ldap/admin
by Richard Allen Megginson
ldap/admin/src/scripts/60upgradeschemafiles.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 4845ffc48517bd2c938129a40c4e4f29c1efcc5a
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Mon Mar 8 12:36:56 2010 -0700
Bug 571514 - upgrade to 1.2.6 should upgrade 05rfc4523.ldif (cert schema)
https://bugzilla.redhat.com/show_bug.cgi?id=571514
Resolves: bug 571514
Bug Description: upgrade to 1.2.6 should upgrade 05rfc4523.ldif (cert schema)
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: Added 05rfc4523.ldif to the list of schema to upgrade.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/admin/src/scripts/60upgradeschemafiles.pl b/ldap/admin/src/scripts/60upgradeschemafiles.pl
index ebc7126..97d6a94 100644
--- a/ldap/admin/src/scripts/60upgradeschemafiles.pl
+++ b/ldap/admin/src/scripts/60upgradeschemafiles.pl
@@ -11,7 +11,7 @@ sub runinst {
# these schema files are obsolete, or we want to replace
# them with newer versions
- my @toremove = qw(00core.ldif 01core389.ldif 01common.ldif 02common.ldif 05rfc2247.ldif 10presence.ldif 28pilot.ldif 30ns-common.ldif 50ns-directory.ldif 60mozilla.ldif);
+ my @toremove = qw(00core.ldif 01core389.ldif 01common.ldif 02common.ldif 05rfc2247.ldif 05rfc4523.ldif 10presence.ldif 28pilot.ldif 30ns-common.ldif 50ns-directory.ldif 60mozilla.ldif);
# these hashes will be used to check for obsolete schema
# in 99user.ldif
14 years, 1 month
ldap/servers
by Richard Allen Megginson
ldap/servers/plugins/acl/acllas.c | 1
ldap/servers/plugins/dna/dna.c | 2 -
ldap/servers/plugins/pwdstorage/smd5_pwd.c | 7 ++----
ldap/servers/plugins/referint/referint.c | 2 -
ldap/servers/plugins/replication/cl5_api.c | 2 +
ldap/servers/plugins/retrocl/retrocl.c | 2 -
ldap/servers/plugins/retrocl/retrocl_po.c | 4 +--
ldap/servers/slapd/attrsyntax.c | 15 ++++++++-----
ldap/servers/slapd/back-ldbm/back-ldbm.h | 1
ldap/servers/slapd/back-ldbm/import-threads.c | 6 ++---
ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c | 29 ++++++++++++--------------
ldap/servers/slapd/back-ldbm/ldif2ldbm.c | 6 ++---
ldap/servers/slapd/entry.c | 2 -
ldap/servers/slapd/modrdn.c | 4 +--
ldap/servers/slapd/plugin.c | 2 -
ldap/servers/slapd/tools/ldclt/ldclt.h | 1
16 files changed, 45 insertions(+), 41 deletions(-)
New commits:
commit 7c3866de8c4983bf31ec9b8afca4f6c36f7053c8
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Fri Mar 5 15:55:53 2010 -0700
cleanup build warnings
This patch cleans up various build warnings found by compiling the code
with -Wall on RHEL5.
Reviewed by: nhosoi (Thanks!)
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 53620e4..9a57d7c 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -1711,7 +1711,6 @@ DS_LASSSFEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
char *ptr;
int len;
int rc;
- char *s = NULL;
lasInfo lasinfo;
int aclssf;
diff --git a/ldap/servers/plugins/dna/dna.c b/ldap/servers/plugins/dna/dna.c
index c82bf6b..0da8f07 100644
--- a/ldap/servers/plugins/dna/dna.c
+++ b/ldap/servers/plugins/dna/dna.c
@@ -859,7 +859,7 @@ dna_parse_config_entry(Slapi_Entry * e, int apply)
entry->threshold = strtoull(value, 0, 0);
slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
- "----------> %s [%" NSPRIu64 "]\n", DNA_THRESHOLD, value);
+ "----------> %s [%s]\n", DNA_THRESHOLD, value);
slapi_ch_free_string(&value);
} else {
diff --git a/ldap/servers/plugins/pwdstorage/smd5_pwd.c b/ldap/servers/plugins/pwdstorage/smd5_pwd.c
index 6747a20..65c6b2a 100644
--- a/ldap/servers/plugins/pwdstorage/smd5_pwd.c
+++ b/ldap/servers/plugins/pwdstorage/smd5_pwd.c
@@ -70,7 +70,6 @@ smd5_pw_cmp( const char *userpwd, const char *dbpwd )
unsigned char *dbhash = quick_dbhash;
struct berval salt;
char *hashresult = NULL;
- SECItem binary_item;
ctx = PK11_CreateDigestContext(SEC_OID_MD5);
if (ctx == NULL) {
@@ -84,13 +83,13 @@ smd5_pw_cmp( const char *userpwd, const char *dbpwd )
*/
hash_len = pwdstorage_base64_decode_len(dbpwd, 0);
if ( hash_len >= sizeof(quick_dbhash) ) { /* get more space: */
- dbhash = (char*) slapi_ch_calloc( hash_len + 1, sizeof(char) );
+ dbhash = (unsigned char*) slapi_ch_calloc( hash_len + 1, sizeof(char) );
if ( dbhash == NULL ) goto loser;
} else {
memset( quick_dbhash, 0, sizeof(quick_dbhash) );
}
- hashresult = PL_Base64Decode( dbpwd, 0, dbhash );
+ hashresult = PL_Base64Decode( dbpwd, 0, (char *)dbhash );
if (NULL == hashresult) {
slapi_log_error( SLAPI_LOG_PLUGIN, SALTED_MD5_SUBSYSTEM_NAME,
"smd5_pw_cmp: userPassword \"%s\" is the wrong length "
@@ -125,7 +124,7 @@ smd5_pw_enc( const char *pwd )
unsigned int outLen;
unsigned char hash_out[MD5_LENGTH + MD5_DEFAULT_SALT_LENGTH];
unsigned char b2a_out[(MD5_LENGTH*2) + (MD5_MAX_SALT_LENGTH*2)]; /* conservative */
- char *salt = hash_out + MD5_LENGTH;
+ unsigned char *salt = hash_out + MD5_LENGTH;
struct berval saltval;
SECItem binary_item;
diff --git a/ldap/servers/plugins/referint/referint.c b/ldap/servers/plugins/referint/referint.c
index a38ad0a..b459a7a 100644
--- a/ldap/servers/plugins/referint/referint.c
+++ b/ldap/servers/plugins/referint/referint.c
@@ -477,7 +477,7 @@ _update_one_per_mod(const char *entryDN, /* DN of the searched entry */
}
slapi_ch_free_string(&newDN);
}
-bail:
+
/* in case these memories have not freed */
slapi_ch_free_string(&newvalue);
slapi_ch_free_string(&sval);
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 95c55e3..b468d32 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -2276,6 +2276,7 @@ static int _cl5RemoveEnv ()
return CL5_SUCCESS;
}
