389-commits May 2015

389-commits@lists.fedoraproject.org

4 participants
46 discussions

Changes to 'refs/tags/389-admin-1.1.41'
by Noriko Hosoi 27 May '15

27 May '15

Changes since 389-admin-1.1.11: Endi S. Dewata (3): Bug 573889 - Migration does not remove deprecated schema Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries Bug 470576 - Migration could do addition checks before commiting actions Ludwig (1): Ticket 47563 - cannot restart directory server from console Mark Reynolds (16): Ticket #286 - compilation fixes for 'format-security' Ticket 401 - Console login fails with anonymous access disabled Ticket 400 - BIND operation result not checked properly in admin server Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry Ticket 47495 - admin express: wrong instance creation time Ticket 47497 - Admin Express - remove "Security Level" Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time Ticket 47300 - Update man page for remove-ds-admin.pl Ticket 47891 - Admin Server reconfig breaks SSL config Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain Ticket 47548 - register-ds-admin does not register into remote config ds Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c Ticket 201 - nCipher HSM cannot be configured via the console Ticket 47929 - Admin Server - disable SSLv3 by default Ticket 47548 - register-ds-admin.pl fails to set local bind DN and password Nathan Kinder (49): Bug 648949 - Merge selinux policy into base OS Regenerated autoconf files Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled Bug 668950 - Add posix group support to Console Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH Bug 618897 - Wrong permissions when creating instance from Console Bug 493424 - remove unneeded modules for admin server apache config Bug 614690 - Don't use exec to call genrb Bug 699815 - (cov#10859) Add missing braces in mod_admserv code Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi Bug 699815 - (cov#10849,10851) Remove unused variables Bug 699907 - (cov#10844) Uninitialized time struct Bug 699907 - (cov#10843) Use of uninitialized variable in logging code Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi Bug 699907 - (cov#10836) Use of uninitialized var in http conn code Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code Bug 700532 - (cov#10832) Incorrect if condition in dsalib Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib Bug 700890 - (cov#10812) Check return value of open() properly in libadmin Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi Bug 700948 - (cov#10842) Use of unintialized variable in statusping Bug 700948 - (cov#10842) Use of unintialized variable in statusping Bug 702150 - (cov#10823) File descriptors leaked in help cgi Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi Bug 702150 - leak of config array in dsalib Bug 702150 - (cov#10816) file descriptor leak in dsalib Bug 702150 - (cov#10817) Leak of string in libdsa Bug 702150 - Resouce leaks in htmladmin.c Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin Bug 702705 - NULL pointer dereferences in viewlog cgi Bug 702705 - (cov#10803) NULL pointer dereference in security cgi Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy Bug 724808 - startup CGIs write temp file to / Bug 730079 - Update SELinux policy during upgrades Ticket #329 - Port modules to httpd 2.4 Ticket #47333 - Relabel lockfile when starting Admin Server Ticket #47334 - Avoid quoting all settings in console.conf Ticket 47468 - Change security password validation error is out of order Ticket 47466 - Importing CA cert with existing name crashes security CGI Ticket 362 - Directory Console generates insufficient key strength Ticket 47467 - Improve CRL import error messages Noriko Hosoi (36): Bug 151705 - Need to update Console Cipher Preferences with new ciphers start-ds-admin.in -- replaced "return 1" with "exit 1" Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies Bug 618858 - move start-ds-admin env file into main admin server Bug 387981 - plain files can be chosen on the Restore Directory dialog Bug 604881 - admin server log files have incorrect permissions/ownerships Bug 604881 - admin server log files have incorrect permissions/ownerships Bug 245278 - Changing to a password with a single quote does not work Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc) Bug 158926 - Unable to install CA certificate when using Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user Bug 476925 - Admin Server: Do not allow 8-bit passwords for Trac Ticket #307 - htmladmin keeps segfaulting If htmladmin fails to connect to the server, the cgi could crash. Ticket #293 - remove-ds-admin.pl does not remove everything Ticket #476 - 389 ds do not start on F18 due to missing modules bump version to 1.1.31 Ticket #567 - Restart of Admin server from console fails on segfault bump version to 1.1.32 bump version to 1.1.33 bump version to 1.1.34 Ticket #47493 - Configuration Tab does not work with FIPS mode enabled bump version to 1.1.36 Ticket 47891 - Admin Server reconfig breaks SSL config Ticket #47995 - Admin Server: source code cleaning bump version to 1.1.37 Ticket #48024 - repl-monitor invoked from adminserver cgi fails bump version to 1.1.38 Ticket #48153 - [adminserver] support NSS 3.18 bump version to 1.1.39 Ticket #48171 - remove-ds-admin.pl removes files in the rpm Ticket #47467 - Improve Add CRL/CKL dialog and errors bump version to 1.1.40 Ticket #48186 - register-ds-admin.pl script prints clear text password in the terminal Ticket #47493 - Configuration Tab does not work with FIPS mode enabled bump version to 1.1.41 Rich Megginson (66): bump version to 1.1.12.a1 initial support for openldap add selinux policy for dsgw skip LD_PRELOAD if using openldap add more log information if nss init fails add even more nss debugging Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized bump version to 1.1.12.a2 fix building with mozldap bump version to 1.1.12.a3 fix autotool build issues with properties files setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error Bug 656441 - Missing library path entry causes LD_PRELOAD error bump version to 1.1.13 bump version to 1.1.14.a1 Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required bump version to 1.1.14 bump version to 1.1.15 bump version to 1.1.16 Bug 703990 - Support upgrade from Red Hat Directory Server bump version to 1.1.17 add support for different skins skip rebranding current brand bump version to 1.1.18 look for separate openldap ldif library bump version to 1.1.19 Bug 710372 - Not able to open the Manage Certificate from DS-console better NSS error handling - reduce memory leaks fix typo in NSS_Shutdown warning message added tests for the security cgi Bug 713000 - Migration stops if old admin server cannot be stopped Bug 718079 - Perl errors when running migrate-ds-admin.pl Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts bump version to 1.1.20 bump version to 1.1.21 handle binary upgrade add man pages for ds_removal and ds_unregister bump version to 1.1.22 fix binary paths bump version to 1.1.23 bump version to 1.1.24 Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd Bug 740959 - 389-console put CA certificates into wrong database bump version to 1.1.25 Bug 767823 - selinux: need to allow admin server to connect to ldap port bump version to 1.1.26 Ticket #161 - Review and address latest Coverity issues Ticket #281 - TLS not working with latest openldap bump version to 1.1.27 bump version to 1.1.28 bump version to 1.1.29 bump version to 1.1.30 ignore files generated by Eclipse Ticket #47486 compiler warnings in adminutil, admin, dsgw Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw add more debugging for SSL connection problems Ticket #47413 389-admin fails to build with latest httpd compiler warning - ldif_read_record lineno type depends on openldap version add Eclipse and patch files bump version to 1.1.35 Ticket #47498 Error Message for Failed to create the configuration directory server Ticket #418 Error with register-ds-admin.pl Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down. Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>" Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour Ticket #47478 No groups file? error restarting Admin server Wes Hardin (1): fix for bug 377 - Unchecked use of SELinux command noriko (1): Ticket #47298 - remove-ds-admin.pl does not stop the admin server --- .gitignore | 4 Makefile.am | 109 Makefile.in | 1767 - VERSION.sh | 4 aclocal.m4 | 7258 ---- admserv/cfgstuff/console.conf.in | 2 admserv/cfgstuff/httpd-2.2.conf.in | 13 admserv/cfgstuff/httpd-2.4.conf.in | 742 admserv/cfgstuff/httpd.conf.in | 2 admserv/cfgstuff/initconfig.in | 5 admserv/cfgstuff/start-ds-admin.in | 83 admserv/cgi-ds/ds_listdb.c | 26 admserv/cgi-ds/ds_snmpctrl.c | 5 admserv/cgi-src40/ReadLog.c | 18 admserv/cgi-src40/admlib.mk | 119 admserv/cgi-src40/admpw.c | 79 admserv/cgi-src40/cgicommon.h | 1 admserv/cgi-src40/cgicommon.properties | 3 admserv/cgi-src40/config.c | 47 admserv/cgi-src40/dllglue.c | 42 admserv/cgi-src40/ds_create.in | 18 admserv/cgi-src40/dsconfig.c | 10 admserv/cgi-src40/head.html | 1 admserv/cgi-src40/help.c | 15 admserv/cgi-src40/htmladmin.c | 810 admserv/cgi-src40/htmladmin.properties | 42 admserv/cgi-src40/monreplication.c | 7 admserv/cgi-src40/repl-monitor-cgi.pl.in | 30 admserv/cgi-src40/restartsrv.c | 9 admserv/cgi-src40/sec-activate.c | 163 admserv/cgi-src40/security.c | 348 admserv/cgi-src40/security.properties | 8 admserv/cgi-src40/start_config_ds.c | 11 admserv/cgi-src40/statpingserv.c | 82 admserv/cgi-src40/stopsrv.c | 10 admserv/cgi-src40/ugdsconfig.c | 39 admserv/cgi-src40/viewdata.c | 264 admserv/cgi-src40/viewdata.properties | 2 admserv/cgi-src40/viewlog.c | 75 admserv/cgi-src40/viewlog.properties | 6 admserv/genrb_wrapper.sh | 2 admserv/html/admserv.html.in | 11 admserv/html/htmladmin.html.in | 13 admserv/html/monreplication.html | 20 admserv/html/viewdata.html | 6 admserv/html/viewlog.html | 14 admserv/makeUpgradeTar.sh | 30 admserv/newinst/src/25changefedorato389.pl | 250 admserv/newinst/src/25rebrand.pl.in | 413 admserv/newinst/src/30updateglobalpref.pl.in | 9 admserv/newinst/src/AdminMigration.pm.in | 79 admserv/newinst/src/AdminServer.pm.in | 270 admserv/newinst/src/AdminUtil.pm.in | 91 admserv/newinst/src/ConfigDSDialogs.pm | 42 admserv/newinst/src/dirserver.map.in | 1 admserv/newinst/src/register-ds-admin.pl.in | 719 admserv/newinst/src/register-ds-admin.res.in | 38 admserv/newinst/src/register_param.map.in | 4 admserv/newinst/src/register_server.pl.in | 6 admserv/newinst/src/remove-ds-admin.pl.in | 8 admserv/newinst/src/setup-ds-admin.pl.in | 6 admserv/newinst/src/setup-ds-admin.res.in | 20 admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49 admserv/schema/ldif/10dsdata.ldif.tmpl | 39 compile | 240 config.guess | 529 config.h.in | 33 config.sub | 379 configure |38698 +++++++++------------- configure.ac | 111 depcomp | 343 include/base/file.h | 3 include/base/util.h | 3 include/libadmin/dbtlibadmin.h | 2 include/libadmin/libadmin.h | 92 include/libdsa/dsalib.h | 15 install-sh | 538 lib/base/file.cpp | 30 lib/base/nscputil.cpp | 51 lib/libadmin/dllglue.c | 77 lib/libadmin/httpcon.c | 5 lib/libadmin/referer.c | 4 lib/libadmin/template.c | 29 lib/libadmin/util.c | 973 lib/libdsa/dsalib_conf.c | 37 lib/libdsa/dsalib_confs.c | 93 lib/libdsa/dsalib_location.c | 56 lib/libdsa/dsalib_tailf.c | 1 lib/libdsa/dsalib_updown.c | 118 lib/libdsa/dsalib_util.c | 56 ltmain.sh |14878 +++++--- m4/adminutil.m4 | 4 m4/httpd.m4 | 3 m4/mozldap.m4 | 116 m4/openldap.m4 | 138 m4/selinux.m4 | 3 man/man8/ds_removal.8 | 54 man/man8/ds_unregister.8 | 48 man/man8/register-ds-admin.pl.8 | 139 man/man8/remove-ds-admin.pl.8 | 10 man/man8/restart-ds-admin.8 | 10 man/man8/start-ds-admin.8 | 10 man/man8/stop-ds-admin.8 | 10 missing | 234 mod_admserv/mod_admserv.c | 564 mod_admserv/mod_admserv.h | 15 mod_restartd/mod_restartd-2.2.c | 22 selinux/dirsrv-admin.fc.in | 5 selinux/dirsrv-admin.te | 2 tests/ds_create/testget.1 | 2 tests/htmladmin/testget.2 | 2 tests/htmladmin/testget.3 | 2 tests/htmladmin/testget.4 | 2 tests/htmladmin/testget.5 | 2 tests/htmladmin/testget.6 | 2 tests/htmladmin/testget.7 | 2 tests/htmladmin/testget.8 | 2 tests/security/testpost.1 | 1 tests/security/testpost.10 | 1 tests/security/testpost.11 | 1 tests/security/testpost.12 | 1 tests/security/testpost.13 | 1 tests/security/testpost.14 | 1 tests/security/testpost.15 | 1 tests/security/testpost.16 | 1 tests/security/testpost.17 | 1 tests/security/testpost.18 | 1 tests/security/testpost.19 | 1 tests/security/testpost.2 | 1 tests/security/testpost.20 | 1 tests/security/testpost.21 | 1 tests/security/testpost.3 | 1 tests/security/testpost.4 | 1 tests/security/testpost.5 | 1 tests/security/testpost.6 | 1 tests/security/testpost.7 | 1 tests/security/testpost.8 | 1 tests/security/testpost.9 | 1 tests/setup.sh | 250 tests/ugdsconfig/testget.10 | 2 tests/viewdata/testget.2 | 2 tests/viewdata/testget.3 | 2 tests/viewdata/testget.4 | 2 tests/viewlog/testget.3 | 2 tests/viewlog/testget.4 | 2 wrappers/initscript.in | 3 wrappers/systemd.service.in | 24 147 files changed, 35311 insertions(+), 38215 deletions(-) ---

