[Fedora-directory-commits] ldapserver/ldap/servers/slapd/back-ldbm index.c, 1.17, 1.18
by Noriko Hosoi
Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv19901
Modified Files:
index.c
Log Message:
Resoves: #484157
Summary: timelimit not honored in some cases
Description: Range search operations could take longer time than the time limit
depending upon the data size, but there was no chance to check the time limit
in the code (index_range_read). Thus, once the range search operation has
started, it could have lasted far exceeding the specified time limit.
I introduced the time check in the range search function.
Index: index.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/index.c,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -r1.17 -r1.18
--- index.c 15 Oct 2008 06:30:08 -0000 1.17
+++ index.c 10 Feb 2009 00:23:27 -0000 1.18
@@ -1055,6 +1055,8 @@
int retry_count = 0;
int is_and = 0;
int sizelimit = 0;
+ time_t curtime, stoptime, optime;
+ int timelimit = -1;
*err = 0;
plen = strlen( prefix = index2prefix( indextype ));
@@ -1063,6 +1065,9 @@
{
slapi_pblock_get(pb, SLAPI_SEARCH_SIZELIMIT, &sizelimit);
}
+ slapi_pblock_get( pb, SLAPI_OPINITIATED_TIME, &optime );
+ slapi_pblock_get(pb, SLAPI_SEARCH_TIMELIMIT, &timelimit);
+ stoptime = optime + timelimit;
/*
* Determine the lookthrough_limit from the PBlock.
@@ -1307,6 +1312,14 @@
0, 0, 0);
break;
}
+ /* check time limit */
+ curtime = current_time();
+ if ( timelimit != -1 && curtime >= stoptime )
+ {
+ LDAPDebug(LDAP_DEBUG_TRACE, "index_range_read timelimit exceeded\n",
+ 0, 0, 0);
+ break;
+ }
/* Check to see if the operation has been abandoned (also happens
* when the connection is closed by the client).
15 years, 1 month
[Fedora-directory-commits] fedora-idm-console build.properties, 1.3, 1.4
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/fedora-idm-console
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv6147
Modified Files:
build.properties
Log Message:
bump version to 1.1.3 to sync with CVS tag
Index: build.properties
===================================================================
RCS file: /cvs/dirsec/fedora-idm-console/build.properties,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- build.properties 3 Feb 2009 16:19:07 -0000 1.3
+++ build.properties 9 Feb 2009 23:05:35 -0000 1.4
@@ -23,7 +23,7 @@
console.root=.
console.version=11
-console.dotversion=1.1.2
+console.dotversion=1.1.3
console.dotgenversion=1.1
theme.core=fedora-idm-console
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/slapd ssl.c, 1.25, 1.26
by Nathan Kinder
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11363/ldap/servers/slapd
Modified Files:
ssl.c
Log Message:
Resolves: 455629
Summary: Only change permissions of certdb when it is newly created.
Index: ssl.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/ssl.c,v
retrieving revision 1.25
retrieving revision 1.26
diff -u -r1.25 -r1.26
--- ssl.c 6 Feb 2009 00:29:44 -0000 1.25
+++ ssl.c 9 Feb 2009 17:30:51 -0000 1.26
@@ -359,9 +359,12 @@
}
}
-static void
-warn_if_no_cert_file(const char *dir)
+/* Logs a warning and returns 1 if cert file doesn't exist. You
+ * can skip the warning log message by setting no_log to 1.*/
+static int
+warn_if_no_cert_file(const char *dir, int no_log)
{
+ int ret = 0;
char *filename = slapi_ch_smprintf("%s/cert8.db", dir);
PRStatus status = PR_Access(filename, PR_ACCESS_READ_OK);
if (PR_SUCCESS != status) {
@@ -369,25 +372,38 @@
filename = slapi_ch_smprintf("%s/cert7.db", dir);
status = PR_Access(filename, PR_ACCESS_READ_OK);
if (PR_SUCCESS != status) {
- slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
- "Warning: certificate DB file cert8.db nor cert7.db exists in [%s] - SSL initialization will likely fail\n",
- dir);
+ ret = 1;
+ if (!no_log) {
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Warning: certificate DB file cert8.db nor cert7.db exists in [%s] - "
+ "SSL initialization will likely fail\n", dir);
+ }
}
}
+
slapi_ch_free_string(&filename);
+ return ret;
}
-static void
-warn_if_no_key_file(const char *dir)
+/* Logs a warning and returns 1 if key file doesn't exist. You
+ * can skip the warning log message by setting no_log to 1.*/
+static int
+warn_if_no_key_file(const char *dir, int no_log)
{
+ int ret = 0;
char *filename = slapi_ch_smprintf("%s/key3.db", dir);
