Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/saslbind.c | 33 ---------------------------------
1 file changed, 33 deletions(-)
New commits:
commit 614d72196e696395d5bc0a6d62f8be9d4ee41c5b
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Mar 10 16:12:08 2014 -0700
Ticket #47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind
Description: SASL_CB_PROXY_POLICY callback is not needed since we
don't support the case authid and authzid do not match. This patch
gets rid of the callback function ids_sasl_proxy_policy.
https://fedorahosted.org/389/ticket/47739
Reviewed by nkinder(a)redhat.com (Thank you, Nathan!!)
(cherry picked from commit 76acff12a86110d4165f94e2cba13ef5c7ebc38a)
(cherry picked from commit 9bc2b46b7c7ee4c975d04b041f73a5992906b07c)
(cherry picked from commit d2063c889feeba122e12f152e2e2c98aed4eb442)
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 2d6ec0a..a5db020 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -219,34 +219,6 @@ static int ids_sasl_log(
return SASL_OK;
}
-static int ids_sasl_proxy_policy(
- sasl_conn_t *conn,
- void *context,
- const char *requested_user, int rlen,
- const char *auth_identity, int alen,
- const char *def_realm, int urlen,
- struct propctx *propctx
-)
-{
- int retVal = SASL_OK;
- /* do not permit sasl proxy authorization */
- /* if the auth_identity is null or empty string, allow the sasl request to go thru */
- if ( (auth_identity != NULL ) && ( strlen(auth_identity) > 0 ) ) {
- Slapi_DN authId , reqUser;
- slapi_sdn_init_dn_byref(&authId,auth_identity);
- slapi_sdn_init_dn_byref(&reqUser,requested_user);
- if (slapi_sdn_compare((const Slapi_DN *)&reqUser,(const Slapi_DN *) &authId) != 0) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "sasl proxy auth not permitted authid=%s user=%s\n",
- auth_identity, requested_user, 0);
- retVal = SASL_NOAUTHZ;
- }
- slapi_sdn_done(&authId);
- slapi_sdn_done(&reqUser);
- }
- return retVal;
-}
-
static void ids_sasl_user_search(
char *basedn,
int scope,
@@ -552,11 +524,6 @@ static sasl_callback_t ids_sasl_callbacks[] =
NULL
},
{
- SASL_CB_PROXY_POLICY,
- (IFP) ids_sasl_proxy_policy,
- NULL
- },
- {
SASL_CB_CANON_USER,
(IFP) ids_sasl_canon_user,
NULL
10 years, 1 month
Branch '389-ds-base-1.3.1' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/saslbind.c | 33 ---------------------------------
1 file changed, 33 deletions(-)
New commits:
commit d2063c889feeba122e12f152e2e2c98aed4eb442
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Mar 10 16:12:08 2014 -0700
Ticket #47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind
Description: SASL_CB_PROXY_POLICY callback is not needed since we
don't support the case authid and authzid do not match. This patch
gets rid of the callback function ids_sasl_proxy_policy.
https://fedorahosted.org/389/ticket/47739
Reviewed by nkinder(a)redhat.com (Thank you, Nathan!!)