1 0

VERSION.sh
by Noriko Hosoi 27 May '15

27 May '15

VERSION.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 220b91d6acc6c8fadabffbc3a11fcf20c7033f9c Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Wed May 27 13:17:02 2015 -0700 bump version to 1.1.41 diff --git a/VERSION.sh b/VERSION.sh index 765c91f..1f0d104 100644 --- a/VERSION.sh +++ b/VERSION.sh @@ -11,7 +11,7 @@ vendorurl=http://port389.org # PACKAGE_VERSION is constructed from these VERSION_MAJOR=1 VERSION_MINOR=1 -VERSION_MAINT=40 +VERSION_MAINT=41 # if this is a PRERELEASE, set VERSION_PREREL # otherwise, comment it out # be sure to include the dot prefix in the prerel

1 0

admserv/cgi-src40
by Noriko Hosoi 27 May '15

27 May '15

admserv/cgi-src40/security.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) New commits: commit 8fc8d1dca1546a285dd7505a8ecb6602c748ac8b Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Wed May 27 13:10:53 2015 -0700 Ticket #47493 - Configuration Tab does not work with FIPS mode enabled Description: To invoke Manage Certificate window, NSS slot needs to be found by looking up the token name. When the token name is "internal (software)", the slot is supposed to be found by PK11_GetInternalKeySlot that provides the support for FIPS instead of PK11_FindSlotByName. This patch calls the right api based upon the token type. https://fedorahosted.org/389/ticket/47493 Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!) diff --git a/admserv/cgi-src40/security.c b/admserv/cgi-src40/security.c index 34bf3a7..2d7f38d 100644 --- a/admserv/cgi-src40/security.c +++ b/admserv/cgi-src40/security.c @@ -890,13 +890,20 @@ static void listCert(char* tokenName) { CERTCertList *certList; CERTCertListNode *cln; - PK11SlotInfo *slot = PK11_FindSlotByName(tokenName); + PK11SlotInfo *slot = NULL; PK11SlotInfo *internal_slot; char *internalTokenName; + if (tokenName && (!strcasecmp(tokenName, "internal") || + !strcasecmp(tokenName, "internal (software)"))) { + slot = PK11_GetInternalKeySlot(); + } else { + slot = PK11_FindSlotByName(tokenName); + } + if (!slot) { - errorRpt(GENERAL_FAILURE, getResourceString(DBT_TOKEN_NAME)); - return; + errorRpt(GENERAL_FAILURE, getResourceString(DBT_TOKEN_NAME)); + return; } if (PK11_IsInternal(slot)) {

1 0

admserv/newinst
by Noriko Hosoi 27 May '15

27 May '15

admserv/newinst/src/register-ds-admin.pl.in | 11 ++++++----- admserv/newinst/src/register-ds-admin.res.in | 2 ++ 2 files changed, 8 insertions(+), 5 deletions(-) New commits: commit 6b0e7456d2a8b605e737a62010c0bf40d03441f1 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue May 26 23:05:11 2015 -0700 Ticket #48186 - register-ds-admin.pl script prints clear text password in the terminal Description: Call reg_get_passwd for the remote DS password, as well. https://fedorahosted.org/389/ticket/48186 Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!) diff --git a/admserv/newinst/src/register-ds-admin.pl.in b/admserv/newinst/src/register-ds-admin.pl.in index aebe0ba..04e936a 100644 --- a/admserv/newinst/src/register-ds-admin.pl.in +++ b/admserv/newinst/src/register-ds-admin.pl.in @@ -62,8 +62,12 @@ sub reg_get_passwd my $key = shift; my $value0 = shift; my $value1 = shift; + my $value2 = shift; - print("\n==============================================================================\n"); + if ( ! $value2 ) + { + print("\n==============================================================================\n"); + } if ( $value1 ) { $setup->msg(0, $key, $value0, $value1); @@ -827,10 +831,7 @@ if ($silent eq "no") chomp($remote_binddn = <>); } - $setup->msg(0, 'remote_prompt', "bind password"); - while($remote_bindpw eq ""){ - chomp($remote_bindpw = <>); - } + $remote_bindpw = reg_get_passwd($setup, 'remote_prompt_bind_password', "", 0, 1); $setup->msg(0, 'remote_conn_use_ssl'); chomp($local_certdir = <>); diff --git a/admserv/newinst/src/register-ds-admin.res.in b/admserv/newinst/src/register-ds-admin.res.in index 99cb3e3..f7c0e67 100644 --- a/admserv/newinst/src/register-ds-admin.res.in +++ b/admserv/newinst/src/register-ds-admin.res.in @@ -62,6 +62,8 @@ remote_register_direction = Register local servers to remote_prompt = Enter Remote %s: +remote_prompt_bind_password = Enter Remote bind password: + remote_conn_use_ssl = If using SSL, enter certificate db directory: remote_register_completed = Successfully registered host '%s' with the configuration server on '%s'.\n

