ldap/servers
by Mark Reynolds
ldap/servers/plugins/acl/acllas.c | 34 +++++++++++++++++-----------------
ldap/servers/plugins/acl/aclparse.c | 4 ++--
ldap/servers/plugins/acl/aclutil.c | 6 +++---
3 files changed, 22 insertions(+), 22 deletions(-)
New commits:
commit 67177a2108ebf04094be003662f8091ecde5706b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 21 15:51:30 2015 -0500
Ticket 47738 - use PL_strcasestr instead of strcasestr
Bug Description: The use of strcasestr results in unresolved symbols for
libacl-plugin.so on build on Solaris
Fix Description: Use PR_strcasestr
Original patch submitted by: cgrzemba(Thanks!)
https://fedorahosted.org/389/ticket/47738
Reviewed by: mreynolds
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 4738a40..e3c1778 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -584,9 +584,9 @@ DS_LASUserDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* URL format */
- if ((strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( s_user, &lasinfo,
ACL_EVAL_USER);
@@ -856,9 +856,9 @@ DS_LASGroupDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
"Group not evaluated(%s)\n", groupName);
break;
} else {
- if ((strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( groupName, &lasinfo,
ACL_EVAL_GROUP);
slapi_log_error ( SLAPI_LOG_ACL, plugin_name,
@@ -1075,9 +1075,9 @@ DS_LASRoleDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* Take care of param strings */
- if ((strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( role, &lasinfo,
ACL_EVAL_ROLE);
@@ -2626,9 +2626,9 @@ DS_LASGroupDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
/* In this case "grppupdnattr="ldap:///base??attr" */
- if ((strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( attrName, &lasinfo,
ACL_EVAL_GROUPDNATTR);
@@ -4199,12 +4199,12 @@ acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) {
int has_macro_levels = 0;
/* Determine what the rule's got once */
- if ( strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
+ if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
/* ($dn) exists */
has_macro_dn = 1;
}
- if ( strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
+ if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
/* [$dn] exists */
has_macro_levels = 1;
}
@@ -4308,7 +4308,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
int l;
Slapi_Attr *attr = NULL;
- str = strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
if ( str == NULL ) {
charray_add(&a, slapi_ch_strdup(rule));
@@ -4317,7 +4317,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
} else {
working_rule = slapi_ch_strdup(rule);
- str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
charray_add(&working_list, working_rule );
while( str != NULL) {
@@ -4415,7 +4415,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
slapi_ch_free_string(¯o_str);
slapi_ch_free_string(¯o_attr_name);
- str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
}/* while */
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index fd262e8..24b186e 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -318,8 +318,8 @@ __aclp__parse_aci(char *str, aci_t *aci_item, char **errbuf)
* have a target and it must have a macro.
*/
- if ((strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
+ if ((PL_strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
/* Must have a targetmacro */
if ( !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) {
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index 0720dae..619f857 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -1250,7 +1250,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
char *working_s, *suffix, *prefix, *patched;
int replace_with_len, substr_len, prefix_len, suffix_len;
- if (strcasestr(s, substr) == NULL) {
+ if (PL_strcasestr(s, substr) == NULL) {
return(slapi_ch_strdup(s));
} else {
@@ -1260,7 +1260,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = slapi_ch_strdup(s);
prefix = working_s;
- str = strcasestr(prefix, substr);
+ str = PL_strcasestr(prefix, substr);
while (str != NULL) {
@@ -1287,7 +1287,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = patched;
prefix = working_s;
- str = strcasestr(prefix, substr);
+ str = PL_strcasestr(prefix, substr);
}
9 years, 2 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/entry.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
New commits:
commit 340b9dc5f979d75ab5bb92c7aa61808ff1fddd1f
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Jun 13 18:22:21 2013 -0700
Ticket #569 - examine replication code to reduce amount of stored state information
Description: commit c7f6f161f4967635d6f02b029be571d88ec61961
made this change:
In case the deleted value list in an attribute is empty:
* this means the entry is deleted and has no more attributes,
* when writing the attr to disk we would loose the AD-csn.
* Add an empty value to the set of deleted values. This will
* never be seen by any client. It will never be moved to the
* present values and is only used to preserve the AD-csn.
The AD-csn size was not counted for the buffer size to allocate.
This patch adds the size.
https://fedorahosted.org/389/ticket/569
Reviewed by Nathan (Thanks!!)
(cherry picked from commit ca02529c797903139c56bd9b8b90e8cd5bd0c3f4)
Conflicts:
ldap/servers/slapd/entry.c
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 1341296..340844d 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -1476,7 +1476,17 @@ entry2str_internal_size_attrlist( const Slapi_Attr *attrlist, int entry2str_ctrl
/* ";adcsn-" + a->a_deletioncsn */
if ( a->a_deletioncsn )
{
- elen+= 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ }
+ if ( valueset_isempty(&a->a_deleted_values)) {
+ /* this means the entry is deleted and has no more attributes,
+ * when writing the attr to disk we would loose the AD-csn.
+ * Add an empty value to the set of deleted values. This will
+ * never be seen by any client. It will never be moved to the
+ * present values and is only used to preserve the AD-csn
+ * We need to add the size for that.
+ */
+ elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
}
}
}
9 years, 3 months
Changes to 'refs/tags/389-ds-console-1.2.9'
by Noriko Hosoi
Changes since the dawn of time:
Endi S. Dewata (3):
Bug 496863 - 'Construct' button creates incorrect referral urls
Resolves: bug 574098
Bug 563513 - New replication -> No changelong configured-msg
Mark Reynolds (10):
Ticket 370 - Opening merge qualifier CoS entry using RHDS console changes the entry
Bumped version to 1.2.7
Ticket 96 - Window too large for Manage password policy
Ticket 47883 - DS Console - java exception when refreshing
Ticket 176 - DS Console should timeout when mismatched port
Ticket 47886 - DS Console - mouse wheel speed very slow
Ticket 47485 - DS instance cannot be restored from remote console
Ticket 47887 - DS Console does not correctly disable SSL
Ticket 135 - DS console - right clicking an object does not select that object
Ticket 47994 - DS Console always sets nsSSL3 to "on" when a securty setting is adjusted
Nathan Kinder (28):
171941 - Adjusted the version number and branding. I had to modify the checkVersion method to deal with running in Console 1.0. I also cleaned up references to consolesdk in the Ant build files. They should be console instead since we dropped the consolesdk naming. The external and internal imports files were adjusted to pick up the new 1.0 Console component.
171941 - checkVersion was comparing versions with greater than when it should have been using greater than or equal to
177696 - Changed usage of enum keyword as a variable name for Java 1.5 compatibility
Bug(s) fixed: 181570
Resolves: 246513
Summary: Initial fedora-ds-console specfile.
Resolves: ?
Resolves: 250137
Resolves: 250145
Resolves: 204510
Resolves: 250636
Resolves: 252036
Add default ldapjdk path as well as a settable parameter
Fixed typo from last checkin
Use less restrictive version of Open Publication License for online help docs.
Resolves: 308221
Resolves: 333171
Resolves: 178247
Resolves: 379191
Bug 599732 - Root node in directory browser shows DN syntax error
Bug 229693 - Update naming attribute when objectclass is removed
Bug 474113 - Allow access log level to be configured from Console
Bug 504803 - Allow nsslapd-*-logmaxdiskspace to be set to -1 in UI
Bug 158262 - Windows Sync UI is inconistent
Bug 533505 - Warn about CA cert trust when enabling SSL in Console
Bug 616707 - Add attribute matching rule UI to Console
Bug 705753 - Refresh problem in Console directory browser
Bug 700908 - Validate matching rules when creating a new attribute
Noriko Hosoi (23):
Changed the ldapconsole package name to <brand>-ds-<version>.jar
Modified ant move syntax to support ant 1.6.2
[186105] Admin Server Makefile updates for Internal build
Resolves: #247215
Resolves: #248073
Resolves: #379191
Resolves: #386041
Resolves: #379191
Resolves: #379191
Resolves: #379191
Resolves: #379191
Resolves: #379191
Resolves: 178947
Bug 553066 - Directory Console: do not display "subtree" index type
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
Bug 661116 - 389-console Configuration tab admin permissions
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 450016 - RFE- Console display values in KB/MB/GB
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 757773 - SSL Port issue in Console
Ticket #47380 - RFE: Winsync loses connection with AD objects when they move from the console.
Bumped version to 1.2.8
Bumped version to 1.2.9
Rich Megginson (39):
Bug(s) fixed: 167761
allow the definition of the console location on the command line with different directory layouts than the default
Bug(s) fixed: 178478
The console now builds jar files in the format
bump version to 1.0.3
updated spec for Fedora DS 1.1 release
Resolves: bug 428357
Bump version to 1.1.2
this is for the 1.1.2 release
Resolves: bug 469261
Resolves: bug 469261
Resolves: bug 234948
Resolves: bug 452596
Resolves: bug 178947
Resolves: bug 177334
Resolves: bug 249120
Resolves: bug 238762
Resolves: bug 179193
Resolves: bug 179184
change version to 1.1.3
Resolves: bug 487831
Resolves: bug 481213
Resolves: bug 483660
Resolves: bug 483660
updated for 1.1.3
version must correspond to ds base version - 1.2.0
rename to 389
change mode of spec file to 644
added separate doc subpackage
update to version 1.2.1
Bug 586571 - DS Console shows escaped DNs
bump version to 1.2.2
Bug 586571 - DS Console shows escaped DNs
Bug 591989 - [console] mis-matched trademark and text
bump version to 1.2.4
bump version to 1.2.5
add skin support
move dsbanner.gif to the localized jar for l10n/skinning
dsbannerlite.gif is obsolete
foxworth (2):
Import initial source drop of Fedora DirectoryConsole
Import initial source drop of Fedora DirectoryConsole
9 years, 3 months
build.properties
by Noriko Hosoi
build.properties | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit f9c99a54c56bcedfdb6b3d08c492c4cb43476572
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 15:10:04 2015 -0800
Bumped version to 1.2.9
diff --git a/build.properties b/build.properties
index 1d99d68..49b83dd 100755
--- a/build.properties
+++ b/build.properties
@@ -21,7 +21,7 @@
lang=en
ldapconsole.root=..
