ldap/servers
by Noriko Hosoi
ldap/servers/slapd/libglobs.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
New commits:
commit 31cd7a838aef30d80be6efe519cc2e821811c645
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 8 10:30:04 2014 -0800
Ticket #447 - Possible to add invalid attribute to nsslapd-allowed-to-delete-attrs
Bug description: If given value of nsslapd-allowed-to-delete-attrs are
all invalid attributes, e.g.,
nsslapd-allowed-to-delete-attrs: invalid0 invalid1
they were logged as invalid, but accidentally set to nsslapd-allowed-
to-delete-attrs.
Fix description: This patch checks the validation result and if there
is no valid attributes given to nsslapd-allowed-to-delete-attrs, it
issues a message in the error log:
nsslapd-allowed-to-delete-attrs: Given attributes are all invalid.
No effects.
and it returns an error. The modify operation fails with "DSA is
unwilling to perform".
https://fedorahosted.org/389/ticket/447
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!)
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index d0bcbb9..603c7ce 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -6815,15 +6815,23 @@ config_set_allowed_to_delete_attrs( const char *attrname, char *value,
/* given value included unknown attribute,
* we need to re-create a value. */
/* reuse the duplicated string for the new attr value. */
- for (s = allowed, d = vcopy; s && *s; s++) {
- size_t slen = strlen(*s);
- memmove(d, *s, slen);
- d += slen;
- memmove(d, " ", 1);
- d++;
+ if (allowed && (NULL == *allowed)) {
+ /* all the values to allow to delete are invalid */
+ slapi_log_error(SLAPI_LOG_FATAL, "config",
+ "%s: Given attributes are all invalid. No effects.\n",
+ CONFIG_ALLOWED_TO_DELETE_ATTRIBUTE);
+ return LDAP_NO_SUCH_ATTRIBUTE;
+ } else {
+ for (s = allowed, d = vcopy; s && *s; s++) {
+ size_t slen = strlen(*s);
+ memmove(d, *s, slen);
+ d += slen;
+ memmove(d, " ", 1);
+ d++;
+ }
+ *(d-1) = '\0';
+ strcpy(value, vcopy); /* original value needs to be refreshed */
}
- *(d-1) = '\0';
- strcpy(value, vcopy); /* original value needs to be refreshed */
} else {
slapi_ch_free_string(&vcopy);
vcopy = slapi_ch_strdup(value);
10 years, 3 months
Branch '389-ds-base-1.3.1' - ldap/servers
by thierry bordaz
ldap/servers/slapd/control.c | 32 +++++++++++++++++++++-----------
1 file changed, 21 insertions(+), 11 deletions(-)
New commits:
commit dea2a254117f1e9f4be1068c6784b2780fec933f
Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com>
Date: Thu May 16 15:28:47 2013 +0200
Ticket 571 (dup 47361) - Empty control list causes LDAP protocol error is thrown
Bug Description:
If a request contains a list of controls containing zero control, it does
not conform RFC http://tools.ietf.org/html/rfc4511#section-4.1.11. Then the
server returns a Protocol Error.
This is too restrictive for some applications.
Note: such application needs to be linked with old version of mozldap or openldap
because recent version skip sending empty list of controls
Fix Description:
The fix is to ignore this error and let the operation complete
Note: ticket 571 (bz 918717) is a duplicate of 47361 (bz 963234). 47361 was used to
backport in 1.2.11. 571 is used to backport in 1.3.1.
This bug is fixed since 1.3.2
https://fedorahosted.org/389/ticket/571
https://fedorahosted.org/389/ticket/47361
Reviewed by: Rich Megginson (thanks Rich !)
Platforms tested: F17 (unit + acceptance vlv/proxy/managed/psearch/tls/bindcontrol)
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/control.c b/ldap/servers/slapd/control.c
index fc3ab9f..e614d50 100644
--- a/ldap/servers/slapd/control.c
+++ b/ldap/servers/slapd/control.c
@@ -354,17 +354,27 @@ get_ldapmessage_controls_ext(
len = -1; /* reset for next loop iter */
}
- if ( (tag != LBER_END_OF_SEQORSET) && (len != -1) ) {
- goto free_and_return;
- }
-
- slapi_pblock_set( pb, SLAPI_REQCONTROLS, ctrls );
- managedsait = slapi_control_present( ctrls,
- LDAP_CONTROL_MANAGEDSAIT, NULL, NULL );
- slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, &managedsait );
- pwpolicy_ctrl = slapi_control_present( ctrls,
- LDAP_X_CONTROL_PWPOLICY_REQUEST, NULL, NULL );
- slapi_pblock_set( pb, SLAPI_PWPOLICY, &pwpolicy_ctrl );
+ if (curcontrols == 0) {
+ int ctrl_not_found = 0; /* means that a given control is not present in the request */
+
+ slapi_pblock_set(pb, SLAPI_REQCONTROLS, NULL);
+ slapi_pblock_set(pb, SLAPI_MANAGEDSAIT, &ctrl_not_found);
+ slapi_pblock_set(pb, SLAPI_PWPOLICY, &ctrl_not_found);
+ slapi_log_error(SLAPI_LOG_CONNS, "connection", "Warning: conn=%d op=%d contains an empty list of controls\n",
+ pb->pb_conn->c_connid, pb->pb_op->o_opid);
+ } else {
+ if ((tag != LBER_END_OF_SEQORSET) && (len != -1)) {
+ goto free_and_return;
+ }
+
+ slapi_pblock_set(pb, SLAPI_REQCONTROLS, ctrls);
+ managedsait = slapi_control_present(ctrls,
+ LDAP_CONTROL_MANAGEDSAIT, NULL, NULL);
+ slapi_pblock_set(pb, SLAPI_MANAGEDSAIT, &managedsait);
+ pwpolicy_ctrl = slapi_control_present(ctrls,
+ LDAP_X_CONTROL_PWPOLICY_REQUEST, NULL, NULL);
+ slapi_pblock_set(pb, SLAPI_PWPOLICY, &pwpolicy_ctrl);
+ }
if ( controlsp != NULL ) {
*controlsp = ctrls;
10 years, 3 months
include/base include/libaccess ldap/servers lib/base lib/libaccess
by Mark Reynolds
include/base/pool.h | 5 +-
include/libaccess/aclproto.h | 4 +
include/libaccess/las.h | 4 +
ldap/servers/plugins/acl/acl.h | 7 +++
ldap/servers/plugins/acl/acl_ext.c | 44 ++++++++++++++++++--
ldap/servers/plugins/acl/aclanom.c | 19 +++++---
ldap/servers/plugins/acl/aclgroup.c | 7 +++
ldap/servers/plugins/acl/aclinit.c | 2
ldap/servers/plugins/acl/acllist.c | 54 +++++++++++++++++++------
ldap/servers/plugins/acl/aclparse.c | 20 ++++-----
ldap/servers/plugins/acl/aclplugin.c | 12 +++++
ldap/servers/plugins/retrocl/retrocl.c | 3 -
ldap/servers/slapd/back-ldbm/dblayer.c | 6 ++
ldap/servers/slapd/back-ldbm/proto-back-ldbm.h | 1
ldap/servers/slapd/back-ldbm/vlv.c | 10 ++++
ldap/servers/slapd/daemon.c | 1
ldap/servers/slapd/schema.c | 9 ++++
ldap/servers/slapd/slapi-private.h | 3 +
lib/base/pool.cpp | 44 +++++++++-----------
lib/libaccess/acl.yy.cpp | 5 ++
lib/libaccess/aclcache.cpp | 24 +++++++++--
lib/libaccess/aclscan.h | 1
lib/libaccess/acltools.cpp | 9 ++++
lib/libaccess/permhash.h | 5 +-
lib/libaccess/register.cpp | 47 +++++++++++++++++++--
25 files changed, 273 insertions(+), 73 deletions(-)
New commits:
commit 1a1b4f86e22e3926786c88995e7c776301c825ce
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Jan 3 17:09:49 2014 -0500
Ticket 47654 - Cleanup old memory leaks reported from valgrind
This patch addresses all the memory leaks reported by valgrind when just
starting and stopping the server. Most of these were around the access control
plugin and libaccess.
