ldap/servers
by Noriko Hosoi
ldap/servers/slapd/libglobs.c | 1 +
1 file changed, 1 insertion(+)
New commits:
commit e754339c441ea30b5c555171e6723ea74375d523
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Wed Nov 14 13:41:30 2012 -0800
Coverity defect: Resource leak 13110
This commit 94b123780b21e503b78bceca9d60904206ef91fa
introduced the resource leak.
Trac Ticket #447 - Possible to add invalid attribute
to nsslapd-allowed-to-delete-attrs
Fix description: This patch calls slapi_ch_array_free for the
allocated charray "allowed".
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index a7e504f..b19c2d9 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -6508,6 +6508,7 @@ config_set_allowed_to_delete_attrs( const char *attrname, char *value,
slapi_ch_free_string(&vcopy);
vcopy = slapi_ch_strdup(value);
}
+ slapi_ch_array_free(allowed);
CFG_LOCK_WRITE(slapdFrontendConfig);
slapi_ch_free_string(&(slapdFrontendConfig->allowed_to_delete_attrs));
slapdFrontendConfig->allowed_to_delete_attrs = vcopy;
11 years, 5 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/dna/dna.c | 49 ++++++++++++++++++-----------------------
1 file changed, 22 insertions(+), 27 deletions(-)
New commits:
commit 322c4ecc2363c4e7a7107ae2e8aa05aa3a55ddf3
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Nov 14 15:18:57 2012 -0500
Ticket 517 - crash in DNA if no dnaMagicRegen is specified
Bug Description: There are several places where we deference config_entry->generate
Fix Description: Properly check for NULL, and allow the update of dnaType.
https://fedorahosted.org/389/ticket/517
Reviewed by: richm(Thanks Rich)
(cherry picked from commit d97835969db3e957032c52ac317699354299c07c)
diff --git a/ldap/servers/plugins/dna/dna.c b/ldap/servers/plugins/dna/dna.c
index 34d67ab..ef01735 100644
--- a/ldap/servers/plugins/dna/dna.c
+++ b/ldap/servers/plugins/dna/dna.c
@@ -804,10 +804,9 @@ dna_parse_config_entry(Slapi_Entry * e, int apply)
value = slapi_entry_attr_get_charptr(e, DNA_GENERATE);
if (value) {
entry->generate = value;
- }
-
- slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
+ slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
"----------> %s [%s]\n", DNA_GENERATE, entry->generate);
+ }
value = slapi_entry_attr_get_charptr(e, DNA_FILTER);
if (value) {
@@ -2809,8 +2808,7 @@ _dna_pre_op_add(Slapi_PBlock *pb, Slapi_Entry *e)
/* does the entry match the filter? */
if (config_entry->slapi_filter) {
- ret = slapi_vattr_filter_test(pb, e, config_entry->slapi_filter,
- 0);
+ ret = slapi_vattr_filter_test(pb, e, config_entry->slapi_filter, 0);
if (LDAP_SUCCESS != ret) {
goto next;
}
@@ -2820,28 +2818,23 @@ _dna_pre_op_add(Slapi_PBlock *pb, Slapi_Entry *e)
/* For a multi-type range, we only generate a value
* for types where the magic value is set. We do not
* generate a value for missing types. */
- for (i = 0; config_entry->types && config_entry->types[i];
- i++) {
- value = slapi_entry_attr_get_charptr(e,
- config_entry->types[i]);
-
- if (value &&
- !slapi_UTF8CASECMP(config_entry->generate, value)) {
- slapi_ch_array_add(&types_to_generate,
- slapi_ch_strdup(config_entry->types[i]));
+ for (i = 0; config_entry->types && config_entry->types[i]; i++) {
+ value = slapi_entry_attr_get_charptr(e, config_entry->types[i]);
+ if (value){
+ if(config_entry->generate == NULL || !slapi_UTF8CASECMP(config_entry->generate, value)){
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(config_entry->types[i]));
+ }
+ slapi_ch_free_string(&value);
}
- slapi_ch_free_string(&value);
}
} else {
/* For a single type range, we generate the value if
* the magic value is set or if the type is missing. */
value = slapi_entry_attr_get_charptr(e, config_entry->types[0]);
- if ((value &&
- !slapi_UTF8CASECMP(config_entry->generate, value)) ||
- (0 == value)) {
- slapi_ch_array_add(&types_to_generate,
- slapi_ch_strdup(config_entry->types[0]));
+ if((config_entry->generate == NULL) || (0 == value) ||
+ (value && !slapi_UTF8CASECMP(config_entry->generate, value))){
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(config_entry->types[0]));
}
slapi_ch_free_string(&value);
}
@@ -3060,13 +3053,15 @@ _dna_pre_op_modify(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Mods *smods)
/* If we have a value, see if it's the magic value. */
if (bv) {
- len = strlen(config_entry->generate);
- if (len == bv->bv_len) {
- if (!slapi_UTF8NCASECMP(bv->bv_val,
- config_entry->generate,
- len)) {
- slapi_ch_array_add(&types_to_generate,
- slapi_ch_strdup(type));
+ if(config_entry->generate == NULL){
+ /* we don't have a magic number set, so apply the update */
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(type));
+ } else {
+ len = strlen(config_entry->generate);
+ if (len == bv->bv_len) {
+ if (!slapi_UTF8NCASECMP(bv->bv_val, config_entry->generate,len)){
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(type));
+ }
}
}
} else if (!dna_is_multitype_range(config_entry)) {
11 years, 5 months
ldap/servers
by Mark Reynolds
ldap/servers/plugins/dna/dna.c | 49 ++++++++++++++++++-----------------------
1 file changed, 22 insertions(+), 27 deletions(-)
New commits:
commit d97835969db3e957032c52ac317699354299c07c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Nov 14 15:18:57 2012 -0500
Ticket 517 - crash in DNA if no dnaMagicRegen is specified
Bug Description: There are several places where we deference config_entry->generate
Fix Description: Properly check for NULL, and allow the update of dnaType.
https://fedorahosted.org/389/ticket/517
Reviewed by: richm(Thanks Rich)
diff --git a/ldap/servers/plugins/dna/dna.c b/ldap/servers/plugins/dna/dna.c
index 2b56967..66d4a05 100644
--- a/ldap/servers/plugins/dna/dna.c
+++ b/ldap/servers/plugins/dna/dna.c
@@ -804,10 +804,9 @@ dna_parse_config_entry(Slapi_Entry * e, int apply)
value = slapi_entry_attr_get_charptr(e, DNA_GENERATE);
if (value) {
entry->generate = value;
- }
-
- slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
+ slapi_log_error(SLAPI_LOG_CONFIG, DNA_PLUGIN_SUBSYSTEM,
"----------> %s [%s]\n", DNA_GENERATE, entry->generate);
+ }
value = slapi_entry_attr_get_charptr(e, DNA_FILTER);
if (value) {
@@ -2809,8 +2808,7 @@ _dna_pre_op_add(Slapi_PBlock *pb, Slapi_Entry *e)
/* does the entry match the filter? */
if (config_entry->slapi_filter) {
- ret = slapi_vattr_filter_test(pb, e, config_entry->slapi_filter,
- 0);
+ ret = slapi_vattr_filter_test(pb, e, config_entry->slapi_filter, 0);
if (LDAP_SUCCESS != ret) {
goto next;
}
@@ -2820,28 +2818,23 @@ _dna_pre_op_add(Slapi_PBlock *pb, Slapi_Entry *e)
/* For a multi-type range, we only generate a value
* for types where the magic value is set. We do not
* generate a value for missing types. */
- for (i = 0; config_entry->types && config_entry->types[i];
- i++) {
- value = slapi_entry_attr_get_charptr(e,
- config_entry->types[i]);
-
- if (value &&
- !slapi_UTF8CASECMP(config_entry->generate, value)) {
- slapi_ch_array_add(&types_to_generate,
- slapi_ch_strdup(config_entry->types[i]));
+ for (i = 0; config_entry->types && config_entry->types[i]; i++) {
+ value = slapi_entry_attr_get_charptr(e, config_entry->types[i]);
+ if (value){
+ if(config_entry->generate == NULL || !slapi_UTF8CASECMP(config_entry->generate, value)){
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(config_entry->types[i]));
+ }
+ slapi_ch_free_string(&value);
}
- slapi_ch_free_string(&value);
}
} else {
/* For a single type range, we generate the value if
* the magic value is set or if the type is missing. */
value = slapi_entry_attr_get_charptr(e, config_entry->types[0]);
- if ((value &&
- !slapi_UTF8CASECMP(config_entry->generate, value)) ||
- (0 == value)) {
- slapi_ch_array_add(&types_to_generate,
- slapi_ch_strdup(config_entry->types[0]));
+ if((config_entry->generate == NULL) || (0 == value) ||
+ (value && !slapi_UTF8CASECMP(config_entry->generate, value))){
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(config_entry->types[0]));
}
slapi_ch_free_string(&value);
}
@@ -3062,13 +3055,15 @@ _dna_pre_op_modify(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Mods *smods)
/* If we have a value, see if it's the magic value. */
if (bv) {
- len = strlen(config_entry->generate);
- if (len == bv->bv_len) {
- if (!slapi_UTF8NCASECMP(bv->bv_val,
- config_entry->generate,
- len)) {
- slapi_ch_array_add(&types_to_generate,
- slapi_ch_strdup(type));
+ if(config_entry->generate == NULL){
+ /* we don't have a magic number set, so apply the update */
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(type));
+ } else {
+ len = strlen(config_entry->generate);
+ if (len == bv->bv_len) {
+ if (!slapi_UTF8NCASECMP(bv->bv_val, config_entry->generate,len)){
+ slapi_ch_array_add(&types_to_generate, slapi_ch_strdup(type));
+ }
}
}
} else if (!dna_is_multitype_range(config_entry)) {
11 years, 5 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/back-ldbm/ldbm_modrdn.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
New commits:
commit d4dbb3d01a7f3f39c5370a10a02109d90c5140e0
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Wed Nov 14 12:23:06 2012 -0800
Trac Ticket #520 - RedHat Directory Server crashes (segfaults) when moving ldap entry
https://fedorahosted.org/389/ticket/520
Fix description: The code to check if the new superior entry exists
or not was returning the "No such object" error only when the op
was requested by the directory manager. This patch is removing
the condition so that whoever the requester is, it returns the error.
