include/libadminutil/admutil.h | 6 ++++
lib/libadminutil/admutil.c | 50 +++++++++++++++++++++++++++++++++++++++++
lib/libadmsslutil/admsslutil.c | 7 +++++
3 files changed, 63 insertions(+)
New commits:
commit 4896a04a1d510116afc346bff2c0c3e67a0348d8
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Oct 29 14:26:25 2014 -0400
Ticket 47929 - Adminutil - do not use SSL3 by default
Bug Description: SSLv3 is no longer safe to use
Fix Description: Set the min and max range to use tls 1.1 and up by default.
Also allow the mix/max ssl versions to be customized.
https://fedorahosted.org/389/ticket/47462
Reviewed by: nhosoi(Thanks!)
diff --git a/include/libadminutil/admutil.h b/include/libadminutil/admutil.h
index 70cde0d..98189e7 100644
--- a/include/libadminutil/admutil.h
+++ b/include/libadminutil/admutil.h
@@ -150,6 +150,12 @@ admldapBuildInfo(char* configRoot, int *errorcode);
PR_IMPLEMENT(void)
destroyAdmldap(AdmldapInfo info);
+PR_IMPLEMENT(int)
+admldapGetSSLMin(AdmldapInfo info);
+
+PR_IMPLEMENT(int)
+admldapGetSSLMax(AdmldapInfo info);
+
PR_IMPLEMENT(char*)
admldapGetHost(AdmldapInfo info);
diff --git a/lib/libadminutil/admutil.c b/lib/libadminutil/admutil.c
index f896655..c8e4f6f 100644
--- a/lib/libadminutil/admutil.c
+++ b/lib/libadminutil/admutil.c
@@ -69,6 +69,8 @@
#include "libadminutil/admutil-int.h"
#include "libadminutil/distadm.h"
#include <ssl.h>
+#include "sslproto.h"
+#include "nss.h"
#if defined(USE_OPENLDAP)
#include <lber.h>
#else
@@ -1527,6 +1529,54 @@ destroyAdmldap(AdmldapInfo info)
}
}
+static int
+getSSLVersion(char *version)
+{
+ if(version == NULL){
+ return 0;
+ }
+
+ if (!strcasecmp(version, "ssl3")){
+ return SSL_LIBRARY_VERSION_3_0;
+ } else if (!strcasecmp(version, "tls1.0")){
+ return SSL_LIBRARY_VERSION_TLS_1_0;
+ } else if (!strcasecmp(version, "tls1.1")){
+ return SSL_LIBRARY_VERSION_TLS_1_1;
+ } else if (!strcasecmp(version, "tls1.2")){
+ return SSL_LIBRARY_VERSION_TLS_1_2;
+ } else if (!strcasecmp(version, "tls1.3")){
+ return SSL_LIBRARY_VERSION_TLS_1_3;
+ } else {
+ return 0;
+ }
+}
+
+PR_IMPLEMENT(int)
+admldapGetSSLMin(AdmldapInfo info)
+{
+ AdmldapHdnlPtr admInfo = (AdmldapHdnlPtr)info;
+ int version = getSSLVersion(treeFindValueAt(admInfo->configInfo, "sslVersionMin", 0));
+
+ if(!version){
+ return SSL_LIBRARY_VERSION_TLS_1_1;
+ } else {
+ return version;
+ }
+}
+
+PR_IMPLEMENT(int)
+admldapGetSSLMax(AdmldapInfo info)
+{
+ AdmldapHdnlPtr admInfo = (AdmldapHdnlPtr)info;
+ int version = getSSLVersion(treeFindValueAt(admInfo->configInfo, "sslVersionMax", 0));
+
+ if(!version){
+ return SSL_LIBRARY_VERSION_TLS_1_2;
+ } else {
+ return version;
+ }
+}
+
PR_IMPLEMENT(char*)
admldapGetHost(AdmldapInfo info)
{
diff --git a/lib/libadmsslutil/admsslutil.c b/lib/libadmsslutil/admsslutil.c
index 1ba0dfa..8c4c52b 100644
--- a/lib/libadmsslutil/admsslutil.c
+++ b/lib/libadmsslutil/admsslutil.c
@@ -131,6 +131,8 @@ static int initNSS(const char *securitydir, AdmldapInfo info)
char *custom_file_copy = NULL;
PRUint32 flags = 0;
char *db_name;
+ SSLVersionRange range;
+ SSLProtocolVariant variant;
/* PKSC11 module must be configured before NSS is initialized */
db_name = PL_strdup("internal (software) ");
@@ -166,6 +168,11 @@ static int initNSS(const char *securitydir, AdmldapInfo info)
return -1;
}
+ range.min = admldapGetSSLMin(info);
+ range.max = admldapGetSSLMax(info);
+ variant = ssl_variant_stream;
+ SSL_VersionRangeSetDefault(variant, &range);
+
/* set export policy */
if(SSLPLCY_Install() != PR_SUCCESS) {
return -1;
1
0
admserv/cfgstuff/console.conf.in | 2 +-
mod_admserv/mod_admserv.c | 27 +++++++++++++++------------
2 files changed, 16 insertions(+), 13 deletions(-)
New commits:
commit dbf1a2e74952e0a36d15b674293fc3071eaf16a7
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Oct 29 13:54:56 2014 -0400
Ticket 47929 - Admin Server - disable SSLv3 by default
Bug Description: SSLv3 is no longer safe to use.
Fix Description: Set the NSS protocol to TLSv1.1 by default, and also
properly set the SSL min/max version range(which can
also be customized in adm.conf). Also made sure the
new range is properly set and initialized.
https://fedorahosted.org/389/ticket/47929
Reviewed by: nhosoi(Thanks!)
diff --git a/admserv/cfgstuff/console.conf.in b/admserv/cfgstuff/console.conf.in
index 5f22439..0b7f106 100644
--- a/admserv/cfgstuff/console.conf.in
+++ b/admserv/cfgstuff/console.conf.in
@@ -108,7 +108,7 @@ NSSCertificateDatabase @securitydir@
# SSL 3 ciphers. SSL 2 is disabled by default.
NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha
-NSSProtocol SSLv3,TLSv1
+NSSProtocol TLSv1.1
# Client Authentication (Type):
# Client certificate verification type. Types are none, optional and
diff --git a/mod_admserv/mod_admserv.c b/mod_admserv/mod_admserv.c
index 3fc19ff..2ffc1fb 100644
--- a/mod_admserv/mod_admserv.c
+++ b/mod_admserv/mod_admserv.c
@@ -145,9 +145,11 @@ module AP_MODULE_DECLARE_DATA admserv_module;
static int sync_task_sie_data(const char *name, char *query, void *arg, request_rec *r);
static int change_sie_password(const char *name, char *query, void* arg, request_rec *r);
static int create_auth_users_cache_entry(char *user, char *userDN, const char *userPW, char *ldapURL);
-
+static int sslinit(AdmldapInfo info, const char *configdir);
static int admserv_check_user_id(request_rec *r);
+static int NSS_inited = 0;
+
/* per-process config structure */
typedef struct {
int nInitCount;
@@ -513,6 +515,13 @@ openLDAPConnection(LdapServerData *data)
{
LDAP *server;
+ if(data->secure && !NSS_inited){
+ AdmldapInfo info;
+ int error = 0;
+
+ info = admldapBuildInfo(configdir, &error);
+ sslinit(info, configdir);
+ }
if (!(server = util_ldap_init(data->securitydir, NULL,
data->host, data->port, data->secure, 1, NULL))) {
ap_log_error(APLOG_MARK, APLOG_CRIT, 0 /* status */, NULL,
@@ -779,23 +788,17 @@ extractLdapServerData(LdapServerData *data, char *ldapURL, const server_rec *s)
static int
sslinit(AdmldapInfo info, const char *configdir)
{
- if (!NSS_IsInitialized()) {
- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0 /* status */, NULL,
- "sslinit: doing NSS initialization");
- /* mod_nss is used when we are a TLS/SSL server - mod_nss starts up before we do
- and will set up all of the TLS/SSL stuff */
- /* if we are acting as simply a TLS/SSL client to the directory server,
- we still have to perform our own TLS/SSL client init */
+ if(!NSS_inited){
if (ADMSSL_Init(info, (char *)configdir, 0)) {
ap_log_error(APLOG_MARK, APLOG_CRIT, 0 /* status */, NULL,
- "sslinit: NSS is required to use LDAPS, but security initialization failed [%d:%s]. Cannot start server",
+ "sslinit: NSS is required to use LDAPS, but security initialization failed [%d:%s].",
PR_GetError(), SSL_Strerror(PR_GetError()));
exit(1);
}
- } else {
- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0 /* status */, NULL,
- "sslinit: mod_nss has been started and initialized");
+ NSS_inited = 1;
}
+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0 /* status */, NULL,
+ "sslinit: mod_nss has been started and initialized");
return 1;
}
1
0
24 Oct '14
dirsrvtests/tickets/ticket47937_test.py | 237 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/dna/dna.c | 8 +
ldap/servers/slapd/entrywsi.c | 5
3 files changed, 248 insertions(+), 2 deletions(-)
New commits:
commit 896424f9bfa90c55358ab23bc28adc2b1ba4a066
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Oct 24 14:14:25 2014 -0400
Ticket 47937 - Crash in entry_add_present_values_wsi_multi_valued
Bug Description: If the DNA plugin uses an invlid attribute for "dnaType"
this can lead to crash when DNA attempts to update this
attribute.
Fix Description: In the DNA plugin, verify that the attribute exists.
Also in entrywsi.c, pass in the type from the attribute
struct(which does do some basic normalization).
https://fedorahosted.org/389/ticket/47937
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 3cdf0eb571d120573f2cda2c140fd2b4215c94fa)
diff --git a/dirsrvtests/tickets/ticket47937_test.py b/dirsrvtests/tickets/ticket47937_test.py
new file mode 100644
index 0000000..09ee714
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47937_test.py
@@ -0,0 +1,237 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47937(topology):
+ """
+ Test that DNA plugin only accepts valid attributes for "dnaType"
+ """
+
+ log.info("Creating \"ou=people\"...")
+ try:
+ topology.standalone.add_s(Entry(('ou=people,' + SUFFIX, {
+ 'objectclass': 'top organizationalunit'.split(),
+ 'ou': 'people'
+ })))
+
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people org unit: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating \"ou=ranges\"...")
+ try:
+ topology.standalone.add_s(Entry(('ou=ranges,' + SUFFIX, {
+ 'objectclass': 'top organizationalunit'.split(),
+ 'ou': 'ranges'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=ranges org unit: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating \"cn=entry\"...")
+ try:
+ topology.standalone.add_s(Entry(('cn=entry,ou=people,' + SUFFIX, {
+ 'objectclass': 'top groupofuniquenames'.split(),
+ 'cn': 'entry'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add test entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating DNA shared config entry...")
+ try:
+ topology.standalone.add_s(Entry(('dnaHostname=localhost.localdomain+dnaPortNum=389,ou=ranges,%s' % SUFFIX, {
+ 'objectclass': 'top dnaSharedConfig'.split(),
+ 'dnaHostname': 'localhost.localdomain',
+ 'dnaPortNum': '389',
+ 'dnaSecurePortNum': '636',
+ 'dnaRemainingValues': '9501'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add shared config entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Add dna plugin config entry...")
+ try:
+ topology.standalone.add_s(Entry(('cn=dna config,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config', {
+ 'objectclass': 'top dnaPluginConfig'.split(),
+ 'dnaType': 'description',
+ 'dnaMaxValue': '10000',
+ 'dnaMagicRegen': '0',
+ 'dnaFilter': '(objectclass=top)',
+ 'dnaScope': 'ou=people,%s' % SUFFIX,
+ 'dnaNextValue': '500',
+ 'dnaSharedCfgDN': 'ou=ranges,%s' % SUFFIX
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add DNA config entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Enable the DNA plugin...")
+ try:
+ topology.standalone.plugins.enable(name=PLUGIN_DNA)
+ except e:
+ log.error("Failed to enable DNA Plugin: error " + e.message['desc'])
+ assert False
+
+ log.info("Restarting the server...")
+ topology.standalone.stop(timeout=120)
+ time.sleep(1)
+ topology.standalone.start(timeout=120)
+ time.sleep(3)
+
+ log.info("Apply an invalid attribute to the DNA config(dnaType: foo)...")
+
+ try:
+ topology.standalone.modify_s('cn=dna config,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config',
+ [(ldap.MOD_REPLACE, 'dnaType', 'foo')])
+ except ldap.LDAPError, e:
+ log.info('Operation failed as expected (error: %s)' % e.message['desc'])
+ else:
+ log.error('Operation incorectly succeeded! Test Failed!')
+ assert False
+
+ topology.standalone.log.info('Test 47937 Passed.')
+
+
+def test_ticket47937_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47937(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/dna/dna.c b/ldap/servers/plugins/dna/dna.c
index 078b35c..91575c0 100644
--- a/ldap/servers/plugins/dna/dna.c
+++ b/ldap/servers/plugins/dna/dna.c
@@ -960,6 +960,14 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry * e, int apply)
}
for (i = 0; entry->types && entry->types[i]; i++) {
+ if (!slapi_attr_syntax_exists(entry->types[i])){
+ slapi_log_error(SLAPI_LOG_FATAL, DNA_PLUGIN_SUBSYSTEM,
+ "dna_parse_config_entry: dnaType (%s) does "
+ "not exist.\n",
+ entry->types[i]);
+ ret = DNA_FAILURE;
+ goto bail;
+ }
slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
"----------> %s [%s]\n", DNA_TYPE, entry->types[i]);
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index bd9196f..c8055d8 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -423,6 +423,7 @@ static void resolve_attribute_state_present_to_deleted(Slapi_Entry *e, Slapi_Att
static void resolve_attribute_state_to_present_or_deleted(Slapi_Entry *e, Slapi_Attr *a, Slapi_Value **valuestoupdate, int attribute_state);
static int entry_add_present_values_wsi_single_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags);
static int entry_add_present_values_wsi_multi_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags);
+
static int
entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags)
{
@@ -439,11 +440,11 @@ entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **b
if(slapi_attr_flag_is_set(a,SLAPI_ATTR_FLAG_SINGLE))
{
- retVal = entry_add_present_values_wsi_single_valued( e, type, bervals, csn, urp, 0 );
+ retVal = entry_add_present_values_wsi_single_valued( e, a->a_type, bervals, csn, urp, 0 );
}
else
{
- retVal = entry_add_present_values_wsi_multi_valued( e, type, bervals, csn, urp, 0 );
+ retVal = entry_add_present_values_wsi_multi_valued( e, a->a_type, bervals, csn, urp, 0 );
}
return retVal;
}
1
0
24 Oct '14
dirsrvtests/tickets/ticket47937_test.py | 237 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/dna/dna.c | 8 +
ldap/servers/slapd/entrywsi.c | 5
3 files changed, 248 insertions(+), 2 deletions(-)
New commits:
commit 738d985dc6f52660e13d94a118271ce288a75ea6
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Oct 24 14:14:25 2014 -0400
Ticket 47937 - Crash in entry_add_present_values_wsi_multi_valued
Bug Description: If the DNA plugin uses an invlid attribute for "dnaType"
this can lead to crash when DNA attempts to update this
attribute.
Fix Description: In the DNA plugin, verify that the attribute exists.
Also in entrywsi.c, pass in the type from the attribute
struct(which does do some basic normalization).
https://fedorahosted.org/389/ticket/47937
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 3cdf0eb571d120573f2cda2c140fd2b4215c94fa)
diff --git a/dirsrvtests/tickets/ticket47937_test.py b/dirsrvtests/tickets/ticket47937_test.py
new file mode 100644
index 0000000..09ee714
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47937_test.py
@@ -0,0 +1,237 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47937(topology):
+ """
+ Test that DNA plugin only accepts valid attributes for "dnaType"
+ """
+
+ log.info("Creating \"ou=people\"...")
+ try:
+ topology.standalone.add_s(Entry(('ou=people,' + SUFFIX, {
+ 'objectclass': 'top organizationalunit'.split(),
+ 'ou': 'people'
+ })))
+
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people org unit: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating \"ou=ranges\"...")
+ try:
+ topology.standalone.add_s(Entry(('ou=ranges,' + SUFFIX, {
+ 'objectclass': 'top organizationalunit'.split(),
+ 'ou': 'ranges'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=ranges org unit: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating \"cn=entry\"...")
+ try:
+ topology.standalone.add_s(Entry(('cn=entry,ou=people,' + SUFFIX, {
+ 'objectclass': 'top groupofuniquenames'.split(),
+ 'cn': 'entry'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add test entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating DNA shared config entry...")
+ try:
+ topology.standalone.add_s(Entry(('dnaHostname=localhost.localdomain+dnaPortNum=389,ou=ranges,%s' % SUFFIX, {
+ 'objectclass': 'top dnaSharedConfig'.split(),
+ 'dnaHostname': 'localhost.localdomain',
+ 'dnaPortNum': '389',
+ 'dnaSecurePortNum': '636',
+ 'dnaRemainingValues': '9501'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add shared config entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Add dna plugin config entry...")
+ try:
+ topology.standalone.add_s(Entry(('cn=dna config,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config', {
+ 'objectclass': 'top dnaPluginConfig'.split(),
+ 'dnaType': 'description',
+ 'dnaMaxValue': '10000',
+ 'dnaMagicRegen': '0',
+ 'dnaFilter': '(objectclass=top)',
+ 'dnaScope': 'ou=people,%s' % SUFFIX,
+ 'dnaNextValue': '500',
+ 'dnaSharedCfgDN': 'ou=ranges,%s' % SUFFIX
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add DNA config entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Enable the DNA plugin...")
+ try:
+ topology.standalone.plugins.enable(name=PLUGIN_DNA)
+ except e:
+ log.error("Failed to enable DNA Plugin: error " + e.message['desc'])
+ assert False
+
+ log.info("Restarting the server...")
+ topology.standalone.stop(timeout=120)
+ time.sleep(1)
+ topology.standalone.start(timeout=120)
+ time.sleep(3)
+
+ log.info("Apply an invalid attribute to the DNA config(dnaType: foo)...")
+
+ try:
+ topology.standalone.modify_s('cn=dna config,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config',
+ [(ldap.MOD_REPLACE, 'dnaType', 'foo')])
+ except ldap.LDAPError, e:
+ log.info('Operation failed as expected (error: %s)' % e.message['desc'])
+ else:
+ log.error('Operation incorectly succeeded! Test Failed!')
+ assert False
+
+ topology.standalone.log.info('Test 47937 Passed.')
+
+
+def test_ticket47937_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47937(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/dna/dna.c b/ldap/servers/plugins/dna/dna.c
index bc280a4..75edca8 100644
--- a/ldap/servers/plugins/dna/dna.c
+++ b/ldap/servers/plugins/dna/dna.c
@@ -936,6 +936,14 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry * e, int apply)
}
for (i = 0; entry->types && entry->types[i]; i++) {
+ if (!slapi_attr_syntax_exists(entry->types[i])){
+ slapi_log_error(SLAPI_LOG_FATAL, DNA_PLUGIN_SUBSYSTEM,
+ "dna_parse_config_entry: dnaType (%s) does "
+ "not exist.\n",
+ entry->types[i]);
+ ret = DNA_FAILURE;
+ goto bail;
+ }
slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
"----------> %s [%s]\n", DNA_TYPE, entry->types[i]);
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 7039bfc..41afe1a 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -423,6 +423,7 @@ static void resolve_attribute_state_present_to_deleted(Slapi_Entry *e, Slapi_Att
static void resolve_attribute_state_to_present_or_deleted(Slapi_Entry *e, Slapi_Attr *a, Slapi_Value **valuestoupdate, int attribute_state);
static int entry_add_present_values_wsi_single_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags);
static int entry_add_present_values_wsi_multi_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags);
+
static int
entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags)
{
@@ -439,11 +440,11 @@ entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **b
if(slapi_attr_flag_is_set(a,SLAPI_ATTR_FLAG_SINGLE))
{
- retVal = entry_add_present_values_wsi_single_valued( e, type, bervals, csn, urp, 0 );
+ retVal = entry_add_present_values_wsi_single_valued( e, a->a_type, bervals, csn, urp, 0 );
}
else
{
- retVal = entry_add_present_values_wsi_multi_valued( e, type, bervals, csn, urp, 0 );
+ retVal = entry_add_present_values_wsi_multi_valued( e, a->a_type, bervals, csn, urp, 0 );
}
return retVal;
}
1
0
dirsrvtests/tickets/ticket47937_test.py | 237 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/dna/dna.c | 8 +
ldap/servers/slapd/entrywsi.c | 5
3 files changed, 248 insertions(+), 2 deletions(-)
New commits:
commit 3cdf0eb571d120573f2cda2c140fd2b4215c94fa
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Oct 24 14:14:25 2014 -0400
Ticket 47937 - Crash in entry_add_present_values_wsi_multi_valued
Bug Description: If the DNA plugin uses an invlid attribute for "dnaType"
this can lead to crash when DNA attempts to update this
attribute.
Fix Description: In the DNA plugin, verify that the attribute exists.
Also in entrywsi.c, pass in the type from the attribute
struct(which does do some basic normalization).
https://fedorahosted.org/389/ticket/47937
Reviewed by: nhosoi(Thanks!)
diff --git a/dirsrvtests/tickets/ticket47937_test.py b/dirsrvtests/tickets/ticket47937_test.py
new file mode 100644
index 0000000..09ee714
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47937_test.py
@@ -0,0 +1,237 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47937(topology):
+ """
+ Test that DNA plugin only accepts valid attributes for "dnaType"
+ """
+
+ log.info("Creating \"ou=people\"...")
+ try:
+ topology.standalone.add_s(Entry(('ou=people,' + SUFFIX, {
+ 'objectclass': 'top organizationalunit'.split(),
+ 'ou': 'people'
+ })))
+
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people org unit: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating \"ou=ranges\"...")
+ try:
+ topology.standalone.add_s(Entry(('ou=ranges,' + SUFFIX, {
+ 'objectclass': 'top organizationalunit'.split(),
+ 'ou': 'ranges'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=ranges org unit: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating \"cn=entry\"...")
+ try:
+ topology.standalone.add_s(Entry(('cn=entry,ou=people,' + SUFFIX, {
+ 'objectclass': 'top groupofuniquenames'.split(),
+ 'cn': 'entry'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add test entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Creating DNA shared config entry...")
+ try:
+ topology.standalone.add_s(Entry(('dnaHostname=localhost.localdomain+dnaPortNum=389,ou=ranges,%s' % SUFFIX, {
+ 'objectclass': 'top dnaSharedConfig'.split(),
+ 'dnaHostname': 'localhost.localdomain',
+ 'dnaPortNum': '389',
+ 'dnaSecurePortNum': '636',
+ 'dnaRemainingValues': '9501'
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add shared config entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Add dna plugin config entry...")
+ try:
+ topology.standalone.add_s(Entry(('cn=dna config,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config', {
+ 'objectclass': 'top dnaPluginConfig'.split(),
+ 'dnaType': 'description',
+ 'dnaMaxValue': '10000',
+ 'dnaMagicRegen': '0',
+ 'dnaFilter': '(objectclass=top)',
+ 'dnaScope': 'ou=people,%s' % SUFFIX,
+ 'dnaNextValue': '500',
+ 'dnaSharedCfgDN': 'ou=ranges,%s' % SUFFIX
+ })))
+
+ except ldap.LDAPError, e:
+ log.error('Failed to add DNA config entry: error ' + e.message['desc'])
+ assert False
+
+ log.info("Enable the DNA plugin...")
+ try:
+ topology.standalone.plugins.enable(name=PLUGIN_DNA)
+ except e:
+ log.error("Failed to enable DNA Plugin: error " + e.message['desc'])
+ assert False
+
+ log.info("Restarting the server...")
+ topology.standalone.stop(timeout=120)
+ time.sleep(1)
+ topology.standalone.start(timeout=120)
+ time.sleep(3)
+
+ log.info("Apply an invalid attribute to the DNA config(dnaType: foo)...")
+
+ try:
+ topology.standalone.modify_s('cn=dna config,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config',
+ [(ldap.MOD_REPLACE, 'dnaType', 'foo')])
+ except ldap.LDAPError, e:
+ log.info('Operation failed as expected (error: %s)' % e.message['desc'])
+ else:
+ log.error('Operation incorectly succeeded! Test Failed!')
+ assert False
+
+ topology.standalone.log.info('Test 47937 Passed.')
+
+
+def test_ticket47937_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47937(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/dna/dna.c b/ldap/servers/plugins/dna/dna.c
index bc280a4..75edca8 100644
--- a/ldap/servers/plugins/dna/dna.c
+++ b/ldap/servers/plugins/dna/dna.c
@@ -936,6 +936,14 @@ dna_parse_config_entry(Slapi_PBlock *pb, Slapi_Entry * e, int apply)
}
for (i = 0; entry->types && entry->types[i]; i++) {
+ if (!slapi_attr_syntax_exists(entry->types[i])){
+ slapi_log_error(SLAPI_LOG_FATAL, DNA_PLUGIN_SUBSYSTEM,
+ "dna_parse_config_entry: dnaType (%s) does "
+ "not exist.\n",
+ entry->types[i]);
+ ret = DNA_FAILURE;
+ goto bail;
+ }
slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
"----------> %s [%s]\n", DNA_TYPE, entry->types[i]);
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 7039bfc..41afe1a 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -423,6 +423,7 @@ static void resolve_attribute_state_present_to_deleted(Slapi_Entry *e, Slapi_Att
static void resolve_attribute_state_to_present_or_deleted(Slapi_Entry *e, Slapi_Attr *a, Slapi_Value **valuestoupdate, int attribute_state);
static int entry_add_present_values_wsi_single_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags);
static int entry_add_present_values_wsi_multi_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags);
+
static int
entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags)
{
@@ -439,11 +440,11 @@ entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **b
if(slapi_attr_flag_is_set(a,SLAPI_ATTR_FLAG_SINGLE))
{
- retVal = entry_add_present_values_wsi_single_valued( e, type, bervals, csn, urp, 0 );
+ retVal = entry_add_present_values_wsi_single_valued( e, a->a_type, bervals, csn, urp, 0 );
}
else
{
- retVal = entry_add_present_values_wsi_multi_valued( e, type, bervals, csn, urp, 0 );
+ retVal = entry_add_present_values_wsi_multi_valued( e, a->a_type, bervals, csn, urp, 0 );
}
return retVal;
}
1
0
Branch '389-ds-base-1.3.3' - 2 commits - dirsrvtests/tickets ldap/servers
by Noriko Hosoi 23 Oct '14
by Noriko Hosoi 23 Oct '14
23 Oct '14
dirsrvtests/tickets/ticket47838_test.py | 165 ++++++++++++++
ldap/servers/slapd/fedse.c | 43 +++
ldap/servers/slapd/ssl.c | 360 ++++++++++++++++++++------------
3 files changed, 427 insertions(+), 141 deletions(-)
New commits:
commit b7b498108e08309d9da2c56528590bb74ddc8cc6
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Oct 22 17:11:17 2014 -0700
Ticket 47928 - CI test: added test cases for ticket 47928
Description:
test_ticket47928_run_0 - Test Case 13 - No SSL version config parameters
test_ticket47928_run_1 - Test Case 14 - No nsSSL3, nsTLS1; sslVersionMin > sslVersionMax
test_ticket47928_run_2 - Test Case 15 - nsSSL3: on; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
test_ticket47928_run_3 - Test Case 16 - nsSSL3: on; nsTLS1: off; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
(cherry picked from commit 958be1271ab440a15649046e7927b44b57a4e19a)
diff --git a/dirsrvtests/tickets/ticket47838_test.py b/dirsrvtests/tickets/ticket47838_test.py
index c98c36e..50a4b50 100644
--- a/dirsrvtests/tickets/ticket47838_test.py
+++ b/dirsrvtests/tickets/ticket47838_test.py
@@ -201,7 +201,8 @@ def test_ticket47838_init(topology):
log.info("\n######################### enable SSL in the directory server with all ciphers ######################\n")
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
- topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3', 'on'),
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3', 'off'),
+ (ldap.MOD_REPLACE, 'nsTLS1', 'on'),
(ldap.MOD_REPLACE, 'nsSSLClientAuth', 'allowed'),
(ldap.MOD_REPLACE, 'allowWeakCipher', 'on'),
(ldap.MOD_REPLACE, 'nsSSL3Ciphers', '+all')])
@@ -645,19 +646,171 @@ def test_ticket47838_run_11(topology):
comp_nsSSLEnableCipherCount(topology, 0)
+def test_ticket47928_run_0(topology):
+ """
+ No SSL version config parameters.
+ Check SSL3 (TLS1.0) is off.
+ """
+ _header(topology, 'Test Case 13 - No SSL version config parameters')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ # add them once and remove them
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3', 'off'),
+ (ldap.MOD_REPLACE, 'nsTLS1', 'on'),
+ (ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.1'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.2')])
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_DELETE, 'nsSSL3', None),
+ (ldap.MOD_DELETE, 'nsTLS1', None),
+ (ldap.MOD_DELETE, 'sslVersionMin', None),
+ (ldap.MOD_DELETE, 'sslVersionMax', None)])
+ topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '64')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_11' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Default SSL Version settings; Configuring the version range as min: TLS1.1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+def test_ticket47928_run_1(topology):
+ """
+ No nsSSL3, nsTLS1; sslVersionMin > sslVersionMax
+ Check sslVersionMax is ignored.
+ """
+ _header(topology, 'Test Case 14 - No nsSSL3, nsTLS1; sslVersionMin > sslVersionMax')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.2'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.1')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_12' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "The min value of NSS version range"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL Initialization" %s | egrep "Configured SSL version range: min: TLS1.2, max: TLS1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+def test_ticket47928_run_2(topology):
+ """
+ nsSSL3: on; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
+ Conflict between nsSSL3 and range; nsSSL3 is disabled
+ """
+ _header(topology, 'Test Case 15 - nsSSL3: on; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.1'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.2'),
+ (ldap.MOD_REPLACE, 'nsSSL3', 'on')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_13' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Found unsecure configuration: nsSSL3: on"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Respect the supported range."' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL Initialization" %s | egrep "Configured SSL version range: min: TLS1.1, max: TLS1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+def test_ticket47928_run_3(topology):
+ """
+ nsSSL3: on; nsTLS1: off; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
+ Conflict between nsSSL3/nsTLS1 and range; nsSSL3 is disabled; nsTLS1 is enabled.
+ """
+ _header(topology, 'Test Case 16 - nsSSL3: on; nsTLS1: off; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.1'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.2'),
+ (ldap.MOD_REPLACE, 'nsSSL3', 'on'),
+ (ldap.MOD_REPLACE, 'nsTLS1', 'off')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_14' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Found unsecure configuration: nsSSL3: on"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Respect the configured range."' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL Initialization" %s | egrep "Configured SSL version range: min: TLS1.1, max: TLS1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
def test_ticket47838_run_last(topology):
"""
Check nssSSL3Chiphers: all <== invalid value
All ciphers are disabled.
"""
- _header(topology, 'Test Case 13 - Check nssSSL3Chiphers: all, which is invalid')
+ _header(topology, 'Test Case 17 - Check nssSSL3Chiphers: all, which is invalid')
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', None)])
topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3Ciphers', 'all')])
log.info("\n######################### Restarting the server ######################\n")
topology.standalone.stop(timeout=10)
- os.system('mv %s %s.47838_10' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('mv %s %s.47838_15' % (topology.standalone.errlog, topology.standalone.errlog))
os.system('touch %s' % (topology.standalone.errlog))
topology.standalone.start(timeout=120)
@@ -671,7 +824,7 @@ def test_ticket47838_run_last(topology):
comp_nsSSLEnableCipherCount(topology, 0)
- topology.standalone.log.info("ticket47838, 47880, 47908 were successfully verified.");
+ topology.standalone.log.info("ticket47838, 47880, 47908, 47928 were successfully verified.");
def test_ticket47838_final(topology):
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
@@ -706,6 +859,10 @@ def run_isolated():
test_ticket47838_run_9(topo)
test_ticket47838_run_10(topo)
test_ticket47838_run_11(topo)
+ test_ticket47928_run_0(topo)
+ test_ticket47928_run_1(topo)
+ test_ticket47928_run_2(topo)
+ test_ticket47928_run_3(topo)
test_ticket47838_run_last(topo)
commit 524d127f14d3bb666d8ac11a277c4ef60693045f
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Oct 22 14:43:26 2014 -0700
Ticket #47928 - Disable SSL v3, by default.
Description:
There are 2 ways to specify the SSL version in in cn=encryption,cn=config.
. existing method (SSL version info)
nsSSL3: on|off
nsTLS1: on|off
. new method (SSL version range)
sslVersionMin: <VERSION>
sslVersionMax: <VERSION>
where <VERSION> takes "SSL3", "TLS1.0" through "TLS1.2".
If no SSL version info nor range are set in cn=encryption,cn=config,
nsSSL3: off
nsTLS1: on
sslVersionMin is TLS1.1
sslVersionMax is TLS1.2
If SSL version info and range have conflicts, a tighter setting is
chosen. For instance, the case of sslVersionMin: TLS1.1; nsTLS1: off;
nsSSL3: on, the range setting is respected.
nsSSL3: off
nsTLS1: on
sslVersionMin is TLS1.1
sslVersionMax is TLS1.2
"SSL alert: Configured range: min: TLS1.1, max: TLS1.2; but nsSSL3 is on
and nsTLS1 is off. Respect the configured range." is logged in the error
log.
When cn=encryption,cn=config is searched, the SSL version info as well
as the range are retrieved from the settings in ssl.c and returned.
E.g.,
dn: cn=encryption,cn=config
nsSSl2: off
nsSSL3: off
nsTLS1: on
sslVersionMin: TLS1.1
sslVersionMax: TLS1.2
https://fedorahosted.org/389/ticket/47928
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit c1ecd8b659a0b8f7d84f8157cb69810c85ee26e4)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 1f455e5..87f45a1 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -77,6 +77,8 @@
extern char ** getSupportedCiphers();
extern char ** getEnabledCiphers();
+extern int getSSLVersionInfo(int *ssl2, int *ssl3, int *tls1);
+extern int getSSLVersionRange(char **min, char **max);
/* Note: These DNs are no need to be normalized */
static const char *internal_entries[] =
@@ -108,8 +110,7 @@ static const char *internal_entries[] =
"cn:encryption\n"
"nsSSLSessionTimeout:0\n"
"nsSSLClientAuth:allowed\n"
- "nsSSL2:off\n"
- "nsSSL3:off\n",
+ "sslVersionMin:tls1.1\n",
"dn:cn=monitor\n"
"objectclass:top\n"
@@ -1688,15 +1689,38 @@ dont_allow_that(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* e, int
return SLAPI_DSE_CALLBACK_ERROR;
}
+static void
+setEntrySSLVersion(Slapi_Entry *entry, char *sslversion, char *newval)
+{
+ char *v = slapi_entry_attr_get_charptr(entry, sslversion);
+
+ if (v) {
+ if (PL_strcasecmp(v, newval)) { /* did not match */
+ struct berval bv;
+ struct berval *bvals[2];
+ bvals[0] = &bv;
+ bvals[1] = NULL;
+ bv.bv_val = newval;
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(entry, sslversion, bvals );
+ }
+ slapi_ch_free_string(&v);
+ } else {
+ slapi_entry_attr_set_charptr(entry, sslversion, newval);
+ }
+}
+
/*This function takes care of the search on the attribute nssslsupportedciphers in cn=encryption,cn=config" entry. This would get the list of supported ciphers from the table in ssl.c and always return that value */
int
search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter, int *returncode, char *returntext, void *arg)
{
-
struct berval *vals[2];
struct berval val;
char ** cipherList = getSupportedCiphers(); /*Get the string array of supported ciphers here */
char ** enabledCipherList = getEnabledCiphers(); /*Get the string array of enabled ciphers here */
+ int ssl2, ssl3, tls1;
+ char *sslVersionMin = NULL;
+ char *sslVersionMax = NULL;
vals[0] = &val;
vals[1] = NULL;
@@ -1720,6 +1744,19 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
enabledCipherList++;
}
+ if (!getSSLVersionInfo(&ssl2, &ssl3, &tls1)) { /* 0 if the version info is initialized */
+ setEntrySSLVersion(entry, "nsSSL2", ssl2?"on":"off");
+ setEntrySSLVersion(entry, "nsSSL3", ssl3?"on":"off");
+ setEntrySSLVersion(entry, "nsTLS1", tls1?"on":"off");
+ }
+
+ if (!getSSLVersionRange(&sslVersionMin, &sslVersionMax)) { /* 0 if the range is initialized or supported */
+ setEntrySSLVersion(entry, "sslVersionMin", sslVersionMin);
+ setEntrySSLVersion(entry, "sslVersionMax", sslVersionMax);
+ }
+ slapi_ch_free_string(&sslVersionMin);
+ slapi_ch_free_string(&sslVersionMax);
+
return SLAPI_DSE_CALLBACK_OK;
}
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 5f9916b..26ef251 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -81,17 +81,25 @@
#endif
#if NSS_VMAJOR * 100 + NSS_VMINOR >= 315
+/* TLS1.2 is defined in RFC5246. */
#define NSS_TLS12 1
#elif NSS_VMAJOR * 100 + NSS_VMINOR >= 314
+/* TLS1.1 is defined in RFC4346. */
#define NSS_TLS11 1
#else
+/*
+ * TLS1.0 is defined in RFC2246.