https://fedorahosted.org/389/ticket/47654
Jenkins: passed
Coverity: passed
Valgrind: passed
Reviewed by: nhosoi(Thanks!)
diff --git a/include/base/pool.h b/include/base/pool.h
index 30990fc..a33c030 100644
--- a/include/base/pool.h
+++ b/include/base/pool.h
@@ -80,6 +80,7 @@ NSAPI_PUBLIC int INTpool_service_debug(pblock *pb, Session *sn, Request *rq);
#endif
NSAPI_PUBLIC pool_handle_t *INTpool_create(void);
+NSAPI_PUBLIC void INTpool_terminate(void);
NSAPI_PUBLIC void INTpool_destroy(pool_handle_t *pool_handle);
@@ -89,8 +90,7 @@ NSAPI_PUBLIC void *INTpool_malloc(pool_handle_t *pool_handle, size_t size );
NSAPI_PUBLIC void INTpool_free(pool_handle_t *pool_handle, void *ptr );
-NSAPI_PUBLIC
-void *INTpool_calloc(pool_handle_t *pool_handle, size_t nelem, size_t elsize);
+NSAPI_PUBLIC void *INTpool_calloc(pool_handle_t *pool_handle, size_t nelem, size_t elsize);
NSAPI_PUBLIC
void *INTpool_realloc(pool_handle_t *pool_handle, void *ptr, size_t size );
@@ -105,6 +105,7 @@ NSPR_END_EXTERN_C
#endif /* DEBUG_CACHES */
#define pool_create INTpool_create
+#define pool_terminate INTpool_terminate
#define pool_destroy INTpool_destroy
#define pool_enabled INTpool_enabled
#define pool_malloc INTpool_malloc
diff --git a/include/libaccess/aclproto.h b/include/libaccess/aclproto.h
index d30b406..767f711 100644
--- a/include/libaccess/aclproto.h
+++ b/include/libaccess/aclproto.h
@@ -147,6 +147,10 @@ NSAPI_PUBLIC int ACL_DatabaseNamesFree(NSErr_t *errp, char **names, int count);
NSAPI_PUBLIC int ACL_InitAttr2Index(void);
NSAPI_PUBLIC int ACL_Attr2Index(const char *attrname);
+NSAPI_PUBLIC void ACL_Attr2IndexListDestroy();
+NSAPI_PUBLIC void ACL_AttrGetterHashDestroy(void);
+NSAPI_PUBLIC void ACL_Destroy(void);
+NSAPI_PUBLIC void ACL_DestroyPools(void);
/*********************************************************************
* ACL cache and flush utility
diff --git a/include/libaccess/las.h b/include/libaccess/las.h
index f2f4f33..cc547a5 100644
--- a/include/libaccess/las.h
+++ b/include/libaccess/las.h
@@ -86,6 +86,10 @@ extern void
ACL_LasHashInit(void);
extern void
ACL_LasHashDestroy(void);
+extern void
+ ACL_AttrGetterHashDestroy(void);
+extern void
+ ACL_MethodHashDestroy(void);
/*
* Revised, normalized method/dbtype registration routines
diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h
index 9e92252..cc042d6 100644
--- a/ldap/servers/plugins/acl/acl.h
+++ b/ldap/servers/plugins/acl/acl.h
@@ -846,6 +846,7 @@ void acl_destroy_aclpb_pool ();
int acl_skip_access_check ( Slapi_PBlock *pb, Slapi_Entry *e );
int aclext_alloc_lockarray ();
+void aclext_free_lockarray();
int aclutil_str_append(char **str1, const char *str2);
void aclutil_print_err (int rv , const Slapi_DN *sdn,
@@ -867,11 +868,14 @@ void acllist_acicache_WRITE_UNLOCK(void);
void acllist_acicache_WRITE_LOCK(void);
void acllist_aciscan_update_scan ( Acl_PBlock *aclpb, char *edn );
int acllist_remove_aci_needsLock( const Slapi_DN *sdn, const struct berval *attr );
+void free_acl_avl_list();
int acllist_insert_aci_needsLock( const Slapi_DN *e_sdn, const struct berval* aci_attr);
int acllist_init ();
+void acllist_free();
int acllist_moddn_aci_needsLock ( Slapi_DN *oldsdn, char *newdn );
void acllist_print_tree ( Avlnode *root, int *depth, char *start, char *side);
AciContainer *acllist_get_aciContainer_new ( );
+void acllist_free_aciContainer ( AciContainer **container);
void acllist_done_aciContainer ( AciContainer *);
void free_targetattrfilters( Targetattrfilter ***attrFilterArray);
@@ -881,6 +885,7 @@ void aclg_markUgroupForRemoval ( aclUserGroup *u_group );
void aclg_reader_incr_ugroup_refcnt(aclUserGroup* u_group);
int aclg_numof_usergroups(void);
int aclgroup_init ();
+void aclgroup_free();
void aclg_regen_group_signature ();
void aclg_reset_userGroup ( struct acl_pblock *aclpb );
void aclg_init_userGroup ( struct acl_pblock *aclpb, const char *dn , int got_lock);
@@ -894,6 +899,8 @@ int aclanom_match_profile (Slapi_PBlock *pb, struct acl_pblock *aclpb,
Slapi_Entry *e, char *attr, int access);
void aclanom_get_suffix_info(Slapi_Entry *e, struct acl_pblock *aclpb );
void aclanom_invalidateProfile();
+void aclanom__del_profile (int closing);
+
typedef enum{
DONT_TAKE_ACLCACHE_READLOCK,
DO_TAKE_ACLCACHE_READLOCK,
diff --git a/ldap/servers/plugins/acl/acl_ext.c b/ldap/servers/plugins/acl/acl_ext.c
index b4327f6..a011291 100644
--- a/ldap/servers/plugins/acl/acl_ext.c
+++ b/ldap/servers/plugins/acl/acl_ext.c
@@ -160,7 +160,7 @@ aclext_alloc_lockarray ( )
extLockArray.lockArray =
(PRLock **) slapi_ch_calloc ( ACLEXT_MAX_LOCKS, sizeof ( PRLock *) );
- for ( i =0; i < ACLEXT_MAX_LOCKS; i++) {
+ for ( i = 0; i < ACLEXT_MAX_LOCKS; i++) {
if (NULL == (lock = PR_NewLock()) ) {
slapi_log_error( SLAPI_LOG_FATAL, plugin_name,
"Unable to allocate locks used for private extension\n");
@@ -171,7 +171,28 @@ aclext_alloc_lockarray ( )
extLockArray.numlocks = ACLEXT_MAX_LOCKS;
return 0;
}
+
+/*
+ * Not in use! The connection table still has references to these locks.