+#ifdef NEED_CL5_REMOVE_LOGS
static int _cl5RemoveLogs ()
{
int rc = CL5_DB_ERROR;
@@ -2321,6 +2322,7 @@ static int _cl5RemoveLogs ()
}
return rc;
}
+#endif /* NEED_CL5_REMOVE_LOGS */
static int _cl5AppInit (PRBool *didRecovery)
{
diff --git a/ldap/servers/plugins/retrocl/retrocl.c b/ldap/servers/plugins/retrocl/retrocl.c
index 271e7fd..556dede 100644
--- a/ldap/servers/plugins/retrocl/retrocl.c
+++ b/ldap/servers/plugins/retrocl/retrocl.c
@@ -358,7 +358,7 @@ static int retrocl_start (Slapi_PBlock *pb)
} else {
retrocl_attributes[i] = slapi_ch_malloc(pos-value+1);
strncpy(retrocl_attributes[i], value, pos-value);
- retrocl_attributes[i][pos-value] = NULL;
+ retrocl_attributes[i][pos-value] = '\0';
retrocl_aliases[i] = slapi_ch_malloc(value+length-pos);
strcpy(retrocl_aliases[i], pos+1);
diff --git a/ldap/servers/plugins/retrocl/retrocl_po.c b/ldap/servers/plugins/retrocl/retrocl_po.c
index 0e537ee..6b1aa56 100644
--- a/ldap/servers/plugins/retrocl/retrocl_po.c
+++ b/ldap/servers/plugins/retrocl/retrocl_po.c
@@ -219,7 +219,7 @@ write_replog_db(
if ( strcasecmp( attributeName, attr_nsuniqueid ) == 0 ) {
Slapi_Entry *entry = NULL;
- char *uniqueId = NULL;
+ const char *uniqueId = NULL;
slapi_pblock_get( pb, SLAPI_ENTRY_POST_OP, &entry );
if ( entry == NULL ) {
@@ -231,7 +231,7 @@ write_replog_db(
slapi_log_error( SLAPI_LOG_PLUGIN, RETROCL_PLUGIN_NAME,
"write_replog_db: add %s: \"%s\"\n", attributeAlias, uniqueId );
- val.bv_val = uniqueId;
+ val.bv_val = (char *)uniqueId;
val.bv_len = strlen( uniqueId );
slapi_entry_add_values( e, attributeAlias, vals );
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index f39c0e9..698c1cd 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -691,10 +691,10 @@ attr_syntax_create(
"Error: the EQUALITY matching rule [%s] is not compatible "
"with the syntax [%s] for the attribute [%s]\n",
mr_equality, attr_syntax, attr_names[0]);
-/*
+#ifdef ENFORCE_MR_SYNTAX_COMPAT
rc = LDAP_INAPPROPRIATE_MATCHING;
goto done;
-*/
+#endif /* ENFORCE_MR_SYNTAX_COMPAT */
}
a.asi_mr_eq_plugin = plugin_mr_find( mr_equality );
if (mr_ordering && !slapi_matchingrule_is_compat(mr_ordering, attr_syntax)) {
@@ -702,10 +702,10 @@ attr_syntax_create(
"Error: the ORDERING matching rule [%s] is not compatible "
"with the syntax [%s] for the attribute [%s]\n",
mr_ordering, attr_syntax, attr_names[0]);
-/*
+#ifdef ENFORCE_MR_SYNTAX_COMPAT
rc = LDAP_INAPPROPRIATE_MATCHING;
goto done;
-*/
+#endif /* ENFORCE_MR_SYNTAX_COMPAT */
}
a.asi_mr_ord_plugin = plugin_mr_find( mr_ordering );
if (mr_substring && !slapi_matchingrule_is_compat(mr_substring, attr_syntax)) {
@@ -713,10 +713,10 @@ attr_syntax_create(
"Error: the SUBSTR matching rule [%s] is not compatible "
"with the syntax [%s] for the attribute [%s]\n",
mr_substring, attr_syntax, attr_names[0]);
-/*
+#ifdef ENFORCE_MR_SYNTAX_COMPAT
rc = LDAP_INAPPROPRIATE_MATCHING;
goto done;
-*/
+#endif /* ENFORCE_MR_SYNTAX_COMPAT */
}
a.asi_mr_sub_plugin = plugin_mr_find( mr_substring );
a.asi_flags = flags;
@@ -736,7 +736,10 @@ attr_syntax_create(
}
*asip = attr_syntax_dup(&a);
+
+#ifdef ENFORCE_MR_SYNTAX_COMPAT
done:
+#endif /* ENFORCE_MR_SYNTAX_COMPAT */
slapi_ch_free((void **)&a.asi_name);
return rc;
diff --git a/ldap/servers/slapd/back-ldbm/back-ldbm.h b/ldap/servers/slapd/back-ldbm/back-ldbm.h
index 1153ff3..b9545b2 100644
--- a/ldap/servers/slapd/back-ldbm/back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/back-ldbm.h
@@ -258,6 +258,7 @@ typedef u_int32_t ID;
#define MAXID ((ID)-3)
#define NOID ((ID)-2)
#define ALLID ((ID)-1)
+#define ID_FMT "%u" /* used in printf-like statements */
/*
* effective only on idl_new_fetch
diff --git a/ldap/servers/slapd/back-ldbm/import-threads.c b/ldap/servers/slapd/back-ldbm/import-threads.c
index 892fd8e..37e1f4d 100644
--- a/ldap/servers/slapd/back-ldbm/import-threads.c
+++ b/ldap/servers/slapd/back-ldbm/import-threads.c
@@ -2460,7 +2460,7 @@ import_get_and_add_parent_rdns(ImportWorkerInfo *info,
if (rc) {
slapi_log_error(SLAPI_LOG_FATAL, "ldif2dbm",
"import_get_and_add_parent_rdns: Failed to "
- "position at ID %lu\n", id);
+ "position at ID " ID_FMT "\n", id);
return rc;
}
/* rdn is allocated in get_value_from_string */
@@ -2468,7 +2468,7 @@ import_get_and_add_parent_rdns(ImportWorkerInfo *info,
if (rc) {
slapi_log_error(SLAPI_LOG_FATAL, "ldif2dbm",
"import_get_and_add_parent_rdns: "
- "Failed to get rdn of entry %lu\n", id);
+ "Failed to get rdn of entry " ID_FMT "\n", id);
goto bail;
}
/* rdn is set to srdn */
@@ -2476,7 +2476,7 @@ import_get_and_add_parent_rdns(ImportWorkerInfo *info,
if (rc < 0) { /* expect rc == 1 since we are setting "rdn" not "dn" */
slapi_log_error(SLAPI_LOG_FATAL, "ldif2dbm",
"import_get_and_add_parent_rdns: "
- "Failed to add rdn %s of entry %lu\n", rdn, id);
+ "Failed to add rdn %s of entry " ID_FMT "\n", rdn, id);
goto bail;
}
rc = get_value_from_string((const char *)data.dptr,
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
index 985b690..6717674 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c
@@ -518,6 +518,20 @@ int attrcrypt_check_enable_cipher(attrcrypt_cipher_entry *ace)
return ret;
}
+int
+attrcrypt_cleanup(attrcrypt_cipher_state *acs)
+{
+ LDAPDebug(LDAP_DEBUG_TRACE,"-> attrcrypt_cleanup\n", 0, 0, 0);
+ if (acs->key) {
+ slapd_pk11_FreeSymKey(acs->key);
+ }
+ if (acs->slot) {
+ slapd_pk11_FreeSlot(acs->slot);
+ }
+ LDAPDebug(LDAP_DEBUG_TRACE,"<- attrcrypt_cleanup\n", 0, 0, 0);
+ return 0;
+}
+
/*
* This function cleans up the inst_attrcrypt_state_private in each backend
* instance.