-ldapconsole.version=1.2.8
+ldapconsole.version=1.2.9
ldapconsole.gen.version=1.2
brand=389
ldapconsole.name=${brand}-ds-${ldapconsole.version}
9 years, 3 months
Changes to 'refs/tags/389-admin-1.1.37'
by Noriko Hosoi
Changes since 389-admin-1.1.11:
Endi S. Dewata (3):
Bug 573889 - Migration does not remove deprecated schema
Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries
Bug 470576 - Migration could do addition checks before commiting actions
Ludwig (1):
Ticket 47563 - cannot restart directory server from console
Mark Reynolds (15):
Ticket #286 - compilation fixes for 'format-security'
Ticket 401 - Console login fails with anonymous access disabled
Ticket 400 - BIND operation result not checked properly in admin server
Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry
Ticket 47495 - admin express: wrong instance creation time
Ticket 47497 - Admin Express - remove "Security Level"
Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time
Ticket 47300 - Update man page for remove-ds-admin.pl
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain
Ticket 47548 - register-ds-admin does not register into remote config ds
Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot
Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c
Ticket 201 - nCipher HSM cannot be configured via the console
Ticket 47929 - Admin Server - disable SSLv3 by default
Nathan Kinder (49):
Bug 648949 - Merge selinux policy into base OS
Regenerated autoconf files
Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled
Bug 668950 - Add posix group support to Console
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 618897 - Wrong permissions when creating instance from Console
Bug 493424 - remove unneeded modules for admin server apache config
Bug 614690 - Don't use exec to call genrb
Bug 699815 - (cov#10859) Add missing braces in mod_admserv code
Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi
Bug 699815 - (cov#10849,10851) Remove unused variables
Bug 699907 - (cov#10844) Uninitialized time struct
Bug 699907 - (cov#10843) Use of uninitialized variable in logging code
Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi
Bug 699907 - (cov#10836) Use of uninitialized var in http conn code
Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code
Bug 700532 - (cov#10832) Incorrect if condition in dsalib
Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib
Bug 700890 - (cov#10812) Check return value of open() properly in libadmin
Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi
Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication
Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi
Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 702150 - (cov#10823) File descriptors leaked in help cgi
Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi
Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi
Bug 702150 - leak of config array in dsalib
Bug 702150 - (cov#10816) file descriptor leak in dsalib
Bug 702150 - (cov#10817) Leak of string in libdsa
Bug 702150 - Resouce leaks in htmladmin.c
Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin
Bug 702705 - NULL pointer dereferences in viewlog cgi
Bug 702705 - (cov#10803) NULL pointer dereference in security cgi
Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl
Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib
Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy
Bug 724808 - startup CGIs write temp file to /
Bug 730079 - Update SELinux policy during upgrades
Ticket #329 - Port modules to httpd 2.4
Ticket #47333 - Relabel lockfile when starting Admin Server
Ticket #47334 - Avoid quoting all settings in console.conf
Ticket 47468 - Change security password validation error is out of order
Ticket 47466 - Importing CA cert with existing name crashes security CGI
Ticket 362 - Directory Console generates insufficient key strength
Ticket 47467 - Improve CRL import error messages
Noriko Hosoi (26):
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
start-ds-admin.in -- replaced "return 1" with "exit 1"
Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies
Bug 618858 - move start-ds-admin env file into main admin server
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 245278 - Changing to a password with a single quote does not work
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 158926 - Unable to install CA certificate when using
Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user
Bug 476925 - Admin Server: Do not allow 8-bit passwords for
Trac Ticket #307 - htmladmin keeps segfaulting
If htmladmin fails to connect to the server, the cgi could crash.
Ticket #293 - remove-ds-admin.pl does not remove everything
Ticket #476 - 389 ds do not start on F18 due to missing modules
bump version to 1.1.31
Ticket #567 - Restart of Admin server from console fails on segfault
bump version to 1.1.32
bump version to 1.1.33
bump version to 1.1.34
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.36
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket #47995 - Admin Server: source code cleaning
bump version to 1.1.37
Rich Megginson (66):
bump version to 1.1.12.a1
initial support for openldap
add selinux policy for dsgw
skip LD_PRELOAD if using openldap
add more log information if nss init fails
add even more nss debugging
Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized
bump version to 1.1.12.a2
fix building with mozldap
bump version to 1.1.12.a3
fix autotool build issues with properties files
setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error
Bug 656441 - Missing library path entry causes LD_PRELOAD error
bump version to 1.1.13
bump version to 1.1.14.a1
Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required
bump version to 1.1.14
bump version to 1.1.15
bump version to 1.1.16
Bug 703990 - Support upgrade from Red Hat Directory Server
bump version to 1.1.17
add support for different skins
skip rebranding current brand
bump version to 1.1.18
look for separate openldap ldif library
bump version to 1.1.19
Bug 710372 - Not able to open the Manage Certificate from DS-console
better NSS error handling - reduce memory leaks
fix typo in NSS_Shutdown warning message
added tests for the security cgi
Bug 713000 - Migration stops if old admin server cannot be stopped
Bug 718079 - Perl errors when running migrate-ds-admin.pl
Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts
bump version to 1.1.20
bump version to 1.1.21
handle binary upgrade
add man pages for ds_removal and ds_unregister
bump version to 1.1.22
fix binary paths
bump version to 1.1.23
bump version to 1.1.24
Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd
Bug 740959 - 389-console put CA certificates into wrong database
bump version to 1.1.25
Bug 767823 - selinux: need to allow admin server to connect to ldap port
bump version to 1.1.26
Ticket #161 - Review and address latest Coverity issues
Ticket #281 - TLS not working with latest openldap
bump version to 1.1.27
bump version to 1.1.28
bump version to 1.1.29
bump version to 1.1.30
ignore files generated by Eclipse
Ticket #47486 compiler warnings in adminutil, admin, dsgw
Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw
add more debugging for SSL connection problems
Ticket #47413 389-admin fails to build with latest httpd
compiler warning - ldif_read_record lineno type depends on openldap version
add Eclipse and patch files
bump version to 1.1.35
Ticket #47498 Error Message for Failed to create the configuration directory server
Ticket #418 Error with register-ds-admin.pl
Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down.
Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>"
Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour
Ticket #47478 No groups file? error restarting Admin server
Wes Hardin (1):
fix for bug 377 - Unchecked use of SELinux command
noriko (1):
Ticket #47298 - remove-ds-admin.pl does not stop the admin server
---
.gitignore | 4
Makefile.am | 109
Makefile.in | 1767 -
VERSION.sh | 4
aclocal.m4 | 7258 ----
admserv/cfgstuff/console.conf.in | 2
admserv/cfgstuff/httpd-2.2.conf.in | 13
admserv/cfgstuff/httpd-2.4.conf.in | 742
admserv/cfgstuff/httpd.conf.in | 2
admserv/cfgstuff/initconfig.in | 5
admserv/cfgstuff/start-ds-admin.in | 83
admserv/cgi-ds/ds_listdb.c | 26
admserv/cgi-ds/ds_snmpctrl.c | 5
admserv/cgi-src40/ReadLog.c | 18
admserv/cgi-src40/admlib.mk | 119
admserv/cgi-src40/admpw.c | 79
admserv/cgi-src40/cgicommon.h | 1
admserv/cgi-src40/cgicommon.properties | 3
admserv/cgi-src40/config.c | 43
admserv/cgi-src40/dllglue.c | 42
admserv/cgi-src40/ds_create.in | 18
admserv/cgi-src40/dsconfig.c | 10
admserv/cgi-src40/head.html | 1
admserv/cgi-src40/help.c | 15
admserv/cgi-src40/htmladmin.c | 810
admserv/cgi-src40/htmladmin.properties | 42
admserv/cgi-src40/monreplication.c | 7
admserv/cgi-src40/repl-monitor-cgi.pl.in | 37
admserv/cgi-src40/restartsrv.c | 9
admserv/cgi-src40/sec-activate.c | 163
admserv/cgi-src40/security.c | 314
admserv/cgi-src40/security.properties | 6
admserv/cgi-src40/start_config_ds.c | 11
admserv/cgi-src40/statpingserv.c | 82
admserv/cgi-src40/stopsrv.c | 10
admserv/cgi-src40/ugdsconfig.c | 39
admserv/cgi-src40/viewdata.c | 264
admserv/cgi-src40/viewdata.properties | 2
admserv/cgi-src40/viewlog.c | 75
admserv/cgi-src40/viewlog.properties | 6
admserv/genrb_wrapper.sh | 2
admserv/html/admserv.html.in | 11
admserv/html/htmladmin.html.in | 13
admserv/html/monreplication.html | 20
admserv/html/viewdata.html | 6
admserv/html/viewlog.html | 14
admserv/makeUpgradeTar.sh | 30
admserv/newinst/src/25changefedorato389.pl | 250
admserv/newinst/src/25rebrand.pl.in | 413
admserv/newinst/src/30updateglobalpref.pl.in | 9
admserv/newinst/src/AdminMigration.pm.in | 79
admserv/newinst/src/AdminServer.pm.in | 266
admserv/newinst/src/AdminUtil.pm.in | 91
admserv/newinst/src/ConfigDSDialogs.pm | 42
admserv/newinst/src/dirserver.map.in | 1
admserv/newinst/src/register-ds-admin.pl.in | 714
admserv/newinst/src/register-ds-admin.res.in | 36
admserv/newinst/src/register_param.map.in | 4
admserv/newinst/src/register_server.pl.in | 6
admserv/newinst/src/remove-ds-admin.pl.in | 8
admserv/newinst/src/setup-ds-admin.pl.in | 6
admserv/newinst/src/setup-ds-admin.res.in | 20
admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49
admserv/schema/ldif/10dsdata.ldif.tmpl | 39
compile | 240
config.guess | 529