(cherry picked from commit 76acff12a86110d4165f94e2cba13ef5c7ebc38a)
(cherry picked from commit 9bc2b46b7c7ee4c975d04b041f73a5992906b07c)
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 96b1f8c..b405c46 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -229,34 +229,6 @@ static int ids_sasl_log(
return SASL_OK;
}
-static int ids_sasl_proxy_policy(
- sasl_conn_t *conn,
- void *context,
- const char *requested_user, int rlen,
- const char *auth_identity, int alen,
- const char *def_realm, int urlen,
- struct propctx *propctx
-)
-{
- int retVal = SASL_OK;
- /* do not permit sasl proxy authorization */
- /* if the auth_identity is null or empty string, allow the sasl request to go thru */
- if ( (auth_identity != NULL ) && ( strlen(auth_identity) > 0 ) ) {
- Slapi_DN authId , reqUser;
- slapi_sdn_init_dn_byref(&authId,auth_identity);
- slapi_sdn_init_dn_byref(&reqUser,requested_user);
- if (slapi_sdn_compare((const Slapi_DN *)&reqUser,(const Slapi_DN *) &authId) != 0) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "sasl proxy auth not permitted authid=%s user=%s\n",
- auth_identity, requested_user, 0);
- retVal = SASL_NOAUTHZ;
- }
- slapi_sdn_done(&authId);
- slapi_sdn_done(&reqUser);
- }
- return retVal;
-}
-
static void ids_sasl_user_search(
char *basedn,
int scope,
@@ -575,11 +547,6 @@ static sasl_callback_t ids_sasl_callbacks[] =
NULL
},
{
- SASL_CB_PROXY_POLICY,
- (IFP) ids_sasl_proxy_policy,
- NULL
- },
- {
SASL_CB_CANON_USER,
(IFP) ids_sasl_canon_user,
NULL
10 years, 1 month
Branch '389-ds-base-1.3.2' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/saslbind.c | 33 ---------------------------------
1 file changed, 33 deletions(-)
New commits:
commit 9bc2b46b7c7ee4c975d04b041f73a5992906b07c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Mar 10 16:12:08 2014 -0700
Ticket #47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind
Description: SASL_CB_PROXY_POLICY callback is not needed since we
don't support the case authid and authzid do not match. This patch
gets rid of the callback function ids_sasl_proxy_policy.
https://fedorahosted.org/389/ticket/47739
Reviewed by nkinder(a)redhat.com (Thank you, Nathan!!)
(cherry picked from commit 76acff12a86110d4165f94e2cba13ef5c7ebc38a)
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 96b1f8c..b405c46 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -229,34 +229,6 @@ static int ids_sasl_log(
return SASL_OK;
}
-static int ids_sasl_proxy_policy(
- sasl_conn_t *conn,
- void *context,
- const char *requested_user, int rlen,
- const char *auth_identity, int alen,
- const char *def_realm, int urlen,
- struct propctx *propctx
-)
-{
- int retVal = SASL_OK;
- /* do not permit sasl proxy authorization */
- /* if the auth_identity is null or empty string, allow the sasl request to go thru */
- if ( (auth_identity != NULL ) && ( strlen(auth_identity) > 0 ) ) {
- Slapi_DN authId , reqUser;
- slapi_sdn_init_dn_byref(&authId,auth_identity);
- slapi_sdn_init_dn_byref(&reqUser,requested_user);
- if (slapi_sdn_compare((const Slapi_DN *)&reqUser,(const Slapi_DN *) &authId) != 0) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "sasl proxy auth not permitted authid=%s user=%s\n",
- auth_identity, requested_user, 0);
- retVal = SASL_NOAUTHZ;
- }
- slapi_sdn_done(&authId);
- slapi_sdn_done(&reqUser);
- }
- return retVal;
-}
-
static void ids_sasl_user_search(
char *basedn,
int scope,
@@ -575,11 +547,6 @@ static sasl_callback_t ids_sasl_callbacks[] =
NULL
},
{
- SASL_CB_PROXY_POLICY,
- (IFP) ids_sasl_proxy_policy,
- NULL
- },
- {
SASL_CB_CANON_USER,
(IFP) ids_sasl_canon_user,
NULL
10 years, 1 month
ldap/servers
by Noriko Hosoi
ldap/servers/slapd/saslbind.c | 33 ---------------------------------
1 file changed, 33 deletions(-)
New commits:
commit 76acff12a86110d4165f94e2cba13ef5c7ebc38a
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Mar 10 16:12:08 2014 -0700
Ticket #47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind
Description: SASL_CB_PROXY_POLICY callback is not needed since we
don't support the case authid and authzid do not match. This patch
gets rid of the callback function ids_sasl_proxy_policy.
https://fedorahosted.org/389/ticket/47739
Reviewed by nkinder(a)redhat.com (Thank you, Nathan!!)
