389-commits November 2013

389-commits@lists.fedoraproject.org

6 participants
103 discussions

dirsrvtests/tickets
by thierry bordaz 27 Nov '13

27 Nov '13

dirsrvtests/tickets/ticket47490_test.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 16be5c6aa9af8c8baf5695dbd3e7f3b045c8cfaa Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com> Date: Wed Nov 27 13:48:18 2013 +0100 Ticket 47586 - CI tests: follow up Bug Description: Uncomment fixture definition Fix Description: https://fedorahosted.org/389/ticket/47586 Reviewed by: ? Platforms tested: F19 Flag Day: no Doc impact: no diff --git a/dirsrvtests/tickets/ticket47490_test.py b/dirsrvtests/tickets/ticket47490_test.py index b4b0067..b6e591e 100644 --- a/dirsrvtests/tickets/ticket47490_test.py +++ b/dirsrvtests/tickets/ticket47490_test.py @@ -125,7 +125,7 @@ def trigger_schema_push(topology): time.sleep(1) loop += 1 -#(a)pytest.fixture(scope="module") +(a)pytest.fixture(scope="module") def topology(request): ''' This fixture is used to create a replicated topology for the 'module'.

1 0

3 commits - admserv/newinst mod_admserv/mod_admserv.c
by Richard Allen Megginson 26 Nov '13

