389-commits September 2016

389-commits@lists.fedoraproject.org

6 participants
43 discussions

ldap/servers
by William Brown 29 Sep '16

29 Sep '16

ldap/servers/slapd/fedse.c | 1 - 1 file changed, 1 deletion(-) New commits: commit 617b64faad36e9dedf13a5bef6748e602f82c4c2 Author: William Brown <firstyear(a)redhat.com> Date: Fri Sep 30 14:08:55 2016 +1000 Ticket 48982 - One line fix, remove unused variable. Bug Description: I forgot to remove the variable resolved_path from fedse.c :( Fix Description: Remove the un-needed code. https://fedorahosted.org/389/ticket/48982 Author: wibrown Review by: one line fix rule. diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c index 6988521..09f292a 100644 --- a/ldap/servers/slapd/fedse.c +++ b/ldap/servers/slapd/fedse.c @@ -1948,7 +1948,6 @@ check_plugin_path(Slapi_PBlock *pb, for (j = 0; vals && vals[j]; j++) { void *handle; char *full_path = NULL; - char *resolved_path = NULL; char *res = NULL; if ( *vals[j] == '/' ) { /* absolute path */

1 0

2 commits - ldap/servers
by William Brown 29 Sep '16

29 Sep '16

ldap/servers/plugins/uiduniq/uid.c | 4 ++-- ldap/servers/slapd/fedse.c | 12 +++++++++--- 2 files changed, 11 insertions(+), 5 deletions(-) New commits: commit 31c0425599b13e492cdadff5ea64da6e1696b6bc Author: William Brown <william(a)blackhats.net.au> Date: Wed Sep 28 11:16:38 2016 +1000 Ticket 48982 - Enabling a plugin that has a versioned so causes overflow Bug Description: Enabling a plugin that has a versioned.so causes overflow. This is becuase we assumed that all plugins are "libname.so", and were not symlinks. So we used a fixed size buffer to realpath. Fix Description: Realpath can dynamically allocate the correct size buffer for the resolved path, so we use that. Additionally, we need to use "free" instead because realpath uses malloc not slapi_ch_malloc. https://fedorahosted.org/389/ticket/48982 Author: wibrown Reviewed by: nhosoi (Thanks so much!) diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c index a7c2a0e..6988521 100644 --- a/ldap/servers/slapd/fedse.c +++ b/ldap/servers/slapd/fedse.c @@ -1956,8 +1956,13 @@ check_plugin_path(Slapi_PBlock *pb, } else { /* relative path */ full_path = slapi_get_plugin_name(PLUGINDIR, vals[j]); } - resolved_path = slapi_ch_malloc(strlen(full_path) + 1); - res = realpath( full_path, resolved_path ); + /* + * See man 3 realpath. We have to pass in NULL here, because we don't + * know if the library is versioned, it could be *any* length when + * resolved. The quirk is that this uses malloc, not slapi_ch_malloc, + * so we need to free res with free() only! + */ + res = realpath( full_path, NULL ); if (res) { if ((handle = dlopen(res, RTLD_NOW)) == NULL) { *returncode = LDAP_UNWILLING_TO_PERFORM; @@ -1972,7 +1977,8 @@ check_plugin_path(Slapi_PBlock *pb, rc = SLAPI_DSE_CALLBACK_ERROR; } slapi_ch_free_string(&full_path); - slapi_ch_free_string(&resolved_path); + /* See comment above. Must free res from realpath with free() only! */ + free(res); } slapi_ch_array_free(vals); commit ffda694dd622b31277da07be76d3469fad86150f Author: William Brown <william(a)blackhats.net.au> Date: Wed Sep 28 10:46:21 2016 +1000 Ticket 48986 - 47808 triggers overflow in uiduniq.c Bug Description: Certain configurations of uiduniq.c would cause an overflow when running with Address Sanitiser Fix Description: Increase the size of the allocation to tmp_config->attrs. https://fedorahosted.org/389/ticket/48986 Author: nhosoi Reviewed by: wibrown diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c index d1d0162..2aba17a 100644 --- a/ldap/servers/plugins/uiduniq/uid.c +++ b/ldap/servers/plugins/uiduniq/uid.c @@ -302,7 +302,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry) } /* Store attrName in the config */ - tmp_config->attrs = (const char **) slapi_ch_calloc(1, sizeof(char *)); + tmp_config->attrs = (const char **) slapi_ch_calloc(2, sizeof(char *)); tmp_config->attrs[0] = slapi_ch_strdup(attrName); argc--; argv++; /* First argument was attribute name and remaining are subtrees */ @@ -345,7 +345,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry) * - requiredObjectClass */ /* Store attrName in the config */ - tmp_config->attrs = (const char **) slapi_ch_calloc(1, sizeof(char *)); + tmp_config->attrs = (const char **) slapi_ch_calloc(2, sizeof(char *)); tmp_config->attrs[0] = slapi_ch_strdup(attrName); /* There is no subtrees */