PRStatus status = PR_Access(filename, PR_ACCESS_READ_OK);
if (PR_SUCCESS != status) {
- slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
- "Warning: key DB file %s does not exist - SSL initialization will likely fail\n",
- filename);
+ ret = 1;
+ if (!no_log) {
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Warning: key DB file %s does not exist - SSL initialization will "
+ "likely fail\n", filename);
+ }
}
+
slapi_ch_free_string(&filename);
+ return ret;
}
/*
@@ -404,11 +420,12 @@
int
slapd_nss_init(int init_ssl, int config_available)
{
- SECStatus secStatus;
- PRErrorCode errorCode;
- int rv = 0;
+ SECStatus secStatus;
+ PRErrorCode errorCode;
+ int rv = 0;
int len = 0;
- PRUint32 nssFlags = 0;
+ int create_certdb = 0;
+ PRUint32 nssFlags = 0;
char *certdir;
char *certdb_file_name = NULL;
char *keydb_file_name = NULL;
@@ -424,32 +441,38 @@
certdir[len-1] = '\0';
}
- /* If the server is configured to use SSL, we must have a key and cert db */
- if (config_get_security()) {
- warn_if_no_cert_file(certdir);
- warn_if_no_key_file(certdir);
- } else { /* otherwise, NSS will create empty databases */
- /* we open the key/cert db in rw mode, so make sure the directory
- is writable */
- if (PR_SUCCESS != PR_Access(certdir, PR_ACCESS_WRITE_OK)) {
- char *serveruser = "unknown";
+ /* If the server is configured to use SSL, we must have a key and cert db */
+ if (config_get_security()) {
+ warn_if_no_cert_file(certdir, 0);
+ warn_if_no_key_file(certdir, 0);
+ } else { /* otherwise, NSS will create empty databases */
+ /* we open the key/cert db in rw mode, so make sure the directory
+ is writable */
+ if (PR_SUCCESS != PR_Access(certdir, PR_ACCESS_WRITE_OK)) {
+ char *serveruser = "unknown";
#ifndef _WIN32
- serveruser = config_get_localuser();
+ serveruser = config_get_localuser();
#endif
- slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
- "Warning: The key/cert database directory [%s] is not writable by "
- "the server uid [%s]: initialization likely to fail.\n",
- certdir, serveruser);
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Warning: The key/cert database directory [%s] is not writable by "
+ "the server uid [%s]: initialization likely to fail.\n",
+ certdir, serveruser);
#ifndef _WIN32
- slapi_ch_free_string(&serveruser);
+ slapi_ch_free_string(&serveruser);
#endif
- }
- }
+ }
+ }
+
+ /* Check if we have a certdb already. If not, set a flag that we are
+ * going to create one so we can set the appropriate permissions on it. */
+ if (warn_if_no_cert_file(certdir, 1) || warn_if_no_key_file(certdir, 1)) {
+ create_certdb = 1;
+ }
- /******** Initialise NSS *********/
+ /******** Initialise NSS *********/
- nssFlags &= (~NSS_INIT_READONLY);
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
+ nssFlags &= (~NSS_INIT_READONLY);
+ slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags);
dongle_file_name = PR_smprintf("%s/pin.txt", certdir);
@@ -476,12 +499,14 @@
* need to modify it after creation. We need to allow read and
* write permission to the group so the certs can be managed via
* the console/adminserver. */
- certdb_file_name = slapi_ch_smprintf("%s/cert8.db", certdir);
- keydb_file_name = slapi_ch_smprintf("%s/key3.db", certdir);
- secmoddb_file_name = slapi_ch_smprintf("%s/secmod.db", certdir);
- chmod(certdb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
- chmod(keydb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
- chmod(secmoddb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
+ if (create_certdb) {
+ certdb_file_name = slapi_ch_smprintf("%s/cert8.db", certdir);
+ keydb_file_name = slapi_ch_smprintf("%s/key3.db", certdir);
+ secmoddb_file_name = slapi_ch_smprintf("%s/secmod.db", certdir);
+ chmod(certdb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
+ chmod(keydb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
+ chmod(secmoddb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
+ }
/****** end of NSS Initialization ******/
_nss_initialized = 1;
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/slapd pw.c, 1.22, 1.23
by Noriko Hosoi
Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv8744
Modified Files:
pw.c
Log Message:
Resolves: #484311
Summary: When password policy is on, replacing userpassword starting with
{clear} fails
Description: #484311 is not a bug; this change is just to improve the error
message.