26 Nov '13

admserv/newinst/src/AdminServer.pm.in | 23 ++++--- mod_admserv/mod_admserv.c | 103 ++++++++++++++++++++++++---------- 2 files changed, 87 insertions(+), 39 deletions(-) New commits: commit bd9522123a4935730b77ec4e2a4ae628b7b270aa Author: Rich Megginson <rmeggins(a)redhat.com> Date: Tue Oct 22 13:49:01 2013 -0600 Ticket #47478 No groups file? error restarting Admin server https://fedorahosted.org/389/ticket/47478 Reviewed by: nkinder (Thanks!) Branch: master Fix Description: When Apache runs the CGI, it has to run through all of the hooks/callbacks again, including the authz callbacks, via a sub-request. For the sub-request, admserv_check_authz was just returning DECLINED, which means "I decline to answer this request for authz, go to the next handler". It was then doing regular Apache authz handling, including looking at the groups file. The fix is to remember what the original authz return value was, and just return that if being called as part of a sub-request. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no diff --git a/mod_admserv/mod_admserv.c b/mod_admserv/mod_admserv.c index d104538..420e36b 100644 --- a/mod_admserv/mod_admserv.c +++ b/mod_admserv/mod_admserv.c @@ -1589,6 +1589,7 @@ populate_task_cache_entries(const char *userDN, LDAP *server) #define IS_START_CONFIG_DS_REQ(uri, serverid, userdn, user) \ uri && !STRNCASECMP(uri, STARTDS_IDENTIFIER, strlen(STARTDS_IDENTIFIER)) && \ serverid && !STRCMP(serverid, "admin-serv") && /* is local superuser */ !userdn && user +#define ADMSERV_AUTHZ_RETVAL "admserv_authz_retval" static int admserv_check_authz(request_rec *r) @@ -1608,19 +1609,25 @@ admserv_check_authz(request_rec *r) long now; int is_start_config_ds_req = 0; int tries = 0; + int retval = DECLINED; + char rvbuf[20]; + const char *rvstr; admserv_config *cf = ap_get_module_config(r->per_dir_config, &admserv_module); ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "admserv_check_authz: request for uri [%s]", r->uri); - /* for some reason, we get sub requests for our tasks which we can ignore */ - if (r->main) { + /* sub requests need to reparse the uri, but do not need to go through the whole authz again + * just return the result from the original authz request + */ + if (r->main && (rvstr = apr_table_get(r->main->notes, ADMSERV_AUTHZ_RETVAL))) { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, - "admserv_check_authz: skipping sub request [%s] - filename [%s] user [%s]", + "admserv_check_authz: sub request [%s] - filename [%s] user [%s] retval [%s]", r->uri, r->main->filename ? r->main->filename : "(null)", - r->main->user ? r->main->user : "(null)"); - return DECLINED; + r->main->user ? r->main->user : "(null)", rvstr); + retval = atoi(rvstr); + goto done; } uri = apr_pstrdup(r->pool, r->uri); /* might need unparsed_uri here? */ @@ -1628,7 +1635,8 @@ admserv_check_authz(request_rec *r) if (!(p = strchr(uri+1, '/'))) { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "admserv_check_authz(): Skipping invalid URI [%s]", uri); - return DECLINED; + retval = DECLINED; + goto done; } serverid = uri+1; @@ -1655,7 +1663,8 @@ admserv_check_authz(request_rec *r) ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): unable to find registered server (%s)", serverid); - return admserv_error(r, HTTP_BAD_REQUEST, "server not registered"); /*i18n*/ + retval = admserv_error(r, HTTP_BAD_REQUEST, "server not registered"); /*i18n*/ + goto done; } } } @@ -1665,7 +1674,8 @@ admserv_check_authz(request_rec *r) ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, "admserv_check_authz(): passing [%s] to the userauth handler", r->uri); - return OK; + retval = OK; + goto done; } entryDN[0] = '\0'; @@ -1673,7 +1683,8 @@ admserv_check_authz(request_rec *r) ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): unable to build DN from URL - bad URL [%s]", uri); - return admserv_error_std(r, "server not registered"); /*i18n*/ + retval = admserv_error_std(r, "server not registered"); /*i18n*/ + goto done; } convert_to_lower_case(entryDN); @@ -1693,12 +1704,14 @@ admserv_check_authz(request_rec *r) "admserv_check_authz: task [%s] not cached for local superuser", entryDN); if (configdsdown) { - return OK; /* let the admserv_config_ds_down handler handle this situation */ + retval = OK; /* let the admserv_config_ds_down handler handle this situation */ + goto done; } if (!send_response) { - return admserv_error_std(r, retmsg); + retval = admserv_error_std(r, retmsg); + goto done; } - return retval; + goto done; } goto found; } @@ -1706,7 +1719,8 @@ admserv_check_authz(request_rec *r) if (!userdn || !pw) { ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, "admserv_check_authz(): invalid userdn/pw"); - return admserv_error_std(r, "invalid user/password"); /*i18n*/ + retval = admserv_error_std(r, "invalid user/password"); /*i18n*/ + goto done; } /* DT 3/10/98 @@ -1725,7 +1739,8 @@ admserv_check_authz(request_rec *r) ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): unable to open LDAP connection to %s:%d", registryServer.host, registryServer.port); - return admserv_error_std(r, "unable to open LDAPConnection"); /*i18n*/ + retval = admserv_error_std(r, "unable to open LDAPConnection"); /*i18n*/ + goto done; } tries = 0; @@ -1743,7 +1758,8 @@ admserv_check_authz(request_rec *r) ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): unable to LDAP BIND as [%s] to %s:%d", userdn ? userdn : "(anon)", registryServer.host, registryServer.port); - return admserv_error_std(r, "unable to open LDAPConnection"); /*i18n*/ + retval = admserv_error_std(r, "unable to open LDAPConnection"); /*i18n*/ + goto done; } } while (server != NULL && ++tries < 2); @@ -1756,7 +1772,7 @@ admserv_check_authz(request_rec *r) ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "admserv_check_authz: could not find cached task [%s] for [%s]", entryDN, userdn ? userdn : "(anon)"); - return retval; + goto done; } goto found; } @@ -1764,7 +1780,8 @@ admserv_check_authz(request_rec *r) ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): got LDAP error %d talking to %s:%d - possible user [%s] not authorized", ldapError, registryServer.host, registryServer.port, userdn ? userdn : "(anon)"); - return admserv_error(r, HTTP_UNAUTHORIZED, "invalid user credentials"); /*i18n*/ + retval = admserv_error(r, HTTP_UNAUTHORIZED, "invalid user credentials"); /*i18n*/ + goto done; } /* Attempt to read the entry data -- involves DS eval of entry ACI for userDN. @@ -1781,7 +1798,8 @@ admserv_check_authz(request_rec *r) "admserv_check_authz(): Task [%s] not found for user [%s] - either" " the task was not registered or the user was not authorized", entryDN, userdn ? userdn : "(anon)"); - return admserv_error(r, HTTP_UNAUTHORIZED, "task not found or unauthorized"); /*i18n*/ + retval = admserv_error(r, HTTP_UNAUTHORIZED, "task not found or unauthorized"); /*i18n*/ + goto done; /* This is remapping - converting the requested URI to the actual CGI filename We can't do this in a translate_name hook because that happens _before_ authenticating @@ -1800,9 +1818,10 @@ found: ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): No ADMCgiBinDir was specified for location [%s]", r->filename); - return admserv_error_std(r, apr_psprintf(r->pool, + retval = admserv_error_std(r, apr_psprintf(r->pool, "No ADMCgiBinDir specified for location [%s]", r->filename)); + goto done; } r->filename = apr_psprintf(r->pool, "%s%c%s", @@ -1819,9 +1838,10 @@ found: ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): start config ds CGI is a directory [%s]", r->filename); - return admserv_error_std(r, apr_psprintf(r->pool, + retval = admserv_error_std(r, apr_psprintf(r->pool, "Invalid URL [%s] is a directory", r->filename)); + goto done; } } @@ -1829,7 +1849,8 @@ found: ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, "admserv_check_authz(): StartConfigDS requested by the local superuser"); - return OK; + retval = OK; + goto done; } /* DT 3/15/98 Runtime command support. */ @@ -1842,7 +1863,8 @@ found: ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "admserv_check_authz: mapped uri [%s] to command [%s]", r->uri, name); - return OK; + retval = OK; + goto done; } else { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "admserv_check_authz: uri [%s] did not begin with [%s] - not a command", @@ -1859,9 +1881,10 @@ found: ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): No ADMCgiBinDir was specified for location [%s]", r->filename); - return admserv_error_std(r, apr_psprintf(r->pool, + retval = admserv_error_std(r, apr_psprintf(r->pool, "No ADMCgiBinDir specified for location [%s]", r->filename)); + goto done; } /* set cgibindir in the Directory/Location section for this server */ @@ -1880,9 +1903,10 @@ found: ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "admserv_check_authz(): CGI is a directory [%s]", r->filename); - return admserv_error_std(r, apr_psprintf(r->pool, + retval = admserv_error_std(r, apr_psprintf(r->pool, "Invalid URL [%s] is a directory", r->filename)); + goto done; } } @@ -1901,7 +1925,11 @@ found: "admserv_check_authz: execute CGI [%s] args [%s]", r->filename, r->args); - return OK; /* FIXME, does this matter? */ + retval = OK; +done: + snprintf(rvbuf, sizeof(rvbuf), "%d", retval); + apr_table_set(r->notes, ADMSERV_AUTHZ_RETVAL, rvbuf); /* remember authz result for sub-requests */ + return retval; } static int commit 8d0482561ed95621e52710d74fb74dc6970a6f04 Author: Rich Megginson <rmeggins(a)redhat.com> Date: Mon Oct 21 15:23:07 2013 -0600 Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour https://fedorahosted.org/389/ticket/47300 Reviewed by: mreynolds (Thanks!) Branch: master Fix Description: Replace these files with their defaults saved in the bakup directory: httpd.conf, console.conf, admserv.conf, nss.conf. Without the -a (all) flag, preserve these files: cert8.db, key3.db, secmod.db, password.conf. With the -a flag, remove them. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no diff --git a/admserv/newinst/src/AdminServer.pm.in b/admserv/newinst/src/AdminServer.pm.in index 1d7d06f..7c7b511 100644 --- a/admserv/newinst/src/AdminServer.pm.in +++ b/admserv/newinst/src/AdminServer.pm.in @@ -355,6 +355,9 @@ sub registerASWithConfigDS { return @errs ? 0 : 1; } +my @saveconffiles = qw(admserv.conf httpd.conf nss.conf console.conf); +my @savesecfiles = qw(cert8.db key3.db secmod.db password.conf); + # update other config files - these are the fields which users typically want to # change during an install or an upgrade, that also must be synced to the Apache # style config files - we use the config CGI in command line mode because it @@ -412,14 +415,13 @@ sub updateHttpConfFiles { print CONSOLECONF @contents; close (CONSOLECONF); } - my @savefiles = qw(admserv.conf httpd.conf nss.conf console.conf cert8.db key3.db secmod.db); if (! -d "$admConf->{configdir}/bakup") { if (system ("mkdir -p $admConf->{configdir}/bakup")) { debug(0, "Error backing up $admConf->{configdir}/console.conf failed: $!"); } } # backup savefiles for "remove-ds-admin.pl -a" - foreach my $savefile (@savefiles) { + foreach my $savefile (@saveconffiles, @savesecfiles) { if (! -f "$admConf->{configdir}/bakup/$savefile") { if (system ("cp -p $admConf->{configdir}/$savefile $admConf->{configdir}/bakup")) { debug(0, "Error backing up $admConf->{configdir}/$savefile failed: $!"); @@ -740,7 +742,10 @@ sub removeAdminServer { } # remove config files - my @savefiles = qw(admserv.conf httpd.conf nss.conf console.conf cert8.db key3.db secmod.db); + my @savefiles = @savesecfiles; # save security files by default + if ($all) { + @savefiles = (); # $all means remove everything, save nothing + } if (opendir(CONFDIR, $configdir)) { while ($file = readdir(CONFDIR)) { next if ($file eq '.' || $file eq '..'); @@ -756,13 +761,11 @@ sub removeAdminServer { } } closedir(CONFDIR); - if ($all) { - # restore backed up savefiles - foreach my $savefile (@savefiles) { - if (-f "$configdir/bakup/$savefile") { - if (system ("mv $configdir/bakup/$savefile $configdir")) { - debug(0, "Error Restoring $configdir/$savefile failed: $!"); - } + # restore original conf files + foreach my $savefile (@saveconffiles) { + if (-f "$configdir/bakup/$savefile") { + if (system ("mv $configdir/bakup/$savefile $configdir")) { + debug(0, "Error Restoring $configdir/$savefile failed: $!"); } } } commit d35d14f7b599ebbc927cf7c6a6d8b163917e70df Author: Rich Megginson <rmeggins(a)redhat.com> Date: Mon Oct 21 14:43:02 2013 -0600 Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>" https://fedorahosted.org/389/ticket/434 Reviewed by: mreynolds (Thanks!) Branch: master Fix Description: Only warn once per process, and give the admin more information about what the problem is and what to do about it. Also added more debugging for access control, and turned down the verbosity of some of the other messages. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no diff --git a/mod_admserv/mod_admserv.c b/mod_admserv/mod_admserv.c index d6d2e19..d104538 100644 --- a/mod_admserv/mod_admserv.c +++ b/mod_admserv/mod_admserv.c @@ -2013,6 +2013,7 @@ admserv_host_ip_check(request_rec *r) char * clientIP = r->connection->remote_ip; #endif char *msg; + static int warned = 0; if (clientIP) { } else { @@ -2036,8 +2037,15 @@ admserv_host_ip_check(request_rec *r) } } else { PRNetAddr addr; - ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, - "admserv_host_ip_check: ap_get_remote_host could not resolve %s", clientIP); + if (!warned) { + ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, + "admserv_host_ip_check: Access control based on hostname [%s] is being used, " + "but the server could not resolve the hostname of client IP address [%s]. Either " + "enable HostnameLookups in console.conf (by default it is off for performance reasons), " + "or turn off access control by host/domain name and use access control by IP address only.", + accessHosts, clientIP); + warned = 1; /* warn only once per process */ + } if (PR_SUCCESS == PR_StringToNetAddr(clientIP, &addr)) { char buf[PR_NETDB_BUF_SIZE]; PRHostEnt hEntry; @@ -2045,16 +2053,19 @@ admserv_host_ip_check(request_rec *r) if (APR_SUCCESS != admserv_match_list(apr_pstrdup(r->pool, accessHosts), hEntry.h_name, matchflags)) { char ** x; - ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, + ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, "admserv_host_ip_check: host [%s] did not match pattern [%s] -" "will scan aliases", hEntry.h_name, accessHosts); for (x = hEntry.h_aliases; x && *x; x++) { if (APR_SUCCESS != admserv_match_list(apr_pstrdup(r->pool, accessHosts), *x, matchflags)) { - ap_log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, + ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, "admserv_host_ip_check: host alias [%s] did not match pattern [%s]", *x, accessHosts); } else { + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "admserv_host_ip_check: host alias [%s] matched pattern [%s] - access allowed", + *x, accessHosts); return DECLINED; } } @@ -2077,7 +2088,13 @@ admserv_host_ip_check(request_rec *r) int matchflags = APR_FNM_PERIOD; apr_status_t rc = admserv_match_list(apr_pstrdup(r->pool, accessAddresses), clientIP, matchflags); if (rc != APR_SUCCESS) { + ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, + "admserv_host_ip_check: client IP address [%s] did not match pattern [%s] - access denied", + clientIP, accessAddresses); } else { + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "admserv_host_ip_check: client IP address [%s] matched pattern [%s] - access allowed", + clientIP, accessAddresses); return DECLINED; } }