1 0

ldap/servers
by Mark Reynolds 28 Sep '16

28 Sep '16

ldap/servers/plugins/posix-winsync/posix-group-func.c | 2 +- ldap/servers/plugins/replication/repl5_replica_config.c | 2 ++ ldap/servers/slapd/daemon.c | 4 ++++ ldap/servers/slapd/log.c | 2 +- ldap/servers/slapd/slapi-plugin.h | 11 ++++++++++- 5 files changed, 18 insertions(+), 3 deletions(-) New commits: commit 04a9c896a99be843e531f989352f39687518c4e8 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Wed Sep 28 14:11:03 2016 -0400 Ticket 48978 - Convert slapi_log_error() to a variadic macro Description: In order to replace the LDAPDebug() logging functions with slapi_log_error() we need make slapi_log_error behave as the LDAPDebug() marco does. The benefit of having the logging function macro is that you can completely remove the presence of error logging. This is very beneficial when investigating a performance issue. https://fedorahosted.org/389/ticket/48978 Reviewed by: nhosoi(Thanks!) diff --git a/ldap/servers/plugins/posix-winsync/posix-group-func.c b/ldap/servers/plugins/posix-winsync/posix-group-func.c index 44ebeef..61e4aa5 100644 --- a/ldap/servers/plugins/posix-winsync/posix-group-func.c +++ b/ldap/servers/plugins/posix-winsync/posix-group-func.c @@ -18,8 +18,8 @@ $Id: posix-group-func.c 28 2011-05-13 14:35:29Z grzemba $ */ #include <string.h> -#include <nspr.h> #include "slapi-plugin.h" +#include <nspr.h> #include "posix-wsp-ident.h" #include "posix-group-func.h" diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c index f125037..20a9433 100644 --- a/ldap/servers/plugins/replication/repl5_replica_config.c +++ b/ldap/servers/plugins/replication/repl5_replica_config.c @@ -3630,6 +3630,7 @@ stop_ruv_cleaning() void cleanruv_log(Slapi_Task *task, int rid, char *task_type, int sev_level, char *fmt, ...) { +#ifdef LDAP_DEBUG va_list ap1; va_list ap2; va_list ap3; @@ -3654,6 +3655,7 @@ cleanruv_log(Slapi_Task *task, int rid, char *task_type, int sev_level, char *fm va_end(ap2); va_end(ap3); va_end(ap4); +#endif } char * diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index 8061f3b..9f8a183 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -1192,7 +1192,11 @@ void slapd_daemon( daemon_ports_t *ports ) tp_config.stacksize = 0; tp_config.event_queue_size = config_get_maxdescriptors(); tp_config.work_queue_size = config_get_maxdescriptors(); +#ifdef LDAP_DEBUG tp_config.log_fct = nunc_stans_logging; +#else + tp_config.log_fct = NULL; +#endif tp_config.log_start_fct = NULL; tp_config.log_close_fct = NULL; tp_config.malloc_fct = nunc_stans_malloc; diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c index 564d7c7..880233f 100644 --- a/ldap/servers/slapd/log.c +++ b/ldap/servers/slapd/log.c @@ -2420,7 +2420,7 @@ vslapd_log_error( * severity - LOG_ERR, LOG_WARNING, LOG_INFO, etc */ int -slapi_log_error( int loglevel, char *subsystem, char *fmt, ... ) +slapi_log_err( int loglevel, char *subsystem, char *fmt, ... ) { va_list ap_err; va_list ap_file; diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 0d3277a..c1a9acf 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -27,6 +27,7 @@ extern "C" { #endif +#include "portable.h" #include "prtypes.h" #include "ldap.h" #include "prprf.h" @@ -57,6 +58,13 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...) ; #endif +/* Define our logging macros */ +#define slapi_log_error(level, subsystem, fmt, ...) +#ifdef LDAP_DEBUG +# undef slapi_log_error +# define slapi_log_error(level, subsystem, ...) slapi_log_err(level, subsystem, __VA_ARGS__) +#endif + /* NSPR uses the print macros a bit differently than ANSI C. We * need to use ll for a 64-bit integer, even when a long is 64-bit. */ @@ -6062,12 +6070,13 @@ int slapi_register_plugin_ext( const char *plugintype, int enabled, /* * logging */ -int slapi_log_error( int loglevel, char *subsystem, char *fmt, ... ) +int slapi_log_err( int loglevel, char *subsystem, char *fmt, ... ) #ifdef __GNUC__ __attribute__ ((format (printf, 3, 4))); #else ; #endif + int slapi_log_error_ext( int loglevel, char *subsystem, char *fmt, va_list varg1, va_list varg2); /* allowed values for the "severity" parameter */

1 0

src/com
by Mark Reynolds 27 Sep '16

27 Sep '16

src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit d2c5e8cd2fb53d642e09f200d93861b142f9615a Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Sep 27 11:31:37 2016 -0400 Ticket 48926 - fix "expiresin" entry definition Bug Description: The "expiresin" component incorrectly set the model to "0", which causes unexpected behaviors in the account policy tab. Fix Description: Set the model to "null" to trigger the correct behavior for this component type. https://fedorahosted.org/389/ticket/48926 Reviewed by: nhosoi(Thanks!) diff --git a/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java b/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java index 0050b39..1a94362 100644 --- a/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java +++ b/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java @@ -512,7 +512,7 @@ public class PasswordPolicyPanel extends BlankPanel { DSEntrySet entries = getDSEntrySet(); - DSEntryExpire expiresInDSEntry = new DSEntryExpire("0", _rbExpiresIn); + DSEntryExpire expiresInDSEntry = new DSEntryExpire(null, _rbExpiresIn); entries.add(_policyspecdn, EXPIRES_ATTR_NAME, expiresInDSEntry); setComponentTable(_rbExpiresIn, expiresInDSEntry);