+ * We need to free these after freeing the connection table in daemon.c
+ */
+void
+aclext_free_lockarray()
+{
+ int i = 0;
+
+ for ( i = 0; i < ACLEXT_MAX_LOCKS; i++) {
+ if(extLockArray.lockArray[i]){
+ PR_DestroyLock(extLockArray.lockArray[i]);
+ extLockArray.lockArray[i] = NULL;
+ }
+ }
+
+ slapi_ch_free((void **)&extLockArray.lockArray);
+}
+
static PRUint32 slot_id =0;
+
static PRLock *
aclext_get_lock ()
{
@@ -188,7 +209,6 @@ void *
acl_conn_ext_constructor ( void *object, void *parent )
{
struct acl_cblock *ext = NULL;
-
ext = (struct acl_cblock * ) slapi_ch_calloc (1, sizeof (struct acl_cblock ) );
if (( ext->aclcb_lock = aclext_get_lock () ) == NULL ) {
slapi_log_error( SLAPI_LOG_FATAL, plugin_name,
@@ -215,14 +235,14 @@ acl_conn_ext_destructor ( void *ext, void *object, void *parent )
PRLock *shared_lock;
if ( NULL == aclcb ) return;
- PR_Lock ( aclcb->aclcb_lock );
+
+ PR_Lock ( aclcb->aclcb_lock );
shared_lock = aclcb->aclcb_lock;
acl_clean_aclEval_context ( &aclcb->aclcb_eval_context, 0 /* clean*/ );
slapi_sdn_free ( &aclcb->aclcb_sdn );
slapi_ch_free ( (void **)&(aclcb->aclcb_eval_context.acle_handles_matched_target));
aclcb->aclcb_lock = NULL;
slapi_ch_free ( (void **) &aclcb );
-
PR_Unlock ( shared_lock );
}
@@ -528,6 +548,7 @@ acl_destroy_aclpb_pool ()
acl__free_aclpb(¤tPbBlock);
currentPbBlock = nextPbBlock;
}
+ PR_DestroyLock(aclQueue->aclq_lock);
slapi_ch_free((void**)&aclQueue);
}
@@ -698,7 +719,7 @@ acl__malloc_aclpb ( )
/* allocate the array for bases */
aclpb->aclpb_grpsearchbase = (char **)
- slapi_ch_malloc (ACLPB_INCR_BASES * sizeof(char *));
+ slapi_ch_calloc (ACLPB_INCR_BASES, sizeof(char *));
aclpb->aclpb_grpsearchbase_size = ACLPB_INCR_BASES;
aclpb->aclpb_numof_bases = 0;
@@ -769,6 +790,19 @@ acl__free_aclpb ( Acl_PBlock **aclpb_ptr)
&(aclpb->aclpb_prev_entryEval_context.acle_handles_matched_target));
slapi_ch_free((void**)
&(aclpb->aclpb_prev_opEval_context.acle_handles_matched_target));
+ slapi_sdn_free(&aclpb->aclpb_authorization_sdn);
+ slapi_sdn_free(&aclpb->aclpb_curr_entry_sdn);
+ if(aclpb->aclpb_macro_ht){
+ acl_ht_free_all_entries_and_values(aclpb->aclpb_macro_ht);
+ PR_HashTableDestroy(aclpb->aclpb_macro_ht);
+ aclpb->aclpb_macro_ht = NULL;
+ }
+ slapi_ch_free((void**)&(aclpb->aclpb_allow_handles));
+ slapi_ch_free((void**)&(aclpb->aclpb_deny_handles));
+ acllist_free_aciContainer(&aclpb->aclpb_aclContainer);
+ slapi_ch_free((void**)&(aclpb->aclpb_aclContainer));
+ slapi_ch_free_string(&aclpb->aclpb_Evalattr);
+ slapi_ch_array_free(aclpb->aclpb_grpsearchbase);
slapi_ch_free((void**)aclpb_ptr);
}
diff --git a/ldap/servers/plugins/acl/aclanom.c b/ldap/servers/plugins/acl/aclanom.c
index fc9ae8c..1e68f22 100644
--- a/ldap/servers/plugins/acl/aclanom.c
+++ b/ldap/servers/plugins/acl/aclanom.c
@@ -69,9 +69,6 @@ static Slapi_RWLock *anom_rwlock = NULL;
#define ANOM_LOCK_WRITE() slapi_rwlock_wrlock (anom_rwlock )
#define ANOM_UNLOCK_WRITE() slapi_rwlock_unlock (anom_rwlock )
-
-static void __aclanom__del_profile ();
-
/*
* aclanom_init ();
* Generate a profile for the anonymous user. We can use this profile
@@ -142,7 +139,7 @@ aclanom_gen_anomProfile (acl_lock_flag_t lock_flag)
}
/* D0 we have one already. If we do, then clean it up */
- __aclanom__del_profile();
+ aclanom__del_profile(0);
/* We have a new signature now */
a_profile->anom_signature = acl_get_aclsignature();
@@ -268,7 +265,7 @@ aclanom_gen_anomProfile (acl_lock_flag_t lock_flag)
/* Do'nt want to support these kind now */
destattrArray[i] = NULL;
/* clean up before leaving */
- __aclanom__del_profile ();
+ aclanom__del_profile (0);
slapi_log_error(SLAPI_LOG_ACL, plugin_name,
"CANCELLING ANOM USER PROFILE 3\n");
goto cleanup;
@@ -297,7 +294,7 @@ aclanom_gen_anomProfile (acl_lock_flag_t lock_flag)
return;
cleanup:
- __aclanom__del_profile ();
+ aclanom__del_profile (0);
ANOM_UNLOCK_WRITE ();
if ( lock_flag == DO_TAKE_ACLCACHE_READLOCK ) {
acllist_acicache_READ_UNLOCK();
@@ -324,8 +321,8 @@ aclanom_invalidateProfile ()
* ASSUMPTION: A WRITE LOCK HAS BEEN OBTAINED
*
*/
-static void
-__aclanom__del_profile (void)
+void
+aclanom__del_profile (int closing)
{
int i;
struct anom_profile *a_profile;
@@ -360,6 +357,12 @@ __aclanom__del_profile (void)
}
a_profile->anom_numacls = 0;
+ if(closing){
+ slapi_destroy_rwlock(anom_rwlock);
+ anom_rwlock = NULL;
+ slapi_ch_free((void **)&acl_anom_profile);
+ }
+
/* Don't clean the signatue */
}
diff --git a/ldap/servers/plugins/acl/aclgroup.c b/ldap/servers/plugins/acl/aclgroup.c
index 2231304..be897cd 100644
--- a/ldap/servers/plugins/acl/aclgroup.c
+++ b/ldap/servers/plugins/acl/aclgroup.c
@@ -76,6 +76,13 @@ aclgroup_init ()
return 0;
}
+void
+aclgroup_free()
+{
+ slapi_destroy_rwlock(aclUserGroups->aclg_rwlock);
+ slapi_ch_free((void **)&aclUserGroups);
+}
+
/*
* aclg_init_userGroup
*
diff --git a/ldap/servers/plugins/acl/aclinit.c b/ldap/servers/plugins/acl/aclinit.c
index 12efa74..0f1a1cd 100644
--- a/ldap/servers/plugins/acl/aclinit.c
+++ b/ldap/servers/plugins/acl/aclinit.c
@@ -324,7 +324,7 @@ aclinit_search_and_update_aci ( int thisbeonly, const Slapi_DN *base,
*
* __aclinit_handler
*
-* For each entry, finds if there is any ACL in thet entry. If there is
+* For each entry, finds if there is any ACL in that entry. If there is
* then the ACL is processed and stored in the ACL LIST.
*
*
diff --git a/ldap/servers/plugins/acl/acllist.c b/ldap/servers/plugins/acl/acllist.c
index cc0219d..88ccb3a 100644
--- a/ldap/servers/plugins/acl/acllist.c
+++ b/ldap/servers/plugins/acl/acllist.c
@@ -93,7 +93,6 @@ static int curAciIndex = 1;
static int __acllist_add_aci ( aci_t *aci );
static int __acllist_aciContainer_node_cmp ( caddr_t d1, caddr_t d2 );
static int __acllist_aciContainer_node_dup ( caddr_t d1, caddr_t d2 );
-static void __acllist_free_aciContainer ( AciContainer **container);
void my_print( Avlnode *root );
@@ -115,6 +114,16 @@ acllist_init ()
return 0;
}
+void
+acllist_free()
+{
+ if(aci_rwlock){
+ slapi_destroy_rwlock(aci_rwlock);
+ aci_rwlock = NULL;
+ }
+ slapi_ch_free((void **)&aciContainerArray);
+}
+
/*
* This is the callback for backend state changes.
