ldap/servers
by Mark Reynolds
ldap/servers/slapd/fedse.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit 36f3f34d87957130fe81bd2b0dd1ed248e86f896
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Aug 14 16:56:36 2013 -0400
Ticket 47384 - Plugin path validation returntext not set correctly
Description: "returntext" was not being set correctly.
https://fedorahosted.org/389/ticket/47384
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 6363a7a..cb6c2ed 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -1944,12 +1944,12 @@ check_plugin_path(Slapi_PBlock *pb,
if (res) {
if (strncmp(PLUGINDIR, resolved_path, plugindir_len) != 0) {
*returncode = LDAP_UNWILLING_TO_PERFORM;
- returntext = "Invalid plugin path";
+ PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,"Invalid plugin path");
rc = SLAPI_DSE_CALLBACK_ERROR;
}
} else {
*returncode = LDAP_UNWILLING_TO_PERFORM;
- returntext = "Invalid plugin path";
+ PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE,"Invalid plugin path");
rc = SLAPI_DSE_CALLBACK_ERROR;
}
slapi_ch_free_string(&full_path);
10 years, 8 months
admserv/cgi-src40
by Nathan Kinder
admserv/cgi-src40/security.c | 60 ++++++++++++++++++++--------------
admserv/cgi-src40/security.properties | 2 -
2 files changed, 37 insertions(+), 25 deletions(-)
New commits:
commit 5c52dd525901f6458d9d47cc6f3e809538d6982a
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Tue Aug 13 22:14:06 2013 -0700
Ticket 47466 - Importing CA cert with existing name crashes security CGI
When a CA certificate is imported through the Console, but a CA certificate
with the same name already exists in the certdb, the security CGI crashes.
We are not checking the return value of CERT_ImportCerts(), which leads to
a NULL dereference.
This patch checks the return value of CERT_ImportCerts for an error, and
we return an appropriate error back to the caller. The functions we were
using to get the error text for NSS errors was returning garbage. We
need to use PR_ErrorToString() to get the proper error strings.
diff --git a/admserv/cgi-src40/security.c b/admserv/cgi-src40/security.c
index fef3bea..1cee29d 100644
--- a/admserv/cgi-src40/security.c
+++ b/admserv/cgi-src40/security.c
@@ -1194,12 +1194,7 @@ generateKey(SECKEYPublicKey** publicKey, char* tokenName)
loser:
if (privateKey==NULL) {
- char *tmpLine = NULL;
-
- tmpLine = (char *)PR_Malloc(PR_GetErrorTextLength()+1);
- PR_GetErrorText(tmpLine);
- PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), tmpLine);
- PR_Free(tmpLine);
+ PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_EN));
rpt_err(GENERAL_FAILURE,
getResourceString(DBT_INTERNAL_ERROR),
@@ -1324,7 +1319,7 @@ static CERTDERCerts* decodeDERCert(char *derCertBase64) {
* Decode and display a DER certificate.
*/
static void printDERCert(int isCACert) {
-
+ SECStatus rv;
char *derCertBase64 = getParameter("dercert",getResourceString(DBT_DER_CERT));
CERTDERCerts *collectArgs = decodeDERCert(derCertBase64);
@@ -1341,12 +1336,23 @@ static void printDERCert(int isCACert) {
char *nickname = NULL;
/*add all cert to temp */
- CERT_ImportCerts(certdb, certUsageSSLServer,
+ rv = CERT_ImportCerts(certdb, certUsageSSLServer,
collectArgs->numcerts, &collectArgs->rawCerts,
&retCerts, keepCerts,
caOnly, nickname);
- printCert(retCerts[collectArgs->numcerts-1], /*showDetail=*/PR_TRUE, certType);
+ if (rv == SECSuccess) {
+ printCert(retCerts[collectArgs->numcerts-1], /*showDetail=*/PR_TRUE, certType);
+ } else {
+ PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(),
+ PR_ErrorToString(PR_GetError(), PR_LANGUAGE_EN));
+
+ /* if unable to import report error */
+ rpt_err(SYSTEM_ERROR,
+ getResourceString(DBT_INTERNAL_ERROR),
+ getResourceString(DBT_INSTALL_FAIL),
+ line);
+ }
}
}
@@ -1378,11 +1384,15 @@ installServerCert(char *tokenName, char *certname)
PRBool caOnly = PR_FALSE;
char *nickname = certname;
- CERT_ImportCerts(certdb, certUsageSSLServer,
+ rv = CERT_ImportCerts(certdb, certUsageSSLServer,
ncerts, &collectArgs->rawCerts,
&retCerts, keepCerts,
caOnly, nickname);
+ if (rv != SECSuccess) {
+ goto bail;
+ }
+
cert = retCerts[0];
}
@@ -1420,19 +1430,15 @@ installServerCert(char *tokenName, char *certname)
/* import certificate to the PKCS11 module */
rv = PK11_ImportCertForKeyToSlot(slot, cert, certname, PR_TRUE, 0);
+bail:
if (rv != SECSuccess) {
- {
- char *tmpLine;
+ PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(),
+ PR_ErrorToString(PR_GetError(), PR_LANGUAGE_EN));
- tmpLine = (char *)PR_Malloc(PR_GetErrorTextLength()+1);
- PR_GetErrorText(tmpLine);
- PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), tmpLine);
- PR_Free(tmpLine);
- }
/* if unable to import report error */
- rpt_err(SYSTEM_ERROR,
- getResourceString(DBT_INTERNAL_ERROR),
- getResourceString(DBT_INSTALL_FAIL),
+ rpt_err(SYSTEM_ERROR,
+ getResourceString(DBT_INTERNAL_ERROR),
+ getResourceString(DBT_INSTALL_FAIL),
line);
}
}
@@ -1482,14 +1488,20 @@ installCACert(char *tokenName, char *certname)
rc = CERT_ImportCerts(certdb, (trustedCA ? certUsageSSLCA : certUsageAnyCA),
collectArgs->numcerts, &collectArgs->rawCerts,
&retCerts, keepCerts, caOnly, nickname);
+
+ if (rc != SECSuccess) {
+ goto bail;
+ }
+
CERT_FindCertByDERCert(certdb, collectArgs->rawCerts);
cert = retCerts[0];
rc = PK11_ImportCert(slot, cert, CK_INVALID_HANDLE, certname, PR_FALSE);
+
+bail:
if (rc != SECSuccess) {
- char *tmpLine = (char *)PR_Malloc(PR_GetErrorTextLength()+1);
- PR_GetErrorText(tmpLine);
- PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), tmpLine);
- PR_Free(tmpLine);
+ PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(),
+ PR_ErrorToString(PR_GetError(), PR_LANGUAGE_EN));
+
/* if unable to import report error */
rpt_err(SYSTEM_ERROR, getResourceString(DBT_INTERNAL_ERROR),
getResourceString(DBT_INSTALL_FAIL), line);
diff --git a/admserv/cgi-src40/security.properties b/admserv/cgi-src40/security.properties
index fd4f91b..183bad0 100644
--- a/admserv/cgi-src40/security.properties
+++ b/admserv/cgi-src40/security.properties
@@ -39,7 +39,7 @@ security11 { "Unable to read alias directory." }
security20 { "Slot not found." }
security21 { "Unable to decode the certificate." }
security22 { "Private key not found." }
-security23 { "Fail to install certificate." }
+security23 { "Failed to install certificate." }
security24 { "Either this certificate is for another server, or this certificate was not requested using this server and the selected security device \"%s\"." }
security25 { "Invalid DER certificate." }
security26 { "Unable to extract any certificates." }
10 years, 8 months
admserv/cgi-src40
by Nathan Kinder
admserv/cgi-src40/security.c | 24 +++++++++++++++++++-----
1 file changed, 19 insertions(+), 5 deletions(-)
New commits:
commit ec879b64efc6f2956dffa8ba0e004e4865364f17
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Tue Aug 13 19:51:49 2013 -0700
Ticket 47468 - Change security password validation error is out of order
When changing the NSS security database password from Console, the
input validation errors that are returned by Admin Server are out of
order from teh UI elements in the Console. The way we were calling
the function to fetch parameters were causing the calling order to
process the input fields from the bottom up as viewed in the UI. This
makes the error message that is returned to the user look a bit odd.
