VERSION.sh | 2 - ldap/servers/plugins/deref/deref.c | 6 ++++ ldap/servers/slapd/attr.c | 9 +++++- ldap/servers/slapd/auditlog.c | 17 +++++++++++ ldap/servers/slapd/back-ldbm/ldbm_modify.c | 5 +++ ldap/servers/slapd/entry.c | 43 +++++++++++++++++++++++++---- ldap/servers/slapd/entrywsi.c | 29 ++++++++++++++++--- ldap/servers/slapd/libglobs.c | 19 ++++++++++++ ldap/servers/slapd/pblock.c | 16 ++++++++++ ldap/servers/slapd/plugin_internal_op.c | 27 ++++++++++++++---- ldap/servers/slapd/proto-slap.h | 5 ++- ldap/servers/slapd/pw_mgmt.c | 5 ++- ldap/servers/slapd/schema.c | 15 ++++++---- ldap/servers/slapd/slap.h | 2 + ldap/servers/slapd/slapi-private.h | 1 15 files changed, 176 insertions(+), 25 deletions(-)
New commits: commit 82abebea0b5e3c0b54dca17385edcce4f67ba9bb Author: Rich Megginson rmeggins@redhat.com Date: Thu Jun 21 15:22:48 2012 -0600
bump version to 1.2.10.11
diff --git a/VERSION.sh b/VERSION.sh index 1fdb59e..7dc03d0 100644 --- a/VERSION.sh +++ b/VERSION.sh @@ -10,7 +10,7 @@ vendor="389 Project" # PACKAGE_VERSION is constructed from these VERSION_MAJOR=1 VERSION_MINOR=2 -VERSION_MAINT=10.10 +VERSION_MAINT=10.11 # if this is a PRERELEASE, set VERSION_PREREL # otherwise, comment it out # be sure to include the dot prefix in the prerel
commit 271f6556e4b5f6fb568ff2a1bed869fdf787be5a Author: Noriko Hosoi nhosoi@totoro.usersys.redhat.com Date: Tue Jun 12 16:41:39 2012 -0700
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 830001 - unhashed#user#password visible after changing password [rhel-6.3] https://bugzilla.redhat.com/show_bug.cgi?id=830001
Bug Description: unhashed#user#password is skipped to check acl in acl_check_mod.
Fix Description: Set SLAPI_ATTR_FLAG_NOUSERMOD to unhashed#user# password schema. It makes clients' modifying the unhashed password fail by UNWILLING TO PERFORM. (cherry picked from commit 1629311d7201a6a7842db15865e02042a2894383)
diff --git a/ldap/servers/slapd/pw_mgmt.c b/ldap/servers/slapd/pw_mgmt.c index 28b0491..d6c897d 100644 --- a/ldap/servers/slapd/pw_mgmt.c +++ b/ldap/servers/slapd/pw_mgmt.c @@ -308,7 +308,10 @@ pw_init ( void ) {
slapi_add_internal_attr_syntax( PSEUDO_ATTR_UNHASHEDUSERPASSWORD, PSEUDO_ATTR_UNHASHEDUSERPASSWORD_OID, - OCTETSTRING_SYNTAX_OID, 0, 0 ); + OCTETSTRING_SYNTAX_OID, 0, + /* Clients don't need to directly modify + * PSEUDO_ATTR_UNHASHEDUSERPASSWORD */ + SLAPI_ATTR_FLAG_NOUSERMOD ); }
commit f3c6aa463a133f9d1160042cf78463128601f173 Author: Noriko Hosoi nhosoi@totoro.usersys.redhat.com Date: Mon Jun 11 16:57:50 2012 -0700
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 830001 - unhashed#user#password visible after changing password [rhel-6.3] https://bugzilla.redhat.com/show_bug.cgi?id=830001
Bug Description: Deref still retrieved unhashed password.