* It needs to add/remove acis as backends come up and go down.
@@ -281,7 +290,7 @@ __acllist_add_aci ( aci_t *aci )
/* now free the tmp container */
aciListHead->acic_list = NULL;
- __acllist_free_aciContainer ( &aciListHead );
+ acllist_free_aciContainer ( &aciListHead );
break;
default:
@@ -344,7 +353,6 @@ __acllist_aciContainer_node_dup ( caddr_t d1, caddr_t d2 )
}
-
/*
* Remove the ACL
*
@@ -379,7 +387,7 @@ acllist_remove_aci_needsLock( const Slapi_DN *sdn, const struct berval *attr )
(IFP) __acllist_aciContainer_node_cmp ))) {
/* In that case we don't have any acl for this entry. cool !!! */
- __acllist_free_aciContainer ( &aciListHead );
+ acllist_free_aciContainer ( &aciListHead );
slapi_log_error ( SLAPI_LOG_ACL, plugin_name,
"No acis to remove in this entry\n" );
return 0;
@@ -410,7 +418,7 @@ acllist_remove_aci_needsLock( const Slapi_DN *sdn, const struct berval *attr )
slapi_sdn_get_ndn ( root->acic_sdn) );
dContainer = (AciContainer *) avl_delete ( &acllistRoot, aciListHead,
__acllist_aciContainer_node_cmp );
- __acllist_free_aciContainer ( &dContainer );
+ acllist_free_aciContainer ( &dContainer );
acl_regen_aclsignature ();
if ( removed_anom_acl )
@@ -437,7 +445,7 @@ acllist_remove_aci_needsLock( const Slapi_DN *sdn, const struct berval *attr )
}
/* Now free the tmp container we used */
- __acllist_free_aciContainer ( &aciListHead );
+ acllist_free_aciContainer ( &aciListHead );
/*
* regenerate the anonymous profile if we have deleted
@@ -463,8 +471,9 @@ acllist_get_aciContainer_new ( )
return head;
}
-static void
-__acllist_free_aciContainer ( AciContainer **container)
+
+void
+acllist_free_aciContainer ( AciContainer **container)
{
PR_ASSERT ( container != NULL );
@@ -490,7 +499,30 @@ acllist_done_aciContainer ( AciContainer *head )
head->acic_list = NULL;
}
-
+static void
+free_aci_avl_container(AciContainer *data)
+{
+ aci_t *head, *next = NULL;
+
+ head = data->acic_list;
+ while ( head ) {
+ /* Free the acl */
+ next = head->aci_next;
+ acllist_free_aci ( head );
+ head = next;
+ }
+ data->acic_list = NULL;
+
+ acllist_free_aciContainer(&data);
+}
+
+void
+free_acl_avl_list()
+{
+ avl_free(acllistRoot,free_aci_avl_container);
+ acllistRoot = NULL;
+}
+
aci_t *
acllist_get_aci_new ()
{
@@ -910,7 +942,7 @@ acllist_moddn_aci_needsLock ( Slapi_DN *oldsdn, char *newdn )
"Can't find the acl in the tree for moddn operation:olddn%s\n",
slapi_sdn_get_ndn ( oldsdn ));
aciListHead->acic_sdn = NULL;
- __acllist_free_aciContainer ( &aciListHead );
+ acllist_free_aciContainer ( &aciListHead );
return 1;
}
@@ -937,7 +969,7 @@ acllist_moddn_aci_needsLock ( Slapi_DN *oldsdn, char *newdn )
}
aciListHead->acic_sdn = NULL;
- __acllist_free_aciContainer ( &aciListHead );
+ acllist_free_aciContainer ( &aciListHead );
return 0;
}
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index 5030b30..266538f 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -147,22 +147,22 @@ acl_parse(Slapi_PBlock *pb, char * str, aci_t *aci_item, char **errbuf)
char *avaType;
struct berval *avaValue;
- Slapi_DN *targdn = slapi_sdn_new();
+ Slapi_DN targdn;
slapi_filter_get_ava ( f, &avaType, &avaValue );
- slapi_sdn_init_dn_byref(targdn, avaValue->bv_val);
+ slapi_sdn_init_dn_byref(&targdn, avaValue->bv_val);
- if (!slapi_sdn_get_dn(targdn)) {
+ if (!slapi_sdn_get_dn(&targdn)) {
/* not a valid DN */
- slapi_sdn_free(&targdn);
+ slapi_sdn_done(&targdn);
return ACL_INVALID_TARGET;
}
- if (!slapi_sdn_issuffix(targdn, aci_item->aci_sdn)) {
- slapi_sdn_free(&targdn);
+ if (!slapi_sdn_issuffix(&targdn, aci_item->aci_sdn)) {
+ slapi_sdn_done(&targdn);
return ACL_INVALID_TARGET;
}
- if (slapi_sdn_compare(targdn, aci_item->aci_sdn)) {
+ if (slapi_sdn_compare(&targdn, aci_item->aci_sdn)) {
int target_check = 0;
if (pb) {
slapi_pblock_get(pb, SLAPI_ACI_TARGET_CHECK, &target_check);
@@ -171,14 +171,14 @@ acl_parse(Slapi_PBlock *pb, char * str, aci_t *aci_item, char **errbuf)
/* Make sure that the target exists */
int rc = 0;
Slapi_PBlock *temppb = slapi_pblock_new();
- slapi_search_internal_set_pb_ext(temppb, targdn,
+ slapi_search_internal_set_pb_ext(temppb, &targdn,
LDAP_SCOPE_BASE, "(objectclass=*)", NULL, 1, NULL, NULL,
(void *)plugin_get_default_component_id(), 0);
slapi_search_internal_pb(temppb);
slapi_pblock_get(temppb, SLAPI_PLUGIN_INTOP_RESULT, &rc);
if (rc != LDAP_SUCCESS) {
slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
- "The ACL target %s does not exist\n", slapi_sdn_get_dn(targdn));
+ "The ACL target %s does not exist\n", slapi_sdn_get_dn(&targdn));
}
slapi_free_search_results_internal(temppb);
@@ -189,7 +189,7 @@ acl_parse(Slapi_PBlock *pb, char * str, aci_t *aci_item, char **errbuf)
}
}
}
- slapi_sdn_free(&targdn);
+ slapi_sdn_done(&targdn);
}
}
diff --git a/ldap/servers/plugins/acl/aclplugin.c b/ldap/servers/plugins/acl/aclplugin.c
index 0d35425..0766560 100644
--- a/ldap/servers/plugins/acl/aclplugin.c
+++ b/ldap/servers/plugins/acl/aclplugin.c
@@ -300,7 +300,17 @@ aclplugin_stop ( Slapi_PBlock *pb )
{
int rc = 0; /* OK */
- acl_destroy_aclpb_pool ();
+ ACL_Destroy();
+ acl_destroy_aclpb_pool();
+ ACL_AttrGetterHashDestroy();
+ ACL_MethodHashDestroy();
+ ACL_DestroyPools();
+ free_acl_avl_list();
+ aclanom__del_profile(1);
+ aclgroup_free();
+ //aclext_free_lockarray();
+ acllist_free();
+
return rc;
}
diff --git a/ldap/servers/plugins/retrocl/retrocl.c b/ldap/servers/plugins/retrocl/retrocl.c
index d21b085..7efe6c3 100644
--- a/ldap/servers/plugins/retrocl/retrocl.c
+++ b/ldap/servers/plugins/retrocl/retrocl.c
@@ -241,8 +241,6 @@ static int retrocl_select_backend(void)
err = slapi_mapping_tree_select(pb,&be,&referral,errbuf);
slapi_entry_free(referral);
- operation_free(&op,NULL);
-
if (err != LDAP_SUCCESS || be == NULL || be == defbackend_get_backend()) {