This patch simply forces the parameters to be fetched in the same
order as they are displayed in the UI in Console.
diff --git a/admserv/cgi-src40/security.c b/admserv/cgi-src40/security.c
index 31da45d..fef3bea 100644
--- a/admserv/cgi-src40/security.c
+++ b/admserv/cgi-src40/security.c
@@ -2184,8 +2184,15 @@ int main(int argc, char *argv[])
} else if (!PORT_Strcmp(operation, "INIT_PIN")) {
/* initialize internal token pin */
- initPin(getParameter("newpwd",getResourceString(DBT_PASSWORD)),
- getParameter("confirmpwd",getResourceString(DBT_PASSWORD)));
+
+ /* We fetch the paramters here for the benefit of the Console. If we call
+ * getParameter() as an argument to initPin, the calling order causes the
+ * error message that is returned to be out of order with the display in
+ * the UI. */
+ char *newpwd = getParameter("newpwd",getResourceString(DBT_PASSWORD));
+ char *confirmpwd = getParameter("confirmpwd",getResourceString(DBT_PASSWORD));
+
+ initPin(newpwd, confirmpwd);
} else if (!PORT_Strcmp(operation, "DELETE_CACERT")) {
/* remove a ca certificate */
@@ -2218,9 +2225,16 @@ int main(int argc, char *argv[])
/* currently change password only apply to key3.db, and we do
not deal with change password for external token. User can
do that via the software that comes with the hardware */
- changePassword(getParameter("oldpwd", getResourceString(DBT_OLD_PWD)),
- getParameter("newpwd", getResourceString(DBT_NEW_PWD)),
- getParameter("confirmpwd", getResourceString(DBT_CONFIRM_PWD)));
+
+ /* We fetch the paramters here for the benefit of the Console. If we call
+ * getParameter() as an argument to initPin, the calling order causes the
+ * error message that is returned to be out of order with the display in
+ * the UI. */
+ char *oldpwd = getParameter("oldpwd", getResourceString(DBT_OLD_PWD));
+ char *newpwd = getParameter("newpwd", getResourceString(DBT_NEW_PWD));
+ char *confirmpwd = getParameter("confirmpwd", getResourceString(DBT_CONFIRM_PWD));
+
+ changePassword(oldpwd, newpwd, confirmpwd);
} else if (!PORT_Strcmp(operation, "INSTALL_CRL_CKL")) {
/* install a crl/ckl certificate */
10 years, 8 months
Branch '389-ds-base-1.3.1' - ldap/admin
by Mark Reynolds
ldap/admin/src/logconv.pl | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
New commits:
commit 3e7ee7ca886feb56b3b26df97882c40d81bfff55
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Aug 14 15:32:36 2013 -0400
Ticket 47461 - logconv.pl - Use of comma-less variable list is deprecated
Description: In newer versions of perl commas are needed to separate variables
when "formatting" output. Also fixed a typo.
https://fedorahosted.org/389/ticket/47461
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 7e9cae5fa2292168e88e87eee2f9249171a1e9d8)
diff --git a/ldap/admin/src/logconv.pl b/ldap/admin/src/logconv.pl
index efc5970..77088ff 100755
--- a/ldap/admin/src/logconv.pl
+++ b/ldap/admin/src/logconv.pl
@@ -594,7 +594,7 @@ print "Restarts: $serverRestartCount\n";
print "Total Connections: $connectionCount\n";
print " - StartTLS Connections: $startTLSCount\n";
print " - LDAPS Connections: $sslCount\n";
-print " - LDAPI Conections: $ldapiCount\n";
+print " - LDAPI Connections: $ldapiCount\n";
print "Peak Concurrent Connections: $maxsimConnection\n";
print "Total Operations: $allOps\n";
print "Total Results: $allResults\n";
@@ -614,20 +614,20 @@ $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs, $c
$bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
format STDOUT =
-Searches: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $srchCount, $searchStat
-Modifications: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $modCount, $modStat
-Adds: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $addCount, $addStat
-Deletes: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $delCount, $deleteStat
-Mod RDNs: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $modrdnCount, $modrdnStat
-Compares: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $cmpCount, $compareStat
-Binds: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $bindCount $bindCountStat
+Searches: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $srchCount, $searchStat,
+Modifications: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $modCount, $modStat,
+Adds: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $addCount, $addStat,
+Deletes: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $delCount, $deleteStat,
+Mod RDNs: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $modrdnCount, $modrdnStat,
+Compares: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $cmpCount, $compareStat,
+Binds: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $bindCount, $bindCountStat,
.
write STDOUT;
10 years, 8 months
ldap/admin
by Mark Reynolds
ldap/admin/src/logconv.pl | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
New commits:
commit 7e9cae5fa2292168e88e87eee2f9249171a1e9d8
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Aug 14 14:51:39 2013 -0400
Ticket 47461 - logconv.pl - Use of comma-less variable list is deprecated
Description: In newer versionis of perl commas are needed to separate variables
when "formatting" output. Also fixed a typo.
https://fedorahosted.org/389/ticket/47461
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/admin/src/logconv.pl b/ldap/admin/src/logconv.pl
index e299b22..ec0fdf5 100755
--- a/ldap/admin/src/logconv.pl
+++ b/ldap/admin/src/logconv.pl
@@ -597,7 +597,7 @@ print "Restarts: $serverRestartCount\n";
print "Total Connections: $connectionCount\n";
print " - StartTLS Connections: $startTLSCount\n";
print " - LDAPS Connections: $sslCount\n";
-print " - LDAPI Conections: $ldapiCount\n";
+print " - LDAPI Connections: $ldapiCount\n";
print "Peak Concurrent Connections: $maxsimConnection\n";
print "Total Operations: $allOps\n";
print "Total Results: $allResults\n";
@@ -618,20 +618,20 @@ my $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs,
my $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
format STDOUT =
-Searches: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $srchCount, $searchStat
-Modifications: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $modCount, $modStat
-Adds: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $addCount, $addStat
-Deletes: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $delCount, $deleteStat
-Mod RDNs: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $modrdnCount, $modrdnStat
-Compares: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $cmpCount, $compareStat
-Binds: @<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<
- $bindCount, $bindCountStat
+Searches: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $srchCount, $searchStat,
+Modifications: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $modCount, $modStat,
+Adds: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $addCount, $addStat,
+Deletes: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $delCount, $deleteStat,
+Mod RDNs: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $modrdnCount, $modrdnStat,
+Compares: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $cmpCount, $compareStat,
+Binds: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+ $bindCount, $bindCountStat,
.
write STDOUT;
10 years, 8 months
Branch '389-ds-base-1.3.1' - ldap/admin
by Mark Reynolds
ldap/admin/src/scripts/DSUtil.pm.in | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
New commits:
commit a7bdcc535b213455b785be004153c51b71ccc3be
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 13 16:39:57 2013 -0400
Ticket 47473 - setup-ds.pl doesn't lookup the "root" group correctly
Bug Description: Silent install will fail, if you set the "SuiteSpotUserID"
to root, but do not set "SuiteSpotGroup".
Fix Description: The root gid is zero, and this incorrectly triggered an
error that cancelled the install. Fix is to check if the
user info is set, instead of checking the group id value;
https://fedorahosted.org/389/ticket/47473
Reviewed by: richm(Thanks!)
(cherry picked from commit 8aa9e8c38186c8447e6825839ef2f784f3ad9815)
diff --git a/ldap/admin/src/scripts/DSUtil.pm.in b/ldap/admin/src/scripts/DSUtil.pm.in
index b971dac..eaf5e4b 100644
--- a/ldap/admin/src/scripts/DSUtil.pm.in
+++ b/ldap/admin/src/scripts/DSUtil.pm.in
@@ -160,8 +160,13 @@ sub getLogin {
# Look up the primary group name for the supplied user
sub getGroup {
my $user = shift;
- my $gid = (getpwnam($user))[3] || confess "Error: could not determine the current group ID: $!";
- return (getgrgid($gid))[0] || confess "Error: could not determine the current group name: $!";
+ my @userinfo = getpwnam($user);
+
+ if(!@userinfo){
+ confess "Error: could not find user ID ($user): $!";
+ }
+
+ return (getgrgid($userinfo[3]))[0] || confess "Error: could not determine the current group name from gid ($userinfo[3]): $!";
}
sub isValidUser {
10 years, 8 months
ldap/admin
by Mark Reynolds
ldap/admin/src/scripts/DSUtil.pm.in | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
New commits:
commit 8aa9e8c38186c8447e6825839ef2f784f3ad9815
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 13 16:39:57 2013 -0400
Ticket 47473 - setup-ds.pl doesn't lookup the "root" group correctly
Bug Description: Silent install will fail, if you set the "SuiteSpotUserID"
to root, but do not set "SuiteSpotGroup".
Fix Description: The root gid is zero, and this incorrectly triggered an
error that cancelled the install. Fix is to check if the
user info is set, instead of checking the group id value;
https://fedorahosted.org/389/ticket/47473
Reviewed by: richm(Thanks!)
diff --git a/ldap/admin/src/scripts/DSUtil.pm.in b/ldap/admin/src/scripts/DSUtil.pm.in
index b971dac..eaf5e4b 100644
--- a/ldap/admin/src/scripts/DSUtil.pm.in
+++ b/ldap/admin/src/scripts/DSUtil.pm.in
@@ -160,8 +160,13 @@ sub getLogin {
# Look up the primary group name for the supplied user
sub getGroup {
my $user = shift;
- my $gid = (getpwnam($user))[3] || confess "Error: could not determine the current group ID: $!";
- return (getgrgid($gid))[0] || confess "Error: could not determine the current group name: $!";
+ my @userinfo = getpwnam($user);
+
+ if(!@userinfo){
+ confess "Error: could not find user ID ($user): $!";
+ }
+
+ return (getgrgid($userinfo[3]))[0] || confess "Error: could not determine the current group name from gid ($userinfo[3]): $!";
}
sub isValidUser {
10 years, 8 months
ldap/servers
by Noriko Hosoi
ldap/servers/plugins/posix-winsync/posix-group-func.c | 2
ldap/servers/plugins/replication/windows_protocol_util.c | 471 +++++++++------
ldap/servers/slapd/valueset.c | 19
3 files changed, 325 insertions(+), 167 deletions(-)
New commits:
commit 03814dd74df7f1f0d2842c5096c6425609da6f2c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Aug 5 12:53:18 2013 -0700
Ticket #415 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist
Bug description:
2 case were fixed.
1) A group on AD has a member which is not a target of windows
sync and exists only on AD. The member value in the group is
synchronized to DS. If an operation is executed on AD so that
the member is replaced with other members which are the target
of the windows sync, the new member values are not synchronized.