1 0

Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi 26 May '15

26 May '15

ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 51 deletions(-) New commits: commit 52a7299d243278de0e1877714f5ff65a5c542b5e Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue May 26 10:41:03 2015 -0700 Ticket #48146 - async simple paged results issue Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced a regression. Handling backend "be" should be done after checking OID MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control. https://fedorahosted.org/389/ticket/48146 Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!) (cherry picked from commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5) (cherry picked from commit 0c7b38abfb4c5c02286efd5e698616534a798993) (cherry picked from commit 2003d79eb3fbd3850c9a2590c65fbe146e96853d) diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c index 15b81b6..bfacb9e 100644 --- a/ldap/servers/slapd/opshared.c +++ b/ldap/servers/slapd/opshared.c @@ -407,57 +407,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result) */ operation_set_target_spec (pb->pb_op, basesdn); - if (be_name == NULL) - { - /* no specific backend was requested, use the mapping tree - */ - err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); - if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) - || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) - { - send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); - rc = -1; - goto free_and_return; - } - if (be_list[0] != NULL) - { - index = 0; - if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ - /* move the index in the be_list which matches pr_be */ - while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) - index++; - } else { - while (be_list[index] && be_list[index+1]) - index++; - } - /* "be" is either pr_be or the last backend */ - be = be_list[index]; - } - else - be = pr_be?pr_be:NULL; - } - else - { - /* specific backend be_name was requested, use slapi_be_select_by_instance_name - */ - if (pr_be) { - be_single = be = pr_be; - } else { - be_single = be = slapi_be_select_by_instance_name(be_name); - } - if (be_single) - slapi_be_Rlock(be_single); - be_list[0] = NULL; - referral_list[0] = NULL; - referral = NULL; - } - - /* this is time to check if mapping tree specific control - * was used to specify that we want to parse only - * one backend + /* + * this is time to check if mapping tree specific control was used to + * specify that we want to parse only one backend. */ slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp); - if (NULL != ctrlp) + if (ctrlp) { if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID, &ctl_value, &iscritical)) @@ -506,7 +461,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result) } } } + } + + if (be_name == NULL) + { + /* no specific backend was requested, use the mapping tree + */ + err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); + if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) + || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) + { + send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); + rc = -1; + goto free_and_return; + } + if (be_list[0] != NULL) + { + index = 0; + if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ + /* move the index in the be_list which matches pr_be */ + while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) + index++; + } else { + while (be_list[index] && be_list[index+1]) + index++; + } + /* "be" is either pr_be or the last backend */ + be = be_list[index]; + } + else + be = pr_be?pr_be:NULL; + } + else + { + /* specific backend be_name was requested, use slapi_be_select_by_instance_name + */ + if (pr_be) { + be_single = be = pr_be; + } else { + be_single = be = slapi_be_select_by_instance_name(be_name); + } + if (be_single) { + slapi_be_Rlock(be_single); + } + be_list[0] = NULL; + referral_list[0] = NULL; + referral = NULL; + } + /* Handle the rest of the controls. */ + if (ctrlp) + { if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS, &ctl_value, &iscritical) ) { @@ -1017,10 +1022,11 @@ next_be: } free_and_return: - if ((be_list[0] != NULL) || (referral_list[0] != NULL)) + if ((be_list[0] != NULL) || (referral_list[0] != NULL)) { slapi_mapping_tree_free_all(be_list, referral_list); - else if (be_single) + } else if (be_single) { slapi_be_Unlock(be_single); + } free_and_return_nolock: slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);