LDAPDebug2Args(LDAP_DEBUG_TRACE,"Mapping tree select failed (%d) %s.\n",
err,errbuf);
@@ -259,6 +257,7 @@ static int retrocl_select_backend(void)
}
retrocl_create_cle();
+ slapi_pblock_destroy(pb);
return retrocl_get_changenumbers();
}
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 62a2bda..2384471 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -2928,6 +2928,10 @@ int dblayer_post_close(struct ldbminfo *li, int dbmode)
charray_free(priv->dblayer_data_directories);
priv->dblayer_data_directories = NULL;
}
+ if(dbmode == DBLAYER_NORMAL_MODE){
+ slapi_ch_free_string(&priv->dblayer_home_directory);
+ }
+
return return_value;
}
@@ -2954,11 +2958,13 @@ int dblayer_close(struct ldbminfo *li, int dbmode)
for (inst_obj = objset_first_obj(li->li_instance_set); inst_obj;
inst_obj = objset_next_obj(li->li_instance_set, inst_obj)) {
inst = (ldbm_instance *)object_get_data(inst_obj);
+ vlv_close(inst);
be = inst->inst_be;
if (NULL != be->be_instance_info) {
return_value |= dblayer_instance_close(be);
}
}
+ LDAPDebug1Arg(LDAP_DEBUG_ANY,"MARK dbmode %d\n",dbmode);
if (return_value != 0) {
/* force recovery next startup if any close failed */
diff --git a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
index 937974e..80fcc21 100644
--- a/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/proto-back-ldbm.h
@@ -544,6 +544,7 @@ struct vlv_response
};
int vlv_init(ldbm_instance *inst);
+void vlv_close(ldbm_instance *inst);
int vlv_remove_callbacks(ldbm_instance *inst);
const Slapi_Entry **vlv_get_search_entries();
struct vlvIndex* vlv_find_searchname(const char * name, backend *be);
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index 5e5d0a5..83b321a 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -337,6 +337,16 @@ void vlv_grok_new_import_entry(const struct backentry *e, backend *be)
slapi_rwlock_unlock(be->vlvSearchList_lock);
}
+void
+vlv_close(ldbm_instance *inst)
+{
+ backend *be = inst->inst_be;
+
+ if(be->vlvSearchList_lock){
+ slapi_destroy_rwlock(be->vlvSearchList_lock);
+ }
+}
+
/*
* Search for the VLV entries which describe the pre-computed indexes we
* support. Register administartion DSE callback functions.
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index e7262dc..772f2a4 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1358,6 +1358,7 @@ void slapd_daemon( daemon_ports_t *ports )
LDAPDebug( LDAP_DEBUG_TRACE, "slapd shutting down - backends closed down\n",
0, 0, 0 );
referrals_free();
+ schema_destroy_dse_lock();
/* tell the time thread to shutdown and then wait for it */
time_shutdown = 1;
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 85063a5..3ec76b4 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -255,6 +255,15 @@ schema_dse_mandatory_init( void )
return PR_SUCCESS;
}
+void
+schema_destroy_dse_lock()
+{
+ if(schema_dse_lock){
+ slapi_destroy_rwlock(schema_dse_lock);
+ schema_dse_lock = NULL;
+ }
+}
+
static void
schema_dse_lock_read( void )
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index e71179a..f315f7e 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -1263,6 +1263,9 @@ int plugin_enabled(const char *plugin_name, void *identity);
*/
int is_slapd_running();
+/* schema.c */
+void schema_destroy_dse_lock();
+
/* attrsyntax.c */
int slapi_add_internal_attr_syntax( const char *name, const char *oid, const char *syntax, const char *mr_equality, unsigned long extraflags );
diff --git a/lib/base/pool.cpp b/lib/base/pool.cpp
index 433fc58..9ee1b8c 100644
--- a/lib/base/pool.cpp
+++ b/lib/base/pool.cpp
@@ -60,13 +60,13 @@
#include "netsite.h"
#include "base/systems.h"
#include "base/systhr.h"
+#include <plhash.h>
#ifdef MALLOC_POOLS
#include "base/pool.h"
#include "base/ereport.h"
#include "base/util.h"
#include "base/crit.h"
-
#include "base/dbtbase.h"
#ifdef DEBUG
@@ -130,7 +130,7 @@ static unsigned long pool_blocks_freed = 0;
static CRITICAL freelist_lock = NULL;
static block_t *freelist = NULL;
static unsigned long freelist_size = 0;
-static unsigned long freelist_max = MAX_FREELIST_SIZE;
+//static unsigned long freelist_max = MAX_FREELIST_SIZE;
static int pool_disable = 0;
int
@@ -195,33 +195,22 @@ _create_block(int size)
static void
_free_block(block_t *block)
{
-
#ifdef POOL_ZERO_DEBUG
memset(block->data, 0xa, block->end-block->data);
#endif /* POOL_ZERO_DEBUG */
- if ((unsigned long)(freelist_size + block->end - block->data) > freelist_max) {
- /* Just have to delete the whole block! */
-
- crit_enter(freelist_lock);
- pool_blocks_freed++;
- crit_exit(freelist_lock);
+ /* Just have to delete the whole block! */
+ crit_enter(freelist_lock);
+ pool_blocks_freed++;
+ crit_exit(freelist_lock);
- PERM_FREE(block->data);
+ PERM_FREE(block->data);
#ifdef POOL_ZERO_DEBUG
- memset(block, 0xa, sizeof(block_t));
+ memset(block, 0xa, sizeof(block_t));
#endif /* POOL_ZERO_DEBUG */
- PERM_FREE(block);
- return;
- }
- crit_enter(freelist_lock);
- freelist_size += (block->end - block->data);
- block->start = block->data;
-
- block->next = freelist;
- freelist = block;
- crit_exit(freelist_lock);
+ PERM_FREE(block);
+ return;
}
/* ptr_in_pool()
@@ -311,8 +300,9 @@ pool_destroy(pool_handle_t *pool_handle)
crit_enter(pool->lock);
#endif
- if (pool->curr_block)
+ if (pool->curr_block){
_free_block(pool->curr_block);
+ }
while(pool->used_blocks) {
tmp_blk = pool->used_blocks;
@@ -332,7 +322,6 @@ pool_destroy(pool_handle_t *pool_handle)
known_pools = search->next;
}
-
#ifdef POOL_LOCKING
crit_exit(pool->lock);
crit_terminate(pool->lock);
@@ -349,6 +338,15 @@ pool_destroy(pool_handle_t *pool_handle)
}
+NSAPI_PUBLIC void
+pool_terminate(void)
+{
+ crit_terminate(known_pools_lock);
+ crit_terminate(freelist_lock);
+ known_pools_lock = NULL;