2) If a group on AD and DS have members which are local and are
not synchronized and the members are removed in the group on
the other side, the delete operation is synchronized and
deletes all the members including the local members.
Fix description:
1) In windows_generate_update_mods, even if a sync'ed member value
in a DS entry is not the target of windows sync and it is does
not exist on DS, a following modify operation including the member
value is proceeded by confirming the existence on AD.
2) AD->DS: in windows_map_mods_for_replay
DS->AD: in windwos_generate_update_mods
added the code to check if an attribute is completely deleted on
one side, then the each value on the other side is in the sync
scope or not. Put the value to the mod for the delete only if
the value is in the sync scope.
Reviewed by Rich (Thank you!!)
https://fedorahosted.org/389/ticket/415
diff --git a/ldap/servers/plugins/posix-winsync/posix-group-func.c b/ldap/servers/plugins/posix-winsync/posix-group-func.c
index 664d637..aa76d6c 100644
--- a/ldap/servers/plugins/posix-winsync/posix-group-func.c
+++ b/ldap/servers/plugins/posix-winsync/posix-group-func.c
@@ -98,7 +98,7 @@ getEntry(const char *udn, char **attrs)
}
else {
slapi_log_error(SLAPI_LOG_FATAL, POSIX_WINSYNC_PLUGIN_NAME,
- "getEntry: error searching for uid: %d", rc);
+ "getEntry: error searching for uid: %d\n", rc);
}
return NULL;
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index dfc4df5..8e92de2 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -409,12 +409,19 @@ map_dn_values(Private_Repl_Protocol *prp,Slapi_ValueSet *original_values, Slapi_
int retval = 0;
int i = 0;
+ if (NULL == mapped_values) {
+ slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
+ "%s: map_dn_values: arg mapped_values is NULL.\n",
+ agmt_get_long_name(prp->agmt));
+ return;
+ }
+
/* Set the keep raw entry flag to avoid overwriting the existing raw entry. */
windows_private_set_keep_raw_entry(prp->agmt, 1);
/* For each value: */
- i= slapi_valueset_first_value(original_values,&original_value);
- while ( i != -1 ) {
+ i= slapi_valueset_first_value(original_values,&original_value);
+ while ( i != -1 ) {
int is_ours = 0;
char *new_dn_string = NULL;
@@ -480,7 +487,7 @@ map_dn_values(Private_Repl_Protocol *prp,Slapi_ValueSet *original_values, Slapi_
local_entry = NULL;
}
} else
- {
+ { /* from windows */
Slapi_Entry *remote_entry = NULL;
Slapi_DN *local_dn = NULL;
/* Try to get the remote entry */
@@ -1534,115 +1541,115 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
return_value = process_replay_add(prp,op->p.p_add.target_entry,local_entry,local_dn,remote_dn,is_user,missing_entry,&password);
break;
case SLAPI_OPERATION_MODIFY:
- {
- LDAPMod **mapped_mods = NULL;
- char *newrdn = NULL;
-
- /*
- * If the magic objectclass and attributes have been added to the entry
- * to make the entry sync-able, add the entry first, then apply the other
- * mods
- */
- if (sync_attrs_added(op->p.p_modify.modify_mods, local_entry)) {
- Slapi_Entry *ad_entry = NULL;
-
- return_value = process_replay_add(prp,local_entry,local_entry,local_dn,remote_dn,is_user,missing_entry,&password);
- slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "%s: windows_replay_update: "
- "The modify operation added the sync objectclass and attribute, so "
- "the entry was added to windows - result [%d]\n",
- agmt_get_long_name(prp->agmt), return_value);
- if (return_value) {
- break; /* error adding entry - cannot continue */
- }
- /* the modify op needs the new remote entry, so retrieve it */
- windows_get_remote_entry(prp, remote_dn, &ad_entry);
- slapi_entry_free(ad_entry); /* getting sets windows_private_get_raw_entry */
- }
+ {
+ LDAPMod **mapped_mods = NULL;
+ char *newrdn = NULL;
+ /*
+ * If the magic objectclass and attributes have been added to the entry
+ * to make the entry sync-able, add the entry first, then apply the other
+ * mods
+ */
+ if (sync_attrs_added(op->p.p_modify.modify_mods, local_entry)) {
+ Slapi_Entry *ad_entry = NULL;
- windows_map_mods_for_replay(prp,op->p.p_modify.modify_mods, &mapped_mods, is_user, &password);
- if (is_user) {
- winsync_plugin_call_pre_ad_mod_user_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
- local_dn,
- local_entry,
- op->p.p_modify.modify_mods,
- remote_dn,
- &mapped_mods);
- } else if (is_group) {
- winsync_plugin_call_pre_ad_mod_group_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
- local_dn,
- local_entry,
- op->p.p_modify.modify_mods,
- remote_dn,
- &mapped_mods);
+ return_value = process_replay_add(prp,local_entry,local_entry,local_dn,remote_dn,is_user,missing_entry,&password);
+ slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
+ "%s: windows_replay_update: "
+ "The modify operation added the sync objectclass and attribute, so "
+ "the entry was added to windows - result [%d]\n",
+ agmt_get_long_name(prp->agmt), return_value);
+ if (return_value) {
+ break; /* error adding entry - cannot continue */
}
+ /* the modify op needs the new remote entry, so retrieve it */
+ windows_get_remote_entry(prp, remote_dn, &ad_entry);
+ slapi_entry_free(ad_entry); /* getting sets windows_private_get_raw_entry */
+ }
- /* Check if a naming attribute is being modified. */
- if (windows_check_mods_for_rdn_change(prp, op->p.p_modify.modify_mods, local_entry, remote_dn, &newrdn)) {
- /* Issue MODRDN */
- slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name, "%s: renaming remote entry \"%s\" with new RDN of \"%s\"\n",
- agmt_get_long_name(prp->agmt), slapi_sdn_get_dn(remote_dn), newrdn);
- return_value = windows_conn_send_rename(prp->conn, slapi_sdn_get_dn(remote_dn),
- newrdn, NULL, 1 /* delete old RDN */,
- NULL, NULL /* returned controls */);
- slapi_ch_free_string(&newrdn);
- }
+ windows_map_mods_for_replay(prp,op->p.p_modify.modify_mods, &mapped_mods, is_user, &password);
+ if (is_user) {
+ winsync_plugin_call_pre_ad_mod_user_mods_cb(prp->agmt,
+ windows_private_get_raw_entry(prp->agmt),
+ local_dn,
+ local_entry,
+ op->p.p_modify.modify_mods,
+ remote_dn,
+ &mapped_mods);
+ } else if (is_group) {
+ winsync_plugin_call_pre_ad_mod_group_mods_cb(prp->agmt,
+ windows_private_get_raw_entry(prp->agmt),
+ local_dn,
+ local_entry,
+ op->p.p_modify.modify_mods,
+ remote_dn,
+ &mapped_mods);
+ }
- /* It's possible that the mapping process results in an empty mod list, in which case we don't bother with the replay */
- if ( mapped_mods == NULL || *(mapped_mods)== NULL )
- {
- return_value = CONN_OPERATION_SUCCESS;
- } else
+ /* Check if a naming attribute is being modified. */
+ if (windows_check_mods_for_rdn_change(prp, op->p.p_modify.modify_mods, local_entry, remote_dn, &newrdn)) {
+ /* Issue MODRDN */
+ slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name, "%s: renaming remote entry \"%s\" with new RDN of \"%s\"\n",
+ agmt_get_long_name(prp->agmt), slapi_sdn_get_dn(remote_dn), newrdn);
