: 186280 use slapi_entry_attr_get_bool instead of slapi_entry_attr_get_int for the fallback and secure config attrs Bug(s) fixed: 205456 Bug: 205456 Bug: 205456 Bug: 205456 remove extraneous endif Create core DS tarball for acceptance test Bug: 205456 Bug(s) fixed: 206450 Bug: 206527 minor change to test commit email notification use new 20060915 version of perldap Bug: 206527 Bug(s) fixed: 206662 fix build breakage - use PERLDAP_BUILT_DIR as the location to download perl since the full DEP has two directory levels in it update internal builds to use latest components Bug(s) fixed: 202889: Bug(s) fixed: 199321 Bug(s) fixed: 210075 Bug(s) fixed: 210120 Bug(s) fixed: 210220 Bug(s) fixed: 185364 Bug(s) fixed: 183903 Bug(s) fixed: 185780 For FDS 103 - When I changed the makefiles around for the earlier fix to enable rpmbuild, Bug(s) fixed: 204623 Change the way ldapserver links with SASL. Rather than specifying a hard coded link path enable pam_passthru for fedora ds builds Bug(s) fixed: 211426 Bug(s) fixed: 213352 Bug(s) fixed: 213786 upgrade version to 1.0.4 Bug(s) fixed: 214243 1) Fedora Core 6 build fixes Bug: 214733 Bug: 214733 Resolves: bug 215669 Resolves: bug 214851 Resolves: bug 215995 Bug(s) fixed: 216758 Bug: 210947 Resolves: bug 217403 I noticed a problem with the autoconf style builds that shows up on 64 bit - some of the scripts had /usr/lib/mozldap6 in the PATH, and some had /usr/lib64/mozldap6. All of them should have lib64. What was happening is that make would create some script templates from the corresponding template .in file, and some it would just copy over (those that have both a template-script and a template-script.in). The template-script files have hardcoded /usr/lib/ - it requires the conversion from template-script.in to template-script to substitute /usr/lib64/ instead. Resolves: bug 218076 Resolves: bug 222398 Resolves: bug 224291 Resolves: bug 224606 Resolves: bug 224672 Resolves: bug 147886 Resolves: bug 224606 fix build problems on Solaris; minor m4 cleanup fix licensing in sasl.m4 Resolves: bug 227452 esolves: bug 227618 Resolves: bug 227771 Resolves: bug 160235 Resolves: bug 227771 make sure .in files are newer than corresponding template script file Remove some bash-isms that were causing problems on RHEL-4 Resolves: bug 228334 change version to 1.1.0a1 Resolves: bug 229286 Resolves: bug 229691 Need to terminate dna plugin config entry with a newline Resolves: bug 229825 Resolves: bug 229077 Resolves: bug 230498 Resolves: bug 230808 Resolves: bug 231507 Resolves: bug 232377 Resolves: bug 232684 Resolves: bug 231905 Resolves: bug 232684 Bump version to 1.1.0 alpha 3 (1.1.0a3) Resolves: bug 233410 Resolves: bug 235743 Resolves: bug 239764 Resolves: bug 238563 Resolves: bug 239765 Resolves: bug 243205 Resolves: bug 237356 Resolves: bug 237356 Resolves: bug 243639 Resolves: bug 237356 Resolves: bug 237356 Resolves: bug 237356 Resolves: bug 237356 Resolves: bug 237356 Resolves: bug 237356 remove obsolete files Resolves: bug 245815 Added nsslapd-ldifdir and nsslapd-bakdir Resolves: bug 246683 Resolves: bug 245815 Resolves: bug 248145 Resolves: bug 248145 Resolves: bug 248272 Resolves: bug 248145 Resolves: bug 248820 move setup-ds.pl and migrate-ds.pl to sbindir removed more obsolete files forgot to tell Makefile.am about removed obsolete files Resolves: bug 249470 Resolves: bug 249633 Resolves: bug 250535 Resolves: bug 237356 Resolves: bug 251227 The arguments to memset were in the wrong order. This code is only used on Windows. forgot to commit the autotool generated files revert back to using autoconf 2.59 - 2.61 causes the -avoid-version flag to be ignored, which causes rpm packaging errors Resolves: bug 251227 Resolves: bug 251227 using ldap also pulls in nss and nspr, so we have to add those - also, put those first in the link line, so that the build finds the dirsec versions of those components and not the mozilla/seamonkey ones in libdir Resolves: bug 251549 Resolves: bug 252190 Resolves: bug 252190 Resolves: bug 253047 Resolves: bug 252263 Resolves: bug 260341 Resolves: bug 262021 Resolves: bug 276741 Resolves: bug 281631 Resolves: bug 244475 Resolves: bug 282741 Resolves: bug 283041 try to fix build breakage on RHEL5 Resolves: bug 288451 Resolves: bug 288451 Resolves: bug 288451 Resolves: bug 249366 Resolves: bug 262021 Resolves: bug 301431 Resolves: bug 262021 Resolves: bug 301811 Resolves: bug 249366 Resolves: bug 282911 Resolves: bug 249366 Resolves: bug 249366 Resolves: bug 248169 Resolves: bug 190220 Resolves: bug 305121 Resolves: bug 244475 migration starts instances now Resolves: bug 317651 Resolves: bug 165761 remove obsolete schema Resolves: bug 288291 Resolves: bug 330121 Resolves: bug 330141 Resolves: bug 185602 Resolves: bug 333291 Resolves: bug 250179 Resolves: bug 250179 Have to free instdir not instname Resolves: bug 232910 Resolves: bug 297221 Resolves: bug 338991 Resolves: bug 339041 Resolves: bug 336881 Resolves: bug 297221 Resolves: bug 340211 Resolves: bug 232910 Resolves: bug 340361 Resolves: bug 232910 Resolves: bug 345711 Resolves: bug 345711 Resolves: Bug 345711 Resolves: bug 353071 bump source code version to 1.1.0 beta 2 Resolves: bug 339041 Resolves: bug 367721 Resolves: bug 345711 Resolves: bug 197997 Resolves: bug 388021 Resolves: bug 371771 Resolves: bug 400421 Reviewed by: nhosoi (Thanks!) Resolves: bug 416721 Resolves: bug 424381 Resolves: bug 424381 Resolves: bug 425861 Resolves: bug 425849 bump version to 1.1.0 for Fedora DS 1.1 release Resolves bug 434403 merge in autotool file fixes for gcc43 with the memberof autotool file additions Resolves: bug 439829 bump version to 1.1.1 - add define for new public slapi task interface have to use *be instead of be in call to be_isdeleted Resolves: bug 442170 Resolves: bug 450973 Resolves: bug 233642 Resolves: bug 431103 Resolves: bug 452323 Resolves: bug 435774 Resolves: bug 440899 Reviewed by: nkinder (Thanks!) Resolves: bug 428765 Resolves: bug 447614 Resolves: bug 447353 Resolves: bug 457846 Resolves: bug 447353 Resolves: bug 457846 Resolves: bug 458171 Resolves: bug 457156 Resolves: bug 458506 Resolves: bug 458507 Resolves: bug 458510 Resolves: bug 458668 Resolves: bug 458675 Resolves: bug 458677 Resolves: bug 458666 a couple of enhancements that make it easier to run the server under various debugging tools Resolves: bug 457846 Resolves: bug 460381 Resolves: bug 459850 