(cherry picked from commit 40e68b18dae23a21654719a742419f172aa54806)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
index c7d821a..69fc053 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
@@ -426,10 +426,11 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
if ( newparententry == NULL )
{
/* There may not be a new parent because we don't intend there to be one. */
- if(slapi_sdn_get_ndn(dn_newsuperiordn)!=NULL)
+ if (slapi_sdn_get_ndn(dn_newsuperiordn))
{
- /* If the new entry is to be a suffix, and we're root, then it's OK that the new parent doesn't exist */
- if (!(slapi_be_issuffix(pb->pb_backend, &dn_newdn)) && isroot)
+ /* If the new entry is not to be a suffix,
+ * return an error no matter who requested this modrdn */
+ if (!slapi_be_issuffix(pb->pb_backend, &dn_newdn))
{
/* Here means that we didn't find the parent */
int err = 0;
@@ -447,7 +448,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
slapi_sdn_get_ndn(dn_newsuperiordn), 0 );
slapi_sdn_done(&ancestorsdn);
goto error_return;
- }
+ }
}
}
else
@@ -465,7 +466,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
if ( parententry == NULL )
{
/* If the entry a suffix, and we're root, then it's OK that the parent doesn't exist */
- if (!(slapi_be_issuffix(pb->pb_backend, sdn)) && isroot)
+ if (!(slapi_be_issuffix(pb->pb_backend, sdn)) && !isroot)
{
/* Here means that we didn't find the parent */
ldap_result_matcheddn = "NULL";
11 years, 5 months
ldap/servers
by Noriko Hosoi
ldap/servers/slapd/back-ldbm/ldbm_modrdn.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
New commits:
commit 40e68b18dae23a21654719a742419f172aa54806
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Wed Nov 14 10:49:35 2012 -0800
Trac Ticket #520 - RedHat Directory Server crashes (segfaults) when moving ldap entry
https://fedorahosted.org/389/ticket/520
Fix description: The code to check if the new superior entry exists
or not was returning the "No such object" error only when the op
was requested by the directory manager. This patch is removing
the condition so that whoever the requester is, it returns the error.
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
index 98b30dc..b6bd61c 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
@@ -549,10 +549,11 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
if ( newparententry == NULL )
{
/* There may not be a new parent because we don't intend there to be one. */
- if(slapi_sdn_get_ndn(dn_newsuperiordn)!=NULL)
+ if (slapi_sdn_get_dn(dn_newsuperiordn))
{
- /* If the new entry is to be a suffix, and we're root, then it's OK that the new parent doesn't exist */
- if (!(slapi_be_issuffix(pb->pb_backend, &dn_newdn)) && isroot)
+ /* If the new entry is not to be a suffix,
+ * return an error no matter who requested this modrdn */
+ if (!slapi_be_issuffix(pb->pb_backend, &dn_newdn))
{
/* Here means that we didn't find the parent */
int err = 0;
@@ -570,7 +571,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
slapi_sdn_get_ndn(dn_newsuperiordn), 0 );
slapi_sdn_done(&ancestorsdn);
goto error_return;
- }
+ }
}
}
else
@@ -588,7 +589,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
if ( parententry == NULL )
{
/* If the entry a suffix, and we're root, then it's OK that the parent doesn't exist */
- if (!(slapi_be_issuffix(pb->pb_backend, sdn)) && isroot)
+ if (!(slapi_be_issuffix(pb->pb_backend, sdn)) && !isroot)
{
/* Here means that we didn't find the parent */
ldap_result_matcheddn = "NULL";
11 years, 5 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/back-ldbm/back-ldbm.h | 5 ++-
ldap/servers/slapd/back-ldbm/idl.c | 7 ++++
ldap/servers/slapd/back-ldbm/index.c | 39 ++++++++++++++++++-------
ldap/servers/slapd/back-ldbm/ldbm_config.c | 23 ++++++++++++++
ldap/servers/slapd/back-ldbm/ldbm_config.h | 1
ldap/servers/slapd/back-ldbm/proto-back-ldbm.h | 1
ldap/servers/slapd/back-ldbm/start.c | 9 +++++
ldap/servers/slapd/back-ldbm/vlv.c | 8 -----
8 files changed, 75 insertions(+), 18 deletions(-)
New commits:
commit 0a54aa676341b7f5f1056373a5067a69cbe54b89
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Nov 13 18:01:57 2012 -0800
Trac Ticket #519 - Search with a complex filter including range search is slow
https://fedorahosted.org/389/ticket/519
Bug description: If a filter contains a range search, the
search retrieves one ID per one idl_fetch and merge it to
the idlist using idl_union, which is slow especially when
the range search result size is large.
Fix description: When the idlist size is larger than nsslapd-
lookthroughlimit, the range search returns ALLID (default
value of nsslapd-lookthroughlimit is 5000). Then, the range
search filter is evaluated before returning to the client.
If the default value of nsslapd-lookthroughlimit can be used,
the search elapsed time is much shorter than generating a
complete idlist in index_range_read_ext. Since the nsslapd-
lookthroughlimit is shared among all the search operations,
larger value might be required for other cases. To have its
own control, this patch introduces a new config parameter
nsslapd-rangelookthroughlimit for the range search.
Also, this patch replaced idl_union in index_range_read_ext
with idl_append_extend and sort the idlist at the end. It
improves the range search, but it is still slower than just
returning ALLID for the large range search.
(cherry picked from commit f026ef0447b18994e0e9b847698703436e874f84)
diff --git a/ldap/servers/slapd/back-ldbm/back-ldbm.h b/ldap/servers/slapd/back-ldbm/back-ldbm.h
index fb45a9f..aed57cf 100644
--- a/ldap/servers/slapd/back-ldbm/back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/back-ldbm.h
@@ -210,7 +210,6 @@ typedef unsigned short u_int16_t;
#define DEFAULT_DBCACHE_SIZE 1000000
#define DEFAULT_MODE 0600
#define DEFAULT_ALLIDSTHRESHOLD 4000
-#define DEFAULT_LOOKTHROUGHLIMIT 5000
#define DEFAULT_IDL_TUNE 1
#define DEFAULT_SEARCH_TUNE 0
#define DEFAULT_IMPORT_INDEX_BUFFER_SIZE 0
@@ -650,6 +649,8 @@ struct ldbminfo {
int li_pagedallidsthreshold;
int li_reslimit_pagedlookthrough_handle;
int li_reslimit_pagedallids_handle; /* allids aka idlistscan */
+ int li_rangelookthroughlimit;
+ int li_reslimit_rangelookthrough_handle;
};
/* li_flags could store these bits defined in ../slapi-plugin.h
@@ -819,6 +820,8 @@ typedef struct _back_search_result_set
/* Name of attribute type used for binder-based look through limit */
#define LDBM_LOOKTHROUGHLIMIT_AT "nsLookThroughLimit"
/* Name of attribute type used for binder-based look through limit */
+#define LDBM_RANGELOOKTHROUGHLIMIT_AT "nsRangeSearchLookThroughLimit"
+/* Name of attribute type used for binder-based look through limit */
#define LDBM_ALLIDSLIMIT_AT "nsIDListScanLimit"
/* Name of attribute type used for binder-based look through simple paged limit */
#define LDBM_PAGEDLOOKTHROUGHLIMIT_AT "nsPagedLookThroughLimit"
diff --git a/ldap/servers/slapd/back-ldbm/idl.c b/ldap/servers/slapd/back-ldbm/idl.c
index 5d467bd..58736f8 100644
--- a/ldap/servers/slapd/back-ldbm/idl.c
+++ b/ldap/servers/slapd/back-ldbm/idl.c
@@ -1620,3 +1620,10 @@ make_cont_key( DBT *contkey, DBT *key, ID id )
sprintf( contkey->dptr, "%c%s%lu", CONT_PREFIX, (char *)key->dptr, (u_long)id );
contkey->dsize = strlen( contkey->dptr ) + 1;
}
+
+int
+idl_sort_cmp(const void *x, const void *y)
+{
+ return *(ID *)x - *(ID *)y;
+}
+
diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c
index a5c6ac5..5948717 100644
--- a/ldap/servers/slapd/back-ldbm/index.c
+++ b/ldap/servers/slapd/back-ldbm/index.c
@@ -1236,6 +1236,7 @@ index_range_read_ext(
time_t curtime, stoptime, optime;
int timelimit = -1;
back_search_result_set *sr = NULL;
+ int isroot = 0;
if (!pb) {
LDAPDebug(LDAP_DEBUG_ANY, "index_range_read: NULL pblock\n",
@@ -1270,11 +1271,11 @@ index_range_read_ext(
if (sr != NULL) {
/* the normal case */
lookthrough_limit = sr->sr_lookthroughlimit;
- } else {
- int isroot = 0;
- slapi_pblock_get( pb, SLAPI_REQUESTOR_ISROOT, &isroot );
- if (!isroot) {
- lookthrough_limit = li->li_lookthroughlimit;
+ }
+ slapi_pblock_get( pb, SLAPI_REQUESTOR_ISROOT, &isroot );
+ if (!isroot) {
+ if (lookthrough_limit > li->li_rangelookthroughlimit) {
+ lookthrough_limit = li->li_rangelookthroughlimit;
}
}
@@ -1478,7 +1479,7 @@ index_range_read_ext(
/* exit the loop when we either run off the end of the table,
* fail to read a key, or read a key that's out of range.