@@ -525,7 +539,6 @@ int attrcrypt_check_enable_cipher(attrcrypt_cipher_entry *ace)
int
attrcrypt_cleanup_private(ldbm_instance *li)
{
- int i = 0;
attrcrypt_cipher_state **current = NULL;
LDAPDebug(LDAP_DEBUG_TRACE, "-> attrcrypt_cleanup_private\n", 0, 0, 0);
@@ -541,20 +554,6 @@ attrcrypt_cleanup_private(ldbm_instance *li)
return 0;
}
-int
-attrcrypt_cleanup(attrcrypt_cipher_state *acs)
-{
- LDAPDebug(LDAP_DEBUG_TRACE,"-> attrcrypt_cleanup\n", 0, 0, 0);
- if (acs->key) {
- slapd_pk11_FreeSymKey(acs->key);
- }
- if (acs->slot) {
- slapd_pk11_FreeSlot(acs->slot);
- }
- LDAPDebug(LDAP_DEBUG_TRACE,"<- attrcrypt_cleanup\n", 0, 0, 0);
- return 0;
-}
-
static attrcrypt_cipher_state *
attrcrypt_get_acs(backend *be, attrcrypt_private *priv)
{
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index e5faa27..b913d68 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -3080,7 +3080,7 @@ _get_and_add_parent_rdns(backend *be,
if (rc) {
slapi_log_error(SLAPI_LOG_FATAL, "ldif2dbm",
"_get_and_add_parent_rdns: Failed to position "
- "at ID %lu\n", id);
+ "at ID " ID_FMT "\n", id);
goto bail;
}
/* rdn is allocated in get_value_from_string */
@@ -3088,7 +3088,7 @@ _get_and_add_parent_rdns(backend *be,
if (rc) {
slapi_log_error(SLAPI_LOG_FATAL, "ldif2dbm",
"_get_and_add_parent_rdns: "
- "Failed to get rdn of entry %lu\n", id);
+ "Failed to get rdn of entry " ID_FMT "\n", id);
goto bail;
}
/* rdn is going to be set to srdn */
@@ -3096,7 +3096,7 @@ _get_and_add_parent_rdns(backend *be,
if (rc < 0) { /* expect rc == 1 since we are setting "rdn" not "dn" */
slapi_log_error(SLAPI_LOG_FATAL, "ldif2dbm",
"_get_and_add_parent_rdns: "
- "Failed to add rdn %s of entry %lu\n", rdn, id);
+ "Failed to add rdn %s of entry " ID_FMT "\n", rdn, id);
goto bail;
}
/* pid */
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 00558f7..3816d42 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -2882,7 +2882,7 @@ slapi_entry_apply_mods( Slapi_Entry *e, LDAPMod **mods )
int
entry_apply_mods( Slapi_Entry *e, LDAPMod **mods )
{
- int err, j;
+ int err;
LDAPMod **mp = NULL;
LDAPDebug( LDAP_DEBUG_TRACE, "=> entry_apply_mods\n", 0, 0, 0 );
diff --git a/ldap/servers/slapd/modrdn.c b/ldap/servers/slapd/modrdn.c
index 38d1300..7873c80 100644
--- a/ldap/servers/slapd/modrdn.c
+++ b/ldap/servers/slapd/modrdn.c
@@ -383,7 +383,7 @@ op_shared_rename(Slapi_PBlock *pb, int passin_args)
(NULL == newrdn) ? "(null)" : newrdn);
} else {
slapi_log_error(SLAPI_LOG_ARGS, NULL,
- "conn=%" NSPRIu64 " op=%d MODRDN invalid new RDN (\"%s\")\n",
+ "conn=%s op=%d MODRDN invalid new RDN (\"%s\")\n",
LOG_INTERNAL_OP_CON_ID,
LOG_INTERNAL_OP_OP_ID,
(NULL == newrdn) ? "(null)" : newrdn);
@@ -415,7 +415,7 @@ op_shared_rename(Slapi_PBlock *pb, int passin_args)
(NULL == newsuperior) ? "(null)" : newsuperiorbuf);
} else {
slapi_log_error(SLAPI_LOG_ARGS, NULL,
- "conn=%" NSPRIu64 " op=%d MODRDN invalid new superior (\"%s\")",
+ "conn=%s op=%d MODRDN invalid new superior (\"%s\")",
LOG_INTERNAL_OP_CON_ID,
LOG_INTERNAL_OP_OP_ID,
(NULL == newsuperior) ? "(null)" : newsuperiorbuf);
diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c
index 24f66b9..133f60e 100644
--- a/ldap/servers/slapd/plugin.c
+++ b/ldap/servers/slapd/plugin.c
@@ -2888,7 +2888,7 @@ void plugin_print_lists(void)
struct slapdplugin *tmp = NULL;
for (i = 0; i < PLUGIN_LIST_GLOBAL_MAX; i++) {
- if (list = get_plugin_list(i))
+ if ((list = get_plugin_list(i)))
{
slapi_log_error(SLAPI_LOG_PLUGIN, NULL,
"---- Plugin List (type %d) ----\n", i);
diff --git a/ldap/servers/slapd/tools/ldclt/ldclt.h b/ldap/servers/slapd/tools/ldclt/ldclt.h
index e6c858a..c8ead2c 100644
--- a/ldap/servers/slapd/tools/ldclt/ldclt.h
+++ b/ldap/servers/slapd/tools/ldclt/ldclt.h
@@ -740,6 +740,7 @@ extern int connectToServer (thread_context *tttctx); /*JLS 14-03-01*/
extern char *dnFromMessage (thread_context *tttctx, LDAPMessage *res);
extern int doAddEntry (thread_context *tttctx);
extern int doAttrReplace (thread_context *tttctx); /*JLS 21-11-00*/
+extern int doAttrFileReplace (thread_context *tttctx);
extern int doBindOnly (thread_context *tttctx); /*JLS 04-05-01*/
extern int doDeleteEntry (thread_context *tttctx);
extern int doExactSearch (thread_context *tttctx);
14 years, 1 month
.gitignore ldap/servers
by Noriko Hosoi
.gitignore | 1 +
ldap/servers/slapd/bind.c | 14 +++++++++++++-
ldap/servers/slapd/libglobs.c | 35 ++++++++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 2 ++
ldap/servers/slapd/slap.h | 2 ++
5 files changed, 52 insertions(+), 2 deletions(-)
New commits:
commit 417e1542fde56d485979daa85d357c5fc14b04d5
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Mar 8 09:35:02 2010 -0800
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
https://bugzilla.redhat.com/show_bug.cgi?id=554573
Resolves: bug 554573
Bug Description: ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
Reviewed by: ???
Branch: HEAD
Fix Description: Added a new config option - nsslapd-force-sasl-external (on/off)
default is off - when set to on, a SIMPLE bind on a connection that has set
a DN from a cert will be changed to be a SASL/EXTERNAL bind.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: yes - new attribute to document
Note: This commit is for reapplying the patch I accidentally reverted
by the previous revert (031e725dce895bf2382ca7801cef772fe6b24c61).