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 22c0588..ba606eb 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -229,34 +229,6 @@ static int ids_sasl_log(
return SASL_OK;
}
-static int ids_sasl_proxy_policy(
- sasl_conn_t *conn,
- void *context,
- const char *requested_user, int rlen,
- const char *auth_identity, int alen,
- const char *def_realm, int urlen,
- struct propctx *propctx
-)
-{
- int retVal = SASL_OK;
- /* do not permit sasl proxy authorization */
- /* if the auth_identity is null or empty string, allow the sasl request to go thru */
- if ( (auth_identity != NULL ) && ( strlen(auth_identity) > 0 ) ) {
- Slapi_DN authId , reqUser;
- slapi_sdn_init_dn_byref(&authId,auth_identity);
- slapi_sdn_init_dn_byref(&reqUser,requested_user);
- if (slapi_sdn_compare((const Slapi_DN *)&reqUser,(const Slapi_DN *) &authId) != 0) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "sasl proxy auth not permitted authid=%s user=%s\n",
- auth_identity, requested_user, 0);
- retVal = SASL_NOAUTHZ;
- }
- slapi_sdn_done(&authId);
- slapi_sdn_done(&reqUser);
- }
- return retVal;
-}
-
static void ids_sasl_user_search(
char *basedn,
int scope,
@@ -569,11 +541,6 @@ static sasl_callback_t ids_sasl_callbacks[] =
NULL
},
{
- SASL_CB_PROXY_POLICY,
- (IFP) ids_sasl_proxy_policy,
- NULL
- },
- {
SASL_CB_CANON_USER,
(IFP) ids_sasl_canon_user,
NULL
10 years, 1 month
Branch '389-ds-base-1.3.1' - lib/base lib/libaccess
by Mark Reynolds
lib/base/pool.cpp | 10 +++++-----
lib/base/system.cpp | 8 ++++----
lib/libaccess/aclcache.cpp | 4 ++--
3 files changed, 11 insertions(+), 11 deletions(-)
New commits:
commit c0c8da7ae44d0fe6d95453efba96a7783910830a
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Mar 7 17:57:40 2014 -0500
Ticket 47700 - Fix compiler warnings
The original fix for ticket 47700 caused new compiler warnings
Addresses these new warnings:
warning: deprecated conversion from string constant to 'char*'
https://fedorahosted.org/389/ticket/47700
Reveiwed by: nhosoi(Thanks!)
(cherry picked from commit 9698a97075e04219e103b2693ac5002d33b19486)
diff --git a/lib/base/pool.cpp b/lib/base/pool.cpp
index 433fc58..f085e4a 100644
--- a/lib/base/pool.cpp
+++ b/lib/base/pool.cpp
@@ -178,7 +178,7 @@ _create_block(int size)
crit_exit(freelist_lock);
if (((newblock = (block_t *)PERM_MALLOC(sizeof(block_t))) == NULL) ||
((newblock->data = (char *)PERM_MALLOC(bytes)) == NULL)) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateBlockOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateBlockOutOfMemory_));
if (newblock)
PERM_FREE(newblock);
return NULL;
@@ -270,7 +270,7 @@ pool_create()
}
if ( (newpool->curr_block =_create_block(BLOCK_SIZE)) == NULL) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateOutOfMemory_));
PERM_FREE(newpool);
return NULL;
}
@@ -291,7 +291,7 @@ pool_create()
crit_exit(known_pools_lock);
}
else
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateOutOfMemory_1));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateOutOfMemory_1));