1 0

Branch '389-ds-base-1.3.5' - ldap/servers
by thierry bordaz 27 Sep '16

27 Sep '16

ldap/servers/slapd/schema.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) New commits: commit e2bc8fd60bf232cd4c1bc9a6860b7bd570a9dff1 Author: Thierry Bordaz <tbordaz(a)redhat.com> Date: Thu Sep 22 20:48:13 2016 +0200 Ticket 48992: Total init may fail if the pushed schema is rejected Bug Description: In the early phase of total update (or incremental update), the supplier may send its schema. A supplier will send its schema to the consumer at the condition its nsSchemaCSN is greater than the consumer nsSchemaCSN. If it is the case, a 1.2.11 supplier will systematically send its schema, while a 1.3 supplier will check that its schema is a superset of the consumer schema before sending it. If a 1.2.11 supplier sends its schema and that schema is a subset of consumer one, then the >1.3 consumer will detect it is a subset and reject the update. In that case the >1.3 consumer rejects a replicated update. On the consumer side, with the fix https://fedorahosted.org/389/ticket/47788, if a replication operation fails, it may trigger the closure of the replication connection. The fix decides, based on the type of failure, if the failure can be ignored (leave the connection opened) or is fatal (close the connection). This is detected, on the consumer side, in multimaster_postop_*->process_postop->ignore_error_and_keep_going. In the current version, if a replicated update of the schema fails it return LDAP_UNWILLING_TO_PERFORM. This is a fatal error regarding ignore_error_and_keep_going that then close the connection and interrupt the total/incremental update. Note this bug can be transient as, the schema learning mechanism (on consumer) may learn from the received schema (even if it is rejected) and update its local schema that increase nsSchemaCSN. If this occur, a later replication session finding a greater nsSchemaCSN on the consumer side will not push the schema Fix Description: When the update of the schema is rejected make it not fatal, switching the returned code from LDAP_UNWILLING_TO_PERFORM to LDAP_CONSTRAINT_VIOLATION https://fedorahosted.org/389/ticket/48992 Reviewed by: Noriko Hosoi, Ludwig Krispenz (thanks to you !) Platforms tested: 7.3 Flag Day: no Doc impact: no diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c index 7689aa9..4b8910d 100644 --- a/ldap/servers/slapd/schema.c +++ b/ldap/servers/slapd/schema.c @@ -2120,7 +2120,24 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr slapi_log_error(SLAPI_LOG_FATAL, "schema", "[C] Local %s must not be overwritten (set replication log for additional info)\n", attr_name); - *returncode = LDAP_UNWILLING_TO_PERFORM; + /* + * If the update (replicated) of the schema is rejected then + * process_postop->ignore_error_and_keep_going will decide if + * this failure is fatal or can be ignored. + * LDAP_UNWILLING_TO_PERFORM is considered as fatal error --> close the connection + * + * A 6.x supplier may send a subset schema and trigger this error, that + * will break the replication session. + * + * With new "learning" mechanism this is not that important if the + * update of the schema is successful or not. Just be permissive + * ignoring that failure to let the full replication session going on + * So return LDAP_CONSTRAINT_VIOLATION (in place of LDAP_UNWILLING_TO_PERFORM) + * is pick up as best choice of non fatal returncode. + * (others better choices UNWILLING_TO_PERFORM, OPERATION_ERROR or ldap_error + * are unfortunately all fatal). + */ + *returncode = LDAP_CONSTRAINT_VIOLATION; return (SLAPI_DSE_CALLBACK_ERROR); } }

