389-commits March 2016

389-commits@lists.fedoraproject.org

6 participants
40 discussions

ldap/admin
by William Brown 31 Mar '16

31 Mar '16

ldap/admin/src/scripts/ns-accountstatus.pl.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) New commits: commit 10787a0bb02e950787e8edb82c41cdba5db1c75c Author: Andrey Cherepanov <cas(a)altlinux.ru> Date: Fri Apr 1 09:45:53 2016 +1000 Ticket 48783 - Fix ns-accountstatus.pl syntax error Bug Description: A missing ; and new line was found in ns-accountstatus.pl in the --help message. Fix Description: Add the correct ); stanza. https://fedorahosted.org/389/ticket/48783 Author: Andrey Cherepanov Review by: wibrown diff --git a/ldap/admin/src/scripts/ns-accountstatus.pl.in b/ldap/admin/src/scripts/ns-accountstatus.pl.in index db3224c..139160b 100644 --- a/ldap/admin/src/scripts/ns-accountstatus.pl.in +++ b/ldap/admin/src/scripts/ns-accountstatus.pl.in @@ -30,7 +30,7 @@ my $verbose = 0; sub usage { print (STDERR "ns-accountstatus.pl [-Z serverID] [-D rootdn] { -w password | -w - | -j filename }\n"); - print (STDERR " [-p port] [-h host] [-P protocol] {-I DN | -b basedn -f filter [-s scope]}" + print (STDERR " [-p port] [-h host] [-P protocol] {-I DN | -b basedn -f filter [-s scope]}\n"); print (STDERR " [-i] [-g seconds]\n\n"); print (STDERR "May be used to get the status a user or a domain of users\n\n"); print (STDERR "Arguments:\n"); @@ -1035,4 +1035,4 @@ for(my $i = 0; $i <= $#entries; $i++){ } exit 103; } -} \ No newline at end of file +}

1 0

ldap/servers
by Noriko Hosoi 31 Mar '16

31 Mar '16

ldap/servers/slapd/ldaputil.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) New commits: commit 16445ac913a7e8eff2b48edf76a42e2bab7d6bb1 Author: Graham Leggett <minfrin(a)sharp.fm> Date: Thu Mar 31 02:48:43 2016 +0200 Ticket #48782 - Make sure that when LDAP_OPT_X_TLS_NEWCTX is set, the value is set to zero. Description: The attached patch is for the optval issue described above. Optval is explicitly set to zero, rather than using whatever arbitrary value is present in optval from the earlier ldap_set_option call. https://fedorahosted.org/389/ticket/48782 Reviewed by nhosoi(a)redhat.com. diff --git a/ldap/servers/slapd/ldaputil.c b/ldap/servers/slapd/ldaputil.c index e62d1f2..3851be5 100644 --- a/ldap/servers/slapd/ldaputil.c +++ b/ldap/servers/slapd/ldaputil.c @@ -605,7 +605,8 @@ setup_ol_tls_conn(LDAP *ld, int clientauth) /* have to do this last - this creates the new TLS handle and sets/copies all of the parameters set above into that TLS handle context - note - that optval is ignored - what matters is that it is not NULL */ + that optval is zero, meaning create a context for a client */ + optval = 0; if ((rc = ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &optval))) { slapi_log_error(SLAPI_LOG_FATAL, "setup_ol_tls_conn", "failed: unable to create new TLS context - %d\n", rc);