1 0

Branch '389-ds-base-1.2.11' - ldap/servers
by Ludwig Krispenz 26 Nov '13

26 Nov '13

ldap/servers/slapd/entry.c | 15 ++++++++------- ldap/servers/slapd/slapi-plugin.h | 15 ++++++++++++++- 2 files changed, 22 insertions(+), 8 deletions(-) New commits: commit 766e747e04d301a4cd48911b71d904847963940d Author: Ludwig Krispenz <lkrispen(a)redhat.com> Date: Tue Nov 26 09:15:53 2013 +0100 Ticket 47591 - entries with empty objectclass attribute value can be hidden Bug Description: The problem is that for the empty value objectClass;vdcsn-5283b8e0000000c80000;deleted it is compared to "ldapsubentry" and "nstombstone" 'if (PL_strncasecmp(type.bv_val,"tombstone",0)' and with length 0, this is always true. Fix Description: add a check bv_len >= strlen(valuetocompare) or bv_len == strlen(valuetocompare) define constants for lengths https://fedorahosted.org/389/ticket/47591 Reviewed by: richm, thanks diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c index a43dc21..d7df631 100644 --- a/ldap/servers/slapd/entry.c +++ b/ldap/servers/slapd/entry.c @@ -327,7 +327,7 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) rawdn = NULL; /* Set once in the loop. This won't affect the caller's passed address. */ } - if ( PL_strncasecmp( type.bv_val, "dn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_DN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_DN, type.bv_len ) == 0 ) { if ( slapi_entry_get_dn_const(e)!=NULL ) { char ebuf[ BUFSIZ ]; LDAPDebug( LDAP_DEBUG_TRACE, @@ -363,7 +363,7 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) continue; } - if ( PL_strncasecmp( type.bv_val, "rdn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_RDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_RDN, type.bv_len ) == 0 ) { if ( NULL == slapi_entry_get_rdn_const( e )) { slapi_entry_set_rdn( e, value.bv_val ); } @@ -374,13 +374,13 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) /* If SLAPI_STR2ENTRY_NO_ENTRYDN is set, skip entrydn */ if ( (flags & SLAPI_STR2ENTRY_NO_ENTRYDN) && - PL_strncasecmp( type.bv_val, "entrydn", type.bv_len ) == 0 ) { + type.bv_len == SLAPI_ATTR_ENTRYDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_ENTRYDN, type.bv_len ) == 0 ) { if (freeval) slapi_ch_free_string(&value.bv_val); continue; } /* retrieve uniqueid */ - if ( PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ + if ( type.bv_len == SLAPI_ATTR_UNIQUEID_LENGTH && PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ if (e->e_uniqueid != NULL){ LDAPDebug (LDAP_DEBUG_TRACE, @@ -398,10 +398,11 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) continue; } - if (PL_strncasecmp(type.bv_val,"objectclass",type.bv_len) == 0) { - if (PL_strncasecmp(value.bv_val,"ldapsubentry",value.bv_len) == 0) + if (value_state == VALUE_PRESENT && type.bv_len >= SLAPI_ATTR_OBJECTCLASS_LENGTH + && PL_strncasecmp(type.bv_val, SLAPI_ATTR_OBJECTCLASS, type.bv_len) == 0) { + if (value.bv_len >= SLAPI_ATTR_VALUE_SUBENTRY_LENGTH && PL_strncasecmp(value.bv_val,SLAPI_ATTR_VALUE_SUBENTRY,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_LDAPSUBENTRY; - if (PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) + if (value.bv_len >= SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH && PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_FLAG_TOMBSTONE; } diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 2ed91b8..d9437ad 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -396,9 +396,22 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...) #define SLAPI_ATTR_OBJECTCLASS "objectclass" #define SLAPI_ATTR_VALUE_TOMBSTONE "nsTombstone" #define SLAPI_ATTR_VALUE_PARENT_UNIQUEID "nsParentUniqueID" +#define SLAPI_ATTR_VALUE_SUBENTRY "ldapsubentry" #define SLAPI_ATTR_NSCP_ENTRYDN "nscpEntryDN" #define SLAPI_ATTR_ENTRYUSN "entryusn" -#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_DN "dn" +#define SLAPI_ATTR_RDN "rdn" +#define SLAPI_ATTR_UNIQUEID_LENGTH 10 +#define SLAPI_ATTR_OBJECTCLASS_LENGTH 11 +#define SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH 11 +#define SLAPI_ATTR_VALUE_PARENT_UNIQUEID_LENGTH 16 +#define SLAPI_ATTR_VALUE_SUBENTRY_LENGTH 12 +#define SLAPI_ATTR_NSCP_ENTRYDN_LENGTH 11 +#define SLAPI_ATTR_ENTRYUSN_LENGTH 8 +#define SLAPI_ATTR_ENTRYDN_LENGTH 7 +#define SLAPI_ATTR_DN_LENGTH 2 +#define SLAPI_ATTR_RDN_LENGTH 3 /* opaque structures */