+ * Close to SSL 3.0.
+ */
#define NSS_TLS10 1
#endif
extern char* slapd_SSL3ciphers;
extern symbol_t supported_ciphers[];
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
-static SSLVersionRange enabledNSSVersions;
+static SSLVersionRange enabledNSSVersions;
+static SSLVersionRange slapdNSSVersions;
+static char *getNSSVersion_str(PRUint16 vnum);
#endif
/* dongle_file_name is set in slapd_nss_init when we set the path for the
@@ -238,6 +246,20 @@ static lookup_cipher _lookup_cipher[] = {
{NULL, NULL}
};
+/* Supported SSL versions */
+/* nsSSL2: on -- we don't allow this any more. */
+PRBool enableSSL2 = PR_FALSE;
+/*
+ * nsSSL3: on -- disable SSLv3 by default.
+ * Corresonding to SSL_LIBRARY_VERSION_3_0 and SSL_LIBRARY_VERSION_TLS_1_0
+ */
+PRBool enableSSL3 = PR_FALSE;
+/*
+ * nsTLS1: on -- enable TLS1 by default.
+ * Corresonding to SSL_LIBRARY_VERSION_TLS_1_1 and greater.
+ */
+PRBool enableTLS1 = PR_TRUE;
+
static void
slapd_SSL_report(int degree, char *fmt, va_list args)
{
@@ -372,6 +394,36 @@ cipher_check_fips(int idx, char ***suplist, char ***unsuplist)
return rc;
}
+int
+getSSLVersionInfo(int *ssl2, int *ssl3, int *tls1)
+{
+ if (!slapd_ssl_listener_is_initialized()) {
+ return -1;
+ }
+ *ssl2 = enableSSL2;
+ *ssl3 = enableSSL3;
+ *tls1 = enableTLS1;
+ return 0;
+}
+
+int
+getSSLVersionRange(char **min, char **max)
+{
+ if (!slapd_ssl_listener_is_initialized()) {
+ return -1;
+ }
+ if ((NULL == min) || (NULL == max)) {
+ return -1;
+ }
+#if defined(NSS_TLS10)
+ return -1; /* not supported */
+#else /* NSS_TLS11 or newer */
+ *min = slapi_ch_strdup(getNSSVersion_str(slapdNSSVersions.min));
+ *max = slapi_ch_strdup(getNSSVersion_str(slapdNSSVersions.max));
+ return 0;
+#endif
+}
+
static void
_conf_init_ciphers()
{
@@ -834,89 +886,132 @@ getNSSVersion_str(PRUint16 vnum)
return vstr;
}
-/* restrict SSLVersionRange with the existing SSL config params (nsSSL3, nsTLS1) */
+#define SSLVGreater(x, y) (((x) > (y)) ? (x) : (y))
+
+/*
+ * Check the SSLVersionRange and the old style config params (nsSSL3, nsTLS1) .
+ * If there are conflicts, choose the secure setting.
+ */
static void
-restrict_SSLVersionRange(SSLVersionRange *sslversion, PRBool enableSSL3, PRBool enableTLS1)
+restrict_SSLVersionRange(void)
{
- int rc = 0;
+ if (slapdNSSVersions.min > slapdNSSVersions.max) {
+ slapd_SSL_warn("Invalid configured SSL range: min: %s, max: %s; "
+ "Resetting the max to the supported max SSL version: %s.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max),
+ getNSSVersion_str(enabledNSSVersions.max));
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ }
if (enableSSL3) {
+ slapd_SSL_warn("Found unsecure configuration: nsSSL3: on; "
+ "We strongly recommend to disable nsSSL3 in %s.", configDN);
if (enableTLS1) {
- /* no restriction */
- ;
+ if (slapdNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but both nsSSL3 and nsTLS1 are on. "
+ "Respect the supported range.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ enableSSL3 = PR_FALSE;
+ }
+ if (slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but both nsSSL3 and nsTLS1 are on. "
+ "Resetting the max to the supported max SSL version: %s.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max),
+ getNSSVersion_str(enabledNSSVersions.max));
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ }
} else {
- if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_3_0) {
- slapd_SSL_warn("Security Initialization: "
- "Supported range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsTLS1. "
- "Ignoring nsTLS1: off\n",
+ /* nsTLS1 is explicitly set to off. */
+ if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ slapd_SSL_warn("Supported range: min: %s, max: %s; "
+ "but nsSSL3 is on and nsTLS1 is off. "
+ "Respect the supported range.",
getNSSVersion_str(enabledNSSVersions.min),
getNSSVersion_str(enabledNSSVersions.max));
- rc = 1;
- } else if (sslversion->min > SSL_LIBRARY_VERSION_3_0) {
- slapd_SSL_warn("Security Initialization: "
- "Configured range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsTLS1. "
- "Ignoring nsTLS1: off\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max));
- rc = 1;
- } else if (sslversion->max < SSL_LIBRARY_VERSION_3_0) {
- slapd_SSL_warn("Security Initialization: "
- "Configured range: min: %s, max: %s; "
- "but the SSL configuration of the server enabled nsSSL3. "
- "Ignoring max: %s\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max),
- getNSSVersion_str(sslversion->max));
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
- rc = 1;
+ slapdNSSVersions.min = SSLVGreater(slapdNSSVersions.min, enabledNSSVersions.min);
+ enableSSL3 = PR_FALSE;
+ enableTLS1 = PR_TRUE;
+ } else if (slapdNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but nsSSL3 is on and nsTLS1 is off. "
+ "Respect the configured range.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ enableSSL3 = PR_FALSE;
+ enableTLS1 = PR_TRUE;
+ } else if (slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ slapd_SSL_warn("Too low configured range: min: %s, max: %s; "
+ "Resetting the range to: min: %s, max: %s.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max),
+ getNSSVersion_str(SSL_LIBRARY_VERSION_TLS_1_0),
+ getNSSVersion_str(SSL_LIBRARY_VERSION_TLS_1_0));
+ slapdNSSVersions.min = SSL_LIBRARY_VERSION_TLS_1_0;
+ slapdNSSVersions.max = SSL_LIBRARY_VERSION_TLS_1_0;
} else {
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
+ /*
+ * slapdNSSVersions.min <= SSL_LIBRARY_VERSION_TLS_1_0 &&
+ * slapdNSSVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1
+ */
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but nsSSL3 is on and nsTLS1 is off. "
+ "Respect the configured range.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ enableTLS1 = PR_TRUE;
}
}
} else {
if (enableTLS1) {
- if (enabledNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_0) {
- slapd_SSL_warn("Security Initialization: "
- "Supported range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsSSL3. ",
- "Ignoring nsSSL3: off\n",
+ if (enabledNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ /* TLS1 is on, but TLS1 is not supported by NSS. */
+ slapd_SSL_warn("Supported range: min: %s, max: %s; "
+ "Setting the version range based upon the supported range.",
getNSSVersion_str(enabledNSSVersions.min),
getNSSVersion_str(enabledNSSVersions.max));
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
- rc = 1;
- } else if (sslversion->max < SSL_LIBRARY_VERSION_TLS_1_0) {
- slapd_SSL_warn("Security Initialization: "
- "Configured range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsSSL3. "
- "Ignoring nsSSL3: off\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max));
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
- rc = 1;
- } else if (sslversion->min < SSL_LIBRARY_VERSION_TLS_1_0) {
- sslversion->min = SSL_LIBRARY_VERSION_TLS_1_0;
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ slapdNSSVersions.min = enabledNSSVersions.min;
+ enableSSL3 = PR_TRUE;
+ enableTLS1 = PR_FALSE;
+ } else if ((slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) ||
+ (slapdNSSVersions.min < SSL_LIBRARY_VERSION_TLS_1_1)) {
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ slapdNSSVersions.min = SSLVGreater(SSL_LIBRARY_VERSION_TLS_1_1, enabledNSSVersions.min);
+ slapd_SSL_warn("Default SSL Version settings; "
+ "Configuring the version range as min: %s, max: %s; ",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ } else {
+ /*
+ * slapdNSSVersions.min >= SSL_LIBRARY_VERSION_TLS_1_1 &&
+ * slapdNSSVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1
+ */
+ ;
}
} else {
- slapd_SSL_warn("Security Initialization: "
- "Supported range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsSSL3 and nsTLS1. "
- "Ignoring nsSSL3: off and nsTLS1: off\n",
- getNSSVersion_str(enabledNSSVersions.min),
- getNSSVersion_str(enabledNSSVersions.max));
- rc = 1;
+ slapd_SSL_warn("Supported range: min: %s, max: %s; "
+ "Respect the configured range.",
+ getNSSVersion_str(enabledNSSVersions.min),
+ getNSSVersion_str(enabledNSSVersions.max));
+ /* nsTLS1 is explicitly set to off. */
+ if (slapdNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ enableTLS1 = PR_TRUE;
+ } else if (slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ enableSSL3 = PR_TRUE;
+ } else {
+ /*
+ * slapdNSSVersions.min <= SSL_LIBRARY_VERSION_TLS_1_0 &&
+ * slapdNSSVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1
+ */
+ enableSSL3 = PR_TRUE;
+ enableTLS1 = PR_TRUE;
+ }
}
}
- if (0 == rc) {
- slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
- "SSL version range: min: %s, max: %s\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max));
- }
}
#endif
@@ -949,7 +1044,7 @@ slapd_nss_init(int init_ssl, int config_available)
SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
slapi_log_error(SLAPI_LOG_CONFIG, "SSL Initialization",
- "supported range: min: %s, max: %s\n",
+ "supported range by NSS: min: %s, max: %s\n",
getNSSVersion_str(enabledNSSVersions.min),
getNSSVersion_str(enabledNSSVersions.max));
#endif
@@ -1120,11 +1215,9 @@ slapd_ssl_init()
PRErrorCode errorCode;
char ** family_list;
char *val = NULL;
- char cipher_string[1024];
int rv = 0;
PK11SlotInfo *slot;
Slapi_Entry *entry = NULL;
- int allowweakcipher = CIPHER_SET_DEFAULTWEAKCIPHER;
/* Get general information */
@@ -1162,23 +1255,6 @@ slapd_ssl_init()
freeConfigEntry( &entry );
return -1;
}
-
- val = slapi_entry_attr_get_charptr(entry, "allowWeakCipher");
- if (val) {
- if (!PL_strcasecmp(val, "off") || !PL_strcasecmp(val, "false") ||
- !PL_strcmp(val, "0") || !PL_strcasecmp(val, "no")) {
- allowweakcipher = CIPHER_SET_DISALLOWWEAKCIPHER;
- } else if (!PL_strcasecmp(val, "on") || !PL_strcasecmp(val, "true") ||
- !PL_strcmp(val, "1") || !PL_strcasecmp(val, "yes")) {
- allowweakcipher = CIPHER_SET_ALLOWWEAKCIPHER;
- } else {
- slapd_SSL_warn("The value of allowWeakCipher \"%s\" in "
- "cn=encryption,cn=config is invalid. "
- "Ignoring it and set it to default.", val);
- }
- }
- slapi_ch_free((void **) &val);
-
if ((family_list = getChildren(configDN))) {
char **family;
char *token;
@@ -1252,22 +1328,6 @@ slapd_ssl_init()
/* ugaston- Cipher preferences must be set before any sslSocket is created
* for such sockets to take preferences into account.
*/
-
- /* Step Three.5: Set SSL cipher preferences */
- *cipher_string = 0;
- if(ciphers && (*ciphers) && PL_strcmp(ciphers, "blank"))
- PL_strncpyz(cipher_string, ciphers, sizeof(cipher_string));
- slapi_ch_free((void **) &ciphers);
-
- if ( NULL != (val = _conf_setciphers(cipher_string, allowweakcipher)) ) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to set SSL cipher "
- "preference information: %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- val, errorCode, slapd_pr_strerror(errorCode));
- rv = 3;
- slapi_ch_free((void **) &val);
- }
-
freeConfigEntry( &entry );
/* Introduce a way of knowing whether slapd_ssl_init has
@@ -1308,7 +1368,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_2) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1319,7 +1379,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1331,7 +1391,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_3_0) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1342,7 +1402,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1352,12 +1412,12 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
} else {
if (ismin) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
}
@@ -1371,7 +1431,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1382,7 +1442,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1394,7 +1454,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_1) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1405,7 +1465,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1418,7 +1478,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_2) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1429,7 +1489,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1441,13 +1501,13 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (ismin) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is out of the range of the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is out of the range of the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.max;
}
@@ -1455,12 +1515,12 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
} else {
if (ismin) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.max;
}
@@ -1490,14 +1550,13 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
int slapd_SSLclientAuth;
char* tmpDir;
Slapi_Entry *e = NULL;
- PRBool enableSSL2 = PR_FALSE;
- PRBool enableSSL3 = PR_TRUE;
- PRBool enableTLS1 = PR_TRUE;
PRBool fipsMode = PR_FALSE;
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
PRUint16 NSSVersionMin = enabledNSSVersions.min;
PRUint16 NSSVersionMax = enabledNSSVersions.max;
#endif
+ char cipher_string[1024];
+ int allowweakcipher = CIPHER_SET_DEFAULTWEAKCIPHER;
/* turn off the PKCS11 pin interactive mode */
#ifndef _WIN32
@@ -1839,6 +1898,8 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
} else {
enableTLS1 = slapi_entry_attr_get_bool( e, "nsTLS1" );
}
+ } else if (enabledNSSVersions.max > SSL_LIBRARY_VERSION_TLS_1_0) {
+ enableTLS1 = PR_TRUE; /* If available, enable TLS1 */
}
slapi_ch_free_string( &val );
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
@@ -1853,14 +1914,12 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
}
slapi_ch_free_string( &val );
if (NSSVersionMin > NSSVersionMax) {
- slapd_SSL_warn("Security Initialization: The min value of NSS version range "
- "\"%s\" is greater than the max value \"%s\"; "
- "the default range \"%s\" - \"%s\" is used.\n",
+ slapd_SSL_warn("The min value of NSS version range \"%s\" is greater than the max value \"%s\".",
getNSSVersion_str(NSSVersionMin),
- getNSSVersion_str(NSSVersionMax),
- getNSSVersion_str(enabledNSSVersions.min),
+ getNSSVersion_str(NSSVersionMax));
+ slapd_SSL_warn("Reset the max \"%s\" to supported max \"%s\".",
+ getNSSVersion_str(NSSVersionMax),
getNSSVersion_str(enabledNSSVersions.max));
- NSSVersionMin = enabledNSSVersions.min;
NSSVersionMax = enabledNSSVersions.max;
}
#endif
@@ -1868,18 +1927,21 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
if (NSSVersionMin > 0) {
/* Use new NSS API SSL_VersionRangeSet (NSS3.14 or newer) */
- SSLVersionRange myNSSVersions;
- myNSSVersions.min = NSSVersionMin;
- myNSSVersions.max = NSSVersionMax;
- restrict_SSLVersionRange(&myNSSVersions, enableSSL3, enableTLS1);
- sslStatus = SSL_VersionRangeSet(pr_sock, &myNSSVersions);
+ slapdNSSVersions.min = NSSVersionMin;
+ slapdNSSVersions.max = NSSVersionMax;
+ restrict_SSLVersionRange();
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Configured SSL version range: min: %s, max: %s\n",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ sslStatus = SSL_VersionRangeSet(pr_sock, &slapdNSSVersions);
if (sslStatus == SECSuccess) {
/* Set the restricted value to the cn=encryption entry */
} else {
slapd_SSL_error("SSL Initialization 2: "
"Failed to set SSL range: min: %s, max: %s\n",
- getNSSVersion_str(myNSSVersions.min),
- getNSSVersion_str(myNSSVersions.max));
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
}
} else {
#endif
@@ -1904,6 +1966,36 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
}
#endif
+ val = slapi_entry_attr_get_charptr(e, "allowWeakCipher");
+ if (val) {
+ if (!PL_strcasecmp(val, "off") || !PL_strcasecmp(val, "false") ||
+ !PL_strcmp(val, "0") || !PL_strcasecmp(val, "no")) {
+ allowweakcipher = CIPHER_SET_DISALLOWWEAKCIPHER;
+ } else if (!PL_strcasecmp(val, "on") || !PL_strcasecmp(val, "true") ||
+ !PL_strcmp(val, "1") || !PL_strcasecmp(val, "yes")) {
+ allowweakcipher = CIPHER_SET_ALLOWWEAKCIPHER;
+ } else {
+ slapd_SSL_warn("The value of allowWeakCipher \"%s\" in %s is invalid.",
+ "Ignoring it and set it to default.", val, configDN);
+ }
+ }
+ slapi_ch_free((void **) &val);
+
+ /* Set SSL cipher preferences */
+ *cipher_string = 0;
+ if(ciphers && (*ciphers) && PL_strcmp(ciphers, "blank"))
+ PL_strncpyz(cipher_string, ciphers, sizeof(cipher_string));
+ slapi_ch_free((void **) &ciphers);
+
+ if ( NULL != (val = _conf_setciphers(cipher_string, allowweakcipher)) ) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to set SSL cipher "
+ "preference information: %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ val, errorCode, slapd_pr_strerror(errorCode));
+ rv = 3;
+ slapi_ch_free((void **) &val);
+ }
+
freeConfigEntry( &e );
if(( slapd_SSLclientAuth = config_get_SSLclientAuth()) != SLAPD_SSLCLIENTAUTH_OFF ) {
1
0
dirsrvtests/tickets/ticket47838_test.py | 165 ++++++++++++++
ldap/servers/slapd/fedse.c | 43 +++
ldap/servers/slapd/ssl.c | 360 ++++++++++++++++++++------------
3 files changed, 427 insertions(+), 141 deletions(-)
New commits:
commit 958be1271ab440a15649046e7927b44b57a4e19a
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Oct 22 17:11:17 2014 -0700
Ticket 47928 - CI test: added test cases for ticket 47928
Description:
test_ticket47928_run_0 - Test Case 13 - No SSL version config parameters
test_ticket47928_run_1 - Test Case 14 - No nsSSL3, nsTLS1; sslVersionMin > sslVersionMax
test_ticket47928_run_2 - Test Case 15 - nsSSL3: on; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
test_ticket47928_run_3 - Test Case 16 - nsSSL3: on; nsTLS1: off; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
diff --git a/dirsrvtests/tickets/ticket47838_test.py b/dirsrvtests/tickets/ticket47838_test.py
index c98c36e..50a4b50 100644
--- a/dirsrvtests/tickets/ticket47838_test.py
+++ b/dirsrvtests/tickets/ticket47838_test.py
@@ -201,7 +201,8 @@ def test_ticket47838_init(topology):
log.info("\n######################### enable SSL in the directory server with all ciphers ######################\n")
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
- topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3', 'on'),
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3', 'off'),
+ (ldap.MOD_REPLACE, 'nsTLS1', 'on'),
(ldap.MOD_REPLACE, 'nsSSLClientAuth', 'allowed'),
(ldap.MOD_REPLACE, 'allowWeakCipher', 'on'),
(ldap.MOD_REPLACE, 'nsSSL3Ciphers', '+all')])
@@ -645,19 +646,171 @@ def test_ticket47838_run_11(topology):
comp_nsSSLEnableCipherCount(topology, 0)
+def test_ticket47928_run_0(topology):
+ """
+ No SSL version config parameters.
+ Check SSL3 (TLS1.0) is off.
+ """
+ _header(topology, 'Test Case 13 - No SSL version config parameters')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ # add them once and remove them
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3', 'off'),
+ (ldap.MOD_REPLACE, 'nsTLS1', 'on'),
+ (ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.1'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.2')])
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_DELETE, 'nsSSL3', None),
+ (ldap.MOD_DELETE, 'nsTLS1', None),
+ (ldap.MOD_DELETE, 'sslVersionMin', None),
+ (ldap.MOD_DELETE, 'sslVersionMax', None)])
+ topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '64')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_11' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Default SSL Version settings; Configuring the version range as min: TLS1.1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+def test_ticket47928_run_1(topology):
+ """
+ No nsSSL3, nsTLS1; sslVersionMin > sslVersionMax
+ Check sslVersionMax is ignored.
+ """
+ _header(topology, 'Test Case 14 - No nsSSL3, nsTLS1; sslVersionMin > sslVersionMax')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.2'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.1')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_12' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "The min value of NSS version range"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL Initialization" %s | egrep "Configured SSL version range: min: TLS1.2, max: TLS1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+def test_ticket47928_run_2(topology):
+ """
+ nsSSL3: on; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
+ Conflict between nsSSL3 and range; nsSSL3 is disabled
+ """
+ _header(topology, 'Test Case 15 - nsSSL3: on; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.1'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.2'),
+ (ldap.MOD_REPLACE, 'nsSSL3', 'on')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_13' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Found unsecure configuration: nsSSL3: on"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Respect the supported range."' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL Initialization" %s | egrep "Configured SSL version range: min: TLS1.1, max: TLS1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+def test_ticket47928_run_3(topology):
+ """
+ nsSSL3: on; nsTLS1: off; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
+ Conflict between nsSSL3/nsTLS1 and range; nsSSL3 is disabled; nsTLS1 is enabled.
+ """
+ _header(topology, 'Test Case 16 - nsSSL3: on; nsTLS1: off; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2')
+
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'sslVersionMin', 'TLS1.1'),
+ (ldap.MOD_REPLACE, 'sslVersionMax', 'TLS1.2'),
+ (ldap.MOD_REPLACE, 'nsSSL3', 'on'),
+ (ldap.MOD_REPLACE, 'nsTLS1', 'off')])
+
+ log.info("\n######################### Restarting the server ######################\n")
+ topology.standalone.stop(timeout=10)
+ os.system('mv %s %s.47838_14' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('touch %s' % (topology.standalone.errlog))
+ topology.standalone.start(timeout=120)
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Found unsecure configuration: nsSSL3: on"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL alert:" %s | egrep "Respect the configured range."' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
+ errmsg = os.popen('egrep "SSL Initialization" %s | egrep "Configured SSL version range: min: TLS1.1, max: TLS1"' % topology.standalone.errlog)
+ if errmsg != "":
+ log.info("Expected message:")
+ log.info("%s" % errmsg.readline())
+ else:
+ log.info("Expected message was not found")
+ assert False
+
def test_ticket47838_run_last(topology):
"""
Check nssSSL3Chiphers: all <== invalid value
All ciphers are disabled.
"""
- _header(topology, 'Test Case 13 - Check nssSSL3Chiphers: all, which is invalid')
+ _header(topology, 'Test Case 17 - Check nssSSL3Chiphers: all, which is invalid')
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+ topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', None)])
topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3Ciphers', 'all')])
log.info("\n######################### Restarting the server ######################\n")
topology.standalone.stop(timeout=10)
- os.system('mv %s %s.47838_10' % (topology.standalone.errlog, topology.standalone.errlog))
+ os.system('mv %s %s.47838_15' % (topology.standalone.errlog, topology.standalone.errlog))
os.system('touch %s' % (topology.standalone.errlog))
topology.standalone.start(timeout=120)
@@ -671,7 +824,7 @@ def test_ticket47838_run_last(topology):
comp_nsSSLEnableCipherCount(topology, 0)
- topology.standalone.log.info("ticket47838, 47880, 47908 were successfully verified.");
+ topology.standalone.log.info("ticket47838, 47880, 47908, 47928 were successfully verified.");
def test_ticket47838_final(topology):
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
@@ -706,6 +859,10 @@ def run_isolated():
test_ticket47838_run_9(topo)
test_ticket47838_run_10(topo)
test_ticket47838_run_11(topo)
+ test_ticket47928_run_0(topo)
+ test_ticket47928_run_1(topo)
+ test_ticket47928_run_2(topo)
+ test_ticket47928_run_3(topo)
test_ticket47838_run_last(topo)
commit c1ecd8b659a0b8f7d84f8157cb69810c85ee26e4
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Oct 22 14:43:26 2014 -0700
Ticket #47928 - Disable SSL v3, by default.
Description:
There are 2 ways to specify the SSL version in in cn=encryption,cn=config.
. existing method (SSL version info)
nsSSL3: on|off
nsTLS1: on|off
. new method (SSL version range)
sslVersionMin: <VERSION>
sslVersionMax: <VERSION>
where <VERSION> takes "SSL3", "TLS1.0" through "TLS1.2".
If no SSL version info nor range are set in cn=encryption,cn=config,
nsSSL3: off
nsTLS1: on
sslVersionMin is TLS1.1
sslVersionMax is TLS1.2
If SSL version info and range have conflicts, a tighter setting is
chosen. For instance, the case of sslVersionMin: TLS1.1; nsTLS1: off;
nsSSL3: on, the range setting is respected.
nsSSL3: off
nsTLS1: on
sslVersionMin is TLS1.1
sslVersionMax is TLS1.2
"SSL alert: Configured range: min: TLS1.1, max: TLS1.2; but nsSSL3 is on
and nsTLS1 is off. Respect the configured range." is logged in the error
log.
When cn=encryption,cn=config is searched, the SSL version info as well
as the range are retrieved from the settings in ssl.c and returned.
E.g.,
dn: cn=encryption,cn=config
nsSSl2: off
nsSSL3: off
nsTLS1: on
sslVersionMin: TLS1.1
sslVersionMax: TLS1.2
https://fedorahosted.org/389/ticket/47928
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 1f455e5..87f45a1 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -77,6 +77,8 @@
extern char ** getSupportedCiphers();
extern char ** getEnabledCiphers();
+extern int getSSLVersionInfo(int *ssl2, int *ssl3, int *tls1);
+extern int getSSLVersionRange(char **min, char **max);
/* Note: These DNs are no need to be normalized */
static const char *internal_entries[] =
@@ -108,8 +110,7 @@ static const char *internal_entries[] =
"cn:encryption\n"
"nsSSLSessionTimeout:0\n"
"nsSSLClientAuth:allowed\n"
- "nsSSL2:off\n"
- "nsSSL3:off\n",
+ "sslVersionMin:tls1.1\n",
"dn:cn=monitor\n"
"objectclass:top\n"
@@ -1688,15 +1689,38 @@ dont_allow_that(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry* e, int
return SLAPI_DSE_CALLBACK_ERROR;
}
+static void
+setEntrySSLVersion(Slapi_Entry *entry, char *sslversion, char *newval)
+{
+ char *v = slapi_entry_attr_get_charptr(entry, sslversion);
+
+ if (v) {
+ if (PL_strcasecmp(v, newval)) { /* did not match */
+ struct berval bv;
+ struct berval *bvals[2];
+ bvals[0] = &bv;
+ bvals[1] = NULL;
+ bv.bv_val = newval;
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(entry, sslversion, bvals );
+ }
+ slapi_ch_free_string(&v);
+ } else {
+ slapi_entry_attr_set_charptr(entry, sslversion, newval);
+ }
+}
+
/*This function takes care of the search on the attribute nssslsupportedciphers in cn=encryption,cn=config" entry. This would get the list of supported ciphers from the table in ssl.c and always return that value */
int
search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter, int *returncode, char *returntext, void *arg)
{
-
struct berval *vals[2];
struct berval val;
char ** cipherList = getSupportedCiphers(); /*Get the string array of supported ciphers here */
char ** enabledCipherList = getEnabledCiphers(); /*Get the string array of enabled ciphers here */
+ int ssl2, ssl3, tls1;
+ char *sslVersionMin = NULL;
+ char *sslVersionMax = NULL;
vals[0] = &val;
vals[1] = NULL;
@@ -1720,6 +1744,19 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
enabledCipherList++;
}
+ if (!getSSLVersionInfo(&ssl2, &ssl3, &tls1)) { /* 0 if the version info is initialized */
+ setEntrySSLVersion(entry, "nsSSL2", ssl2?"on":"off");
+ setEntrySSLVersion(entry, "nsSSL3", ssl3?"on":"off");
+ setEntrySSLVersion(entry, "nsTLS1", tls1?"on":"off");
+ }
+
+ if (!getSSLVersionRange(&sslVersionMin, &sslVersionMax)) { /* 0 if the range is initialized or supported */
+ setEntrySSLVersion(entry, "sslVersionMin", sslVersionMin);
+ setEntrySSLVersion(entry, "sslVersionMax", sslVersionMax);
+ }
+ slapi_ch_free_string(&sslVersionMin);
+ slapi_ch_free_string(&sslVersionMax);
+
return SLAPI_DSE_CALLBACK_OK;
}
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 5f9916b..26ef251 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -81,17 +81,25 @@
#endif
#if NSS_VMAJOR * 100 + NSS_VMINOR >= 315
+/* TLS1.2 is defined in RFC5246. */
#define NSS_TLS12 1
#elif NSS_VMAJOR * 100 + NSS_VMINOR >= 314
+/* TLS1.1 is defined in RFC4346. */
#define NSS_TLS11 1
#else
+/*
+ * TLS1.0 is defined in RFC2246.
+ * Close to SSL 3.0.
+ */
#define NSS_TLS10 1
#endif
extern char* slapd_SSL3ciphers;
extern symbol_t supported_ciphers[];
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
-static SSLVersionRange enabledNSSVersions;
+static SSLVersionRange enabledNSSVersions;
+static SSLVersionRange slapdNSSVersions;
+static char *getNSSVersion_str(PRUint16 vnum);
#endif
/* dongle_file_name is set in slapd_nss_init when we set the path for the
@@ -238,6 +246,20 @@ static lookup_cipher _lookup_cipher[] = {
{NULL, NULL}
};
+/* Supported SSL versions */
+/* nsSSL2: on -- we don't allow this any more. */
+PRBool enableSSL2 = PR_FALSE;
+/*
+ * nsSSL3: on -- disable SSLv3 by default.
+ * Corresonding to SSL_LIBRARY_VERSION_3_0 and SSL_LIBRARY_VERSION_TLS_1_0
+ */
+PRBool enableSSL3 = PR_FALSE;
+/*
+ * nsTLS1: on -- enable TLS1 by default.
+ * Corresonding to SSL_LIBRARY_VERSION_TLS_1_1 and greater.
+ */
+PRBool enableTLS1 = PR_TRUE;
+
static void
slapd_SSL_report(int degree, char *fmt, va_list args)
{
@@ -372,6 +394,36 @@ cipher_check_fips(int idx, char ***suplist, char ***unsuplist)
return rc;
}
+int
+getSSLVersionInfo(int *ssl2, int *ssl3, int *tls1)
+{
+ if (!slapd_ssl_listener_is_initialized()) {
+ return -1;
+ }
+ *ssl2 = enableSSL2;
+ *ssl3 = enableSSL3;
+ *tls1 = enableTLS1;
+ return 0;
+}
+
+int
+getSSLVersionRange(char **min, char **max)
+{
+ if (!slapd_ssl_listener_is_initialized()) {
+ return -1;
+ }
+ if ((NULL == min) || (NULL == max)) {
+ return -1;
+ }
+#if defined(NSS_TLS10)
+ return -1; /* not supported */
+#else /* NSS_TLS11 or newer */
+ *min = slapi_ch_strdup(getNSSVersion_str(slapdNSSVersions.min));
+ *max = slapi_ch_strdup(getNSSVersion_str(slapdNSSVersions.max));
+ return 0;
+#endif
+}
+
static void
_conf_init_ciphers()
{
@@ -834,89 +886,132 @@ getNSSVersion_str(PRUint16 vnum)
return vstr;
}
-/* restrict SSLVersionRange with the existing SSL config params (nsSSL3, nsTLS1) */
+#define SSLVGreater(x, y) (((x) > (y)) ? (x) : (y))
+
+/*
+ * Check the SSLVersionRange and the old style config params (nsSSL3, nsTLS1) .
+ * If there are conflicts, choose the secure setting.
+ */
static void
-restrict_SSLVersionRange(SSLVersionRange *sslversion, PRBool enableSSL3, PRBool enableTLS1)
+restrict_SSLVersionRange(void)
{
- int rc = 0;
+ if (slapdNSSVersions.min > slapdNSSVersions.max) {
+ slapd_SSL_warn("Invalid configured SSL range: min: %s, max: %s; "
+ "Resetting the max to the supported max SSL version: %s.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max),
+ getNSSVersion_str(enabledNSSVersions.max));
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ }
if (enableSSL3) {
+ slapd_SSL_warn("Found unsecure configuration: nsSSL3: on; "
+ "We strongly recommend to disable nsSSL3 in %s.", configDN);
if (enableTLS1) {
- /* no restriction */
- ;
+ if (slapdNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but both nsSSL3 and nsTLS1 are on. "
+ "Respect the supported range.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ enableSSL3 = PR_FALSE;
+ }
+ if (slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but both nsSSL3 and nsTLS1 are on. "
+ "Resetting the max to the supported max SSL version: %s.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max),
+ getNSSVersion_str(enabledNSSVersions.max));
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ }
} else {
- if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_3_0) {
- slapd_SSL_warn("Security Initialization: "
- "Supported range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsTLS1. "
- "Ignoring nsTLS1: off\n",
+ /* nsTLS1 is explicitly set to off. */
+ if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ slapd_SSL_warn("Supported range: min: %s, max: %s; "
+ "but nsSSL3 is on and nsTLS1 is off. "
+ "Respect the supported range.",
getNSSVersion_str(enabledNSSVersions.min),
getNSSVersion_str(enabledNSSVersions.max));
- rc = 1;
- } else if (sslversion->min > SSL_LIBRARY_VERSION_3_0) {
- slapd_SSL_warn("Security Initialization: "
- "Configured range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsTLS1. "
- "Ignoring nsTLS1: off\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max));
- rc = 1;
- } else if (sslversion->max < SSL_LIBRARY_VERSION_3_0) {
- slapd_SSL_warn("Security Initialization: "
- "Configured range: min: %s, max: %s; "
- "but the SSL configuration of the server enabled nsSSL3. "
- "Ignoring max: %s\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max),
- getNSSVersion_str(sslversion->max));
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
- rc = 1;
+ slapdNSSVersions.min = SSLVGreater(slapdNSSVersions.min, enabledNSSVersions.min);
+ enableSSL3 = PR_FALSE;
+ enableTLS1 = PR_TRUE;
+ } else if (slapdNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but nsSSL3 is on and nsTLS1 is off. "
+ "Respect the configured range.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ enableSSL3 = PR_FALSE;
+ enableTLS1 = PR_TRUE;
+ } else if (slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ slapd_SSL_warn("Too low configured range: min: %s, max: %s; "
+ "Resetting the range to: min: %s, max: %s.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max),
+ getNSSVersion_str(SSL_LIBRARY_VERSION_TLS_1_0),
+ getNSSVersion_str(SSL_LIBRARY_VERSION_TLS_1_0));
+ slapdNSSVersions.min = SSL_LIBRARY_VERSION_TLS_1_0;
+ slapdNSSVersions.max = SSL_LIBRARY_VERSION_TLS_1_0;
} else {
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
+ /*
+ * slapdNSSVersions.min <= SSL_LIBRARY_VERSION_TLS_1_0 &&
+ * slapdNSSVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1
+ */
+ slapd_SSL_warn("Configured range: min: %s, max: %s; "
+ "but nsSSL3 is on and nsTLS1 is off. "
+ "Respect the configured range.",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ enableTLS1 = PR_TRUE;
}
}
} else {
if (enableTLS1) {
- if (enabledNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_0) {
- slapd_SSL_warn("Security Initialization: "
- "Supported range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsSSL3. ",
- "Ignoring nsSSL3: off\n",
+ if (enabledNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ /* TLS1 is on, but TLS1 is not supported by NSS. */
+ slapd_SSL_warn("Supported range: min: %s, max: %s; "
+ "Setting the version range based upon the supported range.",
getNSSVersion_str(enabledNSSVersions.min),
getNSSVersion_str(enabledNSSVersions.max));
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
- rc = 1;
- } else if (sslversion->max < SSL_LIBRARY_VERSION_TLS_1_0) {
- slapd_SSL_warn("Security Initialization: "
- "Configured range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsSSL3. "
- "Ignoring nsSSL3: off\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max));
- sslversion->min = SSL_LIBRARY_VERSION_3_0; /* don't enable SSL2 */
- sslversion->max = SSL_LIBRARY_VERSION_3_0;
- rc = 1;
- } else if (sslversion->min < SSL_LIBRARY_VERSION_TLS_1_0) {
- sslversion->min = SSL_LIBRARY_VERSION_TLS_1_0;
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ slapdNSSVersions.min = enabledNSSVersions.min;
+ enableSSL3 = PR_TRUE;
+ enableTLS1 = PR_FALSE;
+ } else if ((slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) ||
+ (slapdNSSVersions.min < SSL_LIBRARY_VERSION_TLS_1_1)) {
+ slapdNSSVersions.max = enabledNSSVersions.max;
+ slapdNSSVersions.min = SSLVGreater(SSL_LIBRARY_VERSION_TLS_1_1, enabledNSSVersions.min);
+ slapd_SSL_warn("Default SSL Version settings; "
+ "Configuring the version range as min: %s, max: %s; ",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ } else {
+ /*
+ * slapdNSSVersions.min >= SSL_LIBRARY_VERSION_TLS_1_1 &&
+ * slapdNSSVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1
+ */
+ ;
}
} else {
- slapd_SSL_warn("Security Initialization: "
- "Supported range: min: %s, max: %s; "
- "but the SSL configuration of the server disables nsSSL3 and nsTLS1. "
- "Ignoring nsSSL3: off and nsTLS1: off\n",
- getNSSVersion_str(enabledNSSVersions.min),
- getNSSVersion_str(enabledNSSVersions.max));
- rc = 1;
+ slapd_SSL_warn("Supported range: min: %s, max: %s; "
+ "Respect the configured range.",
+ getNSSVersion_str(enabledNSSVersions.min),
+ getNSSVersion_str(enabledNSSVersions.max));
+ /* nsTLS1 is explicitly set to off. */
+ if (slapdNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
+ enableTLS1 = PR_TRUE;
+ } else if (slapdNSSVersions.max < SSL_LIBRARY_VERSION_TLS_1_1) {
+ enableSSL3 = PR_TRUE;
+ } else {
+ /*
+ * slapdNSSVersions.min <= SSL_LIBRARY_VERSION_TLS_1_0 &&
+ * slapdNSSVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1
+ */
+ enableSSL3 = PR_TRUE;
+ enableTLS1 = PR_TRUE;
+ }
}
}
- if (0 == rc) {
- slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
- "SSL version range: min: %s, max: %s\n",
- getNSSVersion_str(sslversion->min),
- getNSSVersion_str(sslversion->max));
- }
}
#endif
@@ -949,7 +1044,7 @@ slapd_nss_init(int init_ssl, int config_available)
SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
slapi_log_error(SLAPI_LOG_CONFIG, "SSL Initialization",
- "supported range: min: %s, max: %s\n",
+ "supported range by NSS: min: %s, max: %s\n",
getNSSVersion_str(enabledNSSVersions.min),
getNSSVersion_str(enabledNSSVersions.max));
#endif
@@ -1120,11 +1215,9 @@ slapd_ssl_init()
PRErrorCode errorCode;
char ** family_list;
char *val = NULL;
- char cipher_string[1024];
int rv = 0;
PK11SlotInfo *slot;
Slapi_Entry *entry = NULL;
- int allowweakcipher = CIPHER_SET_DEFAULTWEAKCIPHER;
/* Get general information */
@@ -1162,23 +1255,6 @@ slapd_ssl_init()
freeConfigEntry( &entry );
return -1;
}
-
- val = slapi_entry_attr_get_charptr(entry, "allowWeakCipher");
- if (val) {
- if (!PL_strcasecmp(val, "off") || !PL_strcasecmp(val, "false") ||
- !PL_strcmp(val, "0") || !PL_strcasecmp(val, "no")) {
- allowweakcipher = CIPHER_SET_DISALLOWWEAKCIPHER;
- } else if (!PL_strcasecmp(val, "on") || !PL_strcasecmp(val, "true") ||
- !PL_strcmp(val, "1") || !PL_strcasecmp(val, "yes")) {
- allowweakcipher = CIPHER_SET_ALLOWWEAKCIPHER;
- } else {
- slapd_SSL_warn("The value of allowWeakCipher \"%s\" in "
- "cn=encryption,cn=config is invalid. "
- "Ignoring it and set it to default.", val);
- }
- }
- slapi_ch_free((void **) &val);
-
if ((family_list = getChildren(configDN))) {
char **family;
char *token;
@@ -1252,22 +1328,6 @@ slapd_ssl_init()
/* ugaston- Cipher preferences must be set before any sslSocket is created
* for such sockets to take preferences into account.