1 0

Branch '389-ds-base-1.3.2' - ldap/servers
by Noriko Hosoi 26 May '15

26 May '15

ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 51 deletions(-) New commits: commit 2003d79eb3fbd3850c9a2590c65fbe146e96853d Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue May 26 10:41:03 2015 -0700 Ticket #48146 - async simple paged results issue Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced a regression. Handling backend "be" should be done after checking OID MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control. https://fedorahosted.org/389/ticket/48146 Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!) (cherry picked from commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5) (cherry picked from commit 0c7b38abfb4c5c02286efd5e698616534a798993) diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c index b82a171..c42aaa0 100644 --- a/ldap/servers/slapd/opshared.c +++ b/ldap/servers/slapd/opshared.c @@ -408,57 +408,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result) */ operation_set_target_spec (pb->pb_op, basesdn); - if (be_name == NULL) - { - /* no specific backend was requested, use the mapping tree - */ - err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); - if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) - || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) - { - send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); - rc = -1; - goto free_and_return; - } - if (be_list[0] != NULL) - { - index = 0; - if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ - /* move the index in the be_list which matches pr_be */ - while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) - index++; - } else { - while (be_list[index] && be_list[index+1]) - index++; - } - /* "be" is either pr_be or the last backend */ - be = be_list[index]; - } - else - be = pr_be?pr_be:NULL; - } - else - { - /* specific backend be_name was requested, use slapi_be_select_by_instance_name - */ - if (pr_be) { - be_single = be = pr_be; - } else { - be_single = be = slapi_be_select_by_instance_name(be_name); - } - if (be_single) - slapi_be_Rlock(be_single); - be_list[0] = NULL; - referral_list[0] = NULL; - referral = NULL; - } - - /* this is time to check if mapping tree specific control - * was used to specify that we want to parse only - * one backend + /* + * this is time to check if mapping tree specific control was used to + * specify that we want to parse only one backend. */ slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp); - if (NULL != ctrlp) + if (ctrlp) { if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID, &ctl_value, &iscritical)) @@ -513,7 +468,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result) } } } + } + + if (be_name == NULL) + { + /* no specific backend was requested, use the mapping tree + */ + err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); + if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) + || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) + { + send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); + rc = -1; + goto free_and_return; + } + if (be_list[0] != NULL) + { + index = 0; + if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ + /* move the index in the be_list which matches pr_be */ + while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) + index++; + } else { + while (be_list[index] && be_list[index+1]) + index++; + } + /* "be" is either pr_be or the last backend */ + be = be_list[index]; + } + else + be = pr_be?pr_be:NULL; + } + else + { + /* specific backend be_name was requested, use slapi_be_select_by_instance_name + */ + if (pr_be) { + be_single = be = pr_be; + } else { + be_single = be = slapi_be_select_by_instance_name(be_name); + } + if (be_single) { + slapi_be_Rlock(be_single); + } + be_list[0] = NULL; + referral_list[0] = NULL; + referral = NULL; + } + /* Handle the rest of the controls. */ + if (ctrlp) + { if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS, &ctl_value, &iscritical) ) { @@ -1024,10 +1029,11 @@ next_be: } free_and_return: - if ((be_list[0] != NULL) || (referral_list[0] != NULL)) + if ((be_list[0] != NULL) || (referral_list[0] != NULL)) { slapi_mapping_tree_free_all(be_list, referral_list); - else if (be_single) + } else if (be_single) { slapi_be_Unlock(be_single); + } free_and_return_nolock: slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);