1 0

ldap/servers
by thierry bordaz 31 Mar '16

31 Mar '16

ldap/servers/plugins/replication/repl5_replica.c | 130 ++++++++++++++++++----- 1 file changed, 102 insertions(+), 28 deletions(-) New commits: commit 5cfd3de8f71d2c5917238f78b8559769bdf4727b Author: Thierry Bordaz <tbordaz(a)redhat.com> Date: Fri Mar 25 14:05:02 2016 +0100 Ticket 48597 Deadlock when rebuilding the group of authorized replication managers Bug description: When the replication managers list is defined in a group, the members of the groups are refreshed using an internal search. The refresh is done while holding the replica lock (start_replication_session). If at the same time a write operation holding some DB page , need to lock the replica (i.e. generated a csn) it can deadlock if the internal search need to access the same DB page hold by the write operation. Fix description: The fix is to trigger the internal search of the group members without holding the replica lock. The lookup is done with a local variable that replace the replica field (groupdn_list) once the replica lock is acquired. If the replica updatedn_groups has changed during the lookup (while the replica lock was release) then groupdn_list is not changed. https://fedorahosted.org/389/ticket/48597 Reviewed by: Noriko Hosoi (thanks Noriko !) Platform tested: F23 (but did not find reproducible test case for the hang) Flag day: no Doc impact: no diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c index c7cf25f..6562b3b 100644 --- a/ldap/servers/plugins/replication/repl5_replica.c +++ b/ldap/servers/plugins/replication/repl5_replica.c @@ -20,6 +20,7 @@ #include "repl_shared.h" #include "csnpl.h" #include "cl5_api.h" +#include "slap.h" #define RUV_SAVE_INTERVAL (30 * 1000) /* 30 seconds */ @@ -1089,45 +1090,118 @@ replica_set_legacy_purl (Replica *r, const char *purl) replica_unlock(r->repl_lock); } +static PRBool +valuesets_equal(Slapi_ValueSet *new_dn_groups, Slapi_ValueSet *old_dn_groups) +{ + Slapi_Attr *attr = NULL; + Slapi_Value *val = NULL; + int idx = 0; + PRBool rc = PR_TRUE; + + if (new_dn_groups == NULL) { + if (old_dn_groups == NULL) + return PR_TRUE; + else + return PR_FALSE; + } + if (old_dn_groups == NULL) { + return PR_FALSE; + } + + /* if there is not the same number of value, no need to check the value themselves */ + if (new_dn_groups->num != old_dn_groups->num) { + return PR_FALSE; + } + + attr = slapi_attr_new(); + slapi_attr_init(attr, attr_replicaBindDnGroup); + + /* Check that all values in old_dn_groups also exist in new_dn_groups */ + for (idx = slapi_valueset_first_value(old_dn_groups, &val); + val && (idx != -1); + idx = slapi_valueset_next_value(old_dn_groups, idx, &val)) { + if (slapi_valueset_find(attr, new_dn_groups, val) == NULL) { + rc = PR_FALSE; + break; + } + } + slapi_attr_free(&attr); + return rc; +} /* * Returns true if sdn is the same as updatedn and false otherwise */ PRBool replica_is_updatedn (Replica *r, const Slapi_DN *sdn) { - PRBool result; + PRBool result = PR_FALSE; - PR_ASSERT (r); + PR_ASSERT(r); - replica_lock(r->repl_lock); + replica_lock(r->repl_lock); - if ((r->updatedn_list == NULL) && (r->groupdn_list == NULL)) { - if (sdn == NULL) { - result = PR_TRUE; - } else { - result = PR_FALSE; - } - } else { - result = PR_FALSE; - if (r->updatedn_list ) { - result = replica_updatedn_list_ismember(r->updatedn_list, sdn); - } - if ((result == PR_FALSE) && r->groupdn_list ) { - /* check and rebuild groupdns */ - if (r->updatedn_group_check_interval > -1) { - time_t now = time(NULL); - if (now - r->updatedn_group_last_check > r->updatedn_group_check_interval) { - replica_updatedn_list_group_replace( r->groupdn_list, r->updatedn_groups); - r->updatedn_group_last_check = now; - } - } - result = replica_updatedn_list_ismember(r->groupdn_list, sdn); - } - } + if ((r->updatedn_list == NULL) && (r->groupdn_list == NULL)) { + if (sdn == NULL) { + result = PR_TRUE; + } else { + result = PR_FALSE; + } + replica_unlock(r->repl_lock); + return result; + } - replica_unlock(r->repl_lock); + if (r->updatedn_list) { + result = replica_updatedn_list_ismember(r->updatedn_list, sdn); + if (result == PR_TRUE) { + replica_unlock(r->repl_lock); + return result; + } + } + + if (r->groupdn_list) { + /* check and rebuild groupdns */ + if (r->updatedn_group_check_interval > -1) { + time_t now = time(NULL); + if (now - r->updatedn_group_last_check > r->updatedn_group_check_interval) { + Slapi_ValueSet *updatedn_groups_copy = NULL; + ReplicaUpdateDNList groupdn_list = replica_updatedn_list_new(NULL); + + slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "Authorized replication managers is resync (%ld)\n", now); + updatedn_groups_copy = slapi_valueset_new(); + slapi_valueset_set_valueset(updatedn_groups_copy, r->updatedn_groups); + r->updatedn_group_last_check = now; /* Just to be sure no one will try to reload */ + + /* It can do internal searches, to avoid deadlock release the replica lock + * as we are working on local variables + */ + replica_unlock(r->repl_lock); + replica_updatedn_list_group_replace(groupdn_list, updatedn_groups_copy); + replica_lock(r->repl_lock); + + if (valuesets_equal(r->updatedn_groups, updatedn_groups_copy)) { + /* the updatedn_groups has not been updated while we release the replica + * this is fine to apply the groupdn_list + */ + replica_updatedn_list_delete(r->groupdn_list, NULL); + replica_updatedn_list_free(r->groupdn_list); + r->groupdn_list = groupdn_list; + } else { + /* the unpdatedn_groups has been updated while we released the replica + * groupdn_list in the replica is up to date. Do not replace it + */ + slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "Authorized replication managers (%s) was updated during a refresh\n", attr_replicaBindDnGroup); + replica_updatedn_list_delete(groupdn_list, NULL); + replica_updatedn_list_free(groupdn_list); + } + slapi_valueset_free(updatedn_groups_copy); + } + } + result = replica_updatedn_list_ismember(r->groupdn_list, sdn); + } + + replica_unlock(r->repl_lock); - return result; + return result; } /* * Sets updatedn list for this replica