+ freelist_lock = NULL;
+}
+
NSAPI_PUBLIC void *
pool_malloc(pool_handle_t *pool_handle, size_t size)
{
diff --git a/lib/libaccess/acl.yy.cpp b/lib/libaccess/acl.yy.cpp
index ef88e03..7f81da0 100644
--- a/lib/libaccess/acl.yy.cpp
+++ b/lib/libaccess/acl.yy.cpp
@@ -1571,6 +1571,11 @@ ACL_BUFFER_STATE b;
ACL_FLEX_FREE( (void *) b );
}
+void
+acl_free_buffer(void)
+{
+ acl_delete_buffer(acl_current_buffer);
+}
#ifndef ACL_ALWAYS_INTERACTIVE
#ifndef ACL_NEVER_INTERACTIVE
diff --git a/lib/libaccess/aclcache.cpp b/lib/libaccess/aclcache.cpp
index f814df7..52e019b 100644
--- a/lib/libaccess/aclcache.cpp
+++ b/lib/libaccess/aclcache.cpp
@@ -238,11 +238,11 @@ void
ACL_UriHashDestroy(void)
{
if (acl_uri_hash) {
- PR_HashTableDestroy(acl_uri_hash);
+ PR_HashTableDestroy(acl_uri_hash);
acl_uri_hash = NULL;
}
if (acl_uri_get_hash) {
- PR_HashTableDestroy(acl_uri_get_hash);
+ PR_HashTableDestroy(acl_uri_get_hash);
acl_uri_get_hash = NULL;
}
pool_destroy((void **)acl_uri_hash_pool);
@@ -250,7 +250,7 @@ ACL_UriHashDestroy(void)
}
-void
+NSAPI_PUBLIC void
ACL_Destroy(void)
{
ACL_ListHashDestroy();
@@ -258,6 +258,24 @@ ACL_Destroy(void)
ACL_LasHashDestroy();
}
+NSAPI_PUBLIC void
+ACL_DestroyPools(void)
+{
+ pool_destroy(ACL_DATABASE_POOL);
+ ACLGlobal->databasepool = NULL;
+ pool_destroy(ACL_METHOD_POOL);
+ ACLGlobal->methodpool = NULL;
+ PERM_FREE(ACLGlobal);
+ ACLGlobal = NULL;
+ PERM_FREE(oldACLGlobal);
+ oldACLGlobal = NULL;
+ ACL_Attr2IndexListDestroy();
+ if(acl_hash_crit)
+ crit_terminate(acl_hash_crit);
+ acl_hash_crit = NULL;
+ pool_terminate();
+}
+
/* Only used in ASSERT statements to verify that we have the lock */
int
ACL_CritHeld(void)
diff --git a/lib/libaccess/aclscan.h b/lib/libaccess/aclscan.h
index e2ab719..f1a6a4c 100644
--- a/lib/libaccess/aclscan.h
+++ b/lib/libaccess/aclscan.h
@@ -55,6 +55,7 @@ extern int acl_InitScanner(NSErr_t *errp, char *filename, char *buffer);
extern int acl_EndScanner(void);
extern void aclerror(const char *s);
extern int acllex(void);
+extern void acl_free_buffer(void);
NSPR_END_EXTERN_C
diff --git a/lib/libaccess/acltools.cpp b/lib/libaccess/acltools.cpp
index 0eb7387..3fa8a7d 100644
--- a/lib/libaccess/acltools.cpp
+++ b/lib/libaccess/acltools.cpp
@@ -1767,3 +1767,12 @@ ACL_Attr2Index(const char *attrname)
}
return index;
}
+
+void
+ACL_Attr2IndexListDestroy(void)
+{
+ PListDestroy(ACLAttr2IndexPList);
+ if(acl_parse_crit)
+ crit_terminate(acl_parse_crit);
+ acl_free_buffer();
+}
diff --git a/lib/libaccess/permhash.h b/lib/libaccess/permhash.h
index 9446fb5..e47281c 100644
--- a/lib/libaccess/permhash.h
+++ b/lib/libaccess/permhash.h
@@ -69,8 +69,9 @@ ACL_PermAllocEntry(void *pool, const void *unused)
static void
ACL_PermFreeEntry(void *pool, PLHashEntry *he, PRUintn flag)
{
- if (flag == HT_FREE_ENTRY)
- pool_free((pool_handle_t *)pool, he);
+ if (flag == HT_FREE_ENTRY){
+ pool_free((pool_handle_t *)pool, he);
+ }
}
static PLHashAllocOps ACLPermAllocOps = {
diff --git a/lib/libaccess/register.cpp b/lib/libaccess/register.cpp
index 645b07b..4a1300f 100644
--- a/lib/libaccess/register.cpp
+++ b/lib/libaccess/register.cpp
@@ -117,9 +117,10 @@ ACL_LasHashInit()
ACLAttrGetterHash = PR_NewHashTable(256,
PR_HashCaseString,
PR_CompareCaseStrings,
- PR_CompareValues,
- &ACLPermAllocOps,
+ PL_CompareValues,
+ NULL,
NULL);
+
PR_ASSERT(ACLDbTypeHash);
ACLDbNameHash = PR_NewHashTable(0,
@@ -152,8 +153,47 @@ ACL_LasHashDestroy()
PR_HashTableDestroy(ACLLasFlushHash);
ACLLasFlushHash=NULL;
}
+ if(ACLUserLdbHash){
+ PR_HashTableDestroy(ACLUserLdbHash);
+ ACLUserLdbHash=NULL;
+ }
+ if(ACLDbTypeHash){
+ PR_HashTableDestroy(ACLDbTypeHash);
+ ACLDbTypeHash=NULL;
+ }
+}
+
+static PRIntn
+ACL_GetterHashFree(PLHashEntry *he, PRIntn index, void *arg)
+{
+ ACLAttrGetter_t *getter = (ACLAttrGetter_t *)he->value;
+ if(getter){
+ FREE(getter);
+ getter = NULL;
+ }
+ return HT_ENUMERATE_REMOVE;
}
+void
+ACL_AttrGetterHashDestroy()
+{
+ if (ACLAttrGetterHash) {
+ PL_HashTableEnumerateEntries(ACLAttrGetterHash, ACL_GetterHashFree, NULL);
+ PR_HashTableDestroy(ACLAttrGetterHash);
+ ACLAttrGetterHash=NULL;
+ }
+}
+
+void
+ACL_MethodHashDestroy()
+{
+ if (ACLMethodHash) {
+ PR_HashTableDestroy(ACLMethodHash);
+ ACLMethodHash=NULL;
+ }
+}
+
+
/* ACL_LasRegister
* INPUT
* errp NSError structure
@@ -774,7 +814,6 @@ ACL_AttrGetterRegister(NSErr_t *errp, const char *attr, ACLAttrGetterFn_t fn,
if (position != ACL_AT_FRONT && position != ACL_AT_END) {
return -1;
}
-
ACL_CritEnter();
hep = PR_HashTableRawLookup(ACLAttrGetterHash, PR_HashCaseString(attr), attr);
@@ -799,13 +838,11 @@ ACL_AttrGetterRegister(NSErr_t *errp, const char *attr, ACLAttrGetterFn_t fn,
}
}
else {
-
ACLAttrGetter_t *head = (ACLAttrGetter_t *)((*hep)->value);
PR_INSERT_BEFORE(&getter->list, &head->list);
if (position == ACL_AT_FRONT) {
-
/* Set new head of list */
(*hep)->value = (void *)getter;
}
10 years, 3 months
Branch '389-ds-base-1.3.2' - ldap/ldif ldap/servers
by Mark Reynolds
ldap/ldif/template-dse.ldif.in | 1
ldap/servers/plugins/acl/acllas.c | 11 ++++++----
ldap/servers/slapd/libglobs.c | 39 ++++++++++++++++++++++++++++++++++++++
ldap/servers/slapd/proto-slap.h | 2 +
ldap/servers/slapd/slap.h | 2 +
5 files changed, 51 insertions(+), 4 deletions(-)
New commits:
commit 258bcb5890478c0afe3cf026ff67393cef1c430b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Jan 3 14:25:15 2014 -0500
Ticket 47653 - Need a way to allow users to create entries assigned to themselves
Bug Description: There are cases where users need to be able to create, edit and delete
their own entries. Using an ACI with the "userattr" keyword does not
work with ADD operations(to prevent a security hole). This prevents IPA's
OTP plugin from performing some necessary operations.