1 0

ldap/servers
by thierry bordaz 27 Sep '16

27 Sep '16

ldap/servers/slapd/schema.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) New commits: commit 1b486220105eacf4bd9d5145114e0b1fec78544d Author: Thierry Bordaz <tbordaz(a)redhat.com> Date: Thu Sep 22 20:48:13 2016 +0200 Ticket 48992: Total init may fail if the pushed schema is rejected Bug Description: In the early phase of total update (or incremental update), the supplier may send its schema. A supplier will send its schema to the consumer at the condition its nsSchemaCSN is greater than the consumer nsSchemaCSN. If it is the case, a 1.2.11 supplier will systematically send its schema, while a 1.3 supplier will check that its schema is a superset of the consumer schema before sending it. If a 1.2.11 supplier sends its schema and that schema is a subset of consumer one, then the >1.3 consumer will detect it is a subset and reject the update. In that case the >1.3 consumer rejects a replicated update. On the consumer side, with the fix https://fedorahosted.org/389/ticket/47788, if a replication operation fails, it may trigger the closure of the replication connection. The fix decides, based on the type of failure, if the failure can be ignored (leave the connection opened) or is fatal (close the connection). This is detected, on the consumer side, in multimaster_postop_*->process_postop->ignore_error_and_keep_going. In the current version, if a replicated update of the schema fails it return LDAP_UNWILLING_TO_PERFORM. This is a fatal error regarding ignore_error_and_keep_going that then close the connection and interrupt the total/incremental update. Note this bug can be transient as, the schema learning mechanism (on consumer) may learn from the received schema (even if it is rejected) and update its local schema that increase nsSchemaCSN. If this occur, a later replication session finding a greater nsSchemaCSN on the consumer side will not push the schema Fix Description: When the update of the schema is rejected make it not fatal, switching the returned code from LDAP_UNWILLING_TO_PERFORM to LDAP_CONSTRAINT_VIOLATION https://fedorahosted.org/389/ticket/48992 Reviewed by: Noriko Hosoi, Ludwig Krispenz (thanks to you !) Platforms tested: 7.3 Flag Day: no Doc impact: no diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c index 164dd78..c0581b7 100644 --- a/ldap/servers/slapd/schema.c +++ b/ldap/servers/slapd/schema.c @@ -2120,7 +2120,24 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr slapi_log_error(SLAPI_LOG_ERR, "modify_schema_dse", "[C] Local %s must not be overwritten (set replication log for additional info)\n", attr_name); - *returncode = LDAP_UNWILLING_TO_PERFORM; + /* + * If the update (replicated) of the schema is rejected then + * process_postop->ignore_error_and_keep_going will decide if + * this failure is fatal or can be ignored. + * LDAP_UNWILLING_TO_PERFORM is considered as fatal error --> close the connection + * + * A 6.x supplier may send a subset schema and trigger this error, that + * will break the replication session. + * + * With new "learning" mechanism this is not that important if the + * update of the schema is successful or not. Just be permissive + * ignoring that failure to let the full replication session going on + * So return LDAP_CONSTRAINT_VIOLATION (in place of LDAP_UNWILLING_TO_PERFORM) + * is pick up as best choice of non fatal returncode. + * (others better choices UNWILLING_TO_PERFORM, OPERATION_ERROR or ldap_error + * are unfortunately all fatal). + */ + *returncode = LDAP_CONSTRAINT_VIOLATION; return (SLAPI_DSE_CALLBACK_ERROR); } }