Index: pw.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/pw.c,v
retrieving revision 1.22
retrieving revision 1.23
diff -u -r1.22 -r1.23
--- pw.c 21 Jan 2009 00:00:32 -0000 1.22
+++ pw.c 6 Feb 2009 22:39:50 -0000 1.23
@@ -779,7 +779,7 @@
if ((!is_replication && ((internal_op && pb->pb_conn && !slapi_dn_isroot(pb->pb_conn->c_dn)) ||
(!internal_op && !pb->pb_requestor_isroot)))) {
PR_snprintf( errormsg, BUFSIZ,
- "invalid password syntax - pre-hashed passwords are not allowed");
+ "invalid password syntax - passwords with storage scheme are not allowed");
if ( pwresponse_req == 1 ) {
slapi_pwpolicy_make_response_control ( pb, -1, -1,
LDAP_PWPOLICY_INVALIDPWDSYNTAX );
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/slapd ssl.c, 1.24, 1.25
by Nathan Kinder
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv10811/ldap/servers/slapd
Modified Files:
ssl.c
Log Message:
Resolves: 455629
Summary: Ensure server group has proper permissions on certificate db files.
Index: ssl.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/ssl.c,v
retrieving revision 1.24
retrieving revision 1.25
diff -u -r1.24 -r1.25
--- ssl.c 5 Feb 2009 17:34:56 -0000 1.24
+++ ssl.c 6 Feb 2009 00:29:44 -0000 1.25
@@ -410,6 +410,9 @@
int len = 0;
PRUint32 nssFlags = 0;
char *certdir;
+ char *certdb_file_name = NULL;
+ char *keydb_file_name = NULL;
+ char *secmoddb_file_name = NULL;
/* set in slapd_bootstrap_config,
thus certdir is available even if config_available is false */
@@ -468,9 +471,23 @@
return -1;
}
- /****** end of NSS Initialization ******/
+ /* NSS creates the certificate db files with a mode of 600. There
+ * is no way to pass in a mode to use for creation to NSS, so we
+ * need to modify it after creation. We need to allow read and
+ * write permission to the group so the certs can be managed via
+ * the console/adminserver. */
+ certdb_file_name = slapi_ch_smprintf("%s/cert8.db", certdir);
+ keydb_file_name = slapi_ch_smprintf("%s/key3.db", certdir);
+ secmoddb_file_name = slapi_ch_smprintf("%s/secmod.db", certdir);
+ chmod(certdb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
+ chmod(keydb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
+ chmod(secmoddb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
+ /****** end of NSS Initialization ******/
_nss_initialized = 1;
+ slapi_ch_free_string(&certdb_file_name);
+ slapi_ch_free_string(&keydb_file_name);
+ slapi_ch_free_string(&secmoddb_file_name);
slapi_ch_free_string(&certdir);
return rv;
}
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/slapd libglobs.c, 1.34, 1.35 slapi-private.h, 1.34, 1.35 ssl.c, 1.23, 1.24
by Noriko Hosoi
Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv4758
Modified Files:
libglobs.c slapi-private.h ssl.c
Log Message:
Resolves: #484149
Summary: Clear directory manager password with password storage scheme other
than clear crashes the server
Description:
1) introducing a flag (_nss_initialized) and an API (slapd_nss_is_initialized)
to represent NSS_Initialize is called or not.
2) in config_set_rootpw, if the directory manager's password is given unhashed,
check if NSS is already initialized and the directory manager's password
storage scheme is clear or not. If NSS is not initialized and if the storage
scheme is not CLEAR, report it and return an error LDAP_PARAM_ERROR.