1 0

Branch '389-ds-base-1.3.3' - ldap/servers
by Noriko Hosoi 26 May '15

26 May '15

ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 51 deletions(-) New commits: commit 0c7b38abfb4c5c02286efd5e698616534a798993 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue May 26 10:41:03 2015 -0700 Ticket #48146 - async simple paged results issue Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced a regression. Handling backend "be" should be done after checking OID MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control. https://fedorahosted.org/389/ticket/48146 Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!) (cherry picked from commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5) diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c index 1d454b7..bb053c1 100644 --- a/ldap/servers/slapd/opshared.c +++ b/ldap/servers/slapd/opshared.c @@ -408,57 +408,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result) */ operation_set_target_spec (pb->pb_op, basesdn); - if (be_name == NULL) - { - /* no specific backend was requested, use the mapping tree - */ - err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); - if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) - || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) - { - send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); - rc = -1; - goto free_and_return; - } - if (be_list[0] != NULL) - { - index = 0; - if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ - /* move the index in the be_list which matches pr_be */ - while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) - index++; - } else { - while (be_list[index] && be_list[index+1]) - index++; - } - /* "be" is either pr_be or the last backend */ - be = be_list[index]; - } - else - be = pr_be?pr_be:NULL; - } - else - { - /* specific backend be_name was requested, use slapi_be_select_by_instance_name - */ - if (pr_be) { - be_single = be = pr_be; - } else { - be_single = be = slapi_be_select_by_instance_name(be_name); - } - if (be_single) - slapi_be_Rlock(be_single); - be_list[0] = NULL; - referral_list[0] = NULL; - referral = NULL; - } - - /* this is time to check if mapping tree specific control - * was used to specify that we want to parse only - * one backend + /* + * this is time to check if mapping tree specific control was used to + * specify that we want to parse only one backend. */ slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp); - if (NULL != ctrlp) + if (ctrlp) { if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID, &ctl_value, &iscritical)) @@ -513,7 +468,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result) } } } + } + + if (be_name == NULL) + { + /* no specific backend was requested, use the mapping tree + */ + err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); + if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) + || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) + { + send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); + rc = -1; + goto free_and_return; + } + if (be_list[0] != NULL) + { + index = 0; + if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ + /* move the index in the be_list which matches pr_be */ + while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) + index++; + } else { + while (be_list[index] && be_list[index+1]) + index++; + } + /* "be" is either pr_be or the last backend */ + be = be_list[index]; + } + else + be = pr_be?pr_be:NULL; + } + else + { + /* specific backend be_name was requested, use slapi_be_select_by_instance_name + */ + if (pr_be) { + be_single = be = pr_be; + } else { + be_single = be = slapi_be_select_by_instance_name(be_name); + } + if (be_single) { + slapi_be_Rlock(be_single); + } + be_list[0] = NULL; + referral_list[0] = NULL; + referral = NULL; + } + /* Handle the rest of the controls. */ + if (ctrlp) + { if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS, &ctl_value, &iscritical) ) { @@ -1024,10 +1029,11 @@ next_be: } free_and_return: - if ((be_list[0] != NULL) || (referral_list[0] != NULL)) + if ((be_list[0] != NULL) || (referral_list[0] != NULL)) { slapi_mapping_tree_free_all(be_list, referral_list); - else if (be_single) + } else if (be_single) { slapi_be_Unlock(be_single); + } free_and_return_nolock: slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);

1 0

ldap/servers
by Noriko Hosoi 26 May '15

26 May '15

ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 51 deletions(-) New commits: commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue May 26 10:41:03 2015 -0700 Ticket #48146 - async simple paged results issue Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced a regression. Handling backend "be" should be done after checking OID MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control. https://fedorahosted.org/389/ticket/48146 Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!) diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c index 1d454b7..bb053c1 100644 --- a/ldap/servers/slapd/opshared.c +++ b/ldap/servers/slapd/opshared.c @@ -408,57 +408,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result) */ operation_set_target_spec (pb->pb_op, basesdn); - if (be_name == NULL) - { - /* no specific backend was requested, use the mapping tree - */ - err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); - if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) - || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) - { - send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); - rc = -1; - goto free_and_return; - } - if (be_list[0] != NULL) - { - index = 0; - if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ - /* move the index in the be_list which matches pr_be */ - while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) - index++; - } else { - while (be_list[index] && be_list[index+1]) - index++; - } - /* "be" is either pr_be or the last backend */ - be = be_list[index]; - } - else - be = pr_be?pr_be:NULL; - } - else - { - /* specific backend be_name was requested, use slapi_be_select_by_instance_name - */ - if (pr_be) { - be_single = be = pr_be; - } else { - be_single = be = slapi_be_select_by_instance_name(be_name); - } - if (be_single) - slapi_be_Rlock(be_single); - be_list[0] = NULL; - referral_list[0] = NULL; - referral = NULL; - } - - /* this is time to check if mapping tree specific control - * was used to specify that we want to parse only - * one backend + /* + * this is time to check if mapping tree specific control was used to + * specify that we want to parse only one backend. */ slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp); - if (NULL != ctrlp) + if (ctrlp) { if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID, &ctl_value, &iscritical)) @@ -513,7 +468,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result) } } } + } + + if (be_name == NULL) + { + /* no specific backend was requested, use the mapping tree + */ + err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf); + if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL)) + || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL))) + { + send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL); + rc = -1; + goto free_and_return; + } + if (be_list[0] != NULL) + { + index = 0; + if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */ + /* move the index in the be_list which matches pr_be */ + while (be_list[index] && be_list[index+1] && pr_be != be_list[index]) + index++; + } else { + while (be_list[index] && be_list[index+1]) + index++; + } + /* "be" is either pr_be or the last backend */ + be = be_list[index]; + } + else + be = pr_be?pr_be:NULL; + } + else + { + /* specific backend be_name was requested, use slapi_be_select_by_instance_name + */ + if (pr_be) { + be_single = be = pr_be; + } else { + be_single = be = slapi_be_select_by_instance_name(be_name); + } + if (be_single) { + slapi_be_Rlock(be_single); + } + be_list[0] = NULL; + referral_list[0] = NULL; + referral = NULL; + } + /* Handle the rest of the controls. */ + if (ctrlp) + { if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS, &ctl_value, &iscritical) ) { @@ -1024,10 +1029,11 @@ next_be: } free_and_return: - if ((be_list[0] != NULL) || (referral_list[0] != NULL)) + if ((be_list[0] != NULL) || (referral_list[0] != NULL)) { slapi_mapping_tree_free_all(be_list, referral_list); - else if (be_single) + } else if (be_single) { slapi_be_Unlock(be_single); + } free_and_return_nolock: slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);