1 0

Changes to 'refs/tags/389-admin-1.1.45'
by Noriko Hosoi 26 Sep '16

26 Sep '16

Changes since 389-admin-1.1.11: Endi S. Dewata (3): Bug 573889 - Migration does not remove deprecated schema Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries Bug 470576 - Migration could do addition checks before commiting actions Ludwig (1): Ticket 47563 - cannot restart directory server from console Mark Reynolds (22): Ticket #286 - compilation fixes for 'format-security' Ticket 401 - Console login fails with anonymous access disabled Ticket 400 - BIND operation result not checked properly in admin server Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry Ticket 47495 - admin express: wrong instance creation time Ticket 47497 - Admin Express - remove "Security Level" Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time Ticket 47300 - Update man page for remove-ds-admin.pl Ticket 47891 - Admin Server reconfig breaks SSL config Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain Ticket 47548 - register-ds-admin does not register into remote config ds Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c Ticket 201 - nCipher HSM cannot be configured via the console Ticket 47929 - Admin Server - disable SSLv3 by default Ticket 47548 - register-ds-admin.pl fails to set local bind DN and password Ticket 47548 - register-ds-admin - silent file incorrectly processed Ticket 48213 - Admin server registration requires anonymous binds Ticket 48306 - perl module conditional test is not conditional when checking SELinux policies Ticket 48907 - register-ds-admin fails to find local config DS TIcket 48823 - Admin Server - Add IPv6 support Ticket 48932 - stopping admin server stops all httpd processes Nathan Kinder (49): Bug 648949 - Merge selinux policy into base OS Regenerated autoconf files Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled Bug 668950 - Add posix group support to Console Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH Bug 618897 - Wrong permissions when creating instance from Console Bug 493424 - remove unneeded modules for admin server apache config Bug 614690 - Don't use exec to call genrb Bug 699815 - (cov#10859) Add missing braces in mod_admserv code Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi Bug 699815 - (cov#10849,10851) Remove unused variables Bug 699907 - (cov#10844) Uninitialized time struct Bug 699907 - (cov#10843) Use of uninitialized variable in logging code Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi Bug 699907 - (cov#10836) Use of uninitialized var in http conn code Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code Bug 700532 - (cov#10832) Incorrect if condition in dsalib Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib Bug 700890 - (cov#10812) Check return value of open() properly in libadmin Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi Bug 700948 - (cov#10842) Use of unintialized variable in statusping Bug 700948 - (cov#10842) Use of unintialized variable in statusping Bug 702150 - (cov#10823) File descriptors leaked in help cgi Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi Bug 702150 - leak of config array in dsalib Bug 702150 - (cov#10816) file descriptor leak in dsalib Bug 702150 - (cov#10817) Leak of string in libdsa Bug 702150 - Resouce leaks in htmladmin.c Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin Bug 702705 - NULL pointer dereferences in viewlog cgi Bug 702705 - (cov#10803) NULL pointer dereference in security cgi Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy Bug 724808 - startup CGIs write temp file to / Bug 730079 - Update SELinux policy during upgrades Ticket #329 - Port modules to httpd 2.4 Ticket #47333 - Relabel lockfile when starting Admin Server Ticket #47334 - Avoid quoting all settings in console.conf Ticket 47468 - Change security password validation error is out of order Ticket 47466 - Importing CA cert with existing name crashes security CGI Ticket 362 - Directory Console generates insufficient key strength Ticket 47467 - Improve CRL import error messages Noriko Hosoi (46): Bug 151705 - Need to update Console Cipher Preferences with new ciphers start-ds-admin.in -- replaced "return 1" with "exit 1" Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies Bug 618858 - move start-ds-admin env file into main admin server Bug 387981 - plain files can be chosen on the Restore Directory dialog Bug 604881 - admin server log files have incorrect permissions/ownerships Bug 604881 - admin server log files have incorrect permissions/ownerships Bug 245278 - Changing to a password with a single quote does not work Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc) Bug 158926 - Unable to install CA certificate when using Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user Bug 476925 - Admin Server: Do not allow 8-bit passwords for Trac Ticket #307 - htmladmin keeps segfaulting If htmladmin fails to connect to the server, the cgi could crash. Ticket #293 - remove-ds-admin.pl does not remove everything Ticket #476 - 389 ds do not start on F18 due to missing modules bump version to 1.1.31 Ticket #567 - Restart of Admin server from console fails on segfault bump version to 1.1.32 bump version to 1.1.33 bump version to 1.1.34 Ticket #47493 - Configuration Tab does not work with FIPS mode enabled bump version to 1.1.36 Ticket 47891 - Admin Server reconfig breaks SSL config Ticket #47995 - Admin Server: source code cleaning bump version to 1.1.37 Ticket #48024 - repl-monitor invoked from adminserver cgi fails bump version to 1.1.38 Ticket #48153 - [adminserver] support NSS 3.18 bump version to 1.1.39 Ticket #48171 - remove-ds-admin.pl removes files in the rpm Ticket #47467 - Improve Add CRL/CKL dialog and errors bump version to 1.1.40 Ticket #48186 - register-ds-admin.pl script prints clear text password in the terminal Ticket #47493 - Configuration Tab does not work with FIPS mode enabled bump version to 1.1.41 bump version to 1.1.42 Ticket #48409 - RHDS upgrade change Ownership of certificate files upon upgrade. Ticket #48410 - 389-admin - Unable to remove / unregister a DS instance from admin server Ticket #48429 - running remove-ds-admin.pl multiple times will make it so you cannot install DS bump version to 1.1.43 Ticket #47413 - 389-admin fails to build with latest httpd Bug 1236635 - 389-admin TPS srpmtest failure bump version to 1.1.44 Ticket #48988 - ds_removal and ds_unregister should support prompting for password bump version to 1.1.45 Rich Megginson (66): bump version to 1.1.12.a1 initial support for openldap add selinux policy for dsgw skip LD_PRELOAD if using openldap add more log information if nss init fails add even more nss debugging Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized bump version to 1.1.12.a2 fix building with mozldap bump version to 1.1.12.a3 fix autotool build issues with properties files setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error Bug 656441 - Missing library path entry causes LD_PRELOAD error bump version to 1.1.13 bump version to 1.1.14.a1 Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required bump version to 1.1.14 bump version to 1.1.15 bump version to 1.1.16 Bug 703990 - Support upgrade from Red Hat