*/
- IDList *tmp, *tmp2;
+ IDList *tmp;
/*
char encbuf [BUFSIZ];
LDAPDebug( LDAP_DEBUG_FILTER, " cur_key=%s(%li bytes)\n",
@@ -1549,10 +1550,22 @@ index_range_read_ext(
encoded(&cur_key, encbuf), (long)cur_key.dsize);
}
} else {
- tmp2 = idl_union( be, idl, tmp );
- idl_free( idl );
- idl_free( tmp );
- idl = tmp2;
+ /* idl tmp only contains one id */
+ /* append it at the end here; sort idlist at the end */
+ if (ALLIDS(tmp)) {
+ idl_free(idl);
+ idl = tmp;
+ } else {
+ ID id;
+ for (id = idl_firstid(tmp); id != NOID; id = idl_nextid(tmp, id)) {
+ *err = idl_append_extend(&idl, id);
+ if (*err) {
+ ldbm_nasty("index_range_read - failed to generate idlist",
+ 1097, *err);
+ }
+ }
+ idl_free(tmp);
+ }
if (ALLIDS(idl)) {
LDAPDebug(LDAP_DEBUG_TRACE, "index_range_read hit an allids value\n",
0, 0, 0);
@@ -1601,6 +1614,12 @@ error:
dblayer_release_index_file( be, ai, db );
+ /* sort idl */
+ if (idl && !ALLIDS(idl)) {
+ qsort((void *)&idl->b_ids[0], idl->b_nids,
+ (size_t)sizeof(ID), idl_sort_cmp);
+ }
+
LDAPDebug( LDAP_DEBUG_TRACE, "<= index_range_read(%s,%s) %lu candidates\n",
type, prefix, (u_long)IDL_NIDS(idl) );
return( idl );
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index d0664eb..232af54 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -187,6 +187,28 @@ static int ldbm_config_pagedlookthroughlimit_set(void *arg, void *value, char *e
return retval;
}
+static void *ldbm_config_rangelookthroughlimit_get(void *arg)
+{
+ struct ldbminfo *li = (struct ldbminfo *) arg;
+
+ return (void *) ((uintptr_t)(li->li_rangelookthroughlimit));
+}
+
+static int ldbm_config_rangelookthroughlimit_set(void *arg, void *value, char *errorbuf, int phase, int apply)
+{
+ struct ldbminfo *li = (struct ldbminfo *) arg;
+ int retval = LDAP_SUCCESS;
+ int val = (int) ((uintptr_t)value);
+
+ /* Do whatever we can to make sure the data is ok. */
+
+ if (apply) {
+ li->li_rangelookthroughlimit = val;
+ }
+
+ return retval;
+}
+
static void *ldbm_config_mode_get(void *arg)
{
struct ldbminfo *li = (struct ldbminfo *) arg;
@@ -1341,6 +1363,7 @@ static config_info ldbm_config[] = {
{CONFIG_ENTRYRDN_NOANCESTORID, CONFIG_TYPE_ONOFF, "off", &ldbm_config_entryrdn_noancestorid_get, &ldbm_config_entryrdn_noancestorid_set, 0 /* no show */},
{CONFIG_PAGEDLOOKTHROUGHLIMIT, CONFIG_TYPE_INT, "0", &ldbm_config_pagedlookthroughlimit_get, &ldbm_config_pagedlookthroughlimit_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONFIG_PAGEDIDLISTSCANLIMIT, CONFIG_TYPE_INT, "0", &ldbm_config_pagedallidsthreshold_get, &ldbm_config_pagedallidsthreshold_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
+ {CONFIG_RANGELOOKTHROUGHLIMIT, CONFIG_TYPE_INT, "5000", &ldbm_config_rangelookthroughlimit_get, &ldbm_config_rangelookthroughlimit_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{NULL, 0, NULL, NULL, NULL, 0}
};
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.h b/ldap/servers/slapd/back-ldbm/ldbm_config.h
index 36b8f60..a5830e3 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.h
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.h
@@ -85,6 +85,7 @@ struct config_info {
#define CONFIG_INSTANCE "nsslapd-instance"
#define CONFIG_LOOKTHROUGHLIMIT "nsslapd-lookthroughlimit"
+#define CONFIG_RANGELOOKTHROUGHLIMIT "nsslapd-rangelookthroughlimit"
#define CONFIG_PAGEDLOOKTHROUGHLIMIT "nsslapd-pagedlookthroughlimit"
#define CONFIG_IDLISTSCANLIMIT "nsslapd-idlistscanlimit"
#define CONFIG_PAGEDIDLISTSCANLIMIT "nsslapd-pagedidlistscanlimit"
diff --git a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
index be4120a..48b3164 100644
--- a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
@@ -235,6 +235,7 @@ int idl_is_allids(IDList *idl);
int idl_append(IDList *idl, ID id);
int idl_append_extend(IDList **idl, ID id);
void idl_insert(IDList **idl, ID id);
+int idl_sort_cmp(const void *x, const void *y);
/*
* idl_delete - delete an id from an id list.
* returns 0 id deleted
diff --git a/ldap/servers/slapd/back-ldbm/start.c b/ldap/servers/slapd/back-ldbm/start.c
index 0f42bed..4276c3b 100644
--- a/ldap/servers/slapd/back-ldbm/start.c
+++ b/ldap/servers/slapd/back-ldbm/start.c
@@ -116,6 +116,15 @@ ldbm_back_start( Slapi_PBlock *pb )
return SLAPI_FAIL_GENERAL;
}
+ /* lookthrough limit for the rangesearch */
+ if ( slapi_reslimit_register( SLAPI_RESLIMIT_TYPE_INT,
+ LDBM_RANGELOOKTHROUGHLIMIT_AT, &li->li_reslimit_rangelookthrough_handle )
+ != SLAPI_RESLIMIT_STATUS_SUCCESS ) {
+ LDAPDebug( LDAP_DEBUG_ANY, "start: Resource limit registration failed for rangelookthroughlimit\n",
+ 0, 0, 0 );
+ return SLAPI_FAIL_GENERAL;
+ }
+
/* If the db directory hasn't been set yet, we need to set it to
* the default. */
if (NULL == li->li_directory || '\0' == li->li_directory[0]) {
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index 7172104..39d16bf 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -1048,12 +1048,6 @@ vlv_build_candidate_list_byvalue( struct vlvIndex* p, DBC *dbc, PRUint32 length,
return si;
}
-static int
-vlv_idl_sort_cmp(const void *x, const void *y)
-{
- return *(ID *)x - *(ID *)y;
-}
-
/* build a candidate list (IDL) from a VLV index, given the starting index
* and the ending index (as an inclusive list).
* returns 0 on success, or an LDAP error code.
@@ -1111,7 +1105,7 @@ int vlv_build_idl(PRUint32 start, PRUint32 stop, DB *db, DBC *dbc,
if (dosort)
{
qsort((void *)&idl->b_ids[0], idl->b_nids,
- (size_t)sizeof(ID), vlv_idl_sort_cmp);
+ (size_t)sizeof(ID), idl_sort_cmp);
}
*candidates = idl;
11 years, 5 months
ldap/servers
by Noriko Hosoi
ldap/servers/slapd/back-ldbm/back-ldbm.h | 5 ++-
ldap/servers/slapd/back-ldbm/idl.c | 7 ++++
ldap/servers/slapd/back-ldbm/index.c | 39 ++++++++++++++++++-------
ldap/servers/slapd/back-ldbm/ldbm_config.c | 23 ++++++++++++++
ldap/servers/slapd/back-ldbm/ldbm_config.h | 1
ldap/servers/slapd/back-ldbm/proto-back-ldbm.h | 1
ldap/servers/slapd/back-ldbm/start.c | 9 +++++
ldap/servers/slapd/back-ldbm/vlv.c | 8 -----
8 files changed, 75 insertions(+), 18 deletions(-)
New commits:
commit f026ef0447b18994e0e9b847698703436e874f84
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Nov 13 18:01:57 2012 -0800
Trac Ticket #519 - Search with a complex filter including range search is slow
https://fedorahosted.org/389/ticket/519
Bug description: If a filter contains a range search, the
search retrieves one ID per one idl_fetch and merge it to
the idlist using idl_union, which is slow especially when
the range search result size is large.
Fix description: When the idlist size is larger than nsslapd-
lookthroughlimit, the range search returns ALLID (default
value of nsslapd-lookthroughlimit is 5000). Then, the range
search filter is evaluated before returning to the client.