Resolves: bug 457846 bump version to 1.1.3 Resolves: bug 457846 Bug Description: Need to address 64-bit compiler warnings - part 1 Resolves: bug 454030 Resolves: bug 454030, bug 463991 fix inttypes build breakage on HP-UX Resolves: bug 455026 bug 441026 Resolves: bug 454030 fix typo Resolves: bug 469261 Resolves: bug 469243 Resolves: bug 469261 Resolves: bug 469261 Resolves: bug 469261 Resolves: bug 469261 Resolves: bug 469261 Resolves: bug 454030 Resolves: bug 476127 Resolves: bug 476891 Resolves: bug 476891 Resolves: bug 479077 Resolves: bug 478656 Resolves: bug 471068 Resolves: bug 204966 Resolves: bug 479202 Resolves: bug 479313 Resolves: bug 222055 Resolves: bug 202134 Resolves: bug 179956 Resolves: bug 481223 Resolves: bug 479253 Resolves: bug 482909 Resolves: bug 480642 Resolves: bug 483256 Resolves: bug 483254 Resolves: bug 431607 Resolves: bug 481052 Resolves: bug 477009 Resolves: bug 485694 Resolves: bug 486191 Resolves: bug 486191 Resolves: bug 468474 Resolves: bug 486474 Resolves: bug 486495 Resolves: bug 480869 Resolves: bug 450575 Resolves: bug 487425 Resolves: bug 488866 Resolves: bug 488814 Resolves: bug 488866 Resolves: bug 488866 Resolves: bug 480869 Resolves: bug 489360 Resolves: bug 479254 bump version to 1.2.0 add back support for linux ppc re-enable ppc support Rename to 389 bump version to 1.2.1 - added .gitignore fix rpmlint issues - config files and perl modules should not be executable Fix various compiler warnings Resolves: bug 501490 - Error creating view on FDS 1.2 Added full text of GPLv2 license Implement SASL I/O as an NSPR I/O layer initial commit of io function improvements OpenLDAP support Clean up compiler warnings Reduce noise reported by valgrind Fix attrcrypt usage of nsSymmetricKey Fix unsalted password comparisons Dereference support Change default branding to 389 - remove lite code fix pcre build issues Fix usage of pre-hashed salted passwords bump version to 1.2.2 Retry SASL writes if buffer not fully sent https://bugzilla.redhat.com/show_bug.cgi?id=487425 Fails to start if attrcrypt can't unwrap keys Clean up build warnings Add update code - make setup-ds.pl -u do updates 389-ds-base/glibmm24: conflicting perl provides Start script hardcodes file permissions mask to 077 (600), so the nsslapd-*log-mode configuration attributes don't work logs created at startup can get wrong file mode Should not attempt to pop SASL IO layer if not using SASL IO empty principal name used when using server to server sasl for db chaining MODIFY/replace with empty values does not ignore missing or unknown attributes Bitwise Plugin: Bitwise filter doesn't return except the first entry if its multi-valued SASL IO sometimes loops with "error: would block" Updated man page with the new update options and documentation. more updates - add missing rundir - remove ldapiautodnsuffix bump version to 1.2.4 Implement support for versioning and release engineering procedures - version 1.2.5.a1 Add Named Pipe Log Script, plugins, man page bump version to 1.2.5.rc1 bump version to 1.2.5.rc2 bump version to 1.2.5.rc3 Password replication from 389DS to AD fails version 1.2.5.rc4 Workaround bogus base64 encoded passwords that end in newline bump version to 1.2.6.a1 rhds81 hub with 71 master - err=32 on replica base search during replication Bug 519459 - Semi-hardcoded include and lib directories in db.m4 several spelling errors Net::LDAP password modify extop breaks; msgid in response is 0xFF Bug 543080 - Bitwise plugin fails to return the exact matched entries for Bitwise search filter Bug 537466 - nsslapd-distribution-plugin should not require plugin name to begin with "lib" fix memory leak in attr replace when replacement fails Bug 568196 - Install DS8.2 on Solaris fails Bug 568196 - Install DS8.2 on Solaris fails - part 2 389 DS segfaults on libsyntax-plugin.so - part 1 389 DS segfaults on libsyntax-plugin.so - part 2 fix various memory leaks Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external Bug 570905 - postalAddress syntax should allow empty lines (should allow $$) Bug 572677 - Memory leak in searches including GER control Bug 571677 - Busy replica on consumers when directly deleting a replication conflict Bug 576074 - search filters with parentheses fail Bug 567429 - slapd didn't close connection and get into CLOSE_WAIT state Bug 578167 - repl. of mod/replace deletes multi-valued attrs Bug 561575 - setup-ds-admin fails to supply nsds5ReplicaName when configuring via ConfigFile Bug 577384 - Remove-ds.pl script throws "sh: STARTPIDFILE.*=: not found" error on Solaris 9 Bug 578229 - Blocked sync afer UID or ntUserDomainId change Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements. Bug 576644 - segfault while multimaster replication (paired node won't find deleted entries) Bug 583167 - remove-ds.pl gives error Couldn't open /etc/sysconfig/dirsrv-$INSTANCE Fix too few args for format warning in acllas Bug 591685 - Server instances Fail to Start on Solaris due to Library Path and pcre Bug 593392 - setup-ds-admin.pl -k creates world readable file Bug 595874 - 99user.ldif getting overpopulated Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll Rob Crittenden (7): 149510 149510 149510 149510 156273 156273 Changes so DS can be built with gcc on Solaris. Thomas Lackey (13): Replace missing makefile referenced by SunOS5.8.mk and SunOS5.9.mk. This file is needed to build on Solaris. Add new sync wizard help pages. Alter text of repl4 (summary) wizard page. Pickup new doc files. Allow the migration scripts to recognize the Red Hat-branded server. Add makefile and component information to build the Apache DS for User Sync Build PassSync on Windows. Fix NTDS maven location. Add WiX component information. Add Wix dependency. Add installer icons. Modify NTDS and PassSync to build in the 'built' directory. Use WinSync components from sbc. Fix bug 155276, crash if config has changed since restore. Yi Zhang (2): 459181 - Add attreplacefile option to ldclt 516089 - add dereference search option into ldclt cvsadm (1): Moving NSCP Directory Server from DirectoryBranch to TRUNK, initial drop. (foxworth) svrbld (4): SNMP subagent fixes for HP-UX compiler errors New RPM packaging options Use Linux rpm build for longduration test. Fixed object build path: convert relative path to absolute path (tlackey) unknown (1): This commit was manufactured by cvs2git to create branch