1 0

Branch '389-ds-base-1.3.0' - ldap/servers
by Ludwig Krispenz 26 Nov '13

26 Nov '13

ldap/servers/slapd/entry.c | 15 ++++++++------- ldap/servers/slapd/slapi-plugin.h | 15 ++++++++++++++- 2 files changed, 22 insertions(+), 8 deletions(-) New commits: commit b4e73f343ff57b6dbcdf7dfc2d8813a49ab8d71d Author: Ludwig Krispenz <lkrispen(a)redhat.com> Date: Tue Nov 26 09:15:53 2013 +0100 Ticket 47591 - entries with empty objectclass attribute value can be hidden Bug Description: The problem is that for the empty value objectClass;vdcsn-5283b8e0000000c80000;deleted it is compared to "ldapsubentry" and "nstombstone" 'if (PL_strncasecmp(type.bv_val,"tombstone",0)' and with length 0, this is always true. Fix Description: add a check bv_len >= strlen(valuetocompare) or bv_len == strlen(valuetocompare) define constants for lengths https://fedorahosted.org/389/ticket/47591 Reviewed by: richm, thanks diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c index 8e184a6..6b93192 100644 --- a/ldap/servers/slapd/entry.c +++ b/ldap/servers/slapd/entry.c @@ -341,7 +341,7 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) rawdn = NULL; /* Set once in the loop. This won't affect the caller's passed address. */ } - if ( PL_strncasecmp( type.bv_val, "dn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_DN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_DN, type.bv_len ) == 0 ) { if ( slapi_entry_get_dn_const(e)!=NULL ) { char ebuf[ BUFSIZ ]; LDAPDebug( LDAP_DEBUG_TRACE, @@ -377,7 +377,7 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) continue; } - if ( PL_strncasecmp( type.bv_val, "rdn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_RDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_RDN, type.bv_len ) == 0 ) { if ( NULL == slapi_entry_get_rdn_const( e )) { slapi_entry_set_rdn( e, value.bv_val ); } @@ -388,13 +388,13 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) /* If SLAPI_STR2ENTRY_NO_ENTRYDN is set, skip entrydn */ if ( (flags & SLAPI_STR2ENTRY_NO_ENTRYDN) && - PL_strncasecmp( type.bv_val, "entrydn", type.bv_len ) == 0 ) { + type.bv_len == SLAPI_ATTR_ENTRYDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_ENTRYDN, type.bv_len ) == 0 ) { if (freeval) slapi_ch_free_string(&value.bv_val); continue; } /* retrieve uniqueid */ - if ( PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ + if ( type.bv_len == SLAPI_ATTR_UNIQUEID_LENGTH && PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ if (e->e_uniqueid != NULL){ LDAPDebug (LDAP_DEBUG_TRACE, @@ -412,10 +412,11 @@ str2entry_fast( const char *rawdn, char *s, int flags, int read_stateinfo ) continue; } - if (PL_strncasecmp(type.bv_val,"objectclass",type.bv_len) == 0) { - if (PL_strncasecmp(value.bv_val,"ldapsubentry",value.bv_len) == 0) + if (value_state == VALUE_PRESENT && type.bv_len >= SLAPI_ATTR_OBJECTCLASS_LENGTH + && PL_strncasecmp(type.bv_val, SLAPI_ATTR_OBJECTCLASS, type.bv_len) == 0) { + if (value.bv_len >= SLAPI_ATTR_VALUE_SUBENTRY_LENGTH && PL_strncasecmp(value.bv_val,SLAPI_ATTR_VALUE_SUBENTRY,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_LDAPSUBENTRY; - if (PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) + if (value.bv_len >= SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH && PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_FLAG_TOMBSTONE; } diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index bd2da04..12c8ffa 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -400,9 +400,22 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...) #define SLAPI_ATTR_OBJECTCLASS "objectclass" #define SLAPI_ATTR_VALUE_TOMBSTONE "nsTombstone" #define SLAPI_ATTR_VALUE_PARENT_UNIQUEID "nsParentUniqueID" +#define SLAPI_ATTR_VALUE_SUBENTRY "ldapsubentry" #define SLAPI_ATTR_NSCP_ENTRYDN "nscpEntryDN" #define SLAPI_ATTR_ENTRYUSN "entryusn" -#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_DN "dn" +#define SLAPI_ATTR_RDN "rdn" +#define SLAPI_ATTR_UNIQUEID_LENGTH 10 +#define SLAPI_ATTR_OBJECTCLASS_LENGTH 11 +#define SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH 11 +#define SLAPI_ATTR_VALUE_PARENT_UNIQUEID_LENGTH 16 +#define SLAPI_ATTR_VALUE_SUBENTRY_LENGTH 12 +#define SLAPI_ATTR_NSCP_ENTRYDN_LENGTH 11 +#define SLAPI_ATTR_ENTRYUSN_LENGTH 8 +#define SLAPI_ATTR_ENTRYDN_LENGTH 7 +#define SLAPI_ATTR_DN_LENGTH 2 +#define SLAPI_ATTR_RDN_LENGTH 3 /* opaque structures */