config.h.in | 33
config.sub | 379
configure |38698 +++++++++-------------
configure.ac | 111
depcomp | 343
include/base/file.h | 3
include/base/util.h | 3
include/libadmin/dbtlibadmin.h | 2
include/libadmin/libadmin.h | 92
include/libdsa/dsalib.h | 15
install-sh | 538
lib/base/file.cpp | 30
lib/base/nscputil.cpp | 51
lib/libadmin/dllglue.c | 77
lib/libadmin/httpcon.c | 5
lib/libadmin/referer.c | 4
lib/libadmin/template.c | 29
lib/libadmin/util.c | 973
lib/libdsa/dsalib_conf.c | 37
lib/libdsa/dsalib_confs.c | 93
lib/libdsa/dsalib_location.c | 56
lib/libdsa/dsalib_tailf.c | 1
lib/libdsa/dsalib_updown.c | 118
lib/libdsa/dsalib_util.c | 56
ltmain.sh |14878 +++++---
m4/adminutil.m4 | 4
m4/httpd.m4 | 3
m4/mozldap.m4 | 116
m4/openldap.m4 | 138
m4/selinux.m4 | 3
man/man8/ds_removal.8 | 54
man/man8/ds_unregister.8 | 48
man/man8/register-ds-admin.pl.8 | 139
man/man8/remove-ds-admin.pl.8 | 10
man/man8/restart-ds-admin.8 | 10
man/man8/start-ds-admin.8 | 10
man/man8/stop-ds-admin.8 | 10
missing | 234
mod_admserv/mod_admserv.c | 564
mod_admserv/mod_admserv.h | 15
mod_restartd/mod_restartd-2.2.c | 22
selinux/dirsrv-admin.fc.in | 5
selinux/dirsrv-admin.te | 2
tests/ds_create/testget.1 | 2
tests/htmladmin/testget.2 | 2
tests/htmladmin/testget.3 | 2
tests/htmladmin/testget.4 | 2
tests/htmladmin/testget.5 | 2
tests/htmladmin/testget.6 | 2
tests/htmladmin/testget.7 | 2
tests/htmladmin/testget.8 | 2
tests/security/testpost.1 | 1
tests/security/testpost.10 | 1
tests/security/testpost.11 | 1
tests/security/testpost.12 | 1
tests/security/testpost.13 | 1
tests/security/testpost.14 | 1
tests/security/testpost.15 | 1
tests/security/testpost.16 | 1
tests/security/testpost.17 | 1
tests/security/testpost.18 | 1
tests/security/testpost.19 | 1
tests/security/testpost.2 | 1
tests/security/testpost.20 | 1
tests/security/testpost.21 | 1
tests/security/testpost.3 | 1
tests/security/testpost.4 | 1
tests/security/testpost.5 | 1
tests/security/testpost.6 | 1
tests/security/testpost.7 | 1
tests/security/testpost.8 | 1
tests/security/testpost.9 | 1
tests/setup.sh | 250
tests/ugdsconfig/testget.10 | 2
tests/viewdata/testget.2 | 2
tests/viewdata/testget.3 | 2
tests/viewdata/testget.4 | 2
tests/viewlog/testget.3 | 2
tests/viewlog/testget.4 | 2
wrappers/initscript.in | 3
wrappers/systemd.service.in | 24
147 files changed, 35279 insertions(+), 38203 deletions(-)
---
9 years, 3 months
2 commits - lib/libadmin VERSION.sh
by Noriko Hosoi
VERSION.sh | 2 +-
lib/libadmin/httpcon.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
New commits:
commit 963909573337291e400ce25964bf42fdf9134713
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 13:36:36 2015 -0800
bump version to 1.1.37
diff --git a/VERSION.sh b/VERSION.sh
index 2942ec3..366bcab 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -11,7 +11,7 @@ vendorurl=http://port389.org
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=1
-VERSION_MAINT=36
+VERSION_MAINT=37
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
commit 9ea342d2e63ca060bf6a7f195610815c29b99550
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 13:56:31 2015 -0800
Ticket #47995 - Admin Server: source code cleaning
Description: Removing unnecessary full path. Note: it's in the
DEBUG_TRACE which is not enabled.
https://fedorahosted.org/389/ticket/47995
diff --git a/lib/libadmin/httpcon.c b/lib/libadmin/httpcon.c
index 4bc5abe..24a39e1 100644
--- a/lib/libadmin/httpcon.c
+++ b/lib/libadmin/httpcon.c
@@ -69,7 +69,8 @@ extern void SEC_Init(void);
#ifdef DEBUG_TRACE
FILE *dbf = NULL;
int numconns = 0;
-char *dbd = "/tmp/http_trace.%d";
+/* Replace '/path/to' with a real path when DEBUG_TRACE is enabled. */
+char *dbd = "/path/to/http_trace.%d";
char dbp[256];
#endif
9 years, 3 months
admserv/newinst
by Noriko Hosoi
admserv/newinst/src/AdminServer.pm.in | 44 +++++++++++++++++++++++-------
admserv/newinst/src/setup-ds-admin.res.in | 2 +
2 files changed, 36 insertions(+), 10 deletions(-)
New commits:
commit 894e5b9a64c2edaea6f1a1ef089015a1920169df
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 13:18:59 2015 -0800
Ticket 47891 - Admin Server reconfig breaks SSL config
Description:
1) Use mkdtemp to reduce the risk to disclose the sec file backup
location that is in the same file system as the original files
exist.
2) reconfig_backup_secfiles and reconfig_restore_secfiles expect
the admin config dir, e.g., "/etc/dirsrv/admin-serv" or the dir
specified by the environment variable.
3) Update (--update) did not call reconfig_restore_secfiles in which
restores and delete the backup dir.
4) If creating or accessing the sec backup dir fails, it issues a
fatal error and quits the reconfiguration.
https://fedorahosted.org/389/ticket/47891
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/admserv/newinst/src/AdminServer.pm.in b/admserv/newinst/src/AdminServer.pm.in
index a189c66..0c98a6e 100644
--- a/admserv/newinst/src/AdminServer.pm.in
+++ b/admserv/newinst/src/AdminServer.pm.in
@@ -30,8 +30,11 @@ require Exporter;
use File::Path;
use File::Copy;
+use File::Basename;
+use File::Temp;
-my $secfile_backup_dir = "/tmp/adm-sec-files." . $$;
+my $template_backup_dir = "tmpdirXXXX";
+my $secfile_backup_dir = "";
# tempfiles
use File::Temp qw(tempfile tempdir);
@@ -515,8 +518,12 @@ sub reconfig_backup_secfiles
#
my $configdir = shift;
+ my $dirname = dirname $configdir;
+ my $my_template_backup_dir = $dirname . "/" . $template_backup_dir;
+ $secfile_backup_dir = mkdtemp($my_template_backup_dir);
if ( ! -d $secfile_backup_dir){
- mkdir ($secfile_backup_dir, 0755);
+ $setup->msg($FATAL, 'error_creating_secfile_backup', $secfile_backup_dir, $!);
+ return 0;
}
foreach my $savefile (@reconfigsavefiles) {
if ( -e "$configdir/$savefile"){
@@ -527,6 +534,7 @@ sub reconfig_backup_secfiles
}
}
}
+ return 1;
}
sub reconfig_restore_secfiles
@@ -536,11 +544,16 @@ sub reconfig_restore_secfiles
#
my $configdir = shift;
+ if ( ! -d $secfile_backup_dir){
+ $setup->msg($FATAL, 'error_accessing_secfile_backup', $secfile_backup_dir);
+ return 0;
+ }
foreach my $savefile (@reconfigsavefiles) {
move ("$secfile_backup_dir/$savefile" ,"$configdir/$savefile");
debug(1, "Restoring $configdir/$savefile with $secfile_backup_dir/$savefile\n");
}
rmdir ($secfile_backup_dir);
+ return 1;
}
sub createAdminServer {
@@ -548,13 +561,6 @@ sub createAdminServer {
my $reconfig = shift;
# setup has inf, res, and log
- if ($reconfig) {
- $setup->msg('begin_reconfig_adminserver');
- reconfig_backup_secfiles($setup->{inf}->{admin}->{config_dir});
- } else {
- $setup->msg('begin_create_adminserver');
- }
-
if (!setDefaults($setup)) {
return 0;
}
@@ -578,6 +584,15 @@ sub createAdminServer {
$ENV{ADMSERV_PID_DIR} ||
"@piddir@";
+ if ($reconfig) {
+ $setup->msg('begin_reconfig_adminserver');
+ if (!reconfig_backup_secfiles($configdir)) {
+ return 0;
+ }
+ } else {
+ $setup->msg('begin_create_adminserver');
+ }
+
# if we're just doing the update, just register and return
if ($setup->{update}) {
if (!registerASWithConfigDS($setup, $configdir)) {
@@ -587,6 +602,13 @@ sub createAdminServer {
# Update SELinux policy if needed
updateSelinuxPolicy($setup, $configdir, $securitydir, $logdir, $rundir);
+ # Restore the security files before we start the server
+ if ($reconfig) {
+ if (!reconfig_restore_secfiles($configdir)) {
+ return 0;
+ }
+ }
+
return 1;
}
@@ -619,7 +641,9 @@ sub createAdminServer {
# Restore the security files before we start the server
if ($reconfig) {
- reconfig_restore_secfiles($setup->{inf}->{admin}->{config_dir});
+ if (!reconfig_restore_secfiles($configdir)) {
+ return 0;
+ }
}
if (!startAdminServer($setup, $configdir, $logdir, $rundir)) {
diff --git a/admserv/newinst/src/setup-ds-admin.res.in b/admserv/newinst/src/setup-ds-admin.res.in
index e83d045..b03bc0c 100644
--- a/admserv/newinst/src/setup-ds-admin.res.in
+++ b/admserv/newinst/src/setup-ds-admin.res.in
@@ -161,3 +161,5 @@ error_removing_port_label = Error: could not remove selinux label from port '%s'
error_product_already_exists = Error: the product %s already exists.\
If you want to delete this entry and force the conversion of the older\
product, run this program again with the --force option.\n\n
+error_creating_secfile_backup = Could not create temporary directory %s to backup security files. Error: %s\n
+error_accessing_secfile_backup = Could not access temporary directory %s to restore security files.\n
9 years, 3 months
Branch '389-ds-base-1.3.3' - aclocal.m4 config.guess config.sub dirsrvtests/tickets ldap/admin ldap/ldif ldap/servers Makefile.am Makefile.in
by Mark Reynolds
Makefile.am | 14
Makefile.in | 104 ++--
aclocal.m4 | 15
config.guess | 192 +-------
config.sub | 40 +
dirsrvtests/tickets/ticket47462_test.py | 452 +++++++++++++++++++
ldap/admin/src/scripts/50AES-pbe-plugin.ldif | 16
ldap/admin/src/scripts/52updateAESplugin.pl | 84 +++
ldap/ldif/50replication-plugins.ldif | 2
ldap/ldif/template-dse.ldif.in | 16
ldap/servers/plugins/rever/des.c | 551 -----------------------
ldap/servers/plugins/rever/pbe.c | 621 +++++++++++++++++++++++++++
ldap/servers/plugins/rever/rever.c | 116 +++--
ldap/servers/plugins/rever/rever.h | 11
ldap/servers/slapd/daemon.c | 244 ++++++++++
ldap/servers/slapd/proto-slap.h | 1
ldap/servers/slapd/pw.c | 82 ++-
ldap/servers/slapd/pw.h | 2
ldap/servers/slapd/result.c | 3
ldap/servers/slapd/security_wrappers.c | 6
ldap/servers/slapd/slap.h | 10
ldap/servers/slapd/slapi-plugin.h | 1
ldap/servers/slapd/ssl.c | 4
23 files changed, 1731 insertions(+), 856 deletions(-)
New commits:
commit 603501ec6bbe6ee9b3f033e924a4eef2a4925aa7
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 10:59:05 2015 -0500
Ticket 47462 - Stop using DES in the reversible password
encryption plug-in
Bug Description: DES is not a safe cipher to use for Password Based Encryption(pbe).
AES should be used instead.
Fix Description: Use AES for all new password encodings. AES requires that the
algorithm ID used to encode the password, must also be used to
decode it. So, the algorithm ID is now stored in the cipher prefix:
{AES-<BASE64 encoded alg ID>}<ENCODED PASSWORD>
Since DES is no longer being used, the library has been renamed to a
more apprpriate name:
libdes-plugin -> libpbe-plugin
During upgrades the DES plugin entry has its library path updated
to use libpbe-plugin. The MMR plugin changes its dependency from