1 0

2 commits - ldap/servers
by Richard Allen Megginson 23 Jun '10

23 Jun '10

ldap/servers/slapd/connection.c | 42 +++++++++++++++++++- ldap/servers/slapd/fe.h | 5 +- ldap/servers/slapd/proto-slap.h | 1 ldap/servers/slapd/sasl_io.c | 63 +++++++++++++++++++++--------- ldap/servers/slapd/saslbind.c | 82 ++++++++++++++++++++++++---------------- ldap/servers/slapd/slap.h | 7 +++ 6 files changed, 145 insertions(+), 55 deletions(-) New commits: commit f70152942727368aa0ce378bdfd54c6bad32e69d Author: Rich Megginson <rmeggins(a)redhat.com> Date: Wed Jun 23 10:36:52 2010 -0600 Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll https://bugzilla.redhat.com/show_bug.cgi?id=604453 Resolves: bug 604453 Bug Description: SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll Reviewed by: nhosoi (Thanks!) Branch: master Fix Description: When the server pushes the SASL IO layer on to the connection it must do so when there are no other references to the connection. The only way to do this without introducing more locking is to have the saslbind code just register the intent to push SASL IO at the next available time. This cannot be done in the sasl bind code (or any operation code for that matter) because connection_threadmain() will enable the connection for reading (and polling) after reading the PDU and before calling the operation function. Therefore, during the operation function, the connection may be being actively polled, so we must not access the conn c_prfd. The best place to push the IO layer is in connection_threadmain, after the server has notified that there is read ready on the connection, but before we have actually attempted to read anything. At this point, connection_threadmain is the only thread that will be accessing the connection, and if we push or pop the IO layer before calling the read function, we are guaranteed to have the correct IO layer to use. The code has been made generic enough to allow for use by the startTLS code if the need arises. I also added some more locking in the saslbind code, and changed the sasl IO code to more closely resemble the way that the NSS code deals with IO layer push/pop. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no (cherry picked from commit c28fcadfc7812108573e40f13624e11a5a8609e5) diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index 85aef8e..cf88a59 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -2181,6 +2181,14 @@ connection_threadmain() g_decr_active_threadcnt(); return; case CONN_FOUND_WORK_TO_DO: + /* note - don't need to lock here - connection should only + be used by this thread - since c_gettingber is set to 1 + in connection_activity when the conn is added to the + work queue, setup_pr_read_pds won't add the connection prfd + to the poll list */ + if (connection_call_io_layer_callbacks(pb->pb_conn)) { + LDAPDebug0Args( LDAP_DEBUG_ANY, "Error: could not add/remove IO layers from connection\n" ); + } default: break; } @@ -2194,6 +2202,9 @@ connection_threadmain() PR_Lock(conn->c_mutex); /* Make our own pb in turbo mode */ connection_make_new_pb(&pb,conn); + if (connection_call_io_layer_callbacks(conn)) { + LDAPDebug0Args( LDAP_DEBUG_ANY, "Error: could not add/remove IO layers from connection\n" ); + } PR_Unlock(conn->c_mutex); if (! config_check_referral_mode()) { slapi_counter_increment(ops_initiated); @@ -2775,3 +2786,31 @@ connection_abandon_operations( Connection *c ) } } } + +/* must be called within c->c_mutex */ +void +connection_set_io_layer_cb( Connection *c, Conn_IO_Layer_cb push_cb, Conn_IO_Layer_cb pop_cb, void *cb_data ) +{ + c->c_push_io_layer_cb = push_cb; + c->c_pop_io_layer_cb = pop_cb; + c->c_io_layer_cb_data = cb_data; +} + +/* must be called within c->c_mutex */ +int +connection_call_io_layer_callbacks( Connection *c ) +{ + int rv = 0; + if (c->c_pop_io_layer_cb) { + rv = (c->c_pop_io_layer_cb)(c, c->c_io_layer_cb_data); + c->c_pop_io_layer_cb = NULL; + } + if (!rv && c->c_push_io_layer_cb) { + rv = (c->c_push_io_layer_cb)(c, c->c_io_layer_cb_data); + c->c_push_io_layer_cb = NULL; + } + c->c_io_layer_cb_data = NULL; + + return rv; +} + diff --git a/ldap/servers/slapd/fe.h b/ldap/servers/slapd/fe.h index 3eb1d0a..3a985cb 100644 --- a/ldap/servers/slapd/fe.h +++ b/ldap/servers/slapd/fe.h @@ -116,6 +116,8 @@ int connection_operations_pending( Connection *conn, Operation *op2ignore, void connection_done(Connection *conn); void connection_cleanup(Connection *conn); void connection_reset(Connection* conn, int ns, PRNetAddr * from, int fromLen, int is_SSL); +void connection_set_io_layer_cb( Connection *c, Conn_IO_Layer_cb push_cb, Conn_IO_Layer_cb pop_cb, void *cb_data ); +int connection_call_io_layer_callbacks( Connection *c ); /* * conntable.c @@ -182,7 +184,8 @@ void configure_ns_socket( int * ns ); /* * sasl_io.c */ -int sasl_io_enable(Connection *c); +int sasl_io_enable(Connection *c, void *data); +int sasl_io_cleanup(Connection *c, void *data); /* * sasl_map.c diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 68d5d48..f0d27ca 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -949,7 +949,6 @@ int slapd_ssl_init(); int slapd_ssl_init2(PRFileDesc **fd, int startTLS); int slapd_security_library_is_initialized(); int slapd_ssl_listener_is_initialized(); -int sasl_io_cleanup(Connection *c); int slapd_SSL_client_auth (LDAP* ld); /* diff --git a/ldap/servers/slapd/sasl_io.c b/ldap/servers/slapd/sasl_io.c index f0e403d..b831a86 100644 --- a/ldap/servers/slapd/sasl_io.c +++ b/ldap/servers/slapd/sasl_io.c @@ -481,20 +481,33 @@ sasl_io_write(PRFileDesc *fd, const void *buf, PRInt32 amount) } static PRStatus PR_CALLBACK -sasl_pop_IO_layer(PRFileDesc* stack) +sasl_pop_IO_layer(PRFileDesc* stack, int doclose) { PRFileDesc* layer = NULL; sasl_io_private *sp = NULL; + PRStatus rv = 0; + PRDescIdentity id = PR_TOP_IO_LAYER; /* see if stack has the sasl io layer */ - if (!sasl_LayerID || !stack || !PR_GetIdentitiesLayer(stack, sasl_LayerID)) { + if (!sasl_LayerID || !stack) { LDAPDebug0Args( LDAP_DEBUG_CONNS, "sasl_pop_IO_layer: no SASL IO layer\n" ); return PR_SUCCESS; } + /* if we're not being called during PR_Close, then we just want to + pop the sasl io layer if it is on the stack */ + if (!doclose) { + id = sasl_LayerID; + if (!PR_GetIdentitiesLayer(stack, id)) { + LDAPDebug0Args( LDAP_DEBUG_CONNS, + "sasl_pop_IO_layer: no SASL IO layer\n" ); + return PR_SUCCESS; + } + } + /* remove the layer from the stack */ - layer = PR_PopIOLayer(stack, sasl_LayerID); + layer = PR_PopIOLayer(stack, id); if (!layer) { LDAPDebug0Args( LDAP_DEBUG_CONNS, "sasl_pop_IO_layer: error - could not pop SASL IO layer\n" ); @@ -517,23 +530,29 @@ sasl_pop_IO_layer(PRFileDesc* stack) layer->dtor(layer); } - return PR_SUCCESS; + if (doclose) { + rv = stack->methods->close(stack); + } else { + rv = PR_SUCCESS; + } + + return rv; } static PRStatus PR_CALLBACK closeLayer(PRFileDesc* stack) { + PRStatus rv = 0; LDAPDebug0Args( LDAP_DEBUG_CONNS, "closeLayer: closing SASL IO layer\n" ); - if (PR_FAILURE == sasl_pop_IO_layer(stack)) { + rv = sasl_pop_IO_layer(stack, 1 /* do close */); + if (PR_SUCCESS != rv) { LDAPDebug0Args( LDAP_DEBUG_CONNS, - "closeLayer: error closing SASL IO layer\n" ); - return PR_FAILURE; + "closeLayer: error closing SASL IO layer\n" ); + return rv; } - LDAPDebug0Args( LDAP_DEBUG_CONNS, - "closeLayer: calling PR_Close to close other layers\n" ); - return PR_Close(stack); + return rv; } static PRStatus PR_CALLBACK @@ -561,22 +580,28 @@ initialize(void) /* * Push the SASL I/O layer on top of the current NSPR I/O layer of the prfd used * by the connection. + * must be called with the connection lock (c_mutex) held or in a condition in which + * no other threads are accessing conn->c_prfd */ int -sasl_io_enable(Connection *c) +sasl_io_enable(Connection *c, void *data /* UNUSED */) { PRStatus rv = PR_CallOnce(&sasl_callOnce, initialize); if (PR_SUCCESS == rv) { - PRFileDesc* layer = PR_CreateIOLayerStub(sasl_LayerID, &sasl_IoMethods); - sasl_io_private *sp = (sasl_io_private*) slapi_ch_calloc(1, sizeof(sasl_io_private)); + PRFileDesc* layer = NULL; + sasl_io_private *sp = NULL; + if ( c->c_flags & CONN_FLAG_CLOSING ) { + slapi_log_error( SLAPI_LOG_FATAL, "sasl_io_enable", + "Cannot enable SASL security on connection in CLOSING state\n"); + return PR_FAILURE; + } + layer = PR_CreateIOLayerStub(sasl_LayerID, &sasl_IoMethods); + sp = (sasl_io_private*) slapi_ch_calloc(1, sizeof(sasl_io_private)); sasl_io_init_buffers(sp); layer->secret = sp; - - PR_Lock( c->c_mutex ); sp->conn = c; rv = PR_PushIOLayer(c->c_prfd, PR_TOP_IO_LAYER, layer); - PR_Unlock( c->c_mutex ); if (rv) { LDAPDebug( LDAP_DEBUG_ANY, "sasl_io_enable: error enabling sasl io on connection %" NSPRIu64 " %d:%s\n", c->c_connid, rv, slapd_pr_strerror(rv) ); @@ -592,17 +617,17 @@ sasl_io_enable(Connection *c) /* * Remove the SASL I/O layer from the top of the current NSPR I/O layer of the prfd used * by the connection. Must either be called within the connection lock, or be - * called while the connection is not being referenced by another thread. + * called while the connection (c_prfd) is not being referenced by another thread. */ int -sasl_io_cleanup(Connection *c) +sasl_io_cleanup(Connection *c, void *data /* UNUSED */) { int ret = 0; LDAPDebug( LDAP_DEBUG_CONNS, "sasl_io_cleanup for connection %" NSPRIu64 "\n", c->c_connid, 0, 0 ); - ret = sasl_pop_IO_layer(c->c_prfd); + ret = sasl_pop_IO_layer(c->c_prfd, 0 /* do not close */); c->c_sasl_ssf = 0; diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c index 1ed9942..5870365 100644 --- a/ldap/servers/slapd/saslbind.c +++ b/ldap/servers/slapd/saslbind.c @@ -800,10 +800,12 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) PR_ASSERT(pb); PR_ASSERT(pb->pb_conn); + PR_Lock(pb->pb_conn->c_mutex); continuing = pb->pb_conn->c_flags & CONN_FLAG_SASL_CONTINUE; pb->pb_conn->c_flags &= ~CONN_FLAG_SASL_CONTINUE; /* reset flag */ sasl_conn = (sasl_conn_t*)pb->pb_conn->c_sasl_conn; + PR_Unlock(pb->pb_conn->c_mutex); if (sasl_conn == NULL) { send_ldap_result( pb, LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL, "sasl library unavailable", 0, NULL ); @@ -820,6 +822,7 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) * library that CRAM-MD5 is disabled, but it gives us a * different error code to SASL_NOMECH. */ + /* richm - this locks and unlocks pb->pb_conn */ if (!ids_sasl_mech_supported(pb, sasl_conn, mech)) { rc = SASL_NOMECH; goto sasl_check_result; @@ -857,30 +860,33 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) * using the new mechanism. We also need to do this if the * mechanism changed in the middle of the SASL authentication * process. */ + PR_Lock(pb->pb_conn->c_mutex); if ((pb->pb_conn->c_flags & CONN_FLAG_SASL_COMPLETE) || continuing) { + Slapi_Operation *operation; + slapi_pblock_get( pb, SLAPI_OPERATION, &operation); + slapi_log_error(SLAPI_LOG_CONNS, "ids_sasl_check_bind", + "cleaning up sasl IO conn=%d op=%d complete=%d continuing=%d\n", + pb->pb_conn->c_connid, operation->o_opid, + (pb->pb_conn->c_flags & CONN_FLAG_SASL_COMPLETE), continuing); /* reset flag */ pb->pb_conn->c_flags &= ~CONN_FLAG_SASL_COMPLETE; - /* Lock the connection mutex */ - PR_Lock(pb->pb_conn->c_mutex); - /* remove any SASL I/O from the connection */ - sasl_io_cleanup(pb->pb_conn); + connection_set_io_layer_cb(pb->pb_conn, NULL, sasl_io_cleanup, NULL); /* dispose of sasl_conn and create a new sasl_conn */ sasl_dispose(&sasl_conn); ids_sasl_server_new(pb->pb_conn); sasl_conn = (sasl_conn_t*)pb->pb_conn->c_sasl_conn; - /* Unlock the connection mutex */ - PR_Unlock(pb->pb_conn->c_mutex); - if (sasl_conn == NULL) { send_ldap_result( pb, LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL, "sasl library unavailable", 0, NULL ); + PR_Unlock(pb->pb_conn->c_mutex); return; } } + PR_Unlock(pb->pb_conn->c_mutex); rc = sasl_server_start(sasl_conn, mech, cred->bv_val, cred->bv_len, @@ -890,9 +896,6 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) switch (rc) { case SASL_OK: /* complete */ - /* Set a flag to signify that sasl bind is complete */ - pb->pb_conn->c_flags |= CONN_FLAG_SASL_COMPLETE; - /* retrieve the authenticated username */ if (sasl_getprop(sasl_conn, SASL_USERNAME, (const void**)&username) != SASL_OK) { @@ -922,6 +925,35 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) } slapi_pblock_set( pb, SLAPI_BIND_TARGET, slapi_ch_strdup( dn ) ); + /* see if we negotiated a security layer */ + if ((sasl_getprop(sasl_conn, SASL_SSF, + (const void**)&ssfp) == SASL_OK) && (*ssfp > 0)) { + LDAPDebug(LDAP_DEBUG_TRACE, "sasl ssf=%u\n", (unsigned)*ssfp, 0, 0); + } else { + *ssfp = 0; + } + + /* this is stuff we have to do inside the conn mutex */ + PR_Lock(pb->pb_conn->c_mutex); + /* Set a flag to signify that sasl bind is complete */ + pb->pb_conn->c_flags |= CONN_FLAG_SASL_COMPLETE; + /* note - we set this here in case there are pre-bind + plugins that want to know what the negotiated + ssf is - but this happens before we actually set + up the socket for SASL encryption - so one + consequence is that we attempt to do sasl + encryption on the connection after the pre-bind + plugin has been called, and sasl encryption fails + and the operation returns an error */ + pb->pb_conn->c_sasl_ssf = (unsigned)*ssfp; + + /* set the connection bind credentials */ + PR_snprintf(authtype, sizeof(authtype), "%s%s", SLAPD_AUTH_SASL, mech); + bind_credentials_set_nolock(pb->pb_conn, authtype, dn, + NULL, NULL, NULL, bind_target_entry); + + PR_Unlock(pb->pb_conn->c_mutex); + if (plugin_call_plugins( pb, SLAPI_PLUGIN_PRE_BIND_FN ) != 0){ break; } @@ -942,26 +974,6 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) } } - /* see if we negotiated a security layer */ - if ((sasl_getprop(sasl_conn, SASL_SSF, - (const void**)&ssfp) == SASL_OK) && (*ssfp > 0)) { - LDAPDebug(LDAP_DEBUG_TRACE, "sasl ssf=%u\n", (unsigned)*ssfp, 0, 0); - - /* Enable SASL I/O on the connection now */ - if (0 != sasl_io_enable(pb->pb_conn) ) { - send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL, - "failed to enable sasl i/o", - 0, NULL); - } - /* Set the SSF in the connection */ - pb->pb_conn->c_sasl_ssf = (unsigned)*ssfp; - } - - /* set the connection bind credentials */ - PR_snprintf(authtype, sizeof(authtype), "%s%s", SLAPD_AUTH_SASL, mech); - bind_credentials_set(pb->pb_conn, authtype, dn, - NULL, NULL, NULL, bind_target_entry); - /* set the auth response control if requested */ slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrls); if (slapi_control_present(ctrls, LDAP_CONTROL_AUTH_REQUEST, @@ -1017,11 +1029,17 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) slapi_pblock_set(pb, SLAPI_BIND_RET_SASLCREDS, &bvr); } + /* see if we negotiated a security layer */ + if (*ssfp > 0) { + /* Enable SASL I/O on the connection */ + PR_Lock(pb->pb_conn->c_mutex); + connection_set_io_layer_cb(pb->pb_conn, sasl_io_enable, NULL, NULL); + PR_Unlock(pb->pb_conn->c_mutex); + } + /* send successful result */ send_ldap_result( pb, LDAP_SUCCESS, NULL, NULL, 0, NULL ); - /* TODO: enable sasl security layer */ - /* remove the sasl data from the pblock */ slapi_pblock_set(pb, SLAPI_BIND_RET_SASLCREDS, NULL); diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 7e60ca5..c5ea51c 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1290,6 +1290,8 @@ typedef struct op { * represents a connection from an ldap client */ +typedef int (*Conn_IO_Layer_cb)(struct conn*, void *data); + struct Conn_Private; typedef struct Conn_private Conn_private; @@ -1345,6 +1347,11 @@ typedef struct conn { int c_sort_result_code; /* sort result put in response */ time_t c_timelimit; /* time limit for this connection */ /* PAGED_RESULTS ENDS */ + /* IO layer push/pop */ + Conn_IO_Layer_cb c_push_io_layer_cb; /* callback to push an IO layer on the conn->c_prfd */ + Conn_IO_Layer_cb c_pop_io_layer_cb; /* callback to pop an IO layer off of the conn->c_prfd */ + void *c_io_layer_cb_data; /* callback data */ + } Connection; #define CONN_FLAG_SSL 1 /* Is this connection an SSL connection or not ? * Used to direct I/O code when SSL is handled differently commit beb23fe4b5cc15a692a2282b27a49deedb502eda Author: Rich Megginson <rmeggins(a)redhat.com> Date: Fri Jun 18 11:51:48 2010 -0600 Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll https://bugzilla.redhat.com/show_bug.cgi?id=604453 Resolves: bug 604453 Description: SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll Branch: master Reviewed by: nhosoi (Thanks!) Fix Description: We usually do not have to pop the IO layer from the SASL connection. This is usually handled by PR_Close() on the PRFD, which should only happen when the connection is not being referenced by the main PR_Poll() call. The only time we need to explicitly pop the SASL IO layer is if the client re-negotiates the SASL bind with a different ssf e.g. going from clear to protected or vice versa. Platforms tested: RHEL5 x86_64 (cherry picked from commit ac6ce0947d9b2d5ec3649948bca861f0e318d708) diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index bab3345..85aef8e 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -197,8 +197,7 @@ connection_cleanup(Connection *conn) conn->c_extension= NULL; conn->c_ssl_ssf = 0; conn->c_unix_local = 0; - /* remove any SASL I/O from the connection */ - sasl_io_cleanup(conn); + /* destroy any sasl context */ sasl_dispose((sasl_conn_t**)&conn->c_sasl_conn); /* PAGED_RESULTS */ if (conn->c_search_result_set) {