1 0

ldap/servers
by William Brown 30 Mar '16

30 Mar '16

ldap/servers/slapd/log.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) New commits: commit 6858dfd409a1e7207668f9a789a74bc4e9613d6a Author: William Brown <firstyear(a)redhat.com> Date: Wed Mar 30 13:04:58 2016 +1000 Ticket 47982 - HR Log timers, regression fix for subsystem logging Bug Description: In the introduction of HR log times subsystem was omitted from the errors log. Fix Description: Re-add the subsystem parameter to subsystem logging. https://fedorahosted.org/389/ticket/47982 Author: wibrown Review by: mreynolds (Thanks!) diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c index 80ff53e..34ca10d 100644 --- a/ldap/servers/slapd/log.c +++ b/ldap/servers/slapd/log.c @@ -2289,7 +2289,12 @@ vslapd_log_error( /* blen = strlen(buffer); */ /* This truncates again .... But we have the nice smprintf above! */ - PR_snprintf (buffer+blen, sizeof(buffer)-blen, "%s", vbuf); + if (subsystem == NULL) { + PR_snprintf (buffer+blen, sizeof(buffer)-blen, "%s", vbuf); + } else { + PR_snprintf (buffer+blen, sizeof(buffer)-blen, "%s - %s", subsystem, vbuf); + } + buffer[sizeof(buffer)-1] = '\0'; if (fp)