Fix Description: Added code to Deref plugin to check the deref attribute. If it is unhashed password, skip it. (cherry picked from commit 26b5121d84232cf453fa917f11ba6518a40358ea)
diff --git a/ldap/servers/plugins/deref/deref.c b/ldap/servers/plugins/deref/deref.c index 86055b2..772601c 100644 --- a/ldap/servers/plugins/deref/deref.c +++ b/ldap/servers/plugins/deref/deref.c @@ -634,6 +634,12 @@ deref_do_deref_attr(Slapi_PBlock *pb, BerElement *ctrlber, const char *derefdn, int needpartialattr = 1; /* need PartialAttribute sequence? */ int needvalsset = 1;
+ if (is_type_forbidden(retattrs[ii])) { + slapi_log_error(SLAPI_LOG_PLUGIN, DEREF_PLUGIN_SUBSYSTEM, + "skip forbidden attribute [%s]\n", derefdn); + continue; + } + deref_get_values(entries[0], retattrs[ii], &results, &type_name_disposition, &actual_type_name, flags, &buffer_flags);
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 202fd7c..1c48793 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -624,7 +624,7 @@ int is_rootdse( const char *dn ); int get_entry_object_type(); int entry_computed_attr_init(); void send_referrals_from_entry(Slapi_PBlock *pb, Slapi_Entry *referral); - +int is_type_forbidden(const char *type);
/* * dse.c diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h index ce2e03c..db4a317 100644 --- a/ldap/servers/slapd/slapi-private.h +++ b/ldap/servers/slapd/slapi-private.h @@ -331,7 +331,6 @@ int entry_next_deleted_attribute( const Slapi_Entry *e, Slapi_Attr **a); /* entry.c */ int entry_apply_mods( Slapi_Entry *e, LDAPMod **mods ); int is_type_protected(const char *type); -int is_type_forbidden(const char *type);
int slapi_entries_diff(Slapi_Entry **old_entries, Slapi_Entry **new_entries, int testall, const char *logging_prestr, const int force_update, void *plg_id);
commit f91a1fd94f5a488e237f0d36e96d8db105c58ea7 Author: Noriko Hosoi nhosoi@totoro.usersys.redhat.com Date: Fri Jun 8 14:22:24 2012 -0700
Ticket 365 - passwords in clear text in the audit log
Bug Description: after changing a user password, an additional modify is added to the mods: "unhashed#user#password: <clear text password>"
e.g. PSEUDO_ATTR_UNHASHEDUSERPASSWORD
Fix Description: Added new config param "nsslapd-audit-logging-hide-unhashed-pw". The default is "on". When "on" that single modify op is skipped from the audit logging.
https://fedorahosted.org/389/ticket/365
(cherry picked from commit 43fb648fd4d7663c61c7ea7ff649ffddb9cbf006) (cherry picked from commit 2f24c1f557c3698fb0ecf36b8187b30a6223f8af)
diff --git a/ldap/servers/slapd/auditlog.c b/ldap/servers/slapd/auditlog.c index 0128f2f..7dd8ff6 100644 --- a/ldap/servers/slapd/auditlog.c +++ b/ldap/servers/slapd/auditlog.c @@ -55,6 +55,7 @@ char *attr_changetype = ATTR_CHANGETYPE; char *attr_newrdn = ATTR_NEWRDN; char *attr_deleteoldrdn = ATTR_DELETEOLDRDN; char *attr_modifiersname = ATTR_MODIFIERSNAME; +static int hide_unhashed_pw = 1;
/* Forward Declarations */ static void write_audit_file( int optype, const char *dn, void *change, int flag, time_t curtime ); @@ -151,6 +152,10 @@ write_audit_file( for ( j = 0; mods[j] != NULL; j++ ) { int operationtype= mods[j]->mod_op & ~LDAP_MOD_BVALUES; + + if((strcmp(mods[j]->mod_type, PSEUDO_ATTR_UNHASHEDUSERPASSWORD) == 0) && hide_unhashed_pw){ + continue; + } switch ( operationtype ) { case LDAP_MOD_ADD: @@ -245,3 +250,15 @@ write_audit_file(