DES to AES, and the AES plugin entry is added, and all the password
attributes found in the old DES Plugin are migrated over to the new
AES Plugin entry.
When the server is restarted it checks for any DES passwords in the
database and cn=config. If any are found they are converted to AES,
and the DES plugin is disabled.
Also created a new operation flag: SLAPI_OP_FLAG_IGNORE_UNINDEXED
This flag prevents an internal unnidexed search from being logged
in the "errors" log. When the server starts up it can potentially
do unindexed searches while looking for DES passwords. We don't
want this log "noise" in the errors log everytime the server starts.
https://fedorahosted.org/389/ticket/47462
Design Doc: http://www.port389.org/docs/389ds/design/pbe.html
Valgrind: Passed
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit a57494fcaffccb6fdd060a93ba605d432e38bc09)
diff --git a/Makefile.am b/Makefile.am
index 049ff74..17aadff 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -225,7 +225,7 @@ endif
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -583,7 +583,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -1016,14 +1018,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
diff --git a/Makefile.in b/Makefile.in
index 24a9ddf..dff7462 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -396,15 +396,6 @@ libderef_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libderef_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
-libdes_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
-am_libdes_plugin_la_OBJECTS = \
- ldap/servers/plugins/rever/libdes_plugin_la-des.lo \
- ldap/servers/plugins/rever/libdes_plugin_la-rever.lo
-libdes_plugin_la_OBJECTS = $(am_libdes_plugin_la_OBJECTS)
-libdes_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
- $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libdes_plugin_la_LDFLAGS) $(LDFLAGS) \
- -o $@
libdistrib_plugin_la_DEPENDENCIES = libslapd.la
am_libdistrib_plugin_la_OBJECTS = \
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo
@@ -548,6 +539,15 @@ libpassthru_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libpassthru_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
+libpbe_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
+am_libpbe_plugin_la_OBJECTS = \
+ ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo \
+ ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo
+libpbe_plugin_la_OBJECTS = $(am_libpbe_plugin_la_OBJECTS)
+libpbe_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+ $(AM_CFLAGS) $(CFLAGS) $(libpbe_plugin_la_LDFLAGS) $(LDFLAGS) \
+ -o $@
libposix_winsync_plugin_la_DEPENDENCIES = libslapd.la \
$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1)
am_libposix_winsync_plugin_la_OBJECTS = ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo \
@@ -1154,14 +1154,13 @@ SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1190,14 +1189,13 @@ DIST_SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1637,7 +1635,7 @@ server_LTLIBRARIES = libslapd.la libns-dshttpd.la
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -1991,7 +1989,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -2363,14 +2363,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
@@ -3596,21 +3596,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: \
libderef-plugin.la: $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_DEPENDENCIES) $(EXTRA_libderef_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libderef_plugin_la_LINK) -rpath $(serverplugindir) $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_LIBADD) $(LIBS)
-ldap/servers/plugins/rever/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever
- @: > ldap/servers/plugins/rever/$(am__dirstamp)
-ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
- @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-
-libdes-plugin.la: $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_DEPENDENCIES) $(EXTRA_libdes_plugin_la_DEPENDENCIES)
- $(AM_V_CCLD)$(libdes_plugin_la_LINK) -rpath $(serverplugindir) $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/distrib/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/distrib
@: > ldap/servers/plugins/distrib/$(am__dirstamp)
@@ -3900,6 +3885,21 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: \
libpassthru-plugin.la: $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_DEPENDENCIES) $(EXTRA_libpassthru_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libpassthru_plugin_la_LINK) -rpath $(serverplugindir) $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_LIBADD) $(LIBS)
+ldap/servers/plugins/rever/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever
+ @: > ldap/servers/plugins/rever/$(am__dirstamp)
+ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
+ @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+
+libpbe-plugin.la: $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_DEPENDENCIES) $(EXTRA_libpbe_plugin_la_DEPENDENCIES)
+ $(AM_V_CCLD)$(libpbe_plugin_la_LINK) -rpath $(serverplugindir) $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/posix-winsync/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/posix-winsync
@: > ldap/servers/plugins/posix-winsync/$(am__dirstamp)
@@ -5441,8 +5441,8 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_po.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_rootdse.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_trim.Plo(a)am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo(a)am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo(a)am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo(a)am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_cache.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_plugin.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rootdn_access/$(DEPDIR)/librootdn_access_plugin_la-rootdn_access.Plo(a)am__quote@
@@ -6739,20 +6739,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: ldap/servers/plugins/der
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libderef_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/deref/libderef_plugin_la-deref.lo `test -f 'ldap/servers/plugins/deref/deref.c' || echo '$(srcdir)/'`ldap/servers/plugins/deref/deref.c
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-des.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/des.c' object='ldap/servers/plugins/rever/libdes_plugin_la-des.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libdes_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo: ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdistrib_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo -MD -MP -MF ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo -c -o ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo `test -f 'ldap/servers/plugins/distrib/distrib.c' || echo '$(srcdir)/'`ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Plo
@@ -6991,6 +6977,20 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: ldap/servers/plug
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpassthru_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo `test -f 'ldap/servers/plugins/passthru/ptutil.c' || echo '$(srcdir)/'`ldap/servers/plugins/passthru/ptutil.c
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/pbe.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+
ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo: ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libposix_winsync_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo -MD -MP -MF ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo -c -o ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo `test -f 'ldap/servers/plugins/posix-winsync/posix-winsync.c' || echo '$(srcdir)/'`ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Plo
diff --git a/aclocal.m4 b/aclocal.m4
index 8136dd1..7afd01a 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -220,6 +220,21 @@ m4_popdef([pkg_default])
m4_popdef([pkg_description])
]) dnl PKG_NOARCH_INSTALLDIR
+
+# PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+# -------------------------------------------
+# Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])# PKG_CHECK_VAR
+
# Copyright (C) 2002-2013 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
diff --git a/config.guess b/config.guess
index b79252d..1f5c50c 100755
--- a/config.guess
+++ b/config.guess
@@ -1,8 +1,8 @@
#! /bin/sh
# Attempt to guess a canonical system name.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-06-10'
+timestamp='2014-03-23'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -50,7 +50,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -149,7 +149,7 @@ Linux|GNU|GNU/*)
LIBC=gnu
#endif
EOF
- eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+ eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
;;
esac
@@ -826,7 +826,7 @@ EOF
*:MINGW*:*)
echo ${UNAME_MACHINE}-pc-mingw32
exit ;;
- i*:MSYS*:*)
+ *:MSYS*:*)
echo ${UNAME_MACHINE}-pc-msys
exit ;;
i*:windows32*:*)
@@ -969,10 +969,10 @@ EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
;;
- or1k:Linux:*:*)
- echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+ openrisc*:Linux:*:*)
+ echo or1k-unknown-linux-${LIBC}
exit ;;
- or32:Linux:*:*)
+ or32:Linux:*:* | or1k*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
padre:Linux:*:*)
@@ -1260,16 +1260,26 @@ EOF
if test "$UNAME_PROCESSOR" = unknown ; then
UNAME_PROCESSOR=powerpc
fi
- if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
- if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
- (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
- grep IS_64BIT_ARCH >/dev/null
- then
- case $UNAME_PROCESSOR in
- i386) UNAME_PROCESSOR=x86_64 ;;
- powerpc) UNAME_PROCESSOR=powerpc64 ;;
- esac
+ if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
+ if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+ if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+ grep IS_64BIT_ARCH >/dev/null
+ then
+ case $UNAME_PROCESSOR in
+ i386) UNAME_PROCESSOR=x86_64 ;;
+ powerpc) UNAME_PROCESSOR=powerpc64 ;;
+ esac
+ fi
fi
+ elif test "$UNAME_PROCESSOR" = i386 ; then
+ # Avoid executing cc on OS X 10.9, as it ships with a stub
+ # that puts up a graphical alert prompting to install
+ # developer tools. Any system running Mac OS X 10.7 or
+ # later (Darwin 11 and later) is required to have a 64-bit
+ # processor. This is not true of the ARM version of Darwin
+ # that Apple uses in portable devices.