Directory Server bump version to 1.1.17 add support for different skins skip rebranding current brand bump version to 1.1.18 look for separate openldap ldif library bump version to 1.1.19 Bug 710372 - Not able to open the Manage Certificate from DS-console better NSS error handling - reduce memory leaks fix typo in NSS_Shutdown warning message added tests for the security cgi Bug 713000 - Migration stops if old admin server cannot be stopped Bug 718079 - Perl errors when running migrate-ds-admin.pl Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts bump version to 1.1.20 bump version to 1.1.21 handle binary upgrade add man pages for ds_removal and ds_unregister bump version to 1.1.22 fix binary paths bump version to 1.1.23 bump version to 1.1.24 Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd Bug 740959 - 389-console put CA certificates into wrong database bump version to 1.1.25 Bug 767823 - selinux: need to allow admin server to connect to ldap port bump version to 1.1.26 Ticket #161 - Review and address latest Coverity issues Ticket #281 - TLS not working with latest openldap bump version to 1.1.27 bump version to 1.1.28 bump version to 1.1.29 bump version to 1.1.30 ignore files generated by Eclipse Ticket #47486 compiler warnings in adminutil, admin, dsgw Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw add more debugging for SSL connection problems Ticket #47413 389-admin fails to build with latest httpd compiler warning - ldif_read_record lineno type depends on openldap version add Eclipse and patch files bump version to 1.1.35 Ticket #47498 Error Message for Failed to create the configuration directory server Ticket #418 Error with register-ds-admin.pl Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down. Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>" Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour Ticket #47478 No groups file? error restarting Admin server Wes Hardin (1): fix for bug 377 - Unchecked use of SELinux command William Brown (2): Ticket 47840 - Fix setup-ds-admin.pl to create adm.conf with sbin scripts Ticket 48931 - start-ds-admin should use systemctl noriko (1): Ticket #47298 - remove-ds-admin.pl does not stop the admin server --- .gitignore | 4 Makefile.am | 113 Makefile.in | 2110 - VERSION.sh | 4 aclocal.m4 | 7614 ---- admserv/cfgstuff/console.conf.in | 6 admserv/cfgstuff/ds_removal.in | 7 admserv/cfgstuff/ds_unregister.in | 7 admserv/cfgstuff/httpd-2.2.conf.in | 13 admserv/cfgstuff/httpd-2.4.conf.in | 742 admserv/cfgstuff/httpd.conf.in | 2 admserv/cfgstuff/initconfig.in | 5 admserv/cfgstuff/restart-ds-admin.in | 12 admserv/cfgstuff/start-ds-admin.in | 114 admserv/cfgstuff/stop-ds-admin.in | 55 admserv/cgi-ds/ds_listdb.c | 26 admserv/cgi-ds/ds_snmpctrl.c | 5 admserv/cgi-src40/ReadLog.c | 18 admserv/cgi-src40/admlib.mk | 119 admserv/cgi-src40/admpw.c | 79 admserv/cgi-src40/cgicommon.h | 1 admserv/cgi-src40/cgicommon.properties | 3 admserv/cgi-src40/config.c | 47 admserv/cgi-src40/dllglue.c | 42 admserv/cgi-src40/ds_create.in | 18 admserv/cgi-src40/ds_remove.in | 6 admserv/cgi-src40/dsconfig.c | 10 admserv/cgi-src40/head.html | 1 admserv/cgi-src40/help.c | 15 admserv/cgi-src40/htmladmin.c | 810 admserv/cgi-src40/htmladmin.properties | 42 admserv/cgi-src40/monreplication.c | 7 admserv/cgi-src40/repl-monitor-cgi.pl.in | 30 admserv/cgi-src40/restartsrv.c | 9 admserv/cgi-src40/sec-activate.c | 163 admserv/cgi-src40/security.c | 348 admserv/cgi-src40/security.properties | 8 admserv/cgi-src40/start_config_ds.c | 11 admserv/cgi-src40/statpingserv.c | 82 admserv/cgi-src40/stopsrv.c | 10 admserv/cgi-src40/ugdsconfig.c | 39 admserv/cgi-src40/viewdata.c | 264 admserv/cgi-src40/viewdata.properties | 2 admserv/cgi-src40/viewlog.c | 75 admserv/cgi-src40/viewlog.properties | 6 admserv/genrb_wrapper.sh | 2 admserv/html/admserv.html.in | 11 admserv/html/htmladmin.html.in | 13 admserv/html/monreplication.html | 20 admserv/html/viewdata.html | 6 admserv/html/viewlog.html | 14 admserv/makeUpgradeTar.sh | 30 admserv/newinst/src/25changefedorato389.pl | 250 admserv/newinst/src/25rebrand.pl.in | 413 admserv/newinst/src/30updateglobalpref.pl.in | 9 admserv/newinst/src/AdminMigration.pm.in | 79 admserv/newinst/src/AdminServer.pm.in | 299 admserv/newinst/src/AdminUtil.pm.in | 183 admserv/newinst/src/ConfigDSDialogs.pm | 42 admserv/newinst/src/dirserver.map.in | 1 admserv/newinst/src/register-ds-admin.pl.in | 719 admserv/newinst/src/register-ds-admin.res.in | 38 admserv/newinst/src/register_param.map.in | 4 admserv/newinst/src/register_server.pl.in | 6 admserv/newinst/src/remove-ds-admin.pl.in | 8 admserv/newinst/src/setup-ds-admin.pl.in | 6 admserv/newinst/src/setup-ds-admin.res.in | 20 admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49 admserv/schema/ldif/10dsdata.ldif.tmpl | 39 compile | 245 config.guess | 768 config.h.in | 36 config.sub | 452 configure |38679 +++++++++------------- configure.ac | 111 depcomp | 637 include/base/file.h | 3 include/base/util.h | 3 include/libadmin/dbtlibadmin.h | 2 include/libadmin/libadmin.h | 92 include/libdsa/dsalib.h | 15 install-sh | 526 lib/base/file.cpp | 30 lib/base/nscputil.cpp | 51 lib/libadmin/dllglue.c | 77 lib/libadmin/httpcon.c | 5 lib/libadmin/referer.c | 4 lib/libadmin/template.c | 29 lib/libadmin/util.c | 973 lib/libdsa/dsalib_conf.c | 37 lib/libdsa/dsalib_confs.c | 93 lib/libdsa/dsalib_location.c | 56 lib/libdsa/dsalib_tailf.c | 1 lib/libdsa/dsalib_updown.c | 118 lib/libdsa/dsalib_util.c | 56 ltmain.sh |14878 +++++--- m4/adminutil.m4 | 4 m4/httpd.m4 | 3 m4/mod_nss.m4 | 2 m4/mozldap.m4 | 116 m4/openldap.m4 | 138 m4/selinux.m4 | 3 man/man8/ds_removal.8 | 54 man/man8/ds_unregister.8 | 48 man/man8/register-ds-admin.pl.8 | 139 man/man8/remove-ds-admin.pl.8 | 10 man/man8/restart-ds-admin.8 | 10 man/man8/start-ds-admin.8 | 10 man/man8/stop-ds-admin.8 | 10 missing | 453 mod_admserv/mod_admserv.c | 564 mod_admserv/mod_admserv.h | 15 mod_restartd/mod_restartd-2.2.c | 22 selinux/dirsrv-admin.fc.in | 5 selinux/dirsrv-admin.te | 2 tests/ds_create/testget.1 | 2 tests/htmladmin/testget.2 | 2 tests/htmladmin/testget.3 | 2 tests/htmladmin/testget.4 | 2 tests/htmladmin/testget.5 | 2 tests/htmladmin/testget.6 | 2 tests/htmladmin/testget.7 | 2 tests/htmladmin/testget.8 | 2 tests/security/testpost.1 | 1 tests/security/testpost.10 | 1 tests/security/testpost.11 | 1 tests/security/testpost.12 | 1 tests/security/testpost.13 | 1 tests/security/testpost.14 | 1 tests/security/testpost.15 | 1 tests/security/testpost.16 | 1 tests/security/testpost.17 | 1 tests/security/testpost.18 | 1 tests/security/testpost.19 | 1 tests/security/testpost.2 | 1 tests/security/testpost.20 | 1 tests/security/testpost.21 | 1 tests/security/testpost.3 | 1 tests/security/testpost.4 | 1 tests/security/testpost.5 | 1 tests/security/testpost.6 | 1 tests/security/testpost.7 | 1 tests/security/testpost.8 | 1 tests/security/testpost.9 | 1 tests/setup.sh | 250 tests/ugdsconfig/testget.10 | 2 tests/viewdata/testget.2 | 2 tests/viewdata/testget.3 | 2 tests/viewdata/testget.4 | 2 tests/viewlog/testget.3 | 2 tests/viewlog/testget.4 | 2 wrappers/initscript.in | 3 wrappers/systemd.service.in | 24 153 files changed, 36308 insertions(+), 38968 deletions(-) ---