return (pool_handle_t *)newpool;
}
@@ -388,7 +388,7 @@ pool_malloc(pool_handle_t *pool_handle, size_t size)
*/
blocksize = ( (size + BLOCK_SIZE-1) / BLOCK_SIZE ) * BLOCK_SIZE;
if ( (pool->curr_block = _create_block(blocksize)) == NULL) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolMallocOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolMallocOutOfMemory_));
#ifdef POOL_LOCKING
crit_exit(pool->lock);
#endif
@@ -410,7 +410,7 @@ pool_malloc(pool_handle_t *pool_handle, size_t size)
void _pool_free_error()
{
- ereport(LOG_WARN, "%s", XP_GetAdminStr(DBT_freeUsedWherePermFreeShouldHaveB_));
+ ereport(LOG_WARN, (char *)XP_GetAdminStr(DBT_freeUsedWherePermFreeShouldHaveB_));
return;
}
diff --git a/lib/base/system.cpp b/lib/base/system.cpp
index 287d5a8..b62a814 100644
--- a/lib/base/system.cpp
+++ b/lib/base/system.cpp
@@ -201,7 +201,7 @@ NSAPI_PUBLIC void *system_realloc_perm(void *ptr, int size)
return ptr;
}
} else {
- ereport(LOG_WARN, "realloc: attempt to realloc to smaller size");
+ ereport(LOG_WARN, (char*)"realloc: attempt to realloc to smaller size");
return realloc(ptr, size);
}
@@ -228,20 +228,20 @@ NSAPI_PUBLIC void system_free_perm(void *ptr)
cptr += sizeof(int);
for (index=0; index<DEBUG_MARGIN; index++)
if (cptr[index] != DEBUG_MARGIN_CHAR) {
- ereport(LOG_CATASTROPHE, "free: corrupt memory (prebounds overwrite)");
+ ereport(LOG_CATASTROPHE, (char *)"free: corrupt memory (prebounds overwrite)");
break;
}
cptr += DEBUG_MARGIN + *length;
for (index=0; index<DEBUG_MARGIN; index++)
if (cptr[index] != DEBUG_MARGIN_CHAR) {
- ereport(LOG_CATASTROPHE, "free: corrupt memory (prebounds overwrite)");
+ ereport(LOG_CATASTROPHE, (char *)"free: corrupt memory (prebounds overwrite)");
break;
}
memset(baseptr, DEBUG_FREE_CHAR, *length + 2*DEBUG_MARGIN+sizeof(int));
} else {
- ereport(LOG_CATASTROPHE, "free: freeing unallocated memory");
+ ereport(LOG_CATASTROPHE, (char *)"free: freeing unallocated memory");
}
free(baseptr);
#else
diff --git a/lib/libaccess/aclcache.cpp b/lib/libaccess/aclcache.cpp
index f814df7..8f58344 100644
--- a/lib/libaccess/aclcache.cpp
+++ b/lib/libaccess/aclcache.cpp
@@ -133,8 +133,8 @@ ACL_ListHashInit()
&ACLPermAllocOps,
NULL);
if (ACLListHash == NULL) {
- ereport(LOG_SECURITY, "Unable to allocate ACL List Hash\n");
- return;
+ ereport(LOG_SECURITY, (char *)"Unable to allocate ACL List Hash");
+ return;
}
return;
10 years, 1 month
Branch '389-ds-base-1.3.2' - lib/base lib/libaccess
by Mark Reynolds
lib/base/pool.cpp | 10 +++++-----
lib/base/system.cpp | 8 ++++----
lib/libaccess/aclcache.cpp | 4 ++--
3 files changed, 11 insertions(+), 11 deletions(-)
New commits:
commit ad4f230c5b40ba7462098a922170edc5f33283d1
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Mar 7 17:57:40 2014 -0500
Ticket 47700 - Fix compiler warnings
The original fix for ticket 47700 caused new compiler warnings
Addresses these new warnings:
warning: deprecated conversion from string constant to 'char*'
https://fedorahosted.org/389/ticket/47700
Reveiwed by: nhosoi(Thanks!)