Fix Description: Added a new config attribute "nsslapd-access-userattr-strict". The default
is "on" or strict. For the IPA case, it would need to be set to "off" in
order to allow the desired behavior.
https://fedorahosted.org/389/ticket/47653
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit a9cd4e78f1fd1af5de06aca46c8c10ed70bbe4e1)
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index 9a52bc5..729f2e0 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -33,6 +33,7 @@ nsslapd-validate-cert: warn
nsslapd-allow-unauthenticated-binds: off
nsslapd-require-secure-binds: off
nsslapd-allow-anonymous-access: on
+nsslapd-access-userattr-strict: on
nsslapd-localssf: 71
nsslapd-minssf: 0
nsslapd-port: %ds_port%
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 3646fcd..63169f2 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -1170,6 +1170,7 @@ DS_LASUserDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
char *attrs[2] = { LDAP_ALL_USER_ATTRS, NULL };
lasInfo lasinfo;
int got_undefined = 0;
+ int userattr_strict;
if ( 0 != (rc = __acllas_setup (errp, attr_name, comparator, 0, /* Don't allow range comparators */
attr_pattern,cachable,LAS_cookie,
@@ -1265,6 +1266,8 @@ DS_LASUserDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
slapi_log_error( SLAPI_LOG_ACL, plugin_name,"Attr:%s\n" , attrName);
matched = ACL_FALSE;
+ userattr_strict = config_get_access_userattr_strict();
+
for (i=0; i < numOflevels; i++) {
if ( levels[i] == 0 ) {
Slapi_Value *sval=NULL;
@@ -1276,10 +1279,10 @@ DS_LASUserDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
* must never be allowed to grant access--
* This is because access would be granted based on a value
* of an attribute in the new entry--security hole.
- *
- */
-
- if ( lasinfo.aclpb->aclpb_optype == SLAPI_OPERATION_ADD) {
+ *
+ * There are valid cases where we want to allow this, or be less strict.
+ */
+ if ( userattr_strict && lasinfo.aclpb->aclpb_optype == SLAPI_OPERATION_ADD) {
slapi_log_error( SLAPI_LOG_ACL, plugin_name,
"ACL info: userdnAttr does not allow ADD permission at level 0.\n");
got_undefined = 1;
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 283e9a3..955b1d3 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -264,6 +264,7 @@ slapi_onoff_t init_plugin_logging;
slapi_int_t init_connection_buffer;
slapi_int_t init_listen_backlog_size;
slapi_onoff_t init_ignore_time_skew;
+slapi_onoff_t init_access_userattr_strict;
#ifdef MEMPOOL_EXPERIMENTAL
slapi_onoff_t init_mempool_switch;
#endif
@@ -272,6 +273,7 @@ slapi_onoff_t init_mempool_switch;
#define DEFAULT_ALLOW_ANON_ACCESS "on"
#define DEFAULT_VALIDATE_CERT "warn"
#define DEFAULT_UNHASHED_PW_SWITCH "on"
+#define DEFAULT_ACCESS_USERATTR_STRICT "on"
static int
isInt(ConfigVarType type)
@@ -953,6 +955,12 @@ static struct config_get_and_set {
CONFIG_SPECIAL_ANON_ACCESS_SWITCH,
(ConfigGetFunc)config_get_anon_access_switch,
DEFAULT_ALLOW_ANON_ACCESS},
+ {CONFIG_ACCESS_USERATTR_STRICT, config_set_access_userattr_strict,
+ NULL, 0,
+ (void**)&global_slapdFrontendConfig.access_userattr_strict,
+ CONFIG_ON_OFF,
+ (ConfigGetFunc)config_get_access_userattr_strict,
+ &init_access_userattr_strict},
{CONFIG_LOCALSSF_ATTRIBUTE, config_set_localssf,
NULL, 0,
(void**)&global_slapdFrontendConfig.localssf,
@@ -1518,6 +1526,7 @@ FrontendConfig_init () {
init_plugin_logging = cfg->plugin_logging = LDAP_OFF;
init_listen_backlog_size = cfg->listen_backlog_size = DAEMON_LISTEN_SIZE;
init_ignore_time_skew = cfg->ignore_time_skew = LDAP_OFF;
+ init_access_userattr_strict = cfg->access_userattr_strict = LDAP_ON;
#ifdef MEMPOOL_EXPERIMENTAL
init_mempool_switch = cfg->mempool_switch = LDAP_ON;
cfg->mempool_maxfreelist = 1024;
@@ -6672,6 +6681,36 @@ config_set_force_sasl_external( const char *attrname, char *value,
}
int
+config_set_access_userattr_strict( const char *attrname, char *value,
+ char *errorbuf, int apply )
+{
+ int retVal = LDAP_SUCCESS;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+
+ retVal = config_set_onoff(attrname,
+ value,
+ &(slapdFrontendConfig->access_userattr_strict),
+ errorbuf,
+ apply);
+
+ return retVal;
+}
+
+int
+config_get_access_userattr_strict(void)
+{
+ int retVal;
+
+
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ CFG_ONOFF_LOCK_READ(slapdFrontendConfig);
+ retVal = (int)slapdFrontendConfig->access_userattr_strict;
+ CFG_ONOFF_UNLOCK_READ(slapdFrontendConfig);
+
+ return retVal;
+}
+
+int
config_get_entryusn_global(void)
{
int retVal;
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index af7b553..c6b1b8d 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -399,6 +399,7 @@ int config_set_return_orig_type_switch(const char *attrname, char *value, char *
int config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply );
int config_set_listen_backlog_size(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_ignore_time_skew(const char *attrname, char *value, char *errorbuf, int apply);
+int config_set_access_userattr_strict( const char *attrname, char *value, char *errorbuf, int apply );
#if !defined(_WIN32) && !defined(AIX)
int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply );
@@ -575,6 +576,7 @@ int config_get_plugin_logging();
int config_set_connection_nocanon(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_plugin_logging(const char *attrname, char *value, char *errorbuf, int apply);
int config_get_listen_backlog_size(void);
+int config_get_access_userattr_strict(void);
PLHashNumber hashNocaseString(const void *key);
PRIntn hashNocaseCompare(const void *v1, const void *v2);
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 5b23c69..2763408 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -2009,6 +2009,7 @@ typedef struct _slapdEntryPoints {
#define CONFIG_UNAUTH_BINDS_ATTRIBUTE "nsslapd-allow-unauthenticated-binds"
#define CONFIG_REQUIRE_SECURE_BINDS_ATTRIBUTE "nsslapd-require-secure-binds"
#define CONFIG_ANON_ACCESS_ATTRIBUTE "nsslapd-allow-anonymous-access"
+#define CONFIG_ACCESS_USERATTR_STRICT "nsslapd-access-userattr-strict"
#define CONFIG_LOCALSSF_ATTRIBUTE "nsslapd-localssf"
#define CONFIG_MINSSF_ATTRIBUTE "nsslapd-minssf"
#define CONFIG_MINSSF_EXCLUDE_ROOTDSE "nsslapd-minssf-exclude-rootdse"
@@ -2389,6 +2390,7 @@ typedef struct _slapdFrontendConfig {
slapi_onoff_t connection_nocanon; /* if "on" sets LDAP_OPT_X_SASL_NOCANON */
slapi_onoff_t plugin_logging; /* log all internal plugin operations */
slapi_onoff_t ignore_time_skew;
+ slapi_onoff_t access_userattr_strict;
} slapdFrontendConfig_t;
/* possible values for slapdFrontendConfig_t.schemareplace */
10 years, 3 months
ldap/ldif ldap/servers
by Mark Reynolds
ldap/ldif/template-dse.ldif.in | 1
ldap/servers/plugins/acl/acllas.c | 11 ++++++----
ldap/servers/slapd/libglobs.c | 39 ++++++++++++++++++++++++++++++++++++++
ldap/servers/slapd/proto-slap.h | 2 +
ldap/servers/slapd/slap.h | 2 +
5 files changed, 51 insertions(+), 4 deletions(-)
New commits:
commit a9cd4e78f1fd1af5de06aca46c8c10ed70bbe4e1
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Jan 3 14:25:15 2014 -0500
Ticket 47653 - Need a way to allow users to create entries assigned to themselves
Bug Description: There are cases where users need to be able to create, edit and delete
their own entries. Using an ACI with the "userattr" keyword does not
work with ADD operations(to prevent a security hole). This prevents IPA's
OTP plugin from performing some necessary operations.