If the default value of nsslapd-lookthroughlimit can be used,
the search elapsed time is much shorter than generating a
complete idlist in index_range_read_ext. Since the nsslapd-
lookthroughlimit is shared among all the search operations,
larger value might be required for other cases. To have its
own control, this patch introduces a new config parameter
nsslapd-rangelookthroughlimit for the range search.
Also, this patch replaced idl_union in index_range_read_ext
with idl_append_extend and sort the idlist at the end. It
improves the range search, but it is still slower than just
returning ALLID for the large range search.
diff --git a/ldap/servers/slapd/back-ldbm/back-ldbm.h b/ldap/servers/slapd/back-ldbm/back-ldbm.h
index 39fd950..6536664 100644
--- a/ldap/servers/slapd/back-ldbm/back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/back-ldbm.h
@@ -210,7 +210,6 @@ typedef unsigned short u_int16_t;
#define DEFAULT_DBCACHE_SIZE 1000000
#define DEFAULT_MODE 0600
#define DEFAULT_ALLIDSTHRESHOLD 4000
-#define DEFAULT_LOOKTHROUGHLIMIT 5000
#define DEFAULT_IDL_TUNE 1
#define DEFAULT_SEARCH_TUNE 0
#define DEFAULT_IMPORT_INDEX_BUFFER_SIZE 0
@@ -650,6 +649,8 @@ struct ldbminfo {
int li_pagedallidsthreshold;
int li_reslimit_pagedlookthrough_handle;
int li_reslimit_pagedallids_handle; /* allids aka idlistscan */
+ int li_rangelookthroughlimit;
+ int li_reslimit_rangelookthrough_handle;
};
/* li_flags could store these bits defined in ../slapi-plugin.h
@@ -817,6 +818,8 @@ typedef struct _back_search_result_set
/* Name of attribute type used for binder-based look through limit */
#define LDBM_LOOKTHROUGHLIMIT_AT "nsLookThroughLimit"
/* Name of attribute type used for binder-based look through limit */
+#define LDBM_RANGELOOKTHROUGHLIMIT_AT "nsRangeSearchLookThroughLimit"
+/* Name of attribute type used for binder-based look through limit */
#define LDBM_ALLIDSLIMIT_AT "nsIDListScanLimit"
/* Name of attribute type used for binder-based look through simple paged limit */
#define LDBM_PAGEDLOOKTHROUGHLIMIT_AT "nsPagedLookThroughLimit"
diff --git a/ldap/servers/slapd/back-ldbm/idl.c b/ldap/servers/slapd/back-ldbm/idl.c
index 4227055..65fca7c 100644
--- a/ldap/servers/slapd/back-ldbm/idl.c
+++ b/ldap/servers/slapd/back-ldbm/idl.c
@@ -1620,3 +1620,10 @@ make_cont_key( DBT *contkey, DBT *key, ID id )
sprintf( contkey->dptr, "%c%s%lu", CONT_PREFIX, (char *)key->dptr, (u_long)id );
contkey->dsize = strlen( contkey->dptr ) + 1;
}
+
+int
+idl_sort_cmp(const void *x, const void *y)
+{
+ return *(ID *)x - *(ID *)y;
+}
+
diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c
index a5c6ac5..5948717 100644
--- a/ldap/servers/slapd/back-ldbm/index.c
+++ b/ldap/servers/slapd/back-ldbm/index.c
@@ -1236,6 +1236,7 @@ index_range_read_ext(
time_t curtime, stoptime, optime;
int timelimit = -1;
back_search_result_set *sr = NULL;
+ int isroot = 0;
if (!pb) {
LDAPDebug(LDAP_DEBUG_ANY, "index_range_read: NULL pblock\n",
@@ -1270,11 +1271,11 @@ index_range_read_ext(
if (sr != NULL) {
/* the normal case */
lookthrough_limit = sr->sr_lookthroughlimit;
- } else {
- int isroot = 0;
- slapi_pblock_get( pb, SLAPI_REQUESTOR_ISROOT, &isroot );
- if (!isroot) {
- lookthrough_limit = li->li_lookthroughlimit;
+ }
+ slapi_pblock_get( pb, SLAPI_REQUESTOR_ISROOT, &isroot );
+ if (!isroot) {
+ if (lookthrough_limit > li->li_rangelookthroughlimit) {
+ lookthrough_limit = li->li_rangelookthroughlimit;
}
}
@@ -1478,7 +1479,7 @@ index_range_read_ext(
/* exit the loop when we either run off the end of the table,
* fail to read a key, or read a key that's out of range.
*/
- IDList *tmp, *tmp2;
+ IDList *tmp;
/*
char encbuf [BUFSIZ];
LDAPDebug( LDAP_DEBUG_FILTER, " cur_key=%s(%li bytes)\n",
@@ -1549,10 +1550,22 @@ index_range_read_ext(
encoded(&cur_key, encbuf), (long)cur_key.dsize);
}
} else {
- tmp2 = idl_union( be, idl, tmp );
- idl_free( idl );
- idl_free( tmp );
- idl = tmp2;
+ /* idl tmp only contains one id */
+ /* append it at the end here; sort idlist at the end */
+ if (ALLIDS(tmp)) {
+ idl_free(idl);
+ idl = tmp;
+ } else {
+ ID id;
+ for (id = idl_firstid(tmp); id != NOID; id = idl_nextid(tmp, id)) {
+ *err = idl_append_extend(&idl, id);
+ if (*err) {
+ ldbm_nasty("index_range_read - failed to generate idlist",
+ 1097, *err);
+ }
+ }
+ idl_free(tmp);
+ }
if (ALLIDS(idl)) {
LDAPDebug(LDAP_DEBUG_TRACE, "index_range_read hit an allids value\n",
0, 0, 0);
@@ -1601,6 +1614,12 @@ error:
dblayer_release_index_file( be, ai, db );
+ /* sort idl */
+ if (idl && !ALLIDS(idl)) {
+ qsort((void *)&idl->b_ids[0], idl->b_nids,
+ (size_t)sizeof(ID), idl_sort_cmp);
+ }
+
LDAPDebug( LDAP_DEBUG_TRACE, "<= index_range_read(%s,%s) %lu candidates\n",
type, prefix, (u_long)IDL_NIDS(idl) );
return( idl );
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index d0664eb..232af54 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -187,6 +187,28 @@ static int ldbm_config_pagedlookthroughlimit_set(void *arg, void *value, char *e
return retval;
}
+static void *ldbm_config_rangelookthroughlimit_get(void *arg)
+{
+ struct ldbminfo *li = (struct ldbminfo *) arg;
+
+ return (void *) ((uintptr_t)(li->li_rangelookthroughlimit));
+}
+
+static int ldbm_config_rangelookthroughlimit_set(void *arg, void *value, char *errorbuf, int phase, int apply)
+{
+ struct ldbminfo *li = (struct ldbminfo *) arg;
+ int retval = LDAP_SUCCESS;
+ int val = (int) ((uintptr_t)value);
+
+ /* Do whatever we can to make sure the data is ok. */
+
+ if (apply) {
+ li->li_rangelookthroughlimit = val;
+ }
+
+ return retval;
+}
+
static void *ldbm_config_mode_get(void *arg)
{
struct ldbminfo *li = (struct ldbminfo *) arg;
@@ -1341,6 +1363,7 @@ static config_info ldbm_config[] = {
{CONFIG_ENTRYRDN_NOANCESTORID, CONFIG_TYPE_ONOFF, "off", &ldbm_config_entryrdn_noancestorid_get, &ldbm_config_entryrdn_noancestorid_set, 0 /* no show */},
{CONFIG_PAGEDLOOKTHROUGHLIMIT, CONFIG_TYPE_INT, "0", &ldbm_config_pagedlookthroughlimit_get, &ldbm_config_pagedlookthroughlimit_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONFIG_PAGEDIDLISTSCANLIMIT, CONFIG_TYPE_INT, "0", &ldbm_config_pagedallidsthreshold_get, &ldbm_config_pagedallidsthreshold_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
+ {CONFIG_RANGELOOKTHROUGHLIMIT, CONFIG_TYPE_INT, "5000", &ldbm_config_rangelookthroughlimit_get, &ldbm_config_rangelookthroughlimit_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{NULL, 0, NULL, NULL, NULL, 0}
};
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.h b/ldap/servers/slapd/back-ldbm/ldbm_config.h
index 36b8f60..a5830e3 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.h
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.h
@@ -85,6 +85,7 @@ struct config_info {
#define CONFIG_INSTANCE "nsslapd-instance"
#define CONFIG_LOOKTHROUGHLIMIT "nsslapd-lookthroughlimit"
+#define CONFIG_RANGELOOKTHROUGHLIMIT "nsslapd-rangelookthroughlimit"
#define CONFIG_PAGEDLOOKTHROUGHLIMIT "nsslapd-pagedlookthroughlimit"
#define CONFIG_IDLISTSCANLIMIT "nsslapd-idlistscanlimit"
#define CONFIG_PAGEDIDLISTSCANLIMIT "nsslapd-pagedidlistscanlimit"
diff --git a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
index daf6d05..40fa325 100644
--- a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
@@ -241,6 +241,7 @@ int idl_is_allids(IDList *idl);
int idl_append(IDList *idl, ID id);
int idl_append_extend(IDList **idl, ID id);
void idl_insert(IDList **idl, ID id);
+int idl_sort_cmp(const void *x, const void *y);
/*
* idl_delete - delete an id from an id list.