(cherry picked from commit 9698a97075e04219e103b2693ac5002d33b19486)
diff --git a/lib/base/pool.cpp b/lib/base/pool.cpp
index 433fc58..f085e4a 100644
--- a/lib/base/pool.cpp
+++ b/lib/base/pool.cpp
@@ -178,7 +178,7 @@ _create_block(int size)
crit_exit(freelist_lock);
if (((newblock = (block_t *)PERM_MALLOC(sizeof(block_t))) == NULL) ||
((newblock->data = (char *)PERM_MALLOC(bytes)) == NULL)) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateBlockOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateBlockOutOfMemory_));
if (newblock)
PERM_FREE(newblock);
return NULL;
@@ -270,7 +270,7 @@ pool_create()
}
if ( (newpool->curr_block =_create_block(BLOCK_SIZE)) == NULL) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateOutOfMemory_));
PERM_FREE(newpool);
return NULL;
}
@@ -291,7 +291,7 @@ pool_create()
crit_exit(known_pools_lock);
}
else
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateOutOfMemory_1));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateOutOfMemory_1));
return (pool_handle_t *)newpool;
}
@@ -388,7 +388,7 @@ pool_malloc(pool_handle_t *pool_handle, size_t size)
*/
blocksize = ( (size + BLOCK_SIZE-1) / BLOCK_SIZE ) * BLOCK_SIZE;
if ( (pool->curr_block = _create_block(blocksize)) == NULL) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolMallocOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolMallocOutOfMemory_));
#ifdef POOL_LOCKING
crit_exit(pool->lock);
#endif
@@ -410,7 +410,7 @@ pool_malloc(pool_handle_t *pool_handle, size_t size)
void _pool_free_error()
{
- ereport(LOG_WARN, "%s", XP_GetAdminStr(DBT_freeUsedWherePermFreeShouldHaveB_));
+ ereport(LOG_WARN, (char *)XP_GetAdminStr(DBT_freeUsedWherePermFreeShouldHaveB_));
return;
}
diff --git a/lib/base/system.cpp b/lib/base/system.cpp
index 287d5a8..b62a814 100644
--- a/lib/base/system.cpp
+++ b/lib/base/system.cpp
@@ -201,7 +201,7 @@ NSAPI_PUBLIC void *system_realloc_perm(void *ptr, int size)
return ptr;
}
} else {
- ereport(LOG_WARN, "realloc: attempt to realloc to smaller size");
+ ereport(LOG_WARN, (char*)"realloc: attempt to realloc to smaller size");
return realloc(ptr, size);
}
@@ -228,20 +228,20 @@ NSAPI_PUBLIC void system_free_perm(void *ptr)
cptr += sizeof(int);
for (index=0; index<DEBUG_MARGIN; index++)
if (cptr[index] != DEBUG_MARGIN_CHAR) {
- ereport(LOG_CATASTROPHE, "free: corrupt memory (prebounds overwrite)");
+ ereport(LOG_CATASTROPHE, (char *)"free: corrupt memory (prebounds overwrite)");
break;
}
cptr += DEBUG_MARGIN + *length;
for (index=0; index<DEBUG_MARGIN; index++)
if (cptr[index] != DEBUG_MARGIN_CHAR) {
- ereport(LOG_CATASTROPHE, "free: corrupt memory (prebounds overwrite)");
+ ereport(LOG_CATASTROPHE, (char *)"free: corrupt memory (prebounds overwrite)");
break;
}
memset(baseptr, DEBUG_FREE_CHAR, *length + 2*DEBUG_MARGIN+sizeof(int));
} else {
- ereport(LOG_CATASTROPHE, "free: freeing unallocated memory");
+ ereport(LOG_CATASTROPHE, (char *)"free: freeing unallocated memory");
}
free(baseptr);
#else
diff --git a/lib/libaccess/aclcache.cpp b/lib/libaccess/aclcache.cpp
index f814df7..8f58344 100644
--- a/lib/libaccess/aclcache.cpp
+++ b/lib/libaccess/aclcache.cpp
@@ -133,8 +133,8 @@ ACL_ListHashInit()
&ACLPermAllocOps,
NULL);
if (ACLListHash == NULL) {
- ereport(LOG_SECURITY, "Unable to allocate ACL List Hash\n");
- return;
+ ereport(LOG_SECURITY, (char *)"Unable to allocate ACL List Hash");
+ return;
}
return;
10 years, 1 month
lib/base lib/libaccess
by Mark Reynolds
lib/base/pool.cpp | 10 +++++-----
lib/base/system.cpp | 8 ++++----
lib/libaccess/aclcache.cpp | 4 ++--
3 files changed, 11 insertions(+), 11 deletions(-)
New commits:
commit 9698a97075e04219e103b2693ac5002d33b19486
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Mar 7 17:57:40 2014 -0500
Ticket 47700 - Fix compiler warnings
The original fix for ticket 47700 caused new compiler warnings
Addresses these new warnings:
warning: deprecated conversion from string constant to 'char*'
https://fedorahosted.org/389/ticket/47700
Reveiwed by: nhosoi(Thanks!)