(see commit f4b90ed5e43fa06ea6185cf17073b7a32db6ef4c, as well)
commit 031e725dce895bf2382ca7801cef772fe6b24c61
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Mar 5 16:09:28 2010 -0800
Revert "Merge branch '547503'"
This reverts commit f2a04fdc45cc8a408267019990504354282c4303, reversing
changes made to 0b95451c7e50cb6b2d0cb310dddca18336e1b2ac.
diff --git a/.gitignore b/.gitignore
index 4e68831..c1ba6bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
autom4te.cache
*~
+*.patch
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index 3458ff6..d3e9009 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -305,7 +305,8 @@ do_bind( Slapi_PBlock *pb )
switch ( version ) {
case LDAP_VERSION2:
if (method == LDAP_AUTH_SIMPLE
- && (dn == NULL || *dn == '\0') && cred.bv_len == 0
+ && (config_get_force_sasl_external() ||
+ ((dn == NULL || *dn == '\0') && cred.bv_len == 0))
&& pb->pb_conn->c_external_dn != NULL) {
/* Treat this like a SASL EXTERNAL Bind: */
method = LDAP_AUTH_SASL;
@@ -317,6 +318,17 @@ do_bind( Slapi_PBlock *pb )
}
break;
case LDAP_VERSION3:
+ if ((method == LDAP_AUTH_SIMPLE) &&
+ config_get_force_sasl_external() &&
+ (pb->pb_conn->c_external_dn != NULL)) {
+ /* Treat this like a SASL EXTERNAL Bind: */
+ method = LDAP_AUTH_SASL;
+ saslmech = slapi_ch_strdup (LDAP_SASL_EXTERNAL);
+ /* This enables a client to establish an identity by sending
+ * a certificate in the SSL handshake, and also use LDAPv2
+ * (by sending this type of Bind request).
+ */
+ }
break;
default:
LDAPDebug( LDAP_DEBUG_TRACE, "bind: unknown LDAP protocol version %d\n",
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index c4026ac..89a3c79 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -620,7 +620,11 @@ static struct config_get_and_set {
(ConfigGetFunc)config_get_anon_access_switch},
{CONFIG_MINSSF_ATTRIBUTE, config_set_minssf,
NULL, 0,
- (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL}
+ (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL},
+ {CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE, config_set_force_sasl_external,
+ NULL, 0,
+ (void**)&global_slapdFrontendConfig.force_sasl_external, CONFIG_ON_OFF,
+ (ConfigGetFunc)config_get_force_sasl_external}
#ifdef MEMPOOL_EXPERIMENTAL
,{CONFIG_MEMPOOL_SWITCH_ATTRIBUTE, config_set_mempool_switch,
NULL, 0,
@@ -921,6 +925,7 @@ FrontendConfig_init () {
cfg->rewrite_rfc1274 = LDAP_OFF;
cfg->schemareplace = slapi_ch_strdup( CONFIG_SCHEMAREPLACE_STR_REPLICATION_ONLY );
cfg->schema_ignore_trailing_spaces = SLAPD_DEFAULT_SCHEMA_IGNORE_TRAILING_SPACES;
+ cfg->force_sasl_external = LDAP_OFF; /* do not force sasl external by default - let clients abide by the LDAP standards and send us a SASL/EXTERNAL bind if that's what they want to do */
cfg->pwpolicy_local = LDAP_OFF;
cfg->pw_policy.pw_change = LDAP_ON;
@@ -5491,6 +5496,34 @@ config_set_anon_access_switch( const char *attrname, char *value,
return retVal;
}
+int
+config_get_force_sasl_external(void)
+{
+ int retVal;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ CFG_LOCK_READ(slapdFrontendConfig);
+ retVal = slapdFrontendConfig->force_sasl_external;
+ CFG_UNLOCK_READ(slapdFrontendConfig);
+
+ return retVal;
+}
+
+int
+config_set_force_sasl_external( const char *attrname, char *value,
+ char *errorbuf, int apply )
+{
+ int retVal = LDAP_SUCCESS;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+
+ retVal = config_set_onoff(attrname,
+ value,
+ &(slapdFrontendConfig->force_sasl_external),
+ errorbuf,
+ apply);
+
+ return retVal;
+}
+
/*
* This function is intended to be used from the dse code modify callback. It
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 9133958..be3b9dd 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -370,6 +370,7 @@ int config_set_anon_access_switch(const char *attrname, char *value, char *error
int config_set_minssf(const char *attrname, char *value, char *errorbuf, int apply );
int config_set_accesslogbuffering(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_csnlogging(const char *attrname, char *value, char *errorbuf, int apply);
+int config_set_force_sasl_external(const char *attrname, char *value, char *errorbuf, int apply );
#if !defined(_WIN32) && !defined(AIX)
int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply );
@@ -507,6 +508,7 @@ int config_get_mempool_maxfreelist();
long config_get_system_page_size();
int config_get_system_page_bits();
#endif
+int config_get_force_sasl_external();
int is_abspath(const char *);
char* rel2abspath( char * );
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index adef7a8..589756f 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -1869,6 +1869,7 @@ typedef struct _slapdEntryPoints {
#define CONFIG_SSL_CHECK_HOSTNAME_ATTRIBUTE "nsslapd-ssl-check-hostname"
#define CONFIG_HASH_FILTERS_ATTRIBUTE "nsslapd-hash-filters"
#define CONFIG_OUTBOUND_LDAP_IO_TIMEOUT_ATTRIBUTE "nsslapd-outbound-ldap-io-timeout"
+#define CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE "nsslapd-force-sasl-external"
#ifdef MEMPOOL_EXPERIMENTAL
#define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool"
@@ -2084,6 +2085,7 @@ typedef struct _slapdFrontendConfig {
long system_page_size; /* system page size */
int system_page_bits; /* bit count to shift the system page size */
#endif /* MEMPOOL_EXPERIMENTAL */
+ int force_sasl_external; /* force SIMPLE bind to be SASL/EXTERNAL if client cert credentials were supplied */
} slapdFrontendConfig_t;
/* possible values for slapdFrontendConfig_t.schemareplace */
14 years, 1 month
.gitignore ldap/servers
by Noriko Hosoi
.gitignore | 1 -
ldap/servers/slapd/bind.c | 14 +-------------
ldap/servers/slapd/libglobs.c | 35 +----------------------------------
ldap/servers/slapd/proto-slap.h | 2 --
ldap/servers/slapd/slap.h | 2 --
5 files changed, 2 insertions(+), 52 deletions(-)
New commits:
commit 031e725dce895bf2382ca7801cef772fe6b24c61
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Mar 5 16:09:28 2010 -0800
Revert "Merge branch '547503'"
This reverts commit f2a04fdc45cc8a408267019990504354282c4303, reversing
changes made to 0b95451c7e50cb6b2d0cb310dddca18336e1b2ac.
diff --git a/.gitignore b/.gitignore
index c1ba6bd..4e68831 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,2 @@
autom4te.cache
*~
-*.patch
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index d3e9009..3458ff6 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -305,8 +305,7 @@ do_bind( Slapi_PBlock *pb )
switch ( version ) {
case LDAP_VERSION2:
if (method == LDAP_AUTH_SIMPLE
- && (config_get_force_sasl_external() ||
- ((dn == NULL || *dn == '\0') && cred.bv_len == 0))
+ && (dn == NULL || *dn == '\0') && cred.bv_len == 0
&& pb->pb_conn->c_external_dn != NULL) {
/* Treat this like a SASL EXTERNAL Bind: */
method = LDAP_AUTH_SASL;
@@ -318,17 +317,6 @@ do_bind( Slapi_PBlock *pb )
}
break;
case LDAP_VERSION3:
- if ((method == LDAP_AUTH_SIMPLE) &&
- config_get_force_sasl_external() &&
- (pb->pb_conn->c_external_dn != NULL)) {
- /* Treat this like a SASL EXTERNAL Bind: */
- method = LDAP_AUTH_SASL;
- saslmech = slapi_ch_strdup (LDAP_SASL_EXTERNAL);
- /* This enables a client to establish an identity by sending
- * a certificate in the SSL handshake, and also use LDAPv2
- * (by sending this type of Bind request).