* returns 0 id deleted
diff --git a/ldap/servers/slapd/back-ldbm/start.c b/ldap/servers/slapd/back-ldbm/start.c
index 0f42bed..4276c3b 100644
--- a/ldap/servers/slapd/back-ldbm/start.c
+++ b/ldap/servers/slapd/back-ldbm/start.c
@@ -116,6 +116,15 @@ ldbm_back_start( Slapi_PBlock *pb )
return SLAPI_FAIL_GENERAL;
}
+ /* lookthrough limit for the rangesearch */
+ if ( slapi_reslimit_register( SLAPI_RESLIMIT_TYPE_INT,
+ LDBM_RANGELOOKTHROUGHLIMIT_AT, &li->li_reslimit_rangelookthrough_handle )
+ != SLAPI_RESLIMIT_STATUS_SUCCESS ) {
+ LDAPDebug( LDAP_DEBUG_ANY, "start: Resource limit registration failed for rangelookthroughlimit\n",
+ 0, 0, 0 );
+ return SLAPI_FAIL_GENERAL;
+ }
+
/* If the db directory hasn't been set yet, we need to set it to
* the default. */
if (NULL == li->li_directory || '\0' == li->li_directory[0]) {
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index cf68bb3..3131661 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -1048,12 +1048,6 @@ vlv_build_candidate_list_byvalue( struct vlvIndex* p, DBC *dbc, PRUint32 length,
return si;
}
-static int
-vlv_idl_sort_cmp(const void *x, const void *y)
-{
- return *(ID *)x - *(ID *)y;
-}
-
/* build a candidate list (IDL) from a VLV index, given the starting index
* and the ending index (as an inclusive list).
* returns 0 on success, or an LDAP error code.
@@ -1111,7 +1105,7 @@ int vlv_build_idl(PRUint32 start, PRUint32 stop, DB *db, DBC *dbc,
if (dosort)
{
qsort((void *)&idl->b_ids[0], idl->b_nids,
- (size_t)sizeof(ID), vlv_idl_sort_cmp);
+ (size_t)sizeof(ID), idl_sort_cmp);
}
*candidates = idl;
11 years, 5 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/posix-winsync/posix-winsync.c | 129 ++++++++++++++-------
ldap/servers/slapd/mapping_tree.c | 2
2 files changed, 91 insertions(+), 40 deletions(-)
New commits:
commit f95bc254e3019727123068af5612058be05fb6be
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Tue Nov 13 11:21:26 2012 -0800
Trac Ticket #500 - Newly created users with organizationalPerson objectClass fails to sync from AD to DS with missing attribute error
https://fedorahosted.org/389/ticket/500
Bug description: Posix Account objectclass requires homeDirectory,
uidNumber, and gidNumber. When an AD entry has just some of these
attributes or other allow-to-have attributes, i.e., loginShell or
gecos, the entry is incompletely converted to Posix Account entry
and fails to be added due to the missing attribute error.
Fix description: Before transforming the AD entry to the DS posix
account entry, check the required attributes first. If any of the
above 3 attributes is missing, all of the posix account related
attributes are dropped and added to the DS as a non-posix account
entry. If the PLUGIN log level is set, this type of message is
logged in the error log.
[] posix-winsync - AD entry CN=<CN>,OU=<OU>,DC=<DC>,DC=<COM> does
not have required attribute uidNumber for posixAccount objectclass.
(cherry picked from commit 19e49e69124ff19530a584f90808aa652a4c686f)
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index aa292c3..92a3a79 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -86,14 +86,17 @@ typedef struct _windows_attr_map
{
char *windows_attribute_name;
char *ldap_attribute_name;
+ int isMUST; /* schema: required attribute */
} windows_attribute_map;
-static windows_attribute_map user_attribute_map[] = { { "unixHomeDirectory", "homeDirectory" },
- { "loginShell", "loginShell" },
- { "uidNumber", "uidNumber" },
- { "gidNumber", "gidNumber" },
- { "gecos", "gecos" },
- { NULL, NULL } };
+static windows_attribute_map user_attribute_map[] = {
+ { "unixHomeDirectory", "homeDirectory", 1 },
+ { "loginShell", "loginShell", 0 },
+ { "uidNumber", "uidNumber", 1 },
+ { "gidNumber", "gidNumber", 1 },
+ { "gecos", "gecos", 0 },
+ { NULL, NULL, 0 }
+};
static windows_attribute_map user_mssfu_attribute_map[] =
{ { "msSFU30homedirectory", "homeDirectory" },
@@ -751,7 +754,9 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
int is_present_local = 0;
int do_modify_local = 0;
int rc;
+ int i;
windows_attribute_map *attr_map = user_attribute_map;
+ PRBool posixval = PR_TRUE;
if (posix_winsync_config_get_msSFUSchema())
attr_map = user_mssfu_attribute_map;
@@ -759,15 +764,33 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"--> _pre_ds_mod_user_cb -- begin\n");
+ /* check all of the required attributes are in the ad_entry:
+ * MUST (cn $ uid $ uidNumber $ gidNumber $ homeDirectory).
+ * If any of the required attributes are missing, drop them before adding
+ * the entry to the DS. */
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
+ Slapi_Attr *pa_attr;
+ if (attr_map[i].isMUST &&
+ slapi_entry_attr_find(ad_entry,
+ attr_map[i].windows_attribute_name,
+ &pa_attr)) {
+ /* required attribute does not exist */
+ posixval = PR_FALSE;
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "AD entry %s does not have required attribute %s for posixAccount objectclass.\n",
+ slapi_entry_get_dn_const(ad_entry),
+ attr_map[i].ldap_attribute_name);
+ }
+ }
+
/* add objectclass: posixAccount, uidnumber ,gidnumber ,homeDirectory, loginshell */
/* in the ad to ds case we have no changelog, so we have to compare the entries */
for (rc = slapi_entry_first_attr(ad_entry, &attr); rc == 0;
rc = slapi_entry_next_attr(ad_entry, attr, &attr)) {
char *type = NULL;
- size_t i = 0;
slapi_attr_get_type(attr, &type);
- for (; attr_map[i].windows_attribute_name != NULL; i++) {
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
if (0 == slapi_attr_type_cmp(type, attr_map[i].windows_attribute_name,
SLAPI_TYPE_CMP_SUBTYPE)) {
Slapi_Attr *local_attr = NULL;
@@ -779,7 +802,10 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
slapi_entry_attr_find(ds_entry, local_type, &local_attr);
is_present_local = (NULL == local_attr) ? 0 : 1;
if (is_present_local) {
+ /* DS entry has the posix attrs.
+ * I.e., it is a posix account*/
int values_equal = 0;
+ posixval = PR_TRUE;
values_equal = attr_compare_equal(attr, local_attr);
if (!values_equal) {
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
@@ -791,8 +817,8 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
valueset_get_valuearray(vs));
*do_modify = 1;
}
- } else {
-
+ } else if (posixval) {
+ /* only if AD provides the all necessary attributes */
slapi_mods_add_mod_values(smods, LDAP_MOD_ADD, local_type,
valueset_get_valuearray(vs));
*do_modify = do_modify_local = 1;
@@ -804,10 +830,11 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
}
}
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "<-- _pre_ds_mod_user_cb present %d modify %d\n", is_present_local,
- do_modify_local);
+ "<-- _pre_ds_mod_user_cb present %d modify %d isPosixaccount %s\n",
+ is_present_local, do_modify_local,
+ posixval?"yes":"no");
- if (!is_present_local && do_modify_local) {
+ if (!is_present_local && do_modify_local && posixval) {
Slapi_Attr *oc_attr = NULL;
Slapi_Value *voc = slapi_value_new();
@@ -988,8 +1015,9 @@ posix_winsync_pre_ds_add_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
{
Slapi_Attr *attr = NULL;
char *type = NULL;
- PRBool posixval = PR_FALSE;
+ PRBool posixval = PR_TRUE;
windows_attribute_map *attr_map = user_attribute_map;
+ int i = 0;
if (posix_winsync_config_get_msSFUSchema())
attr_map = user_mssfu_attribute_map;
@@ -998,42 +1026,65 @@ posix_winsync_pre_ds_add_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"--> _pre_ds_add_user_cb -- begin\n");
- for (slapi_entry_first_attr(ad_entry, &attr); attr; slapi_entry_next_attr(ad_entry, attr, &attr)) {
- size_t i = 0;
-
- slapi_attr_get_type(attr, &type);
- if (!type) {
- continue;
+ /* check all of the required attributes are in the ad_entry:
+ * MUST (cn $ uid $ uidNumber $ gidNumber $ homeDirectory).