Index: libglobs.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/libglobs.c,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -r1.34 -r1.35
--- libglobs.c 5 Dec 2008 22:41:52 -0000 1.34
+++ libglobs.c 5 Feb 2009 17:34:56 -0000 1.35
@@ -2501,12 +2501,20 @@
is_hashed = pw_val2scheme ( value, NULL, 0 );
if ( is_hashed ) {
- slapdFrontendConfig->rootpw = slapi_ch_strdup ( value );
- free_pw_scheme(is_hashed);
- }
- else {
- /* pwd enc func returns slapi_ch_malloc memory */
- slapdFrontendConfig->rootpw = (slapdFrontendConfig->rootpwstoragescheme->pws_enc)(value);
+ slapdFrontendConfig->rootpw = slapi_ch_strdup ( value );
+ free_pw_scheme(is_hashed);
+ } else if (slapd_nss_is_initialized() ||
+ (strcasecmp(slapdFrontendConfig->rootpwstoragescheme->pws_name,
+ "clear") == 0)) {
+ /* to hash, security library should have been initialized, by now */
+ /* pwd enc func returns slapi_ch_malloc memory */
+ slapdFrontendConfig->rootpw = (slapdFrontendConfig->rootpwstoragescheme->pws_enc)(value);
+ } else {
+ PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
+ "%s: password scheme mismatch (passwd scheme is %s; "
+ "password is clear text)", attrname,
+ slapdFrontendConfig->rootpwstoragescheme->pws_name);
+ retVal = LDAP_PARAM_ERROR;
}
CFG_UNLOCK_WRITE(slapdFrontendConfig);
Index: slapi-private.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slapi-private.h,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -r1.34 -r1.35
--- slapi-private.h 21 Jan 2009 00:00:32 -0000 1.34
+++ slapi-private.h 5 Feb 2009 17:34:56 -0000 1.35
@@ -1107,6 +1107,7 @@
/* Client SSL code */
int slapd_security_library_is_initialized( void );
+int slapd_nss_is_initialized( void );
char* slapd_get_tmp_dir( void );
/* util.c */
Index: ssl.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/ssl.c,v
retrieving revision 1.23
retrieving revision 1.24
diff -u -r1.23 -r1.24
--- ssl.c 28 Jan 2009 21:59:41 -0000 1.23
+++ ssl.c 5 Feb 2009 17:34:56 -0000 1.24
@@ -87,6 +87,7 @@
static int _security_library_initialized = 0;
static int _ssl_listener_initialized = 0;
+static int _nss_initialized = 0;
/* Our name for the internal token, must match PKCS-11 config data below */
static char *internalTokenName = "Internal (Software) Token";
@@ -469,6 +470,7 @@
/****** end of NSS Initialization ******/
+ _nss_initialized = 1;
slapi_ch_free_string(&certdir);
return rv;
}
@@ -1243,6 +1245,12 @@
return _ssl_listener_initialized;
}
+int
+slapd_nss_is_initialized()
+{
+ return _nss_initialized;
+}
+
/* memory to store tmpdir is allocated and returned; caller should free it. */
char* slapd_get_tmp_dir()
{
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/memberof memberof.c, 1.14, 1.15
by Nathan Kinder
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/memberof
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv25897/ldap/servers/plugins/memberof
Modified Files:
memberof.c
Log Message:
Resolves: 463337
Summary: Update member attributes that refer to renamed entries when processing a MODRDN.
Index: memberof.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/memberof/memberof.c,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- memberof.c 5 Dec 2008 22:41:51 -0000 1.14
+++ memberof.c 5 Feb 2009 16:20:49 -0000 1.15
@@ -486,7 +486,6 @@
struct slapi_entry *post_e = NULL;
char *pre_dn = 0;
char *post_dn = 0;
- int interested = 0;
slapi_pblock_get( pb, SLAPI_ENTRY_PRE_OP, &pre_e );
slapi_pblock_get( pb, SLAPI_ENTRY_POST_OP, &post_e );
@@ -497,40 +496,35 @@
post_dn = slapi_entry_get_ndn(post_e);
}
- /* is the entry of interest? */
+ /* copy config so it doesn't change out from under us */
memberof_rlock_config();
mainConfig = memberof_get_config();
- if(pre_dn && post_dn &&
- !slapi_filter_test_simple(post_e, mainConfig->group_filter))
- {
- interested = 1;
- /* copy config so it doesn't change out from under us */
- memberof_copy_config(&configCopy, mainConfig);
- }
+ memberof_copy_config(&configCopy, mainConfig);
memberof_unlock_config();
- if(interested)
+ memberof_lock();
+
+ /* update any downstream members */
+ if(pre_dn && post_dn &&
+ !slapi_filter_test_simple(post_e, configCopy.group_filter))
{
Slapi_Attr *attr = 0;
- memberof_lock();
-
/* get a list of member attributes present in the group
* entry that is being renamed. */
if(0 == slapi_entry_attr_find(post_e, configCopy.groupattr, &attr))
{
memberof_moddn_attr_list(pb, &configCopy, pre_dn, post_dn, attr);
}
+ }
- /* modrdn must change the dns in groups that have
- * this group as a member.