1 0

Branch '389-ds-base-1.3.1' - ldap/servers
by Ludwig Krispenz 26 Nov '13

26 Nov '13

ldap/servers/slapd/entry.c | 15 ++++++++------- ldap/servers/slapd/slapi-plugin.h | 15 ++++++++++++++- 2 files changed, 22 insertions(+), 8 deletions(-) New commits: commit 6b47eb4f54ff1e0a8b9c4aa9f3e6c3c3d958fd56 Author: Ludwig Krispenz <lkrispen(a)redhat.com> Date: Tue Nov 26 09:15:53 2013 +0100 Ticket 47591 - entries with empty objectclass attribute value can be hidden Bug Description: The problem is that for the empty value objectClass;vdcsn-5283b8e0000000c80000;deleted it is compared to "ldapsubentry" and "nstombstone" 'if (PL_strncasecmp(type.bv_val,"tombstone",0)' and with length 0, this is always true. Fix Description: add a check bv_len >= strlen(valuetocompare) or bv_len == strlen(valuetocompare) define constants for lengths https://fedorahosted.org/389/ticket/47591 Reviewed by: richm, thanks diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c index e0248c8..60e1dfe 100644 --- a/ldap/servers/slapd/entry.c +++ b/ldap/servers/slapd/entry.c @@ -340,7 +340,7 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in rawdn = NULL; /* Set once in the loop. This won't affect the caller's passed address. */ } - if ( PL_strncasecmp( type.bv_val, "dn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_DN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_DN, type.bv_len ) == 0 ) { if ( slapi_entry_get_dn_const(e)!=NULL ) { char ebuf[ BUFSIZ ]; LDAPDebug( LDAP_DEBUG_TRACE, @@ -376,7 +376,7 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in continue; } - if ( PL_strncasecmp( type.bv_val, "rdn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_RDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_RDN, type.bv_len ) == 0 ) { if ( NULL == slapi_entry_get_rdn_const( e )) { slapi_entry_set_rdn( e, value.bv_val ); } @@ -387,13 +387,13 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in /* If SLAPI_STR2ENTRY_NO_ENTRYDN is set, skip entrydn */ if ( (flags & SLAPI_STR2ENTRY_NO_ENTRYDN) && - PL_strncasecmp( type.bv_val, "entrydn", type.bv_len ) == 0 ) { + type.bv_len == SLAPI_ATTR_ENTRYDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_ENTRYDN, type.bv_len ) == 0 ) { if (freeval) slapi_ch_free_string(&value.bv_val); continue; } /* retrieve uniqueid */ - if ( PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ + if ( type.bv_len == SLAPI_ATTR_UNIQUEID_LENGTH && PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ if (e->e_uniqueid != NULL){ LDAPDebug (LDAP_DEBUG_TRACE, @@ -411,10 +411,11 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in continue; } - if (PL_strncasecmp(type.bv_val,"objectclass",type.bv_len) == 0) { - if (PL_strncasecmp(value.bv_val,"ldapsubentry",value.bv_len) == 0) + if (value_state == VALUE_PRESENT && type.bv_len >= SLAPI_ATTR_OBJECTCLASS_LENGTH + && PL_strncasecmp(type.bv_val, SLAPI_ATTR_OBJECTCLASS, type.bv_len) == 0) { + if (value.bv_len >= SLAPI_ATTR_VALUE_SUBENTRY_LENGTH && PL_strncasecmp(value.bv_val,SLAPI_ATTR_VALUE_SUBENTRY,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_LDAPSUBENTRY; - if (PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) + if (value.bv_len >= SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH && PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_FLAG_TOMBSTONE; } diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 0b2fab8..b77895e 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -451,9 +451,22 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...) #define SLAPI_ATTR_OBJECTCLASS "objectclass" #define SLAPI_ATTR_VALUE_TOMBSTONE "nsTombstone" #define SLAPI_ATTR_VALUE_PARENT_UNIQUEID "nsParentUniqueID" +#define SLAPI_ATTR_VALUE_SUBENTRY "ldapsubentry" #define SLAPI_ATTR_NSCP_ENTRYDN "nscpEntryDN" #define SLAPI_ATTR_ENTRYUSN "entryusn" -#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_DN "dn" +#define SLAPI_ATTR_RDN "rdn" +#define SLAPI_ATTR_UNIQUEID_LENGTH 10 +#define SLAPI_ATTR_OBJECTCLASS_LENGTH 11 +#define SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH 11 +#define SLAPI_ATTR_VALUE_PARENT_UNIQUEID_LENGTH 16 +#define SLAPI_ATTR_VALUE_SUBENTRY_LENGTH 12 +#define SLAPI_ATTR_NSCP_ENTRYDN_LENGTH 11 +#define SLAPI_ATTR_ENTRYUSN_LENGTH 8 +#define SLAPI_ATTR_ENTRYDN_LENGTH 7 +#define SLAPI_ATTR_DN_LENGTH 2 +#define SLAPI_ATTR_RDN_LENGTH 3 /* opaque structures */