lenstr_free( &l ); } + +void +auditlog_hide_unhashed_pw() +{ + hide_unhashed_pw = 1; +} + +void +auditlog_expose_unhashed_pw() +{ + hide_unhashed_pw = 0; +} diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index aafbd7e..14f8f20 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -453,6 +453,9 @@ static struct config_get_and_set { {CONFIG_AUDITLOG_LOGGING_ENABLED_ATTRIBUTE, NULL, log_set_logging, SLAPD_AUDIT_LOG, (void**)&global_slapdFrontendConfig.auditlog_logging_enabled, CONFIG_ON_OFF, NULL}, + {CONFIG_AUDITLOG_LOGGING_HIDE_UNHASHED_PW, config_set_auditlog_unhashed_pw, + NULL, 0, + (void**)&global_slapdFrontendConfig.auditlog_logging_hide_unhashed_pw, CONFIG_ON_OFF, NULL}, {CONFIG_ACCESSLOG_BUFFERING_ATTRIBUTE, config_set_accesslogbuffering, NULL, 0, (void**)&global_slapdFrontendConfig.accesslogbuffering, CONFIG_ON_OFF, NULL}, @@ -1040,6 +1043,7 @@ FrontendConfig_init () { cfg->auditlog_minfreespace = 5; cfg->auditlog_exptime = 1; cfg->auditlog_exptimeunit = slapi_ch_strdup("month"); + cfg->auditlog_logging_hide_unhashed_pw = LDAP_ON;
cfg->entryusn_global = LDAP_OFF; cfg->entryusn_import_init = slapi_ch_strdup("0"); @@ -1133,6 +1137,21 @@ get_entry_point( int ep_name, caddr_t *ep_addr ) return rc; }
+int +config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply) +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS; + + retVal = config_set_onoff ( attrname, value, &(slapdFrontendConfig->auditlog_logging_hide_unhashed_pw), + errorbuf, apply); + if(strcasecmp(value,"on") == 0){ + auditlog_hide_unhashed_pw(); + } else { + auditlog_expose_unhashed_pw(); + } + return retVal; +}
/* * Utility function called by many of the config_set_XXX() functions. diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index e60d1a8..202fd7c 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -379,6 +379,7 @@ int config_set_entryusn_global( const char *attrname, char *value, char *errorbu int config_set_allowed_to_delete_attrs( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_entryusn_import_init( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_default_naming_context( const char *attrname, char *value, char *errorbuf, int apply ); +int config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply);
#if !defined(_WIN32) && !defined(AIX) int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply ); @@ -1176,6 +1177,8 @@ void factory_destroy_extension(int type,void *object,void *parent,void **extensi */
void write_audit_log_entry( Slapi_PBlock *pb); +void auditlog_hide_unhashed_pw(); +void auditlog_expose_unhashed_pw();
/* * eventq.c diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index b855ff0..c01e590 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1856,6 +1856,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_ACCESSLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-accesslog-logging-enabled" #define CONFIG_ERRORLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-errorlog-logging-enabled" #define CONFIG_AUDITLOG_LOGGING_ENABLED_ATTRIBUTE "nsslapd-auditlog-logging-enabled" +#define CONFIG_AUDITLOG_LOGGING_HIDE_UNHASHED_PW "nsslapd-auditlog-logging-hide-unhashed-pw" #define CONFIG_ROOTDN_ATTRIBUTE "nsslapd-rootdn" #define CONFIG_ROOTPW_ATTRIBUTE "nsslapd-rootpw" #define CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE "nsslapd-rootpwstoragescheme" @@ -2134,6 +2135,7 @@ typedef struct _slapdFrontendConfig { int auditlog_minfreespace; int auditlog_exptime; char *auditlog_exptimeunit; + int auditlog_logging_hide_unhashed_pw;
int return_exact_case; /* Return attribute names with the same case * as they appear in at.conf */
commit 7059152aad67625f7d5bd56e8a6b2b7f5cec2b70 Author: Noriko Hosoi nhosoi@totoro.usersys.redhat.com Date: Fri Jun 8 11:39:56 2012 -0700
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 830001 - unhashed#user#password visible after changing password [rhel-6.3] https://bugzilla.redhat.com/show_bug.cgi?id=830001
Bug Description: unhashed password is stored in the entry in memory when an entry/a password is added or the password is modified. The password could be visible by the ordinary search if the type "unhashed#user#password" is specified in the attribute list.