+ return_value = windows_conn_send_rename(prp->conn, slapi_sdn_get_dn(remote_dn),
+ newrdn, NULL, 1 /* delete old RDN */,
+ NULL, NULL /* returned controls */);
+ slapi_ch_free_string(&newrdn);
+ }
+
+ /* It's possible that the mapping process results in an empty mod list, in which case we don't bother with the replay */
+ if ((mapped_mods == NULL) || (*mapped_mods == NULL))
+ {
+ return_value = CONN_OPERATION_SUCCESS;
+ } else
+ {
+ int ldap_op = 0;
+ int ldap_result_code = 0;
+ if (slapi_is_loglevel_set(SLAPI_LOG_REPL))
{
- int ldap_op = 0;
- int ldap_result_code = 0;
- if (slapi_is_loglevel_set(SLAPI_LOG_REPL))
+ int i = 0;
+ slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
+ "dump mods for replay update:\n");
+ for(i=0;mapped_mods[i];i++)
{
- int i = 0;
- slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,"dump mods for replay update:");
- for(i=0;mapped_mods[i];i++)
- {
- slapi_mod_dump(mapped_mods[i],i);
- }
- }
- return_value = windows_conn_send_modify(prp->conn, slapi_sdn_get_dn(remote_dn), mapped_mods, NULL, NULL /* returned controls */);
- windows_conn_get_error(prp->conn, &ldap_op, &ldap_result_code);
- if ((return_value != CONN_OPERATION_SUCCESS) && !ldap_result_code) {
- /* op failed but no ldap error code ??? */
- ldap_result_code = LDAP_OPERATIONS_ERROR;
- }
- if (is_user) {
- winsync_plugin_call_post_ad_mod_user_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
- local_dn, local_entry,
- op->p.p_modify.modify_mods,
- remote_dn, mapped_mods, &ldap_result_code);
- } else if (is_group) {
- winsync_plugin_call_post_ad_mod_group_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
- local_dn, local_entry,
- op->p.p_modify.modify_mods,
- remote_dn, mapped_mods, &ldap_result_code);
- }
- /* see if plugin reset success/error condition */
- if ((return_value != CONN_OPERATION_SUCCESS) && !ldap_result_code) {
- return_value = CONN_OPERATION_SUCCESS;
- windows_conn_set_error(prp->conn, ldap_result_code);
- } else if ((return_value == CONN_OPERATION_SUCCESS) && ldap_result_code) {
- return_value = CONN_OPERATION_FAILED;
- windows_conn_set_error(prp->conn, ldap_result_code);
+ slapi_mod_dump(mapped_mods[i],i);
}
}
- if (mapped_mods)
- {
- ldap_mods_free(mapped_mods,1);
- mapped_mods = NULL;
+ return_value = windows_conn_send_modify(prp->conn, slapi_sdn_get_dn(remote_dn), mapped_mods, NULL, NULL /* returned controls */);
+ windows_conn_get_error(prp->conn, &ldap_op, &ldap_result_code);
+ if ((return_value != CONN_OPERATION_SUCCESS) && !ldap_result_code) {
+ /* op failed but no ldap error code ??? */
+ ldap_result_code = LDAP_OPERATIONS_ERROR;
+ }
+ if (is_user) {
+ winsync_plugin_call_post_ad_mod_user_mods_cb(prp->agmt,
+ windows_private_get_raw_entry(prp->agmt),
+ local_dn, local_entry,
+ op->p.p_modify.modify_mods,
+ remote_dn, mapped_mods, &ldap_result_code);
+ } else if (is_group) {
+ winsync_plugin_call_post_ad_mod_group_mods_cb(prp->agmt,
+ windows_private_get_raw_entry(prp->agmt),
+ local_dn, local_entry,
+ op->p.p_modify.modify_mods,
+ remote_dn, mapped_mods, &ldap_result_code);
}
+ /* see if plugin reset success/error condition */
+ if ((return_value != CONN_OPERATION_SUCCESS) && !ldap_result_code) {
+ return_value = CONN_OPERATION_SUCCESS;
+ windows_conn_set_error(prp->conn, ldap_result_code);
+ } else if ((return_value == CONN_OPERATION_SUCCESS) && ldap_result_code) {
+ return_value = CONN_OPERATION_FAILED;
+ windows_conn_set_error(prp->conn, ldap_result_code);
+ }
+ }
+ if (mapped_mods)
+ {
+ ldap_mods_free(mapped_mods,1);
+ mapped_mods = NULL;
}
break;
+ }
case SLAPI_OPERATION_DELETE:
if (delete_remote_entry_allowed(local_entry))
{
@@ -2618,17 +2625,34 @@ done:
static void
-windows_map_mods_for_replay(Private_Repl_Protocol *prp,LDAPMod **original_mods, LDAPMod ***returned_mods, int is_user, char** password)
+windows_map_mods_for_replay(Private_Repl_Protocol *prp,
+ LDAPMod **original_mods,
+ LDAPMod ***returned_mods,
+ int is_user,
+ char** password)
{
Slapi_Mods smods = {0};
Slapi_Mods mapped_smods = {0};
LDAPMod *mod = NULL;
- int is_nt4 = windows_private_get_isnt4(prp->agmt);
+ int is_nt4 = 0;
Slapi_Mod *mysmod = NULL;
const Slapi_Entry *ad_entry = NULL;
Slapi_Entry *ad_entry_copy = NULL;
+ const Slapi_DN *windows_subtree = NULL;
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_map_mods_for_replay\n", 0, 0, 0 );
+ if (NULL == prp) {
+ LDAPDebug(LDAP_DEBUG_TRACE,
+ "<= windows_map_mods_for_replay; NULL protocol; NOOP\n", 0, 0, 0);
+ return;
+ }
+ windows_subtree = windows_private_get_windows_subtree(prp->agmt);
+ if (NULL == windows_subtree) {
+ LDAPDebug(LDAP_DEBUG_TRACE,
+ "<= windows_map_mods_for_replay; NULL agreement subtree; NOOP\n", 0, 0, 0);
+ return;
+ }
+ is_nt4 = windows_private_get_isnt4(prp->agmt);
/* Iterate through the original mods, looking each attribute type up in the maps for either user or group */
@@ -2716,13 +2740,66 @@ windows_map_mods_for_replay(Private_Repl_Protocol *prp,LDAPMod **original_mods,
mapped_values = NULL;
} else
{
- /* this might be a del: mod, in which case there are no values */
- if (mod->mod_op & LDAP_MOD_DELETE)
+ if (slapi_valueset_isempty(vs) && (mod->mod_op & LDAP_MOD_DELETE))
{
- mysmod = slapi_mod_new();
- slapi_mod_init(mysmod, 0);
- slapi_mod_set_operation(mysmod, LDAP_MOD_DELETE|LDAP_MOD_BVALUES);
- slapi_mod_set_type(mysmod, mapped_type);
+ /* modify - del all, in which case there are no values */
+ Slapi_Attr *attr = NULL;
+
+ /*
+ * ad_entry:
+ * get mapped_type values
+ * get in-scope values from the values
+ */
+ slapi_entry_attr_find(ad_entry, mapped_type, &attr);
+ if (attr) {
+ Slapi_ValueSet *thisvs = NULL;
+ Slapi_Value *valp = NULL;
+ Slapi_DN *sdn = slapi_sdn_new();
+ int i;
+ int is_in_subtree = 0;
+ Slapi_Value **myva = NULL;
+
+ slapi_attr_get_valueset(attr, &thisvs); /* thisvs is dup'ed */
+ for (i = slapi_valueset_first_value(thisvs, &valp);
+ (i != -1) && (valp != NULL);
+ i = slapi_valueset_next_value(thisvs, i, &valp)) {
+ /* valp is a pointer to va in thisvs */
+ const char *strval = slapi_value_get_string(valp); /* no dup */
+ if (strval) {
+ slapi_sdn_set_dn_byref(sdn, strval);
+ is_in_subtree = slapi_sdn_scope_test(sdn, windows_subtree,
+ LDAP_SCOPE_SUBTREE);
+ if (is_in_subtree) {
+ /*
+ * If delete all on DS,
+ * we could delete the values on AD in the scope.
+ */
+ /* myva is (re)allocated and valp is copied */
+ valuearray_add_value(&myva, valp);
+ }
+ }
+ }
+ if (myva) {
+ Slapi_ValueSet *myvs = NULL;
+
+ myvs = slapi_valueset_new();
+ valueset_set_valuearray_passin(myvs, myva);
+ mysmod = slapi_mod_new();
+ slapi_mod_init_valueset_byval(mysmod,
+ LDAP_MOD_DELETE|LDAP_MOD_BVALUES,
+ mapped_type,
+ myvs);
+ slapi_valueset_free(myvs);
+ }
+ slapi_sdn_free(&sdn);
+ slapi_valueset_free(thisvs);
+ } else {
+ /*
+ * No corresponsing attribute in AD.
+ * There's no need to do anything on AD.