diff --git a/lib/base/pool.cpp b/lib/base/pool.cpp
index 9ee1b8c..3398dad 100644
--- a/lib/base/pool.cpp
+++ b/lib/base/pool.cpp
@@ -178,7 +178,7 @@ _create_block(int size)
crit_exit(freelist_lock);
if (((newblock = (block_t *)PERM_MALLOC(sizeof(block_t))) == NULL) ||
((newblock->data = (char *)PERM_MALLOC(bytes)) == NULL)) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateBlockOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateBlockOutOfMemory_));
if (newblock)
PERM_FREE(newblock);
return NULL;
@@ -259,7 +259,7 @@ pool_create()
}
if ( (newpool->curr_block =_create_block(BLOCK_SIZE)) == NULL) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateOutOfMemory_));
PERM_FREE(newpool);
return NULL;
}
@@ -280,7 +280,7 @@ pool_create()
crit_exit(known_pools_lock);
}
else
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolCreateOutOfMemory_1));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolCreateOutOfMemory_1));
return (pool_handle_t *)newpool;
}
@@ -386,7 +386,7 @@ pool_malloc(pool_handle_t *pool_handle, size_t size)
*/
blocksize = ( (size + BLOCK_SIZE-1) / BLOCK_SIZE ) * BLOCK_SIZE;
if ( (pool->curr_block = _create_block(blocksize)) == NULL) {
- ereport(LOG_CATASTROPHE, "%s", XP_GetAdminStr(DBT_poolMallocOutOfMemory_));
+ ereport(LOG_CATASTROPHE, (char *)XP_GetAdminStr(DBT_poolMallocOutOfMemory_));
#ifdef POOL_LOCKING
crit_exit(pool->lock);
#endif
@@ -408,7 +408,7 @@ pool_malloc(pool_handle_t *pool_handle, size_t size)
void _pool_free_error()
{
- ereport(LOG_WARN, "%s", XP_GetAdminStr(DBT_freeUsedWherePermFreeShouldHaveB_));
+ ereport(LOG_WARN, (char *)XP_GetAdminStr(DBT_freeUsedWherePermFreeShouldHaveB_));
return;
}
diff --git a/lib/base/system.cpp b/lib/base/system.cpp
index 287d5a8..b62a814 100644
--- a/lib/base/system.cpp
+++ b/lib/base/system.cpp
@@ -201,7 +201,7 @@ NSAPI_PUBLIC void *system_realloc_perm(void *ptr, int size)
return ptr;
}
} else {
- ereport(LOG_WARN, "realloc: attempt to realloc to smaller size");
+ ereport(LOG_WARN, (char*)"realloc: attempt to realloc to smaller size");
return realloc(ptr, size);
}
@@ -228,20 +228,20 @@ NSAPI_PUBLIC void system_free_perm(void *ptr)
cptr += sizeof(int);
for (index=0; index<DEBUG_MARGIN; index++)
if (cptr[index] != DEBUG_MARGIN_CHAR) {
- ereport(LOG_CATASTROPHE, "free: corrupt memory (prebounds overwrite)");
+ ereport(LOG_CATASTROPHE, (char *)"free: corrupt memory (prebounds overwrite)");
break;
}
cptr += DEBUG_MARGIN + *length;
for (index=0; index<DEBUG_MARGIN; index++)
if (cptr[index] != DEBUG_MARGIN_CHAR) {
- ereport(LOG_CATASTROPHE, "free: corrupt memory (prebounds overwrite)");
+ ereport(LOG_CATASTROPHE, (char *)"free: corrupt memory (prebounds overwrite)");
break;
}
memset(baseptr, DEBUG_FREE_CHAR, *length + 2*DEBUG_MARGIN+sizeof(int));
} else {
- ereport(LOG_CATASTROPHE, "free: freeing unallocated memory");
+ ereport(LOG_CATASTROPHE, (char *)"free: freeing unallocated memory");
}
free(baseptr);
#else
diff --git a/lib/libaccess/aclcache.cpp b/lib/libaccess/aclcache.cpp
index 52e019b..42d08aa 100644
--- a/lib/libaccess/aclcache.cpp
+++ b/lib/libaccess/aclcache.cpp
@@ -133,8 +133,8 @@ ACL_ListHashInit()
&ACLPermAllocOps,
NULL);
if (ACLListHash == NULL) {
- ereport(LOG_SECURITY, "Unable to allocate ACL List Hash\n");
- return;
+ ereport(LOG_SECURITY, (char *)"Unable to allocate ACL List Hash");
+ return;
}
return;
10 years, 1 month
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/acl/acl_ext.c | 6 ++++++