*/
-
- /* Step Three.5: Set SSL cipher preferences */
- *cipher_string = 0;
- if(ciphers && (*ciphers) && PL_strcmp(ciphers, "blank"))
- PL_strncpyz(cipher_string, ciphers, sizeof(cipher_string));
- slapi_ch_free((void **) &ciphers);
-
- if ( NULL != (val = _conf_setciphers(cipher_string, allowweakcipher)) ) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to set SSL cipher "
- "preference information: %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- val, errorCode, slapd_pr_strerror(errorCode));
- rv = 3;
- slapi_ch_free((void **) &val);
- }
-
freeConfigEntry( &entry );
/* Introduce a way of knowing whether slapd_ssl_init has
@@ -1308,7 +1368,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_2) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1319,7 +1379,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1331,7 +1391,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_3_0) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1342,7 +1402,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1352,12 +1412,12 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
} else {
if (ismin) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
}
@@ -1371,7 +1431,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_0) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1382,7 +1442,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1394,7 +1454,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_1) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1405,7 +1465,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1418,7 +1478,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_2) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is lower than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
@@ -1429,7 +1489,7 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
/* never happens */
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is higher than the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.max));
(*rval) = enabledNSSVersions.max;
} else {
@@ -1441,13 +1501,13 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
if (ismin) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
"\"%s\" is out of the range of the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
"\"%s\" is out of the range of the supported version; "
- "the default value \"%s\" is used.\n",
+ "the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.max;
}
@@ -1455,12 +1515,12 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
} else {
if (ismin) {
slapd_SSL_warn("Security Initialization: The value of sslVersionMin "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.min;
} else {
slapd_SSL_warn("Security Initialization: The value of sslVersionMax "
- "\"%s\" is invalid; the default value \"%s\" is used.\n",
+ "\"%s\" is invalid; the default value \"%s\" is used.",
val, getNSSVersion_str(enabledNSSVersions.min));
(*rval) = enabledNSSVersions.max;
}
@@ -1490,14 +1550,13 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
int slapd_SSLclientAuth;
char* tmpDir;
Slapi_Entry *e = NULL;
- PRBool enableSSL2 = PR_FALSE;
- PRBool enableSSL3 = PR_TRUE;
- PRBool enableTLS1 = PR_TRUE;
PRBool fipsMode = PR_FALSE;
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
PRUint16 NSSVersionMin = enabledNSSVersions.min;
PRUint16 NSSVersionMax = enabledNSSVersions.max;
#endif
+ char cipher_string[1024];
+ int allowweakcipher = CIPHER_SET_DEFAULTWEAKCIPHER;
/* turn off the PKCS11 pin interactive mode */
#ifndef _WIN32
@@ -1839,6 +1898,8 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
} else {
enableTLS1 = slapi_entry_attr_get_bool( e, "nsTLS1" );
}
+ } else if (enabledNSSVersions.max > SSL_LIBRARY_VERSION_TLS_1_0) {
+ enableTLS1 = PR_TRUE; /* If available, enable TLS1 */
}
slapi_ch_free_string( &val );
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
@@ -1853,14 +1914,12 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
}
slapi_ch_free_string( &val );
if (NSSVersionMin > NSSVersionMax) {
- slapd_SSL_warn("Security Initialization: The min value of NSS version range "
- "\"%s\" is greater than the max value \"%s\"; "
- "the default range \"%s\" - \"%s\" is used.\n",
+ slapd_SSL_warn("The min value of NSS version range \"%s\" is greater than the max value \"%s\".",
getNSSVersion_str(NSSVersionMin),
- getNSSVersion_str(NSSVersionMax),
- getNSSVersion_str(enabledNSSVersions.min),
+ getNSSVersion_str(NSSVersionMax));
+ slapd_SSL_warn("Reset the max \"%s\" to supported max \"%s\".",
+ getNSSVersion_str(NSSVersionMax),
getNSSVersion_str(enabledNSSVersions.max));
- NSSVersionMin = enabledNSSVersions.min;
NSSVersionMax = enabledNSSVersions.max;
}
#endif
@@ -1868,18 +1927,21 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
if (NSSVersionMin > 0) {
/* Use new NSS API SSL_VersionRangeSet (NSS3.14 or newer) */
- SSLVersionRange myNSSVersions;
- myNSSVersions.min = NSSVersionMin;
- myNSSVersions.max = NSSVersionMax;
- restrict_SSLVersionRange(&myNSSVersions, enableSSL3, enableTLS1);
- sslStatus = SSL_VersionRangeSet(pr_sock, &myNSSVersions);
+ slapdNSSVersions.min = NSSVersionMin;
+ slapdNSSVersions.max = NSSVersionMax;
+ restrict_SSLVersionRange();
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Configured SSL version range: min: %s, max: %s\n",
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
+ sslStatus = SSL_VersionRangeSet(pr_sock, &slapdNSSVersions);
if (sslStatus == SECSuccess) {
/* Set the restricted value to the cn=encryption entry */
} else {
slapd_SSL_error("SSL Initialization 2: "
"Failed to set SSL range: min: %s, max: %s\n",
- getNSSVersion_str(myNSSVersions.min),
- getNSSVersion_str(myNSSVersions.max));
+ getNSSVersion_str(slapdNSSVersions.min),
+ getNSSVersion_str(slapdNSSVersions.max));
}
} else {
#endif
@@ -1904,6 +1966,36 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
}
#endif
+ val = slapi_entry_attr_get_charptr(e, "allowWeakCipher");
+ if (val) {
+ if (!PL_strcasecmp(val, "off") || !PL_strcasecmp(val, "false") ||
+ !PL_strcmp(val, "0") || !PL_strcasecmp(val, "no")) {
+ allowweakcipher = CIPHER_SET_DISALLOWWEAKCIPHER;
+ } else if (!PL_strcasecmp(val, "on") || !PL_strcasecmp(val, "true") ||
+ !PL_strcmp(val, "1") || !PL_strcasecmp(val, "yes")) {
+ allowweakcipher = CIPHER_SET_ALLOWWEAKCIPHER;
+ } else {
+ slapd_SSL_warn("The value of allowWeakCipher \"%s\" in %s is invalid.",
+ "Ignoring it and set it to default.", val, configDN);
+ }
+ }
+ slapi_ch_free((void **) &val);
+
+ /* Set SSL cipher preferences */
+ *cipher_string = 0;
+ if(ciphers && (*ciphers) && PL_strcmp(ciphers, "blank"))
+ PL_strncpyz(cipher_string, ciphers, sizeof(cipher_string));
+ slapi_ch_free((void **) &ciphers);
+
+ if ( NULL != (val = _conf_setciphers(cipher_string, allowweakcipher)) ) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to set SSL cipher "
+ "preference information: %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ val, errorCode, slapd_pr_strerror(errorCode));
+ rv = 3;
+ slapi_ch_free((void **) &val);
+ }
+
freeConfigEntry( &e );
if(( slapd_SSLclientAuth = config_get_SSLclientAuth()) != SLAPD_SSLCLIENTAUTH_OFF ) {
1
0
src/com/netscape/admin/dirserv/ContentMenuController.java | 66 -
src/com/netscape/admin/dirserv/DSBaseModel.java | 2
src/com/netscape/admin/dirserv/DSContentPage.java | 922 ++++++++------
src/com/netscape/admin/dirserv/DSResourceModel.java | 6
src/com/netscape/admin/dirserv/dirserv.properties | 4
5 files changed, 634 insertions(+), 366 deletions(-)
New commits:
commit e2ab4839652b75e678be9dd8225b050d16c2cfd5
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 23 10:52:03 2014 -0700
Ticket #47380 - RFE: Winsync loses connection with AD objects when they move from the console.
Description: Previously, "move" operation was implemented as the
combination of "cut" and "paste", which was internally, "delete"
and "add". In the windows sync context, delete and add on one
side does not fully recover the other side.
This patch replaces "cut" and "pasted" with "move" and "movepaste".
By "move", it puts selected DN(s) into DN clipboard. If the DN
clipboard is not empty, "movepaste" is enabled, moving the cursor,
selecting the new superior, then choosing movepaste, the entries
in the DN clipboard are moved to the new superior by modrdn. The
movepaste is restlicted to one time operation, that is, once the
move was done, the DN clipboard is cleaned up and movepaste in the
menu is grayed out.
In terms of windows sync, since the modrdn operation is sent and
replayed on the AD, the results on DS and AD are in sync.
Note: At the "move" phase, you could choose multiple entries and
move them into the same destination.
https://fedorahosted.org/389/ticket/47380
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
Per suggestion by Mark, replaced the C style comments with the Java
style ones.
diff --git a/src/com/netscape/admin/dirserv/ContentMenuController.java b/src/com/netscape/admin/dirserv/ContentMenuController.java
index e89841f..9a9121b 100644
--- a/src/com/netscape/admin/dirserv/ContentMenuController.java
+++ b/src/com/netscape/admin/dirserv/ContentMenuController.java
@@ -91,12 +91,13 @@ public class ContentMenuController {
* Enables/disables the menu items, according to which entry is selected.
* It assumes that an object is selected in the tree.
*/
- public void updateMenuState() {
+ public void updateMenuState() {
boolean isRootSelected = _contentPage.isRootSelected();
boolean isSelectedNodeRemote = _contentPage.isSelectedNodeRemote();
boolean isSuffixSelected = _contentPage.isSelectedNodeSuffix();
- boolean isClipboardEmpty = _contentPage.isClipboardEmpty();
- Integer selectionActivationState = new Integer(AccountInactivation.CANNOT_BE_ACTIVATED_INACTIVATED);
+ boolean isClipboardEmpty = _contentPage.isClipboardEmpty();
+ boolean isDnInClipboardEmpty = _contentPage.isDnInClipboardEmpty(); // used by move
+ Integer selectionActivationState = new Integer(AccountInactivation.CANNOT_BE_ACTIVATED_INACTIVATED);
Integer selectionVlvState = new Integer(CreateVLVIndex.CAN_NOT_HAVE_INDEX);
Integer selectionPWPState = new Integer(PasswordPolicyPanel.NO_PWP);
@@ -110,9 +111,10 @@ public class ContentMenuController {
updateAciMenuItems(isRootSelected);
updateRoleMenuItems(isRootSelected);
updateReferralMenuItems(isRootSelected);
- updateCutCopyPasteMenuItems(isRootSelected,
+ updateMoveCopyPasteMenuItems(isRootSelected,
isSuffixSelected,
- isClipboardEmpty);
+ isClipboardEmpty,
+ isDnInClipboardEmpty);
updateSearchMenuItems(isRootSelected);
updateActivateInactivateMenuItems(selectionActivationState, isSelectedNodeRemote);
updateVLVMenuItems(selectionVlvState, isSelectedNodeRemote);
@@ -232,10 +234,10 @@ public class ContentMenuController {
_resource.getString("menu", "inactivate-description"),
_listener),
new MenuItemSeparator(),
- new MenuItemText( CUT,
- _resource.getString("menu", "EditCut"),
+ new MenuItemText( MOVE,
+ _resource.getString("menu", "EditMove"),
_resource.getString("menu",
- "EditCut-description"),
+ "EditMove"),
_listener),
new MenuItemText( COPY,
_resource.getString("menu", "EditCopy"),
@@ -247,6 +249,11 @@ public class ContentMenuController {
_resource.getString("menu",
"EditPaste-description"),
_listener),
+ new MenuItemText( MOVEPASTE,
+ _resource.getString("menu", "EditMovePaste"),
+ _resource.getString("menu",
+ "EditMovePaste-description"),
+ _listener),
new MenuItemText( DELETE,
_resource.getString("menu", "EditDelete"),
_resource.getString("menu",
@@ -257,8 +264,8 @@ public class ContentMenuController {
_resource.getString("menu", "refresh"),
_resource.getString("menu",
"refresh-description"),
- _listener),
- };
+ _listener),
+ };
addShortCuts(_contextMenuItems);
setActionCommand(_contextMenuItems);
}
@@ -453,10 +460,10 @@ public class ContentMenuController {
private void createEditMenuItems() {
_editMenuItems = new IMenuItem[] {
new MenuItemSeparator(),
- new MenuItemText( CUT,
- _resource.getString("menu", "EditCut"),
+ new MenuItemText( MOVE,
+ _resource.getString("menu", "EditMove"),
_resource.getString("menu",
- "EditCut-description"),
+ "EditMove-description"),
_listener),
new MenuItemText( COPY,
_resource.getString("menu", "EditCopy"),
@@ -468,6 +475,11 @@ public class ContentMenuController {
_resource.getString("menu",
"EditPaste-description"),
_listener),
+ new MenuItemText(
+ _resource.getString("menu", "EditMovePaste"),
+ _resource.getString("menu",
+ "EditMovePaste-description"),
+ _listener),
new MenuItemText( DELETE,
_resource.getString("menu", "EditDelete"),
_resource.getString("menu",
@@ -1000,24 +1012,28 @@ public class ContentMenuController {
setEnabledMenuItem(_contextMenuItems, SET_REFERRALS, !isRootSelected);
}
- private void updateCutCopyPasteMenuItems(boolean isRootSelected,
- boolean isSuffixSelected,
- boolean isClipboardEmpty) {
+ private void updateMoveCopyPasteMenuItems(boolean isRootSelected,
+ boolean isSuffixSelected,
+ boolean isClipboardEmpty,
+ boolean isDnInClipboardEmpty) {
setEnabledMenuItem(_editMenuItems, COPY, (!isRootSelected && !isSuffixSelected));
setEnabledMenuItem(_contextMenuItems, COPY, (!isRootSelected && !isSuffixSelected));
- setEnabledMenuItem(_editMenuItems, CUT, (!isRootSelected && !isSuffixSelected));
- setEnabledMenuItem(_contextMenuItems, CUT, (!isRootSelected && !isSuffixSelected));
+ setEnabledMenuItem(_editMenuItems, MOVE, (!isRootSelected && !isSuffixSelected));
+ setEnabledMenuItem(_contextMenuItems, MOVE, (!isRootSelected && !isSuffixSelected));
setEnabledMenuItem(_editMenuItems, DELETE, (!isRootSelected && !isSuffixSelected));
setEnabledMenuItem(_contextMenuItems, DELETE, (!isRootSelected && !isSuffixSelected));
- setEnabledMenuItem(_editMenuItems, COPYDN, !isRootSelected);
- setEnabledMenuItem(_editMenuItems, COPYLDAPURL, !isRootSelected);
-
+ setEnabledMenuItem(_editMenuItems, COPYDN, !isRootSelected);
+ setEnabledMenuItem(_editMenuItems, COPYLDAPURL, !isRootSelected);
+
setEnabledMenuItem(_editMenuItems, PASTE, !isRootSelected && !isClipboardEmpty);
- setEnabledMenuItem(_contextMenuItems, PASTE, !isRootSelected && !isClipboardEmpty);
+ setEnabledMenuItem(_contextMenuItems, PASTE, !isRootSelected && !isClipboardEmpty);
+
+ setEnabledMenuItem(_editMenuItems, MOVEPASTE, !isRootSelected && !isDnInClipboardEmpty);
+ setEnabledMenuItem(_contextMenuItems, MOVEPASTE, !isRootSelected && !isDnInClipboardEmpty);
}
private void updatePWPMenuItems(Integer selectionPWPState,
@@ -1136,8 +1152,9 @@ public class ContentMenuController {
//_shortCutTable.put(REFRESHTREE, KeyStroke.getKeyStroke(KeyEvent.VK_R, Event.CTRL_MASK));
_shortCutTable.put(REFRESHNODE, KeyStroke.getKeyStroke(KeyEvent.VK_R, Event.CTRL_MASK));
_shortCutTable.put(COPY, KeyStroke.getKeyStroke(KeyEvent.VK_C, Event.CTRL_MASK));
- _shortCutTable.put(CUT, KeyStroke.getKeyStroke(KeyEvent.VK_X, Event.CTRL_MASK));
+ _shortCutTable.put(MOVE, KeyStroke.getKeyStroke(KeyEvent.VK_M, Event.CTRL_MASK));
_shortCutTable.put(PASTE, KeyStroke.getKeyStroke(KeyEvent.VK_V, Event.CTRL_MASK));
+ _shortCutTable.put(MOVEPASTE, KeyStroke.getKeyStroke(KeyEvent.VK_W, Event.CTRL_MASK));
_shortCutTable.put(DELETE, KeyStroke.getKeyStroke(KeyEvent.VK_D, Event.CTRL_MASK));
}
@@ -1190,9 +1207,10 @@ public class ContentMenuController {
static final String ROLES = "roles";
static final String SET_REFERRALS = "referral";
static final String AUTHENTICATE = "authenticate";
- static final String CUT = "cut";
+ static final String MOVE = "move";
static final String COPY = "copy";
static final String PASTE = "paste";
+ static final String MOVEPASTE = "movepaste";
static final String UNDO = "undo";
static final String DELETE = "delete";
static final String NEW_USER = "newuser";
diff --git a/src/com/netscape/admin/dirserv/DSBaseModel.java b/src/com/netscape/admin/dirserv/DSBaseModel.java
index 1e719d9..bff044c 100644
--- a/src/com/netscape/admin/dirserv/DSBaseModel.java
+++ b/src/com/netscape/admin/dirserv/DSBaseModel.java
@@ -455,8 +455,10 @@ abstract public class DSBaseModel extends ResourceModel
static final String ROLES = "roles";
static final String AUTHENTICATE = "authenticate";
static final String CUT = "cut";
+ static final String MOVE = "move";
static final String COPY = "copy";
static final String PASTE = "paste";
+ static final String MOVEPASTE = "movepaste";
static final String UNDO = "undo";
static final String DELETE = "delete";
static final String NEW_USER = "newuser";
diff --git a/src/com/netscape/admin/dirserv/DSContentPage.java b/src/com/netscape/admin/dirserv/DSContentPage.java
index bb6de7b..57f6503 100644
--- a/src/com/netscape/admin/dirserv/DSContentPage.java
+++ b/src/com/netscape/admin/dirserv/DSContentPage.java
@@ -71,7 +71,6 @@ implements IPage,
}
-
/**
* IPage implementation
* ====================
@@ -184,7 +183,7 @@ implements IPage,
_controller.setContainerClasses(CONTAINER_OBJECTCLASSES);
_controller.setMaxChildren(DISPLAYED_CHILDREN_LIMIT);
- /* Create the children controller */
+ // Create the children controller
_childrenController = new ChildrenController(_list,
_connectionPool,
_iconPool);
@@ -198,14 +197,14 @@ implements IPage,
_attributePanel);
- /* Create the database config object */
+ // Create the database config object
_databaseConfig = new DatabaseConfig();
// NUMSUBORDINATE HACK
// We attach the hacker to the (tree) browser controller.
_controller.setNumSubordinateHacker(_databaseConfig.getNumSubordinateHacker());
- /* Create the menu controller */
+ // Create the menu controller
_menuController = new ContentMenuController(DSContentPage.this,
_contextMenu,
_framework,
@@ -237,7 +236,7 @@ implements IPage,
}});
}
- /* Create the entry editor */
+ // Create the entry editor
_entryEditor = new EntryEditor(getSchema(), _framework, _databaseConfig);
Vector vSuffixes = _databaseConfig.getRootSuffixesWithEntry();
if (vSuffixes.size() > 0) {
@@ -273,7 +272,7 @@ implements IPage,
_childrenController.setFollowReferrals(followReferrals);
- /* Initialize the display */
+ // Initialize the display
_controller.setDisplayFlags(_display);
_childrenController.setDisplayFlags(_display);
@@ -376,10 +375,10 @@ implements IPage,
if (_isInitialized) {
try {
refreshDatabaseConfigAndSuffixes(/*refreshAll=*/false);
- /* Give the focus to the main tree */
+ // Give the focus to the main tree
_tree.grabFocus();
_menuController.populateMenuItems();
- /* Refresh the menus */
+ // Refresh the menus
_menuController.recreateDynamicMenus();
} catch (Exception e) {
}
@@ -406,9 +405,9 @@ implements IPage,
* IContentPageInfo implementation
* ============================================
*/
- /**
- * Implements IContentPageInfo
- */
+ /**
+ * Implements IContentPageInfo
+ */
public boolean isRootSelected() {
boolean isRootSelected = false;
IBrowserNodeInfo node = getSelectedNodeInfo();
@@ -438,18 +437,23 @@ implements IPage,
}
return isSelectedNodeSuffix;
}
- /**
- * Implements IContentPageInfo
- */
+
+ /**
+ * Implements IContentPageInfo
+ */
public boolean isClipboardEmpty() {
return (_clipboard.isEmpty());
}
- /**
- * Implements IContentPageInfo
- *
- * Should not be called if the node is remote
- */
+ public boolean isDnInClipboardEmpty() {
+ return (_clipboard.isDnEmpty());
+ }
+
+ /**
+ * Implements IContentPageInfo
+ *
+ * Should not be called if the node is remote
+ */
public Integer getSelectionVlvState() {
IBrowserNodeInfo node = getSelectedNodeInfo();
return getNodeVlvState(node);
@@ -458,22 +462,22 @@ implements IPage,
/**
*
* Should not be called if the node is remote
- */
+ */
Integer getNodeVlvState(IBrowserNodeInfo node) {
Integer state = new Integer(CreateVLVIndex.CAN_NOT_HAVE_INDEX);
- if (node != null) {
- String dn = Helper.getNodeInfoDN(node);
+ if (node != null) {
+ String dn = Helper.getNodeInfoDN(node);
if (dn != null) {
- state = (Integer)_vlvCache.get(dn);
- if (state == null) {
+ state = (Integer)_vlvCache.get(dn);
+ if (state == null) {
try {
state = new Integer(CreateVLVIndex.CAN_NOT_HAVE_INDEX);
state = new Integer(CreateVLVIndex.indexStatus(dn,
- _framework.getServerObject().getServerInfo()));
- } catch (LDAPException lde) {
+ _framework.getServerObject().getServerInfo()));
+ } catch (LDAPException lde) {
/* If something gone wrong we keep the default value CAN_NOT_HAVE_INDEX:
- this is called by the menu controller and it has no context enough to display error*/
- }
+ this is called by the menu controller and it has no context enough to display error*/
+ }
_vlvCache.put(dn, state);
}
}
@@ -482,31 +486,31 @@ implements IPage,
}
/**
- * This method should return what type of PWP may be added to the selected
- * node. Options are NO_PWP, USER_PWP, SUBTREE_PWP or BOTH_PWP (defined in
- * PasswordPolicyPanel.
- *
- * Should not be called if the node is remote
- */
+ * This method should return what type of PWP may be added to the selected
+ * node. Options are NO_PWP, USER_PWP, SUBTREE_PWP or BOTH_PWP (defined in
+ * PasswordPolicyPanel.
+ *
+ * Should not be called if the node is remote
+ */
public Integer getSelectionPWPState() {
Integer state = new Integer(PasswordPolicyPanel.BOTH_PWP);
return state;
}
- /**
- * Implements IContentPageInfo
- *
- * Should not be called if the node is remote
- */
+ /**
+ * Implements IContentPageInfo
+ *
+ * Should not be called if the node is remote
+ */
public Integer getSelectionActivationState() {
Integer state = new Integer(AccountInactivation.CANNOT_BE_ACTIVATED_INACTIVATED);
IBrowserNodeInfo node = getSelectedNodeInfo();
- if (node != null && node.getErrorType() == node.ERROR_NONE) {
- String dn = Helper.getNodeInfoDN(node);
+ if (node != null && node.getErrorType() == node.ERROR_NONE) {
+ String dn = Helper.getNodeInfoDN(node);
if (dn != null) {
- state = (Integer)_activationCache.get(dn);
- if (state == null) {
+ state = (Integer)_activationCache.get(dn);
+ if (state == null) {
try {
state = new Integer(AccountInactivation.CANNOT_BE_ACTIVATED_INACTIVATED);
String[] attrs = {"nsrole", "nsroledn", "objectclass", "nsAccountLock"};
@@ -515,16 +519,16 @@ implements IPage,
LDAPEntry entry = ldc.read(dn, attrs);
if (entry != null) {
AccountInactivation account = new AccountInactivation(entry);
- state = new Integer(account.operationAllowed(ldc));
+ state = new Integer(account.operationAllowed(ldc));
}
try {
ldc.disconnect(); // prepareReferralConnection clones connection
} catch (Exception ignore) {}
_connectionPool.releaseConnection(ldc0);
- } catch (LDAPException lde) {
+ } catch (LDAPException lde) {
/* If something gone wrong we keep the default value CANNOT_BE_ACTIVATED_INACTIVATED:
this is called by the menu controller and it has no context enough to display error*/
- }
+ }
_activationCache.put(dn, state);
}
}
@@ -532,37 +536,37 @@ implements IPage,
return state;
}
- /**
- * Implements IContentPageInfo
- */
+ /**
+ * Implements IContentPageInfo
+ */
public String getPanelLayout() {
return _layout;
}
- /**
- * Implements IContentPageInfo
- */
+ /**
+ * Implements IContentPageInfo
+ */
public int getDisplay() {
return _display;
}
- /**
- * Implements IContentPageInfo
- */
+ /**
+ * Implements IContentPageInfo
+ */
public boolean isSorted() {
return _controller.isSorted();
}
- /**
- * Implements IContentPageInfo
- */
+ /**
+ * Implements IContentPageInfo
+ */
public boolean getFollowReferrals() {
return _controller.getFollowReferrals();
}
- /**
- * Implements IContentPageInfo
- */
+ /**
+ * Implements IContentPageInfo
+ */
public String getSelectedPartitionView() {
return _selectedPartitionView;
}
@@ -803,19 +807,22 @@ implements IPage,
actionAuthenticate();
} else if( cmd.equals( ContentMenuController.COPY ) ) {
- actionCopy( );
+ actionCopy();
+
+ } else if( cmd.equals( ContentMenuController.PASTE ) ) {
+ actionPaste();
- } else if( cmd.equals( ContentMenuController.PASTE ) ) {
- actionPaste( );
+ } else if( cmd.equals( ContentMenuController.MOVEPASTE ) ) {
+ actionMovePaste();
- } else if( cmd.equals( ContentMenuController.CUT ) ) {
- actionCut();
+ } else if( cmd.equals( ContentMenuController.MOVE ) ) {
+ actionMove();
} else if( cmd.equals( ContentMenuController.DELETE ) ) {
actionDelete();
} else if( cmd.equals( ContentMenuController.COPYDN ) ) {
- actionCopyDN( );
+ actionCopyDN(false);
} else if( cmd.equals( ContentMenuController.COPYLDAPURL ) ) {
actionCopyLDAPURL( );
@@ -856,11 +863,11 @@ implements IPage,
} else if( cmd.equals( ContentMenuController.DELETE_VLV_INDEX ) ) {
actionDeleteVLVIndex( );
- } else if( cmd.equals( ContentMenuController.SET_PWP_USER ) ) {
- actionSetPWP(PasswordPolicyPanel.FINEGRAINED_USER );
+ } else if( cmd.equals( ContentMenuController.SET_PWP_USER ) ) {
+ actionSetPWP(PasswordPolicyPanel.FINEGRAINED_USER );
- } else if( cmd.equals( ContentMenuController.SET_PWP_SUBTREE ) ) {
- actionSetPWP(PasswordPolicyPanel.FINEGRAINED_SUBTREE );
+ } else if( cmd.equals( ContentMenuController.SET_PWP_SUBTREE ) ) {
+ actionSetPWP(PasswordPolicyPanel.FINEGRAINED_SUBTREE );
} else if ( cmd.equals( ContentMenuController.FOLLOW_REFERRALS ) ) {
actionFollowReferrals();
@@ -1040,7 +1047,7 @@ implements IPage,
public void mouseEntered(MouseEvent e) {
}
- /**
+ /**
* MouseListener implementation
* ====================================
*
@@ -1048,7 +1055,7 @@ implements IPage,
public void mouseExited(MouseEvent e) {
}
- /**
+ /**
* MouseListener implementation
* ====================================
*
@@ -1063,7 +1070,7 @@ implements IPage,
}
}
- /**
+ /**
* FocusListener implementation
* ====================================
*/
@@ -1149,16 +1156,16 @@ implements IPage,
}
}
- /**
- * This method is called before we expand a node in the tree, or we select a node and we have
- * a node/leaf view. In other words, before we search for the children of a node.
- *
- * Checks the number of children of a given node, and, considering the display options
- * chosen, asks the user for confirmation to continue or not.
- *
- * Return true if the user chooses to continue with the operation (display children of the node).
- * false otherwise.
- */
+ /**
+ * This method is called before we expand a node in the tree, or we select a node and we have
+ * a node/leaf view. In other words, before we search for the children of a node.
+ *
+ * Checks the number of children of a given node, and, considering the display options
+ * chosen, asks the user for confirmation to continue or not.
+ *
+ * Return true if the user chooses to continue with the operation (display children of the node).
+ * false otherwise.
+ */
private boolean checkChildrenForNode(IBrowserNodeInfo node) {
int vlvState = getNodeVlvState(node).intValue();
@@ -1264,16 +1271,16 @@ implements IPage,
_controller.setFollowReferrals(!_controller.getFollowReferrals());
_childrenController.setFollowReferrals(_controller.getFollowReferrals());
- /* Clear the selection... */
+ // Clear the selection...
_tree.clearSelection();
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
- /* Refresh the vlv cache */
+ // Refresh the vlv cache
_vlvCache.clear();
- /* Refresh the activation cache */
+ // Refresh the activation cache
_activationCache.clear();
_preferences.set(FOLLOW_REFERRALS_PREFERENCES, _controller.getFollowReferrals());
@@ -1281,35 +1288,35 @@ implements IPage,
private void actionRefreshTree() {
- /* Clear the selection... */
+ // Clear the selection...