+ UNAME_PROCESSOR=x86_64
fi
echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
exit ;;
@@ -1361,154 +1371,6 @@ EOF
exit ;;
esac
-eval $set_cc_for_build
-cat >$dummy.c <<EOF
-#ifdef _SEQUENT_
-# include <sys/types.h>
-# include <sys/utsname.h>
-#endif
-main ()
-{
-#if defined (sony)
-#if defined (MIPSEB)
- /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed,
- I don't know.... */
- printf ("mips-sony-bsd\n"); exit (0);
-#else
-#include <sys/param.h>
- printf ("m68k-sony-newsos%s\n",
-#ifdef NEWSOS4
- "4"
-#else
- ""
-#endif
- ); exit (0);
-#endif
-#endif
-
-#if defined (__arm) && defined (__acorn) && defined (__unix)
- printf ("arm-acorn-riscix\n"); exit (0);
-#endif
-
-#if defined (hp300) && !defined (hpux)
- printf ("m68k-hp-bsd\n"); exit (0);
-#endif
-
-#if defined (NeXT)
-#if !defined (__ARCHITECTURE__)
-#define __ARCHITECTURE__ "m68k"
-#endif
- int version;
- version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
- if (version < 4)
- printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
- else
- printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
- exit (0);
-#endif
-
-#if defined (MULTIMAX) || defined (n16)
-#if defined (UMAXV)
- printf ("ns32k-encore-sysv\n"); exit (0);
-#else
-#if defined (CMU)
- printf ("ns32k-encore-mach\n"); exit (0);
-#else
- printf ("ns32k-encore-bsd\n"); exit (0);
-#endif
-#endif
-#endif
-
-#if defined (__386BSD__)
- printf ("i386-pc-bsd\n"); exit (0);
-#endif
-
-#if defined (sequent)
-#if defined (i386)
- printf ("i386-sequent-dynix\n"); exit (0);
-#endif
-#if defined (ns32000)
- printf ("ns32k-sequent-dynix\n"); exit (0);
-#endif
-#endif
-
-#if defined (_SEQUENT_)
- struct utsname un;
-
- uname(&un);
-
- if (strncmp(un.version, "V2", 2) == 0) {
- printf ("i386-sequent-ptx2\n"); exit (0);
- }
- if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
- printf ("i386-sequent-ptx1\n"); exit (0);
- }
- printf ("i386-sequent-ptx\n"); exit (0);
-
-#endif
-
-#if defined (vax)
-# if !defined (ultrix)
-# include <sys/param.h>
-# if defined (BSD)
-# if BSD == 43
- printf ("vax-dec-bsd4.3\n"); exit (0);
-# else
-# if BSD == 199006
- printf ("vax-dec-bsd4.3reno\n"); exit (0);
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# endif
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# else
- printf ("vax-dec-ultrix\n"); exit (0);
-# endif
-#endif
-
-#if defined (alliant) && defined (i860)
- printf ("i860-alliant-bsd\n"); exit (0);
-#endif
-
- exit (1);
-}
-EOF
-
-$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
- { echo "$SYSTEM_NAME"; exit; }
-
-# Apollos put the system type in the environment.
-
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
-
-# Convex versions that predate uname can use getsysinfo(1)
-
-if [ -x /usr/convex/getsysinfo ]
-then
- case `getsysinfo -f cpu_type` in
- c1*)
- echo c1-convex-bsd
- exit ;;
- c2*)
- if getsysinfo -f scalar_acc
- then echo c32-convex-bsd
- else echo c2-convex-bsd
- fi
- exit ;;
- c34*)
- echo c34-convex-bsd
- exit ;;
- c38*)
- echo c38-convex-bsd
- exit ;;
- c4*)
- echo c4-convex-bsd
- exit ;;
- esac
-fi
-
cat >&2 <<EOF
$0: unable to guess system type
diff --git a/config.sub b/config.sub
index c765b34..66c5074 100755
--- a/config.sub
+++ b/config.sub
@@ -1,8 +1,8 @@
#! /bin/sh
# Configuration validation subroutine script.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-04-24'
+timestamp='2014-07-28'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -68,7 +68,7 @@ Report bugs and patches to <config-patches(a)gnu.org>."
version="\
GNU config.sub ($timestamp)
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -257,7 +257,7 @@ case $basic_machine in
| avr | avr32 \
| be32 | be64 \
| bfin \
- | c4x | clipper \
+ | c4x | c8051 | clipper \
| d10v | d30v | dlx | dsp16xx \
| epiphany \
| fido | fr30 | frv \
@@ -265,6 +265,7 @@ case $basic_machine in
| hexagon \
| i370 | i860 | i960 | ia64 \
| ip2k | iq2000 \
+ | k1om \
| le32 | le64 \
| lm32 \
| m32c | m32r | m32rle | m68000 | m68k | m88k \
@@ -282,8 +283,10 @@ case $basic_machine in
| mips64vr5900 | mips64vr5900el \
| mipsisa32 | mipsisa32el \
| mipsisa32r2 | mipsisa32r2el \
+ | mipsisa32r6 | mipsisa32r6el \
| mipsisa64 | mipsisa64el \
| mipsisa64r2 | mipsisa64r2el \
+ | mipsisa64r6 | mipsisa64r6el \
| mipsisa64sb1 | mipsisa64sb1el \
| mipsisa64sr71k | mipsisa64sr71kel \
| mipsr5900 | mipsr5900el \
@@ -295,8 +298,7 @@ case $basic_machine in
| nds32 | nds32le | nds32be \
| nios | nios2 | nios2eb | nios2el \
| ns16k | ns32k \
- | open8 \
- | or1k | or32 \
+ | open8 | or1k | or1knd | or32 \
| pdp10 | pdp11 | pj | pjl \
| powerpc | powerpc64 | powerpc64le | powerpcle \
| pyramid \
@@ -324,7 +326,7 @@ case $basic_machine in
c6x)
basic_machine=tic6x-unknown
;;
- m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip)
+ m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
basic_machine=$basic_machine-unknown
os=-none
;;
@@ -372,7 +374,7 @@ case $basic_machine in
| be32-* | be64-* \
| bfin-* | bs2000-* \
| c[123]* | c30-* | [cjt]90-* | c4x-* \
- | clipper-* | craynv-* | cydra-* \
+ | c8051-* | clipper-* | craynv-* | cydra-* \
| d10v-* | d30v-* | dlx-* \
| elxsi-* \
| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
@@ -381,6 +383,7 @@ case $basic_machine in
| hexagon-* \
| i*86-* | i860-* | i960-* | ia64-* \
| ip2k-* | iq2000-* \
+ | k1om-* \
| le32-* | le64-* \
| lm32-* \
| m32c-* | m32r-* | m32rle-* \
@@ -400,8 +403,10 @@ case $basic_machine in
| mips64vr5900-* | mips64vr5900el-* \
| mipsisa32-* | mipsisa32el-* \
| mipsisa32r2-* | mipsisa32r2el-* \
+ | mipsisa32r6-* | mipsisa32r6el-* \
| mipsisa64-* | mipsisa64el-* \
| mipsisa64r2-* | mipsisa64r2el-* \
+ | mipsisa64r6-* | mipsisa64r6el-* \
| mipsisa64sb1-* | mipsisa64sb1el-* \
| mipsisa64sr71k-* | mipsisa64sr71kel-* \
| mipsr5900-* | mipsr5900el-* \
@@ -413,6 +418,7 @@ case $basic_machine in
| nios-* | nios2-* | nios2eb-* | nios2el-* \
| none-* | np1-* | ns16k-* | ns32k-* \
| open8-* \
+ | or1k*-* \
| orion-* \
| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
@@ -794,7 +800,7 @@ case $basic_machine in
os=-mingw64
;;
mingw32)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-mingw32
;;
mingw32ce)
@@ -822,6 +828,10 @@ case $basic_machine in
basic_machine=powerpc-unknown
os=-morphos
;;
+ moxiebox)
+ basic_machine=moxie-unknown
+ os=-moxiebox
+ ;;
msdos)
basic_machine=i386-pc
os=-msdos
@@ -830,7 +840,7 @@ case $basic_machine in
basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
;;
msys)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-msys
;;
mvs)