Fix Description: 1. Set "unhashed#user#password" to the forbidden attribute list, which is dropped from the search attribute list. 2. Get effective right does not return "unhashed#user#password" 3. In the modify operation, adding "unhashed#user#password" to or deleting "unhashed#user#password" from the entry never returns an error regardless of the attribute value. Internally, the operation is ignored. (cherry picked from commit 9df3c438ebd05bbaa5e7b2506fc5d5e9f3ff4a95) (Fixed conflicts in ldap/servers/slapd/{entry.c,entrywsi.c,slapi-private.h) (cherry picked from commit 8f0811a86a1b233cf9566349653ef7f184278144)
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c index 26d5947..6072ba4 100644 --- a/ldap/servers/slapd/attr.c +++ b/ldap/servers/slapd/attr.c @@ -805,7 +805,14 @@ attr_add_valuearray(Slapi_Attr *a, Slapi_Value **vals, const char *dn) for ( i = 0; vals[i] != NULL; ++i ) { if ( slapi_attr_value_find( a, slapi_value_get_berval(vals[i]) ) == 0 ) { duplicate_index = i; - rc = LDAP_TYPE_OR_VALUE_EXISTS; + if (is_type_forbidden(a->a_type)) { + /* If the attr is in the forbidden list + * (e.g., unhashed password), + * we don't return any useful info to the clients. */ + rc = LDAP_OTHER; + } else { + rc = LDAP_TYPE_OR_VALUE_EXISTS; + } break; } } diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modify.c b/ldap/servers/slapd/back-ldbm/ldbm_modify.c index 943a095..ca8216f 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_modify.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_modify.c @@ -336,6 +336,11 @@ ldbm_back_modify( Slapi_PBlock *pb ) } if ( !change_entry || ldap_result_code != 0 ) { /* change_entry == 0 is not an error, but we need to free lock etc */ + if (LDAP_OTHER == ldap_result_code) { + /* We don't proceed the op, but we don't want to return the reason. + * E.g., unhashed password modify failed. */ + ldap_result_code = 0; + } goto error_return; } } diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c index 5afba09..a292b87 100644 --- a/ldap/servers/slapd/entry.c +++ b/ldap/servers/slapd/entry.c @@ -63,7 +63,6 @@
/* a helper function to set special rdn to a tombstone entry */ static int _entry_set_tombstone_rdn(Slapi_Entry *e, const char *normdn); -static int is_type_protected(const char *type);
/* protected attributes which are not included in the flattened entry, * which will be stored in the db. */ @@ -71,6 +70,9 @@ static char *protected_attrs_all [] = {PSEUDO_ATTR_UNHASHEDUSERPASSWORD, SLAPI_ATTR_ENTRYDN, NULL};
+static char *forbidden_attrs [] = {PSEUDO_ATTR_UNHASHEDUSERPASSWORD, + NULL}; + /* * An attribute name is of the form 'basename[;option]'. * The state informaion is encoded in options. For example: @@ -1613,7 +1615,7 @@ entry2str_internal_put_valueset( const char *attrtype, const CSN *attrcsn, CSNTy } }
-static int +int is_type_protected(const char *type) { char **paap = NULL; @@ -1625,6 +1627,18 @@ is_type_protected(const char *type) return 0; }