_list.clearSelection();
_tree.clearSelection();
- /* Refresh the database config */
+ // Refresh the database config
/* NOTE: if we implement a listener mechanism for the database config,
we should modify this */
refreshDatabaseConfigAndSuffixes(/*refreshAll=*/true);
- /* Refresh the schema */
+ // Refresh the schema
setSchema(null);
_allAttrs = null;
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
- /* Refresh the vlv cache */
+ // Refresh the vlv cache
_vlvCache.clear();
- /* Refresh the activation cache */
+ // Refresh the activation cache
_activationCache.clear();
- /* Refresh the entry Editor */
+ // Refresh the entry Editor
_entryEditor.setSchema(getSchema());
- /* Refresh the menus */
+ // Refresh the menus
_menuController.recreateDynamicMenus();
- /* Execute the refresh in the tree */
+ // Execute the refresh in the tree
_tree.grabFocus();
_controller.startRefresh();
}
@@ -1317,16 +1324,16 @@ implements IPage,
private void actionRefreshNode() {
if (_lastFocusComponent == _list) {
- /* Execute the refresh for the list node */
+ // Execute the refresh for the list node
_childrenController.startRefresh(getSelectedNodeInfo());
return;
}
- /* Execute the refresh for the tree node */
+ // Execute the refresh for the tree node
_tree.grabFocus();
_controller.startRefresh(getSelectedNodeInfo());
- /* Unselect/seclect the node for the full refresh */
+ // Unselect/seclect the node for the full refresh
TreePath path = _tree.getSelectionPath();
_tree.clearSelection();
_tree.setSelectionPath(path);
@@ -1418,7 +1425,7 @@ implements IPage,
controllerLdc.getSearchConstraints().setServerControls(newCtls);
}
- /* Update the tree */
+ // Update the tree
String selectedSuffix = _databaseConfig.getSuffixForDatabase(partition);
_controller.removeAllSuffixes();
_controller.addSuffix(selectedSuffix, null);
@@ -1439,7 +1446,7 @@ implements IPage,
controllerLdc.getSearchConstraints().setServerControls(newCtls);
}
- /* Update the tree */
+ // Update the tree
_controller.removeAllSuffixes();
Vector vSuffixes = _databaseConfig.getRootSuffixesWithEntry();
// We populate the browser controller
@@ -1455,7 +1462,7 @@ implements IPage,
getFollowReferrals()) {
actionFollowReferrals();
} else {
- /* Follow referrals clears selection: do the same thing */
+ // Follow referrals clears selection: do the same thing
_tree.clearSelection();
}
}
@@ -1613,7 +1620,7 @@ implements IPage,
}
if (ldc != null) {
String dn = Helper.getNodeInfoDN(node);
- /* Do the copy */
+ // Do the copy
LDAPConnection ldcNr = prepareReferralConnection(ldc);
/* For the copy we need to not limit the number of results in the
search constraints */
@@ -1629,14 +1636,14 @@ implements IPage,
ldcNr.disconnect(); // prepareReferralConnection clones connection
} catch (Exception ignore) {}
_connectionPool.releaseConnection(ldc);
- /* In order to update the Paste menu */
+ // In order to update the Paste menu
_menuController.updateMenuState();
}
}
}
}
- private void actionCopyDN() {
+ private void actionCopyDN(boolean move) {
IBrowserNodeInfo node = getSelectedNodeInfo();
if (node != null) {
if (continueOperation(node)) {
@@ -1645,6 +1652,9 @@ implements IPage,
Toolkit.getDefaultToolkit().getSystemClipboard().setContents(
ss,
ss );
+ if (move) {
+ _clipboard.putDn(dn);
+ }
}
}
}
@@ -1659,6 +1669,11 @@ implements IPage,
}
}
+ private void actionMove() {
+ actionCopyDN(true);
+ _menuController.updateMenuState();
+ }
+
private void actionPaste() {
IBrowserNodeInfo node = getSelectedNodeInfo();
if (node != null) {
@@ -1671,12 +1686,12 @@ implements IPage,
}
if (ldc != null) {
String dn = Helper.getNodeInfoDN(node);
- /* Do the paste */
+ // Do the paste
LDAPConnection ldcNr = prepareReferralConnection(ldc);
Paster paster = new Paster(ldcNr, dn, _framework, _clipboard);
paster.execute();
- /* Update the tree */
+ // Update the tree
Vector addedRootEntries = paster.getPastedRootEntries();
if (addedRootEntries != null) {
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
@@ -1709,6 +1724,57 @@ implements IPage,
}
}
+ private void actionMovePaste() {
+ Debug.println("DSContentPage.actionMovePaste()");
+ IBrowserNodeInfo node = getSelectedNodeInfo();
+ if (node != null) {
+ if (continueOperation(node)) {
+ LDAPConnection ldc = null;
+ try {
+ ldc = getConnectionForNode(node);
+ } catch (LDAPException e) {
+ displayConnectionError(e, node);
+ }
+ if (ldc != null) {
+ String dn = Helper.getNodeInfoDN(node);
+ // Do the paste
+ LDAPConnection ldcNr = prepareReferralConnection(ldc);
+ MovePaster movePaster = new MovePaster(ldcNr, dn, _framework, _clipboard);
+ movePaster.execute();
+
+ // Update the tree
+ Vector addedRootEntries = movePaster.getMovedRootEntries();
+ if (addedRootEntries != null) {
+ if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
+ (_lastFocusComponent == _tree)) {
+ Enumeration e = addedRootEntries.elements();
+ while (e.hasMoreElements()) {
+ String pastedDn = (String)e.nextElement();
+ _controller.notifyEntryAdded(node, pastedDn);
+ if (_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT)) {
+ _childrenController.notifyEntryAdded(pastedDn);
+ }
+ }
+ } else if (_lastFocusComponent == _list) {
+ _childrenController.notifyEntryChanged(node);
+ TreePath path = getLastSelectedPath();
+ if (path != null) {
+ IBrowserNodeInfo treeNode = _controller.getNodeInfoFromPath(path);
+ if (treeNode != null) {
+ _controller.notifyChildEntryChanged(treeNode, dn);
+ }
+ }
+ }
+ }
+ try {
+ ldcNr.disconnect(); // prepareReferralConnection clones connection
+ } catch (Exception ignore) {}
+ _connectionPool.releaseConnection(ldc);
+ }
+ }
+ }
+ }
+
private void actionCut() {
IBrowserNodeInfo node = getSelectedNodeInfo();
if (node != null) {
@@ -1721,7 +1787,7 @@ implements IPage,
}
if (ldc != null) {
String dn = Helper.getNodeInfoDN(node);
- /* Do the cut */
+ // Do the cut
LDAPConnection ldcNr = prepareReferralConnection(ldc);
/* For the cut we need to not limit the number of results in the
search constraints */
@@ -1732,12 +1798,12 @@ implements IPage,
CutDeleter cutter = new CutDeleter(ldcNr, dn, _framework, _clipboard, true);
cutter.execute();
- /* In order to update the Paste menu */
+ // In order to update the Paste menu
_menuController.updateMenuState();
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
(_lastFocusComponent == _tree)) {
- /* Select the parent of the entry we tried to delete */
+ // Select the parent of the entry we tried to delete
TreePath parentPath = getLastSelectedPath().getParentPath();
_tree.setSelectionPath(parentPath);
}
@@ -1745,7 +1811,7 @@ implements IPage,
if (cutter.isWholeTreeDeleted()) {
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
(_lastFocusComponent == _tree)) {
- /* If everything deleted, just inform the browser controller */
+ // If everything deleted, just inform the browser controller
_controller.notifyEntryDeleted(node);
} else if (_lastFocusComponent == _list) {
_childrenController.notifyEntryDeleted(node);
@@ -1761,7 +1827,7 @@ implements IPage,
} else {
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
(_lastFocusComponent == _tree)) {
- /* If not, refresh it */
+ // If not, refresh it
_controller.startRefresh(node);
} else if (_lastFocusComponent == _list) {
_childrenController.notifyEntryChanged(node);
@@ -1796,7 +1862,7 @@ implements IPage,
if (ldc != null) {
String dn = Helper.getNodeInfoDN(node);
- /* Do the delete */
+ // Do the delete
LDAPConnection ldcNr = prepareReferralConnection(ldc);
/* For the delete we need to not limit the number of results in the
search constraints */
@@ -1810,7 +1876,7 @@ implements IPage,
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
(_lastFocusComponent == _tree)) {
- /* Select the parent of the entry we tried to delete */
+ // Select the parent of the entry we tried to delete
TreePath parentPath = getLastSelectedPath().getParentPath();
_tree.setSelectionPath(parentPath);
}
@@ -1818,7 +1884,7 @@ implements IPage,
if (deleter.isWholeTreeDeleted()) {
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
(_lastFocusComponent == _tree)) {
- /* If everything deleted, just inform the browser controller */
+ // If everything deleted, just inform the browser controller
_controller.notifyEntryDeleted(node);
} else if (_lastFocusComponent == _list) {
_childrenController.notifyEntryDeleted(node);
@@ -1834,7 +1900,7 @@ implements IPage,
} else {
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
(_lastFocusComponent == _tree)) {
- /* If not, refresh it */
+ // If not, refresh it
_controller.startRefresh(node);
} else if (_lastFocusComponent == _list) {
_childrenController.notifyEntryChanged(node);
@@ -1856,17 +1922,16 @@ implements IPage,
}
}
- /**
- * This method is called after we delete a WHOLE subtree
- *
- * It checks if the 'New Root Entry' menu has to be updated or not.
- *
- * @returns true if the DatabaseConfig has been updated. false otherwise.
- *
- */
+ /**
+ * This method is called after we delete a WHOLE subtree
+ *
+ * It checks if the 'New Root Entry' menu has to be updated or not.
+ *
+ * @returns true if the DatabaseConfig has been updated. false otherwise.
+ */
private boolean checkObjectDeleted(String deletedObjectDn, LDAPConnection ldc) {
boolean databaseConfigUpdated = false;
- /* We see if we deleted one of the root suffixes, and if so, tell to update the menu */
+ // We see if we deleted one of the root suffixes, and if so, tell to update the menu
DN dn1 = new DN (deletedObjectDn);
Vector rootSuffixesWithEntry = _databaseConfig.getRootSuffixesWithEntry();
for (int i=0; (i< rootSuffixesWithEntry.size()) && !databaseConfigUpdated; i++) {
@@ -1878,7 +1943,7 @@ implements IPage,
}
}
if (databaseConfigUpdated) {
- /* Update the new root entry menu items */
+ // Update the new root entry menu items
_menuController.recreateNewRootEntryMenus();
}
return databaseConfigUpdated;
@@ -1915,14 +1980,14 @@ implements IPage,
String ugDn;
if (ugLdc.getHost().equals(aciLdc.getHost()) &&
(ugLdc.getPort() == aciLdc.getPort())) {
- Debug.println("ContentModel.actionACL: ACI and users are on the same directory");
+ Debug.println("ContentPage.actionACL: ACI and users are on the same directory");
ugDn = Console.getConsoleInfo().getUserBaseDN();
}
else {
- Debug.println("ContentModel.actionACL: ACI and users are on different directories");
+ Debug.println("ContentPage.actionACL: ACI and users are on different directories");
ugDn = _databaseConfig.getRootSuffixForEntry(dn);
}
- Debug.println("ContentModel.actionACL: users will be search from " + ugDn);
+ Debug.println("ContentPage.actionACL: users will be search from " + ugDn);
ACIManager acm = new ACIManager(_framework, dn, aciLdc, dn, aciLdc, ugDn);
acm.show();
try {
@@ -1942,7 +2007,7 @@ implements IPage,
}
}
}
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
}
}
@@ -1952,7 +2017,7 @@ implements IPage,
private void actionRoles() {
IBrowserNodeInfo node = getSelectedNodeInfo();
if ( node != null ) {
- /* Only allow to set roles of the entries in the server */
+ // Only allow to set roles of the entries in the server
if (!node.isRemote()) {
String dn = Helper.getNodeInfoDN(node);
@@ -1982,7 +2047,7 @@ implements IPage,
}
}
}
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
try {
ldc.disconnect(); // prepareReferralConnection clones connection
@@ -2031,7 +2096,7 @@ implements IPage,
if (ed.isAuthModified()) {
_controller.notifyAuthDataChanged(null);
}
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
}
}
@@ -2145,7 +2210,7 @@ implements IPage,
task.getLockingInfrastructureDNs());
}
});
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
_activationCache.remove(Helper.getNodeInfoDN(node));
_menuController.updateMenuState();
@@ -2180,7 +2245,7 @@ implements IPage,
IBrowserNodeInfo suffixNode = _controller.getNodeInfoFromPath(parentPath);
String nextEntry;
- /* If the selected node in the tree is the suffix node we have to update the children panel*/
+ // If the selected node in the tree is the suffix node we have to update the children panel.
boolean updateChildrenPanel = false;
if (_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT)) {
TreePath path = getLastSelectedPath();
@@ -2276,7 +2341,7 @@ implements IPage,
try {
ldc.disconnect(); // prepareReferralConnection clones connection
} catch (Exception ignore) {}
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
_activationCache.remove(Helper.getNodeInfoDN(node));
_menuController.updateMenuState();
@@ -2440,7 +2505,7 @@ implements IPage,
// is not returned a referral exception (in the case of node
// is a referral).
LDAPConnection editLdc = prepareReferralConnection(ldc);
- /* We are editing a role: we need to not limit the number of results in the search constraints */
+ // We are editing a role: we need to not limit the number of results in the search constraints
LDAPSearchConstraints cons =
editLdc.getSearchConstraints();
cons.setMaxResults(0);
@@ -2576,21 +2641,21 @@ implements IPage,
}
}
- /**
- * Method called after editing an entry. It assumes that the entry has been
- * modified. It updates consequently the tree (or the children list) and the
- * entry cache of the attribute controller.
- */
+ /**
+ * Method called after editing an entry. It assumes that the entry has been
+ * modified. It updates consequently the tree (or the children list) and the
+ * entry cache of the attribute controller.
+ */
private void updateAfterModify(IBrowserNodeInfo node, String editedObjectDn, LDAPConnection editLdc) {
String oldDn = Helper.getNodeInfoDN(node);
DN oldDN = new DN(oldDn);
DN newDN = new DN(editedObjectDn);
if (!oldDN.equals(newDN)) {
- /* We modified the rdn, have to check the new root menu items */
+ // We modified the rdn, have to check the new root menu items
checkObjectAdded(editedObjectDn, editLdc);
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
(_lastFocusComponent == _tree)) {
- /* Update the tree */
+ // Update the tree
TreePath parentPath = _controller.notifyEntryDeleted(node);
IBrowserNodeInfo parentNode = _controller.getNodeInfoFromPath(parentPath);
TreePath newPath = _controller.notifyEntryAdded(parentNode,
@@ -2598,7 +2663,7 @@ implements IPage,
_tree.setSelectionPath(newPath);
_selectedDnLabel.setText(editedObjectDn);
} else if (_lastFocusComponent == _list) {
- /* Update the list */
+ // Update the list
_childrenController.notifyEntryDNChanged(node, editedObjectDn);
TreePath path = getLastSelectedPath();
@@ -2626,22 +2691,22 @@ implements IPage,
}
}
}
- /* Refresh the attribute table */
+ // Refresh the attribute table
_attributeController.reset();
}
- /**
- * This method is called after we add an entry or we modify an rdn.
- *
- * It checks if the 'New Root Entry' menu has to be udpated or not.
- * It checks if the user can see the added entry or not and if he/she can't
- * display an information dialog giving the reason
- *
- * @returns true if the DatabaseConfig has been updated. false otherwise.
- */
+ /**
+ * This method is called after we add an entry or we modify an rdn.
+ *
+ * It checks if the 'New Root Entry' menu has to be udpated or not.
+ * It checks if the user can see the added entry or not and if he/she can't
+ * display an information dialog giving the reason
+ *
+ * @returns true if the DatabaseConfig has been updated. false otherwise.
+ */
private boolean checkObjectAdded(String newObjectDn, LDAPConnection ldc) {
boolean databaseConfigUpdated = false;
- /* We see if we added one of the root suffixes, and if so, tell to update the menu */
+ // We see if we added one of the root suffixes, and if so, tell to update the menu
DN dn1 = new DN (newObjectDn);
Vector rootSuffixesWithoutEntry = _databaseConfig.getRootSuffixesWithoutEntry();
for (int i=0; (i< rootSuffixesWithoutEntry.size()) && !databaseConfigUpdated; i++) {
@@ -2654,7 +2719,7 @@ implements IPage,
}
if (databaseConfigUpdated) {
- /* Update the new root entry menu items */
+ // Update the new root entry menu items
_menuController.recreateNewRootEntryMenus();
}
@@ -2690,12 +2755,12 @@ implements IPage,
return databaseConfigUpdated;
}
- /**
- * Method called after added an entry. It updates properly the tree and (if visible)
- * the list of children.
- *
- * It assumes that the parentNode corresponds to the selection done by the user
- */
+ /**
+ * Method called after added an entry. It updates properly the tree and (if visible)
+ * the list of children.
+ *
+ * It assumes that the parentNode corresponds to the selection done by the user
+ */
private void updateViewAfterAdd(LDAPEntry newObject, IBrowserNodeInfo parentNode) {
String newObjectDn = newObject.getDN();
if (!_layout.equals(ContentMenuController.NODE_LEAF_LAYOUT) ||
@@ -2706,7 +2771,7 @@ implements IPage,
_controller.notifyEntryAdded(parentNode, newObjectDn);
}
} else {
- /* We show everything in the tree in this case */
+ // We show everything in the tree in this case
_controller.notifyEntryAdded(parentNode, newObjectDn);
}
} else if (_lastFocusComponent == _list) {
@@ -2741,12 +2806,12 @@ implements IPage,
private void actionAuthenticate() {
boolean status = getNewAuthentication();
- /* If everything went OK, refresh the tree... */
+ // If everything went OK, refresh the tree...
if ( status ) {
_controller.setLDAPConnection(_framework.getServerObject().getServerInfo().getLDAPConnection());
actionRefreshTree();
} else {
- Debug.println("ContentModel.actionAuthenticate(): could not reauthenticate");
+ Debug.println("ContentPage.actionAuthenticate(): could not reauthenticate");
}
}
@@ -2770,7 +2835,7 @@ implements IPage,
- /* Fast method to detect if an entry has children or not */
+ // Fast method to detect if an entry has children or not
protected boolean entryHasChildren(LDAPEntry entry) {
boolean hasChildren = false;
LDAPAttribute attr = entry.getAttribute("numsubordinates");
@@ -2988,10 +3053,10 @@ implements IPage,
private Clipboard _clipboard = new Clipboard();
- /* Objects interested in authentication changes */
+ // Objects interested in authentication changes
private Vector _authListeners = new Vector();
- /* List of all the attributesfor the property editor */
+ // List of all the attributesfor the property editor
private String[] _allAttrs = null;
}
@@ -3087,7 +3152,7 @@ class SearchUG implements IRPCallBack, MouseListener {
public void mousePressed(MouseEvent e) {
}
- /**
+ /**
* MouseListener implementation
* ====================================
*
@@ -3103,7 +3168,7 @@ class SearchUG implements IRPCallBack, MouseListener {
public void mouseEntered(MouseEvent e) {
}
- /**
+ /**
* MouseListener implementation
* ====================================
*
@@ -3111,7 +3176,7 @@ class SearchUG implements IRPCallBack, MouseListener {
public void mouseExited(MouseEvent e) {
}
- /**
+ /**
* MouseListener implementation
* ====================================
*
@@ -3139,7 +3204,7 @@ class SearchUG implements IRPCallBack, MouseListener {
private CustomNode createNode(LDAPEntry entry) {
CustomNode node = new CustomNode(entry.getDN());
- /* Get the objectclass */
+ // Get the objectclass
LDAPAttribute objectClass = entry.getAttribute("objectclass");
Icon icon = _iconPool.getIcon(objectClass, 0);
@@ -3480,7 +3545,7 @@ class Inactivator implements ActionListener, Runnable {
"accountinactivation-inactivate", "cannotinactivate", abreviatedDN)+"\n");
break;
case AccountInactivation.ROOT_OR_CONFIG_ENTRY:
- /* Assume we could not find the suffixes because the entry is in the config, is cn=config, is cn=schema, cn=monitor... */
+ // Assume we could not find the suffixes because the entry is in the config, is cn=config, is cn=schema, cn=monitor...
_dlg.appendTextToTextArea(DSUtil._resource.getString(
"accountinactivation-inactivate", "rootorconfigentry", abreviatedDN)+"\n");
break;
@@ -3556,11 +3621,11 @@ class UserGroupAdapter implements IResEditorAdvancedOpt {
LDAPEntry entry;
DSEntryDialog dlg;
if ( observableentry.isNewUser() ) {
- /* Preliminary DN - null from Kingpin */
+ // Preliminary DN - null from Kingpin
String dn = observableentry.getDN();
Debug.println( "UserGroupAdapter.run: DN = " +
dn );
- /* Get all attributes set by the custom editor */
+ // Get all attributes set by the custom editor
LDAPAttributeSet set = new LDAPAttributeSet();
Enumeration en = observableentry.getAttributesList();
if ( en != null ) {
@@ -3573,7 +3638,7 @@ class UserGroupAdapter implements IResEditorAdvancedOpt {
v.removeAllElements();
}
}
- /* Get all required attributes for the object classes */
+ // Get all required attributes for the object classes
String key = "cn";
Vector v = observableentry.get( "objectclass" );
LDAPSchema schema = _page.getSchema();
@@ -3598,7 +3663,7 @@ class UserGroupAdapter implements IResEditorAdvancedOpt {
Debug.println( "UserGroupAdapter.run: " +
"key = " + key );
if ( dn == null ) {
- /* Get rdn */
+ // Get rdn
String rdn = getFirstStringValue( set, key );
if ( (rdn == null) || (rdn.length() < 1) ) {
rdn = DSContentPage.DEFAULT_NEW;
@@ -3617,7 +3682,7 @@ class UserGroupAdapter implements IResEditorAdvancedOpt {
dlg = _page.editGeneric(false, false, entry, _ldc );
} else {
- /* Get all attributes set by the custom editor */
+ // Get all attributes set by the custom editor
LDAPAttributeSet set = new LDAPAttributeSet();
Enumeration en = observableentry.getAttributesList();
if ( en != null ) {
@@ -3637,7 +3702,7 @@ class UserGroupAdapter implements IResEditorAdvancedOpt {
}
if ( dlg != null ) {
- /* Notify the observable from the kingpin editor */
+ // Notify the observable from the kingpin editor
LDAPModificationSet mods = dlg.getChanges();
String[] rdnAttrs = dlg.getNamingAttributes();
@@ -3830,13 +3895,13 @@ class Copier implements Runnable, ActionListener {
boolean _isCancelled = false;
JFrame _frame;
- GenericProgressDialog _progressDialog;
+ GenericProgressDialog _progressDialog;
- int _numberCopiedObjects = 0;
+ int _numberCopiedObjects = 0;
String _startDn;
- LDAPConnection _ldc;
+ LDAPConnection _ldc;
String[] COPY_ATTRS = { "*", "numsubordinates" }; // To be in sync with the CUT_ATTRS
Clipboard _clipboard;
@@ -3864,15 +3929,14 @@ class Copier implements Runnable, ActionListener {
}
}
- public void execute() {
+ public void execute() {
if (_startDn.equals("")) {
- /* If the user chose to copy the root entry we
- display an error message */
+ // If the user chose to copy the root entry we display an error message
DSUtil.showErrorDialog( _frame,
"copy-root-error-title",
"copy-root-error-msg",
(String[]) null,
- "browser" );
+ "browser" );
} else {
createCopyProgressDialog();
Thread thread = new Thread(Copier.this);
@@ -3883,26 +3947,26 @@ class Copier implements Runnable, ActionListener {
}
public void run() {
- try {
- copyTree(_ldc, _startDn);
- updateProgressDialogForEnd();
+ try {
+ copyTree(_ldc, _startDn);
+ updateProgressDialogForEnd();
} catch (LDAPException lde) {
/* If something went wrong display an error message and enable
the close button of the progress dialog */
String[] arg = {Helper.getLDAPErrorMessage(lde)};
- String msg = DSUtil._resource.getString("browser",
+ String msg = DSUtil._resource.getString("browser",
"copying-error-label",
arg);
- _progressDialog.setTextInLabel(msg);
- _progressDialog.waitForClose();
+ _progressDialog.setTextInLabel(msg);
+ _progressDialog.waitForClose();
}
}
- private void copyTree (LDAPConnection ldc, String baseDn) throws LDAPException {
- boolean copyOk = true;
+ private void copyTree (LDAPConnection ldc, String baseDn) throws LDAPException {
+ boolean copyOk = true;
LDAPEntry baseEntry = ldc.read(baseDn,
COPY_ATTRS);
- recursiveCopy(baseEntry, ldc);
+ recursiveCopy(baseEntry, ldc);
}
private void recursiveCopy(LDAPEntry baseEntry, LDAPConnection ldc) throws LDAPException {
@@ -3920,10 +3984,10 @@ class Copier implements Runnable, ActionListener {
CHILDREN_FILTER,
COPY_ATTRS,
false);
- /* Copy each child found, recursively */
+ // Copy each child found, recursively
while ( search_results.hasMoreElements() &&
!_isCancelled) {
- /* Get the next child */
+ // Get the next child
Object nextElement = search_results.nextElement();
LDAPEntry entry = null;
if (nextElement instanceof LDAPEntry) {
@@ -3951,11 +4015,11 @@ class Copier implements Runnable, ActionListener {
} else if (nextElement instanceof LDAPException) {
LDAPException ex = (LDAPException)nextElement;
ldc.abandon(search_results);
- /* The entry has been deleted */
+ // The entry has been deleted
if (ex.getLDAPResultCode() == 32) {
containerChildren.clear();
} else {
- /* Don't know what to do */
+ // Don't know what to do
throw ex;
}
}
@@ -3964,25 +4028,24 @@ class Copier implements Runnable, ActionListener {
if (_isCancelled) {
ldc.abandon(search_results);
} else {
- /* Recursively copy container entries bellow this entry...*/
+ // Recursively copy container entries bellow this entry...
for (int i=0;
(i<containerChildren.size()) && !_isCancelled;
- i++) {
- recursiveCopy((LDAPEntry)containerChildren.elementAt(i),
- ldc);
+ i++) {
+ recursiveCopy((LDAPEntry)containerChildren.elementAt(i), ldc);
}
}
}
- /* Copy this container object */
- if (!_isCancelled) {
+ // Copy this container object
+ if (!_isCancelled) {
String[] arg = {DSUtil.abreviateString(baseDN, 45)};
String msg = DSUtil._resource.getString("browser",
"copying-object-label",
arg);
_progressDialog.setTextInLabel(msg);
- _numberCopiedObjects++;
+ _numberCopiedObjects++;
- _clipboard.putEntry(baseEntry);
+ _clipboard.putEntry(baseEntry);
}
}
@@ -3990,8 +4053,8 @@ class Copier implements Runnable, ActionListener {
if (_isCancelled ||
(_numberCopiedObjects < 2)) {
_progressDialog.closeCallBack();
- } else {
- String[] arg = {String.valueOf(_numberCopiedObjects)};
+ } else {
+ String[] arg = {String.valueOf(_numberCopiedObjects)};
_progressDialog.setTextInLabel(DSUtil._resource.getString("browser",
"copied-objects-label",
arg));
@@ -4007,7 +4070,7 @@ class Copier implements Runnable, ActionListener {
GenericProgressDialog.ONLY_CANCEL_BUTTON_OPTION,
title,
null,
- null);
+ null);
_progressDialog.setLabelColumns(50);
_progressDialog.addActionListener(Copier.this);
}
@@ -4020,9 +4083,9 @@ class CutDeleter implements Runnable, ActionListener {
boolean _isCancelled = false;
JFrame _frame;
- GenericProgressDialog _progressDialog;
+ GenericProgressDialog _progressDialog;
- int _numberDeletedObjects = 0;
+ int _numberDeletedObjects = 0;
boolean _isWholeTreeDeleted = false;
@@ -4071,8 +4134,7 @@ class CutDeleter implements Runnable, ActionListener {
public void execute() {
if (_startDn.equals("")) {
- /* If the user chose to copy the root entry we
- display an error message */
+ // If the user chose to copy the root entry we display an error message
DSUtil.showErrorDialog( _frame,
"delete-root-error-title",
"delete-root-error-msg",
@@ -4083,11 +4145,11 @@ class CutDeleter implements Runnable, ActionListener {
try {
_baseEntry = _ldc.read(_startDn, _attrs);
manyEntries = DSContentModel.entryHasChildren(_baseEntry);
- } catch (LDAPException lde) {
+ } catch (LDAPException lde) {
}
- boolean doDelete = confirmDelete(manyEntries);
+ boolean doDelete = confirmDelete(manyEntries);
- if (doDelete) {
+ if (doDelete) {
createDeleteProgressDialog(manyEntries);
Thread thread = new Thread(CutDeleter.this);
thread.start();
@@ -4100,22 +4162,20 @@ class CutDeleter implements Runnable, ActionListener {
return _isWholeTreeDeleted;
}
- public void run() {
- boolean deleteOK = deleteTree(_ldc, _startDn);
+ public void run() {
+ boolean deleteOK = deleteTree(_ldc, _startDn);
_isWholeTreeDeleted = !entryExists(_ldc, _startDn);
- updateProgressDialogForEnd(deleteOK);
+ updateProgressDialogForEnd(deleteOK);
}
private boolean confirmDelete(boolean manyEntries) {
- boolean confirmDelete = true;
+ boolean confirmDelete = true;
boolean requiresConfirmation = false;
String[] args = new String[1];
- args[0] = DSUtil.abreviateString(
- _startDn,
- 30);
+ args[0] = DSUtil.abreviateString(_startDn, 30);
String msg = null;
- if (manyEntries) {
+ if (manyEntries) {
msg = "confirmDeleteTree";
} else {
msg = "confirmDeleteObject";
@@ -4171,10 +4231,10 @@ class CutDeleter implements Runnable, ActionListener {
CHILDREN_FILTER,
_attrs,
false);
- /* Delete each child found, recursively */
+ // Delete each child found, recursively
while ( search_results.hasMoreElements() &&
!_isCancelled) {
- /* Get the next child */
+ // Get the next child
Object nextElement = search_results.nextElement();
LDAPEntry entry = null;
try {
@@ -4212,7 +4272,7 @@ class CutDeleter implements Runnable, ActionListener {
":" + ldapError);
_progressDialog.appendTextToTextArea(entry.getDN()+": "+ldapError+"\n");
} else {
- /* Case where we got an exception */
+ // Case where we got an exception
Debug.println("CutDeleter.recursiveDelete: " +
"error deleting "+ ldapError);
_progressDialog.appendTextToTextArea(ldapError+"\n");
@@ -4226,7 +4286,7 @@ class CutDeleter implements Runnable, ActionListener {
if (_isCancelled) {
ldc.abandon(search_results);
} else {
- /* Recursively delete container entries bellow this entry...*/
+ // Recursively delete container entries bellow this entry...
for (int i=0;
(i<containerChildren.size()) && !_isCancelled;
i++) {
@@ -4235,15 +4295,15 @@ class CutDeleter implements Runnable, ActionListener {
}
}
- /* Finally delete the entry */
+ // Finally delete the entry
if (!_isCancelled) {
try {
ldc.delete( baseDN );
String[] arg = {DSUtil.abreviateString(baseDN, 45)};
String msg = DSUtil._resource.getString("browser",
"deleting-object-label",
- arg);
- _progressDialog.setTextInLabel(msg);
+ arg);
+ _progressDialog.setTextInLabel(msg);
_numberDeletedObjects++;
if (_cut) {
_clipboard.putEntry(baseEntry);
@@ -4264,14 +4324,14 @@ class CutDeleter implements Runnable, ActionListener {
if (_isCancelled ||
((_numberDeletedObjects < 2) && deleteOk)) {
_progressDialog.closeCallBack();
- } else {
- String[] arg = {String.valueOf(_numberDeletedObjects)};
+ } else {
+ String[] arg = {String.valueOf(_numberDeletedObjects)};
_progressDialog.setTextInLabel(DSUtil._resource.getString("browser",
"deleted-objects-label",
arg));
_progressDialog.waitForClose();
- }
- }
+ }
+ }
private void createDeleteProgressDialog(boolean many) {
String title;
@@ -4287,13 +4347,13 @@ class CutDeleter implements Runnable, ActionListener {
null,
null);
_progressDialog.setTextInTextAreaLabel( DSUtil._resource.getString("browser", "non-deleted-objects-label"));
- _progressDialog.setTextAreaRows(3);
+ _progressDialog.setTextAreaRows(3);
_progressDialog.setLabelColumns(50);
_progressDialog.addActionListener(CutDeleter.this);
}
private boolean entryExists(LDAPConnection ldc, String dn) {
- boolean entryExists = false;
+ boolean entryExists = false;
try {
LDAPEntry entry = ldc.read(dn,
NOT_CUT_ATTRS );
@@ -4312,7 +4372,7 @@ class Paster implements Runnable, ActionListener {
boolean _isCancelled = false;
JFrame _frame;
- GenericProgressDialog _progressDialog;
+ GenericProgressDialog _progressDialog;
Clipboard _clipboard;
@@ -4322,7 +4382,7 @@ class Paster implements Runnable, ActionListener {
String _startDn;
- LDAPConnection _ldc;
+ LDAPConnection _ldc;
public Paster(LDAPConnection ldc, String startDn, JFrame frame, Clipboard clipboard) {
_frame = frame;
@@ -4343,12 +4403,12 @@ class Paster implements Runnable, ActionListener {
public void execute() {
if (_startDn.equals("") &&
(_clipboard.getSize() > 0)) {
- /* Can't paste in the root */
+ // Can't paste in the root
DSUtil.showErrorDialog( _frame,
"paste-in-root-error-title",
"paste-in-root-error-msg",
(String[]) null,
- "browser" );
+ "browser" );
} else {
createPasteProgressDialog();
Thread thread = new Thread(Paster.this);
@@ -4360,21 +4420,21 @@ class Paster implements Runnable, ActionListener {
public void run() {
_pastedRootEntries = new Vector();
boolean pasteOk = pasteTree(_ldc, _startDn, _pastedRootEntries);
- updateProgressDialogForEnd(pasteOk);
+ updateProgressDialogForEnd(pasteOk);
}
public Vector getPastedRootEntries() {
return _pastedRootEntries;
}
- /* We make the assumption that the clipboard is a LIFO list */
+ // We make the assumption that the clipboard is a LIFO list.
private boolean pasteTree(LDAPConnection ldc,
String baseDN,
Vector pastedRootEntries) {
Vector triedToPasteRootEntries = new Vector();
- boolean pasteOk = true;
- for (int i=0 ; (i< _clipboard.getSize())&& !_isCancelled; i++) {
+ boolean pasteOk = true;
+ for (int i=0 ; (i< _clipboard.getSize())&& !_isCancelled; i++) {
LDAPEntry currentEntry = _clipboard.getEntryAt(i);
LDAPEntry entryToPaste = getEntryToPaste(currentEntry, baseDN, triedToPasteRootEntries);
try {
@@ -4388,7 +4448,7 @@ class Paster implements Runnable, ActionListener {
_progressDialog.setTextInLabel(msg);
}
- _numberPastedObjects++;
+ _numberPastedObjects++;
DN lastTriedDN = (DN)triedToPasteRootEntries.elementAt(triedToPasteRootEntries.size() - 1);
DN currentPastedDN = new DN(currentEntry.getDN());
if (lastTriedDN.equals(currentPastedDN)) {
@@ -4400,25 +4460,25 @@ class Paster implements Runnable, ActionListener {
"error pasting entry=" +
entryToPaste.getDN()+
":" + lde);
- _progressDialog.appendTextToTextArea(entryToPaste.getDN()+": "+lde+"\n");
+ _progressDialog.appendTextToTextArea(entryToPaste.getDN()+": "+lde+"\n");
}
- }
+ }
return pasteOk;
- }
+ }
private LDAPEntry getEntryToPaste(LDAPEntry entry, String baseDn, Vector triedToPasteRootEntries) {
- /* We calculate the new dn of the entry, and we take into account that we may be adding
- a tree, so we check if we have added the parent entry for this entry to calculate the
- new dn. This dn is composed of the rdn of the entry relative to the old parent and the dn of the new
- parent (baseDn).
- This method updates the list of subtree roots that have been added. The last added root is put
- at the end of the list.
- */
- DN entryDN = new DN(entry.getDN());
- String[] rdns = LDAPDN.explodeDN( entry.getDN(),
- false );
+ /*
+ * We calculate the new dn of the entry, and we take into account that we may be adding
+ * a tree, so we check if we have added the parent entry for this entry to calculate the
+ * new dn. This dn is composed of the rdn of the entry relative to the old parent and
+ * the dn of the new parent (baseDn).
+ * This method updates the list of subtree roots that have been added. The last added
+ * root is put at the end of the list.
+ */
+ DN entryDN = new DN(entry.getDN());
+ String[] rdns = LDAPDN.explodeDN( entry.getDN(), false );
String newDn = "";
- boolean pastedRootFound = false;
+ boolean pastedRootFound = false;
for (int i=0; (i<triedToPasteRootEntries.size()) && !pastedRootFound; i++) {
if (entryDN.isDescendantOf((DN)triedToPasteRootEntries.elementAt(i))) {
pastedRootFound = true;
@@ -4429,7 +4489,7 @@ class Paster implements Runnable, ActionListener {
for (int j=0; j <= entryRDNCount - rootRDNCount; j++) {
newDn += rdns[j]+", ";
}
- newDn += baseDn;
+ newDn += baseDn;
}
}
if (!pastedRootFound) {
@@ -4448,8 +4508,175 @@ class Paster implements Runnable, ActionListener {
if (_isCancelled ||
((_numberPastedObjects < 2) && pasteOk)) {
_progressDialog.closeCallBack();
- } else {
- String[] arg = {String.valueOf(_numberPastedObjects)};
+ } else {
+ String[] arg = {String.valueOf(_numberPastedObjects)};
+ _progressDialog.setTextInLabel(DSUtil._resource.getString("browser",
+ "pasted-objects-label",
+ arg));
+ _progressDialog.waitForClose();
+ }
+ }
+
+ private void createPasteProgressDialog() {
+ String title = DSUtil._resource.getString("browser", "paste-objects-title");
+
+ _progressDialog = new GenericProgressDialog(_frame,
+ true,
+ GenericProgressDialog.TEXT_FIELD_AND_CANCEL_BUTTON_OPTION,
+ title,
+ null,
+ null);
+ _progressDialog.setTextInTextAreaLabel( DSUtil._resource.getString("browser", "non-pasted-objects-label"));
+ _progressDialog.setTextAreaRows(3);
+ _progressDialog.setLabelColumns(50);
+ _progressDialog.addActionListener(Paster.this);
+ }
+}
+
+class MovePaster implements Runnable, ActionListener {
+ boolean _isCancelled = false;
+
+ JFrame _frame;
+ GenericProgressDialog _progressDialog;
+
+ Clipboard _clipboard;
+
+ Vector _pastedRootEntries;
+
+ int _numberMovedObjects = 0;
+
+ String _startDn;
+
+ LDAPConnection _ldc;
+
+ public MovePaster(LDAPConnection ldc, String startDn, JFrame frame, Clipboard clipboard) {
+ _frame = frame;
+ _ldc = ldc;
+ _startDn = startDn;
+ _clipboard = clipboard;
+ }
+
+ public void actionPerformed(ActionEvent e) {
+ if (e.getActionCommand().equals(GenericProgressDialog.CANCEL)) {
+ _isCancelled = true;
+ _progressDialog.disableCancelButton();
+ } else if (e.getActionCommand().equals(GenericProgressDialog.CLOSE)) {
+ _progressDialog.closeCallBack();
+ }
+ }
+
+ public void execute() {
+ if (_startDn.equals("") &&
+ (_clipboard.getSize() > 0)) {
+ // Can't paste in the root
+ DSUtil.showErrorDialog( _frame,
+ "paste-in-root-error-title",
+ "paste-in-root-error-msg",
+ (String[]) null,
+ "browser" );
+ } else {
+ createPasteProgressDialog();
+ Thread thread = new Thread(MovePaster.this);
+ thread.start();
+ _progressDialog.packAndShow();
+ }
+ }
+
+ public void run() {
+ _pastedRootEntries = new Vector();
+ boolean pasteOk = movePasteObjs(_ldc, _startDn, _pastedRootEntries);
+ updateProgressDialogForEnd(pasteOk);
+ }
+
+ public Vector getMovedRootEntries() {
+ return _pastedRootEntries;
+ }
+
+ // We make the assumption that the clipboard is a LIFO list.
+ // If pastedRootEntries has elements, the moved entreis are refreshed on the console page.
+ private boolean movePasteObjs(LDAPConnection ldc,
+ String baseDN,
+ Vector pastedRootEntries) {
+ Vector triedToPasteRootEntries = new Vector();
+ boolean pasteOk = true;
+ for (int i = 0 ; (i < _clipboard.getDnSize()) && !_isCancelled; i++) {
+ String currentDn = _clipboard.getDnAt(i);
+ String movedDn = getDnToMove(currentDn, baseDN, triedToPasteRootEntries);
+ if ((null == movedDn) || movedDn.equals("")) {
+ continue;
+ }
+ try {
+ // rdn remains the same, just move to the new parent.