1 0

Branch '389-ds-base-1.3.2' - ldap/servers
by Ludwig Krispenz 26 Nov '13

26 Nov '13

ldap/servers/slapd/entry.c | 15 ++++++++------- ldap/servers/slapd/slapi-plugin.h | 15 ++++++++++++++- 2 files changed, 22 insertions(+), 8 deletions(-) New commits: commit 4e469938f2d6526cd89ad30a98f52a5a25101b8c Author: Ludwig Krispenz <lkrispen(a)redhat.com> Date: Tue Nov 26 09:15:53 2013 +0100 Ticket 47591 - entries with empty objectclass attribute value can be hidden Bug Description: The problem is that for the empty value objectClass;vdcsn-5283b8e0000000c80000;deleted it is compared to "ldapsubentry" and "nstombstone" 'if (PL_strncasecmp(type.bv_val,"tombstone",0)' and with length 0, this is always true. Fix Description: add a check bv_len >= strlen(valuetocompare) or bv_len == strlen(valuetocompare) define constants for lengths https://fedorahosted.org/389/ticket/47591 Reviewed by: richm, thanks diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c index 549f294..a7c7010 100644 --- a/ldap/servers/slapd/entry.c +++ b/ldap/servers/slapd/entry.c @@ -361,7 +361,7 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in rawdn = NULL; /* Set once in the loop. This won't affect the caller's passed address. */ } - if ( PL_strncasecmp( type.bv_val, "dn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_DN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_DN, type.bv_len ) == 0 ) { if ( slapi_entry_get_dn_const(e)!=NULL ) { char ebuf[ BUFSIZ ]; LDAPDebug( LDAP_DEBUG_TRACE, @@ -397,7 +397,7 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in continue; } - if ( PL_strncasecmp( type.bv_val, "rdn", type.bv_len ) == 0 ) { + if ( type.bv_len == SLAPI_ATTR_RDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_RDN, type.bv_len ) == 0 ) { if ( NULL == slapi_entry_get_rdn_const( e )) { slapi_entry_set_rdn( e, value.bv_val ); } @@ -408,13 +408,13 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in /* If SLAPI_STR2ENTRY_NO_ENTRYDN is set, skip entrydn */ if ( (flags & SLAPI_STR2ENTRY_NO_ENTRYDN) && - PL_strncasecmp( type.bv_val, "entrydn", type.bv_len ) == 0 ) { + type.bv_len == SLAPI_ATTR_ENTRYDN_LENGTH && PL_strncasecmp( type.bv_val, SLAPI_ATTR_ENTRYDN, type.bv_len ) == 0 ) { if (freeval) slapi_ch_free_string(&value.bv_val); continue; } /* retrieve uniqueid */ - if ( PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ + if ( type.bv_len == SLAPI_ATTR_UNIQUEID_LENGTH && PL_strncasecmp (type.bv_val, SLAPI_ATTR_UNIQUEID, type.bv_len) == 0 ){ if (e->e_uniqueid != NULL){ LDAPDebug (LDAP_DEBUG_TRACE, @@ -432,10 +432,11 @@ str2entry_fast( const char *rawdn, const Slapi_RDN *srdn, char *s, int flags, in continue; } - if (PL_strncasecmp(type.bv_val,"objectclass",type.bv_len) == 0) { - if (PL_strncasecmp(value.bv_val,"ldapsubentry",value.bv_len) == 0) + if (value_state == VALUE_PRESENT && type.bv_len >= SLAPI_ATTR_OBJECTCLASS_LENGTH + && PL_strncasecmp(type.bv_val, SLAPI_ATTR_OBJECTCLASS, type.bv_len) == 0) { + if (value.bv_len >= SLAPI_ATTR_VALUE_SUBENTRY_LENGTH && PL_strncasecmp(value.bv_val,SLAPI_ATTR_VALUE_SUBENTRY,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_LDAPSUBENTRY; - if (PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) + if (value.bv_len >= SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH && PL_strncasecmp(value.bv_val, SLAPI_ATTR_VALUE_TOMBSTONE,value.bv_len) == 0) e->e_flags |= SLAPI_ENTRY_FLAG_TOMBSTONE; } diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 5c5b10b..b835e90 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -475,9 +475,22 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...) #define SLAPI_ATTR_OBJECTCLASS "objectclass" #define SLAPI_ATTR_VALUE_TOMBSTONE "nsTombstone" #define SLAPI_ATTR_VALUE_PARENT_UNIQUEID "nsParentUniqueID" +#define SLAPI_ATTR_VALUE_SUBENTRY "ldapsubentry" #define SLAPI_ATTR_NSCP_ENTRYDN "nscpEntryDN" #define SLAPI_ATTR_ENTRYUSN "entryusn" -#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_ENTRYDN "entrydn" +#define SLAPI_ATTR_DN "dn" +#define SLAPI_ATTR_RDN "rdn" +#define SLAPI_ATTR_UNIQUEID_LENGTH 10 +#define SLAPI_ATTR_OBJECTCLASS_LENGTH 11 +#define SLAPI_ATTR_VALUE_TOMBSTONE_LENGTH 11 +#define SLAPI_ATTR_VALUE_PARENT_UNIQUEID_LENGTH 16 +#define SLAPI_ATTR_VALUE_SUBENTRY_LENGTH 12 +#define SLAPI_ATTR_NSCP_ENTRYDN_LENGTH 11 +#define SLAPI_ATTR_ENTRYUSN_LENGTH 8 +#define SLAPI_ATTR_ENTRYDN_LENGTH 7 +#define SLAPI_ATTR_DN_LENGTH 2 +#define SLAPI_ATTR_RDN_LENGTH 3 /* opaque structures */

1 0

ldap/servers
by Richard Allen Megginson 26 Nov '13

26 Nov '13

ldap/servers/slapd/ssl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit e66c4cecc47eff659a72a51c1e1722fb41c1dfbc Author: Rich Megginson <rmeggins(a)redhat.com> Date: Tue Nov 26 08:14:07 2013 -0700 Ticket #47596 attrcrypt fails to find unlocked key https://fedorahosted.org/389/ticket/47596 Reviewed by: nkinder (Thanks!) Branch: master Fix Description: Additional fix to the previous fix. As it turns out, the function PK11_IsLoggedIn() only returns true if the slot has been unlocked with a pin or password. If the slot does not need a login at all, because the cert/key db has no password, PK11_IsLoggedIn will return false. The code must check for PK11_NeedLogin too. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 8b80acb..61809aa 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -1602,7 +1602,7 @@ slapd_get_unlocked_key_for_cert(CERTCertificate *cert, void *pin_arg) slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Missing slot for slot list element for certificate [%s]\n", certsubject); - } else if (PK11_IsLoggedIn(slot, pin_arg)) { + } else if (!PK11_NeedLogin(slot) || PK11_IsLoggedIn(slot, pin_arg)) { key = PK11_FindKeyByDERCert(slot, cert, pin_arg); slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Found unlocked slot [%s] token [%s] for certificate [%s]\n",