+int +is_type_forbidden(const char *type) +{ + char **paap = NULL; + for (paap = forbidden_attrs; paap && *paap; paap++) { + if (0 == strcasecmp(type, *paap)) { + return 1; + } + } + return 0; +} + static void entry2str_internal_put_attrlist( const Slapi_Attr *attrlist, int attr_state, int entry2str_ctrl, char **ecur, char **typebuf, size_t *typebuf_len) { @@ -3405,12 +3419,25 @@ delete_values_sv_internal( Slapi_Attr *a; int retVal= LDAP_SUCCESS;
+ /* + * If type is in the protected_attrs_all list, we could ignore the failure, + * as the attribute could only exist in the entry in the memory when the + * add/mod operation is done, while the retried entry from the db does not + * contain the attribute. + */ + if (is_type_protected(type) || is_type_forbidden(type)) { + flags |= SLAPI_VALUE_FLAG_IGNOREERROR; + } + /* delete the entire attribute */ if ( valuestodelete == NULL || valuestodelete[0] == NULL ){ LDAPDebug( LDAP_DEBUG_ARGS, "removing entire attribute %s\n", type, 0, 0 ); - return( attrlist_delete( &e->e_attrs, type) ? - LDAP_NO_SUCH_ATTRIBUTE : LDAP_SUCCESS ); + retVal = attrlist_delete( &e->e_attrs, type); + if (flags & SLAPI_VALUE_FLAG_IGNOREERROR) { + return LDAP_SUCCESS; + } + return(retVal ? LDAP_NO_SUCH_ATTRIBUTE : LDAP_SUCCESS); }
/* delete specific values - find the attribute first */ @@ -3418,6 +3445,9 @@ delete_values_sv_internal( if ( a == NULL ) { LDAPDebug( LDAP_DEBUG_ARGS, "could not find attribute %s\n", type, 0, 0 ); + if (flags & SLAPI_VALUE_FLAG_IGNOREERROR) { + return LDAP_SUCCESS; + } return( LDAP_NO_SUCH_ATTRIBUTE ); }
@@ -3446,8 +3476,11 @@ delete_values_sv_internal( "value for attribute type %s found in " "entry %s\n", a->a_type, slapi_entry_get_dn_const(e), 0 ); } + if (flags & SLAPI_VALUE_FLAG_IGNOREERROR) { + retVal = LDAP_SUCCESS; + } } - } + } return( retVal ); } diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c index a749cee..d812783 100644 --- a/ldap/servers/slapd/entrywsi.c +++ b/ldap/servers/slapd/entrywsi.c @@ -634,14 +634,33 @@ entry_delete_present_values_wsi(Slapi_Entry *e, const char *type, struct berval } else if (attr_state==ATTRIBUTE_DELETED) { - retVal= LDAP_NO_SUCH_ATTRIBUTE; + /* If the type is in the forbidden attr list (e.g., unhashed password), + * we don't return the reason of the failure to the clients. */ + if (is_type_forbidden(type)) { + retVal = LDAP_SUCCESS; + } else { + retVal= LDAP_NO_SUCH_ATTRIBUTE; + } } else if (attr_state==ATTRIBUTE_NOTFOUND) { - if (!urp) - { - /* Only warn if not urping */ - LDAPDebug( LDAP_DEBUG_ARGS, "could not find attribute %s\n", type, 0, 0 ); + /* + * If type is in the protected_attrs_all list, we could ignore the + * failure, as the attribute could only exist in the entry in the + * memory when the add/mod operation is done, while the retried entry + * from the db does not contain the attribute. + * So is in the forbidden_attrs list. We don't return the reason + * of the failure. + */ + if (is_type_protected(type) || is_type_forbidden(type)) { + retVal = LDAP_SUCCESS; + } else { + if (!urp) { + /* Only warn if not urping */ + LDAPDebug1Arg(LDAP_DEBUG_ARGS, "could not find attribute %s\n", + type); + } + retVal = LDAP_NO_SUCH_ATTRIBUTE; } retVal= LDAP_NO_SUCH_ATTRIBUTE; /* NOTE: LDAP says that a MOD REPLACE with no vals of a non-existent diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c index 79d96f0..523d672 100644 --- a/ldap/servers/slapd/pblock.c +++ b/ldap/servers/slapd/pblock.c @@ -3006,6 +3006,22 @@ slapi_pblock_set( Slapi_PBlock *pblock, int arg, void *value ) case SLAPI_SEARCH_ATTRS: if(pblock->pb_op!