- */
- }
break;
default:
LDAPDebug( LDAP_DEBUG_TRACE, "bind: unknown LDAP protocol version %d\n",
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 89a3c79..c4026ac 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -620,11 +620,7 @@ static struct config_get_and_set {
(ConfigGetFunc)config_get_anon_access_switch},
{CONFIG_MINSSF_ATTRIBUTE, config_set_minssf,
NULL, 0,
- (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL},
- {CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE, config_set_force_sasl_external,
- NULL, 0,
- (void**)&global_slapdFrontendConfig.force_sasl_external, CONFIG_ON_OFF,
- (ConfigGetFunc)config_get_force_sasl_external}
+ (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL}
#ifdef MEMPOOL_EXPERIMENTAL
,{CONFIG_MEMPOOL_SWITCH_ATTRIBUTE, config_set_mempool_switch,
NULL, 0,
@@ -925,7 +921,6 @@ FrontendConfig_init () {
cfg->rewrite_rfc1274 = LDAP_OFF;
cfg->schemareplace = slapi_ch_strdup( CONFIG_SCHEMAREPLACE_STR_REPLICATION_ONLY );
cfg->schema_ignore_trailing_spaces = SLAPD_DEFAULT_SCHEMA_IGNORE_TRAILING_SPACES;
- cfg->force_sasl_external = LDAP_OFF; /* do not force sasl external by default - let clients abide by the LDAP standards and send us a SASL/EXTERNAL bind if that's what they want to do */
cfg->pwpolicy_local = LDAP_OFF;
cfg->pw_policy.pw_change = LDAP_ON;
@@ -5496,34 +5491,6 @@ config_set_anon_access_switch( const char *attrname, char *value,
return retVal;
}
-int
-config_get_force_sasl_external(void)
-{
- int retVal;
- slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
- CFG_LOCK_READ(slapdFrontendConfig);
- retVal = slapdFrontendConfig->force_sasl_external;
- CFG_UNLOCK_READ(slapdFrontendConfig);
-
- return retVal;
-}
-
-int
-config_set_force_sasl_external( const char *attrname, char *value,
- char *errorbuf, int apply )
-{
- int retVal = LDAP_SUCCESS;
- slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
-
- retVal = config_set_onoff(attrname,
- value,
- &(slapdFrontendConfig->force_sasl_external),
- errorbuf,
- apply);
-
- return retVal;
-}
-
/*
* This function is intended to be used from the dse code modify callback. It
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index be3b9dd..9133958 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -370,7 +370,6 @@ int config_set_anon_access_switch(const char *attrname, char *value, char *error
int config_set_minssf(const char *attrname, char *value, char *errorbuf, int apply );
int config_set_accesslogbuffering(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_csnlogging(const char *attrname, char *value, char *errorbuf, int apply);
-int config_set_force_sasl_external(const char *attrname, char *value, char *errorbuf, int apply );
#if !defined(_WIN32) && !defined(AIX)
int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply );
@@ -508,7 +507,6 @@ int config_get_mempool_maxfreelist();
long config_get_system_page_size();
int config_get_system_page_bits();
#endif
-int config_get_force_sasl_external();
int is_abspath(const char *);
char* rel2abspath( char * );
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 589756f..adef7a8 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -1869,7 +1869,6 @@ typedef struct _slapdEntryPoints {
#define CONFIG_SSL_CHECK_HOSTNAME_ATTRIBUTE "nsslapd-ssl-check-hostname"
#define CONFIG_HASH_FILTERS_ATTRIBUTE "nsslapd-hash-filters"
#define CONFIG_OUTBOUND_LDAP_IO_TIMEOUT_ATTRIBUTE "nsslapd-outbound-ldap-io-timeout"
-#define CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE "nsslapd-force-sasl-external"
#ifdef MEMPOOL_EXPERIMENTAL
#define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool"
@@ -2085,7 +2084,6 @@ typedef struct _slapdFrontendConfig {
long system_page_size; /* system page size */
int system_page_bits; /* bit count to shift the system page size */
#endif /* MEMPOOL_EXPERIMENTAL */
- int force_sasl_external; /* force SIMPLE bind to be SASL/EXTERNAL if client cert credentials were supplied */
} slapdFrontendConfig_t;
/* possible values for slapdFrontendConfig_t.schemareplace */
14 years, 1 month
esc/src/app/xul/esc/chrome/content/esc password.js, 1.4, 1.5 password.xul, 1.5, 1.6
by Jack Magne
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv26530
Modified Files:
password.js password.xul
Log Message:
Fix bug#568514 ESC crashes after leaving the computer untouched.
Index: password.js
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/password.js,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- password.js 4 Feb 2009 01:43:47 -0000 1.4
+++ password.js 5 Mar 2010 23:58:08 -0000 1.5
@@ -42,6 +42,22 @@
window.close();
}
+//
+// unregister our notify event
+//
+function cleanup()
+{
+ TrayRemoveWindow(null);
+ try {
+ netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+ netkey.rhCoolKeyUnSetNotifyCallback(gNotify);
+ } catch(e) {
+ MyAlert(getBundleString("errorUniversalXPConnect") + e);
+ }
+
+}
+
+
function GetLocalPINValue()
{
Index: password.xul
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/password.xul,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- password.xul 7 Jun 2009 00:09:16 -0000 1.5
+++ password.xul 5 Mar 2010 23:58:08 -0000 1.6
@@ -23,6 +23,7 @@
id="esc-window"
title="&getESCPassword;"
onload="PasswordLoad();"
+ onunload="cleanup();"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<stringbundle id="esc_strings" src="chrome://esc/locale/esc.properties"/>
14 years, 1 month
esc/src/app/xul/esc/chrome/content/esc password.js, 1.4, 1.4.2.1 password.xul, 1.5, 1.5.2.1
by Jack Magne
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv26412
Modified Files:
Tag: PKI_8_0_RTM_BRANCH
password.js password.xul
Log Message:
Fix bug#568514 ESC crashes after leaving the computer untouched.