1 0

Changes to 'refs/tags/winsync-1.1.7'
by Noriko Hosoi 30 Mar '16

30 Mar '16

Changes since the dawn of time: David Boreham (17): Merge over new code: fractional replication, wan replication and windows sync plus associated UI Merge password sync code from Bozeman Pass Change password sync copyright notices, merge fixes to password sync code Fix instability in re-try and backoff mechanism Add new NT4 LDAP Service, used by windows sync Fix handling of group membership, fix installer GUID, fix handling of entry description Change GUID for installer Fix display names in pass sync to say Fedora Fix display name to say Fedora... Fix various bad memory free bugs Merge fixes over Fixes for memory leaks in ntds Patches we apply to apache ds 0.9 Update packaging for ntds Fix ntds installer to allow repair and removal Memory Leak Fixes for Apache DS Fix for #157895 : logon hours doesn't work Nathan Kinder (22): Copyright updates 155068 - Added license to source files Fixed licensing typo Fix search scope for AD password sync - 159037 170321 - Increase winsync version to 1.0.1 170328 - Fixed modify type installation so it actually updates the registry 170558 - Add certutil, pk12util and missing dlls to PassSync.msi 170558 - Add certutil, pk12util and missing dlls to PassSync.msi 170135 - Improved passsync logging facilities 170556 - Make passsync obey backoff for retries when DS is down 170816 - Don't consume password changes if modify fails 170071 - Automatically add grouptype for new groups being synchd to NT4 Initial drop of new stand-alone winsync build-system Changed unix style line endings to DOS style for nmake makefiles Remove carriage returns from nmake makefiles Initial checkin of stand-alone winsync build-system 186765 - Fixed memory leaks in passsync service 186171 - Fixed memory leaks in passhook.dll 186657 - Implemented locking around passhook data file access Related: 490048 Related: 490048 ticket 47352 - Abandon old password changes prior to syncing Noriko Hosoi (9): Ticket #47353 - PassSync fails to open changelog Ticket #47357 - Update the PassSync build environment Ticket #47357 - Update the PassSync build environment Ticket #47351 - Passsync loops when updating password of locked user Ticket #363 - Passsync/Winsync handles passwords with 8-th bit characters incorrectly bump verison to 1.1.5 Bug 980432 - Password Synchronization Service cannot be upgraded Ticket #47987 - Support TLS1.1 and newer SSL versions bump the PassSync version to 1.1.7 Rich Megginson (12): Resolves: bug 471408 Resolves: bug 482892 Resolves: bug 426421 245630 476095 remove internal paths ; use new improved unzip.vbs Resolves: Bug 482892 Resolves: bug 482892 Resolves: bug 490048 rename to 389 Add support for Windows 2008, VC 9, 64-bit and 32-bit Allow install to continue if service fails Fix install issues on 2008 - bump version to 1.1.3 use nspr 4.8.4 and nss 3.12.6 - bump version to 1.1.4 Thomas Lackey (3): Add makefile and component information to build the Apache DS for User Sync Add installer icons. Modify NTDS and PassSync to build in the 'built' directory. Viktor Ashirov (1): Ticket #48778 - PassSync installer overwrites "Notification Packages" value in registry instead of appending it unknown (4): handle 32-bit and 64-bit ldapcsdk with different dates Add VC runtime merge module - Add migration Remove files on uninstall - allow install to continue if service doesn't start Allow BRAND with spaces - remove CANDLE.EXE tracing