=NULL) { + char **attrs; + for (attrs = (char **)value; attrs && *attrs; attrs++) { + /* Get rid of forbidden attr, e.g., + * PSEUDO_ATTR_UNHASHEDUSERPASSWORD, + * which never be returned. */ + if (is_type_forbidden(*attrs)) { + char **ptr; + for (ptr = attrs; ptr && *ptr; ptr++) { + if (ptr == attrs) { + slapi_ch_free_string(ptr); /* free unhashed type */ + } + *ptr = *(ptr + 1); /* attrs is NULL terminated; + the NULL is copied here. */ + } + } + } pblock->pb_op->o_params.p.p_search.search_attrs = (char **) value; } break; diff --git a/ldap/servers/slapd/plugin_internal_op.c b/ldap/servers/slapd/plugin_internal_op.c index 9654780..412c7c3 100644 --- a/ldap/servers/slapd/plugin_internal_op.c +++ b/ldap/servers/slapd/plugin_internal_op.c @@ -291,6 +291,7 @@ slapi_search_internal_set_pb (Slapi_PBlock *pb, const char *base, int operation_flags) { Operation *op; + char **tmp_attrs = NULL; if (pb == NULL || base == NULL) { slapi_log_error(SLAPI_LOG_FATAL, NULL, @@ -304,7 +305,9 @@ slapi_search_internal_set_pb (Slapi_PBlock *pb, const char *base, slapi_pblock_set(pb, SLAPI_SEARCH_SCOPE, &scope); slapi_pblock_set(pb, SLAPI_SEARCH_STRFILTER, (void*)filter); slapi_pblock_set(pb, SLAPI_CONTROLS_ARG, controls); - slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, attrs); + /* forbidden attrs could be removed in slapi_pblock_set. */ + tmp_attrs = slapi_ch_array_dup(attrs); + slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, tmp_attrs); slapi_pblock_set(pb, SLAPI_SEARCH_ATTRSONLY, &attrsonly); if (uniqueid) { @@ -322,6 +325,7 @@ slapi_search_internal_set_pb_ext (Slapi_PBlock *pb, Slapi_DN *sdn, int operation_flags) { Operation *op; + char **tmp_attrs = NULL; if (pb == NULL || sdn == NULL) { slapi_log_error(SLAPI_LOG_FATAL, NULL, @@ -337,7 +341,9 @@ slapi_search_internal_set_pb_ext (Slapi_PBlock *pb, Slapi_DN *sdn, slapi_pblock_set(pb, SLAPI_SEARCH_SCOPE, &scope); slapi_pblock_set(pb, SLAPI_SEARCH_STRFILTER, (void*)filter); slapi_pblock_set(pb, SLAPI_CONTROLS_ARG, controls); - slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, attrs); + /* forbidden attrs could be removed in slapi_pblock_set. */ + tmp_attrs = slapi_ch_array_dup(attrs); + slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, tmp_attrs); slapi_pblock_set(pb, SLAPI_SEARCH_ATTRSONLY, &attrsonly); if (uniqueid) { @@ -351,6 +357,7 @@ void slapi_seq_internal_set_pb(Slapi_PBlock *pb, char *base, int type, char *att Slapi_ComponentId *plugin_identity, int operation_flags) { Operation *op; + char **tmp_attrs = NULL; if (pb == NULL || base == NULL) { slapi_log_error(SLAPI_LOG_FATAL, NULL, @@ -364,8 +371,10 @@ void slapi_seq_internal_set_pb(Slapi_PBlock *pb, char *base, int type, char *att slapi_pblock_set(pb, SLAPI_SEQ_TYPE, &type); slapi_pblock_set(pb, SLAPI_SEQ_ATTRNAME, attrname); slapi_pblock_set(pb, SLAPI_SEQ_VAL, val); - slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, attrs); - slapi_pblock_set(pb, SLAPI_SEARCH_ATTRSONLY, &attrsonly); + /* forbidden