+ * If any of the required attributes are missing, drop them before adding
+ * the entry to the DS. */
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
+ Slapi_Attr *pa_attr;
+ if (attr_map[i].isMUST &&
+ slapi_entry_attr_find(ad_entry,
+ attr_map[i].windows_attribute_name,
+ &pa_attr)) {
+ /* required attribute does not exist */
+ posixval = PR_FALSE;
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "AD entry %s does not have required attribute %s for posixAccount objectclass.\n",
+ slapi_entry_get_dn_const(ad_entry),
+ attr_map[i].ldap_attribute_name);
}
+ }
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "--> _pre_ds_add_user_cb -- "
- "look for [%s] to new entry [%s]\n", type, slapi_entry_get_dn_const(ds_entry));
- for (; attr_map[i].windows_attribute_name != NULL; i++) {
- if (slapi_attr_type_cmp(attr_map[i].windows_attribute_name, type,
- SLAPI_TYPE_CMP_SUBTYPE) == 0) {
- Slapi_ValueSet *svs = NULL;
- slapi_attr_get_valueset(attr, &svs);
- slapi_entry_add_valueset(ds_entry, attr_map[i].ldap_attribute_name, svs);
- slapi_valueset_free(svs);
+ /* converts the AD attributes to DS posix attribute if all the posix
+ * required attributes are available */
+ if (posixval) {
+ int rc;
+ for (slapi_entry_first_attr(ad_entry, &attr); attr;
+ slapi_entry_next_attr(ad_entry, attr, &attr)) {
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "--> _pre_ds_add_user_cb -- "
- "adding val for [%s] to new entry [%s]\n", type,
- slapi_entry_get_dn_const(ds_entry));
- posixval = PR_TRUE;
+ slapi_attr_get_type(attr, &type);
+ if (!type) {
+ continue;
+ }
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ds_add_user_cb -- "
+ "look for [%s] to new entry [%s]\n",
+ type, slapi_entry_get_dn_const(ds_entry));
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
+ if (slapi_attr_type_cmp(attr_map[i].windows_attribute_name,
+ type, SLAPI_TYPE_CMP_SUBTYPE) == 0) {
+ Slapi_ValueSet *svs = NULL;
+ slapi_attr_get_valueset(attr, &svs);
+ slapi_entry_add_valueset(ds_entry,
+ attr_map[i].ldap_attribute_name, svs);
+ slapi_valueset_free(svs);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ds_add_user_cb -- "
+ "adding val for [%s] to new entry [%s]\n",
+ type, slapi_entry_get_dn_const(ds_entry));
+ }
}
}
- }
- if (posixval) {
- int rc;
rc = slapi_entry_add_string(ds_entry, "objectClass", "posixAccount");
rc |= slapi_entry_add_string(ds_entry, "objectClass", "shadowAccount");
rc |= slapi_entry_add_string(ds_entry, "objectClass", "inetUser");
- if (rc != 0)
+ if (rc != 0) {
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"<-- _pre_ds_add_user_cb -- adding objectclass for new entry failed %d\n",
rc);
- else {
+ } else {
if (posix_winsync_config_get_mapNestedGrouping()) {
memberUidLock();
addUserToGroupMembership(ds_entry);
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index e8e414f..da8e4f3 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -2451,7 +2451,7 @@ int slapi_mapping_tree_select_and_check(Slapi_PBlock *pb,char *newdn, Slapi_Back
{
ret = LDAP_AFFECTS_MULTIPLE_DSAS;
PR_snprintf(errorbuf, BUFSIZ,
- "Cannot move entries accross backends\n");
+ "Cannot move entries across backends\n");
goto unlock_and_return;
}
}
11 years, 5 months
ldap/servers
by Noriko Hosoi
ldap/servers/plugins/posix-winsync/posix-winsync.c | 129 ++++++++++++++-------
ldap/servers/slapd/mapping_tree.c | 2
2 files changed, 91 insertions(+), 40 deletions(-)
New commits:
commit 19e49e69124ff19530a584f90808aa652a4c686f
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Tue Nov 13 11:21:26 2012 -0800
Trac Ticket #500 - Newly created users with
organizationalPerson objectClass fails to sync from AD to DS with missing attribute error
https://fedorahosted.org/389/ticket/500
Bug description: Posix Account objectclass requires homeDirectory,
uidNumber, and gidNumber. When an AD entry has just some of these
attributes or other allow-to-have attributes, i.e., loginShell or
gecos, the entry is incompletely converted to Posix Account entry
and fails to be added due to the missing attribute error.
Fix description: Before transforming the AD entry to the DS posix
account entry, check the required attributes first. If any of the
above 3 attributes is missing, all of the posix account related
attributes are dropped and added to the DS as a non-posix account
entry. If the PLUGIN log level is set, this type of message is
logged in the error log.
[] posix-winsync - AD entry CN=<CN>,OU=<OU>,DC=<DC>,DC=<COM> does
not have required attribute uidNumber for posixAccount objectclass.
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index aa292c3..92a3a79 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -86,14 +86,17 @@ typedef struct _windows_attr_map
{
char *windows_attribute_name;
char *ldap_attribute_name;
+ int isMUST; /* schema: required attribute */
} windows_attribute_map;
-static windows_attribute_map user_attribute_map[] = { { "unixHomeDirectory", "homeDirectory" },
- { "loginShell", "loginShell" },
- { "uidNumber", "uidNumber" },
- { "gidNumber", "gidNumber" },
- { "gecos", "gecos" },
- { NULL, NULL } };
+static windows_attribute_map user_attribute_map[] = {
+ { "unixHomeDirectory", "homeDirectory", 1 },
+ { "loginShell", "loginShell", 0 },
+ { "uidNumber", "uidNumber", 1 },
+ { "gidNumber", "gidNumber", 1 },
+ { "gecos", "gecos", 0 },
+ { NULL, NULL, 0 }
+};
static windows_attribute_map user_mssfu_attribute_map[] =
{ { "msSFU30homedirectory", "homeDirectory" },
@@ -751,7 +754,9 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
int is_present_local = 0;
int do_modify_local = 0;
int rc;
+ int i;
windows_attribute_map *attr_map = user_attribute_map;
+ PRBool posixval = PR_TRUE;
if (posix_winsync_config_get_msSFUSchema())
attr_map = user_mssfu_attribute_map;
@@ -759,15 +764,33 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"--> _pre_ds_mod_user_cb -- begin\n");
+ /* check all of the required attributes are in the ad_entry:
+ * MUST (cn $ uid $ uidNumber $ gidNumber $ homeDirectory).
+ * If any of the required attributes are missing, drop them before adding
+ * the entry to the DS. */
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
+ Slapi_Attr *pa_attr;
+ if (attr_map[i].isMUST &&
+ slapi_entry_attr_find(ad_entry,
+ attr_map[i].windows_attribute_name,
+ &pa_attr)) {
+ /* required attribute does not exist */
+ posixval = PR_FALSE;
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "AD entry %s does not have required attribute %s for posixAccount objectclass.\n",
+ slapi_entry_get_dn_const(ad_entry),
+ attr_map[i].ldap_attribute_name);
+ }
+ }
+
/* add objectclass: posixAccount, uidnumber ,gidnumber ,homeDirectory, loginshell */
/* in the ad to ds case we have no changelog, so we have to compare the entries */
for (rc = slapi_entry_first_attr(ad_entry, &attr); rc == 0;
rc = slapi_entry_next_attr(ad_entry, attr, &attr)) {
char *type = NULL;
- size_t i = 0;
slapi_attr_get_type(attr, &type);
- for (; attr_map[i].windows_attribute_name != NULL; i++) {
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
if (0 == slapi_attr_type_cmp(type, attr_map[i].windows_attribute_name,
SLAPI_TYPE_CMP_SUBTYPE)) {
Slapi_Attr *local_attr = NULL;
@@ -779,7 +802,10 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
slapi_entry_attr_find(ds_entry, local_type, &local_attr);
is_present_local = (NULL == local_attr) ? 0 : 1;
if (is_present_local) {
+ /* DS entry has the posix attrs.
+ * I.e., it is a posix account*/
int values_equal = 0;
+ posixval = PR_TRUE;
values_equal = attr_compare_equal(attr, local_attr);
if (!values_equal) {
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
@@ -791,8 +817,8 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
valueset_get_valuearray(vs));
*do_modify = 1;
}
- } else {
-
+ } else if (posixval) {
+ /* only if AD provides the all necessary attributes */
slapi_mods_add_mod_values(smods, LDAP_MOD_ADD, local_type,
valueset_get_valuearray(vs));
*do_modify = do_modify_local = 1;
@@ -804,10 +830,11 @@ posix_winsync_pre_ds_mod_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
}
}
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "<-- _pre_ds_mod_user_cb present %d modify %d\n", is_present_local,
- do_modify_local);
+ "<-- _pre_ds_mod_user_cb present %d modify %d isPosixaccount %s\n",
+ is_present_local, do_modify_local,
+ posixval?"yes":"no");
- if (!is_present_local && do_modify_local) {
+ if (!is_present_local && do_modify_local && posixval) {
Slapi_Attr *oc_attr = NULL;
Slapi_Value *voc = slapi_value_new();
@@ -988,8 +1015,9 @@ posix_winsync_pre_ds_add_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
{
Slapi_Attr *attr = NULL;
char *type = NULL;
- PRBool posixval = PR_FALSE;
+ PRBool posixval = PR_TRUE;
windows_attribute_map *attr_map = user_attribute_map;
+ int i = 0;
if (posix_winsync_config_get_msSFUSchema())
attr_map = user_mssfu_attribute_map;
@@ -998,42 +1026,65 @@ posix_winsync_pre_ds_add_user_cb(void *cbdata, const Slapi_Entry *rawentry, Slap
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"--> _pre_ds_add_user_cb -- begin\n");
- for (slapi_entry_first_attr(ad_entry, &attr); attr; slapi_entry_next_attr(ad_entry, attr, &attr)) {
- size_t i = 0;
-
- slapi_attr_get_type(attr, &type);
- if (!type) {
- continue;
+ /* check all of the required attributes are in the ad_entry:
+ * MUST (cn $ uid $ uidNumber $ gidNumber $ homeDirectory).