Fix Description: Added a new config attribute "nsslapd-access-userattr-strict". The default
is "on" or strict. For the IPA case, it would need to be set to "off" in
order to allow the desired behavior.
https://fedorahosted.org/389/ticket/47653
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index af176e9..bca7076 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -33,6 +33,7 @@ nsslapd-validate-cert: warn
nsslapd-allow-unauthenticated-binds: off
nsslapd-require-secure-binds: off
nsslapd-allow-anonymous-access: on
+nsslapd-access-userattr-strict: on
nsslapd-localssf: 71
nsslapd-minssf: 0
nsslapd-port: %ds_port%
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 3646fcd..63169f2 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -1170,6 +1170,7 @@ DS_LASUserDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
char *attrs[2] = { LDAP_ALL_USER_ATTRS, NULL };
lasInfo lasinfo;
int got_undefined = 0;
+ int userattr_strict;
if ( 0 != (rc = __acllas_setup (errp, attr_name, comparator, 0, /* Don't allow range comparators */
attr_pattern,cachable,LAS_cookie,
@@ -1265,6 +1266,8 @@ DS_LASUserDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
slapi_log_error( SLAPI_LOG_ACL, plugin_name,"Attr:%s\n" , attrName);
matched = ACL_FALSE;
+ userattr_strict = config_get_access_userattr_strict();
+
for (i=0; i < numOflevels; i++) {
if ( levels[i] == 0 ) {
Slapi_Value *sval=NULL;
@@ -1276,10 +1279,10 @@ DS_LASUserDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
* must never be allowed to grant access--
* This is because access would be granted based on a value
* of an attribute in the new entry--security hole.
- *
- */
-
- if ( lasinfo.aclpb->aclpb_optype == SLAPI_OPERATION_ADD) {
+ *
+ * There are valid cases where we want to allow this, or be less strict.
+ */
+ if ( userattr_strict && lasinfo.aclpb->aclpb_optype == SLAPI_OPERATION_ADD) {
slapi_log_error( SLAPI_LOG_ACL, plugin_name,
"ACL info: userdnAttr does not allow ADD permission at level 0.\n");
got_undefined = 1;
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 9165e08..d0bcbb9 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -265,6 +265,7 @@ slapi_onoff_t init_plugin_logging;
slapi_int_t init_connection_buffer;
slapi_int_t init_listen_backlog_size;
slapi_onoff_t init_ignore_time_skew;
+slapi_onoff_t init_access_userattr_strict;
#ifdef MEMPOOL_EXPERIMENTAL
slapi_onoff_t init_mempool_switch;
#endif
@@ -273,6 +274,7 @@ slapi_onoff_t init_mempool_switch;
#define DEFAULT_ALLOW_ANON_ACCESS "on"
#define DEFAULT_VALIDATE_CERT "warn"
#define DEFAULT_UNHASHED_PW_SWITCH "on"
+#define DEFAULT_ACCESS_USERATTR_STRICT "on"
static int
isInt(ConfigVarType type)
@@ -954,6 +956,12 @@ static struct config_get_and_set {
CONFIG_SPECIAL_ANON_ACCESS_SWITCH,
(ConfigGetFunc)config_get_anon_access_switch,
DEFAULT_ALLOW_ANON_ACCESS},
+ {CONFIG_ACCESS_USERATTR_STRICT, config_set_access_userattr_strict,
+ NULL, 0,
+ (void**)&global_slapdFrontendConfig.access_userattr_strict,
+ CONFIG_ON_OFF,
+ (ConfigGetFunc)config_get_access_userattr_strict,
+ &init_access_userattr_strict},
{CONFIG_LOCALSSF_ATTRIBUTE, config_set_localssf,
NULL, 0,
(void**)&global_slapdFrontendConfig.localssf,
@@ -1519,6 +1527,7 @@ FrontendConfig_init () {
init_plugin_logging = cfg->plugin_logging = LDAP_OFF;
init_listen_backlog_size = cfg->listen_backlog_size = DAEMON_LISTEN_SIZE;
init_ignore_time_skew = cfg->ignore_time_skew = LDAP_OFF;
+ init_access_userattr_strict = cfg->access_userattr_strict = LDAP_ON;
#ifdef MEMPOOL_EXPERIMENTAL
init_mempool_switch = cfg->mempool_switch = LDAP_ON;
cfg->mempool_maxfreelist = 1024;
@@ -6673,6 +6682,36 @@ config_set_force_sasl_external( const char *attrname, char *value,
}
int
+config_set_access_userattr_strict( const char *attrname, char *value,
+ char *errorbuf, int apply )
+{
+ int retVal = LDAP_SUCCESS;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+
+ retVal = config_set_onoff(attrname,
+ value,
+ &(slapdFrontendConfig->access_userattr_strict),
+ errorbuf,
+ apply);
+
+ return retVal;
+}
+
+int
+config_get_access_userattr_strict(void)
+{
+ int retVal;
+
+
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ CFG_ONOFF_LOCK_READ(slapdFrontendConfig);
+ retVal = (int)slapdFrontendConfig->access_userattr_strict;
+ CFG_ONOFF_UNLOCK_READ(slapdFrontendConfig);
+
+ return retVal;
+}
+
+int
config_get_entryusn_global(void)
{
int retVal;
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 358e103..120f20d 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -401,6 +401,7 @@ int config_set_return_orig_type_switch(const char *attrname, char *value, char *
int config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply );
int config_set_listen_backlog_size(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_ignore_time_skew(const char *attrname, char *value, char *errorbuf, int apply);
+int config_set_access_userattr_strict( const char *attrname, char *value, char *errorbuf, int apply );
#if !defined(_WIN32) && !defined(AIX)
int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply );
@@ -577,6 +578,7 @@ int config_get_plugin_logging();
int config_set_connection_nocanon(const char *attrname, char *value, char *errorbuf, int apply);
int config_set_plugin_logging(const char *attrname, char *value, char *errorbuf, int apply);
int config_get_listen_backlog_size(void);
+int config_get_access_userattr_strict(void);
PLHashNumber hashNocaseString(const void *key);
PRIntn hashNocaseCompare(const void *v1, const void *v2);
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 710da22..c5b5242 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -2012,6 +2012,7 @@ typedef struct _slapdEntryPoints {
#define CONFIG_UNAUTH_BINDS_ATTRIBUTE "nsslapd-allow-unauthenticated-binds"
#define CONFIG_REQUIRE_SECURE_BINDS_ATTRIBUTE "nsslapd-require-secure-binds"
#define CONFIG_ANON_ACCESS_ATTRIBUTE "nsslapd-allow-anonymous-access"
+#define CONFIG_ACCESS_USERATTR_STRICT "nsslapd-access-userattr-strict"
#define CONFIG_LOCALSSF_ATTRIBUTE "nsslapd-localssf"
#define CONFIG_MINSSF_ATTRIBUTE "nsslapd-minssf"
#define CONFIG_MINSSF_EXCLUDE_ROOTDSE "nsslapd-minssf-exclude-rootdse"
@@ -2392,6 +2393,7 @@ typedef struct _slapdFrontendConfig {
slapi_onoff_t connection_nocanon; /* if "on" sets LDAP_OPT_X_SASL_NOCANON */
slapi_onoff_t plugin_logging; /* log all internal plugin operations */
slapi_onoff_t ignore_time_skew;
+ slapi_onoff_t access_userattr_strict;
} slapdFrontendConfig_t;
/* possible values for slapdFrontendConfig_t.schemareplace */
10 years, 3 months