+ String[] rdns = LDAPDN.explodeDN(currentDn, false);
+ Debug.println("MovePaster.rename " + currentDn + " newrdn: " + rdns[0] + " to " + baseDN);
+ ldc.rename(currentDn, rdns[0], baseDN, false);
+
+ if ((_numberMovedObjects % 5) == 0) {
+ String[] arg = {DSUtil.abreviateString(currentDn, 45)};
+ String msg = DSUtil._resource.getString("browser",
+ "pasting-object-label",
+ arg);
+ _progressDialog.setTextInLabel(msg);
+ }
+
+ _numberMovedObjects++;
+ DN lastTriedDN = (DN)triedToPasteRootEntries.elementAt(triedToPasteRootEntries.size() - 1);
+ DN movedDN = new DN(movedDn);
+ if (lastTriedDN.equals(movedDN)) {
+ pastedRootEntries.addElement(movedDn);
+ }
+ } catch (LDAPException lde) {
+ pasteOk = false;
+ Debug.println("MovePaster.movePasteObjs: " + "error pasting entry=" + movedDn +
+ ":" + lde);
+ _progressDialog.appendTextToTextArea(movedDn+": "+lde+"\n");
+ }
+ }
+ _clipboard.cleanDn();
+
+ return pasteOk;
+ }
+
+ private String getDnToMove(String dn, String baseDn, Vector triedToPasteRootEntries) {
+ /*
+ * We calculate the new dn of the entry, and we take into account that we may be adding
+ * a tree, so we check if we have added the parent entry for this entry to calculate the
+ * new dn. This dn is composed of the rdn of the entry relative to the old parent and
+ * the dn of the new parent (baseDn).
+ * This method updates the list of subtree roots that have been added. The last added
+ * root is put at the end of the list.
+ */
+ DN entryDN = new DN(dn);
+ String[] rdns = LDAPDN.explodeDN( dn, false );
+ String newDn = "";
+ boolean pastedRootFound = false;
+ for (int i=0; (i<triedToPasteRootEntries.size()) && !pastedRootFound; i++) {
+ if (entryDN.isDescendantOf((DN)triedToPasteRootEntries.elementAt(i))) {
+ pastedRootFound = true;
+ DN rootDN = (DN)triedToPasteRootEntries.elementAt(i);
+ int rootRDNCount = rootDN.countRDNs();
+ int entryRDNCount = entryDN.countRDNs();
+
+ for (int j=0; j <= entryRDNCount - rootRDNCount; j++) {
+ newDn += rdns[j]+", ";
+ }
+ newDn += baseDn;
+ }
+ }
+ if (!pastedRootFound) {
+ newDn = rdns[0] + ", " + baseDn;
+ DN newDN = new DN(newDn);
+ triedToPasteRootEntries.addElement(newDN);
+ }
+
+ return newDn;
+ }
+
+ private void updateProgressDialogForEnd(boolean pasteOk) {
+ if (_isCancelled || ((_numberMovedObjects < 8) && pasteOk)) {
+ _progressDialog.closeCallBack();
+ } else {
+ String[] arg = {String.valueOf(_numberMovedObjects)};
_progressDialog.setTextInLabel(DSUtil._resource.getString("browser",
"pasted-objects-label",
arg));
@@ -4469,15 +4696,16 @@ class Paster implements Runnable, ActionListener {
_progressDialog.setTextInTextAreaLabel( DSUtil._resource.getString("browser", "non-pasted-objects-label"));
_progressDialog.setTextAreaRows(3);
_progressDialog.setLabelColumns(50);
- _progressDialog.addActionListener(Paster.this);
+ _progressDialog.addActionListener(MovePaster.this);
}
}
-
class Clipboard {
Vector _container;
+ Vector _dncontainer;
Clipboard() {
_container = new Vector();
+ _dncontainer = new Vector();
}
public boolean isEmpty() {
@@ -4488,10 +4716,10 @@ class Clipboard {
return (LDAPEntry)_container.elementAt(index);
}
- /* The clipboard is supposed to be a LIFO list...*/
+ // The clipboard is supposed to be a LIFO list...
public void putEntry(LDAPEntry entry) {
_container.insertElementAt(entry, 0);
- }
+ }
public void clean() {
_container.clear();
@@ -4499,7 +4727,28 @@ class Clipboard {
public int getSize() {
return _container.size();
- }
+ }
+
+ public boolean isDnEmpty() {
+ return (_dncontainer.size() == 0);
+ }
+
+ public String getDnAt(int index) {
+ return (String)_dncontainer.elementAt(index);
+ }
+
+ // The clipboard is supposed to be a LIFO list...
+ public void putDn(String dn) {
+ _dncontainer.insertElementAt(dn, 0);
+ }
+
+ public void cleanDn() {
+ _dncontainer.clear();
+ }
+
+ public int getDnSize() {
+ return _dncontainer.size();
+ }
}
class EntryEditor implements IAdapterInfo {
@@ -4511,7 +4760,7 @@ class EntryEditor implements IAdapterInfo {
_databaseConfig = databaseConfig;
}
- /* Returns true if the entry was created, false otherwise */
+ // Returns true if the entry was created, false otherwise
public boolean createUser(String parentDn,
LDAPConnection ldc) {
_createdObject = null;
@@ -4520,7 +4769,7 @@ class EntryEditor implements IAdapterInfo {
return newPredefinedObject( objectClass, parentDn );
}
- /* Returns true if the entry was created, false otherwise */
+ // Returns true if the entry was created, false otherwise
public boolean createGroup(String parentDn,
LDAPConnection ldc) {
_createdObject = null;
@@ -4529,7 +4778,7 @@ class EntryEditor implements IAdapterInfo {
return newPredefinedObject( objectClass, parentDn );
}
- /* Returns true if the entry was created, false otherwise */
+ // Returns true if the entry was created, false otherwise
public boolean createOrganizationalUnit(String parentDn,
LDAPConnection ldc) {
_createdObject = null;
@@ -4538,7 +4787,7 @@ class EntryEditor implements IAdapterInfo {
return newPredefinedObject( objectClass, parentDn );
}
- /* Returns true if the entry was created, false otherwise */
+ // Returns true if the entry was created, false otherwise
public boolean createCos(String parentDn,
LDAPConnection ldc) {
_createdObject = null;
@@ -4550,7 +4799,7 @@ class EntryEditor implements IAdapterInfo {
return newPredefinedObject( objectClass, parentDn );
}
- /* Returns true if the entry was created, false otherwise */
+ // Returns true if the entry was created, false otherwise
public boolean createRole(String parentDn,
LDAPConnection ldc) {
_createdObject = null;
@@ -4562,7 +4811,7 @@ class EntryEditor implements IAdapterInfo {
return newPredefinedObject( objectClass, parentDn );
}
- /* Returns true if the entry was created, false otherwise */
+ // Returns true if the entry was created, false otherwise
public boolean createObject(String parentDn,
LDAPConnection ldc) {
_createdObject = null;
@@ -4579,13 +4828,13 @@ class EntryEditor implements IAdapterInfo {
Vector v = DSSchemaHelper.getObjectClassVector( selectedObjectClass, _schema );
if ( isStandardObjectClass( v.elements() ) ) {
- /* Yes, it is. So call the UserGroup editor. */
+ // Yes, it is. So call the UserGroup editor.
objectCreated = newPredefinedObject( v, parentDn );
return objectCreated;
}
- /* Not a standard object class, so do it ourselves */
- /* Get all required attributes */
+ // Not a standard object class, so do it ourselves
+ // Get all required attributes
Hashtable ht = new Hashtable();
DSSchemaHelper.allRequiredAttributes(selectedObjectClass, _schema, ht);
Enumeration e = ht.elements();
@@ -4596,15 +4845,14 @@ class EntryEditor implements IAdapterInfo {
String name = (String)e.nextElement();
LDAPAttribute attr = new LDAPAttribute( name );
- /* Initialize the objectclass attribute with the
- chain of superiors */
+ // Initialize the objectclass attribute with the chain of superiors
if ( name.equalsIgnoreCase( "objectclass" ) ) {
v = DSSchemaHelper.getObjectClassVector( selectedObjectClass, _schema );
for( int i = v.size() - 1; i >= 0; i-- ) {
attr.addValue( (String)v.elementAt( i ) );
}
} else {
- /* Not objectclass, initialize with the empty string */
+ // Not objectclass, initialize with the empty string
attr.addValue( "" );
if ( (prefix == null) && !name.equalsIgnoreCase( "aci" ) ) {
prefix = name;
@@ -4613,7 +4861,7 @@ class EntryEditor implements IAdapterInfo {
set.add( attr );
}
- /* Last resort, first optional attribute */
+ // Last resort, first optional attribute
if ( prefix == null ) {
ht = new Hashtable();
DSSchemaHelper.allOptionalAttributes(selectedObjectClass, _schema, ht);
@@ -4621,7 +4869,7 @@ class EntryEditor implements IAdapterInfo {
if ( e.hasMoreElements() ) {
prefix = (String)e.nextElement();
- /* aci is not valid for use as an RDN */
+ // aci is not valid for use as an RDN
if ( prefix.equalsIgnoreCase( "aci" ) ) {
if ( e.hasMoreElements() ) {
prefix = (String)e.nextElement();
@@ -4631,14 +4879,14 @@ class EntryEditor implements IAdapterInfo {
}
}
}
- /* Can't figure out what attribute to use for RDN */
+ // Can't figure out what attribute to use for RDN
if ( prefix == null ) {
DSUtil.showErrorDialog( _frame, "noRDN", selectedObjectClass,
"EntryObject" );
return false;
}
- /* Preliminary DN ??? */
+ // Preliminary DN ???
String value = DEFAULT_NEW;
LDAPAttribute attr = set.getAttribute( prefix );
if ( attr != null ) {
@@ -4672,12 +4920,12 @@ class EntryEditor implements IAdapterInfo {
return objectCreated;
}
- /* Returns true if the entry was created, false otherwise */
+ // Returns true if the entry was created, false otherwise
public boolean createRootObject(String suffixDn, LDAPConnection ldc) {
boolean done = false;
boolean objectCreated = false;
- /* See if it has the rights (only directory manager can perform this task) */
+ // See if it has the rights (only directory manager can perform this task)
if (!DSUtil.isLocalDirectoryManager(ldc)) {
DSUtil.showInformationDialog(_frame,
"addRootEntry-needtobedirectorymanager",
@@ -4706,13 +4954,13 @@ class EntryEditor implements IAdapterInfo {
LDAPAttributeSet set = new LDAPAttributeSet();
- /* The naming attribute (obtained from the suffix) */
+ // The naming attribute (obtained from the suffix)
LDAPAttribute attr = new LDAPAttribute( namingAttribute );
attr.addValue(value);
set.add(attr);
- /* The aci attribute with the default values */
+ // The aci attribute with the default values
String[] aciValues = {"(targetattr != \"userPassword\") (version 3.0; acl \"Anonymous access\"; allow (read, search, compare)userdn = \"ldap:///anyone\";)",
"(targetattr != \"nsroledn||aci\")(version 3.0; acl \"Allow self entry modification except for nsroledn and aci attributes\"; allow (write)userdn =\"ldap:///self\";)",
"(targetattr = \"*\")(version 3.0; acl \"Configuration Adminstrator\"; allow (all) userdn = \"ldap:///"+getAdminDN(ldc)+"\";)",
@@ -4725,7 +4973,7 @@ class EntryEditor implements IAdapterInfo {
set.add(attr);
- /* The required attributes */
+ // The required attributes
Hashtable ht = new Hashtable();
DSSchemaHelper.allRequiredAttributes(selectedObjectClass, _schema, ht);
Enumeration e = ht.elements();
@@ -4734,15 +4982,14 @@ class EntryEditor implements IAdapterInfo {
if (!name.equalsIgnoreCase (namingAttribute)) {
attr = new LDAPAttribute( name );
- /* Initialize the objectclass attribute with the
- chain of superiors */
+ // Initialize the objectclass attribute with the chain of superiors
if ( name.equalsIgnoreCase( "objectclass" ) ) {
Vector v = DSSchemaHelper.getObjectClassVector( selectedObjectClass, _schema );
for( int i = v.size() - 1; i >= 0; i-- ) {
attr.addValue( (String)v.elementAt( i ) );
}
} else {
- /* Not objectclass nor the attribute we already added, initialize with the empty string */
+ // Not objectclass nor the attribute we already added, initialize with the empty string
attr.addValue( "" );
}
set.add( attr );
@@ -4758,13 +5005,13 @@ class EntryEditor implements IAdapterInfo {
if ( entryDlg != null ) {
attrs = entryDlg.getAttributes();
}
- /* The user has clicked on cancel, we return */
+ // The user has clicked on cancel, we return.
if ( attrs == null ) {
done = true;
}
if (!done) {
- /* We add the entry in the directory */
+ // We add the entry in the directory.
LDAPEntry newObject = new LDAPEntry(entryDlg.getDN(), attrs);
objectCreated = addObject( newObject, ldc );
}
@@ -4788,7 +5035,7 @@ class EntryEditor implements IAdapterInfo {
boolean objectModified = false;
_editedObjectDn = null;
_ldc = ldc;
- /* Fetch all attributes of the entry */
+ // Fetch all attributes of the entry.
if (_allAttrs == null) {
String[] editableAttributes = DSSchemaHelper.getOperationalAttributes(_schema);
String[] allAttributes = null;
@@ -4824,7 +5071,7 @@ class EntryEditor implements IAdapterInfo {
entry = _ldc.read(entryDn, _allAttrs, searchConstraints);
} catch (LDAPException lde) {
Debug.println("DSContentPage.editObject: LDAPException [" + lde + "]");
- /* The entry could not be read... */
+ // The entry could not be read...
String[] args = {
entryDn,
Helper.getLDAPErrorMessage(lde)};
@@ -4842,7 +5089,7 @@ class EntryEditor implements IAdapterInfo {
/* In the case we don't want to call always the generic editor, check if this has an
objectclass known to the UserGroup editor. Get the object class to java class association. */
if (!isAdvanced && isStandardObjectClass(objectclass.getStringValues())) {
- /* Yes, it is. So call the UserGroup editor. */
+ // Yes, it is. So call the UserGroup editor.
ConsoleInfo info = new ConsoleInfo();
info.setUserLDAPConnection(_ldc);
info.setUserHost(_ldc.getHost());
@@ -4859,7 +5106,7 @@ class EntryEditor implements IAdapterInfo {
String buttonText =
_resource.getString( "UserGroup",
"Advanced-label" );
- /* Install an "Advanced" button for generic editing */
+ // Install an "Advanced" button for generic editing
ed.registerAdvancedOption( new UserGroupAdapter(EntryEditor.this,
buttonText,
entry,
@@ -4939,8 +5186,7 @@ class EntryEditor implements IAdapterInfo {
} else {
while( en.hasMoreElements() &&
!isStandardObjectClass ) {
- /* Check each object class of this entry to see if
- it is one of the known ones. */
+ // Check each object class of this entry to see if it is one of the known ones.
String name = ((String)en.nextElement()).toLowerCase();
if ( htable.get( name ) != null ) {
isStandardObjectClass = true;
@@ -4992,7 +5238,7 @@ class EntryEditor implements IAdapterInfo {
if (ed != null) {
String buttonText =
_resource.getString( "UserGroup", "Advanced-label" );
- /* Install an "Advanced" button for generic editing */
+ // Install an "Advanced" button for generic editing
ed.registerAdvancedOption( new UserGroupAdapter(EntryEditor.this,
buttonText,
parentDn,
@@ -5030,7 +5276,7 @@ class EntryEditor implements IAdapterInfo {
}
private boolean addObject( LDAPEntry entry, LDAPConnection ldc ) {
- /* Loop here, in case reauthentication is required */
+ // Loop here, in case reauthentication is required
if ( ldc == null ) {
Debug.println( "EntryEditor.addEntry: no LDAP connection" );
return false;
@@ -5046,20 +5292,20 @@ class EntryEditor implements IAdapterInfo {
done = true;
} catch ( LDAPException e ) {
Debug.println( "EntryEditor.addObject() Adding " + entry.getDN() + ", " + e );
- /* Allow reauthenticating on insufficient privileges */
+ // Allow reauthenticating on insufficient privileges
if ( e.getLDAPResultCode() ==
e.INSUFFICIENT_ACCESS_RIGHTS ) {
- /* Put up dialog indicating the problem */
+ // Put up dialog indicating the problem
DSUtil.showPermissionDialog( _frame, ldc );
} else if ( e.getLDAPResultCode() ==
e.NO_SUCH_OBJECT ) {
- /* Put up dialog indicating the problem */
+ // Put up dialog indicating the problem
DSUtil.showErrorDialog(_frame, "noParentForAdd",
"", "EntryObject");
result = false;
done = true;
} else {
- /* Some other error. Just show a dialog. */
+ // Some other error. Just show a dialog.
DSUtil.showLDAPErrorDialog( _frame,
e, "111-title" );
result = false;
@@ -5071,7 +5317,7 @@ class EntryEditor implements IAdapterInfo {
}
private DSEntryDialog doGenericDialog( LDAPEntry entry, int options, LDAPConnection ldc ) {
- /* Make a list of attribute names */
+ // Make a list of attribute names
LDAPAttributeSet set = entry.getAttributeSet();
int i = 0;
LDAPSchema schema = getSchema();
@@ -5089,21 +5335,19 @@ class EntryEditor implements IAdapterInfo {
names[i] = (String)v.elementAt( i );
}
- /* Sort the attributes alphabetically by name */
+ // Sort the attributes alphabetically by name
DSUtil.trimAndBubbleSort( names, true );
for( i = 0; i < names.length; i++ ) {
labels[i] = names[i];
}
- /* Make a single page with all attributes */
- EntryPageDescription page =
- new EntryPageDescription( names, labels );
- /* Data model for property editor */
- DSPropertyModel model = new DSPropertyModel( _schema,
- entry, page );
- /* Editor window */
+ // Make a single page with all attributes
+ EntryPageDescription page = new EntryPageDescription( names, labels );
+ // Data model for property editor
+ DSPropertyModel model = new DSPropertyModel( _schema, entry, page );
+ // Editor window
DSEntryPanel child = new DSEntryPanel( model , options, ldc);
- /* Do it as a dialog */
+ // Do it as a dialog
DSEntryDialog dlg = new DSEntryDialog( _frame, child );
dlg.setTitle( _resource.getString( "EntryObject", "property-dialog-title",
entry.getDN()) );
@@ -5211,7 +5455,7 @@ class EntryEditor implements IAdapterInfo {
if ((mods != null) && (dlg != null)) {
if (!saveChanges( mods, dlg.getAttributes(), ldc, intermediateDn)) {
- /* try to go back to old dn */
+ // try to go back to old dn
String oldRdn = oldDN.explodeDN(false)[0];
ldc.rename( intermediateDn, oldRdn, false );
dlg = null;
@@ -5223,12 +5467,12 @@ class EntryEditor implements IAdapterInfo {
}
}
} else {
- /* Just rename the entry if no mods to do */
+ // Just rename the entry if no mods to do
ldc.rename( entry.getDN(), newrdn, false );
}
} catch ( LDAPException lde ) {
- /* Something went wrong when renaming */
- /* The entry could not be read... */
+ // Something went wrong when renaming
+ // The entry could not be read...
String[] args = {
entry.getDN(),
Helper.getLDAPErrorMessage(lde)};
@@ -5261,27 +5505,26 @@ class EntryEditor implements IAdapterInfo {
(mods.size() > 0) ) {
try {
ldc.modify( dn, mods, (LDAPConstraints)cons );
- if ( DSUtil.requiresRestart ( dn, mods )) {
- DSUtil.showInformationDialog( _frame,
- "requires-restart", (String)null );
- }
+ if ( DSUtil.requiresRestart ( dn, mods )) {
+ DSUtil.showInformationDialog( _frame, "requires-restart", (String)null );
+ }
} catch ( LDAPException e ) {
Debug.println( "DSContentPage$EntryEditor.saveChanges Modifying " + dn + ", " + e );
- /* Allow reauthenticating on insufficient privileges */
+ // Allow reauthenticating on insufficient privileges
if ( e.getLDAPResultCode() ==
e.INSUFFICIENT_ACCESS_RIGHTS ) {
- /* Put up dialog indicating the problem */
+ // Put up dialog indicating the problem
DSUtil.showPermissionDialog( _frame, ldc );
- /* If the user cancels reauthentication, bail */
+ // If the user cancels reauthentication, bail
saveChanges = false;
} else if ( e.getLDAPResultCode() ==
e.NO_SUCH_OBJECT ) {
- /* Entry doesn't exist, try adding it */
+ // Entry doesn't exist, try adding it
LDAPEntry entry = new LDAPEntry(dn, set);
saveChanges = addObject( entry, ldc );
} else {
- /* Some other error. Just show a dialog. */
+ // Some other error. Just show a dialog.
DSUtil.showLDAPErrorDialog( _frame,
e, "111-title" );
saveChanges = false;
@@ -5315,6 +5558,7 @@ interface IContentPageInfo {
public boolean isSelectedNodeRemote();
public boolean isSelectedNodeSuffix();
public boolean isClipboardEmpty();
+ public boolean isDnInClipboardEmpty();
public boolean isSorted();
public Integer getSelectionActivationState();
public Integer getSelectionVlvState();
@@ -5547,7 +5791,7 @@ class AttributeController implements Runnable {
String longestValue = null;
int longestValueRow = 0;
- /* In order to sort the attributes */
+ // In order to sort the attributes
String[] attributeNames = new String[numberAttributes];
for (int i=0; i<numberAttributes; i++) {
LDAPAttribute attr = set.elementAt(i);
@@ -5555,10 +5799,10 @@ class AttributeController implements Runnable {
attributeNames[i] = attributeName;
}
- /* Sort the attributes */
+ // Sort the attributes
DSUtil.bubbleSort(attributeNames, true);
- /* Populate the table and calculate the preferred size */
+ // Populate the table and calculate the preferred size
for (int i=0; i<numberAttributes; i++) {
LDAPAttribute attr = set.getAttribute(attributeNames[i]);
String attributeName = attributeNames[i];
@@ -5619,7 +5863,7 @@ class AttributeController implements Runnable {
}
}
-/* Our particular table model, conceived to display attributes */
+// Our particular table model, conceived to display attributes
class AttributeTableModel extends AbstractTableModel {
public AttributeTableModel() {
@@ -5672,7 +5916,7 @@ class RemoteNodeInformationDialog extends AbstractDialog {
String _section = "RemoteNodeInformationDialog";
static ResourceSet _resource = DSUtil._resource;
- /* We assume that the node is a valid node with a non null URL */
+ // We assume that the node is a valid node with a non null URL.
public RemoteNodeInformationDialog(JFrame frame,
IBrowserNodeInfo node) {
super( frame, "", true, OK | CANCEL);
@@ -5741,7 +5985,7 @@ class DisplayedChildrenLimitExceededDialog extends AbstractDialog {
String _section = "DisplayedChildrenLimitExceededDialog";
static ResourceSet _resource = DSUtil._resource;
- /* We assume that the node is a valid node with a non null URL */
+ // We assume that the node is a valid node with a non null URL.
public DisplayedChildrenLimitExceededDialog(JFrame frame,
IBrowserNodeInfo node) {
super( frame, "", true, OK);
@@ -5810,7 +6054,7 @@ class SortedChildrenLimitExceededDialog extends AbstractDialog {
String _section = "SortedChildrenLimitExceededDialog";
static ResourceSet _resource = DSUtil._resource;
- /* We assume that the node is a valid node with a non null URL */
+ // We assume that the node is a valid node with a non null URL.
public SortedChildrenLimitExceededDialog(JFrame frame,
IBrowserNodeInfo node) {
super( frame, "", true, OK );
diff --git a/src/com/netscape/admin/dirserv/DSResourceModel.java b/src/com/netscape/admin/dirserv/DSResourceModel.java
index da5358d..1b46355 100644
--- a/src/com/netscape/admin/dirserv/DSResourceModel.java
+++ b/src/com/netscape/admin/dirserv/DSResourceModel.java
@@ -130,10 +130,10 @@ public class DSResourceModel extends DSBaseModel
if (_menuEdit == null) {
_menuEdit = new IMenuItem[] {
/*
- new MenuItemText( CUT,
- _resource.getString("menu", "EditCut"),
+ new MenuItemText( MOVE,
+ _resource.getString("menu", "EditMove"),
_resource.getString("menu",
- "EditCut-description")),
+ "EditMove-description")),
new MenuItemText( COPY,
_resource.getString("menu", "EditCopy"),
_resource.getString("menu",
diff --git a/src/com/netscape/admin/dirserv/dirserv.properties b/src/com/netscape/admin/dirserv/dirserv.properties
index 2cfcdf1..65b6f17 100644
--- a/src/com/netscape/admin/dirserv/dirserv.properties
+++ b/src/com/netscape/admin/dirserv/dirserv.properties
@@ -47,6 +47,8 @@ menu-EditUndo=&Undo
menu-EditUndo-description=Undo the last change
menu-EditCut=C&ut
menu-EditCut-description=Remove object and move it to the clipboard
+menu-EditMove=M&ove
+menu-EditMove-description=Move it to the clipboard
menu-EditCopy=Cop&y
menu-EditCopy-description=Copy object to the clipboard
menu-EditCopyDN=Copy D&N
@@ -55,6 +57,8 @@ menu-EditCopyLDAPURL=Copy &LDAP URL
menu-EditCopyLDAPURL-description=Copy LDAP URL of object to the clipboard
menu-EditPaste=Pas&te
menu-EditPaste-description=Paste object from clipboard
+menu-EditMovePaste=MovePas&te
+menu-EditMovePaste-description=Move object from clipboard
menu-EditDelete=&Delete
menu-EditDelete-description=Delete object
menu-EditNew=&New
1
0
Changes since 389-ds-base-1.2.6.a1:
Anupam Jain (1):
Ticket #47423 - 7-bit check plugin does not work for userpassword attribute
Charles Lopes (1):
Bug #361: Bad DNs in ACIs can segfault ns-slapd
Endi S. Dewata (168):
Bug 545620 - Password cannot start with minus sign
Bug 538525 - Ability to create instance as non-root user
Bug 570542 - Root password cannot contain matching curly braces
Bug 470684 - Pam_passthru plugin doesn't verify account activation
Bug 573375 - MODRDN operation not logged
Bug 520151 - Error when modifying userPassword with proxy user
Bug 455489 - Address compiler warnings about strict-aliasing rules
Bug 566320 - RFE: add exception to removal of attributes in cn=config for aci
Bug 566043 - startpid file is only cleaned by initscript runs
Bug 584109 - Slapd crashes while parsing DNA configuration
Bug 542570 - Directory Server port number is not validated in the beginning.
Bug 145181 - Plugin target/bind subtrees only take 1 value.
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 628096 - spurious error message from /sbin/service when doing a stop on no instances
Bug 573889 - Migration does not remove deprecated schema
Bug 606545 - core schema should include numSubordinates
Bug 643979 - Strange byte sequence for attribute with no values (nsslapd-referral)
Endi Sukma Dewata (16):
Bug 630092 - Coverity #12117: Resource leaks issues
Bug 630092 - Coverity #15478: Resource leaks issues
Bug 630092 - Coverity #15479: Resource leaks issues
Bug 630092 - Coverity #15481: Resource leaks issues
Bug 630092 - Coverity #15482: Resource leaks issues
Bug 630092 - Coverity #15483: Resource leaks issues
Bug 630092 - Coverity #15484: Resource leaks issues
Bug 630092 - Coverity #15485: Resource leaks issues
Bug 630092 - Coverity #15487: Resource leaks issues
Bug 630092 - Coverity #15490: Resource leaks issues
Bug 630092 - Coverity #15497: Resource leaks issues
Bug 630092 - Coverity #11991: Resource leaks issues
Bug 630092 - Coverity #12000: Resource leaks issues
Bug 630092 - Coverity #12003: Resource leaks issues
Bug 630092 - Coverity #11985: Resource leaks issues
Bug 630092 - Coverity #11992,11993: Resource leaks issues
Jeroen van Meeuwen (Kolab Systems) (1):
Suppress alert on unavailable port with forced setup
Ken Rossato (8):
Factorize into new isPosixGroup function
Change "return"s in modGroupMembership to "break"s to avoid leaking
Memory leaks: unmatched slapi_attr_get_valueset and slapi_value_new
Simplify program flow: eliminate unnecessary continue
Simplify program flow: make adduids/moduids/deluids action blocks all similar
Fix logic errors: del_mod should be latched (might not be last mod), and avoid skipping add-mods (int value 0)
Simplify program flow: change while loops to for
Ticket #481 - expand nested posix groups
Ludwig Krispenz (10):
Ticket 518 - dse.ldif is 0 length after server kill or machine kill
Ticket 47395 47397 v2 correct behaviour of account policy if only stateattr
Ticket 47396 - crash on modrdn of tombstone
CVE-2013-2219 ACLs inoperative in some search scenarios
fix compiler warning
Ticket 47577 - crash when removing entries from cache
Ticket 47591 - entries with empty objectclass attribute value can be hidden
Ticket 47704 - invalid sizelimits in aci group evaluation
Ticket 47821 - deref plugin cannot handle complex acis
Ticket 47872 - Filter AND with only one clause should be optimized
Mark Reynolds (183):
Ticket #71 - unable to delete managed entry config
Ticket #159 - Managed Entry Plugin runs against managed entries upon any update without validating
Ticket #177 - logconv.pl doesn't detect restarts
Merge branch 'ticket159'
Ticket #49 - better handling for server shutdown while long running tasks are active
Ticket #50 - server should not call a plugin after the plugin close function is calle
Updated for ticket#50
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #140 - incorrect memset parameters
Revert "Ticket #140 - incorrect memset parameters"
Revert "Ticket #55 - Limit of 1024 characters for nsMatchingRule"
Ticket #38 - nisDomain schema is incorrect
Ticket #6 - protocol error from proxied auth operation
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #39 - Account Policy Plugin does not work for simple binds when PAM Pass Through Auth plugin is enabled
Ticket 175 - logconv.pl improvements
Ticket 175 - minor fixes
Ticket #17 - Replication optimizations
Ticket #17 - new replication optimizations
Ticket #129 - Should only update modifyTimestamp/modifiersName on MODIFY ops
Ticket #111 - ability to control behavior of modifyTimestamp/modifiersName
Ticket #211 - dnaNextValue gets incremented even if the user addition fails
Ticket #74 - Add schema for DNA plugin (RFE)
Ticket #306 - void function cannot return value
Ticket #302 - use thread local storage for internalModifiersName & internalCreatorsName
Schema Reload crash fix
Ticket #291 - cannot use & in a sasl map search filter
Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash
Ticket #191 - Implement SO_KEEPALIVE in network calls
Config changes fail because of unknown attribute "internalModifiersname"
Ticket #292 - logconv.pl reporting unindexed search with different search base than shown in access logs
Ticket #308 - Automembership plugin fails if data and config area mixed in the plugin configuration
Ticket #271 - replication code cleanup
TIcket #285 - compilation fixes for '--format-security'
Ticket #271 - Slow shutdown when you have 100+ replication agreements
Ticket #24 - Add nsTLS1 to the DS schema
Ticket #319 - ldap-agent crashes on start with signal SIGSEGV
Ticket #20 - Allow automember to work on entries that have already been added
Ticket #315 - ns-slapd exits/crashes if /var fills up
Ticket #315 - small fix to libglobs
Ticket #183 - passwordMaxFailure should lockout password one sooner - and should be configurable to avoid regressions
Coverity Fixes
Ticket #325 - logconv.pl : use of getopts to parse command line options
Ticket #183 - passwordMaxFailure should lockout password one sooner
Ticket #207 - [RFE] enable attribute that tracks when a password was last set
Ticket #214 - Adding Replication agreement should complain if required nsds5ReplicaCredentials not supplied
Ticket #337 - Improve CLEANRUV task
Ticket #321 - krbExtraData is being null modified and replicated on each ssh login
Ticket #110 - RFE limiting root DN by host, IP, time of day, day of week
Ticket 368 - Make the cleanAllRUV task one step
Coverity Fix
Ticket 365 - passwords in clear text in the audit log
Ticket 366 - Change DS to purge ticket from krb cache in case of authentication error
Ticket 399 - slapi_ldap_bind() doesn't check bind results
Ticket #369 - restore of replica ldif file on second master after deleting two records shows only 1 deletion
Update the slapi-plugin documentation on new slapi functions, and added a slapi function for checking on shutdowns
Ticket #388 - Improve replication agreement status messages
COVERITY FIXES
Ticket 413 - "Server is unwilling to perform" when running ldapmodify on nsds5ReplicaStripAttrs
Ticket 403 - CLEANALLRUV feature
Ticket 407 - memory leak in dna plugin
Ticket 403 - cleanallruv coverity fixes
bump version to 1.2.11.8 for offical release
Ticket 407 - dna memory leak - fix crash from prev fix
Bumped version to 1.2.11.9
Ticket 403 - CLEANALLRUV revisions
bumped version to 1.2.11.10
Ticket 403 - fix CLEANALLRUV regression from last commit
Ticket 429
CLEANALLRUV coverity fixes
Ticket 436 - nsds5ReplicaEnabled can be set with any invalid values.
Ticket 386 - large memory growth with ldapmodify(heap fragmentation)
Ticket 450 - CLEANALLRUV task gets stuck on winsync replication agreement
Ticket 452 - automember rebuild task adds users to groups that do not match the configuration scope
Ticket 467 - CLEANALLRUV abort task should be able to ignore down replicas
Ticket 474 - Root DN Access Control - days allowed not working correctly
Ticket 475 - Root DN Access Control - improve value checking for config
Ticket 473 - change VERSION.sh to have console version be major.minor
Ticket 457 - dirsrv init script returns 0 even when few or all instances fail to start
Ticket 477 - CLEANALLRUV if there are only winsync agmts task will hang
Ticket 478 - passwordTrackUpdateTime stops working with subtree password policies
Ticket #446 - anonymous limits are being applied to directory manager
Ticket 488 - Doc: DS error log messages with typo
Ticket 486 - nsslapd-enablePlugin should not be multivalued
Ticket 468 - if pam_passthru is enabled, need to AC_CHECK_HEADERS([security/pam_appl.h])
Ticket 517 - crash in DNA if no dnaMagicRegen is specified
Ticket 495 - internalModifiersname not updated by DNA plugin
Ticket 337 - improve CLEANRUV functionality
Coverity Fixes
Ticket 20 - Allow automember to work on entries that have already been added
Ticket 216 - disable replication agreements
Coverity Issues for 1.2.11
Ticket 527 - ns-slapd segfaults if it cannot rename the logs
Ticket 541 - RootDN Access Control plugin is missing after upgrade
Ticket 541 - need to set plugin as off in ldif template
Ticket 495 - 1.2.11 - plugin dn is missing from pblock
bump version to 1.2.11.18
Ticket 367 - Invalid chaining config triggers a disk full error and shutdown
Ticket 590 - ns-slapd segfaults while trying to delete a tombstone entry
Ticket 571 - server does not accept 0 length LDAP Control sequence
Ticket 571 - Need attribute syntax functions from master
bump version to 1.2.11.19
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC
Coverity issue 13091
Ticket 628 - crash in aci evaluation
Ticket 47318 - server fails to start after upgrade(schema error)
bump verison to 1.2.11.21
Ticket 580 - Wrong error code return when using EXTERNAL SASL and no client certificate
Coverity Fixes (part 1)
Coverity Fixes (Part 2)
Coverity Fixes (Part 3)
Coverity Fixes (Part 4)
Coverity Fixes (Part 5)
Ticket 47385 - DS not shutting down when disk monitoring threshold is reached
Fri Jun 7 10:41:00 2013 -0400
Ticket 47383 - connections attribute in cn=snmp,cn=monitor is counted twice
Ticket 47376 - DESC should not be empty as per RFC 2252 (ldapv3)
Coverity Fixes (Part 7)
Ticket 47385 - Disk Monitoring is not triggered as expected.