@@ -1367,14 +1377,14 @@ case $os in
| -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
| -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
| -linux-newlib* | -linux-musl* | -linux-uclibc* \
- | -uxpv* | -beos* | -mpeix* | -udk* \
+ | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
| -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
| -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
| -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
| -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
| -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
| -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
- | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
+ | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
# Remember, each alternative MUST END IN *, to match a version number.
;;
-qnx*)
@@ -1546,6 +1556,9 @@ case $basic_machine in
c4x-* | tic4x-*)
os=-coff
;;
+ c8051-*)
+ os=-elf
+ ;;
hexagon-*)
os=-elf
;;
@@ -1589,9 +1602,6 @@ case $basic_machine in
mips*-*)
os=-elf
;;
- or1k-*)
- os=-elf
- ;;
or32-*)
os=-coff
;;
diff --git a/dirsrvtests/tickets/ticket47462_test.py b/dirsrvtests/tickets/ticket47462_test.py
new file mode 100644
index 0000000..a909b37
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47462_test.py
@@ -0,0 +1,452 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import time
+import logging
+import pytest
+import re
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+from lib389._constants import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
+installation1_prefix = None
+installation2_prefix = None
+
+DES_PLUGIN = 'cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config'
+AES_PLUGIN = 'cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config'
+MMR_PLUGIN = 'cn=Multimaster Replication Plugin,cn=plugins,cn=config'
+AGMT_DN = ''
+USER_DN = 'cn=test_user,' + DEFAULT_SUFFIX
+USER1_DN = 'cn=test_user1,' + DEFAULT_SUFFIX
+TEST_REPL_DN = 'cn=test repl,' + DEFAULT_SUFFIX
+
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ At the beginning, It may exists a master2 instance and/or a master2 instance.
+ It may also exists a backup for the master1 and/or the master2.
+
+ Principle:
+ If master1 instance exists:
+ restart it
+ If master2 instance exists:
+ restart it
+ If backup of master1 AND backup of master2 exists:
+ create or rebind to master1
+ create or rebind to master2
+
+ restore master1 from backup
+ restore master2 from backup
+ else:
+ Cleanup everything
+ remove instances
+ remove backups
+ Create instances
+ Initialize replication
+ Create backups
+ '''
+ global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+ # Get the status of the backups
+ backup_master1 = master1.checkBackupFS()
+ backup_master2 = master2.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.stop(timeout=10)
+ master1.start(timeout=10)
+
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.stop(timeout=10)
+ master2.start(timeout=10)
+
+ if backup_master1 and backup_master2:
+ # The backups exist, assuming they are correct
+ # we just re-init the instances with them
+ if not instance_master1:
+ master1.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master1.open()
+
+ if not instance_master2:
+ master2.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master2.open()
+
+ # restore master1 from backup
+ master1.stop(timeout=10)
+ master1.restoreFS(backup_master1)
+ master1.start(timeout=10)
+
+ # restore master2 from backup
+ master2.stop(timeout=10)
+ master2.restoreFS(backup_master2)
+ master2.start(timeout=10)
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve master-consumer
+ # so we need to create everything
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove all the backups. So even if we have a specific backup file
+ # (e.g backup_master) we clear all backups that an instance my have created
+ if backup_master1:
+ master1.clearBackupFS()
+ if backup_master2:
+ master2.clearBackupFS()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ AGMT_DN = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ master1.agreement
+ if not AGMT_DN:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % AGMT_DN)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=DEFAULT_SUFFIX, host=master1.host, port=master1.port, properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(AGMT_DN)
+
+ # Check replication is working fine
+ master1.add_s(Entry((TEST_REPL_DN, {'objectclass': "top person".split(),
+ 'sn': 'test_repl',
+ 'cn': 'test_repl'})))
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication is not working!')
+ assert False
+
+ # Time to create the backups
+ master1.stop(timeout=10)
+ master1.backupfile = master1.backupFS()
+ master1.start(timeout=10)
+
+ master2.stop(timeout=10)
+ master2.backupfile = master2.backupFS()
+ master2.start(timeout=10)
+
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
+
+ #
+ # Here we have two instances master and consumer
+ # with replication working. Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyMaster1Master2(master1, master2)
+
+
+def test_ticket47462(topology):
+ """
+ Test that AES properly replaces DES during an update/restart, and that
+ replication also works correctly.
+ """
+
+ #
+ # First set config as if it's an older version. Set DES to use libdes-plugin,
+ # MMR to depend on DES, delete the existing AES plugin, and set a DES password
+ # for the replication agreement.
+ #
+
+ #
+ # Add an extra attribute to the DES plugin args
+ #
+ try:
+ topology.master1.modify_s(DES_PLUGIN,
+ [(ldap.MOD_REPLACE, 'nsslapd-pluginPath', 'libdes-plugin'),
+ (ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')])
+
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.master1.modify_s(MMR_PLUGIN,
+ [(ldap.MOD_DELETE, 'nsslapd-plugin-depends-on-named', 'AES')])
+
+ except ldap.NO_SUCH_ATTRIBUTE:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ #
+ # Delete the AES plugin
+ #
+ try:
+ topology.master1.delete_s(AES_PLUGIN)
+ except ldap.NO_SUCH_OBJECT:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to delete AES plugin, error: ' + e.message['desc'])
+ assert False
+
+ # restart the server so we must use DES plugin
+ topology.master1.restart(timeout=10)
+
+ #
+ # Get the agmt dn, and set the password
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'objectclass=nsDS5ReplicationAgreement')
+ if entry:
+ agmt_dn = entry[0].dn
+ log.info('Found agmt dn (%s)' % agmt_dn)
+ else:
+ log.fatal('No replication agreements!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ try:
+ properties = {RA_BINDPW: "password"}
+ topology.master1.agreement.setProperties(None, agmt_dn, None, properties)
+ log.info('Successfully modified replication agreement')
+ except ValueError:
+ log.error('Failed to update replica agreement: ' + AGMT_DN)
+ assert False
+
+ #
+ # Check replication works with the new DES password
+ #
+ try:
+ topology.master1.add_s(Entry((USER1_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER1_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed fo user1!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # Run the upgrade...
+ #
+ topology.master1.upgrade('online')
+ topology.master1.restart(timeout=10)
+ topology.master2.restart(timeout=10)
+
+ #
+ # Check that the restart converted existing DES credentials
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'nsDS5ReplicaCredentials=*')
+ if entry:
+ val = entry[0].getValue('nsDS5ReplicaCredentials')
+ if val.startswith('{AES-'):
+ log.info('The DES credentials have been converted to AES')
+ else:
+ log.fatal('Failed to convert credentials from DES to AES!')
+ assert False
+ else:
+ log.fatal('Failed to find any entries with nsDS5ReplicaCredentials ')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the AES plugin exists, and has all the attributes listed in DES plugin.
+ # The attributes might not be in the expected order so check all the attributes.
+ #
+ try:
+ entry = topology.master1.search_s(AES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginarg0', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg1', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg2', 'description'):
+ log.fatal('The AES plugin did not have the DES attribute copied over correctly')
+ assert False
+ else:
+ log.info('The AES plugin was correctly setup')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the MMR plugin was updated
+ #
+ try:
+ entry = topology.master1.search_s(MMR_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-plugin-depends-on-named', 'AES'):
+ log.fatal('The MMR Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The MMR plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the DES plugin was correctly updated
+ #
+ try:
+ entry = topology.master1.search_s(DES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginPath', 'libpbe-plugin'):
+ log.fatal('The DES Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The DES plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check replication one last time
+ #
+ try:
+ topology.master1.add_s(Entry((USER_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # If we got here the test passed
+ #
+ log.info('Test PASSED')
+
+
+def test_ticket47462_final(topology):
+ topology.master1.stop(timeout=10)
+ topology.master2.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation1_prefix
+ global installation2_prefix
+ installation1_prefix = None
+ installation2_prefix = None
+
+ topo = topology(True)
+ test_ticket47462(topo)
+
+if __name__ == '__main__':
+ run_isolated()
diff --git a/ldap/admin/src/scripts/50AES-pbe-plugin.ldif b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
new file mode 100644
index 0000000..564ceae
--- /dev/null
+++ b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
@@ -0,0 +1,16 @@
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginprecedence: 1
+nsslapd-pluginid: ID
+nsslapd-pluginDescription: DESC
+nsslapd-pluginVersion: PACKAGE_VERSION
+nsslapd-pluginVendor: VENDOR
diff --git a/ldap/admin/src/scripts/52updateAESplugin.pl b/ldap/admin/src/scripts/52updateAESplugin.pl
new file mode 100644
index 0000000..6a8a885
--- /dev/null
+++ b/ldap/admin/src/scripts/52updateAESplugin.pl
@@ -0,0 +1,84 @@
+use Mozilla::LDAP::Conn;
+use Mozilla::LDAP::Entry;
+use Mozilla::LDAP::Utils qw(normalizeDN);
+use Mozilla::LDAP::API qw(:constant ldap_url_parse ldap_explode_dn);
+use File::Basename;
+use File::Copy;
+use DSUtil qw(debug serverIsRunning);
+
+#
+# Check if there is a DES plugin and make sure the AES plugin contains the same attributes
+#
+sub runinst {
+ my ($inf, $inst, $dseldif, $conn) = @_;
+ my @attrs;
+ my @attrs_to_add;
+ my $aes_count = 0;
+ my $des_count = 0;
+ my $i = 0;
+
+ my $aes_dn = "cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $aes_entry = $conn->search($aes_dn, "base", "(cn=*)");
+ if (!$aes_entry) {
+ # No AES plugin - nothing to do
+ return ();
+ }
+
+ # We need to grab the AES plugin args...