- */
- memberof_replace_dn_from_groups(pb, &configCopy, pre_dn, post_dn);
-
- memberof_unlock();
+ /* It's possible that this is an entry who is a member
+ * of other group entries. We need to update any member
+ * attributes to refer to the new name. */
+ memberof_replace_dn_from_groups(pb, &configCopy, pre_dn, post_dn);
- memberof_free_config(&configCopy);
- }
+ memberof_unlock();
+ memberof_free_config(&configCopy);
}
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/views views.c, 1.12, 1.13
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/views
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18122/ldapserver/ldap/servers/plugins/views
Modified Files:
views.c
Log Message:
Resolves: bug 483254
Bug Description: Modification of nsViewFilter of a virtual view OU crashes the server
Reviewed by: nhosoi, andrey.ivanov (Thanks!)
Fix Description: When we delete a node, not only do we need to have the parent node discover its new children, we need to have each child discover a new parent.
Platforms tested: RHEL5
Flag Day: no
Doc impact: no
Index: views.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/views/views.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- views.c 15 Oct 2008 06:30:02 -0000 1.12
+++ views.c 5 Feb 2009 15:19:01 -0000 1.13
@@ -131,6 +131,7 @@
static int views_cache_add_dn_views(char *dn, viewEntry **pViews);
static void views_cache_add_ll_entry(void** attrval, void *theVal);
static void views_cache_discover_parent(viewEntry *pView);
+static void views_cache_discover_parent_for_children(viewEntry *pView);
static void views_cache_discover_children(viewEntry *pView);
static void views_cache_discover_view_scope(viewEntry *pView);
static void views_cache_create_applied_filter(viewEntry *pView);
@@ -658,6 +659,22 @@
}
}
+/*
+ views_cache_discover_parent_for_children
+ ------------------------------
+ The current node is being deleted - for each child, need
+ to find a new parent
+*/
+static void views_cache_discover_parent_for_children(viewEntry *pView)
+{
+ int ii = 0;
+
+ for (ii = 0; pView->pChildren && (ii < pView->child_count); ++ii)
+ {
+ viewEntry *current = (viewEntry *)pView->pChildren[ii];
+ views_cache_discover_parent(current);
+ }
+}
/*
views_cache_discover_children
@@ -1471,9 +1488,11 @@
theCache.pCacheViews = (viewEntry*)(theView->list.pNext);
}
- /* update children */
+ /* the parent of this node needs to know about its children */
if(theView->pParent)
views_cache_discover_children((viewEntry*)theView->pParent);
+ /* each child of the deleted node will need to discover a new parent */
+ views_cache_discover_parent_for_children((viewEntry*)theView);
/* update filters */
for(current = theCache.pCacheViews; current != NULL; current = current->list.pNext)
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/replication windows_protocol_util.c, 1.50, 1.51
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/replication
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv983/ldapserver/ldap/servers/plugins/replication
Modified Files:
windows_protocol_util.c
Log Message:
Resolves: bug 483256
Bug Description: DS crash when modify entry that does not exist in AD
Reviewed by: nkinder (Thanks!)
Fix Description: The function that checks to see if the mod has already been made to the AD entry should just return 0 if the AD entry does not exist or could not be found - in this case, the regular windows replay code will handle it.
Platforms tested: RHEL5
Flag Day: no
Doc impact: no
Index: windows_protocol_util.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/windows_protocol_util.c,v
retrieving revision 1.50
retrieving revision 1.51
diff -u -r1.50 -r1.51
--- windows_protocol_util.c 26 Jan 2009 17:35:14 -0000 1.50
+++ windows_protocol_util.c 4 Feb 2009 20:40:34 -0000 1.51
@@ -1817,6 +1817,14 @@
return 1;
}
+ if (!ad_entry) { /* mods cannot already have been made */
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "%s: mod_already_made: "
+ "AD entry not found\n",
+ agmt_get_long_name(prp->agmt));
+ return retval; /* just allow - will probably fail later if entry really doesn't exist */
+ }
+
op = slapi_mod_get_operation(smod);
type = slapi_mod_get_type(smod);
if (SLAPI_IS_MOD_ADD(op)) { /* make sure value is not there */
15 years, 1 month
[Fedora-directory-commits] ldapserver/ldap/servers/slapd util.c, 1.27, 1.28
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1947/ldapserver/ldap/servers/slapd
Modified Files:
util.c
Log Message:
Resolves: bug 480642
Bug Description: HPUX: Server to Server SASL - Unknown Authentication Method
Reviewed by: nkinder (Thanks!)