1 0

Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi 26 May '15

26 May '15

ldap/servers/slapd/bind.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) New commits: commit 164cb2460538d63ee2b2cde3e28323e51dc9741c Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Sat May 9 18:55:39 2015 -0700 Ticket #48183 - bind on db chained to AD returns err=32 Description by rmeggins(a)redhat.com: bind is doing a search for the entry post bind, which fails because we don't enable password policy chaining by default. I think in this case, we should not look up password policy, because if the remote is AD or some other non-389 server, we can't use the password policy information. We should instead rely on the remote server to evaluate the password policy. The commit 4fc53e1a63222d0ff67c30a59f2cff4b535f90a8 introduced the bug. Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check https://fedorahosted.org/389/ticket/48183 Revewed by nhosoi(a)redhat.com. (cherry picked from commit eb46e6f1975b19956bb38d5e070e6eb5159200b4) (cherry picked from commit 03bee0a0d4dbe313bca88cfafc605f6cb01b9fdc) (cherry picked from commit 46242d88b62716d99641eceac26476a9c842c149) diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c index edb36c4..11ec22e 100644 --- a/ldap/servers/slapd/bind.c +++ b/ldap/servers/slapd/bind.c @@ -777,7 +777,8 @@ do_bind( Slapi_PBlock *pb ) * was in be_bind. Since be_bind returned SLAPI_BIND_SUCCESS, * the entry is in the DS. So, we need to retrieve it once more. */ - if (!bind_target_entry) { + if (!slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA) && + !bind_target_entry) { bind_target_entry = get_entry(pb, slapi_sdn_get_ndn(sdn)); if (bind_target_entry) { myrc = slapi_check_account_lock(pb, bind_target_entry,

1 0

Branch '389-ds-base-1.3.2' - ldap/servers
by Noriko Hosoi 26 May '15

26 May '15

ldap/servers/slapd/bind.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) New commits: commit 46242d88b62716d99641eceac26476a9c842c149 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Sat May 9 18:55:39 2015 -0700 Ticket #48183 - bind on db chained to AD returns err=32 Description by rmeggins(a)redhat.com: bind is doing a search for the entry post bind, which fails because we don't enable password policy chaining by default. I think in this case, we should not look up password policy, because if the remote is AD or some other non-389 server, we can't use the password policy information. We should instead rely on the remote server to evaluate the password policy. The commit 4fc53e1a63222d0ff67c30a59f2cff4b535f90a8 introduced the bug. Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check https://fedorahosted.org/389/ticket/48183 Revewed by nhosoi(a)redhat.com. (cherry picked from commit eb46e6f1975b19956bb38d5e070e6eb5159200b4) (cherry picked from commit 03bee0a0d4dbe313bca88cfafc605f6cb01b9fdc) diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c index bc4aa24..2b9d67c 100644 --- a/ldap/servers/slapd/bind.c +++ b/ldap/servers/slapd/bind.c @@ -777,7 +777,8 @@ do_bind( Slapi_PBlock *pb ) * was in be_bind. Since be_bind returned SLAPI_BIND_SUCCESS, * the entry is in the DS. So, we need to retrieve it once more. */ - if (!bind_target_entry) { + if (!slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA) && + !bind_target_entry) { bind_target_entry = get_entry(pb, slapi_sdn_get_ndn(sdn)); if (bind_target_entry) { myrc = slapi_check_account_lock(pb, bind_target_entry,

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits May 2015