1 file changed, 6 insertions(+)
New commits:
commit e0092e3321975d0388b107986252baecf8b830ec
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Tue Feb 18 11:40:16 2014 +0100
Ticket 47704 - invalid sizelimits in aci group evaluation
Bug Description: aci group evaluation fails because of sizelimit exceeded
but it is exceeded because it is -1476887876 or another
negative integer becasue operation parameter are a union
based on operation types and so for otehr than search
the value is dependent on the operation params
Fix Description: treat any negative integer like -1 (unlimited). A better fix
would be to introduce a specific configuration param or
to abondon the limit in group evaluation at all. But this
could introduce backward compatibility problems and
will be handled in ticket 47703 for newer versions
https://fedorahosted.org/389/ticket/47704
Reviewed by: Rich, thanks
(cherry picked from commit 377266ebb2ff488aa3cc4b96990c002db7e6103e)
diff --git a/ldap/servers/plugins/acl/acl_ext.c b/ldap/servers/plugins/acl/acl_ext.c
index e42a7e2..7c50308 100644
--- a/ldap/servers/plugins/acl/acl_ext.c
+++ b/ldap/servers/plugins/acl/acl_ext.c
@@ -835,6 +835,12 @@ acl_init_aclpb ( Slapi_PBlock *pb , Acl_PBlock *aclpb, const char *ndn, int copy
slapi_pblock_get( pb, SLAPI_SEARCH_SIZELIMIT, &aclpb->aclpb_max_member_sizelimit );
if ( aclpb->aclpb_max_member_sizelimit == 0 ) {
aclpb->aclpb_max_member_sizelimit = SLAPD_DEFAULT_LOOKTHROUGHLIMIT;
+ } else if ( aclpb->aclpb_max_member_sizelimit < -1 ) {
+ /* handle the case of a negtive size limit either set or due
+ * to bug bz1065971. The member size limit should be dropped,
+ * but for backward compatibility to the best we can
+ */
+ aclpb->aclpb_max_member_sizelimit = -1;
}
slapi_pblock_get( pb, SLAPI_OPERATION_TYPE, &aclpb->aclpb_optype );
10 years, 1 month
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/replication/urp_glue.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
New commits:
commit 2786adb5d6c6257762bf28ceb8decd229bec1676
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Mar 7 14:44:40 2014 -0800
Ticket #47737 - Under heavy stress, failure of turning a tombstone into glue makes the server hung
Description: Turning a tombstone entry to a glue entry is done in a
while loop (create_glue_entry:urp_glue.c) Unless the transformation
is successful (or LDAP_NO_SUCH_OBJECT), it cannot exit from the loop.
But under a stress, there could be a tombstone and a conflict entry
coexist, and do_create_glue_entry keeps returning LDAP_ALREADY_EXISTS.
In such a case, we need to give up creating a glue.
https://fedorahosted.org/389/ticket/47737
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!)
(cherry picked from commit a84dab5923de59cfda9bd4e78813d0c22bab35ae)
(cherry picked from commit 97fa6d25159bcdbc6701c4696d675683bed34761)
(cherry picked from commit b92eb1ad96039df4bea35f6e318912adf0d63014)
diff --git a/ldap/servers/plugins/replication/urp_glue.c b/ldap/servers/plugins/replication/urp_glue.c
index 369363d..6eeb826 100644
--- a/ldap/servers/plugins/replication/urp_glue.c
+++ b/ldap/servers/plugins/replication/urp_glue.c
@@ -169,7 +169,6 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
sdn = slapi_sdn_new_dn_byval(slapi_sdn_get_ndn(superiordn));
slapi_sdn_add_rdn(sdn,rdn);
-
/* must take care of multi-valued rdn: split rdn into different lines introducing
* '\n' between each type/value pair.