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold(Fixed typo in libglobs.c)
Ticket 47441 - Disk Monitoring not checking filesystem with logs
Ticket 47421 - memory leaks in set_krb5_creds
Ticket 47449 - deadlock after adding and deleting entries
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket #356 - RFE - Track bind info
Ticket 539 - logconv.pl should handle microsecond timing
Ticket 471 - logconv.pl tool removes the access logs contents if "-M" is not correctly used
TIcket 419 - logconv.pl - improve memory management
Ticket 419 - logconv.pl - improve memory management
Ticket 611 - logconv.pl missing stats for StartTLS, LDAPI, and AUTOBIND
Ticket 47447 - logconv.pl man page missing -m,-M,-B,-D
Ticket 47461 - logconv.pl - Use of comma-less variable list is deprecated
Ticket 47520 - Fix various issues with logconv.pl
Ticket 47509 - CLEANALLRUV doesnt run across all replicas
Ticket 47509 - Cleanallruv jenkins error
Tickets: 47510 & 47543 - 389 fails to build when using Mozldap
Ticket 47517 - fix memory leak in ldbm_delete.c
Ticket 47587 - hard coded limit of 64 masters in agreement and changelog code
Ticket 47627 - changelog iteration should ignore cleaned rids when getting the minCSN
Ticket 47627 - Fix replication logging
Ticket 47678 - modify-delete userpassword
Ticket 47641 - 7-bit check plugin not checking MODRDN operation
Ticket 47638 - Overflow in nsslapd-disk-monitoring-threshold on 32bit platform
Ticket 417, 458, 47522 - Password Administrator Backport
Ticket 47637 - rsa_null_sha should not be enabled by default
Ticket 47729 - Directory Server crashes if shutdown during a replication initialization
Ticket 47722 - rsearch filter error on any search filter
Ticket47722 - Fixed filter not correctly identified
Ticket 47740 - Coverity Fixes (Mark - part 1)
Ticket 47538 - RFE: repl-monitor.pl plain text output, cmdline config options
Ticket 47640 - Fix coverity issues - part 3
Ticket 47740 - Fix coverity erorrs - Part 4
Ticket 47740 - Fix coverity issues - Part 5
Ticket 47740 - Fix coverity issues: null deferences - Part 6
Ticket 47740 - Crash caused by changes to certmap.c
Ticket 47743 - Memory leak with proxy auth control
Ticket 47740 - Fix coverity issues(part 7)
Ticket 47766 - Tombstone purging can crash the server if the backend is stopped/disabled
Ticket 47767 - Nested tombstones become orphaned after purge
Ticket 47771 - Performing deletes during tombstone purging results in operation errors
Ticket 47736 - Import incorrectly updates numsubordinates for tombstone entries
Ticket 47782 - Parent numbordinate count can be incorrectly updated if an error occurs
Ticket 47771 - Cherry pick issue parentsdn freed twice
Ticket 47771 - Move parentsdn initialization to avoid crash
Ticket 47793 - Server crashes if uniqueMember is invalid syntax and memberOf
Ticket 47772 - fix coverity issue
Ticket 47670 - Aci warnings in error log
Ticket 47713 - Logconv.pl with an empty access log gives lots of errors
Ticket 47446 - logconv.pl memory continually grows
Ticket 47813 - managed entry plugin fails to update member
Ticket 47813 - remove "goto bail" from previous commit
Ticket 47426 - move compute_idletimeout out of handle_pr_read_ready
Ticket47426 - Coverity issue with last commit(move compute_idletimeout out of handle_pr_read_ready)
Ticket 47817 - The error result text message should be obtained just prior to sending result
Ticket 47781 - Server deadlock if online import started while
Ticket 47858 - Internal searches using OP_FLAG_REVERSE_CANDIDATE_ORDER can crash the server
Ticket 47861 - Certain schema files are not replaced during upgrade
Ticket 47862 - Repl-monitor.pl ignores the provided connection parameters
Ticket 47862 - repl-monitor fails to convert "*" to default values
Ticket 47457 - default nsslapd-sasl-max-buffer-size should be 2MB
Matthew Via (1):
Ticket #47428 - Memory leak in 389-ds-base 1.2.11.15
Nathan Kinder (196):
Bug 549554 - Trim single-valued attributes before sending to AD
Improve search for pcre header file
Bug 434735 - Allow SASL ANONYMOUS mech to work
Bug 570912 - Avoid selinux context conflict with httpd
Allow instance name to be parsed from start-slapd
Add managed entries plug-in
Bug 572355 - Label instance files and ports during upgrade.
Bug 578863 - Password modify extop needs to send referrals on replicas
Bug 584156 - Remove ldapi socket file during upgrade
Fix rsearch usage of name files for random filters
Bug 584497 - Allow DNA plugin to set same value on multiple attributes
Add replication session hooks
Correct function prototype for repl session hook
Bug 592389 - Set anonymous resource limits properly
Bug 601433 - Add man pages for start-dirsrv and related commands
Bug 604263 - Fix memory leak when password change is rejected
Bug 612242 - membership change on DS does not show on AD
Bug 613833 - Allow dirsrv_t to bind to rpc ports
Bug 594745 - Get rid of dirsrv_lib_t label
Bug 620927 - Allow multiple membership attributes in memberof plugin
Bug 612264 - ACI issue with (targetattr='userPassword')
Bug 630098 - fix coverity Defect Type: Code maintainability issues
Bug 630098 - fix coverity Defect Type: Code maintainability issues
Bug 630093 - (cov#15511) Don't use unintialized search_results in refint plugin
Bug 630093 - (cov#15518) Need to intialize fd in ldbm2ldif code
Bug 630096 - (cov#11778) check return value of ldap_parse_result
Bug 630096 - (cov#15446) check return value of ber_scanf()
Bug 630096 - (cov#15449,15450) Check return value of stat()
Bug 630096 - (cov#15448) Check return value of cache_replace()
Bug 630096 - (cov#15447) - Check return value of idl_append_extend()
Bug 630090 - (cov#11974) Remove unused ACL functions
Bug 630090 - (cov#15445) Fix illegal free in archive code
Bug 630094 - (cov#11818) Fix unreachable return in snmp subagent
Bug 630094 - (cov#15451) Get rid of unreachable free statements
Bug 630094 - (cov#15452) Remove NULL checking for op_string
Bug 630094 - (cov#15453) Eliminate NULL check for local_newentry
Bug 630094 - (cov#15454) Fix deadcode issue in mapping tree code
Bug 630094 - (cov#15455) Remove deadcode in attr_index_config()
Bug 630094 - (cov#15456) Remove NULL check for srdn in import code
Bug 630094 - (cov#15457) Remove deadcode in import code
Bug 630094 - (cov#15458) Fix deadcode issue in moddn code
Bug 630094 - (cov#15459) Remove NULL check for srdn in ldif2ldbm code
Bug 630094 - (cov#15520) Fix unreachable code issue if perfctrs code
Bug 630094 - (cov#15581) Add missing breaks in agt_mopen_stats()
Bug 690090 - (cov#11974) Remove additional unused ACL functions
Bug 630091 - (cov#15512) Fix usage of uninitialized bervals
Bug 630091 - (cov#15513) Fix usage of uninitialized bervals
Bug 630091 - (cov#15514) Initialize DBT in entryrdn_get_parent()
Bug 630091 - (cov#15515) Use of uninitialized array in index config code
Bug 630091 - (cov#15516,15517) Initialize pointers before attempting to free
Bug 630091 - (cov#15519) Initialize bervals in search_easter_egg()
Bug 630091 - (cov#15582) Free of uninitialized pointer in attr_index_config()
Bug 630097 - (cov#11933) Fix NULL dereference in schema code
Bug 630097 - (cov#11938) NULL dereference in mmldif
Bug 630097 - (cov#11946) NULL dereference in ResHashCreate()
Bug 630097 - (cov#11964) Remove dead code from libaccess
Bug 630097 - (cov#12143) NULL dereference in cos cache code
Bug 630097 - (cov#12148) NULL dereference in ruvInit()
Bug 630097 - (cov#12182,12183) NULL dereference in import code
Bug 630097 - (cov#15460) NULL deference in ACL URL code
Bug 630097 - (cov#15461) Remove unnecessary NULL check in DNA
Bug 630097 - (cov#15462) NULL dereference in mep_modrdn_post_op()
Bug 630097 - (cov#15463) Remove NULL check in referint plugin
Bug 630097 - (cov#15464) NULL dereference in repl code
Bug 630097 - (cov#15465) Null dereference in USN code
Bug 630097 - (cov#15473) NULL dereference in ResHashCreate()
Bug 630097 - (cov#15505) NULL dereference in memberOf code
Bug 630097 - (cov#15506) NULL dereference in dblayer code
Bug 630097 - (cov#15507,15508) NULL dereference in entryrdn code
Bug 630097 - (cov#15509) NULL dereference in idsktune
Bug 630097 - (cov#11938) NULL dereference in mmldif
Bug 630097 - (cov#15477) NULL dereference in ACL plug-in code
Bug 630091 - (cov#12209) Use of uninitialized pointer in libaccess
Bug 630092 - (cov#12116) Resource leak in ldclt code
Bug 630092 - (cov#12105) Resource leak in pwdscheme config code
Bug 630092 - (cov#12068) Resource leak in certmap code
Bug 630091 - (cov#11973) Array overrun in libaccess
Bug 522055 - Scope check for managed attribute fails
Bug 625335 - Self-write aci has permission to invalid attribute
Bug 631993 - Log authzid when proxy auth control is used
Cov #16300 - Unused variable in account policy plugin
Bug 544321 - remove-ds.pl should not throw error unlabelling port
Bug 555955 - Allow CoS values to be merged
Bug 643937 - Initialize replication version flags
Bug 305131 - Allow empty modify operation
Bug 619633 - Make attribute uniqueness obey requiredObjectClass
Bug 619623 - attr-unique-plugin ignores requiredObjectClass on modrdn operations
Bug 189985 - Improve attribute uniqueness error message
Bug 647932 - multiple memberOf configuration adding memberOf where there is no member
Bug 521088 - DNA should check ACLs before getting a value from the range
Bug 635009 - Add one-way AD sync capability
Bump VERSION.sh to 1.2.8.a1
Bug 648949 - Move selinux policy into base OS
Bug 648949 - Update configure
Roll back VERSION.sh for 1.2.7 release
Bug 625950 - hash nsslapd-rootpw changes in audit log
Bug 656392 - Remove calls to ber_err_print()
Bug 656515 - Allow Name and Optional UID syntax for grouping attributes
Bug 197886 - Avoid overflow of UUID generator
Bug 658312 - Allow mapped attribute types to be quoted
Bug 197886 - Initialize return value for UUID generation code
Bug 658309 - Process escaped characters in managed entry mappings
Bug 659456 - Incorrect usage of ber_printf() in winsync code
Bug 641944 - Don't normalize non-DN RDN values
Bug 658312 - Invalid free in Managed Entry plug-in
Bug 661792 - Valid managed entry config rejected
Bug 588791 - Allow anonymous rootDSE access only
Bug 606439 - Creating server instance with LDAPI takes too long
Bug 632670 - Chain-on-update logs managed-entries-plugin errors
Bug 621008 - parsing purge RUV from changelog at startup fails
Bug 663191 - Don't use $USER in DSCreate.pm
Bug 663597 - Memory leaks in normalization code
Bug 659131 - Incorrect RDN values added with multi-valued RDN
Bug 661102 - Rename of managed entries not handled correctly
Bug 193297 - Call pre-bind plug-ins for all SASL bind steps
Bug 201652 - LDAPv2 bind with expired password doesn't unbind correctly
Bug 470576 - Migration could do addition checks before commiting actions
Bug 481195 - Missing op type in log when password change required
Bug 509897 - Validate dnaScope to ensure it is a legal DN
Bug 505722 - Allow ntGroup to have mail attribute present
Bug 543633 - replication problems if supplier is killed under update load
Bug 671033 - range sharing between server breaks with SASL/GSSAPI auth
Bug 527912 - setup-ds.pl appears to hang when DNS is unreachable
Bug 252249 - Add pkg-config file for plug-in developers
Bug 670616 - Allow SSF to be set for local (ldapi) connections
Bug 668862 - init scripts return wrong error code
Bug 674430 - Improve error messages for attribute uniqueness
Bug 675853 - dirsrv crash segfault in need_new_pw()
Bug 678646 - Ignore tombstone operations in managed entry plug-in
Bug 671199 - Don't allow other to write to rundir
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 674852 - crash in ldap-agent when using OpenLDAP
Bug 681345 - setup-ds.pl should set SuiteSpotGroup automatically
Bug 680558 - Winsync plugin fails to restrain itself to the configured subtree
Bug 504803 - Allow maxlogsize to be set if logmaxdiskspace is -1
Bug 687974 - (cov#10715) Fix Coverity uninitialized variables issues
Bug 688341 - (cov#10709) Fix Coverity code maintainability issues
Bug 688341 - (cov#10708) Fix Coverity code maintainability issues
Bug 688341 - (cov#10706,10707) Fix Coverity code maintainability issues
Bug 688341 - (cov#10704,10705) Fix Coverity code maintainability issues
Bug 688341 - (cov#10703) Fix Coverity code maintainability issues
Bug 688341 - (cov#10702) Fix Coverity code maintainability issues
Bug 688341 - (cov#10709) Fix Coverity code maintainability issues
Bug 689537 - (cov#10699) Fix Coverity NULL pointer dereferences
Bug 689537 - (cov#10610) Fix Coverity NULL pointer dereferences
Bug 689537 - (cov#10608) Fix Coverity NULL pointer dereferences
Bug 689952 - (cov#10581) Incorrect bit check in replication connection code
Bug 690526 - (cov#10734) Double free in dse_add()
Bug 690649 - (cov#10731) Use of free'd pointer in indexing code
Bug 690882 - (cov#10571) Incorrect sizeof use in uuid code
Bug 690882 - (cov#10636,10637) Useless comparison in attrcrypt
Bug 690882 - (cov#10703) Incorrect sizeof use in vattr code
Bug 690882 - (cov#10572,10710) Incorrect sizeof use in uuid code
Bug 691574 - (cov#10579) Check return value of ber_scanf() in sort code
Bug 691574 - (cov#10577) Check return types when adding RDN CSNs
Bug 691574 - (cov#10573) check return value in GER code
Bug 691574 - (cov#10575) Check return value of ldap_get_option
Bug 691574 - (cov#10573) Fix syntax error
Bug 693868 - Add managed entry config during in-place upgrade
Add Auto Membership Plug-in
Bug 698428 - Make auto membership use Slapi_DN for DN comparisons
Bug 695779 - windows sync can lose old values when a new value is added
Bug 700557 - Linked attrs callbacks access free'd pointers after close
Bug 700557 - Leak at shutdown in DNA plug-in
Bug 703304 - Auto membership alternate config area should override default area
Bug 703304 - Auto membership alternate config area should override default area
Bug 703530 - Allow Managed Entry config to be relocated
Bug 697961 - memberOf needs to be triggered by internal operations
Bug 710377 - Import with chain-on-update crashes ns-slapd
Split automember regex rules into separate entries
Bug 713209 - Update sudo schema
Bug 691313 - Need TLS/SSL error messages in repl status and errors log
Bug 723937 - Slapi_Counter API broken on 32-bit F15
Bug 725743 - Make memberOf use PRMonitor for it's operation lock
Bug 729717 - Fatal error messages when syncing deletes from AD
Bug 728510 - Run dirsync after sending updates to AD
Bug 730387 - Add slapi_rwlock API and use POSIX rwlocks
Bug 611438 - Add Account Usability Control support
Bug 728592 - Allow ns-slapd to start with an invalid server cert
Bug 732541 - Ignore error 32 when adding automember config
Bug 722292 - Entries in DS are not updated properly when using WinSync API
Bug 722292 - (cov#11030) Leak of mapped_sdn in winsync rename code
Bug 735114 - renaming a managed entry does not update mepmanagedby
Bug 739172 - Allow separate fractional attrs for incremental and total protocols
Bug 743966 - Compiler warnings in account usability plugin
Bug 744946 - (cov#11046) NULL dereference in IDL code
Bug 752155 - Use restorecon after creating init script lock file
Ticket 284 - Remove unnecessary SNMP MIB files
ticket 304 - Fix kernel version checking in dsktune
ticket 211 - Use of uninitialized variables in ldbm_back_modify()
ticket 181 - Allow PAM passthru plug-in to have multiple config entries
coverity 12563 Read from pointer after free (fix 2)
Ticket 211 - Avoid preop range requests non-DNA operations
Ticket #503 - Improve AD version in winsync log message
Ticket 549 - DNA plugin no longer reports additional info when range is depleted
Ticket 556 - Don't overwrite certmap.conf during upgrade
Noriko Hosoi (442):
544089 - Referential Integrity Plugin does not take into account the attribute
557224 - subtree rename breaks the referential integrity plug-in
247413 - Incorrect error on multiple identical value add
559016 - Attempting to rename suffix returns inappropriate errors
555577 - Syntax validation fails for "ou=NetscapeRoot" tree
Undo - 555577 - Syntax validation fails for "ou=NetscapeRoot" tree
560827 - Admin Server templates: DistinguishName validation fails
548535 - memory leak in attrcrypt
563365 - Error handling problems in the backend functions
565664 - Incorrect parameter for CACHE_RETURN()
565987 - redhat-ds-base fails to build due to undefined struct
527848 - make sure db upgrade to 4.7 and later works correctly
539618 - Replication bulk import reports Invalid read/write
567370 - dncache: assertion failure in id2entry_delete
548115 - memory leak in schema reload
555970 - missing read lock in the combination of cos and nsview
539618 - Replication bulk import reports Invalid read/write
570667 - MMR: simultaneous total updates on the masters cause
Merge branch '547503'
Revert "Merge branch '547503'"
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
199923 - subtree search fails to find items under a db
570107 - The import of LDIFs with base-64 encoded DNs fails,
572649 - DS8.2 crashes on RHEL 4 (corresponding to bob, ber_2 test case)
573060 - DN normalizer: ESC HEX HEX is not normalized (
573896 - initializing subtree with invalid syntax crashes ns-slapd
515805 - Stop "initialize Database" crashes the server
548533 - memory leak in Repl_5_Inc_Protocol_new
Fixing a syntax error
Update to New DN Format
585905 - ACL with targattrfilters error crashes the server
574167 - An escaped space at the end of the RDN value is not
590931 - rhds81 import - hardcoded pages_limit for nsslapd-import-cache-autosize
591336 - Implementing upgrade DN format tool
593453 - Creating password policy with ns-newpolicy.pl on Replicated
593110 - backup-restore does not ALWAYS work
593899 - adding specific ACI causes very large mem allocate request
588867 - entryusn plugin fails on solaris
593899 - adding specific ACI causes very large mem allocate request
595893 - Base DN in SASL mapping is not normalized
511112 - Password history limited to 25 values
597375 - Deleting LDBM database causes backup/restore problem
574101 - MODRDN request never returns - possible deadlock
606920 - anonymous resource limit - nstimelimit -
605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl
578296 - Attribute type entrydn needs to be added when subtree
609256 - Selinux: pwdhash fails if called via Admin Server CGI
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
616618 - 389 v1.2.5 accepts 2 identical entries with different DN formats
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
616608 - SIGBUS in RDN index reads on platforms with strict alignments
619595 - Upgrading sub suffix under non-normalized suffix disappears
513166 - Simple Paged result doesn't provide the server's estimate
621928 - Unable to enable replica (rdn problem?) on 1.2.6 rc6
Bug 194531 - db2bak is too noisy
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 623118 - Simplepaged results going in infinite loop
Bug 614511 - fix coverity Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 619122 - fix coverity Defect Type: Resource leaks issues CID 11975 - 12051
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverity Defect Type: Resource leaks issues CID 12052 - 12093
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892
Bug 616500 - fix coverity Defect Type: Resource leaks issues
Bug 623507 - fix coverity Defect Type: Incorrect expression issues
Bug 623507 - fix coverity Defect Type: Incorrect expression issues
Bug 613056 - fix coverify Defect Type: Null pointer dereferences
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Removed redundant code in agmt_new_from_entry
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 628300 - DN is not normalized in dn/entry cache when an entry is added, entrydn is not present in search results
Bug 531642 - EntryUSN: RFE: a configuration option to make entryusn "global"
Bug 627738 - The cn=monitor statistics entries for the dnentry cache do not change or change very rarely
DN normalizer should check the invalid type
Bug 627738 - The cn=monitor statistics entries for the dnentry cache
Bug 629710 - escape_string does not check '\<HEX><HEX>'
agmtlist_shutdown (repl5_agmtlist.c) had an illegal access defect.
Bug 633168 - Share backend dbEnv with the replication changelog
Bug 633168 - Share backend dbEnv with the replication changelog
Bug 631862 - crash - delete entries not in cache + referint
Bug 625014 - SubTree Renames: ModRDN operation fails and the server hangs if the entry is moved to "under" the same DN.
Bug 558099 - Enhancement request: Log more information about the search result being a paged one
Bug 635987 - Incorrect sub scope search result with
Bug 606920 - anonymous resource limit- nstimelimit -
Bug 635987 - Incorrect sub scope search result with ACL containing ldap:///self
Bug 639289 - Adding a new CN entry with UpperCase UTF-8 Character
Bug 640027 - Naming attribute with a special char sequence parsing bug
Bug 640854 - changelog db: _cl5WriteOperation: failed to
Bug 637852 - sasl_io_start_packet: failed - read only 3 bytes
Bug 586966 - Sample update script has syntax errors
Bug 586973 - Sample update ldif points to non-existent directory
Bug 602456 - Allow to add any cn=config attributes;
Bug 244229 - targetattr not verified against schema when setting an aci
Bug 643532 - Incorrect DNs sometimes returned on searches
Bug 592397 - Upgrade tool dn2rdn: it does not clean up
Bug 645061 - Upgrade: 06inetorgperson.ldif and 05rfc4524.ldif
Bug 629681 - Retro Changelog trimming does not behave as expected
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 638773 - permissions too loose on pid and lock files
Bug 491733 - dbtest crashes
Bug 329751 - "nested" filtered roles searches candidates more
Bug 567282 - server can not abandon searchRequest of "simple paged results"
Bug 572018 - Upgrading from 1.2.5 to 1.2.6.a2 deletes userRoot
Bug 651571 - When attrcrypt is on, entrydn is stored in the backend db
Bug 661918 - 389-ds MMR plugin's changelogdb path logic is incorrect
Bug 182507 - clear-password mod from replica is discarded before changelogged
Bug 602456 - Allow to add any cn=config attributes;
Bug 489379 - passwordExpirationTime in entry being added
Bug 663484 - Entry usn plugin fails to properly tag entries on initialization
Bug 664563 - GER: ger for non-present entry is not correct
Bug 653007 - db2ldif export of clear text passwords lacks storage scheme
Bug 667488 - Cannot recreate numsubordinates index with db2index
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 615100 - log rotationinfo always recreated at startup,
Bug 624442 - MMR: duplicate replica ID
Bug 669205 - db2bak: backed up changelog should include RUVs
Bug 616850 - ldapmodify failed to reject the replace operation
Bug 627993 - Inconsistent storage of password expiry times
Bug 627993 - Inconsistent storage of password expiry times
dn2rdn should respect the DB version info
Bug 646381 - Faulty password for nsmultiplexorcredentials does not give any error message in logs
Bug 624547 - attrcrypt should query the given slot/token for
Bug 668619 - slapd stops responding
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
Bug 615052 - intrinsics and 64-bit atomics code fails to compile
Bug 616213 - insufficient stack size for HP-UX on PA-RISC
Bug 675265 - preventryusn gets added to entries on a failed delete
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 676053 - export task followed by import task causes cache assertion
Bug 676053 - export task followed by import task causes cache assertion
Bug 676053 - export task followed by import task causes cache assertion
Bug 450016 - RFE- Console display values in KB/MB/GB
Cancelling commit aef19508c4f618285116d2068655183658f564d9
Bug 625424 - repl-monitor.pl doesn't work in hub node
Bug 679978 - modifying attr value crashes the server, which is supposed to
Bug 681015 - RFE: allow fine grained password policy duration attributes in days, hours, minutes, as well
Bug 668909 - Can't modify replication agreement in some cases
Bug 684996 - Exported tombstone cannot be imported correctly
Bug 681015 - RFE: allow fine grained password policy duration attributes in days, hours, minutes, as well
Bug 689866 - ns-newpwpolicy.pl needs to use the new DN format
Bug 690955 - Mrclone fails due to the replica generation id mismatch
Bug 696407 - If an entry with a mixed case RDN is turned to be
Bug 697027 - 1 - minor memory leaks found by Valgrind + TET
Bug 697027 - 2 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 697027 - 4 - minor memory leaks found by Valgrind + TET
Bug 697027 - 5 - minor memory leaks found by Valgrind + TET
Bug 697027 - 6 - minor memory leaks found by Valgrind + TET
Bug 697027 - 7 - minor memory leaks found by Valgrind + TET
Bug 697027 - 8 - minor memory leaks found by Valgrind + TET
Bug 697027 - 9 - minor memory leaks found by Valgrind + TET
Bug 697027 - 10 - minor memory leaks found by Valgrind + TET
Bug 697027 - 11 - minor memory leaks found by Valgrind + TET
Bug 697027 - 12 - minor memory leaks found by Valgrind + TET
Bug 697027 - 13 - minor memory leaks found by Valgrind + TET
Bug 697027 - 14 - minor memory leaks found by Valgrind + TET
Bug 697027 - 15 - minor memory leaks found by Valgrind + TET
Bug 697027 - 16 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 700215 - ldclt core dumps
Bug 668619 - slapd stops responding
Bug 709826 - Memory leak: when extra referrals configured
Bug 706179 - DS can not restart after create a new objectClass has entryusn attribute
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
Bug 718303 - Intensive updates on masters could break the consumer's cache
Merge branch '718303'
Bug 719069 - clean up compiler warnings in 389-ds-base 1.2.9
Bug 712855 - Directory Server 8.2 logs "Netscape Portable
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 732153 - subtree and user account lockout policies implemented?
Introducing an environment variable USE_VALGRIND to clean up the entry cache and dn cache on exit.
Bug 744945 - nsslapd-counters attribute value cannot be set to "off"
Keep unhashed password psuedo-attribute in the adding entry
Reduce the number of DN normalization
Bug 745259 - Incorrect entryUSN index under high load
Bug 750622 - Fix Coverity (11104) Resource leak:
Bug 750624 - Fix Coverity (11053) Explicit null dereferenced:
Bug 750625 - Fix Coverity (11066) Unused pointer value
Bug 750625 - Fix Coverity (11065) Uninitialized pointer read
Bug 750625 - Fix Coverity (11064) Dereference before null check
Bug 750625 - Fix Coverity (11061) Resource leak
Bug 750625 - Fix Coverity (11060) Dereference null return value
Bug 750625 - Fix Coverity (11058, 11059) Dereference null return value
Bug 750625 - Fix Coverity (11057) Dereference null return value
Bug 750625 - Fix Coverity (11055) Explicit null dereferenced
Bug 750625 - Fix Coverity (11054) Dereference after null check
Bug 750625 - Fix Coverity (11117) Uninitialized pointer read
Bug 750625 - Fix Coverity (11116) Uninitialized pointer read
Bug 750625 - Fix Coverity (11114, 11115) Uninitialized value use
Bug 750625 - Fix Coverity (11113) Uninitialized pointer read
Bug 750625 - Fix Coverity (11112) Uninitialized pointer read
Bug 750625 - Fix Coverity (11109, 11110, 11111) Uninitialized pointer read
Bug 750625 - Fix Coverity (11108) Sizeof not portable
Bug 750625 - Fix Coverity (11107) Dereference before null check
Bug 750625 - Fix Coverity (11096) Explicit null dereferenced
Bug 750625 - Fix Coverity (11095) Explicit null dereferenced
Bug 750625 - Fix Coverity (11094) Dereference after null check
Bug 750625 - Fix Coverity (11091) Unchecked return value
Bug 750625 - Fix Coverity (11055-2) Explicit null dereferenced
Bug 750625 - Fix Coverity (11062) Resource leak
Bug 750625 - Fix Coverity (11066-2) Unused pointer value
Bug 750625 - Fix Coverity (12195) Dereference after null check
Bug 750625 - Fix Coverity (12196) Dereference before null check
Bug 750625 - Fix Coverity (11066-3) Unused pointer value
Bug 745259 - Incorrect entryUSN index under high load in
Trac Ticket 2 - If node entries are tombstone'd,
Trac Ticket 2 - If node entries are tombstone'd,
Trac Ticket 26 - Please support setting
Trac Ticket 75 - Unconfigure plugin opperations are being called.
Trac Ticket 168 - minssf should not apply to rootdse
Trac Ticket #18 - Data inconsitency during replication
Trac Ticket #52 - FQDN set to nsslapd-listenhost
Trac Ticket 139 - eliminate the use of char *dn in favor of Slapi_DN *dn
Trac Ticket 35 - Log not clear enough on schema errors
Trac Ticket #274 - Reindexing entryrdn fails if
Trac Ticket #275 - Invalid read reported by valgrind
Trac Ticket 51 - memory leaks in 389-ds-base-1.2.8.2-1.el5?
Trac Ticket #27 - SASL/PLAIN binds do not work
Trac Ticket #84 - 389 Directory Server Unnecessary Checkpoints
Trac Ticket #169 - allow 389 to use db5
Trac Ticket #34 - remove-ds.pl does not remove everything
Trac Ticket #26 - Please support setting defaultNamingContext in the rootdse.
Trac Ticket #298 - crash when replicating orphaned tombstone entry
Trac Ticket #290 - server hangs during shutdown if betxn pre/post op fails
Trac Ticket #290 - server hangs during shutdown if betxn pre/post op fails
Minor bug fix introcuded by commit 69c9f3bf7dd9fe2cadd5eae0ab72ce218b78820e
Trac Ticket #260 - 389 DS does not support multiple
Fixing compiler warnings
Trac Ticket #303 - make DNA range requests work with transactions
coverity 12606 Logically dead code
Trac Ticket #46 - setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 (revised) - setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 - (take 3) setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 - (additional) setup-ds-admin.pl does not
Trac Ticket #45 - Fine Grained Password policy:
Trac Ticket #46 - (additional 2) setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #335 - transaction retries need to be cache aware
Trac Ticket #338 - letters in object's cn get converted to
Trac Ticket #310 - Avoid calling escape_string() for logged DNs
Trac Ticket #19 - Convert entryUSN plugin to transaction aware type
Trac Ticket #345 - db deadlock return should not log error
Trac Ticket #359 - Database RUV could mismatch the one
Trac Ticket #338 - letters in object's cn get converted to
Trac Ticket #359 - Database RUV could mismatch the one
Trac Ticket #335 - transaction retries need to be cache aware
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
audit log does not log unhashed password: enabled, by default.
Trac Ticket 396 - Account Usability Control Not Working [Bug 835238]
Trac Ticket #346 - Slow ldapmodify operation time for large quantities of multi-valued attribute values
Trac Ticket #346 - Slow ldapmodify operation time for large quantities of multi-valued attribute values
12813: Uninitialized pointer read
Trac Ticket #412 - memberof performance enhancement
Trac Ticket #409 - Report during startup if nsslapd-cachememsize is too small
Coverity defects
Trac Ticket #346 - Slow ldapmodify operation time for large
Trac Ticket #437 - variable dn should not be used in ldbm_back_delete
Coverity defects
Trac Ticket #466 - entry_apply_mod - ADD: Failed to set
Undo commit db792dbc7141b03bd33b710b79ed0942c34d6530
Trac Ticket #470 - 389 prevents from adding a posixaccount
Trac Ticket #340 - Change on SLAPI_MODRDN_NEWSUPERIOR is not
Bug 863576 - Dirsrv deadlock locking up IPA
bump version to 1.2.11.16
Coverity defects
Fixing compiler warnings in the posix-winsync plugin
Trac Ticket #494 - slapd entered to infinite loop during new index addition
Coverity defects
Trac Ticket #498 - Cannot abaondon simple paged result search
Trac Ticket #500 - Newly created users with organizationalPerson objectClass fails to sync from AD to DS with missing attribute error
Trac Ticket #519 - Search with a complex filter including range search is slow
Trac Ticket #520 - RedHat Directory Server crashes (segfaults) when moving ldap entry
Ticket #572 - PamConfig schema not updated during upgrade
Bug 906005 - Valgrind reports memleak in modify_update_last_modified_attr
Ticket 570 - DS returns error 20 when replacing values of a multi-valued attribute (only when replication is enabled)
Ticket #576 - DNA: use event queue for config update only at the start up
Ticket #579 - Error messages encountered when using POSIX winsync
Ticket #634 - Deadlock in DNA plug-in
Ticket #627 - ns-slapd crashes sporadically with segmentation fault in libslapd.so
Ticket #47308 - unintended information exposure when anonymous access is set to rootdse
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
bump version to 1.2.11.20
Coverity fix
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
Ticket #47347 - Simple paged results should support async search
Trac Ticket #531 - loading an entry from the database should use str2entry_f
Ticket #47327 - error syncing group if group member user is not synced
Ticket #47367 - (phase 1) ldapdelete returns non-leaf entry error while trying to remove a leaf entry
Ticket #47391 - deleting and adding userpassword fails to update the password
Ticket #47391 - deleting and adding userpassword fails to update the password (additional fix)
Ticket #47402 - Attribute names are incorrect in search results
Ticket #47412 - Modify RUV should be serialized in ldbm_back_modify/add
Ticket #47435 - Very large entryusn values after enabling the USN plugin and the lastusn value is negative.
Ticket #47378 - fix recent compiler warnings
Ticket #543 - Sorting with attributes in ldapsearch gives incorrect result
Ticket #47492 - PassSync removes User must change password flag on the Windows side
Ticket #47523 - Set up replcation/agreement before initializing the sub suffix, the sub suffix is not found by ldapsearch
Ticket #47534 - RUV tombstone search with scope "one" doesn`t work
Coverity fixes - 12023, 12024, and 12025
Ticket #422 - 389-ds-base - Can't call method "getText"
Ticket #47488 - Users from AD sub OU does not sync to IPA
Ticket #47581 - Winsync plugin segfault during incremental backoff
Ticket #47581 - Winsync plugin segfault during incremental backoff (phase 2)
Ticket #47463 - IDL-style can become mismatched during partial restoration
Ticket #47693 - Environment variables are not passed when DS is started via service
Ticket #47693 - Environment variables are not passed when DS is started via service
Ticket #47677 - Size returned by slapi_entry_size is not accurate
Ticket #47642 - Windows Sync group issues
Ticket #415 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist
Ticket 346 - version 4 Slow ldapmodify operation time for large quantities of multi-valued attribute values
Ticket 47369 version2 - provide default syntax plugin
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
Ticket #47731 - A tombstone entry is deleted by ldapdelete
Ticket #47735 - e_uniqueid fails to set if an entry is a conflict entry
Ticket #47737 - Under heavy stress, failure of turning a tombstone into glue makes the server hung
Ticket #47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind
bump version to 1.2.11.26
Ticket #47734 - Change made in resolving ticket #346 fails on Debian SPARC64
Ticket #47740 - Coverity issue in 1.3.3
Ticket #47735 - e_uniqueid fails to set if an entry is a conflict entry
Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check
bump version to 1.2.11.29
Ticket #346 - Slow ldapmodify operation time for large quantities of multi-valued attribute values
Ticket #47707 - 389 DS Server crashes and dies while handles paged searches from clients
Ticket #47649 - Server hangs in cos_cache when adding a user entry
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47764 - Problem with deletion while replicated
Ticket #47780 - Some VLV search request causes memory leaks
Ticket #47804 - db2bak.pl error with changelogdb
Ticket #47770 - #481 breaks possibility to reassemble memberuid list
Ticket #47809 - find a way to remove replication plugin errors messages "changelog iteration code returned a dummy entry with csn %s, skipping ..."
Ticket 47331 - Self entry access ACI not working properly
Ticket #47820 - 1.2.11 branch: coverity errors
Revert "Ticket #47423 - 7-bit check plugin does not work for userpassword attribute"
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Revert "Ticket #47750 - Creating a glue fails if one above level is a conflict or missing"
Ticket #47863 - New defects found in 389-ds-base-1.2.11
Trac Ticket #443 - Deleting attribute present in
Ticket #443 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
Ticket #346 - Fixing memory leaks
Ticket #47824 - paged results control is not working in some cases when we have a subsuffix.
Bug 1123477 - unauthenticated information disclosure
bump version to 1.2.11.30
Ticket #47874 - Performance degradation with scope ONE after some load
Ticket #415 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist
Trac Ticket #443 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Revert "Ticket #47875 - dirsrv not running with old openldap"
Revert "Ticket #47875 - dirsrv not running with old openldap"
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Bug 1129660 - Adding users to user group throws Internal server error.
bump version to 1.2.11.31
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
bump version to 1.2.11.32
Rich Megginson (438):
Net::LDAP password modify extop breaks; msgid in response is 0xFF
Clean up assert for entrydn
Bug 543080 - Bitwise plugin fails to return the exact matched entries for Bitwise search filter
Bug 537466 - nsslapd-distribution-plugin should not require plugin name to begin with "lib"
bump version to 1.2.6.a2
Do not use syntax plugins directly for filters, indexing
wrap new style matching rule plugins for use in old style indexing code
change extensible filter code to use new syntax function style mr funcs
change syntax plugins to register required matching rule plugins
crash looking up compat syntax; numeric string syntax using integer; make octet string ordering work correctly
fix memory leak in attr replace when replacement fails
fix dso linking issues found by fedora 13 linking
problems linking with -z defs
389 DS segfaults on libsyntax-plugin.so - part 1
389 DS segfaults on libsyntax-plugin.so - part 2
389 DS segfaults on libsyntax-plugin.so - part 3
Bug 460162 - FedoraDS "with-FHS" installs init.d StartupScript in wrong location on non-RHEL/Fedora OS
Bug 568196 - Install DS8.2 on Solaris fails
Bug 568196 - Install DS8.2 on Solaris fails - part 2
Bug 551198 - LDAPI: incorrect logging to access log
bump version to 1.2.6.a3
fix various memory leaks
Bug 551198 - LDAPI: incorrect logging to access log - part 2
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
cleanup build warnings
Bug 571514 - upgrade to 1.2.6 should upgrade 05rfc4523.ldif (cert schema)
Bug 570905 - postalAddress syntax should allow empty lines (should allow $$)
Add support for additional schema/matching rules included with 389
Bug 572677 - Memory leak in searches including GER control
Bug 571677 - Busy replica on consumers when directly deleting a replication conflict
Bug 576074 - search filters with parentheses fail
Bug 567429 - slapd didn't close connection and get into CLOSE_WAIT state
Bug 578167 - repl. of mod/replace deletes multi-valued attrs
Bug 561575 - setup-ds-admin fails to supply nsds5ReplicaName when configuring via ConfigFile
Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements.