1 0

Branch 'Directory_Server_8_2_Branch' - 2 commits - ldap/servers
by Richard Allen Megginson 23 Jun '10

23 Jun '10

ldap/servers/slapd/connection.c | 42 +++++++++++++++++++- ldap/servers/slapd/fe.h | 5 +- ldap/servers/slapd/proto-slap.h | 1 ldap/servers/slapd/sasl_io.c | 63 +++++++++++++++++++++--------- ldap/servers/slapd/saslbind.c | 82 ++++++++++++++++++++++++---------------- ldap/servers/slapd/slap.h | 7 +++ 6 files changed, 145 insertions(+), 55 deletions(-) New commits: commit c28fcadfc7812108573e40f13624e11a5a8609e5 Author: Rich Megginson <rmeggins(a)redhat.com> Date: Wed Jun 23 10:36:52 2010 -0600 Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll https://bugzilla.redhat.com/show_bug.cgi?id=604453 Resolves: bug 604453 Bug Description: SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll Reviewed by: nhosoi (Thanks!) Branch: Directory_Server_8_2_Branch Fix Description: When the server pushes the SASL IO layer on to the connection it must do so when there are no other references to the connection. The only way to do this without introducing more locking is to have the saslbind code just register the intent to push SASL IO at the next available time. This cannot be done in the sasl bind code (or any operation code for that matter) because connection_threadmain() will enable the connection for reading (and polling) after reading the PDU and before calling the operation function. Therefore, during the operation function, the connection may be being actively polled, so we must not access the conn c_prfd. The best place to push the IO layer is in connection_threadmain, after the server has notified that there is read ready on the connection, but before we have actually attempted to read anything. At this point, connection_threadmain is the only thread that will be accessing the connection, and if we push or pop the IO layer before calling the read function, we are guaranteed to have the correct IO layer to use. The code has been made generic enough to allow for use by the startTLS code if the need arises. I also added some more locking in the saslbind code, and changed the sasl IO code to more closely resemble the way that the NSS code deals with IO layer push/pop. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index 7a0e3d8..768f959 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -2161,6 +2161,14 @@ connection_threadmain() g_decr_active_threadcnt(); return; case CONN_FOUND_WORK_TO_DO: + /* note - don't need to lock here - connection should only + be used by this thread - since c_gettingber is set to 1 + in connection_activity when the conn is added to the + work queue, setup_pr_read_pds won't add the connection prfd + to the poll list */ + if (connection_call_io_layer_callbacks(pb->pb_conn)) { + LDAPDebug0Args( LDAP_DEBUG_ANY, "Error: could not add/remove IO layers from connection\n" ); + } default: break; } @@ -2174,6 +2182,9 @@ connection_threadmain() PR_Lock(conn->c_mutex); /* Make our own pb in turbo mode */ connection_make_new_pb(&pb,conn); + if (connection_call_io_layer_callbacks(conn)) { + LDAPDebug0Args( LDAP_DEBUG_ANY, "Error: could not add/remove IO layers from connection\n" ); + } PR_Unlock(conn->c_mutex); if (! config_check_referral_mode()) { slapi_counter_increment(ops_initiated); @@ -2755,3 +2766,31 @@ connection_abandon_operations( Connection *c ) } } } + +/* must be called within c->c_mutex */ +void +connection_set_io_layer_cb( Connection *c, Conn_IO_Layer_cb push_cb, Conn_IO_Layer_cb pop_cb, void *cb_data ) +{ + c->c_push_io_layer_cb = push_cb; + c->c_pop_io_layer_cb = pop_cb; + c->c_io_layer_cb_data = cb_data; +} + +/* must be called within c->c_mutex */ +int +connection_call_io_layer_callbacks( Connection *c ) +{ + int rv = 0; + if (c->c_pop_io_layer_cb) { + rv = (c->c_pop_io_layer_cb)(c, c->c_io_layer_cb_data); + c->c_pop_io_layer_cb = NULL; + } + if (!rv && c->c_push_io_layer_cb) { + rv = (c->c_push_io_layer_cb)(c, c->c_io_layer_cb_data); + c->c_push_io_layer_cb = NULL; + } + c->c_io_layer_cb_data = NULL; + + return rv; +} + diff --git a/ldap/servers/slapd/fe.h b/ldap/servers/slapd/fe.h index 3eb1d0a..3a985cb 100644 --- a/ldap/servers/slapd/fe.h +++ b/ldap/servers/slapd/fe.h @@ -116,6 +116,8 @@ int connection_operations_pending( Connection *conn, Operation *op2ignore, void connection_done(Connection *conn); void connection_cleanup(Connection *conn); void connection_reset(Connection* conn, int ns, PRNetAddr * from, int fromLen, int is_SSL); +void connection_set_io_layer_cb( Connection *c, Conn_IO_Layer_cb push_cb, Conn_IO_Layer_cb pop_cb, void *cb_data ); +int connection_call_io_layer_callbacks( Connection *c ); /* * conntable.c @@ -182,7 +184,8 @@ void configure_ns_socket( int * ns ); /* * sasl_io.c */ -int sasl_io_enable(Connection *c); +int sasl_io_enable(Connection *c, void *data); +int sasl_io_cleanup(Connection *c, void *data); /* * sasl_map.c diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index a21380e..66c02a1 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -927,7 +927,6 @@ int slapd_ssl_init(); int slapd_ssl_init2(PRFileDesc **fd, int startTLS); int slapd_security_library_is_initialized(); int slapd_ssl_listener_is_initialized(); -int sasl_io_cleanup(Connection *c); int slapd_SSL_client_auth (LDAP* ld); /* diff --git a/ldap/servers/slapd/sasl_io.c b/ldap/servers/slapd/sasl_io.c index f0e403d..b831a86 100644 --- a/ldap/servers/slapd/sasl_io.c +++ b/ldap/servers/slapd/sasl_io.c @@ -481,20 +481,33 @@ sasl_io_write(PRFileDesc *fd, const void *buf, PRInt32 amount) } static PRStatus PR_CALLBACK -sasl_pop_IO_layer(PRFileDesc* stack) +sasl_pop_IO_layer(PRFileDesc* stack, int doclose) { PRFileDesc* layer = NULL; sasl_io_private *sp = NULL; + PRStatus rv = 0; + PRDescIdentity id = PR_TOP_IO_LAYER; /* see if stack has the sasl io layer */ - if (!sasl_LayerID || !stack || !PR_GetIdentitiesLayer(stack, sasl_LayerID)) { + if (!sasl_LayerID || !stack) { LDAPDebug0Args( LDAP_DEBUG_CONNS, "sasl_pop_IO_layer: no SASL IO layer\n" ); return PR_SUCCESS; } + /* if we're not being called during PR_Close, then we just want to + pop the sasl io layer if it is on the stack */ + if (!doclose) { + id = sasl_LayerID; + if (!PR_GetIdentitiesLayer(stack, id)) { + LDAPDebug0Args( LDAP_DEBUG_CONNS, + "sasl_pop_IO_layer: no SASL IO layer\n" ); + return PR_SUCCESS; + } + } + /* remove the layer from the stack */ - layer = PR_PopIOLayer(stack, sasl_LayerID); + layer = PR_PopIOLayer(stack, id); if (!layer) { LDAPDebug0Args( LDAP_DEBUG_CONNS, "sasl_pop_IO_layer: error - could not pop SASL IO layer\n" ); @@ -517,23 +530,29 @@ sasl_pop_IO_layer(PRFileDesc* stack) layer->dtor(layer); } - return PR_SUCCESS; + if (doclose) { + rv = stack->methods->close(stack); + } else { + rv = PR_SUCCESS; + } + + return rv; } static PRStatus PR_CALLBACK closeLayer(PRFileDesc* stack) { + PRStatus rv = 0; LDAPDebug0Args( LDAP_DEBUG_CONNS, "closeLayer: closing SASL IO layer\n" ); - if (PR_FAILURE == sasl_pop_IO_layer(stack)) { + rv = sasl_pop_IO_layer(stack, 1 /* do close */); + if (PR_SUCCESS != rv) { LDAPDebug0Args( LDAP_DEBUG_CONNS, - "closeLayer: error closing SASL IO layer\n" ); - return PR_FAILURE; + "closeLayer: error closing SASL IO layer\n" ); + return rv; } - LDAPDebug0Args( LDAP_DEBUG_CONNS, - "closeLayer: calling PR_Close to close other layers\n" ); - return PR_Close(stack); + return rv; } static PRStatus PR_CALLBACK @@ -561,22 +580,28 @@ initialize(void) /* * Push the SASL I/O layer on top of the current NSPR I/O layer of the prfd used * by the connection. + * must be called with the connection lock (c_mutex) held or in a condition in which + * no other threads are accessing conn->c_prfd */ int -sasl_io_enable(Connection *c) +sasl_io_enable(Connection *c, void *data /* UNUSED */) { PRStatus rv = PR_CallOnce(&sasl_callOnce, initialize); if (PR_SUCCESS == rv) { - PRFileDesc* layer = PR_CreateIOLayerStub(sasl_LayerID, &sasl_IoMethods); - sasl_io_private *sp = (sasl_io_private*) slapi_ch_calloc(1, sizeof(sasl_io_private)); + PRFileDesc* layer = NULL; + sasl_io_private *sp = NULL; + if ( c->c_flags & CONN_FLAG_CLOSING ) { + slapi_log_error( SLAPI_LOG_FATAL, "sasl_io_enable", + "Cannot enable SASL security on connection in CLOSING state\n"); + return PR_FAILURE; + } + layer = PR_CreateIOLayerStub(sasl_LayerID, &sasl_IoMethods); + sp = (sasl_io_private*) slapi_ch_calloc(1, sizeof(sasl_io_private)); sasl_io_init_buffers(sp); layer->secret = sp; - - PR_Lock( c->c_mutex ); sp->conn = c; rv = PR_PushIOLayer(c->c_prfd, PR_TOP_IO_LAYER, layer); - PR_Unlock( c->c_mutex ); if (rv) { LDAPDebug( LDAP_DEBUG_ANY, "sasl_io_enable: error enabling sasl io on connection %" NSPRIu64 " %d:%s\n", c->c_connid, rv, slapd_pr_strerror(rv) ); @@ -592,17 +617,17 @@ sasl_io_enable(Connection *c) /* * Remove the SASL I/O layer from the top of the current NSPR I/O layer of the prfd used * by the connection. Must either be called within the connection lock, or be - * called while the connection is not being referenced by another thread. + * called while the connection (c_prfd) is not being referenced by another thread. */ int -sasl_io_cleanup(Connection *c) +sasl_io_cleanup(Connection *c, void *data /* UNUSED */) { int ret = 0; LDAPDebug( LDAP_DEBUG_CONNS, "sasl_io_cleanup for connection %" NSPRIu64 "\n", c->c_connid, 0, 0 ); - ret = sasl_pop_IO_layer(c->c_prfd); + ret = sasl_pop_IO_layer(c->c_prfd, 0 /* do not close */); c->c_sasl_ssf = 0; diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c index 42d289a..6d85fc0 100644 --- a/ldap/servers/slapd/saslbind.c +++ b/ldap/servers/slapd/saslbind.c @@ -800,10 +800,12 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) PR_ASSERT(pb); PR_ASSERT(pb->pb_conn); + PR_Lock(pb->pb_conn->c_mutex); continuing = pb->pb_conn->c_flags & CONN_FLAG_SASL_CONTINUE; pb->pb_conn->c_flags &= ~CONN_FLAG_SASL_CONTINUE; /* reset flag */ sasl_conn = (sasl_conn_t*)pb->pb_conn->c_sasl_conn; + PR_Unlock(pb->pb_conn->c_mutex); if (sasl_conn == NULL) { send_ldap_result( pb, LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL, "sasl library unavailable", 0, NULL ); @@ -820,6 +822,7 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) * library that CRAM-MD5 is disabled, but it gives us a * different error code to SASL_NOMECH. */ + /* richm - this locks and unlocks pb->pb_conn */ if (!ids_sasl_mech_supported(pb, sasl_conn, mech)) { rc = SASL_NOMECH; goto sasl_check_result; @@ -857,30 +860,33 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) * using the new mechanism. We also need to do this if the * mechanism changed in the middle of the SASL authentication * process. */ + PR_Lock(pb->pb_conn->c_mutex); if ((pb->pb_conn->c_flags & CONN_FLAG_SASL_COMPLETE) || continuing) { + Slapi_Operation *operation; + slapi_pblock_get( pb, SLAPI_OPERATION, &operation); + slapi_log_error(SLAPI_LOG_CONNS, "ids_sasl_check_bind", + "cleaning up sasl IO conn=%d op=%d complete=%d continuing=%d\n", + pb->pb_conn->c_connid, operation->o_opid, + (pb->pb_conn->c_flags & CONN_FLAG_SASL_COMPLETE), continuing); /* reset flag */ pb->pb_conn->c_flags &= ~CONN_FLAG_SASL_COMPLETE; - /* Lock the connection mutex */ - PR_Lock(pb->pb_conn->c_mutex); - /* remove any SASL I/O from the connection */ - sasl_io_cleanup(pb->pb_conn); + connection_set_io_layer_cb(pb->pb_conn, NULL, sasl_io_cleanup, NULL); /* dispose of sasl_conn and create a new sasl_conn */ sasl_dispose(&sasl_conn); ids_sasl_server_new(pb->pb_conn); sasl_conn = (sasl_conn_t*)pb->pb_conn->c_sasl_conn; - /* Unlock the connection mutex */ - PR_Unlock(pb->pb_conn->c_mutex); - if (sasl_conn == NULL) { send_ldap_result( pb, LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL, "sasl library unavailable", 0, NULL ); + PR_Unlock(pb->pb_conn->c_mutex); return; } } + PR_Unlock(pb->pb_conn->c_mutex); rc = sasl_server_start(sasl_conn, mech, cred->bv_val, cred->bv_len, @@ -890,9 +896,6 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) switch (rc) { case SASL_OK: /* complete */ - /* Set a flag to signify that sasl bind is complete */ - pb->pb_conn->c_flags |= CONN_FLAG_SASL_COMPLETE; - /* retrieve the authenticated username */ if (sasl_getprop(sasl_conn, SASL_USERNAME, (const void**)&username) != SASL_OK) { @@ -922,6 +925,35 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) } slapi_pblock_set( pb, SLAPI_BIND_TARGET, slapi_ch_strdup( dn ) ); + /* see if we negotiated a security layer */ + if ((sasl_getprop(sasl_conn, SASL_SSF, + (const void**)&ssfp) == SASL_OK) && (*ssfp > 0)) { + LDAPDebug(LDAP_DEBUG_TRACE, "sasl ssf=%u\n", (unsigned)*ssfp, 0, 0); + } else { + *ssfp = 0; + } + + /* this is stuff we have to do inside the conn mutex */ + PR_Lock(pb->pb_conn->c_mutex); + /* Set a flag to signify that sasl bind is complete */ + pb->pb_conn->c_flags |= CONN_FLAG_SASL_COMPLETE; + /* note - we set this here in case there are pre-bind + plugins that want to know what the negotiated + ssf is - but this happens before we actually set + up the socket for SASL encryption - so one + consequence is that we attempt to do sasl + encryption on the connection after the pre-bind + plugin has been called, and sasl encryption fails + and the operation returns an error */ + pb->pb_conn->c_sasl_ssf = (unsigned)*ssfp; + + /* set the connection bind credentials */ + PR_snprintf(authtype, sizeof(authtype), "%s%s", SLAPD_AUTH_SASL, mech); + bind_credentials_set_nolock(pb->pb_conn, authtype, dn, + NULL, NULL, NULL, bind_target_entry); + + PR_Unlock(pb->pb_conn->c_mutex); + if (plugin_call_plugins( pb, SLAPI_PLUGIN_PRE_BIND_FN ) != 0){ break; } @@ -942,26 +974,6 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) } } - /* see if we negotiated a security layer */ - if ((sasl_getprop(sasl_conn, SASL_SSF, - (const void**)&ssfp) == SASL_OK) && (*ssfp > 0)) { - LDAPDebug(LDAP_DEBUG_TRACE, "sasl ssf=%u\n", (unsigned)*ssfp, 0, 0); - - /* Enable SASL I/O on the connection now */ - if (0 != sasl_io_enable(pb->pb_conn) ) { - send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL, - "failed to enable sasl i/o", - 0, NULL); - } - /* Set the SSF in the connection */ - pb->pb_conn->c_sasl_ssf = (unsigned)*ssfp; - } - - /* set the connection bind credentials */ - PR_snprintf(authtype, sizeof(authtype), "%s%s", SLAPD_AUTH_SASL, mech); - bind_credentials_set(pb->pb_conn, authtype, dn, - NULL, NULL, NULL, bind_target_entry); - /* set the auth response control if requested */ slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrls); if (slapi_control_present(ctrls, LDAP_CONTROL_AUTH_REQUEST, @@ -1017,11 +1029,17 @@ void ids_sasl_check_bind(Slapi_PBlock *pb) slapi_pblock_set(pb, SLAPI_BIND_RET_SASLCREDS, &bvr); } + /* see if we negotiated a security layer */ + if (*ssfp > 0) { + /* Enable SASL I/O on the connection */ + PR_Lock(pb->pb_conn->c_mutex); + connection_set_io_layer_cb(pb->pb_conn, sasl_io_enable, NULL, NULL); + PR_Unlock(pb->pb_conn->c_mutex); + } + /* send successful result */ send_ldap_result( pb, LDAP_SUCCESS, NULL, NULL, 0, NULL ); - /* TODO: enable sasl security layer */ - /* remove the sasl data from the pblock */ slapi_pblock_set(pb, SLAPI_BIND_RET_SASLCREDS, NULL); diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 98aee57..10da992 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1253,6 +1253,8 @@ typedef struct op { * represents a connection from an ldap client */ +typedef int (*Conn_IO_Layer_cb)(struct conn*, void *data); + struct Conn_Private; typedef struct Conn_private Conn_private; @@ -1308,6 +1310,11 @@ typedef struct conn { int c_sort_result_code; /* sort result put in response */ time_t c_timelimit; /* time limit for this connection */ /* PAGED_RESULTS ENDS */ + /* IO layer push/pop */ + Conn_IO_Layer_cb c_push_io_layer_cb; /* callback to push an IO layer on the conn->c_prfd */ + Conn_IO_Layer_cb c_pop_io_layer_cb; /* callback to pop an IO layer off of the conn->c_prfd */ + void *c_io_layer_cb_data; /* callback data */ + } Connection; #define CONN_FLAG_SSL 1 /* Is this connection an SSL connection or not ? * Used to direct I/O code when SSL is handled differently commit ac6ce0947d9b2d5ec3649948bca861f0e318d708 Author: Rich Megginson <rmeggins(a)redhat.com> Date: Fri Jun 18 11:51:48 2010 -0600 Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll https://bugzilla.redhat.com/show_bug.cgi?id=604453 Resolves: bug 604453 Description: SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll Reviewed by: Fix Description: We usually do not have to pop the IO layer from the SASL connection. This is usually handled by PR_Close() on the PRFD, which should only happen when the connection is not being referenced by the main PR_Poll() call. The only time we need to explicitly pop the SASL IO layer is if the client re-negotiates the SASL bind with a different ssf e.g. going from clear to protected or vice versa. Platforms tested: RHEL5 x86_64 diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index d2b728c..7a0e3d8 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -197,8 +197,7 @@ connection_cleanup(Connection *conn) conn->c_extension= NULL; conn->c_ssl_ssf = 0; conn->c_unix_local = 0; - /* remove any SASL I/O from the connection */ - sasl_io_cleanup(conn); + /* destroy any sasl context */ sasl_dispose((sasl_conn_t**)&conn->c_sasl_conn); /* PAGED_RESULTS */ if (conn->c_search_result_set) {