*/
@@ -187,8 +186,7 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
rdnstr = slapi_ch_realloc(rdnstr, alloc_len);
rdnpair = &rdnstr[rdnstr_len];
}
- slapi_ldif_put_type_and_value_with_options(&rdnpair, rdntype,
- rdnval, rdnval_len, LDIF_OPT_NOWRAP);
+ slapi_ldif_put_type_and_value_with_options(&rdnpair, rdntype, rdnval, rdnval_len, LDIF_OPT_NOWRAP);
*rdnpair = '\0';
}
estr= slapi_ch_smprintf(glue_entry, slapi_sdn_get_ndn(sdn), rdnstr, uniqueid,
@@ -247,6 +245,12 @@ create_glue_entry ( Slapi_PBlock *pb, char *sessionid, Slapi_DN *dn, const char
sessionid, dnstr, uniqueid);
done= 1;
break;
+ case LDAP_ALREADY_EXISTS:
+ slapi_log_error ( SLAPI_LOG_FATAL, repl_plugin_name,
+ "%s: Skipped creating glue entry %s uniqueid=%s reason Entry Already Exists\n",
+ sessionid, dnstr, uniqueid);
+ done= 1;
+ break;
case LDAP_NO_SUCH_OBJECT:
/* The parent is missing */
{
10 years, 1 month
Branch '389-ds-base-1.3.1' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/replication/urp_glue.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
New commits:
commit b92eb1ad96039df4bea35f6e318912adf0d63014
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Mar 7 14:44:40 2014 -0800
Ticket #47737 - Under heavy stress, failure of turning a tombstone into glue makes the server hung
Description: Turning a tombstone entry to a glue entry is done in a
while loop (create_glue_entry:urp_glue.c) Unless the transformation
is successful (or LDAP_NO_SUCH_OBJECT), it cannot exit from the loop.
But under a stress, there could be a tombstone and a conflict entry
coexist, and do_create_glue_entry keeps returning LDAP_ALREADY_EXISTS.
In such a case, we need to give up creating a glue.
https://fedorahosted.org/389/ticket/47737
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!)
(cherry picked from commit a84dab5923de59cfda9bd4e78813d0c22bab35ae)
(cherry picked from commit 97fa6d25159bcdbc6701c4696d675683bed34761)
diff --git a/ldap/servers/plugins/replication/urp_glue.c b/ldap/servers/plugins/replication/urp_glue.c
index 369363d..6eeb826 100644
--- a/ldap/servers/plugins/replication/urp_glue.c
+++ b/ldap/servers/plugins/replication/urp_glue.c
@@ -169,7 +169,6 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
sdn = slapi_sdn_new_dn_byval(slapi_sdn_get_ndn(superiordn));
slapi_sdn_add_rdn(sdn,rdn);
-
/* must take care of multi-valued rdn: split rdn into different lines introducing
* '\n' between each type/value pair.
*/
@@ -187,8 +186,7 @@ do_create_glue_entry(const Slapi_RDN *rdn, const Slapi_DN *superiordn, const cha
rdnstr = slapi_ch_realloc(rdnstr, alloc_len);
rdnpair = &rdnstr[rdnstr_len];
}
- slapi_ldif_put_type_and_value_with_options(&rdnpair, rdntype,
- rdnval, rdnval_len, LDIF_OPT_NOWRAP);
+ slapi_ldif_put_type_and_value_with_options(&rdnpair, rdntype, rdnval, rdnval_len, LDIF_OPT_NOWRAP);
*rdnpair = '\0';
}
estr= slapi_ch_smprintf(glue_entry, slapi_sdn_get_ndn(sdn), rdnstr, uniqueid,
@@ -247,6 +245,12 @@ create_glue_entry ( Slapi_PBlock *pb, char *sessionid, Slapi_DN *dn, const char
sessionid, dnstr, uniqueid);
done= 1;
break;
+ case LDAP_ALREADY_EXISTS:
+ slapi_log_error ( SLAPI_LOG_FATAL, repl_plugin_name,
+ "%s: Skipped creating glue entry %s uniqueid=%s reason Entry Already Exists\n",
+ sessionid, dnstr, uniqueid);
+ done= 1;
+ break;
case LDAP_NO_SUCH_OBJECT:
/* The parent is missing */
{
10 years, 1 month