Bug 576644 - segfault while multimaster replication (paired node won't find deleted entries)
start of 1.2.6.a4
Bug 572018 - Upgrading from 1.2.5 to 1.2.6.a2 deletes userRoot
Fix too few args for format warning in acllas
Bug 586571 - DS Console shows escaped DNs
Bug 591685 - Server instances Fail to Start on Solaris due to Library Path and pcre
bump console version to 1.2.3
Repl Session API needs to check for NULL api before init
Bug 593392 - setup-ds-admin.pl -k creates world readable file
Bug 595874 - 99user.ldif getting overpopulated
bump version to 1.2.6.a5
bump version to 1.2.6.rc1
bump version to 1.2.6.rc2
bump version to 1.2.6.rc3
Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
Bug 603942 - null deref in _ger_parse_control() for subjectdn
bump version to 1.2.6.rc4
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 602530 - coverity: op_shared_modify: compare pre, post and original entries before freeing them
Bug 602531 - coverity: op_shared_delete: compare preop entry and GLUE_PARENT_ENTRY before freeing them
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 610177 - fix coverity Defect Type: Uninitialized variables issues
Bug 610276 - fix coverity Defect Type: API usage errors issues
Bug 611850 - fix coverity Defect Type: Error handling issues
Bug 614242 - C99/ANSI C++ related compile errors on HP-UX
Bug 547503 - replication broken again, with 389 MMR replication and TCP errors
Bug 617013 - repl-monitor.pl use cpu upto 90%
fix build failures due to libtool problems
Bug 617629 - Missing aliases in new schema files
Bug 617862 - Replication: Unable to delete tombstone errors
bump version to 1.2.7.a1
Bug 610281 - fix coverity Defect Type: Control flow issues - daemon.c:write_function()
Bug 610281 - fix coverity Defect Type: Control flow issues - last repl init status
postalAddress syntax does not accept empty values
ger should support both "dn" and "distinguishedName"
openldap - ldap_url_parse_ext is not part of the public api
fix memleak in ldbm_config_read_instance_entries
Add -x option to ldap tools when using openldap
openldap - add support for missing controls, add ldif api, fix NSS usage
port client tools to use openldap API
use the mozldap versions of the proxy auth control create function
document slapi wrappers for openldap/mozldap functions that differ
fix some compiler warnings
use strcasecmp with ptype and type->bv_val
ber_printf 'o' cannot handle NULL bv_val
fix the url_parse logic when looking for a missing suffix DN
openldap ldapsearch uses -LLL to suppress # version: N
add ldaptool_opts for the non BUNDLE case in Makefile.am
openldap ldapsearch returns empty line at end of LDIF output
have to use LDAP_OPT_X_TLS_NEVER to defeat cert hostname checking
openldap_read_function needs to set EWOULDBLOCK if the buffer is empty
do not terminate unwrapped LDIF line with another newline
slapi_ldap_url_parse must handle multiple host:port in url
convert mozldap host list to openldap uri list
move the out pointer back if continuation lines were removed
check src < *out only; only check for \nspace if src < *out - 2
use slapi_ldap_url_parse in the acl code
do not un-null-terminate normalized DN until new url is constructed
implement slapi_ldap_explode_dn and slapi_ldap_explode_rdn
use slapi_pblock_set to set the ldap result code for the be postop plugins
pass the string copy to slapi_dn_normalize_original
bug 614511 - fix coverity null reference - revert macro aci $dn logic
fix compiler warnings - unused vars/funcs, invalid casts
use slapi_mods_init_passin/get_ldapmods_passout if modifying the smods
Have to explicitly set protocol version to 3
Only check modrdn ops for backend/suffix correctness if not the default backend
Bug 634561 - Server crushes when using Windows Sync Agreement
openldap ber_init will assert if the bv->bv_val is NULL
add the account policy plugin and related server code, schema, and config
fix pblock memory leak
do not register pre/post op plugins if disabled
add support for global inactivity limit
fix typos in Makefile.am, acctpolicy schema
bump version to 1.2.7.a2
remove extra format argument; use %lu for size_t printf format
Bug 644013 - uniqueness plugin segfault bug
bump version to 1.2.7.a3
bump to 1.2.7.a4
bump version to 1.2.7.a5
put replication config entries in separate file
bump version to 1.2.7.a6
bump version to 1.2.7.1
bump version to 1.2.7.2
bump version to 1.2.7.3
bump version to 1.2.7.4
Bug 515329 - Multiple mods in one operation can result in an inconsistent replica
bump version to 1.2.8.a1
Bug 642046 - Segfault when using SASL/GSSAPI multimaster replication, possible krb5_creds doublefree
Bug 624485 - setup dsktune check step should default to "yes" if no problems found
Bug 622907 - support piped passwords to perl-based maintenance commands
Bug 624485 - setup dsktune check step should default to "yes" if no problems found
Bug 576534 - Password displayed on console when entered in command-line utilities
Bug 667935 - DS pipe log script's logregex.py plugin is not redirecting the log output to the text file
bump version to 1.2.8.a2
Bug 668385 - DS pipe log script is executed as many times as the dirsrv service is restarted
Bug 676689 - crash while adding a new user to be synced to windows
Bug 675113 - ns-slapd core dump in windows_tot_run if oneway sync is used
Bug 677440 - clean up compiler warnings in 389-ds-base 1.2.8
Bug 677774 - DS fails to start after reboot
Bug 666076 - dirsrv crash (1.2.7.5) with multiple simple paged result searches
Bug 675320 - empty modify operation with repl on or lastmod off will crash server
bump version to 1.2.9.a1 - console version to 1.2.4
Bug 677705 - ds-logpipe.py script is failing to validate "-s" and "--serverpid" options with "-t".
Bug 676655 - winsync stops working after server restart
Bug 680555 - ns-slapd segfaults if I have more than 100 DBs
Bug 514190 - setup-ds-admin.pl --debug does not log to file
Bug 518890 - setup-ds-admin.pl - improve hostname validation
Bug 644784 - Memory leak in "testbind.c" plugin
Bug 683250 - slapd crashing when traffic replayed
Bug 690584 - #10691 ldbm_back_init() - fix coverity resource leak issues
Bug 690584 - #10690 #10689 attrcrypt_get_ssl_cert_name() - fix coverity resource leak issues
Bug 690584 - #10688 - dblayer_make_env - fix coverity resource leak issues
Bug 690584 - #10669 #10668 cl5ImportLDIF - fix coverity resource leak issues
Bug 690584 - #10658 linked_attrs_pre_op - fix coverity resource leak issues
Bug 690584 - #10655 acllas__handle_group_entry - fix coverity resource leak issues
Bug 690584 - #10654 #10653 str2entry_dupcheck - fix coverity resource leak issues
Bug 690584 - #10652 #10651 #10650 #10649 #10648 #10647 send_specific_attrs send_all_attrs - fix coverity resource leak issues
Bug 690584 - #10643 hash_rootpw - fix coverity resource leak issues
Bug 690584 - #10641 reslimit_bv2int - fix coverity resource leak issues
Bug 691422 - sdt_destroy - fix coverity control flow issues
Bug 691422 - ldbm_back_upgradedb - fix coverity control flow issues
Bug 691422 - csnplFree - fix coverity control flow issues
Bug 691422 - SetUnicodeStringFromUTF_8 - fix coverity control flow issues
Bug 691422 - cl5DeleteRUV - fix coverity control flow issues
Bug 691422 - acl_read_access_allowed_on_entry - fix coverity control flow issues
Bug 691422 - search_internal_callback_pb - fix coverity control flow issues
Bug 691422 - cl5WriteRUV - fix coverity control flow issues
Bug 691422 - windows_replay_update - fix coverity control flow issues
Bug 690584 - #10691 ldbm_back_init() - fix coverity resource leak issues
Bug 690584 - #10652 #10651 #10650 #10649 #10648 #10647 send_specific_attrs send_all_attrs - fix coverity resource leak issues
Bug 668385 - DS pipe log script is executed as many times as the dirsrv service is restarted
Bug 692937 - Replica install fails after step for "enable GSSAPI for replication"
Bug 692331 - Segfault on index update during full replication push on 1.2.7.5
Bug 693451 - cannot use localized matching rules
Bug 693455 - nsMatchingRule does not work with multiple values
Bug 693503 - matching rules do not inherit from superior attribute type
Bug 693466 - Unable to change schema online
Bug 692991 - rhds82 - windows_tot_run: failed to obtain data to send to the consumer; LDAP error - -1
Bug 693473 - rhds82 rfe - windows_tot_run to log Sizelimit exceeded instead of LDAP error - -1
Bug 693962 - Full replica push loses some entries with multi-valued RDNs
Bug 694336 - Group sync hangs Windows initial Sync
Bug 700145 - userpasswd not replicating
Bug 703990 - Support upgrade from Red Hat Directory Server
bump console version to 1.2.5
Bug 703990 - Support upgrade from Red Hat Directory Server
Bug 703990 - Support upgrade from Red Hat Directory Server
Bug 707015 - Cannot disable SSLv3 and use TLS only
bump version to 1.2.9.a2
Bug 707384 - only allow FIPS approved cipher suites in FIPS mode
Bug 711906 - ns-slapd segfaults using suffix referrals
Bug 706209 - LEGAL: RHEL6.1 License issue for 389-ds-base package
Bug 703703 - setup-ds-admin.pl asks for legal agreement to a non-existant file
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
bump console version to 1.2.6
Bug 697694 - rhds82 - incr update state stop_fatal_error "requires administrator action", with extop_result: 9
Bug 716980 - winsync uses old AD entry if new one not found
add support for ldif files with changetype: add
writing Inf file shows SchemaFile = ARRAY(0xhexnum)
look for separate openldap ldif library
bump version to 1.2.9.a3
Bug 709468 - RSA Authentication Server timeouts when using simple paged results on RHDS 8.2.
Bug 720059 - RDN with % can cause crashes or missing entries
bump version to 1.2.9.0
Bug 725542 - Instance upgrade fails when upgrading 389-ds-base package
Bug 725953 - Winsync: DS entries fail to sync to AD, if the User's CN entry contains a comma
Bug 723937 - replication failing on RUV errors
bump version to 1.2.9.1
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.2
Bug 727511 - ldclt SSL search requests are failing with "illegal error numbe
bump version to 1.2.9.3
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.4
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.5
Bug 729378 - delete user subtree container in AD + modify password in DS == DS crash
Bug 723937 - replication failing on RUV errors
Bug 729369 - upgrade DB to upgrade from entrydn to entryrdn format is not working.
make sure the DBVERSION file ends in a newline
bump version to 1.2.10.a1
Bug 633803 - passwordisglobalpolicy attribute brakes TLS chaining
Bug 733103 - large targetattr list with syntax errors cause server to crash or hang
Bug 703990 - cross-platform - Support upgrade from Red Hat Directory Server
Bug 735121 - simple paged search + ip/dns based ACI hangs server
Bug 695736 - Providing native systemd file for upcoming F15 Feature Systemd
Bug 590826 - Reloading database from ldif causes changelog to emit "data no longer matches" errors
Bug 736712 - Modifying ruv entry deadlocks server
Add support for pre/post db transaction plugins
Make all backend operations transaction aware
Bug 741744 - MOD operations with chained delete/add get back error 53 on backend config
Bug 742324 - allow nsslapd-idlistscanlimit to be set dynamically and per-user
Bug 741744 - part2 - MOD operations with chained delete/add get back error 53 on backend config
Bug 740942 - allow resource limits to be set for paged searches independently of limits for other searches/operations
bump version to 1.2.10.a2
bump version to 1.2.10.a3
fix transaction support in ldbm_delete
bump version to 1.2.10.a4
set the ENTRY_POST_OP for modrdn betxnpostoperation plugins
pass the plugin config entry to the plugin init function
make memberof transaction aware and able to be a betxnpostoperation plugin
Bug 741744 - part3 - MOD operations with chained delete/add get back error 53
bump version to 1.2.10.a5
Change referential integrity to be a betxnpostoperation plugin
Use new PLUGIN_CONFIG_ENTRY feature to allow switching between txn and regular
Bug 748575 - rhds81 modrn operation and 100% cpu use in replication
Bug 748575 - part 2 - rhds81 modrdn operation and 100% cpu use in replication
Bug 751495 - 'setup-ds.pl -u' fails with undefined routine 'updateSystemD'
bump version to 1.2.10.a6
Bug 751645 - crash when simple paged fails to send entry to client
csn_as_string - use slapi_uN_to_hex instead of sprintf
uniqueid formatting - use slapi_u8_to_hex instead of sprintf
fix member variable name error in slapi_uniqueIDFormat
reduce calls to csn_as_string and slapi_log_error
csn_init_as_string should not use sscanf
use slapi_hexchar2int and slapi_str_to_u8 everywhere
Bug 755754 - Unable to start dirsrv service using systemd
Bug 755725 - 389 programs linked against openldap crash during shutdown
Ticket 1 - pre-normalize filter and pre-compile substring regex - and other optimizations
Ticket #162 - Infinite loop / spin inside strcmpi_fast, acl_read_access_allowed_on_attr, server DoS
bak2db gets stuck in infinite loop
Ticket #256 - debug build assertion in ACL_EvalDestroy()
bump version to 1.2.10.a7
Ticket #167 - Mixing transaction and non-transaction plugins can cause deadlock
fix mep sdn compiler warnings
add a hack to disable sasl hostname canonicalization - helps with testing when you don't want to set up correct host name resolution and/or cannot set the default system hostname
Ticket #12 - 389 DS DNA Plugin / Replication failing on GSSAPI
Ticket #257 - repl-monitor doesn't work if leftmost hostnames are the same
fix recent compiler warnings
Ticket #15 - Get rid of rwlock.h/rwlock.c and just use slapi_rwlock instead
fix compiler warnings
Remove redundant code - make a global into a static
Ticket #262 - pid file not removed with systemd
fix mozldap build issues
Ticket #264 - upgrade needs better check for "server is running"
Ticket #263 - add systemd include directive
bump version to 1.2.10.rc1
change version to 1.2.10.a8
Ticket #272 - add tombstonenumsubordinates to schema
bump version to 1.2.10.rc1
Ticket #161 - Review and address latest Coverity issues
Ticket #22 - RFE: Support sendmail LDAP routing schema
Ticket #29 - Samba3-schema is missing sambaTrustedDomainPassword
Ticket #273 - ruv tombstone searches don't work after reindex entryrdn
Ticket #273 - ruv tombstone searches don't work after reindex entryrdn
fix a couple of minor coverity issues
Ticket #87 - Manpages fixes
Ticket #13 - slapd process exits when put the database on read only mode while updates are coming to the server
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #277 - cannot set repl referrals or state
Ticket #278 - Schema replication update failed: Invalid syntax
Ticket #277 - cannot set repl referrals or state
Ticket #279 - filter normalization does not use matching rules
Ticket #280 - extensible binary filters do not work
Ticket #281 - TLS not working with latest openldap
coverity 12488 Resource leak In attr_index_config(): Leak of memory or pointers to system resources
bump version to 1.2.10.rc2
fix compiler warning in acct policy plugin
bump version to 1.2.11.a1
Ticket #294 - 389 DS Segfaults during replica install in FreeIPA
coverity uninit var and resource leak
Revert "Ticket #111 - ability to control behavior of modifyTimestamp/modifiersName"
Revert "Ticket #167 - Mixing transaction and non-transaction plugins can cause deadlock"
Revert "Change referential integrity to be a betxnpostoperation plugin"
Revert "make memberof transaction aware and able to be a betxnpostoperation plugin"
Revert "pass the plugin config entry to the plugin init function"
coverity 12559 Uninitialized pointer read In ldbm_back_modify(): Reads an uninitialized pointer or its target
Ticket #281 - TLS not working with latest openldap
Trac Ticket #298 - crash when replicating orphaned tombstone entry
Ticket #301 - implement transaction support using thread local storage
init txn thread private data for all database modes
handle null smods
memleak in mep_parse_config_entry
memleak in normalize_mods2bvals
destroy the entry cache and dn cache in the dse post op delete callback
Ticket #289 - allow betxn plugin config changes
coverity 12563 Read from pointer after free
Ticket 317 - RHDS fractional replication with excluded password policy attributes leads to wrong error messages.
Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash
Ticket #320 - allow most plugins to be betxn plugins
Ticket #324 - Sync with group attribute containing () fails
Ticket #324 - redux: Sync with group attribute containing () fails
Ticket #316 and Ticket #70 - add post add/mod and AD add callback hooks
Ticket #261 - Add Solaris i386
Ticket #331 - transaction errors with db 4.3 and db 4.2
schema def must have DESC '' - close paren must be preceded by space
Ticket #336 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
Ticket #336 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
Ticket #347 - IPA dirsvr seg-fault during system longevity test
Ticket #348 - crash in ldap_initialize with multiple threads
Ticket #351 - use betxn plugins by default
Ticket #353 - coverity 12625-12629 - leaks, dead code, unchecked return
bump version to 1.2.11.1
Ticket #348 - crash in ldap_initialize with multiple threads
Ticket #351 - use betxn plugins by default
bump version to 1.2.11.2
Ticket #358 - managed entry doesn't delete linked entry
bump version to 1.2.11.3
Trac Ticket #359 - Database RUV could mismatch the one in changelog under the stress
Ticket #321 - krbExtraData is being null modified and replicated on each ssh login
Ticket #360 - ldapmodify returns Operations error
Ticket #382 - DS Shuts down intermittently
Ticket #383 - usn + mmr = deletions are not replicated
bump version to 1.2.11.4
fix coverity issues with uninit vals, no return checking
Ticket #389 - ADD operations not in audit log
Ticket #360 - ldapmodify returns Operations error - fix delete caching
Ticket #360 - ldapmodify returns Operations error - fix delete caching
improve txn test index handling
Ticket #387 - managed entry sometimes doesn't delete the managed entry
Ticket #387 - managed entry sometimes doesn't delete the managed entry
bump version to 1.2.11.5
bump version to 1.2.11.6
Ticket 378 - unhashed#user#password visible after changing password
bump version to 1.2.11.7
Ticket #405 - referint modrdn not working if case is different
Ticket #406 - Impossible to rename entry (modrdn) with Attribute Uniqueness plugin enabled
Ticket #410 - Referential integrity plug-in does not work when update interval is not zero
Ticket #425 - support multiple winsync plugins
Ticket #430 - server to server ssl client auth broken with latest openldap
Ticket #426 - support posix schema for user and group sync
coverity - mbo dead code - winsync leaks, deadcode, null check, test code
Ticket #355 - winsync should not delete entry that appears to be out of scope
Ticket #440 - periodic dirsync timed event causes server to loop repeatedly
fix mem leaks with parent dn log message, setting winsync windows domain
coverity - posix winsync mem leaks, null check, deadcode, null ref, use after free
fix coverity resource leak in windows_plugin_add
bump version to 1.2.11.12
Ticket #426 - support posix schema for user and group sync
bump version to 1.2.11.13
Ticket #374 - consumer can go into total update mode for no reason
bump version to 1.2.11.14
fix compiler warnings in ticket 374 code
bump version to 1.2.11.15
Ticket #491 - multimaster_extop_cleanruv returns wrong error codes
Ticket #47362 - ipa upgrade selinuxusermap data not replicating
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
Ticket #47349 - DS instance crashes under a high load
Ticket #47378 - fix recent compiler warnings
Ticket #47377 - make listen backlog size configurable
Ticket #47375 - flush_ber error sending back start_tls response will deadlock
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47410 - changelog db deadlocks with DNA and replication
Ticket #47392 - ldbm errors when adding/modifying/deleting entries
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket #47424 - Replication problem with add-delete requests on single-valued attributes
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Fix compiler warnings for Ticket 47395 and 47397
fix compiler warning in posix winsync code for posix_group_del_memberuid_callback
fix coverity 11895 - null deref - caused by fix to ticket 47392
fix coverity 11915 - dead code - introduced with fix for ticket 346
Revert "fix coverity 11915 - dead code - introduced with fix for ticket 346"
bump version to 1.2.11.22
Bug 999634 - ns-slapd crash due to bogus DN
Ticket #47516 replication stops with excessive clock skew
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47336 - logconv.pl -m not working for all stats
Ticket #47341 - logconv.pl -m time calculation is wrong
Ticket #47348 - add etimes to per second/minute stats
Ticket #47387 - improve logconv.pl performance with large access logs
Ticket #47387 - improve logconv.pl performance with large access logs
Ticket #47501 logconv.pl uses /var/tmp for BDB temp files
Ticket 47533 logconv: some stats do not work across server restarts
bump version to 1.2.11.23
minor fixes for bdb 4.2/4.3 and mozldap
bump version to 1.2.11.24
Ticket #47551 logconv: -V does not produce unindexed search report
Ticket #47550 logconv: failed logins: Use of uninitialized value in numeric comparison at logconv.pl line 949
ticket #47550 wip
Ticket #47559 hung server - related to sasl and initialize
Ticket #47585 Replication Failures related to skipped entries due to cleaned rids
Revert "Ticket #47559 hung server - related to sasl and initialize"
Ticket #47596 attrcrypt fails to find unlocked key
Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches
bump version to 1.2.11.25
Ticket #47596 attrcrypt fails to find unlocked key
Ticket #47623 fix memleak caused by 47347
Ticket #47623 fix memleak caused by 47347
Ticket #47516 replication stops with excessive clock skew
Ticket #471 logconv.pl tool removes the access logs contents if "-M" is not correctly used
Ticket #47692 single valued attribute replicated ADD does not work
fix coverity 11915 - dead code - introduced with fix for ticket 346
Ticket #47448 - Segfault in 389-ds-base-1.3.1.4-1.fc19 when setting up FreeIPA replication
Ticket #47492 - PassSync removes User must change password flag on the Windows side
Ticket #47773 - mem leak in do_bind when there is an error
Ticket #47774 mem leak in do_search - rawbase not freed upon certain errors
Ticket #47772 empty modify returns LDAP_INVALID_DN_SYNTAX
Ticket #47772 empty modify returns LDAP_INVALID_DN_SYNTAX
Ticket #47831 - server restart wipes out index config if there is a default index
Ticket #47692 single valued attribute replicated ADD does not work
Ticket 47446 - logconv.pl memory continually grows
Thierry bordaz (tbordaz) (7):
Ticket 47361 - Empty control list causes LDAP protocol error is thrown
Ticket 47393 - Attribute are not encrypted on a consumer after a full initialization
Ticket 47489 - Under specific values of nsDS5ReplicaName, replication may get broken or updates missing
Ticket 47354 - Indexed search are logged with 'notes=U' in the access logs
Ticket 47787 - A replicated MOD fails (Unwilling to perform) if it targets a tombstone
Ticket 47331 - Self entry access ACI not working properly
Ticket 616 - High contention on computed attribute lock
nturpin (1):
Ticket #3: acl cache overflown problem
root (4):
Bug 480787 - Autoconf parameter --with and --without
Ticket #326 - MemberOf plugin should work on all backends
Ticket #337 - RFE - Improve CLEANRUV functionality
Ticket #216 - RFE - Disable replication agreements
---
.gitignore | 1
Makefile.am | 305
Makefile.in | 5408 -
README | 11
VERSION.sh | 7
aclocal.m4 | 6996 -
compile | 21
config.guess | 302
config.h.in | 28
config.sub | 232
configure |42772 +++++-------
configure.ac | 213
depcomp | 172
dirsrv.pc.in | 7
dirsrvtests/tickets/ticket47787_test.py | 630
include/base/dbtbase.h | 2
include/base/file.h | 3
include/base/lexer.h | 126
include/base/rwlock.h | 91
include/i18n.h | 115
include/ldaputil/ldaputil.h | 10
include/libaccess/aclerror.h | 1
include/libaccess/aclproto.h | 15
include/libaccess/aclstruct.h | 2
include/libaccess/dbtlibaccess.h | 3
include/public/nsacl/aclapi.h | 7
install-sh | 517
ldap/admin/src/base-initconfig.in | 44
ldap/admin/src/initconfig.in | 37
ldap/admin/src/logconv.pl | 3296
ldap/admin/src/scripts/10cleanupldapi.pl | 23
ldap/admin/src/scripts/10fixrundir.pl | 11
ldap/admin/src/scripts/50acctusabilityplugin.ldif | 21
ldap/admin/src/scripts/50automemberplugin.ldif | 15
ldap/admin/src/scripts/50fixNsState.pl | 240
ldap/admin/src/scripts/50managedentriesplugin.ldif | 16
ldap/admin/src/scripts/50refintprecedence.ldif | 4
ldap/admin/src/scripts/50rootdnaccesscontrolplugin.ldif | 16
ldap/admin/src/scripts/50smd5pwdstorageplugin.ldif | 5
ldap/admin/src/scripts/60upgradeschemafiles.pl | 2
ldap/admin/src/scripts/70upgradefromldif.pl | 108
ldap/admin/src/scripts/80upgradednformat.pl | 206
ldap/admin/src/scripts/81changelog.pl | 34
ldap/admin/src/scripts/90subtreerename.pl | 21
ldap/admin/src/scripts/91subtreereindex.pl | 148
ldap/admin/src/scripts/DSCreate.pm.in | 357
ldap/admin/src/scripts/DSDialogs.pm | 6
ldap/admin/src/scripts/DSMigration.pm.in | 47
ldap/admin/src/scripts/DSUpdate.pm.in | 50
ldap/admin/src/scripts/DSUtil.pm.in | 343
ldap/admin/src/scripts/DialogManager.pm | 241
ldap/admin/src/scripts/DialogManager.pm.in | 241
ldap/admin/src/scripts/Inf.pm | 67
ldap/admin/src/scripts/Migration.pm.in | 20
ldap/admin/src/scripts/Setup.pm.in | 20
ldap/admin/src/scripts/SetupDialogs.pm.in | 31
ldap/admin/src/scripts/SetupLog.pm | 8
ldap/admin/src/scripts/dnaplugindepends.ldif | 3
ldap/admin/src/scripts/ds-logpipe.py | 221
ldap/admin/src/scripts/exampleupdate.ldif | 2
ldap/admin/src/scripts/exampleupdate.sh | 10
ldap/admin/src/scripts/logregex.py | 16
ldap/admin/src/scripts/migrate-ds.pl.in | 13
ldap/admin/src/scripts/remove-ds.pl.in | 30
ldap/admin/src/scripts/repl-monitor.pl.in | 642
ldap/admin/src/scripts/restart-dirsrv.in | 25
ldap/admin/src/scripts/setup-ds.pl.in | 7
ldap/admin/src/scripts/setup-ds.res.in | 35
ldap/admin/src/scripts/start-dirsrv.in | 43
ldap/admin/src/scripts/stop-dirsrv.in | 27
ldap/admin/src/scripts/template-bak2db.in | 49
ldap/admin/src/scripts/template-bak2db.pl.in | 29
ldap/admin/src/scripts/template-cleanallruv.pl.in | 186
ldap/admin/src/scripts/template-db2bak.in | 53
ldap/admin/src/scripts/template-db2bak.pl.in | 29
ldap/admin/src/scripts/template-db2index.in | 14
ldap/admin/src/scripts/template-db2index.pl.in | 33
ldap/admin/src/scripts/template-db2ldif.in | 15
ldap/admin/src/scripts/template-db2ldif.pl.in | 29
ldap/admin/src/scripts/template-dbverify.in | 15
ldap/admin/src/scripts/template-dn2rdn.in | 25
ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in | 29
ldap/admin/src/scripts/template-fixup-memberof.pl.in | 29
ldap/admin/src/scripts/template-ldif2db.in | 15
ldap/admin/src/scripts/template-ldif2db.pl.in | 29
ldap/admin/src/scripts/template-ldif2ldap.in | 19
ldap/admin/src/scripts/template-monitor.in | 19
ldap/admin/src/scripts/template-ns-accountstatus.pl.in | 33
ldap/admin/src/scripts/template-ns-activate.pl.in | 33
ldap/admin/src/scripts/template-ns-inactivate.pl.in | 33
ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in | 47
ldap/admin/src/scripts/template-restart-slapd.in | 2
ldap/admin/src/scripts/template-restoreconfig.in | 15
ldap/admin/src/scripts/template-saveconfig.in | 15
ldap/admin/src/scripts/template-schema-reload.pl.in | 29
ldap/admin/src/scripts/template-start-slapd.in | 3
ldap/admin/src/scripts/template-stop-slapd.in | 2
ldap/admin/src/scripts/template-suffix2instance.in | 15
ldap/admin/src/scripts/template-syntax-validate.pl.in | 29
ldap/admin/src/scripts/template-upgradedb.in | 15
ldap/admin/src/scripts/template-upgradednformat.in | 63
ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in | 29
ldap/admin/src/scripts/template-verify-db.pl.in | 19
ldap/admin/src/scripts/template-vlvindex.in | 15
ldap/admin/src/slapd.inf.in | 2
ldap/admin/src/template-initconfig.in | 18
ldap/docs/LICENSE.txt | 132
ldap/docs/README.txt | 11
ldap/include/ldaplog.h | 32
ldap/ldif/50posix-winsync-plugin.ldif | 21
ldap/ldif/50replication-plugins.ldif | 26
ldap/ldif/template-baseacis.ldif.in | 2
ldap/ldif/template-bitwise.ldif.in | 6
ldap/ldif/template-dnaplugin.ldif.in | 2
ldap/ldif/template-dse.ldif.in | 107
ldap/ldif/template-suffix-db.ldif.in | 1
ldap/libraries/libavl/avl.c | 7
ldap/schema/00core.ldif | 72
ldap/schema/01core389.ldif | 73
ldap/schema/02common.ldif | 17
ldap/schema/05rfc4523.ldif | 14
ldap/schema/05rfc4524.ldif | 30
ldap/schema/06inetorgperson.ldif | 5
ldap/schema/10automember-plugin.ldif | 123
ldap/schema/10dna-plugin.ldif | 204
ldap/schema/10mep-plugin.ldif | 104
ldap/schema/30ns-common.ldif | 4
ldap/schema/50ns-directory.ldif | 4
ldap/schema/50ns-mail.ldif | 10
ldap/schema/60acctpolicy.ldif | 47
ldap/schema/60nis.ldif | 2
ldap/schema/60pam-plugin.ldif | 3
ldap/schema/60posix-winsync-plugin.ldif | 44
ldap/schema/60qmail.ldif | 24
ldap/schema/60radius.ldif | 132
ldap/schema/60sabayon.ldif | 10
ldap/schema/60samba3.ldif | 36
ldap/schema/60sendmail.ldif | 54
ldap/schema/60sudo.ldif | 58
ldap/servers/plugins/acct_usability/acct_usability.c | 464
ldap/servers/plugins/acct_usability/acct_usability.h | 63
ldap/servers/plugins/acctpolicy/acct_config.c | 154
ldap/servers/plugins/acctpolicy/acct_init.c | 191
ldap/servers/plugins/acctpolicy/acct_plugin.c | 321
ldap/servers/plugins/acctpolicy/acct_util.c | 274
ldap/servers/plugins/acctpolicy/acctpolicy.h | 82
ldap/servers/plugins/acctpolicy/sampleconfig.ldif | 40
ldap/servers/plugins/acctpolicy/samplepolicy.ldif | 27
ldap/servers/plugins/acl/acl.c | 357
ldap/servers/plugins/acl/acl.h | 53
ldap/servers/plugins/acl/acl_ext.c | 160
ldap/servers/plugins/acl/aclanom.c | 24
ldap/servers/plugins/acl/acleffectiverights.c | 117
ldap/servers/plugins/acl/aclgroup.c | 21
ldap/servers/plugins/acl/aclinit.c | 2
ldap/servers/plugins/acl/acllas.c | 402
ldap/servers/plugins/acl/acllist.c | 130
ldap/servers/plugins/acl/aclparse.c | 663
ldap/servers/plugins/acl/aclplugin.c | 43
ldap/servers/plugins/acl/aclproxy.c | 232
ldap/servers/plugins/acl/aclutil.c | 128
ldap/servers/plugins/automember/automember.c | 2673
ldap/servers/plugins/automember/automember.h | 134
ldap/servers/plugins/bitwise/bitwise.c | 23
ldap/servers/plugins/chainingdb/cb.h | 8
ldap/servers/plugins/chainingdb/cb_add.c | 105
ldap/servers/plugins/chainingdb/cb_bind.c | 224
ldap/servers/plugins/chainingdb/cb_compare.c | 101
ldap/servers/plugins/chainingdb/cb_config.c | 221
ldap/servers/plugins/chainingdb/cb_conn_stateless.c | 104
ldap/servers/plugins/chainingdb/cb_controls.c | 52
ldap/servers/plugins/chainingdb/cb_delete.c | 125
ldap/servers/plugins/chainingdb/cb_init.c | 6
ldap/servers/plugins/chainingdb/cb_instance.c | 586
ldap/servers/plugins/chainingdb/cb_modify.c | 135
ldap/servers/plugins/chainingdb/cb_modrdn.c | 176
ldap/servers/plugins/chainingdb/cb_monitor.c | 6
ldap/servers/plugins/chainingdb/cb_schema.c | 4
ldap/servers/plugins/chainingdb/cb_search.c | 223
ldap/servers/plugins/chainingdb/cb_utils.c | 15
ldap/servers/plugins/collation/collate.c | 40
ldap/servers/plugins/collation/orfilter.c | 19
ldap/servers/plugins/cos/cos.c | 52
ldap/servers/plugins/cos/cos_cache.c | 797
ldap/servers/plugins/deref/deref.c | 125
ldap/servers/plugins/dna/dna.c | 1849
ldap/servers/plugins/http/http_impl.c | 85
ldap/servers/plugins/linkedattrs/fixup_task.c | 119
ldap/servers/plugins/linkedattrs/linked_attrs.c | 261
ldap/servers/plugins/linkedattrs/linked_attrs.h | 7
ldap/servers/plugins/memberof/memberof.c | 1117
ldap/servers/plugins/memberof/memberof.h | 11
ldap/servers/plugins/memberof/memberof_config.c | 275
ldap/servers/plugins/mep/mep.c | 2856
ldap/servers/plugins/mep/mep.h | 130
ldap/servers/plugins/pam_passthru/pam_passthru.h | 48
ldap/servers/plugins/pam_passthru/pam_ptconfig.c | 721
ldap/servers/plugins/pam_passthru/pam_ptimpl.c | 81
ldap/servers/plugins/pam_passthru/pam_ptpreop.c | 587
ldap/servers/plugins/passthru/passthru.h | 4
ldap/servers/plugins/passthru/ptbind.c | 6
ldap/servers/plugins/passthru/ptconfig.c | 43
ldap/servers/plugins/passthru/ptconn.c | 8
ldap/servers/plugins/passthru/ptpreop.c | 17
ldap/servers/plugins/posix-winsync/README | 50
ldap/servers/plugins/posix-winsync/posix-group-func.c | 1018
ldap/servers/plugins/posix-winsync/posix-group-func.h | 24
ldap/servers/plugins/posix-winsync/posix-group-task.c | 494