1 0

2 commits - passwordsync/build.bat passwordsync/wix
by Noriko Hosoi 30 Mar '16

30 Mar '16

passwordsync/build.bat | 2 +- passwordsync/wix/PassSync.wxs | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) New commits: commit 760a7e09105b07c7319f07bde2ec0666b175bc53 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Wed Mar 30 13:29:01 2016 -0700 bump the PassSync version to 1.1.7 diff --git a/passwordsync/build.bat b/passwordsync/build.bat index 7aa861a..7a7f404 100755 --- a/passwordsync/build.bat +++ b/passwordsync/build.bat @@ -170,7 +170,7 @@ if [%BRANDNOSPACE%] == [] ( set BRANDNOSPACE=389 ) if [%VERSION%] == [] ( - set VERSION=1.1.6 + set VERSION=1.1.7 ) rem ======== Set Various Build Directories ======== commit 9d00c49afbc3719fcd5c41da5a677d0fe40d29ff Author: Viktor Ashirov <vashirov(a)redhat.com> Date: Tue Mar 29 22:14:40 2016 +0200 Ticket #48778 - PassSync installer overwrites "Notification Packages" value in registry instead of appending it Bug Description: During the installation of the PassSync, key "Notification Packages" in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ is owerwritten instead of being appended. Fix Description: Use MultiStringValue for updating the registry value: http://wixtoolset.org/documentation/manual/v3/xsd/wix/multistringvalue.html https://fedorahosted.org/389/ticket/48778 Reviewed by: nhosoi(a)redhat.com diff --git a/passwordsync/wix/PassSync.wxs b/passwordsync/wix/PassSync.wxs index 55b3c56..e61ab00 100644 --- a/passwordsync/wix/PassSync.wxs +++ b/passwordsync/wix/PassSync.wxs @@ -271,7 +271,9 @@ <RegistryValue Name='Log Level' Type='string' Value='0' /> </RegistryKey> <RegistryKey Id='NotPkgs' Root='HKLM' Key='SYSTEM\ControlSet001\Control\Lsa' ForceCreateOnInstall='yes' > - <RegistryValue Name='Notification Packages' Type='multiString' Value='passhook'/> + <RegistryValue Name='Notification Packages' Type='multiString' Action='append'> + <MultiStringValue>passhook</MultiStringValue> + </RegistryValue> </RegistryKey> <RemoveFile Id='NSSDBFiles' On='uninstall' Name='*.db'/>

1 0

ldap/servers
by Noriko Hosoi 30 Mar '16

30 Mar '16

ldap/servers/slapd/ldaputil.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 696e29b9a48733f3dcc105ee15847b4a1a270b24 Author: Graham Leggett <minfrin(a)sharp.fm> Date: Wed Mar 30 23:20:51 2016 +0200 Ticket #48781 - Vague error message: setup_ol_tls_conn - failed: unable to create new TLS context Include the underlying error code to the message "failed: unable to create new TLS context". https://fedorahosted.org/389/ticket/48781 Reviewed by nhosoi(a)redhat.com. diff --git a/ldap/servers/slapd/ldaputil.c b/ldap/servers/slapd/ldaputil.c index 9281e20..e62d1f2 100644 --- a/ldap/servers/slapd/ldaputil.c +++ b/ldap/servers/slapd/ldaputil.c @@ -608,7 +608,7 @@ setup_ol_tls_conn(LDAP *ld, int clientauth) that optval is ignored - what matters is that it is not NULL */ if ((rc = ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &optval))) { slapi_log_error(SLAPI_LOG_FATAL, "setup_ol_tls_conn", - "failed: unable to create new TLS context\n"); + "failed: unable to create new TLS context - %d\n", rc); } return rc;

1 0

ldap/admin
by Noriko Hosoi 29 Mar '16

29 Mar '16

ldap/admin/src/scripts/start-dirsrv.in | 28 +--------------------------- 1 file changed, 1 insertion(+), 27 deletions(-) New commits: commit 46dbd62db4413c1a1ea3adfb1f07863a4f2982ba Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Mar 29 16:45:59 2016 -0700 Ticket #48779 - Remove startpidfile check in start-dirsrv Description: Since this fix was made, startpid file is not longer generated in the systemd start. Ticket 47951 - Add PIDFile option to .service commit d4deb29a2ed2c738fab41500e6c806f40c4dff17 start-dirsrv script should be updated to adjust to the fix. https://fedorahosted.org/389/ticket/48779 Reviewed by wibrown(a)redhat.com (Thank you, William!!) diff --git a/ldap/admin/src/scripts/start-dirsrv.in b/ldap/admin/src/scripts/start-dirsrv.in index 513addb..4bc0ba2 100755 --- a/ldap/admin/src/scripts/start-dirsrv.in +++ b/ldap/admin/src/scripts/start-dirsrv.in @@ -41,16 +41,6 @@ start_instance() { export DS_CONFIG_DIR PIDFILE=$RUN_DIR/$PRODUCT_NAME-$SERV_ID.pid - STARTPIDFILE=$RUN_DIR/$PRODUCT_NAME-$SERV_ID.startpid - if test -f $STARTPIDFILE ; then - PID=`cat $STARTPIDFILE` - if kill -s 0 $PID > /dev/null 2>&1 ; then - echo There is an ns-slapd process already running: $PID - return 2; - else - rm -f $STARTPIDFILE - fi - fi if test -f $PIDFILE ; then PID=`cat $PIDFILE` if kill -s 0 $PID > /dev/null 2>&1 ; then @@ -70,27 +60,12 @@ start_instance() { return 1 fi else - $SERVERBIN_DIR/ns-slapd -D $CONFIG_DIR -i $PIDFILE -w $STARTPIDFILE "$@" + $SERVERBIN_DIR/ns-slapd -D $CONFIG_DIR -i $PIDFILE "$@" if [ $? -ne 0 ]; then return 1 fi fi loop_counter=1 - # wait for 10 seconds for the start pid file to appear - max_count=${STARTPID_TIME:-10} - while test $loop_counter -le $max_count; do - loop_counter=`expr $loop_counter + 1` - if test ! -f $STARTPIDFILE ; then - sleep 1; - else - PID=`cat $STARTPIDFILE` - fi - done - if test ! -f $STARTPIDFILE ; then - echo Server failed to start !!! Please check errors log for problems - return 1 - fi - loop_counter=1 # wait for 10 minutes (600 times 1 seconds) max_count=${PID_TIME:-600} while test $loop_counter -le $max_count; do @@ -104,7 +79,6 @@ start_instance() { fi else PID=`cat $PIDFILE` - rm -f $STARTPIDFILE return 0; fi done