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $aes_entry->getValues($argattr);
+ if($val ne ""){
+ $attrs[$aes_count] = $val;
+ $aes_count++;
+ } else {
+ last;
+ }
+ $i++;
+ }
+
+ # Grab the DES plugin
+ my $des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $des_entry = $conn->search($des_dn, "base", "(cn=*)");
+ if (!$des_entry) {
+ # No DES plugin - nothing to do
+ return ();
+ }
+
+ # We need to check the DES plugin args against the AES args.
+ $i = 0;
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $des_entry->getValues($argattr);
+ if($val eq ""){
+ last;
+ }
+ if(!($val ~~ @attrs) ){
+ $attrs_to_add[$des_count] = $val;
+ $des_count++;
+ }
+ $i++;
+ }
+
+ # Add the missing attributes to the AES plugin
+ if($#attrs_to_add >= 0){
+ foreach $val (@attrs_to_add){
+ $aes_entry->addValue("nsslapd-pluginarg" . $aes_count, $val);
+ $aes_count++;
+ }
+ $conn->update($aes_entry);
+ }
+
+ # Change replication plugin dependency from DES to AES
+ my $mmr_entry = $conn->search("cn=Multimaster Replication Plugin,cn=plugins,cn=config", "base", "(cn=*)");
+ $mmr_entry->removeValue("nsslapd-plugin-depends-on-named", "DES");
+ $mmr_entry->addValue("nsslapd-plugin-depends-on-named", "AES");
+ $conn->update($mmr_entry);
+
+ # Change the des plugin to use the new libpbe-plugin library
+ $des_entry->{"nsslapd-pluginPath"} = [ "libpbe-plugin" ];
+ $conn->update($des_entry);
+
+ return ();
+}
+
diff --git a/ldap/ldif/50replication-plugins.ldif b/ldap/ldif/50replication-plugins.ldif
index 0b4924c..71afbea 100644
--- a/ldap/ldif/50replication-plugins.ldif
+++ b/ldap/ldif/50replication-plugins.ldif
@@ -22,6 +22,6 @@ nsslapd-plugintype: object
nsslapd-pluginbetxn: on
nsslapd-pluginenabled: on
nsslapd-plugin-depends-on-named: ldbm database
-nsslapd-plugin-depends-on-named: DES
+nsslapd-plugin-depends-on-named: AES
nsslapd-plugin-depends-on-named: Class of Service
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index 720ebad..6acbfae 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -207,12 +207,26 @@ nsslapd-plugininitfunc: ns_mta_md5_pwd_storage_scheme_init
nsslapd-plugintype: pwdstoragescheme
nsslapd-pluginenabled: on
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginid: aes-storage-scheme
+nsslapd-pluginprecedence: 1
+
dn: cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config
objectclass: top
objectclass: nsSlapdPlugin
objectclass: extensibleObject
cn: DES
-nsslapd-pluginpath: libdes-plugin
+nsslapd-pluginpath: libpbe-plugin
nsslapd-plugininitfunc: des_init
nsslapd-plugintype: reverpwdstoragescheme
nsslapd-pluginenabled: on
diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c
deleted file mode 100644
index 73830f0..0000000
--- a/ldap/servers/plugins/rever/des.c
+++ /dev/null
@@ -1,551 +0,0 @@
-/** BEGIN COPYRIGHT BLOCK
- * This Program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; version 2 of the License.
- *
- * This Program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place, Suite 330, Boston, MA 02111-1307 USA.
- *
- * In addition, as a special exception, Red Hat, Inc. gives You the additional
- * right to link the code of this Program with code not covered under the GNU
- * General Public License ("Non-GPL Code") and to distribute linked combinations
- * including the two, subject to the limitations in this paragraph. Non-GPL Code
- * permitted under this exception must only link to the code of this Program
- * through those well defined interfaces identified in the file named EXCEPTION
- * found in the source code files (the "Approved Interfaces"). The files of
- * Non-GPL Code may instantiate templates or use macros or inline functions from
- * the Approved Interfaces without causing the resulting work to be covered by
- * the GNU General Public License. Only Red Hat, Inc. may make changes or
- * additions to the list of Approved Interfaces. You must obey the GNU General
- * Public License in all respects for all of the Program code and other code used
- * in conjunction with the Program except the Non-GPL Code covered by this
- * exception. If you modify this file, you may extend this exception to your
- * version of the file, but you are not obligated to do so. If you do not wish to
- * provide this exception without modification, you must delete this exception
- * statement from your version and license this file solely under the GPL without
- * exception.
- *
- *
- * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
- * Copyright (C) 2005 Red Hat, Inc.
- * All rights reserved.
- * END COPYRIGHT BLOCK **/
-
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-#endif
-
-/* from /usr/project/iplanet/ws/ds5.ke/ns/svrcore/pkcs7/tstarchive.c */
-
-#include <string.h>
-#include <stdio.h>
-
-#include <ldap.h>
-#include <nspr.h>
-#include <nss.h>
-#include <secmod.h>
-/*
-#include <secasn1.h>
-#include <secpkcs7.h>
-*/
-#include <key.h>
-#include <certdb.h>
-#include <cert.h>
-#include <svrcore.h>
-#include <secmodt.h>
-#include <prtypes.h>
-#include <seccomon.h>
-#include <pk11func.h>
-
-#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */
-#include "rever.h"
-#include <slap.h>
-#include "slapi-plugin.h"
-#include <uuid.h>
-
-
-struct pk11MechItem
-{
- CK_MECHANISM_TYPE type;
- const char *mechName;
-};
-static const struct pk11MechItem mymech = { CKM_DES_CBC, "DES CBC encryption" };
-
-
-static Slapi_Mutex *mylock = NULL;
-
-struct pk11ContextStore
-{
- PK11SlotInfo *slot;
- const struct pk11MechItem *mech;
-
- PK11SymKey *key;
- SECItem *params;
-
- int length;
- unsigned char *crypt;
-};
-
-static int encode_path(char *inPlain, char **outCipher, char *path);
-static int decode_path(char *inCipher, char **outPlain, char *path);
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path);
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
-static void freeDes(struct pk11ContextStore *out);
-
-void
-init_des_plugin()
-{
- mylock = slapi_new_mutex();
-}
-
-int
-encode(char *inPlain, char **outCipher)
-{
- return encode_path(inPlain, outCipher, NULL);
-}
-
-static int
-encode_path(char *inPlain, char **outCipher, char *path)
-{
- struct pk11ContextStore *context = NULL;
- int err;
-
- unsigned char *cipher = NULL;
- char *tmp = NULL;
- char *base = NULL;
-
-
- *outCipher = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* Try an encryption */
- if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success )
- {
- base = BTOA_DataToAscii(cipher, context->length);
- if ( base != NULL )
- {
- tmp = slapi_ch_malloc( 3 + strlen(REVER_SCHEME_NAME) + strlen(base));
- if ( tmp != NULL )
- {
- sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, REVER_SCHEME_NAME, PWD_HASH_PREFIX_END, base);
- *outCipher = tmp;
- tmp = NULL;
- err = 0;
- }
- PORT_Free(base);
- }
- }
- }
-
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-int
-decode(char *inCipher, char **outPlain)
-{
- return decode_path(inCipher, outPlain, NULL);
-}
-
-
-static int
-decode_path(char *inCipher, char **outPlain, char *path)
-{
- struct pk11ContextStore *context = NULL;
- char *plain= NULL;
- int err;
-
- unsigned char *base = NULL;
- int len = 0;
-
-
- *outPlain = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* it seems that there is memory leak in that function: bug 400170 */
-
- base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
- if ( base != NULL )
- {
- if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success )
- {
- *outPlain = plain;
- err = 0;
- }
- }
- }
-
- PORT_Free(base);
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-static void freeDes(struct pk11ContextStore *out)
-{
- if (out)
- {
- if (out->slot)
- slapd_pk11_freeSlot(out->slot);
- if (out->key)
- slapd_pk11_freeSymKey(out->key);
- if (out->params)
- SECITEM_FreeItem(out->params,PR_TRUE);
- if (out->crypt)
- free(out->crypt);
- }
-}
-
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path)
-{
- SVRCOREError err = SVRCORE_Success;
- struct pk11ContextStore *store = NULL;
- SECItem *pwitem = NULL;
- SECItem *result = NULL;
- SECAlgorithmID *algid = NULL;
- SECOidTag algoid;
- SECItem *salt = NULL;
- CK_MECHANISM pbeMech;
- CK_MECHANISM cryptoMech;
-
- char *configdir = NULL;
- char *iv = NULL;
-
- store = (struct pk11ContextStore*)slapi_ch_malloc(sizeof(*store));
- if (store == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- *out = store;
-
- /* Low-level init */
- store->slot = NULL;
- store->key = NULL;
- store->params = NULL;
- store->crypt = NULL;
-
- /* Use the tokenName to find a PKCS11 slot */
- store->slot = slapd_pk11_findSlotByName((char *)token);
- if (store->slot == NULL)
- {
- err = SVRCORE_NoSuchToken_Error;
- goto done;
- }
-
- /* Generate a key and parameters to do the encryption */
- store->mech = &mymech;
-
- /* Generate a unique id, used as salt for the key generation */
- if ( path == NULL )
- {
- configdir = config_get_configdir();
- if ( configdir == NULL )
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- }
- else
- {
- configdir = slapi_ch_strdup(path);
- }
- if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS )
- {
- slapi_ch_free((void**)&configdir);
- err = SVRCORE_System_Error;
- goto done;
- }
- slapi_ch_free((void**)&configdir);
-
- pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (pwitem == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- pwitem->type = siBuffer;
- pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if (pwitem->data == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)pwitem->data, iv);
- pwitem->len = strlen(iv) + 1;
-
- algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
-
- salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (salt == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- salt->type = siBuffer;
- salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if ( salt->data == NULL )
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)salt->data, iv);
- salt->len = strlen(iv) + 1;
-
- algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
-