Index: password.js
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/password.js,v
retrieving revision 1.4
retrieving revision 1.4.2.1
diff -u -r1.4 -r1.4.2.1
--- password.js 4 Feb 2009 01:43:47 -0000 1.4
+++ password.js 5 Mar 2010 23:57:11 -0000 1.4.2.1
@@ -42,6 +42,22 @@
window.close();
}
+//
+// unregister our notify event
+//
+function cleanup()
+{
+ TrayRemoveWindow(null);
+ try {
+ netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+ netkey.rhCoolKeyUnSetNotifyCallback(gNotify);
+ } catch(e) {
+ MyAlert(getBundleString("errorUniversalXPConnect") + e);
+ }
+
+}
+
+
function GetLocalPINValue()
{
Index: password.xul
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/password.xul,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- password.xul 7 Jun 2009 00:09:16 -0000 1.5
+++ password.xul 5 Mar 2010 23:57:11 -0000 1.5.2.1
@@ -23,6 +23,7 @@
id="esc-window"
title="&getESCPassword;"
onload="PasswordLoad();"
+ onunload="cleanup();"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<stringbundle id="esc_strings" src="chrome://esc/locale/esc.properties"/>
14 years, 1 month
2 commits - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/replication/repl5.h | 6 ++++
ldap/servers/plugins/replication/repl5_protocol.c | 28 ++++++++++++++++++++++
ldap/servers/plugins/replication/repl_extop.c | 24 ++++++++++++++++++
3 files changed, 58 insertions(+)
New commits:
commit f2a04fdc45cc8a408267019990504354282c4303
Merge: f4b90ed... 0b95451...
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Mar 5 15:06:43 2010 -0800
Merge branch '547503'
commit 0b95451c7e50cb6b2d0cb310dddca18336e1b2ac
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Mar 5 10:07:38 2010 -0800
570667 - MMR: simultaneous total updates on the masters cause
deadlock and data loss
https://bugzilla.redhat.com/show_bug.cgi?id=570667
Description: In the MMR topology, if a master receives a total
update request to initialize the other master and being initialized
by the other master at the same time, the 2 replication threads hang
and the replicated backend instance could be wiped out.
To prevent the server running the total update supplier and the
consumer at the same time, REPLICA_TOTAL_EXCL_SEND and _RECV bits
have been introduced. If the server is sending the total update
to other replicas, the server rejects the total update request
on the backend. But the server can send multiple total updates
to other replicas at the same time. If the total update from
other master is in progress on the server, the server rejects
another total update from yet another master as well as a request
to initialize other replicas.
diff --git a/ldap/servers/plugins/replication/repl5.h b/ldap/servers/plugins/replication/repl5.h
index 97ce556..c6859dd 100644
--- a/ldap/servers/plugins/replication/repl5.h
+++ b/ldap/servers/plugins/replication/repl5.h
@@ -521,6 +521,12 @@ void replica_write_ruv (Replica *r);
#define REPLICA_INCREMENTAL_IN_PROGRESS 2 /* Set only between start and stop inc */
#define REPLICA_TOTAL_IN_PROGRESS 4 /* Set only between start and stop total */
#define REPLICA_AGREEMENTS_DISABLED 8 /* Replica is offline */
+#define REPLICA_TOTAL_EXCL_SEND 16 /* The server is either sending or receiving
+ the total update. Introducing it if SEND
+ is active, RECV should back off. And
+ vice versa. But SEND can coexist. */
+#define REPLICA_TOTAL_EXCL_RECV 32 /* ditto */
+
PRBool replica_is_state_flag_set(Replica *r, PRInt32 flag);
void replica_set_state_flag (Replica *r, PRUint32 flag, PRBool clear);
void replica_set_tombstone_reap_stop(Replica *r, PRBool val);
diff --git a/ldap/servers/plugins/replication/repl5_protocol.c b/ldap/servers/plugins/replication/repl5_protocol.c
index 927c450..efb3271 100644
--- a/ldap/servers/plugins/replication/repl5_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_protocol.c
@@ -317,6 +317,28 @@ prot_thread_main(void *arg)
dev_debug("prot_thread_main(STATE_PERFORMING_INCREMENTAL_UPDATE): end");
break;
case STATE_PERFORMING_TOTAL_UPDATE:
+ {
+ Slapi_DN *dn = agmt_get_replarea(agmt);
+ Replica *replica = NULL;
+ Object *replica_obj = replica_get_replica_from_dn(dn);
+ if (replica_obj)
+ {
+ replica = (Replica*) object_get_data (replica_obj);
+ /* If total update against this replica is in progress,
+ * we should not initiate the total update to other replicas. */
+ if (replica_is_state_flag_set(replica, REPLICA_TOTAL_EXCL_RECV))
+ {
+ object_release(replica_obj);
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
+ "%s: total update on the replica is in progress. Cannot initiate the total update.\n", agmt_get_long_name(rp->agmt));
+ break;
+ }
+ else
+ {
+ replica_set_state_flag (replica, REPLICA_TOTAL_EXCL_SEND, 0);
+ }
+ }
+
PR_Lock(rp->lock);
/* stop incremental protocol if running */
@@ -332,7 +354,13 @@ prot_thread_main(void *arg)
replica initialization is completed. */
agmt_replica_init_done (agmt);
+ if (replica_obj)
+ {
+ replica_set_state_flag (replica, REPLICA_TOTAL_EXCL_SEND, 1);
+ object_release(replica_obj);
+ }
break;
+ }
case STATE_FINISHED:
dev_debug("prot_thread_main(STATE_FINISHED): exiting prot_thread_main");
done = 1;
diff --git a/ldap/servers/plugins/replication/repl_extop.c b/ldap/servers/plugins/replication/repl_extop.c
index b65c6c8..c47ea93 100644
--- a/ldap/servers/plugins/replication/repl_extop.c
+++ b/ldap/servers/plugins/replication/repl_extop.c
@@ -678,6 +678,25 @@ multimaster_extop_StartNSDS50ReplicationRequest(Slapi_PBlock *pb)
goto send_response;
}
+ if (REPL_PROTOCOL_50_TOTALUPDATE == connext->repl_protocol_version)
+ {
+ /* If total update has been initiated against other replicas or
+ * this replica is already being initialized, we should return
+ * an error immediately. */
+ if (replica_is_state_flag_set(replica,
+ REPLICA_TOTAL_EXCL_SEND|REPLICA_TOTAL_EXCL_RECV))
+ {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
+ "%s: total update on is initiated on the replica. Cannot execute the total update from other master.\n", repl_root);
+ response = NSDS50_REPL_REPLICA_BUSY;
+ goto send_response;
+ }
+ else
+ {
+ replica_set_state_flag (replica, REPLICA_TOTAL_EXCL_RECV, 0);
+ }
+ }
+
/* check that this replica is not a 4.0 consumer */
if (replica_is_legacy_consumer (replica))
{
@@ -861,6 +880,11 @@ multimaster_extop_StartNSDS50ReplicationRequest(Slapi_PBlock *pb)
slapi_pblock_get(pb, SLAPI_CONNECTION, &connext->connection);
send_response:
+ if (connext && replica &&
+ (REPL_PROTOCOL_50_TOTALUPDATE == connext->repl_protocol_version))
+ {
+ replica_set_state_flag (replica, REPLICA_TOTAL_EXCL_RECV, 1);
+ }
if (response != NSDS50_REPL_REPLICA_READY)
{
int resp_log_level = SLAPI_LOG_FATAL;
14 years, 1 month
Branch 'Directory_Server_8_2_Branch' - .gitignore ldap/servers
by Richard Allen Megginson
.gitignore | 1 +
ldap/servers/slapd/bind.c | 14 +++++++++++++-
ldap/servers/slapd/libglobs.c | 35 ++++++++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 2 ++
ldap/servers/slapd/slap.h | 2 ++
5 files changed, 52 insertions(+), 2 deletions(-)
New commits:
commit 9d5dd1348c4b33e31181291477a4d87e47a3da81
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Fri Mar 5 12:13:08 2010 -0700
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
https://bugzilla.redhat.com/show_bug.cgi?id=554573
Resolves: bug 554573
Bug Description: ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
Reviewed by: nhosoi (Thanks!)