ldap/servers/plugins/posix-winsync/posix-winsync-config.c | 303
ldap/servers/plugins/posix-winsync/posix-winsync.c | 1805
ldap/servers/plugins/posix-winsync/posix-wsp-ident.h | 53
ldap/servers/plugins/pwdstorage/smd5_pwd.c | 9
ldap/servers/plugins/referint/referint.c | 780
ldap/servers/plugins/replication/cl4_api.c | 2
ldap/servers/plugins/replication/cl5.h | 3
ldap/servers/plugins/replication/cl5_api.c | 2759
ldap/servers/plugins/replication/cl5_api.h | 122
ldap/servers/plugins/replication/cl5_clcache.c | 177
ldap/servers/plugins/replication/cl5_clcache.h | 2
ldap/servers/plugins/replication/cl5_config.c | 249
ldap/servers/plugins/replication/cl5_init.c | 2
ldap/servers/plugins/replication/cl5_test.c | 2
ldap/servers/plugins/replication/cl_crypt.c | 203
ldap/servers/plugins/replication/cl_crypt.h | 53
ldap/servers/plugins/replication/csnpl.c | 74
ldap/servers/plugins/replication/legacy_consumer.c | 43
ldap/servers/plugins/replication/llist.c | 8
ldap/servers/plugins/replication/repl-session-plugin.h | 119
ldap/servers/plugins/replication/repl.h | 16
ldap/servers/plugins/replication/repl5.h | 154
ldap/servers/plugins/replication/repl5_agmt.c | 564
ldap/servers/plugins/replication/repl5_agmtlist.c | 135
ldap/servers/plugins/replication/repl5_connection.c | 200
ldap/servers/plugins/replication/repl5_inc_protocol.c | 1380
ldap/servers/plugins/replication/repl5_init.c | 203
ldap/servers/plugins/replication/repl5_mtnode_ext.c | 19
ldap/servers/plugins/replication/repl5_plugins.c | 238
ldap/servers/plugins/replication/repl5_prot_private.h | 4
ldap/servers/plugins/replication/repl5_protocol.c | 107
ldap/servers/plugins/replication/repl5_protocol_util.c | 570
ldap/servers/plugins/replication/repl5_replica.c | 1121
ldap/servers/plugins/replication/repl5_replica_config.c | 2708
ldap/servers/plugins/replication/repl5_replica_dnhash.c | 26
ldap/servers/plugins/replication/repl5_replica_hash.c | 30
ldap/servers/plugins/replication/repl5_ruv.c | 642
ldap/servers/plugins/replication/repl5_ruv.h | 24
ldap/servers/plugins/replication/repl5_tot_protocol.c | 40
ldap/servers/plugins/replication/repl5_total.c | 26
ldap/servers/plugins/replication/repl5_updatedn_list.c | 2
ldap/servers/plugins/replication/repl_bind.c | 7
ldap/servers/plugins/replication/repl_compare.c | 18
ldap/servers/plugins/replication/repl_connext.c | 158
ldap/servers/plugins/replication/repl_controls.c | 2
ldap/servers/plugins/replication/repl_extop.c | 926
ldap/servers/plugins/replication/repl_globals.c | 10
ldap/servers/plugins/replication/repl_init.c | 1
ldap/servers/plugins/replication/repl_objset.c | 9
ldap/servers/plugins/replication/repl_session_plugin.c | 188
ldap/servers/plugins/replication/repl_shared.h | 17
ldap/servers/plugins/replication/replutil.c | 155
ldap/servers/plugins/replication/test_repl_session_plugin.c | 335
ldap/servers/plugins/replication/urp.c | 278
ldap/servers/plugins/replication/urp.h | 8
ldap/servers/plugins/replication/urp_glue.c | 51
ldap/servers/plugins/replication/urp_tombstone.c | 64
ldap/servers/plugins/replication/windows_connection.c | 167
ldap/servers/plugins/replication/windows_inc_protocol.c | 99
ldap/servers/plugins/replication/windows_private.c | 1628
ldap/servers/plugins/replication/windows_protocol_util.c | 1651
ldap/servers/plugins/replication/windows_tot_protocol.c | 132
ldap/servers/plugins/replication/windowsrepl.h | 60
ldap/servers/plugins/replication/winsync-plugin.h | 495
ldap/servers/plugins/retrocl/retrocl.c | 51
ldap/servers/plugins/retrocl/retrocl.h | 2
ldap/servers/plugins/retrocl/retrocl_create.c | 13
ldap/servers/plugins/retrocl/retrocl_po.c | 20
ldap/servers/plugins/retrocl/retrocl_trim.c | 20
ldap/servers/plugins/rever/des.c | 72
ldap/servers/plugins/rever/rever.c | 8
ldap/servers/plugins/roles/roles_cache.c | 131
ldap/servers/plugins/roles/roles_plugin.c | 52
ldap/servers/plugins/rootdn_access/rootdn_access.c | 702
ldap/servers/plugins/rootdn_access/rootdn_access.h | 59
ldap/servers/plugins/schema_reload/schema_reload.c | 63
ldap/servers/plugins/shared/plugin-utils.h | 112
ldap/servers/plugins/shared/utils.c | 508
ldap/servers/plugins/statechange/statechange.c | 55
ldap/servers/plugins/syntaxes/bin.c | 142
ldap/servers/plugins/syntaxes/bitstring.c | 68
ldap/servers/plugins/syntaxes/ces.c | 172
ldap/servers/plugins/syntaxes/cis.c | 321
ldap/servers/plugins/syntaxes/deliverymethod.c | 32
ldap/servers/plugins/syntaxes/dn.c | 72
ldap/servers/plugins/syntaxes/facsimile.c | 32
ldap/servers/plugins/syntaxes/guide.c | 32
ldap/servers/plugins/syntaxes/int.c | 96
ldap/servers/plugins/syntaxes/nameoptuid.c | 73
ldap/servers/plugins/syntaxes/numericstring.c | 148
ldap/servers/plugins/syntaxes/sicis.c | 32
ldap/servers/plugins/syntaxes/string.c | 455
ldap/servers/plugins/syntaxes/syntax.h | 61
ldap/servers/plugins/syntaxes/syntax_common.c | 118
ldap/servers/plugins/syntaxes/tel.c | 94
ldap/servers/plugins/syntaxes/teletex.c | 32
ldap/servers/plugins/syntaxes/telex.c | 31
ldap/servers/plugins/syntaxes/validate.c | 17
ldap/servers/plugins/syntaxes/value.c | 134
ldap/servers/plugins/uiduniq/7bit.c | 82
ldap/servers/plugins/uiduniq/plugin-utils.h | 96
ldap/servers/plugins/uiduniq/uid.c | 370
ldap/servers/plugins/uiduniq/utils.c | 249
ldap/servers/plugins/usn/usn.c | 352
ldap/servers/plugins/usn/usn.h | 3
ldap/servers/plugins/usn/usn_cleanup.c | 44
ldap/servers/plugins/views/views.c | 36
ldap/servers/slapd/abandon.c | 6
ldap/servers/slapd/add.c | 322
ldap/servers/slapd/agtmmap.c | 114
ldap/servers/slapd/apibroker.c | 58
ldap/servers/slapd/attr.c | 273
ldap/servers/slapd/attrlist.c | 33
ldap/servers/slapd/attrsyntax.c | 546
ldap/servers/slapd/auditlog.c | 87
ldap/servers/slapd/auth.c | 95
ldap/servers/slapd/ava.c | 2
ldap/servers/slapd/back-ldbm/ancestorid.c | 132
ldap/servers/slapd/back-ldbm/archive.c | 91
ldap/servers/slapd/back-ldbm/back-ldbm.h | 129
ldap/servers/slapd/back-ldbm/backentry.c | 7
ldap/servers/slapd/back-ldbm/cache.c | 237
ldap/servers/slapd/back-ldbm/dbhelp.c | 77
ldap/servers/slapd/back-ldbm/dblayer.c | 2429
ldap/servers/slapd/back-ldbm/dblayer.h | 17
ldap/servers/slapd/back-ldbm/dbtest.c | 349
ldap/servers/slapd/back-ldbm/dbverify.c | 6
ldap/servers/slapd/back-ldbm/dbversion.c | 52
ldap/servers/slapd/back-ldbm/dn2entry.c | 63
ldap/servers/slapd/back-ldbm/filterindex.c | 312
ldap/servers/slapd/back-ldbm/findentry.c | 147
ldap/servers/slapd/back-ldbm/id2entry.c | 191
ldap/servers/slapd/back-ldbm/idl.c | 136
ldap/servers/slapd/back-ldbm/idl_common.c | 42
ldap/servers/slapd/back-ldbm/idl_new.c | 130
ldap/servers/slapd/back-ldbm/idl_shim.c | 17
ldap/servers/slapd/back-ldbm/import-merge.c | 34
ldap/servers/slapd/back-ldbm/import-threads.c | 1390
ldap/servers/slapd/back-ldbm/import.c | 403
ldap/servers/slapd/back-ldbm/import.h | 32
ldap/servers/slapd/back-ldbm/index.c | 531
ldap/servers/slapd/back-ldbm/init.c | 89
ldap/servers/slapd/back-ldbm/instance.c | 174
ldap/servers/slapd/back-ldbm/ldbm_add.c | 721
ldap/servers/slapd/back-ldbm/ldbm_attr.c | 892
ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c | 988
ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c | 4
ldap/servers/slapd/back-ldbm/ldbm_bind.c | 9
ldap/servers/slapd/back-ldbm/ldbm_compare.c | 9
ldap/servers/slapd/back-ldbm/ldbm_config.c | 402
ldap/servers/slapd/back-ldbm/ldbm_config.h | 13
ldap/servers/slapd/back-ldbm/ldbm_delete.c | 920
ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c | 1711
ldap/servers/slapd/back-ldbm/ldbm_index_config.c | 691
ldap/servers/slapd/back-ldbm/ldbm_instance_config.c | 272
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 609
ldap/servers/slapd/back-ldbm/ldbm_modrdn.c | 947
ldap/servers/slapd/back-ldbm/ldbm_search.c | 830
ldap/servers/slapd/back-ldbm/ldbm_usn.c | 80
ldap/servers/slapd/back-ldbm/ldif2ldbm.c | 833
ldap/servers/slapd/back-ldbm/matchrule.c | 50
ldap/servers/slapd/back-ldbm/misc.c | 301
ldap/servers/slapd/back-ldbm/monitor.c | 32
ldap/servers/slapd/back-ldbm/nextid.c | 17
ldap/servers/slapd/back-ldbm/parents.c | 146
ldap/servers/slapd/back-ldbm/perfctrs.c | 26
ldap/servers/slapd/back-ldbm/proto-back-ldbm.h | 73
ldap/servers/slapd/back-ldbm/seq.c | 8
ldap/servers/slapd/back-ldbm/sort.c | 196
ldap/servers/slapd/back-ldbm/start.c | 109
ldap/servers/slapd/back-ldbm/upgrade.c | 59
ldap/servers/slapd/back-ldbm/vlv.c | 396
ldap/servers/slapd/back-ldbm/vlv_srch.c | 17
ldap/servers/slapd/back-ldbm/vlv_srch.h | 3
ldap/servers/slapd/back-ldif/back-ldif.h | 2
ldap/servers/slapd/back-ldif/modify.c | 2
ldap/servers/slapd/back-ldif/modrdn.c | 12
ldap/servers/slapd/backend.c | 83
ldap/servers/slapd/backend_manager.c | 18
ldap/servers/slapd/bind.c | 456
ldap/servers/slapd/bulk_import.c | 39
ldap/servers/slapd/charray.c | 32
ldap/servers/slapd/compare.c | 43
ldap/servers/slapd/computed.c | 184
ldap/servers/slapd/config.c | 51
ldap/servers/slapd/configdse.c | 72
ldap/servers/slapd/connection.c | 349
ldap/servers/slapd/conntable.c | 7
ldap/servers/slapd/control.c | 58
ldap/servers/slapd/csn.c | 89
ldap/servers/slapd/csngen.c | 62
ldap/servers/slapd/csnset.c | 4
ldap/servers/slapd/daemon.c | 923
ldap/servers/slapd/delete.c | 128
ldap/servers/slapd/dn.c | 1632
ldap/servers/slapd/dse.c | 848
ldap/servers/slapd/dynalib.c | 29
ldap/servers/slapd/entry.c | 1367
ldap/servers/slapd/entrywsi.c | 314
ldap/servers/slapd/errormap.c | 10
ldap/servers/slapd/eventq.c | 4
ldap/servers/slapd/extendop.c | 35
ldap/servers/slapd/factory.c | 1
ldap/servers/slapd/fe.h | 5
ldap/servers/slapd/fedse.c | 40
ldap/servers/slapd/filter.c | 141
ldap/servers/slapd/filter.h | 1
ldap/servers/slapd/filtercmp.c | 26
ldap/servers/slapd/filterentry.c | 50
ldap/servers/slapd/generation.c | 1
ldap/servers/slapd/index_subsystem.c | 28
ldap/servers/slapd/intrinsics.h | 7
ldap/servers/slapd/ldaputil.c | 893
ldap/servers/slapd/lenstr.c | 6
ldap/servers/slapd/libglobs.c | 2259
ldap/servers/slapd/libslapd.def | 1
ldap/servers/slapd/log.c | 374
ldap/servers/slapd/log.h | 20
ldap/servers/slapd/main.c | 320
ldap/servers/slapd/mapping_tree.c | 515
ldap/servers/slapd/match.c | 96
ldap/servers/slapd/modify.c | 710
ldap/servers/slapd/modrdn.c | 379
ldap/servers/slapd/modutil.c | 77
ldap/servers/slapd/operation.c | 48
ldap/servers/slapd/opshared.c | 475
ldap/servers/slapd/pagedresults.c | 787
ldap/servers/slapd/passwd_extop.c | 207
ldap/servers/slapd/pblock.c | 677
ldap/servers/slapd/plugin.c | 376
ldap/servers/slapd/plugin_acl.c | 50
ldap/servers/slapd/plugin_internal_op.c | 204
ldap/servers/slapd/plugin_mr.c | 474
ldap/servers/slapd/plugin_syntax.c | 441
ldap/servers/slapd/protect_db.c | 24
ldap/servers/slapd/protect_db.h | 7
ldap/servers/slapd/proto-slap.h | 176
ldap/servers/slapd/proxyauth.c | 246
ldap/servers/slapd/psearch.c | 76
ldap/servers/slapd/pw.c | 678
ldap/servers/slapd/pw.h | 8
ldap/servers/slapd/pw_mgmt.c | 165
ldap/servers/slapd/pw_retry.c | 121
ldap/servers/slapd/rdn.c | 269
ldap/servers/slapd/referral.c | 29
ldap/servers/slapd/regex.c | 35
ldap/servers/slapd/resourcelimit.c | 84
ldap/servers/slapd/result.c | 104
ldap/servers/slapd/rootdse.c | 12
ldap/servers/slapd/rwlock.c | 257
ldap/servers/slapd/rwlock.h | 65
ldap/servers/slapd/sasl_io.c | 167
ldap/servers/slapd/sasl_map.c | 63
ldap/servers/slapd/saslbind.c | 209
ldap/servers/slapd/schema.c | 376
ldap/servers/slapd/schemaparse.c | 13
ldap/servers/slapd/search.c | 179
ldap/servers/slapd/security_wrappers.c | 36
ldap/servers/slapd/slap.h | 301
ldap/servers/slapd/slapi-plugin-compat4.h | 6
ldap/servers/slapd/slapi-plugin.h | 1614
ldap/servers/slapd/slapi-private.h | 130
ldap/servers/slapd/slapi2nspr.c | 79
ldap/servers/slapd/slapi_counter.c | 24
ldap/servers/slapd/snmp_collator.c | 23
ldap/servers/slapd/sort.c | 11
ldap/servers/slapd/ssl.c | 414
ldap/servers/slapd/start_tls_extop.c | 230
ldap/servers/slapd/str2filter.c | 5
ldap/servers/slapd/task.c | 186
ldap/servers/slapd/test-plugins/testbind.c | 1
ldap/servers/slapd/test-plugins/testpostop.c | 3
ldap/servers/slapd/thread_data.c | 174
ldap/servers/slapd/time.c | 91
ldap/servers/slapd/tools/dbscan.c | 91
ldap/servers/slapd/tools/ldclt/data.c | 83
ldap/servers/slapd/tools/ldclt/ldapfct.c | 1144
ldap/servers/slapd/tools/ldclt/ldclt.c | 60
ldap/servers/slapd/tools/ldclt/ldclt.h | 3
ldap/servers/slapd/tools/ldclt/ldcltU.c | 24
ldap/servers/slapd/tools/ldclt/parser.c | 19
ldap/servers/slapd/tools/ldclt/scalab01.c | 190
ldap/servers/slapd/tools/ldclt/threadMain.c | 6
ldap/servers/slapd/tools/ldif.c | 4
ldap/servers/slapd/tools/migratecred.c | 2
ldap/servers/slapd/tools/mmldif.c | 19
ldap/servers/slapd/tools/pwenc.c | 6
ldap/servers/slapd/tools/rsearch/addthread.c | 51
ldap/servers/slapd/tools/rsearch/infadd.c | 7
ldap/servers/slapd/tools/rsearch/nametable.c | 4
ldap/servers/slapd/tools/rsearch/rsearch.c | 11
ldap/servers/slapd/tools/rsearch/sdattable.c | 64
ldap/servers/slapd/tools/rsearch/searchthread.c | 130
ldap/servers/slapd/uniqueid.c | 99
ldap/servers/slapd/utf8compare.c | 30
ldap/servers/slapd/util.c | 433
ldap/servers/slapd/uuid.c | 22
ldap/servers/slapd/value.c | 62
ldap/servers/slapd/valueset.c | 1173
ldap/servers/slapd/vattr.c | 115
ldap/servers/snmp/NETWORK-SERVICES-MIB.txt | 650
ldap/servers/snmp/RFC-1215.txt | 38
ldap/servers/snmp/RFC1155-SMI.txt | 119
ldap/servers/snmp/SNMPv2-CONF.txt | 322
ldap/servers/snmp/SNMPv2-SMI.txt | 344
ldap/servers/snmp/SNMPv2-TC.txt | 772
ldap/servers/snmp/ldap-agent.c | 26
ldap/servers/snmp/main.c | 32
ldap/servers/snmp/netscape-ldap.mib | 759
ldap/systools/idsktune.c | 100
lib/base/crit.cpp | 6
lib/base/ereport.cpp | 2
lib/base/file.cpp | 24
lib/base/lexer.cpp | 1015
lib/base/plist.cpp | 3
lib/base/pool.cpp | 10
lib/base/rwlock.cpp | 168
lib/base/util.cpp | 15
lib/ldaputil/cert.c | 4
lib/ldaputil/certmap.c | 572
lib/ldaputil/dbconf.c | 14
lib/ldaputil/utest/Makefile | 149
lib/ldaputil/utest/auth.cpp | 611
lib/ldaputil/utest/authtest | 138
lib/ldaputil/utest/certmap.conf | 68
lib/ldaputil/utest/dblist.conf | 47
lib/ldaputil/utest/example.c | 153
lib/ldaputil/utest/plugin.c | 152
lib/ldaputil/utest/plugin.h | 57
lib/ldaputil/utest/stubs.c | 144
lib/ldaputil/utest/stubs.cpp | 139
lib/ldaputil/utest/test.ref | 480
lib/ldaputil/vtable.c | 2
lib/libaccess/acl.tab.cpp | 25
lib/libaccess/aclcache.cpp | 105
lib/libaccess/aclflush.cpp | 1
lib/libaccess/aclpriv.h | 1
lib/libaccess/acltext.y | 4
lib/libaccess/acltools.cpp | 1899
lib/libaccess/aclutil.cpp | 13
lib/libaccess/authdb.cpp | 112
lib/libaccess/lasdns.cpp | 23
lib/libaccess/lasgroup.cpp | 10
lib/libaccess/lasip.cpp | 20
lib/libaccess/nseframe.cpp | 1
lib/libaccess/oneeval.cpp | 31
lib/libaccess/permhash.h | 11
lib/libaccess/register.cpp | 57
lib/libaccess/usrcache.cpp | 14
lib/libaccess/utest/.purify | 19
lib/libaccess/utest/Makefile | 147
lib/libaccess/utest/acl.dat | 44
lib/libaccess/utest/aclfile0 | 87
lib/libaccess/utest/aclfile1 | 43
lib/libaccess/utest/aclfile10 | 45
lib/libaccess/utest/aclfile11 | 43
lib/libaccess/utest/aclfile12 | 43
lib/libaccess/utest/aclfile13 | 43
lib/libaccess/utest/aclfile14 | 43
lib/libaccess/utest/aclfile15 | 43
lib/libaccess/utest/aclfile16 | 43
lib/libaccess/utest/aclfile17 | 43
lib/libaccess/utest/aclfile18 | 51
lib/libaccess/utest/aclfile19 | 46
lib/libaccess/utest/aclfile2 | 43
lib/libaccess/utest/aclfile3 | 43
lib/libaccess/utest/aclfile4 | 43
lib/libaccess/utest/aclfile5 | 43
lib/libaccess/utest/aclfile6 | 55
lib/libaccess/utest/aclfile7 | 43
lib/libaccess/utest/aclfile8 | 43
lib/libaccess/utest/aclfile9 | 43
lib/libaccess/utest/aclgrp0 | 42
lib/libaccess/utest/aclgrp1 | 42
lib/libaccess/utest/aclgrp2 | 42
lib/libaccess/utest/aclgrp3 | 42
lib/libaccess/utest/aclgrp4 | 42
lib/libaccess/utest/acltest.cpp | 794
lib/libaccess/utest/onetest.cpp | 77
lib/libaccess/utest/shexp.cpp | 331
lib/libaccess/utest/shexp.h | 168
lib/libaccess/utest/test.ref | 217
lib/libaccess/utest/testmain.cpp | 89
lib/libaccess/utest/twotest.cpp | 87
lib/libaccess/utest/ustubs.cpp | 331
lib/libadmin/error.c | 9
lib/libadmin/template.c | 2
lib/libadmin/util.c | 48
lib/libsi18n/coreres.c | 141
lib/libsi18n/coreres.h | 52
lib/libsi18n/getlang.c | 330
lib/libsi18n/getstrmem.c | 160
lib/libsi18n/getstrmem.h | 1
lib/libsi18n/getstrprop.c | 85
lib/libsi18n/makstrdb.c | 21
lib/libsi18n/propset.c | 442
lib/libsi18n/propset.h | 80
lib/libsi18n/reshash.c | 21
ltmain.sh |13199 ++-
m4/db.m4 | 27
m4/fhs.m4 | 4
m4/icu.m4 | 25
m4/kerberos.m4 | 4
m4/mozldap.m4 | 38
m4/netsnmp.m4 | 15
m4/nspr.m4 | 17
m4/nss.m4 | 17
m4/openldap.m4 | 30
m4/pcre.m4 | 28
m4/sasl.m4 | 25
m4/selinux.m4 | 13
m4/svrcore.m4 | 41
man/man1/cl-dump.1 | 18
man/man1/dbgen.pl.1 | 4
man/man1/infadd.1 | 8
man/man1/logconv.pl.1 | 44
man/man1/migratecred.1 | 6
man/man1/mmldif.1 | 4
man/man1/pwdhash.1 | 4
man/man1/repl-monitor.1 | 41
man/man8/ns-slapd.8 | 10
man/man8/remove-ds.pl.8 | 6
man/man8/restart-dirsrv.8 | 50
man/man8/setup-ds.pl.8 | 4
man/man8/start-dirsrv.8 | 50
man/man8/stop-dirsrv.8 | 50
missing | 104
selinux/dirsrv.fc.in | 2
selinux/dirsrv.if | 41
selinux/dirsrv.te | 11
wrappers/cl-dump.in | 11
wrappers/dbscan.in | 10
wrappers/infadd.in | 12
wrappers/initscript.in | 245
wrappers/ldap-agent-initscript.in | 20
wrappers/ldap-agent.in | 12
wrappers/ldclt.in | 12
wrappers/ldif.in | 12
wrappers/migratecred.in | 14
wrappers/mmldif.in | 14
wrappers/pwdhash.in | 14
wrappers/repl-monitor.in | 11
wrappers/rsearch.in | 12
wrappers/systemd-snmp.service.in | 16
wrappers/systemd.group.in | 6
wrappers/systemd.template.service.in | 28
wrappers/systemd.template.sysconfig | 3
655 files changed, 112267 insertions(+), 77235 deletions(-)
---
1
0
17 Oct '14
dirsrvtests/tickets/ticket47553_ger.py | 553 ++++++++++++++++++++++++++
ldap/servers/plugins/acl/acleffectiverights.c | 67 +--
2 files changed, 590 insertions(+), 30 deletions(-)
New commits:
commit 96d74598074aab2a924c4bcecef21e5aa1f045d4
Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com>
Date: Thu Oct 16 17:24:15 2014 +0200
Ticket 47553: Enhance ACIs to have more control over MODRDN operations
Bug Description:
The ticket 47553 introduces a new aci right: moddn.
This rights allows/deny to do a MODDN from a part of the DIT to an other.
Before the right allow/deny to do a MODDN was granted if the subject had 'write' access to the rdn attribute.
To switch from the previous mode to the new one, there is a toggle 'nsslapd-moddn-aci'.
The getEffectiveRight control, should report the MODDN right ('n') according to
the acis and the value of this toggle
Fix Description:
test 'nsslapd-moddn-aci' in the geteffectiveright code
https://fedorahosted.org/389/ticket/47553
Reviewed by: Noriko (Thanks !)
Platforms tested: F17
Flag Day: no
Doc impact: no
diff --git a/dirsrvtests/tickets/ticket47553_ger.py b/dirsrvtests/tickets/ticket47553_ger.py
new file mode 100644
index 0000000..d688c70
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47553_ger.py
@@ -0,0 +1,553 @@
+'''
+Created on Nov 7, 2013
+
+@author: tbordaz
+'''
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import time
+import logging
+import pytest
+import re
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+from lib389._constants import REPLICAROLE_MASTER
+from ldap.controls.simple import GetEffectiveRightsControl
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
+installation1_prefix = None
+installation2_prefix = None
+
+TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
+
+STAGING_CN = "staged user"
+PRODUCTION_CN = "accounts"
+EXCEPT_CN = "excepts"
+
+STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
+PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
+PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
+
+STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
+PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
+BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
+BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
+
+BIND_CN = "bind_entry"
+BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
+BIND_PW = "password"
+
+NEW_ACCOUNT = "new_account"
+MAX_ACCOUNTS = 20
+
+CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ At the beginning, It may exists a master2 instance and/or a master2 instance.
+ It may also exists a backup for the master1 and/or the master2.
+
+ Principle:
+ If master1 instance exists:
+ restart it
+ If master2 instance exists:
+ restart it
+ If backup of master1 AND backup of master2 exists:
+ create or rebind to master1
+ create or rebind to master2
+
+ restore master1 from backup
+ restore master2 from backup
+ else:
+ Cleanup everything
+ remove instances
+ remove backups
+ Create instances
+ Initialize replication
+ Create backups
+ '''
+ global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+
+ # Get the status of the backups
+ backup_master1 = master1.checkBackupFS()
+ backup_master2 = master2.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.stop(timeout=10)
+ master1.start(timeout=10)
+
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.stop(timeout=10)
+ master2.start(timeout=10)
+
+ if backup_master1 and backup_master2:
+ # The backups exist, assuming they are correct
+ # we just re-init the instances with them
+ if not instance_master1:
+ master1.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master1.open()
+
+ if not instance_master2:
+ master2.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master2.open()
+
+ # restore master1 from backup
+ master1.stop(timeout=10)
+ master1.restoreFS(backup_master1)
+ master1.start(timeout=10)
+
+ # restore master2 from backup
+ master2.stop(timeout=10)
+ master2.restoreFS(backup_master2)
+ master2.start(timeout=10)
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve master-consumer
+ # so we need to create everything
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove all the backups. So even if we have a specific backup file
+ # (e.g backup_master) we clear all backups that an instance my have created
+ if backup_master1:
+ master1.clearBackupFS()
+ if backup_master2:
+ master2.clearBackupFS()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+
+ if not repl_agreement:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % repl_agreement)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(repl_agreement)
+
+ # Check replication is working fine
+ master1.add_s(Entry((TEST_REPL_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': 'test_repl',
+ 'cn': 'test_repl'})))
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+
+ # Time to create the backups
+ master1.stop(timeout=10)
+ master1.backupfile = master1.backupFS()
+ master1.start(timeout=10)
+
+ master2.stop(timeout=10)
+ master2.backupfile = master2.backupFS()
+ master2.start(timeout=10)
+
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
+
+ #
+ # Here we have two instances master and consumer
+ # with replication working. Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyMaster1Master2(master1, master2)
+
+
+
+def _bind_manager(topology):
+ topology.master1.log.info("Bind as %s " % DN_DM)
+ topology.master1.simple_bind_s(DN_DM, PASSWORD)
+
+def _bind_normal(topology):
+ # bind as bind_entry
+ topology.master1.log.info("Bind as %s" % BIND_DN)
+ topology.master1.simple_bind_s(BIND_DN, BIND_PW)
+
+def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
+ '''
+ It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
+ '''
+ assert mod_type != None
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ #topology.master1.modify_s(SUFFIX, mod)
+ topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
+ topology.master1.modify_s(PROD_EXCEPT_DN, mod)
+
+def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
+ assert mod_type != None
+
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+def _moddn_aci_from_production_to_staging(topology, mod_type=None):
+ assert mod_type != None
+
+ ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+
+def test_ticket47553_init(topology):
+ """
+ Creates
+ - a staging DIT
+ - a production DIT
+ - add accounts in staging DIT
+ - enable ACL logging (commented for performance reason)
+
+ """
+
+ topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
+
+ # entry used to bind with
+ topology.master1.log.info("Add %s" % BIND_DN)
+ topology.master1.add_s(Entry((BIND_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': BIND_CN,
+ 'cn': BIND_CN,
+ 'userpassword': BIND_PW})))
+
+ # DIT for staging
+ topology.master1.log.info("Add %s" % STAGING_DN)
+ topology.master1.add_s(Entry((STAGING_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': STAGING_CN,
+ 'description': "staging DIT"})))
+
+ # DIT for production
+ topology.master1.log.info("Add %s" % PRODUCTION_DN)
+ topology.master1.add_s(Entry((PRODUCTION_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': PRODUCTION_CN,
+ 'description': "production DIT"})))
+
+ # DIT for production/except
+ topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
+ topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': EXCEPT_CN,
+ 'description': "production except DIT"})))
+
+ # enable acl error logging
+ #mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
+ #topology.master1.modify_s(DN_CONFIG, mod)
+ #topology.master2.modify_s(DN_CONFIG, mod)
+
+
+
+
+
+ # add dummy entries in the staging DIT
+ for cpt in range(MAX_ACCOUNTS):
+ name = "%s%d" % (NEW_ACCOUNT, cpt)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+
+
+def test_ticket47553_mode_default_add_deny(topology):
+ '''
+ This test case checks that the ADD operation fails (no ADD aci on production)
+ '''
+
+ topology.master1.log.info("\n\n######################### mode moddn_aci : ADD (should fail) ######################\n")
+
+ _bind_normal(topology)
+
+ #
+ # First try to add an entry in production => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
+ name = "%s%d" % (NEW_ACCOUNT, 0)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+ assert 0 # this is an error, we should not be allowed to add an entry in production
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+def test_ticket47553_mode_default_ger_no_moddn(topology):
+ topology.master1.log.info("\n\n######################### mode moddn_aci : GER no moddn ######################\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
+ rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
+ ger={}
+ value=''
+ for dn, attrs in rdata:
+ topology.master1.log.info ("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+def test_ticket47553_mode_default_ger_with_moddn(topology):
+ '''
+ This test case adds the moddn aci and check ger contains 'n'
+ '''
+
+ topology.master1.log.info("\n\n######################### mode moddn_aci: GER with moddn ######################\n")
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
+ rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
+ ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info ("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+def test_ticket47553_mode_switch_default_to_legacy(topology):
+ '''
+ This test switch the server from default mode to legacy
+ '''
+ topology.master1.log.info("\n\n######################### Disable the moddn aci mod ######################\n" )
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+def test_ticket47553_mode_legacy_ger_no_moddn1(topology):
+ topology.master1.log.info("\n\n######################### mode legacy 1: GER no moddn ######################\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
+ rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
+ ger={}
+ value=''
+ for dn, attrs in rdata:
+ topology.master1.log.info ("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+def test_ticket47553_mode_legacy_ger_no_moddn2(topology):
+ topology.master1.log.info("\n\n######################### mode legacy 2: GER no moddn ######################\n")
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
+ rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
+ ger={}
+ value=''
+ for dn, attrs in rdata:
+ topology.master1.log.info ("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+def test_ticket47553_mode_legacy_ger_with_moddn(topology):
+ topology.master1.log.info("\n\n######################### mode legacy : GER with moddn ######################\n")
+
+ # being allowed to read/write the RDN attribute use to allow the RDN
+ ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"cn\")" % (PRODUCTION_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN production changing the RDN attribute\"; allow (read,search,write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
+ rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
+ ger={}
+ value=''
+ for dn, attrs in rdata:
+ topology.master1.log.info ("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ _bind_normal(topology)
+
+
+def test_ticket47553_final(topology):
+ topology.master1.stop(timeout=10)
+ topology.master2.stop(timeout=10)
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation1_prefix
+ global installation2_prefix
+ installation1_prefix = None
+ installation2_prefix = None
+
+ topo = topology(True)
+ topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
+ test_ticket47553_init(topo)
+
+ # Check that without appropriate aci we are not allowed to add/delete
+ test_ticket47553_mode_default_add_deny(topo)
+ test_ticket47553_mode_default_ger_no_moddn(topo)
+ test_ticket47553_mode_default_ger_with_moddn(topo)
+ test_ticket47553_mode_switch_default_to_legacy(topo)
+ test_ticket47553_mode_legacy_ger_no_moddn1(topo)
+ test_ticket47553_mode_legacy_ger_no_moddn2(topo)
+ test_ticket47553_mode_legacy_ger_with_moddn(topo)
+
+ test_ticket47553_final(topo)
+
+
+
+
+if __name__ == '__main__':
+ run_isolated()
+
diff --git a/ldap/servers/plugins/acl/acleffectiverights.c b/ldap/servers/plugins/acl/acleffectiverights.c
index b9e2055..3c7d635 100644
--- a/ldap/servers/plugins/acl/acleffectiverights.c
+++ b/ldap/servers/plugins/acl/acleffectiverights.c
@@ -456,38 +456,45 @@ _ger_get_entry_rights (
entryrights |= SLAPI_ACL_DELETE;
_append_gerstr(gerstr, gerstrsize, gerstrcap, "d", NULL);
}
- /*
- * Some limitation/simplification applied here:
- * - The modrdn right requires the rights to delete the old rdn and
- * the new one. However we have no knowledge of what the new rdn
- * is going to be.
- * - In multi-valued RDN case, we check the right on
- * the first rdn type only for now.
- */
- rdn = slapi_rdn_new_dn ( slapi_entry_get_ndn (e) );
- slapi_rdn_get_first(rdn, &rdntype, &rdnvalue);
- if ( NULL != rdntype ) {
- slapi_log_error (SLAPI_LOG_ACL, plugin_name,
- "_ger_get_entry_rights: SLAPI_ACL_WRITE_DEL & _ADD %s\n", rdntype );
- if (acl_access_allowed(gerpb, e, rdntype, NULL,
- ACLPB_SLAPI_ACL_WRITE_DEL) == LDAP_SUCCESS &&
- acl_access_allowed(gerpb, e, rdntype, NULL,
- ACLPB_SLAPI_ACL_WRITE_ADD) == LDAP_SUCCESS)
- {
- /* n - rename e */
- entryrights |= SLAPI_ACL_WRITE;
- _append_gerstr(gerstr, gerstrsize, gerstrcap, "n", NULL);
- }
- }
- slapi_rdn_free ( &rdn );
-
- if (acl_access_allowed(gerpb, e, NULL, NULL, SLAPI_ACL_MODDN) == LDAP_SUCCESS) {
- slapi_log_error (SLAPI_LOG_ACL, plugin_name,
- "_ger_get_entry_rights: SLAPI_ACL_MODDN %s\n", slapi_entry_get_ndn (e) );
+
+ if (config_get_moddn_aci()) {
+ /* The server enforces the new MODDN aci right.
+ * So the status 'n' is set if this right is granted.
+ * Opposed to the legacy mode where this flag is set if
+ * WRITE was granted on rdn attrbibute
+ */
+ if (acl_access_allowed(gerpb, e, NULL, NULL, SLAPI_ACL_MODDN) == LDAP_SUCCESS) {
+ slapi_log_error(SLAPI_LOG_ACL, plugin_name,
+ "_ger_get_entry_rights: SLAPI_ACL_MODDN %s\n", slapi_entry_get_ndn(e));
+ /* n - rename e */
+ entryrights |= SLAPI_ACL_MODDN;
+ _append_gerstr(gerstr, gerstrsize, gerstrcap, "n", NULL);
+ }
+ } else {
+ /*
+ * Some limitation/simplification applied here:
+ * - The modrdn right requires the rights to delete the old rdn and
+ * the new one. However we have no knowledge of what the new rdn
+ * is going to be.
+ * - In multi-valued RDN case, we check the right on
+ * the first rdn type only for now.
+ */
+ rdn = slapi_rdn_new_dn(slapi_entry_get_ndn(e));
+ slapi_rdn_get_first(rdn, &rdntype, &rdnvalue);
+ if (NULL != rdntype) {
+ slapi_log_error(SLAPI_LOG_ACL, plugin_name,
+ "_ger_get_entry_rights: SLAPI_ACL_WRITE_DEL & _ADD %s\n", rdntype);
+ if (acl_access_allowed(gerpb, e, rdntype, NULL,
+ ACLPB_SLAPI_ACL_WRITE_DEL) == LDAP_SUCCESS &&
+ acl_access_allowed(gerpb, e, rdntype, NULL,
+ ACLPB_SLAPI_ACL_WRITE_ADD) == LDAP_SUCCESS) {
/* n - rename e */
- entryrights |= SLAPI_ACL_MODDN;
- _append_gerstr(gerstr, gerstrsize, gerstrcap, "n", NULL);
+ entryrights |= SLAPI_ACL_WRITE;
+ _append_gerstr(gerstr, gerstrsize, gerstrcap, "n", NULL);
+ }
}
+ slapi_rdn_free(&rdn);
+ }
if ( entryrights == 0 )
{
_append_gerstr(gerstr, gerstrsize, gerstrcap, "none", NULL);
1
0