+ * If any of the required attributes are missing, drop them before adding
+ * the entry to the DS. */
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
+ Slapi_Attr *pa_attr;
+ if (attr_map[i].isMUST &&
+ slapi_entry_attr_find(ad_entry,
+ attr_map[i].windows_attribute_name,
+ &pa_attr)) {
+ /* required attribute does not exist */
+ posixval = PR_FALSE;
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "AD entry %s does not have required attribute %s for posixAccount objectclass.\n",
+ slapi_entry_get_dn_const(ad_entry),
+ attr_map[i].ldap_attribute_name);
}
+ }
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name, "--> _pre_ds_add_user_cb -- "
- "look for [%s] to new entry [%s]\n", type, slapi_entry_get_dn_const(ds_entry));
- for (; attr_map[i].windows_attribute_name != NULL; i++) {
- if (slapi_attr_type_cmp(attr_map[i].windows_attribute_name, type,
- SLAPI_TYPE_CMP_SUBTYPE) == 0) {
- Slapi_ValueSet *svs = NULL;
- slapi_attr_get_valueset(attr, &svs);
- slapi_entry_add_valueset(ds_entry, attr_map[i].ldap_attribute_name, svs);
- slapi_valueset_free(svs);
+ /* converts the AD attributes to DS posix attribute if all the posix
+ * required attributes are available */
+ if (posixval) {
+ int rc;
+ for (slapi_entry_first_attr(ad_entry, &attr); attr;
+ slapi_entry_next_attr(ad_entry, attr, &attr)) {
- slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
- "--> _pre_ds_add_user_cb -- "
- "adding val for [%s] to new entry [%s]\n", type,
- slapi_entry_get_dn_const(ds_entry));
- posixval = PR_TRUE;
+ slapi_attr_get_type(attr, &type);
+ if (!type) {
+ continue;
+ }
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ds_add_user_cb -- "
+ "look for [%s] to new entry [%s]\n",
+ type, slapi_entry_get_dn_const(ds_entry));
+ for (i = 0; attr_map[i].windows_attribute_name != NULL; i++) {
+ if (slapi_attr_type_cmp(attr_map[i].windows_attribute_name,
+ type, SLAPI_TYPE_CMP_SUBTYPE) == 0) {
+ Slapi_ValueSet *svs = NULL;
+ slapi_attr_get_valueset(attr, &svs);
+ slapi_entry_add_valueset(ds_entry,
+ attr_map[i].ldap_attribute_name, svs);
+ slapi_valueset_free(svs);
+
+ slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
+ "--> _pre_ds_add_user_cb -- "
+ "adding val for [%s] to new entry [%s]\n",
+ type, slapi_entry_get_dn_const(ds_entry));
+ }
}
}
- }
- if (posixval) {
- int rc;
rc = slapi_entry_add_string(ds_entry, "objectClass", "posixAccount");
rc |= slapi_entry_add_string(ds_entry, "objectClass", "shadowAccount");
rc |= slapi_entry_add_string(ds_entry, "objectClass", "inetUser");
- if (rc != 0)
+ if (rc != 0) {
slapi_log_error(SLAPI_LOG_PLUGIN, posix_winsync_plugin_name,
"<-- _pre_ds_add_user_cb -- adding objectclass for new entry failed %d\n",
rc);
- else {
+ } else {
if (posix_winsync_config_get_mapNestedGrouping()) {
memberUidLock();
addUserToGroupMembership(ds_entry);
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index 237fc24..5de0e46 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -2451,7 +2451,7 @@ int slapi_mapping_tree_select_and_check(Slapi_PBlock *pb,char *newdn, Slapi_Back
{
ret = LDAP_AFFECTS_MULTIPLE_DSAS;
PR_snprintf(errorbuf, BUFSIZ,
- "Cannot move entries accross backends\n");
+ "Cannot move entries across backends\n");
goto unlock_and_return;
}
}
11 years, 5 months
lib/libaccess
by Noriko Hosoi
lib/libaccess/lasdns.cpp | 283 ++++++++++++++++++++++-------------------------
1 file changed, 133 insertions(+), 150 deletions(-)
New commits:
commit 8a9684ff9cadddc58de3a849c1e875955ea16128
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Fri Nov 9 10:52:38 2012 -0800
Trac Ticket #311 - IP lookup failing with multiple DNS
entries
https://fedorahosted.org/389/ticket/311
Bug description: DNS keyword in ACI only accepted an FQDN returned
from gethostbyaddr. If an alias hostname was set in an ACI, a request
sent from the host was treated as the one from the primary hostname
and it failed to get the expected access rights.
Fix description: This patch turns the "dns" keyword covers the alias
hostnames, as well. In addition to the primary hostname, by setting
the secondary hostnames as dns, clients requests would obtain the
expected access rights. When an IP address is associated with multiple
hostnames (primary: hostA, aliases: hostB and hostC), they could be
listed, for instance, in an aci as follows:
aci: (targetattr = "*") (version 3.0;acl "dns example";allow (all)
dns="hostA.example.com" or dns="hostB.example.com" or dns="hostC.
example.com";)
diff --git a/lib/libaccess/lasdns.cpp b/lib/libaccess/lasdns.cpp
index e4032f1..de8e624 100644
--- a/lib/libaccess/lasdns.cpp
+++ b/lib/libaccess/lasdns.cpp
@@ -137,14 +137,13 @@ LASDnsMatch(char *token, LASDnsContext_t *context)
int
LASDnsBuild(NSErr_t *errp, char *attr_pattern, LASDnsContext_t *context, int aliasflg)
{
- size_t delimiter; /* length of valid token */
- char token[256]; /* max length dns name */
- int i;
- int ipcnt = 0;
- char **p;
- unsigned long *ipaddrs=0;
+ size_t delimiter; /* length of valid tokeni */
+ char token[256]; /* max length dns name */
+ int i;
+ int ipcnt = 0;
+ char **p;
pool_handle_t *pool;
- PRStatus error=PR_SUCCESS;
+ PRStatus error=PR_SUCCESS;
char buffer[PR_NETDB_BUF_SIZE];
#ifdef UTEST
struct hostent *he, host;
@@ -154,164 +153,146 @@ LASDnsBuild(NSErr_t *errp, char *attr_pattern, LASDnsContext_t *context, int ali
char *end_attr_pattern;
if (attr_pattern == NULL) {
- nserrGenerate(errp, ACLERRINVAL, ACLERR4770, ACL_Program, 1,
- XP_GetAdminStr(DBT_lasdnsbuildInvalidAttributePattern_));
+ nserrGenerate(errp, ACLERRINVAL, ACLERR4770, ACL_Program, 1,
+ XP_GetAdminStr(DBT_lasdnsbuildInvalidAttributePattern_));
return LAS_EVAL_INVALID;
}
context->Table = PR_NewHashTable(0,
- PR_HashCaseString,
- PR_CompareCaseStrings,
- PR_CompareValues,
- &ACLPermAllocOps,
- NULL);
+ PR_HashCaseString,
+ PR_CompareCaseStrings,
+ PR_CompareValues,
+ &ACLPermAllocOps,
+ NULL);
pool = pool_create();
context->pool = pool;
if ((!context->Table) || (!context->pool)) {
- nserrGenerate(errp, ACLERRNOMEM, ACLERR4700, ACL_Program, 1,
- XP_GetAdminStr(DBT_lasdnsbuildUnableToAllocateHashT_));
+ nserrGenerate(errp, ACLERRNOMEM, ACLERR4700, ACL_Program, 1,
+ XP_GetAdminStr(DBT_lasdnsbuildUnableToAllocateHashT_));
return LAS_EVAL_INVALID;
}
end_attr_pattern = attr_pattern + strlen(attr_pattern);
do {
- size_t maxsize = sizeof(token);
- /* Get a single hostname from the pattern string */
- delimiter = strcspn(attr_pattern, ", \t");
- if (delimiter >= maxsize) {
- delimiter = maxsize-1;
- }
+ size_t maxsize = sizeof(token);
+ /* Get a single hostname from the pattern string */
+ delimiter = strcspn(attr_pattern, ", \t");
+ if (delimiter >= maxsize) {
+ delimiter = maxsize-1;
+ }
PL_strncpyz(token, attr_pattern, delimiter + 1);
token[delimiter] = '\0';
- /* Skip any white space after the token */
+ /* Skip any white space after the token */
attr_pattern += delimiter;
if (attr_pattern < end_attr_pattern) {
attr_pattern += strspn(attr_pattern, ", \t");
}
/* If there's a wildcard, strip it off but leave the "."
- * Can't have aliases for a wildcard pattern.
- * Treat "*" as a special case. If so, go ahead and hash it.
- */
+ * Can't have aliases for a wildcard pattern.
+ * Treat "*" as a special case. If so, go ahead and hash it.