Branch: Directory_Server_8_2_Branch
Fix Description: Added a new config option - nsslapd-force-sasl-external (on/off)
default is off - when set to on, a SIMPLE bind on a connection that has set
a DN from a cert will be changed to be a SASL/EXTERNAL bind.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: yes - new attribute to document
(cherry picked from commit f4b90ed5e43fa06ea6185cf17073b7a32db6ef4c)
diff --git a/.gitignore b/.gitignore
index 4e68831..c1ba6bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
autom4te.cache
*~
+*.patch
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index b2604c1..4fe4a05 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -305,7 +305,8 @@ do_bind( Slapi_PBlock *pb )
switch ( version ) {
case LDAP_VERSION2:
if (method == LDAP_AUTH_SIMPLE
- && (dn == NULL || *dn == '\0') && cred.bv_len == 0
+ && (config_get_force_sasl_external() ||
+ ((dn == NULL || *dn == '\0') && cred.bv_len == 0))
&& pb->pb_conn->c_external_dn != NULL) {
/* Treat this like a SASL EXTERNAL Bind: */
method = LDAP_AUTH_SASL;
@@ -317,6 +318,17 @@ do_bind( Slapi_PBlock *pb )
}
break;
case LDAP_VERSION3:
+ if ((method == LDAP_AUTH_SIMPLE) &&
+ config_get_force_sasl_external() &&
+ (pb->pb_conn->c_external_dn != NULL)) {
+ /* Treat this like a SASL EXTERNAL Bind: */
+ method = LDAP_AUTH_SASL;
+ saslmech = slapi_ch_strdup (LDAP_SASL_EXTERNAL);
+ /* This enables a client to establish an identity by sending
+ * a certificate in the SSL handshake, and also use LDAPv2
+ * (by sending this type of Bind request).
+ */
+ }
break;
default:
LDAPDebug( LDAP_DEBUG_TRACE, "bind: unknown LDAP protocol version %d\n",
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 8f02d03..9295861 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -620,7 +620,11 @@ static struct config_get_and_set {
(ConfigGetFunc)config_get_anon_access_switch},
{CONFIG_MINSSF_ATTRIBUTE, config_set_minssf,
NULL, 0,
- (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL}
+ (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL},
+ {CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE, config_set_force_sasl_external,
+ NULL, 0,
+ (void**)&global_slapdFrontendConfig.force_sasl_external, CONFIG_ON_OFF,
+ (ConfigGetFunc)config_get_force_sasl_external}
#ifdef MEMPOOL_EXPERIMENTAL
,{CONFIG_MEMPOOL_SWITCH_ATTRIBUTE, config_set_mempool_switch,
NULL, 0,
@@ -921,6 +925,7 @@ FrontendConfig_init () {
cfg->rewrite_rfc1274 = LDAP_OFF;
cfg->schemareplace = slapi_ch_strdup( CONFIG_SCHEMAREPLACE_STR_REPLICATION_ONLY );
cfg->schema_ignore_trailing_spaces = SLAPD_DEFAULT_SCHEMA_IGNORE_TRAILING_SPACES;
+ cfg->force_sasl_external = LDAP_OFF; /* do not force sasl external by default - let clients abide by the LDAP standards and send us a SASL/EXTERNAL bind if that's what they want to do */
cfg->pwpolicy_local = LDAP_OFF;
cfg->pw_policy.pw_change = LDAP_ON;
@@ -5491,6 +5496,34 @@ config_set_anon_access_switch( const char *attrname, char *value,
return retVal;
}
+int
+config_get_force_sasl_external(void)
+{
+ int retVal;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ CFG_LOCK_READ(slapdFrontendConfig);
+ retVal = slapdFrontendConfig->force_sasl_external;
+ CFG_UNLOCK_READ(slapdFrontendConfig);
+
+ return retVal;
+}
+
+int
+config_set_force_sasl_external( const char *attrname, char *value,
+ char *errorbuf, int apply )
+{
+ int retVal = LDAP_SUCCESS;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+
+ retVal = config_set_onoff(attrname,
+ value,
+ &(slapdFrontendConfig->force_sasl_external),
+ errorbuf,
+ apply);
+
+ return retVal;
+}
+
/*
* This function is intended to be used from the dse code modify callback. It
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index feca39a..5608670 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -349,6 +349,7 @@ int config_set_anon_access_switch(const char *attrname, char *value, char *error
int config_set_minssf(const char *attrname, char *value, char *errorbuf, int apply );
int config_set_accesslogbuffering(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_csnlogging(const char *attrname, char *value, char *errorbuf, int apply);
+int config_set_force_sasl_external(const char *attrname, char *value, char *errorbuf, int apply );
#if !defined(_WIN32) && !defined(AIX)
int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply );
@@ -486,6 +487,7 @@ int config_get_mempool_maxfreelist();
long config_get_system_page_size();
int config_get_system_page_bits();
#endif
+int config_get_force_sasl_external();
int is_abspath(const char *);
char* rel2abspath( char * );
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index e7c0dc6..9a860e9 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -1835,6 +1835,7 @@ typedef struct _slapdEntryPoints {
#define CONFIG_SSL_CHECK_HOSTNAME_ATTRIBUTE "nsslapd-ssl-check-hostname"
#define CONFIG_HASH_FILTERS_ATTRIBUTE "nsslapd-hash-filters"
#define CONFIG_OUTBOUND_LDAP_IO_TIMEOUT_ATTRIBUTE "nsslapd-outbound-ldap-io-timeout"
+#define CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE "nsslapd-force-sasl-external"
#ifdef MEMPOOL_EXPERIMENTAL
#define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool"
@@ -2050,6 +2051,7 @@ typedef struct _slapdFrontendConfig {
long system_page_size; /* system page size */
int system_page_bits; /* bit count to shift the system page size */
#endif /* MEMPOOL_EXPERIMENTAL */
+ int force_sasl_external; /* force SIMPLE bind to be SASL/EXTERNAL if client cert credentials were supplied */
} slapdFrontendConfig_t;
/* possible values for slapdFrontendConfig_t.schemareplace */
14 years, 1 month
.gitignore ldap/servers
by Richard Allen Megginson
.gitignore | 1 +
ldap/servers/slapd/bind.c | 14 +++++++++++++-
ldap/servers/slapd/libglobs.c | 35 ++++++++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 2 ++
ldap/servers/slapd/slap.h | 2 ++
5 files changed, 52 insertions(+), 2 deletions(-)
New commits:
commit f4b90ed5e43fa06ea6185cf17073b7a32db6ef4c
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Fri Mar 5 12:13:08 2010 -0700
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
https://bugzilla.redhat.com/show_bug.cgi?id=554573
Resolves: bug 554573
Bug Description: ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: Added a new config option - nsslapd-force-sasl-external (on/off)
default is off - when set to on, a SIMPLE bind on a connection that has set
a DN from a cert will be changed to be a SASL/EXTERNAL bind.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: yes - new attribute to document
diff --git a/.gitignore b/.gitignore
index 4e68831..c1ba6bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
autom4te.cache
*~
+*.patch
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index 3458ff6..d3e9009 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -305,7 +305,8 @@ do_bind( Slapi_PBlock *pb )
switch ( version ) {
case LDAP_VERSION2:
if (method == LDAP_AUTH_SIMPLE
- && (dn == NULL || *dn == '\0') && cred.bv_len == 0
+ && (config_get_force_sasl_external() ||
+ ((dn == NULL || *dn == '\0') && cred.bv_len == 0))
&& pb->pb_conn->c_external_dn != NULL) {
/* Treat this like a SASL EXTERNAL Bind: */
method = LDAP_AUTH_SASL;
@@ -317,6 +318,17 @@ do_bind( Slapi_PBlock *pb )
}
break;
case LDAP_VERSION3:
+ if ((method == LDAP_AUTH_SIMPLE) &&
+ config_get_force_sasl_external() &&
+ (pb->pb_conn->c_external_dn != NULL)) {
+ /* Treat this like a SASL EXTERNAL Bind: */
+ method = LDAP_AUTH_SASL;
+ saslmech = slapi_ch_strdup (LDAP_SASL_EXTERNAL);
+ /* This enables a client to establish an identity by sending
+ * a certificate in the SSL handshake, and also use LDAPv2
+ * (by sending this type of Bind request).