Fix Description: On some platforms, we do not install the sasl auth method plugins in a standard location, so we have the nsslapd-saslpath config setting to provide that location in a CB_GETPATH callback provided to sasl_server_init. This works fine for being a SASL server. However, to be an LDAP SASL client, we have to provide that callback to sasl_client_init too. This call happens the first time the mozldap client library is initialized. mozldap has a hardcoded list of sasl callbacks it provides, and does not allow callers to augment that list. So, we simply replace the list with one that contains the CB_GETPATH callback.
Platforms tested: HP-UX 11.23 64-bit
Flag Day: no
Doc impact: no
Index: util.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/util.c,v
retrieving revision 1.27
retrieving revision 1.28
diff -u -r1.27 -r1.28
--- util.c 13 Jan 2009 22:24:15 -0000 1.27
+++ util.c 4 Feb 2009 18:21:01 -0000 1.28
@@ -885,6 +885,54 @@
return( s );
}
+#include <sasl.h>
+
+/* copied from mozldap libldap/saslbind.c */
+static int
+slapd_sasl_fail()
+{
+ return( SASL_FAIL );
+}
+
+/* copied from slapd/saslbind.c - not an easy way to share this function
+ between the two files */
+static int slapd_sasl_getpluginpath(sasl_conn_t *conn, const char **path)
+{
+ /* Try to get path from config, otherwise check for SASL_PATH environment
+ * variable. If neither of these are set, default to /usr/lib64/sasl2 on
+ * 64-bit Linux machines, and /usr/lib/sasl2 on all other platforms.
+ */
+ char *pluginpath = config_get_saslpath();
+ if ((!pluginpath) || (*pluginpath == '\0')) {
+ if (!(pluginpath = getenv("SASL_PATH"))) {
+#if defined(LINUX) && defined(__LP64__)
+ pluginpath = "/usr/lib64/sasl2";
+#else
+ pluginpath = "/usr/lib/sasl2";
+#endif
+ }
+ }
+ *path = pluginpath;
+ return SASL_OK;
+}
+
+/* copied from mozldap libldap/saslbind.c - except
+ SASL_CB_GETPATH added as last item (before SASL_CB_LIST_END
+ This allows us to set the sasl path used for outgoing
+ client connections */
+sasl_callback_t slapd_client_callbacks[] = {
+ { SASL_CB_GETOPT, slapd_sasl_fail, NULL },
+ { SASL_CB_GETREALM, NULL, NULL },
+ { SASL_CB_USER, NULL, NULL },
+ { SASL_CB_CANON_USER, NULL, NULL },
+ { SASL_CB_AUTHNAME, NULL, NULL },
+ { SASL_CB_PASS, NULL, NULL },
+ { SASL_CB_ECHOPROMPT, NULL, NULL },
+ { SASL_CB_NOECHOPROMPT, NULL, NULL },
+ { SASL_CB_GETPATH, slapd_sasl_getpluginpath, NULL },
+ { SASL_CB_LIST_END, NULL, NULL }
+};
+
/*
Perform LDAP init and return an LDAP* handle. If ldapurl is given,
that is used as the basis for the protocol, host, port, and whether
@@ -914,6 +962,16 @@
LDAPURLDesc *ludp = NULL;
LDAP *ld = NULL;
int rc = 0;
+ extern sasl_callback_t *client_callbacks;
+
+ /* We need to provide a sasl path used for client connections, especially
+ if the server is not set up to be a sasl server - since mozldap provides
+ no way to override the default path programatically, we replace its
+ client callback list with our own so that we can provide a CB_GETPATH
+ callback */
+ if (client_callbacks != slapd_client_callbacks) {
+ client_callbacks = slapd_client_callbacks;
+ }
/* if ldapurl is given, parse it */
if (ldapurl && ((rc = ldap_url_parse_no_defaults(ldapurl, &ludp, 0)) ||
@@ -1105,7 +1163,6 @@
return slapi_ldap_init_ext(NULL, ldaphost, ldapport, secure, shared, NULL);
}
-#include <sasl.h>
/*
* Does the correct bind operation simple/sasl/cert depending
* on the arguments passed in. If the user specified to use
15 years, 1 month