+ */
if (token[0] == '*') {
- if (token[1] != '\0') {
- if (!PR_HashTableAdd(context->Table, pool_strdup(pool, &token[1]), (void *)-1)) {
- nserrGenerate(errp, ACLERRFAIL, ACLERR4710, ACL_Program, 2,
- XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), token);
- return LAS_EVAL_INVALID;
- }
- } else {
- if (!PR_HashTableAdd(context->Table, pool_strdup(pool, token), (void *)-1)) {
- nserrGenerate(errp, ACLERRFAIL, ACLERR4720, ACL_Program, 2, XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), token);
- return LAS_EVAL_INVALID;
- }
- }
- } else {
- /* This is a single hostname add it to the hash table */
- if (!PR_HashTableAdd(context->Table, pool_strdup(pool, &token[0]), (void *)-1)) {
- nserrGenerate(errp, ACLERRFAIL, ACLERR4730, ACL_Program, 2, XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), token);
- return LAS_EVAL_INVALID;
- }
-
- if (aliasflg) {
- /* memset(buffer, '\0', PR_NETDB_BUF_SIZE);
- */
-#ifdef UTEST
- he = gethostbyname(token);
-#else
- error = PR_GetHostByName(token,
- buffer,
- PR_NETDB_BUF_SIZE,
- &host);
- if (error == PR_SUCCESS) he = &host;
- else he = NULL;
-#endif
- if (he) {
- /* Make a copy of the list of IP addresses if any */
- if (he->h_addr_list && he->h_addr_list[0]) {
-
- /* Count the IP addresses */
- for (p = he->h_addr_list, ipcnt = 0; *p; ++p) {
- ++ipcnt;
- }
-
- /* Allocate space */
- ipaddrs = (unsigned long *)PERM_MALLOC(ipcnt * sizeof(unsigned long));
-
- /* Copy IP addresses */
- for (i = 0; i < ipcnt; ++i) {
- ipaddrs[i] = 0;
- memcpy((void *)&ipaddrs[i], he->h_addr_list[i], 4);
- }
- }
-
- /* Add each of the aliases to the list */
- if (he->h_aliases && he->h_aliases[0]) {
-
- for (p = he->h_aliases; *p; ++p) {
- /* Add it to the hash table */
- if (!PR_HashTableAdd(context->Table, pool_strdup(pool, *p), (void*)-1)) {
- nserrGenerate(errp, ACLERRFAIL, ACLERR4740, ACL_Program, 2,
- XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), *p);
- PERM_FREE(ipaddrs);
- return LAS_EVAL_INVALID;
- }
- }
- }
-
- for (i = 0; i < ipcnt; ++i) {
-
-#ifdef UTEST
- he = gethostbyaddr((char *)&ipaddrs[i], 4, AF_INET);
-#else
- error = PR_GetHostByAddr((PRNetAddr *)&ipaddrs[i],
- buffer,
- PR_NETDB_BUF_SIZE,
- &host);
- if (error == PR_SUCCESS) he = &host;
- else he = NULL;
-#endif
- if (he) {
- if (he->h_name) {
- /* Add it to the hash table */
- if (!PR_HashTableAdd(context->Table, pool_strdup(pool, he->h_name),
- (void *)-1)) {
- nserrGenerate(errp, ACLERRFAIL, ACLERR4750, ACL_Program, 2,
- XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), he->h_name);
- PERM_FREE(ipaddrs);
- return LAS_EVAL_INVALID;
- }
- }
+ if (token[1] != '\0') {
+ if (!PR_HashTableAdd(context->Table, pool_strdup(pool, &token[1]), (void *)-1)) {
+ nserrGenerate(errp, ACLERRFAIL, ACLERR4710, ACL_Program, 2,
+ XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), token);
+ return LAS_EVAL_INVALID;
+ }
+ } else {
+ if (!PR_HashTableAdd(context->Table, pool_strdup(pool, token), (void *)-1)) {
+ nserrGenerate(errp, ACLERRFAIL, ACLERR4720, ACL_Program, 2, XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), token);
+ return LAS_EVAL_INVALID;
+ }
+ }
+ } else {
+ /* This is a single hostname add it to the hash table */
+ if (!PR_HashTableAdd(context->Table, pool_strdup(pool, &token[0]), (void *)-1)) {
+ nserrGenerate(errp, ACLERRFAIL, ACLERR4730, ACL_Program, 2, XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), token);
+ return LAS_EVAL_INVALID;
+ }
+
+ if (aliasflg) {
+ void *iter = NULL;
+ int addrcnt = 0;
+ PRNetAddr *netaddr = (PRNetAddr *)PERM_CALLOC(sizeof(PRNetAddr));
+ PRAddrInfo *infop = PR_GetAddrInfoByName(token,
+ PR_AF_UNSPEC, (PR_AI_ADDRCONFIG|PR_AI_NOCANONNAME));
+ if (!netaddr) {
+ if (infop) {
+ PR_FreeAddrInfo(infop);
+ }
+ return LAS_EVAL_NEED_MORE_INFO; /* hostname not known to dns? */
+ }
+ if (!infop) {
+ if (netaddr) {
+ PERM_FREE(netaddr);
+ }
+ return LAS_EVAL_NEED_MORE_INFO; /* hostname not known to dns? */
+ }
+ /* need to count the address, first */
+ while ((iter = PR_EnumerateAddrInfo(iter, infop, 0, netaddr))) {
+ addrcnt++;
+ }
+ if (0 == addrcnt) {
+ PERM_FREE(netaddr);
+ PR_FreeAddrInfo(infop);
+ return LAS_EVAL_NEED_MORE_INFO; /* hostname not known to dns? */
+ }
+ iter = NULL; /* from the beginning */
+ memset(netaddr, 0, sizeof(PRNetAddr));
+ for (i = 0; i < addrcnt; i++) {
+ iter = PR_EnumerateAddrInfo( iter, infop, 0, netaddr );
+ if (NULL == iter) {
+ break;
+ }
+ error = PR_GetHostByAddr(netaddr, buffer,
+ PR_NETDB_BUF_SIZE, &host);
+ if (error == PR_SUCCESS) {
+ he = &host;
+ } else {
+ continue;
+ }
+ if (he->h_name) {
+ /* Add it to the hash table */
+ if (!PR_HashTableAdd(context->Table,
+ pool_strdup(pool, he->h_name),
+ (void *)-1)) {
+ nserrGenerate(errp, ACLERRFAIL, ACLERR4750,
+ ACL_Program, 2,
+ XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_),
+ he->h_name);
+ PERM_FREE(netaddr);
+ PR_FreeAddrInfo(infop);
+ return LAS_EVAL_INVALID;
+ }
+ }
- if (he->h_aliases && he->h_aliases[0]) {
- for (p = he->h_aliases; *p; ++p) {
- /* Add it to the hash table */
- if (!PR_HashTableAdd(context->Table, pool_strdup(pool, *p), (void *)-1)) {
- nserrGenerate(errp, ACLERRFAIL, ACLERR4760, ACL_Program, 2,
- XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_), *p);
- PERM_FREE(ipaddrs);
- return LAS_EVAL_INVALID;
- }
- }
- }
- }
- }
-
- PERM_FREE(ipaddrs);
- ipaddrs = NULL;
-
- } /* if he */
-
-
- } /* if aliasflg */
-
- } /* else - single hostname */
-
-
+ if (he->h_aliases && he->h_aliases[0]) {
+ for (p = he->h_aliases; *p; ++p) {
+ /* Add it to the hash table */
+ if (!PR_HashTableAdd(context->Table,
+ pool_strdup(pool, *p),
+ (void *)-1)) {
+ nserrGenerate(errp, ACLERRFAIL, ACLERR4760,
+ ACL_Program, 2,
+ XP_GetAdminStr(DBT_lasdnsbuildUnableToAddKeySN_),
+ *p);
+ PERM_FREE(netaddr);
+ PR_FreeAddrInfo(infop);
+ return LAS_EVAL_INVALID;
+ }
+ }
+ }
+ } /* for (i = 0; i < addrcnt; i++) */
+ PERM_FREE(netaddr);
+ PR_FreeAddrInfo(infop);
+ } /* if aliasflg */
+ } /* else - single hostname */
} while ((attr_pattern != NULL) &&
- (attr_pattern[0] != '\0') &&
- (delimiter != 0));
+ (attr_pattern[0] != '\0') &&
+ (delimiter != 0));
return 0;
}
@@ -363,18 +344,20 @@ int LASDnsEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
*cachable = ACL_INDEF_CACHABLE;
- if (strcmp(attr_name, "dns") == 0)
- aliasflg = 0;
- else if (strcmp(attr_name, "dnsalias") == 0)
- aliasflg = 1;
- else {
- nserrGenerate(errp, ACLERRINVAL, ACLERR4800, ACL_Program, 2, XP_GetAdminStr(DBT_lasDnsBuildReceivedRequestForAtt_), attr_name);
- return LAS_EVAL_INVALID;
+ if (strcmp(attr_name, "dns") == 0) {
+ /* Enable aliasflg for "dns", which allows "dns" hostname to look up
+ * DSN hash table using the primary hostname. */
+ aliasflg = 1;
+ } else if (strcmp(attr_name, "dnsalias") == 0) {
+ aliasflg = 1;
+ } else {
+ nserrGenerate(errp, ACLERRINVAL, ACLERR4800, ACL_Program, 2, XP_GetAdminStr(DBT_lasDnsBuildReceivedRequestForAtt_), attr_name);
+ return LAS_EVAL_INVALID;
}
if ((comparator != CMP_OP_EQ) && (comparator != CMP_OP_NE)) {
- nserrGenerate(errp, ACLERRINVAL, ACLERR4810, ACL_Program, 2, XP_GetAdminStr(DBT_lasdnsevalIllegalComparatorDN_), comparator_string(comparator));
- return LAS_EVAL_INVALID;
+ nserrGenerate(errp, ACLERRINVAL, ACLERR4810, ACL_Program, 2, XP_GetAdminStr(DBT_lasdnsevalIllegalComparatorDN_), comparator_string(comparator));
+ return LAS_EVAL_INVALID;
}
/* If this is the first time through, build the pattern tree first. */
11 years, 5 months