1 0

VERSION.sh
by Noriko Hosoi 26 Sep '16

26 Sep '16

VERSION.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit b55fec15335baf5443bb0ccfbbc1ea8041f199eb Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Mon Sep 26 16:55:14 2016 -0700 bump version to 1.1.45 diff --git a/VERSION.sh b/VERSION.sh index 497fa68..4e1f314 100644 --- a/VERSION.sh +++ b/VERSION.sh @@ -11,7 +11,7 @@ vendorurl=http://port389.org # PACKAGE_VERSION is constructed from these VERSION_MAJOR=1 VERSION_MINOR=1 -VERSION_MAINT=44 +VERSION_MAINT=45 # if this is a PRERELEASE, set VERSION_PREREL # otherwise, comment it out # be sure to include the dot prefix in the prerel

1 0

Branch '389-ds-base-1.3.4' - ldap/servers
by Ludwig Krispenz 26 Sep '16

26 Sep '16

ldap/servers/plugins/replication/cl5_clcache.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) New commits: commit fba9d48c4a6bf5ca2b148ed2e544e9b65f67dcbc Author: Thierry Bordaz <tbordaz(a)redhat.com> Date: Thu Sep 8 11:38:15 2016 +0200 use a consumer maxcsn only as anchor if supplier is more advanced diff --git a/ldap/servers/plugins/replication/cl5_clcache.c b/ldap/servers/plugins/replication/cl5_clcache.c index 74f0fec..ca8b841 100644 --- a/ldap/servers/plugins/replication/cl5_clcache.c +++ b/ldap/servers/plugins/replication/cl5_clcache.c @@ -717,24 +717,22 @@ clcache_adjust_anchorcsn ( CLC_Buffer *buf, int *flag ) curr, conmaxcsn); } - if (csn_compare (cscb->local_maxcsn, cscb->prev_local_maxcsn) == 0 || - csn_compare (cscb->prev_local_maxcsn, buf->buf_current_csn) > 0 ) { - if (csn_compare (cscb->local_maxcsn, cscb->consumer_maxcsn) > 0 ) { + if (csn_compare(cscb->local_maxcsn, cscb->consumer_maxcsn) > 0) { + /* We have something to send for this RID */ + + if (csn_compare(cscb->local_maxcsn, cscb->prev_local_maxcsn) == 0 || + csn_compare(cscb->prev_local_maxcsn, buf->buf_current_csn) > 0) { + /* No new changes or it remains, in the buffer, updates to send */ rid_anchor = buf->buf_current_csn; - } - } else { - /* prev local max csn < csnBuffer AND different from local maxcsn */ - if (cscb->prev_local_maxcsn == NULL) { + } else { + /* prev local max csn < csnBuffer AND different from local maxcsn */ if (cscb->consumer_maxcsn == NULL) { /* the consumer hasn't seen changes for this RID */ rid_anchor = cscb->local_mincsn; rid_flag = DB_SET; - } else if ( csn_compare (cscb->local_maxcsn, cscb->consumer_maxcsn) > 0 ) { + } else { rid_anchor = cscb->consumer_maxcsn; } - } else { - /* csnPrevMaxSup > 0 */ - rid_anchor = cscb->consumer_maxcsn; } }