attrs could be removed in slapi_pblock_set. */ + tmp_attrs = slapi_ch_array_dup(attrs); + slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, tmp_attrs); + slapi_pblock_set(pb, SLAPI_SEARCH_ATTRSONLY, &attrsonly); slapi_pblock_set(pb, SLAPI_CONTROLS_ARG, controls); slapi_pblock_set(pb, SLAPI_PLUGIN_IDENTITY, plugin_identity); } @@ -383,6 +392,7 @@ static int seq_internal_callback_pb (Slapi_PBlock *pb, void *callback_data, char *base; char *attrname, *val; Slapi_DN *sdn = NULL; + char **tmp_attrs = NULL;
slapi_pblock_get(pb, SLAPI_ORIGINAL_TARGET_DN, (void *)&base ); slapi_pblock_get(pb, SLAPI_CONTROLS_ARG, &controls); @@ -445,6 +455,9 @@ static int seq_internal_callback_pb (Slapi_PBlock *pb, void *callback_data, slapi_pblock_get(pb, SLAPI_SEARCH_TARGET_SDN, &sdn); slapi_sdn_free(&sdn); slapi_pblock_set(pb, SLAPI_SEARCH_TARGET_SDN, NULL); + slapi_pblock_get(pb, SLAPI_SEARCH_ATTRS, &tmp_attrs); + slapi_ch_array_free(tmp_attrs); + slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, NULL);
return rc; } @@ -731,6 +744,7 @@ search_internal_callback_pb (Slapi_PBlock *pb, void *callback_data, char *ifstr; int opresult; int rc = 0; + char **tmp_attrs = NULL;
PR_ASSERT (pb);
@@ -801,10 +815,13 @@ search_internal_callback_pb (Slapi_PBlock *pb, void *callback_data,
done: slapi_ch_free((void **) & fstr); - if (filter != NULL) + if (filter != NULL) { slapi_filter_free(filter, 1 /* recurse */); } + slapi_pblock_get(pb, SLAPI_SEARCH_ATTRS, &tmp_attrs); + slapi_ch_array_free(tmp_attrs); + slapi_pblock_set(pb, SLAPI_SEARCH_ATTRS, NULL);
return(rc); } diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c index 5f1438b..8f3be98 100644 --- a/ldap/servers/slapd/schema.c +++ b/ldap/servers/slapd/schema.c @@ -1387,15 +1387,18 @@ schema_list_attributes_callback(struct asyntaxinfo *asi, void *arg) return ATTR_SYNTAX_ENUM_NEXT; } if (aew->flag && (asi->asi_flags & aew->flag)) { - charray_add(&aew->attrs, slapi_ch_strdup(asi->asi_name)); + /* skip unhashed password */ + if (!is_type_forbidden(asi->asi_name)) { + charray_add(&aew->attrs, slapi_ch_strdup(asi->asi_name)); if (NULL != asi->asi_aliases) { - int i; + int i;
- for ( i = 0; asi->asi_aliases[i] != NULL; ++i ) { + for ( i = 0; asi->asi_aliases[i] != NULL; ++i ) { charray_add(&aew->attrs, - slapi_ch_strdup(asi->asi_aliases[i])); - } - } + slapi_ch_strdup(asi->asi_aliases[i])); + } + } + } } return ATTR_SYNTAX_ENUM_NEXT; } diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h index 2ef4288..ce2e03c 100644 --- a/ldap/servers/slapd/slapi-private.h +++ b/ldap/servers/slapd/slapi-private.h @@ -330,6 +330,8 @@ int entry_next_deleted_attribute( const Slapi_Entry *e, Slapi_Attr **a);
/* entry.c */ int entry_apply_mods( Slapi_Entry *e, LDAPMod **mods ); +int is_type_protected(const char *type); +int is_type_forbidden(const char *type);
int slapi_entries_diff(Slapi_Entry **old_entries, Slapi_Entry **new_entries, int testall, const char *logging_prestr, const int force_update, void *plg_id);
389-commits@lists.fedoraproject.org