1 0

Branch '389-ds-base-1.3.2' - ldap/servers
by Richard Allen Megginson 26 Nov '13

26 Nov '13

ldap/servers/slapd/ssl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit f608a943745e51fe4b5dbfb18bada2e2d13e0d6a Author: Rich Megginson <rmeggins(a)redhat.com> Date: Tue Nov 26 08:14:07 2013 -0700 Ticket #47596 attrcrypt fails to find unlocked key https://fedorahosted.org/389/ticket/47596 Reviewed by: nkinder (Thanks!) Branch: 389-ds-base-1.3.2 Fix Description: Additional fix to the previous fix. As it turns out, the function PK11_IsLoggedIn() only returns true if the slot has been unlocked with a pin or password. If the slot does not need a login at all, because the cert/key db has no password, PK11_IsLoggedIn will return false. The code must check for PK11_NeedLogin too. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no (cherry picked from commit e66c4cecc47eff659a72a51c1e1722fb41c1dfbc) diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 8b80acb..61809aa 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -1602,7 +1602,7 @@ slapd_get_unlocked_key_for_cert(CERTCertificate *cert, void *pin_arg) slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Missing slot for slot list element for certificate [%s]\n", certsubject); - } else if (PK11_IsLoggedIn(slot, pin_arg)) { + } else if (!PK11_NeedLogin(slot) || PK11_IsLoggedIn(slot, pin_arg)) { key = PK11_FindKeyByDERCert(slot, cert, pin_arg); slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Found unlocked slot [%s] token [%s] for certificate [%s]\n",

1 0

Branch '389-ds-base-1.3.1' - ldap/servers
by Richard Allen Megginson 26 Nov '13

26 Nov '13

ldap/servers/slapd/ssl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 5d2a20b4881d5374a9088ed1504b2d7e753976bb Author: Rich Megginson <rmeggins(a)redhat.com> Date: Tue Nov 26 08:14:07 2013 -0700 Ticket #47596 attrcrypt fails to find unlocked key https://fedorahosted.org/389/ticket/47596 Reviewed by: nkinder (Thanks!) Branch: 389-ds-base-1.3.1 Fix Description: Additional fix to the previous fix. As it turns out, the function PK11_IsLoggedIn() only returns true if the slot has been unlocked with a pin or password. If the slot does not need a login at all, because the cert/key db has no password, PK11_IsLoggedIn will return false. The code must check for PK11_NeedLogin too. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no (cherry picked from commit e66c4cecc47eff659a72a51c1e1722fb41c1dfbc) (cherry picked from commit f608a943745e51fe4b5dbfb18bada2e2d13e0d6a) diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 8b80acb..61809aa 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -1602,7 +1602,7 @@ slapd_get_unlocked_key_for_cert(CERTCertificate *cert, void *pin_arg) slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Missing slot for slot list element for certificate [%s]\n", certsubject); - } else if (PK11_IsLoggedIn(slot, pin_arg)) { + } else if (!PK11_NeedLogin(slot) || PK11_IsLoggedIn(slot, pin_arg)) { key = PK11_FindKeyByDERCert(slot, cert, pin_arg); slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Found unlocked slot [%s] token [%s] for certificate [%s]\n",

1 0

Branch '389-ds-base-1.2.11' - ldap/servers
by Richard Allen Megginson 26 Nov '13

26 Nov '13

ldap/servers/slapd/ssl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 326d636ed48142acd418073c1e22061e6b7757cc Author: Rich Megginson <rmeggins(a)redhat.com> Date: Tue Nov 26 08:14:07 2013 -0700 Ticket #47596 attrcrypt fails to find unlocked key https://fedorahosted.org/389/ticket/47596 Reviewed by: nkinder (Thanks!) Branch: 389-ds-base-1.2.11 Fix Description: Additional fix to the previous fix. As it turns out, the function PK11_IsLoggedIn() only returns true if the slot has been unlocked with a pin or password. If the slot does not need a login at all, because the cert/key db has no password, PK11_IsLoggedIn will return false. The code must check for PK11_NeedLogin too. Platforms tested: RHEL6 x86_64 Flag Day: no Doc impact: no (cherry picked from commit e66c4cecc47eff659a72a51c1e1722fb41c1dfbc) (cherry picked from commit f608a943745e51fe4b5dbfb18bada2e2d13e0d6a) (cherry picked from commit 5d2a20b4881d5374a9088ed1504b2d7e753976bb) (cherry picked from commit 33df11ea7a9cbef5f78fe0d43da8a1c77b0a6c98) diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 8b80acb..61809aa 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -1602,7 +1602,7 @@ slapd_get_unlocked_key_for_cert(CERTCertificate *cert, void *pin_arg) slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Missing slot for slot list element for certificate [%s]\n", certsubject); - } else if (PK11_IsLoggedIn(slot, pin_arg)) { + } else if (!PK11_NeedLogin(slot) || PK11_IsLoggedIn(slot, pin_arg)) { key = PK11_FindKeyByDERCert(slot, cert, pin_arg); slapi_log_error(SLAPI_LOG_TRACE, "slapd_get_unlocked_key_for_cert", "Found unlocked slot [%s] token [%s] for certificate [%s]\n",

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits November 2013