1 0

dirsrvtests/tests ldap/servers
by Mark Reynolds 26 Sep '16

26 Sep '16

dirsrvtests/tests/tickets/ticket47431_test.py | 2 +- dirsrvtests/tests/tickets/ticket47823_test.py | 14 +++++++------- dirsrvtests/tests/tickets/ticket48784_test.py | 2 +- ldap/servers/plugins/uiduniq/uid.c | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) New commits: commit b3a167557c65036eee98b2bcce90e3e86869b368 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Mon Sep 26 10:25:44 2016 -0400 Ticket 48978 - Fix CI test to account for new logging format Description: There are some tests that check for error log messages, but those messages have slightly changed in the new format. Updated the tests to account for the new log messages. https://fedorahosted.org/389/ticket/48978 Reviewed by: spichugi(Thanks!) diff --git a/dirsrvtests/tests/tickets/ticket47431_test.py b/dirsrvtests/tests/tickets/ticket47431_test.py index 00d3f98..27a52b9 100644 --- a/dirsrvtests/tests/tickets/ticket47431_test.py +++ b/dirsrvtests/tests/tickets/ticket47431_test.py @@ -81,7 +81,7 @@ def test_ticket47431_1(topology): ''' log.info("Ticket 47431 - 1: Check 26 duplicate values are treated as one...") - expected = "str2entry_dupcheck: .* duplicate values for attribute type nsslapd-pluginarg2 detected in entry cn=7-bit check,cn=plugins,cn=config." + expected = "str2entry_dupcheck - .* duplicate values for attribute type nsslapd-pluginarg2 detected in entry cn=7-bit check,cn=plugins,cn=config." log.debug('modify_s %s' % DN_7BITPLUGIN) try: diff --git a/dirsrvtests/tests/tickets/ticket47823_test.py b/dirsrvtests/tests/tickets/ticket47823_test.py index ba5d110..4d6058a 100644 --- a/dirsrvtests/tests/tickets/ticket47823_test.py +++ b/dirsrvtests/tests/tickets/ticket47823_test.py @@ -643,7 +643,7 @@ def test_ticket47823_invalid_config_1(topology): pass # Check the expected error message - regex = re.compile("Config fail: unable to parse old style") + regex = re.compile("Unable to parse old style") res = _pattern_errorlog(topology.standalone.errorlog_file, regex) if not res: # be sure to restore a valid config before assert @@ -694,7 +694,7 @@ def test_ticket47823_invalid_config_2(topology): pass # Check the expected error message - regex = re.compile("Config info: No valid subtree is defined") + regex = re.compile("No valid subtree is defined") res = _pattern_errorlog(topology.standalone.errorlog_file, regex) if not res: # be sure to restore a valid config before assert @@ -747,7 +747,7 @@ def test_ticket47823_invalid_config_3(topology): pass # Check the expected error message - regex = re.compile("Config fail: unable to parse old style") + regex = re.compile("Unable to parse old style") res = _pattern_errorlog(topology.standalone.errorlog_file, regex) if not res: # be sure to restore a valid config before assert @@ -799,7 +799,7 @@ def test_ticket47823_invalid_config_4(topology): pass # Check the expected error message - regex = re.compile("Config info: No valid subtree is defined") + regex = re.compile("No valid subtree is defined") res = _pattern_errorlog(topology.standalone.errorlog_file, regex) if not res: # be sure to restore a valid config before assert @@ -850,7 +850,7 @@ def test_ticket47823_invalid_config_5(topology): pass # Check the expected error message - regex = re.compile("Config info: attribute name not defined") + regex = re.compile("Attribute name not defined") res = _pattern_errorlog(topology.standalone.errorlog_file, regex) if not res: # be sure to restore a valid config before assert @@ -901,7 +901,7 @@ def test_ticket47823_invalid_config_6(topology): pass # Check the expected error message - regex = re.compile("Config info: objectclass for subtree entries is not defined") + regex = re.compile("Objectclass for subtree entries is not defined") res = _pattern_errorlog(topology.standalone.errorlog_file, regex) if not res: # be sure to restore a valid config before assert @@ -952,7 +952,7 @@ def test_ticket47823_invalid_config_7(topology): pass # Check the expected error message - regex = re.compile("Config info: No valid subtree is defined") + regex = re.compile("No valid subtree is defined") res = _pattern_errorlog(topology.standalone.errorlog_file, regex) if not res: # be sure to restore a valid config before assert diff --git a/dirsrvtests/tests/tickets/ticket48784_test.py b/dirsrvtests/tests/tickets/ticket48784_test.py index fca6d9e..bc69308 100644 --- a/dirsrvtests/tests/tickets/ticket48784_test.py +++ b/dirsrvtests/tests/tickets/ticket48784_test.py @@ -426,7 +426,7 @@ def test_ticket48784(topology): log.info('##### Searching for entries on master1...') entries = topology.master1.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, '(uid=*)') - assert 12 == len(entries) + assert 11 == len(entries) # This is supposed to be "1" less than master 2's entry count log.info('##### Searching for entries on master2...') entries = topology.master2.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, '(uid=*)') diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c index f05e15c..d1d0162 100644 --- a/ldap/servers/plugins/uiduniq/uid.c +++ b/ldap/servers/plugins/uiduniq/uid.c @@ -384,7 +384,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry) if (tmp_config->subtrees == NULL) { /* Uniqueness is enforced on entries matching objectclass */ if (tmp_config->subtree_entries_oc == NULL) { - slapi_log_error(SLAPI_LOG_ERR, plugin_name, "uniqueness_entry_to_config - objectclass for subtree entries is not defined\n"); + slapi_log_error(SLAPI_LOG_ERR, plugin_name, "uniqueness_entry_to_config - Objectclass for subtree entries is not defined\n"); rc = SLAPI_PLUGIN_FAILURE; goto done; }

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits September 2016