+ * slapi_mod_set_type(mysmod, mapped_type);
+ */
+ }
}
}
slapi_mod_done(&smod);
@@ -4288,19 +4365,20 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
int is_group = 0;
int rc = 0;
int is_nt4 = windows_private_get_isnt4(prp->agmt);
+ const Slapi_DN *local_subtree = NULL;
/* Iterate over the attributes on the remote entry, updating the local entry where appropriate */
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_generate_update_mods\n", 0, 0, 0 );
*do_modify = 0;
- if (!remote_entry || !local_entry) {
- slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "%s: windows_generate_update_mods: remote_entry is [%s] local_entry is [%s] "
- "cannot generate update mods\n", agmt_get_long_name(prp->agmt),
- remote_entry ? slapi_entry_get_dn_const(remote_entry) : "NULL",
- local_entry ? slapi_entry_get_dn_const(local_entry) : "NULL");
- goto bail;
- }
+ if (!remote_entry || !local_entry) {
+ slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
+ "%s: windows_generate_update_mods: remote_entry is [%s] local_entry is [%s] "
+ "cannot generate update mods\n", agmt_get_long_name(prp->agmt),
+ remote_entry ? slapi_entry_get_dn_const(remote_entry) : "NULL",
+ local_entry ? slapi_entry_get_dn_const(local_entry) : "NULL");
+ goto bail;
+ }
if (to_windows)
{
@@ -4310,8 +4388,8 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
windows_is_remote_entry_user_or_group(remote_entry,&is_user,&is_group);
}
- for (rc = slapi_entry_first_attr(remote_entry, &attr); rc == 0;
- rc = slapi_entry_next_attr(remote_entry, attr, &attr))
+ for (rc = slapi_entry_first_attr(remote_entry, &attr); rc == 0;
+ rc = slapi_entry_next_attr(remote_entry, attr, &attr))
{
int is_present_local = 0;
char *type = NULL;
@@ -4455,15 +4533,17 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
} else {
/* A dn-valued attribute : need to take special steps */
Slapi_ValueSet *mapped_remote_values = NULL;
+ Slapi_ValueSet *local_values = NULL;
+
+ /* We ignore any DNs that are outside the scope of the agreement (on both sides) */
+ slapi_attr_get_valueset(local_attr,&local_values);
+
/* First map all the DNs to that they're in a consistent domain */
map_dn_values(prp,vs,&mapped_remote_values, to_windows,0);
if (mapped_remote_values)
{
- Slapi_ValueSet *local_values = NULL;
Slapi_ValueSet *restricted_local_values = NULL;
/* Now do a compare on the values, generating mods to bring them into consistency (if any) */
- /* We ignore any DNs that are outside the scope of the agreement (on both sides) */
- slapi_attr_get_valueset(local_attr,&local_values);
if (local_values)
{
map_dn_values(prp,local_values,&restricted_local_values,!to_windows,1);
@@ -4475,6 +4555,9 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
}
else
{
+ windows_generate_dn_value_mods(local_type, local_attr, smods,
+ mapped_remote_values,
+ local_values,do_modify);
slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
"windows_generate_update_mods: no restricted local values found for "
"local attribute %s in local entry %s for remote attribute "
@@ -4484,9 +4567,9 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
type ? type : "NULL",
slapi_entry_get_dn(remote_entry));
}
- slapi_valueset_free(local_values);
- local_values = NULL;
} else {
+ windows_generate_dn_value_mods(local_type, local_attr, smods,
+ mapped_remote_values, NULL, do_modify);
slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
"windows_generate_update_mods: no local values found for "
"local attribute %s in local entry %s for remote attribute "
@@ -4499,18 +4582,25 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
slapi_valueset_free(mapped_remote_values);
mapped_remote_values = NULL;
} else {
- slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "windows_generate_update_mods: could not map the values in "
- "local attribute %s in local entry %s for remote attribute "
- "%s in remote entry %s\n",
- local_type,
- slapi_entry_get_dn(local_entry),
- type ? type : "NULL",
- slapi_entry_get_dn(remote_entry));
+ if (local_values) {
+ windows_generate_dn_value_mods(local_type, local_attr, smods,
+ NULL, local_values, do_modify);
+ } else {
+ slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
+ "windows_generate_update_mods: could not map the values in "
+ "local attribute %s in local entry %s for remote attribute "
+ "%s in remote entry %s\n",
+ local_type,
+ slapi_entry_get_dn(local_entry),
+ type ? type : "NULL",
+ slapi_entry_get_dn(remote_entry));
+ }
}
+ slapi_valueset_free(local_values);
+ local_values = NULL;
}
} else
- {
+ { /* !is_present_local || is_guid */
if (!is_present_local)
{
slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
@@ -4607,37 +4697,91 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
slapi_ch_free_string(&local_type);
}
- /* Check if any attributes were deleted from the remote entry */
- entry_first_deleted_attribute(remote_entry, &del_attr);
- while (del_attr != NULL) {
- Slapi_Attr *local_attr = NULL;
- char *type = NULL;
- char *local_type = NULL;
- int mapdn = 0;
+ /* Check if any attributes were deleted from the remote entry */
+ entry_first_deleted_attribute(remote_entry, &del_attr);
+ local_subtree = windows_private_get_directory_subtree(prp->agmt);
+ while (del_attr != NULL) {
+ Slapi_Attr *local_attr = NULL;
+ char *type = NULL;
+ char *local_type = NULL;
+ int mapdn = 0;
- /* Map remote type to local type */
+ /* Map remote type to local type */
slapi_attr_get_type(del_attr, &type);
- if ( is_straight_mapped_attr(type,is_user,is_nt4) ) {
- local_type = slapi_ch_strdup(type);
- } else {
- windows_map_attr_name(type , to_windows, is_user, 0 /* not create */, &local_type, &mapdn);
- }
-
- /* Check if this attr exists in the local entry */
- if (local_type) {
- slapi_entry_attr_find(local_entry, local_type, &local_attr);
- if (local_attr) {
- slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "windows_generate_update_mods: deleting %s attribute from local entry\n", local_type);
- /* Delete this attr from the local entry */
- slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, local_type, NULL);
+ if ( is_straight_mapped_attr(type,is_user,is_nt4) ) {
+ local_type = slapi_ch_strdup(type);
+ } else {
+ windows_map_attr_name(type , to_windows, is_user, 0 /* not create */, &local_type, &mapdn);
+ }
+
+ /* Check if this attr exists in the local entry */
+ if (local_type) {
+ slapi_entry_attr_find(local_entry, local_type, &local_attr);
+ if (local_attr) {
+ Slapi_Mod *mysmod = NULL;
+ slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
+ "windows_generate_update_mods: deleting %s attribute from local entry\n", local_type);
+ /* Delete this attr from the local entry */
+ /* if type is dn and the dn is out of winsync scope, keep them.
+ * othewise delete all attr. */
+ if (mapdn) {
+ Slapi_ValueSet *vs = NULL;
+ Slapi_Value *valp = NULL;
+ Slapi_DN *sdn = slapi_sdn_new();
+ int i = 0;
+ int is_in_subtree = 0;
+ Slapi_Value **myva = NULL;
+
+ slapi_attr_get_valueset(local_attr, &vs); /* thisvs is dup'ed */
+ for (i = slapi_valueset_first_value(vs, &valp);
+ (i != -1) && (valp != NULL);
+ i = slapi_valueset_next_value(vs, i, &valp)) {
+ /* valp is a pointer to va in vs */
+ const char *strval = slapi_value_get_string(valp); /* no dup */
+ if (strval) {
+ slapi_sdn_set_dn_byref(sdn, strval);
+ is_in_subtree = slapi_sdn_scope_test(sdn, local_subtree,
+ LDAP_SCOPE_SUBTREE);
+ if (is_in_subtree) {
+ /*
+ * If delete all on AD,
+ * we could delete the values on DS in the scope.
+ */
+ /* myva is (re)allocated and valp is copied */
+ valuearray_add_value(&myva, valp);
+ }
+ }
+ }
+ if (myva) {
+ Slapi_ValueSet *myvs = NULL;
+
+ myvs = slapi_valueset_new();
+ valueset_set_valuearray_passin(myvs, myva);
+ mysmod = slapi_mod_new();
+ slapi_mod_init_valueset_byval(mysmod,
+ LDAP_MOD_DELETE|LDAP_MOD_BVALUES,
+ local_type,
+ myvs);
+ slapi_valueset_free(myvs);
+ }
+ slapi_sdn_free(&sdn);
+ slapi_valueset_free(vs);
+ if (mysmod) {
+ slapi_mods_add_ldapmod(smods, slapi_mod_get_ldapmod_passout(mysmod));
+ }
+ if (mysmod) {
+ slapi_mod_free(&mysmod);
+ }
+ } else {
+ slapi_mods_add_mod_values(smods, LDAP_MOD_DELETE, local_type, NULL);
+ }
*do_modify = 1;
- }
- }
+ }
+ }
- entry_next_deleted_attribute(remote_entry, &del_attr);
+ entry_next_deleted_attribute(remote_entry, &del_attr);
slapi_ch_free_string(&local_type);
- }
+ }
if (to_windows) {
if (is_user) {
@@ -4742,7 +4886,7 @@ windows_update_remote_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry
static int
windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,Slapi_Entry *local_entry)
{
- Slapi_Mods smods = {0};
+ Slapi_Mods smods = {0};
int retval = 0;
Slapi_PBlock *pb = NULL;
int do_modify = 0;
@@ -4778,9 +4922,9 @@ windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,
/* compare the parents */
retval = windows_get_superior_change(prp,
- slapi_entry_get_sdn(local_entry),
- mapped_sdn,
- &newsuperior, 0 /* to_windows */);
+ slapi_entry_get_sdn(local_entry),
+ mapped_sdn,
+ &newsuperior, 0 /* to_windows */);
if (newsuperior || newrdn) {
/* remote parent is different from the local parent */
@@ -4833,7 +4977,6 @@ windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,
}
}
-
slapi_mods_init (&smods, 0);
retval = windows_generate_update_mods(prp,remote_entry,local_entry,0,&smods,&do_modify);
@@ -5387,7 +5530,7 @@ retry:
void
windows_dirsync_inc_run(Private_Repl_Protocol *prp)
- {
+{
int rc = 0;
int done = 0;
diff --git a/ldap/servers/slapd/valueset.c b/ldap/servers/slapd/valueset.c
index 62dad9c..59b3d47 100644
--- a/ldap/servers/slapd/valueset.c
+++ b/ldap/servers/slapd/valueset.c
@@ -696,12 +696,24 @@ slapi_valueset_join_attr_valueset(const Slapi_Attr *a, Slapi_ValueSet *vs1, cons
int
slapi_valueset_first_value( Slapi_ValueSet *vs, Slapi_Value **v )
{
+ if (NULL == vs) {
+ if (v) {
+ *v = NULL;
+ }
+ return 0;
+ }
return valuearray_first_value(vs->va,v);
}
int
slapi_valueset_next_value( Slapi_ValueSet *vs, int index, Slapi_Value **v)
{
+ if (NULL == vs) {
+ if (v) {
+ *v = NULL;
+ }
+ return index;
+ }
return valuearray_next_value(vs->va,index,v);
}
@@ -728,6 +740,9 @@ slapi_valueset_isempty( const Slapi_ValueSet *vs)
int
valueset_isempty( const Slapi_ValueSet *vs)
{
+ if (NULL == vs) {
+ return 1; /* true */
+ }
return valuearray_isempty(vs->va);
}
@@ -736,8 +751,8 @@ Slapi_Value *
slapi_valueset_find(const Slapi_Attr *a, const Slapi_ValueSet *vs, const Slapi_Value *v)
{
Slapi_Value *r= NULL;
- if(vs->num > 0 )
- {
+ if(vs && (vs->num > 0))
+ {
if (vs->sorted) {
r = valueset_find_sorted(a,vs,v,NULL);
} else {
10 years, 8 months
ldap/servers
by Noriko Hosoi
ldap/servers/slapd/back-ldbm/archive.c | 50 +++++++++++++++-----------
ldap/servers/slapd/back-ldbm/dblayer.c | 6 +--
ldap/servers/slapd/back-ldbm/dbversion.c | 29 ++++++++-------
ldap/servers/slapd/back-ldbm/import-threads.c | 2 -
ldap/servers/slapd/main.c | 6 +--
ldap/servers/slapd/task.c | 2 -
6 files changed, 54 insertions(+), 41 deletions(-)
New commits:
commit ad32c623e83b3a2c0736f6037a5ff1c2c3219382
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Aug 6 14:04:52 2013 -0700
Ticket #630 - The backend name provided to bak2db is not validated
Bug description: backend instance name was not validated correctly.