+ */
+ }
break;
default:
LDAPDebug( LDAP_DEBUG_TRACE, "bind: unknown LDAP protocol version %d\n",
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index c4026ac..89a3c79 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -620,7 +620,11 @@ static struct config_get_and_set {
(ConfigGetFunc)config_get_anon_access_switch},
{CONFIG_MINSSF_ATTRIBUTE, config_set_minssf,
NULL, 0,
- (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL}
+ (void**)&global_slapdFrontendConfig.minssf, CONFIG_INT, NULL},
+ {CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE, config_set_force_sasl_external,
+ NULL, 0,
+ (void**)&global_slapdFrontendConfig.force_sasl_external, CONFIG_ON_OFF,
+ (ConfigGetFunc)config_get_force_sasl_external}
#ifdef MEMPOOL_EXPERIMENTAL
,{CONFIG_MEMPOOL_SWITCH_ATTRIBUTE, config_set_mempool_switch,
NULL, 0,
@@ -921,6 +925,7 @@ FrontendConfig_init () {
cfg->rewrite_rfc1274 = LDAP_OFF;
cfg->schemareplace = slapi_ch_strdup( CONFIG_SCHEMAREPLACE_STR_REPLICATION_ONLY );
cfg->schema_ignore_trailing_spaces = SLAPD_DEFAULT_SCHEMA_IGNORE_TRAILING_SPACES;
+ cfg->force_sasl_external = LDAP_OFF; /* do not force sasl external by default - let clients abide by the LDAP standards and send us a SASL/EXTERNAL bind if that's what they want to do */
cfg->pwpolicy_local = LDAP_OFF;
cfg->pw_policy.pw_change = LDAP_ON;
@@ -5491,6 +5496,34 @@ config_set_anon_access_switch( const char *attrname, char *value,
return retVal;
}
+int
+config_get_force_sasl_external(void)
+{
+ int retVal;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ CFG_LOCK_READ(slapdFrontendConfig);
+ retVal = slapdFrontendConfig->force_sasl_external;
+ CFG_UNLOCK_READ(slapdFrontendConfig);
+
+ return retVal;
+}
+
+int
+config_set_force_sasl_external( const char *attrname, char *value,
+ char *errorbuf, int apply )
+{
+ int retVal = LDAP_SUCCESS;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+
+ retVal = config_set_onoff(attrname,
+ value,
+ &(slapdFrontendConfig->force_sasl_external),
+ errorbuf,
+ apply);
+
+ return retVal;
+}
+
/*
* This function is intended to be used from the dse code modify callback. It
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 9133958..be3b9dd 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -370,6 +370,7 @@ int config_set_anon_access_switch(const char *attrname, char *value, char *error
int config_set_minssf(const char *attrname, char *value, char *errorbuf, int apply );
int config_set_accesslogbuffering(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_csnlogging(const char *attrname, char *value, char *errorbuf, int apply);
+int config_set_force_sasl_external(const char *attrname, char *value, char *errorbuf, int apply );
#if !defined(_WIN32) && !defined(AIX)
int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply );
@@ -507,6 +508,7 @@ int config_get_mempool_maxfreelist();
long config_get_system_page_size();
int config_get_system_page_bits();
#endif
+int config_get_force_sasl_external();
int is_abspath(const char *);
char* rel2abspath( char * );
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index adef7a8..589756f 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -1869,6 +1869,7 @@ typedef struct _slapdEntryPoints {
#define CONFIG_SSL_CHECK_HOSTNAME_ATTRIBUTE "nsslapd-ssl-check-hostname"
#define CONFIG_HASH_FILTERS_ATTRIBUTE "nsslapd-hash-filters"
#define CONFIG_OUTBOUND_LDAP_IO_TIMEOUT_ATTRIBUTE "nsslapd-outbound-ldap-io-timeout"
+#define CONFIG_FORCE_SASL_EXTERNAL_ATTRIBUTE "nsslapd-force-sasl-external"
#ifdef MEMPOOL_EXPERIMENTAL
#define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool"
@@ -2084,6 +2085,7 @@ typedef struct _slapdFrontendConfig {
long system_page_size; /* system page size */
int system_page_bits; /* bit count to shift the system page size */
#endif /* MEMPOOL_EXPERIMENTAL */
+ int force_sasl_external; /* force SIMPLE bind to be SASL/EXTERNAL if client cert credentials were supplied */
} slapdFrontendConfig_t;
/* possible values for slapdFrontendConfig_t.schemareplace */
14 years, 1 month
ldap/servers
by Richard Allen Megginson
ldap/servers/slapd/daemon.c | 1 +
1 file changed, 1 insertion(+)
New commits:
commit d66eb3dd9fdb9648b5058161bf8a7740a16fb2d8
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Thu Mar 4 14:50:38 2010 -0700
Bug 551198 - LDAPI: incorrect logging to access log - part 2
https://bugzilla.redhat.com/show_bug.cgi?id=551198
Resolves: bug 551198
Bug Description: LDAPI: incorrect logging to access log - part 2
Reviewed by: andrey.ivanov(a)polytechnique.fr (Thanks!)
Branch: HEAD
Fix Description: Initialize the from PRNetAddr to nulls. That way, if
PR_Accept doesn't fill in the local fields, we can see that they are
empty and set the printed from field to "local".
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 3b8986c..0db7f13 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -2075,6 +2075,7 @@ handle_new_connection(Connection_Table *ct, int tcps, PRFileDesc *pr_acceptfd, i
PRNetAddr from;
PRFileDesc *pr_clonefd = NULL;
+ memset(&from, 0, sizeof(from)); /* reset to nulls so we can see what was set */
if ( (ns = accept_and_configure( tcps, pr_acceptfd, &from,
sizeof(from), secure, local, &pr_clonefd)) == SLAPD_INVALID_SOCKET ) {
return -1;
14 years, 1 month