1 0

Branch 'Directory_Server_8_2_Branch' - ldap/servers
by Noriko Hosoi 23 Jun '10

23 Jun '10

ldap/servers/slapd/opshared.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) New commits: commit 46934c07d9fb1d04f6059793a041931b33de092b Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Jun 22 13:55:02 2010 -0700 606920 - anonymous resource limit - nstimelimit - also applied to "cn=directory manager" https://bugzilla.redhat.com/show_bug.cgi?id=606920 Description: When a timelimit (as well as a sizelimit) is successfully retrieved from SLAPIResLimitConnData, the value is always set to pblock. With this change, it sets "no limit (-1)" if the operation is initiated by Directory Manager. diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c index e07888c..d06dd2d 100644 --- a/ldap/servers/slapd/opshared.c +++ b/ldap/servers/slapd/opshared.c @@ -1370,12 +1370,14 @@ compute_limits (Slapi_PBlock *pb) } } - if ( requested_timelimit == 0 ) { - timelimit = ( max_timelimit == -1 ) ? -1 : max_timelimit; + if ( isroot ) { + timelimit = max_timelimit = -1; /* no limit */ + } else if ( requested_timelimit == 0 ) { + timelimit = ( max_timelimit == -1 ) ? -1 : max_timelimit; } else if ( max_timelimit == -1 || requested_timelimit < max_timelimit ) { - timelimit = requested_timelimit; + timelimit = requested_timelimit; } else { - timelimit = max_timelimit; + timelimit = max_timelimit; } set_timelimit: @@ -1399,12 +1401,14 @@ compute_limits (Slapi_PBlock *pb) } } - if ( requested_sizelimit == 0 ) { - sizelimit = ( max_sizelimit == -1 ) ? -1 : max_sizelimit; + if ( isroot ) { + sizelimit = max_sizelimit = -1; + } else if ( requested_sizelimit == 0 ) { + sizelimit = ( max_sizelimit == -1 ) ? -1 : max_sizelimit; } else if ( max_sizelimit == -1 || requested_sizelimit < max_sizelimit ) { - sizelimit = requested_sizelimit; + sizelimit = requested_sizelimit; } else { - sizelimit = max_sizelimit; + sizelimit = max_sizelimit; } slapi_pblock_set(pb, SLAPI_SEARCH_SIZELIMIT, &sizelimit);

1 0

ldap/servers
by Noriko Hosoi 23 Jun '10

23 Jun '10

ldap/servers/slapd/opshared.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) New commits: commit ee751718a4e99f49c935aef06e309886e1f5beca Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Jun 22 13:55:02 2010 -0700 606920 - anonymous resource limit - nstimelimit - also applied to "cn=directory manager" https://bugzilla.redhat.com/show_bug.cgi?id=606920 Description: When a timelimit (as well as a sizelimit) is successfully retrieved from SLAPIResLimitConnData, the value is always set to pblock. With this change, it sets "no limit (-1)" if the operation is initiated by Directory Manager. diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c index e07888c..d06dd2d 100644 --- a/ldap/servers/slapd/opshared.c +++ b/ldap/servers/slapd/opshared.c @@ -1370,12 +1370,14 @@ compute_limits (Slapi_PBlock *pb) } } - if ( requested_timelimit == 0 ) { - timelimit = ( max_timelimit == -1 ) ? -1 : max_timelimit; + if ( isroot ) { + timelimit = max_timelimit = -1; /* no limit */ + } else if ( requested_timelimit == 0 ) { + timelimit = ( max_timelimit == -1 ) ? -1 : max_timelimit; } else if ( max_timelimit == -1 || requested_timelimit < max_timelimit ) { - timelimit = requested_timelimit; + timelimit = requested_timelimit; } else { - timelimit = max_timelimit; + timelimit = max_timelimit; } set_timelimit: @@ -1399,12 +1401,14 @@ compute_limits (Slapi_PBlock *pb) } } - if ( requested_sizelimit == 0 ) { - sizelimit = ( max_sizelimit == -1 ) ? -1 : max_sizelimit; + if ( isroot ) { + sizelimit = max_sizelimit = -1; + } else if ( requested_sizelimit == 0 ) { + sizelimit = ( max_sizelimit == -1 ) ? -1 : max_sizelimit; } else if ( max_sizelimit == -1 || requested_sizelimit < max_sizelimit ) { - sizelimit = requested_sizelimit; + sizelimit = requested_sizelimit; } else { - sizelimit = max_sizelimit; + sizelimit = max_sizelimit; } slapi_pblock_set(pb, SLAPI_SEARCH_SIZELIMIT, &sizelimit);

1 0

Branch 'Directory_Server_8_2_Branch' - ldap/admin
by Noriko Hosoi 18 Jun '10

18 Jun '10

ldap/admin/src/scripts/70upgradednformat.pl | 7 +++++++ 1 file changed, 7 insertions(+) New commits: commit a109da80a8eae4400b42a27bb5de604f9aee344d Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Fri Jun 18 14:24:05 2010 -0700 605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl https://bugzilla.redhat.com/show_bug.cgi?id=605827 Description: 70upgradednformat.pl does nothing if the server is up. The upgrade script is effective only when it's called in the Off- line mode. diff --git a/ldap/admin/src/scripts/70upgradednformat.pl b/ldap/admin/src/scripts/70upgradednformat.pl index 639a282..894a088 100644 --- a/ldap/admin/src/scripts/70upgradednformat.pl +++ b/ldap/admin/src/scripts/70upgradednformat.pl @@ -11,9 +11,16 @@ use File::Copy; # recursively copy the instance dir to the work dir (dnupgrade) # run upgradednformat w/o -N against the DB in the work dir # if it went ok, replace the original instance dir with the work dir. +# Note: This script does nothing if the server is up. sub runinst { my ($inf, $inst, $dseldif, $conn) = @_; + # First, check if the server is up or down. + if ($conn->isa("Mozilla::LDAP::Conn")) { + # The server is up, we do nothing. + return (); + } + my @errs; my $config = "cn=config";

1 0

VERSION.sh
by Richard Allen Megginson 16 Jun '10

16 Jun '10

VERSION.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 10966f3cfe9a60ac385ca76bc331fa292da7b888 Author: Rich Megginson <rmeggins(a)redhat.com> Date: Wed Jun 16 10:22:10 2010 -0600 bump version to 1.2.6.rc3 diff --git a/VERSION.sh b/VERSION.sh index dc8c1ac..fd343ad 100644 --- a/VERSION.sh +++ b/VERSION.sh @@ -14,7 +14,7 @@ VERSION_MAINT=6 # if this is a PRERELEASE, set VERSION_PREREL # otherwise, comment it out # be sure to include the dot prefix in the prerel -VERSION_PREREL=.rc2 +VERSION_PREREL=.rc3 # NOTES on VERSION_PREREL # use aN for an alpha release e.g. a1, a2, etc. # use rcN for a release candidate e.g. rc1, rc2, etc.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits June 2010