When a given backend instance name was not valid, the instance name
was ignored and the utility restored all instances, which was a default
behaviour of the restore -- bak2db.
Fix description: This patch adds the code to check the backend instance
name. If there is no backend instance, the restore request is ignored.
In addition, it enhanced the back up path validation, as well.
There was another bug found in the restore/bak2db. The backend instance
name is supposed to be case insensitive, but the case was not ignored.
The bug was fixed, too.
Reviewed by Rich (Thank you!!)
https://fedorahosted.org/389/ticket/630
diff --git a/ldap/servers/slapd/back-ldbm/archive.c b/ldap/servers/slapd/back-ldbm/archive.c
index f5fab1a..f8972f6 100644
--- a/ldap/servers/slapd/back-ldbm/archive.c
+++ b/ldap/servers/slapd/back-ldbm/archive.c
@@ -55,6 +55,10 @@ int ldbm_back_archive2ldbm( Slapi_PBlock *pb )
int run_from_cmdline = 0;
Slapi_Task *task;
int is_old_to_new = 0;
+ ldbm_instance *inst = NULL;
+ char *dbversion = NULL;
+ char *dataversion = NULL;
+ int value = 0;
slapi_pblock_get( pb, SLAPI_PLUGIN_PRIVATE, &li );
slapi_pblock_get( pb, SLAPI_SEQ_VAL, &rawdirectory );
@@ -64,40 +68,46 @@ int ldbm_back_archive2ldbm( Slapi_PBlock *pb )
li->li_flags = run_from_cmdline = (task_flags & SLAPI_TASK_RUNNING_FROM_COMMANDLINE);
if ( !rawdirectory || !*rawdirectory ) {
- LDAPDebug( LDAP_DEBUG_ANY, "archive2db: no archive name\n",
- 0, 0, 0 );
- return( -1 );
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "archive2db: no archive name\n");
+ return -1;
}
directory = rel2abspath(rawdirectory);
+ return_value = dbversion_read(li, directory, &dbversion, &dataversion);
+ if (return_value) {
+ if (ENOENT == return_value) {
+ LDAPDebug1Arg(LDAP_DEBUG_ANY, "archive2db: no back up \"%s\" exists.\n",
+ directory);
+ return -1;
+ }
+ LDAPDebug1Arg(LDAP_DEBUG_ANY, "Warning: Unable to read dbversion file in %s\n",
+ directory);
+ }
/* check the current idl format vs backup DB version */
- if (idl_get_idl_new())
- {
- char *dbversion = NULL;
- char *dataversion = NULL;
- int value = 0;
-
- if (dbversion_read(li, directory, &dbversion, &dataversion) != 0)
- {
- LDAPDebug(LDAP_DEBUG_ANY, "Warning: Unable to read dbversion "
- "file in %s\n", directory, 0, 0);
- }
+ if (idl_get_idl_new()) {
value = lookup_dbversion(dbversion, DBVERSION_TYPE);
- if (value & DBVERSION_OLD_IDL)
- {
+ if (value & DBVERSION_OLD_IDL) {
is_old_to_new = 1;
}
- slapi_ch_free_string(&dbversion);
- slapi_ch_free_string(&dataversion);
}
+ slapi_ch_free_string(&dbversion);
+ slapi_ch_free_string(&dataversion);
/* No ldbm be's exist until we process the config information. */
if (run_from_cmdline) {
mapping_tree_init();
ldbm_config_load_dse_info(li);
- } else {
- ldbm_instance *inst;
+ }
+ if (backendname) {
+ inst = ldbm_instance_find_by_name(li, backendname);
+ if (NULL == inst) {
+ LDAPDebug1Arg(LDAP_DEBUG_ANY, "archive2db: backend \"%s\" does not exist.\n",
+ backendname);
+ return -1;
+ }
+ }
+ if (!run_from_cmdline) {
Object *inst_obj, *inst_obj2;
/* task does not support restore old idl onto new idl server */
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index cddd9ce..5b981b0 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -5526,7 +5526,7 @@ dblayer_delete_database_ex(struct ldbminfo *li, char *instance, char *cldir)
ldbm_instance *inst = (ldbm_instance *)object_get_data(inst_obj);
if (inst->inst_be->be_instance_info != NULL) {
- if ((NULL != instance) && (strcmp(inst->inst_name,instance) != 0))
+ if ((NULL != instance) && (strcasecmp(inst->inst_name,instance) != 0))
{
LDAPDebug(LDAP_DEBUG_ANY,
"dblayer_delete_database: skipping instance %s\n",inst->inst_name , 0, 0);
@@ -6638,7 +6638,7 @@ static int dblayer_fri_trim(char *fri_dir_path, char* bename)
tmp_rval = PR_GetFileInfo64(filename, &info);
if (tmp_rval == PR_SUCCESS && PR_FILE_DIRECTORY == info.type)
{
- if(strcmp(direntry->name,bename)!=0)
+ if(strcasecmp(direntry->name,bename)!=0)
{
LDAPDebug(LDAP_DEBUG_ANY, "Removing file %s from staging area\n",
filename, 0, 0);
@@ -6834,7 +6834,7 @@ int dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *
{
PR_snprintf(filename1, sizeof(filename1), "%s/%s",
src_dir, direntry->name);
- if(!frirestore || strcmp(direntry->name,bename)==0)
+ if(!frirestore || strcasecmp(direntry->name,bename)==0)
{
tmp_rval = PR_GetFileInfo64(filename1, &info);
if (tmp_rval == PR_SUCCESS && PR_FILE_DIRECTORY == info.type) {
diff --git a/ldap/servers/slapd/back-ldbm/dbversion.c b/ldap/servers/slapd/back-ldbm/dbversion.c
index e4eee32..43633eb 100644
--- a/ldap/servers/slapd/back-ldbm/dbversion.c
+++ b/ldap/servers/slapd/back-ldbm/dbversion.c
@@ -160,30 +160,34 @@ dbversion_read(struct ldbminfo *li, const char *directory,
{
char filename[ MAXPATHLEN*2 ];
PRFileDesc *prfd;
- int rc = -1;
char * iter = NULL;
+ PRFileInfo64 fileinfo;
+ int rc;
if (!is_fullpath((char *)directory)) {
- return rc;
+ return ENOENT;
}
if (NULL == ldbmversion) {
- return rc;
+ return EINVAL;
+ }
+
+ rc = PR_GetFileInfo64(directory, &fileinfo);
+ if ((rc != PR_SUCCESS) || (fileinfo.type != PR_FILE_DIRECTORY)) {
+ /* Directory does not exist or not a directory. */
+ return ENOENT;
}
mk_dbversion_fullpath(li, directory, filename);
/* Open the file */
- if (( prfd = PR_Open( filename, PR_RDONLY, SLAPD_DEFAULT_FILE_MODE )) ==
- NULL )
- {
+ prfd = PR_Open(filename, PR_RDONLY, SLAPD_DEFAULT_FILE_MODE);
+ if (prfd == NULL) {
/* File missing... we are probably creating a new database. */
- }
- else
- {
+ return EACCES;
+ } else {
char buf[LDBM_VERSION_MAXBUF];
- PRInt32 nr = slapi_read_buffer( prfd, buf,
- (PRInt32)LDBM_VERSION_MAXBUF-1 );
+ PRInt32 nr = slapi_read_buffer(prfd, buf, (PRInt32)LDBM_VERSION_MAXBUF-1);
if ( nr > 0 && nr != (PRInt32)LDBM_VERSION_MAXBUF-1 )
{
char *t;
@@ -200,9 +204,8 @@ dbversion_read(struct ldbminfo *li, const char *directory,
}
}
(void)PR_Close( prfd );
- rc= 0;
+ return 0;
}
- return rc;
}
diff --git a/ldap/servers/slapd/back-ldbm/import-threads.c b/ldap/servers/slapd/back-ldbm/import-threads.c
index c0475c6..3a3aab8 100644
--- a/ldap/servers/slapd/back-ldbm/import-threads.c
+++ b/ldap/servers/slapd/back-ldbm/import-threads.c
@@ -3709,7 +3709,7 @@ dse_conf_verify_core(struct ldbminfo *li, char *src_dir, char *file_name, char *
if (entry_filter != NULL) /* Single instance restoration */
{
- if (NULL == strstr(estr, entry_filter)) {
+ if (NULL == PL_strcasestr(estr, entry_filter)) {
slapi_ch_free_string(&estr);
continue;
}
diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c
index a17a2c5..f1812be 100644
--- a/ldap/servers/slapd/main.c
+++ b/ldap/servers/slapd/main.c
@@ -2634,7 +2634,7 @@ slapd_exemode_db2archive()
memset( &pb, '\0', sizeof(pb) );
pb.pb_backend = NULL;
pb.pb_plugin = backend_plugin;
- pb.pb_instance_name = cmd_line_instance_name;
+ pb.pb_instance_name = NULL;
pb.pb_seq_val = archive_name;
pb.pb_task_flags = SLAPI_TASK_RUNNING_FROM_COMMANDLINE;
#ifndef _WIN32
@@ -2647,7 +2647,7 @@ slapd_exemode_db2archive()
static int
slapd_exemode_archive2db()
{
- int return_value= 0;
+ int return_value= 0;
Slapi_PBlock pb;
struct slapdplugin *backend_plugin;
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
@@ -2664,7 +2664,7 @@ slapd_exemode_archive2db()
0, 0, 0 );
return 1;
}
-
+
/* Make sure we aren't going to run slapd in
* a mode that is going to conflict with other
* slapd processes that are currently running
diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c
index 5fc0b08..3ffd799 100644
--- a/ldap/servers/slapd/task.c
+++ b/ldap/servers/slapd/task.c
@@ -1567,7 +1567,7 @@ static int task_restore_add(Slapi_PBlock *pb, Slapi_Entry *e,
slapi_ch_free((void **)&cookie);
if (NULL == be || NULL == be->be_database->plg_archive2db) {
LDAPDebug(LDAP_DEBUG_ANY,
- "ERROR: no db2archive function defined.\n", 0, 0, 0);
+ "ERROR: no archive2db function defined.\n", 0, 0, 0);
*returncode = LDAP_UNWILLING_TO_PERFORM;
rv = SLAPI_DSE_CALLBACK_ERROR;
goto out;
10 years, 8 months
ldap/servers
by Noriko Hosoi
ldap/servers/plugins/acl/acl.c | 26 ++++++------
ldap/servers/plugins/acl/acl.h | 11 +++--
ldap/servers/plugins/acl/acllist.c | 9 +++-
ldap/servers/plugins/acl/aclparse.c | 77 +++++++++++++++++++++++++++---------
ldap/servers/slapd/pblock.c | 11 +++++
ldap/servers/slapd/plugin_acl.c | 2
ldap/servers/slapd/slap.h | 4 +
ldap/servers/slapd/slapi-plugin.h | 3 +
8 files changed, 104 insertions(+), 39 deletions(-)
New commits:
commit 44ebe2287e8cee0c0c96e20c27621689428e6cbc
Author: Anupam Jain <anjain(a)localhost.localdomain>
Date: Thu Aug 1 15:13:32 2013 -0700
Ticket #626 - Possible to add nonexistent target to ACI
Fix description: This patch checks if the acl target exists and logs
a warning in the server log if the target does not exist. It does
not, however, validate targets containing wildcards or macros
https://fedorahosted.org/389/ticket/626
Reviewed by rmeggins and nhosoi.