1 0

Branch '389-ds-base-1.3.4' - dirsrvtests/tests
by Mark Reynolds 27 Mar '16

27 Mar '16

dirsrvtests/tests/tickets/ticket47462_test.py | 9 +++++++++ 1 file changed, 9 insertions(+) New commits: commit 957dfe18e45e5dc5fb2febef13c67e64fe1d89ae Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Sun Mar 27 18:16:51 2016 -0400 Ticket 47888 - Add CI test Description: Add CI test for testing AES conversion with an empty backend Reviewed by: mreynolds (cherry picked from commit afb1e338abc29e84b94dbb15d472276ef0b72eaa) diff --git a/dirsrvtests/tests/tickets/ticket47462_test.py b/dirsrvtests/tests/tickets/ticket47462_test.py index c88cf43..f290647 100644 --- a/dirsrvtests/tests/tickets/ticket47462_test.py +++ b/dirsrvtests/tests/tickets/ticket47462_test.py @@ -240,6 +240,15 @@ def test_ticket47462(topology): assert False # + # Add a backend (that has no entries) + # + try: + topology.master1.backend.create("o=empty", {BACKEND_NAME: "empty"}) + except ldap.LDAPError as e: + log.fatal('Failed to create extra/empty backend: ' + e.message['desc']) + assert False + + # # Run the upgrade... # topology.master1.upgrade('online')

1 0

dirsrvtests/tests
by Mark Reynolds 27 Mar '16

27 Mar '16

dirsrvtests/tests/tickets/ticket47462_test.py | 9 +++++++++ 1 file changed, 9 insertions(+) New commits: commit afb1e338abc29e84b94dbb15d472276ef0b72eaa Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Sun Mar 27 18:16:51 2016 -0400 Ticket 47888 - Add CI test Description: Add CI test for testing AES conversion with an empty backend Reviewed by: mreynolds diff --git a/dirsrvtests/tests/tickets/ticket47462_test.py b/dirsrvtests/tests/tickets/ticket47462_test.py index c88cf43..f290647 100644 --- a/dirsrvtests/tests/tickets/ticket47462_test.py +++ b/dirsrvtests/tests/tickets/ticket47462_test.py @@ -240,6 +240,15 @@ def test_ticket47462(topology): assert False # + # Add a backend (that has no entries) + # + try: + topology.master1.backend.create("o=empty", {BACKEND_NAME: "empty"}) + except ldap.LDAPError as e: + log.fatal('Failed to create extra/empty backend: ' + e.message['desc']) + assert False + + # # Run the upgrade... # topology.master1.upgrade('online')

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits March 2016