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index a05037c..ce0fb92 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -1494,16 +1494,16 @@ acl_check_mods(
** syntax
*/
if (strcmp(mod->mod_type,
- aci_attr_type) == 0) {
- if ( 0 != (rv = acl_verify_syntax( e_sdn,
- mod->mod_bvalues[i], errbuf))) {
+ aci_attr_type) == 0) {
+ if ( 0 != (rv = acl_verify_syntax(pb, e_sdn,
+ mod->mod_bvalues[i], errbuf))) {
aclutil_print_err(rv, e_sdn,
mod->mod_bvalues[i],
- errbuf);
+ errbuf);
/* Cleanup */
slapi_mods_done(&smods);
return LDAP_INVALID_SYNTAX;
- }
+ }
}
} /* for */
}
@@ -1680,8 +1680,8 @@ acl_modified (Slapi_PBlock *pb, int optype, Slapi_DN *e_sdn, void *change)
acllist_acicache_WRITE_LOCK();
i= slapi_attr_first_value ( attr,&sval );
while ( i != -1 ) {
- attrVal = slapi_value_get_berval(sval);
- rv= acllist_insert_aci_needsLock(e_sdn, attrVal );
+ attrVal = slapi_value_get_berval(sval);
+ rv= acllist_insert_aci_needsLock_ext(pb, e_sdn, attrVal );
if (rv <= ACL_ERR)
aclutil_print_err(rv, e_sdn, attrVal, NULL);
/* Print the aci list */
@@ -1722,10 +1722,10 @@ acl_modified (Slapi_PBlock *pb, int optype, Slapi_DN *e_sdn, void *change)
if (bvalue == NULL)
break;
for (; *bvalue != NULL; ++bvalue) {
- rv=acllist_insert_aci_needsLock( e_sdn, *bvalue);
+ rv=acllist_insert_aci_needsLock_ext(pb, e_sdn, *bvalue);
if (rv <= ACL_ERR) {
- aclutil_print_err(rv, e_sdn,
- *bvalue, NULL);
+ aclutil_print_err(rv, e_sdn,
+ *bvalue, NULL);
}
}
} else {
@@ -1735,10 +1735,10 @@ acl_modified (Slapi_PBlock *pb, int optype, Slapi_DN *e_sdn, void *change)
for (; *value != NULL; ++value) {
b.bv_len = strlen (*value);
b.bv_val = *value;
- rv=acllist_insert_aci_needsLock( e_sdn, &b);
+ rv=acllist_insert_aci_needsLock_ext(pb, e_sdn, &b);
if (rv <= ACL_ERR) {
- aclutil_print_err(rv, e_sdn,
- &b, NULL);
+ aclutil_print_err(rv, e_sdn,
+ &b, NULL);
}
}
}
diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h
index 13c6f90..9e92252 100644
--- a/ldap/servers/plugins/acl/acl.h
+++ b/ldap/servers/plugins/acl/acl.h
@@ -808,14 +808,17 @@ int acl_access_allowed_main ( Slapi_PBlock *pb, Slapi_Entry *e, char **attrs,
struct berval *val, int access , int flags, char **errbuf);
int acl_access_allowed( Slapi_PBlock *pb, Slapi_Entry *e, char *attr,
struct berval *val, int access );
-int acl_verify_syntax(const Slapi_DN *e_sdn, const struct berval *bval, char **errbuf);
aclUserGroup * acl_get_usersGroup ( struct acl_pblock *aclpb , char *n_dn);
void acl_print_acllib_err (NSErr_t *errp , char * str);
int acl_check_mods( Slapi_PBlock *pb, Slapi_Entry *e, LDAPMod **mods, char **errbuf );
-int acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf);
char * acl__access2str(int access);
void acl_strcpy_special (char *d, char *s);
-int acl_parse(char *str, aci_t *aci_item, char **errbuf);
+int acl_parse(Slapi_PBlock *pb, char * str, aci_t *aci_item, char **errbuf);
+int acl_verify_aci_syntax (Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf);
+int acl_verify_syntax(Slapi_PBlock *pb, const Slapi_DN *e_sdn,
+ const struct berval *bval, char **errbuf);
+int acllist_insert_aci_needsLock_ext( Slapi_PBlock *pb, const Slapi_DN *e_sdn,
+ const struct berval* aci_attr);
char * acl_access2str ( int access );
int acl_init_ext ();
void * acl_get_ext (ext_type type, void *object);
@@ -864,7 +867,7 @@ void acllist_acicache_WRITE_UNLOCK(void);
void acllist_acicache_WRITE_LOCK(void);
void acllist_aciscan_update_scan ( Acl_PBlock *aclpb, char *edn );
int acllist_remove_aci_needsLock( const Slapi_DN *sdn, const struct berval *attr );
-int acllist_insert_aci_needsLock( const Slapi_DN *e_sdn, const struct berval* aci_attr);
+int acllist_insert_aci_needsLock( const Slapi_DN *e_sdn, const struct berval* aci_attr);
int acllist_init ();
int acllist_moddn_aci_needsLock ( Slapi_DN *oldsdn, char *newdn );
void acllist_print_tree ( Avlnode *root, int *depth, char *start, char *side);
diff --git a/ldap/servers/plugins/acl/acllist.c b/ldap/servers/plugins/acl/acllist.c
index 623a739..c01bed3 100644
--- a/ldap/servers/plugins/acl/acllist.c
+++ b/ldap/servers/plugins/acl/acllist.c
@@ -97,7 +97,6 @@ static void __acllist_free_aciContainer ( AciContainer **container);
void my_print( Avlnode *root );
-
int
acllist_init ()
{
@@ -196,6 +195,12 @@ void acl_be_state_change_fnc ( void *handle, char *be_name, int old_state,
int
acllist_insert_aci_needsLock( const Slapi_DN *e_sdn, const struct berval* aci_attr)
{
+ return(acllist_insert_aci_needsLock_ext(NULL, e_sdn, aci_attr));
+}
+
+int
+acllist_insert_aci_needsLock_ext( Slapi_PBlock *pb, const Slapi_DN *e_sdn, const struct berval* aci_attr)
+{
aci_t *aci;
char *acl_str;
@@ -209,7 +214,7 @@ acllist_insert_aci_needsLock( const Slapi_DN *e_sdn, const struct berval* aci_at
acl_str = slapi_ch_strdup(aci_attr->bv_val);
/* Parse the ACL TEXT */
- if ( 0 != (rv = acl_parse ( acl_str, aci, NULL )) ) {
+ if ( 0 != (rv = acl_parse ( pb, acl_str, aci, NULL )) ) {
slapi_log_error (SLAPI_LOG_FATAL, plugin_name,
"ACL PARSE ERR(rv=%d): %s\n", rv, acl_str );
slapi_ch_free ( (void **) &acl_str );
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index a8a38a1..ce44964 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -65,7 +65,6 @@ static int acl_verify_exactly_one_attribute( char *attr_name, Slapi_Filter *f);
static int type_compare( Slapi_Filter *f, void *arg);
static int acl_check_for_target_macro( aci_t *aci_item, char *value);
static int get_acl_rights_as_int( char * strValue);
-
/***************************************************************************
*
* acl_parse
@@ -75,6 +74,7 @@ static int get_acl_rights_as_int( char * strValue);
*
*
* Input:
+* Slapi_PBlock *pb - Parameter block
* char *str - Input string which has the ACL
* This is a duped copy, so here we have
* the right to stich '\0' characters into str for
@@ -93,7 +93,7 @@ static int get_acl_rights_as_int( char * strValue);
*
**************************************************************************/
int
-acl_parse(char * str, aci_t *aci_item, char **errbuf)
+acl_parse(Slapi_PBlock *pb, char * str, aci_t *aci_item, char **errbuf)
{
int rv=0;
@@ -110,10 +110,10 @@ acl_parse(char * str, aci_t *aci_item, char **errbuf)
}
} else if (!next) {
/* the statement does not start with a parenthesis */
- return(ACL_SYNTAX_ERR);
- } else {
+ return(ACL_SYNTAX_ERR);
+ } else {
/* then we have done all the processing */
- return 0;
+ return 0;
}
LDAP_UTF8INC(str); /* skip the "(" */
save = next;
@@ -146,14 +146,50 @@ acl_parse(char * str, aci_t *aci_item, char **errbuf)
if (aci_item->aci_type & ACI_TARGET_DN) {
char *avaType;
struct berval *avaValue;
- const char *dn;
- dn = slapi_sdn_get_ndn(aci_item->aci_sdn);
- slapi_filter_get_ava(f, &avaType, &avaValue);
+ Slapi_DN *targdn = slapi_sdn_new();
+ slapi_filter_get_ava ( f, &avaType, &avaValue );
+ slapi_sdn_init_dn_byref(targdn, avaValue->bv_val);
- if (!slapi_dn_issuffix(avaValue->bv_val, dn)) {
+ if (!slapi_sdn_get_dn(targdn)) {
+ /* not a valid DN */
+ slapi_sdn_free(&targdn);
return ACL_INVALID_TARGET;
}
+
+ if (!slapi_sdn_issuffix(targdn, aci_item->aci_sdn)) {
+ slapi_sdn_free(&targdn);
+ return ACL_INVALID_TARGET;
+ }
+
+ if (slapi_sdn_compare(targdn, aci_item->aci_sdn)) {
+ int target_check = 0;
+ if (pb) {
+ slapi_pblock_get(pb, SLAPI_ACI_TARGET_CHECK, &target_check);
+ }
+ if (target_check != 1) {
+ /* Make sure that the target exists */
+ int rc = 0;
+ Slapi_PBlock *temppb = slapi_pblock_new();
+ slapi_search_internal_set_pb_ext(temppb, targdn,
+ LDAP_SCOPE_BASE, "(objectclass=*)", NULL, 1, NULL, NULL,
+ (void *)plugin_get_default_component_id(), 0);
+ slapi_search_internal_pb(temppb);
+ slapi_pblock_get(temppb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
+ if (rc != LDAP_SUCCESS) {
+ slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
+ "The ACL target %s does not exist\n", slapi_sdn_get_dn(targdn));
+ }
+
+ slapi_free_search_results_internal(temppb);
+ slapi_pblock_destroy(temppb);
+ if (pb) {
+ target_check = 1;
+ slapi_pblock_set(pb, SLAPI_ACI_TARGET_CHECK, &target_check);
+ }
+ }
+ }
+ slapi_sdn_free(&targdn);
}
}
@@ -164,8 +200,8 @@ acl_parse(char * str, aci_t *aci_item, char **errbuf)
**
*/
if ((aci_item->aci_elevel != ACI_ELEVEL_USERDN_ANYONE) &&
- !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) {
- slapi_ch_free((void **)&aci_item->targetFilterStr);
+ !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) {
+ slapi_ch_free((void **)&aci_item->targetFilterStr);
}
/*
@@ -1550,6 +1586,7 @@ acl_strcpy_special (char *d, char *s)
* verify if the aci's being added for the entry has a valid syntax or not.
*
* Input:
+* Slapi_PBlock *pb - Parameter block
* Slapi_Entry *e - The Slapi_Entry itself
* char **errbuf; -- error message
*
@@ -1562,7 +1599,7 @@ acl_strcpy_special (char *d, char *s)
*
**************************************************************************/
int
-acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf)
+acl_verify_aci_syntax (Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf)
{
if (e != NULL) {
@@ -1580,8 +1617,8 @@ acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf)
i= slapi_attr_first_value ( attr,&sval );
while ( i != -1 ) {
- attrVal = slapi_value_get_berval ( sval );
- rv = acl_verify_syntax( e_sdn, attrVal, errbuf );
+ attrVal = slapi_value_get_berval ( sval );
+ rv = acl_verify_syntax( pb, e_sdn, attrVal, errbuf );
if ( 0 != rv ) {
aclutil_print_err(rv, e_sdn, attrVal, errbuf);
return ACL_ERR;
@@ -1598,6 +1635,7 @@ acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf)
* added/replaced has the right syntax or not.
*
* Input:
+* Slapi_PBlock *pb - Parameter block
* Slapi_DN *e_sdn - sdn of the entry
* berval *bval - The berval containg the aci value
*
@@ -1608,19 +1646,20 @@ acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf)
* None.
*
**************************************************************************/
+
int
-acl_verify_syntax(const Slapi_DN *e_sdn,
- const struct berval *bval, char **errbuf)
+acl_verify_syntax(Slapi_PBlock *pb, const Slapi_DN *e_sdn,
+ const struct berval *bval, char **errbuf)
{
aci_t *aci_item;
- int rv = 0;
+ int rv = 0;
char *str;
aci_item = acllist_get_aci_new ();
slapi_sdn_set_ndn_byval ( aci_item->aci_sdn, slapi_sdn_get_ndn ( e_sdn ) );
/* make a copy the the string */
- str = slapi_ch_strdup(bval->bv_val);
- rv = acl_parse(str, aci_item, errbuf);
+ str = slapi_ch_strdup(bval->bv_val);
+ rv = acl_parse(pb, str, aci_item, errbuf);
/* cleanup before you leave ... */
acllist_free_aci (aci_item);
diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c
index bf9d71e..d3cc55c 100644
--- a/ldap/servers/slapd/pblock.c
+++ b/ldap/servers/slapd/pblock.c
@@ -1953,6 +1953,12 @@ slapi_pblock_get( Slapi_PBlock *pblock, int arg, void *value )
(*(int *)value) = -1;
}
break;
+
+ /* ACI Target Check */
+ case SLAPI_ACI_TARGET_CHECK:
+ (*(int *)value) = pblock->pb_aci_target_check;
+ break;
+
default:
LDAPDebug( LDAP_DEBUG_ANY,
"Unknown parameter block argument %d\n", arg, 0, 0 );
@@ -3526,6 +3532,11 @@ slapi_pblock_set( Slapi_PBlock *pblock, int arg, void *value )
pblock->pb_paged_results_index = *(int *)value;
break;
+ /* ACI Target Check */
+ case SLAPI_ACI_TARGET_CHECK:
+ pblock->pb_aci_target_check = *((int *) value);
+ break;
+
default:
LDAPDebug( LDAP_DEBUG_ANY,
"Unknown parameter block argument %d\n", arg, 0, 0 );
diff --git a/ldap/servers/slapd/plugin_acl.c b/ldap/servers/slapd/plugin_acl.c
index eebc292..e4a3a76 100644
--- a/ldap/servers/slapd/plugin_acl.c
+++ b/ldap/servers/slapd/plugin_acl.c
@@ -217,7 +217,7 @@ plugin_call_acl_verify_syntax ( Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf
if (plugin_invoke_plugin_sdn (p, SLAPI_PLUGIN_ACL_SYNTAX_CHECK, pb,
(Slapi_DN*)slapi_entry_get_sdn_const (e))){
plugin_called = 1;
- rc = (*p->plg_acl_syntax_check)( e, errbuf );
+ rc = (*p->plg_acl_syntax_check)( pb, e, errbuf );
if ( rc != LDAP_SUCCESS ) break;
}
}
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index c4acb60..88f1791 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -1745,6 +1745,10 @@ typedef struct slapi_pblock {
int pb_paged_results_index; /* stash SLAPI_PAGED_RESULTS_INDEX */
passwdPolicy *pwdpolicy;
void *op_stack_elem;
+
+ /* For ACI Target Check */
+ int pb_aci_target_check; /* this flag prevents duplicate checking of ACI's target existence */
+
} slapi_pblock;
/* index if substrlens */
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 8309012..6cb6d74 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -6989,6 +6989,9 @@ typedef struct slapi_plugindesc {
/* Simple paged results index */
#define SLAPI_PAGED_RESULTS_INDEX 1945
+/* ACI Target Check */
+#define SLAPI_ACI_TARGET_CHECK 1946
+
/* convenience macros for checking modify operation types */
#define SLAPI_IS_MOD_ADD(x) (((x) & ~LDAP_MOD_BVALUES) == LDAP_MOD_ADD)
#define SLAPI_IS_MOD_DELETE(x) (((x) & ~LDAP_MOD_BVALUES) == LDAP_MOD_DELETE)
10 years, 9 months