- slapi_lock_mutex(mylock);
- store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
- if (store->key == 0)
- {
- slapi_unlock_mutex(mylock);
- err = SVRCORE_System_Error;
- goto done;
- }
-
- slapi_unlock_mutex(mylock);
- pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
- result = slapd_pk11_paramFromAlgid(algid);
- secoid_destroyAlgorithmID(algid, PR_TRUE);
- pbeMech.pParameter = result->data;
- pbeMech.ulParameterLen = result->len;
- if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
- PR_FALSE) != CKR_OK)
- {
- SECITEM_FreeItem(result, PR_TRUE);
- err = SVRCORE_System_Error;
- goto done;
- }
- SECITEM_FreeItem(result, PR_TRUE);
- SECITEM_FreeItem(pwitem, PR_TRUE);
- SECITEM_FreeItem(salt, PR_TRUE);
- store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (store->params == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- store->params->type = store->mech->type;
- store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
- if (store->params->data == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
- store->params->len = cryptoMech.ulParameterLen;
- PORT_Free(cryptoMech.pParameter);
-
-done:
- slapi_ch_free((void**)&iv);
- return (err);
-}
-
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
-{
- SVRCOREError err = SVRCORE_Success;
- unsigned char *plain = NULL;
- unsigned char *cipher_with_padding = NULL;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = len;
-
- /* store->length is the max. length of the returned clear text -
- must be >= length of crypted bytes - also must be a multiple
- of blocksize */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* plain will hold the returned clear text */
- plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!plain)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer holding the original cipher bytes, padded with
- zeros to a multiple of blocksize - do not need +1 since buffer is not
- a string */
- cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length);
- if (!cipher_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- memcpy(cipher_with_padding, cipher, len);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- /* warning - there is a purify UMR in the NSS des code - you may see it when the
- password is not a multiple of 8 bytes long */
- rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
- cipher_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- {
- *out = (char *)plain;
- }
- else
- {
- slapi_ch_free((void **)&plain);
- }
-
- slapi_ch_free((void **)&cipher_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
-{
- SVRCOREError err = SVRCORE_Success;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
- unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = strlen(clear);
-
- /* the size of the clear text buffer passed to the des encryption functions
- must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
- of this size, copy the clear text password into it, and pad the rest with
- zeros */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* store->crypt will hold the crypted password - it must be >= clear length */
- /* store->crypt is freed in NSS; let's not use slapi_ch_calloc */
- store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
- store->length+1);
- if (!store->crypt)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer big enough to hold the clear text password and padding */
- clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!clear_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- /* copy the clear text password into the buffer - the calloc insures the
- remainder is zero padded */
- strcpy((char *)clear_with_padding, clear);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
- clear_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- *out = store->crypt;
-
- slapi_ch_free((void **)&clear_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-/*
- The UUID name based generator was broken on x86 platforms. We use
- this to generate the password encryption key. During migration,
- we have to fix this so we can use the fixed generator. The env.
- var USE_BROKEN_UUID tells the uuid generator to use the old
- broken method to create the UUID. That will allow us to decrypt
- the password to the correct clear text, then we can turn off
- the broken method and use the fixed method to encrypt the
- password.
-*/
-char *
-migrateCredentials(char *oldpath, char *newpath, char *oldcred)
-{
- static char *useBrokenUUID = "USE_BROKEN_UUID=1";
- static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
- char *plain = NULL;
- char *cipher = NULL;
-
- init_des_plugin();
-
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
- NSS_NoDB_Init(NULL);
-
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(useBrokenUUID);
- }
-
- if ( decode_path(oldcred, &plain, oldpath) == 0 )
- {
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(disableBrokenUUID);
- }
- if ( encode_path(plain, &cipher, newpath) != 0 )
- return(NULL);
- else
- return(cipher);
- }
- else
- return(NULL);
-}
diff --git a/ldap/servers/plugins/rever/pbe.c b/ldap/servers/plugins/rever/pbe.c
new file mode 100644
index 0000000..abb8d1b
--- /dev/null
+++ b/ldap/servers/plugins/rever/pbe.c
@@ -0,0 +1,621 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This Program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; version 2 of the License.
+ *
+ * This Program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * In addition, as a special exception, Red Hat, Inc. gives You the additional
+ * right to link the code of this Program with code not covered under the GNU
+ * General Public License ("Non-GPL Code") and to distribute linked combinations
+ * including the two, subject to the limitations in this paragraph. Non-GPL Code
+ * permitted under this exception must only link to the code of this Program
+ * through those well defined interfaces identified in the file named EXCEPTION
+ * found in the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline functions from
+ * the Approved Interfaces without causing the resulting work to be covered by
+ * the GNU General Public License. Only Red Hat, Inc. may make changes or
+ * additions to the list of Approved Interfaces. You must obey the GNU General
+ * Public License in all respects for all of the Program code and other code used
+ * in conjunction with the Program except the Non-GPL Code covered by this
+ * exception. If you modify this file, you may extend this exception to your
+ * version of the file, but you are not obligated to do so. If you do not wish to
+ * provide this exception without modification, you must delete this exception
+ * statement from your version and license this file solely under the GPL without
+ * exception.
+ *
+ *
+ * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
+ * Copyright (C) 2015 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <string.h>
+#include <stdio.h>
+
+#include <ldap.h>
+#include <nspr.h>
+#include <nss.h>
+#include <secmod.h>
+/*
+#include <secasn1.h>
+#include <secpkcs7.h>
+*/
+#include <key.h>
+#include <certdb.h>
+#include <cert.h>
+#include <svrcore.h>
+#include <secmodt.h>
+#include <prtypes.h>
+#include <seccomon.h>
+#include <pk11func.h>
+
+#define NEED_TOK_PBE /* see slap.h - defines tokPBE and ptokPBE */
+#include "rever.h"
+#include <slap.h>
+#include "slapi-plugin.h"
+#include <uuid.h>
+#include <plbase64.h>
+
+struct pk11MechItem
+{
+ CK_MECHANISM_TYPE type;
+ const char *mechName;
+};
+
+static const struct pk11MechItem DESmech = { CKM_DES_CBC, "DES CBC encryption" };
+static const struct pk11MechItem AESmech = { CKM_AES_CBC, "AES CBC encryption" };
+static Slapi_Mutex *pbe_lock = NULL;
+
+struct pk11ContextStore
+{
+ PK11SlotInfo *slot;
+ const struct pk11MechItem *mech;
+ PK11SymKey *key;
+ SECItem *params;
+ int length;
+ unsigned char *crypt;
+ char *algid_base64;
+};
+
+/*
+ * der_algid converting functions:
+ *
+ * SECStatus ATOB_ConvertAsciiToItem(SECItem *binary_item, const char *ascii);
+ * char * BTOA_ConvertItemToAscii(SECItem *binary_item);
+ *
+ */
+
+static int encode_path(char *inPlain, char **outCipher, char *path, int mech);
+static int decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid);
+static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *algid);
+static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
+static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
+static void freePBE(struct pk11ContextStore *store);
+
+void
+init_pbe_plugin()
+{
+ if(!pbe_lock){
+ pbe_lock = slapi_new_mutex();
+ }
+}
+
+int
+encode(char *inPlain, char **outCipher, int mech)
+{
+ return encode_path(inPlain, outCipher, NULL, mech);
+}
+
+static int
+encode_path(char *inPlain, char **outCipher, char *path, int mech)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *cipher = NULL;
+ char *tmp = NULL;
+ char *base = NULL;
+ int len = 0;
+ int err;
+
+ *outCipher = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, NULL) == SVRCORE_Success ){
+ /* Try an encryption */
+ if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ){
+ base = BTOA_DataToAscii(cipher, context->length);
+ if ( base != NULL ){
+ const char *scheme;
+ if (mech == AES_MECH){
+ scheme = AES_REVER_SCHEME_NAME;
+ len = 3 + strlen(scheme)+ strlen(context->algid_base64) + strlen(base) + 1;
+ if( (tmp = slapi_ch_malloc( len )) ){
+ /*
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ sprintf( tmp, "%c%s-%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ context->algid_base64,PWD_HASH_PREFIX_END, base);
+ }
+ } else {
+ /* Old school DES */
+ scheme = DES_REVER_SCHEME_NAME;
+ if((tmp = slapi_ch_malloc( 3 + strlen(scheme) + strlen(base)))){
+ sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ PWD_HASH_PREFIX_END, base);
+ }
+ }
+ if ( tmp != NULL ){
+ *outCipher = tmp;
+ tmp = NULL;
+ err = 0;
+ }
+ PORT_Free(base);
+ }
+ }
+ }
+ freePBE(context);
+
+ return(err);
+}
+
+int
+decode(char *inCipher, char **outPlain, int mech, char *algid)
+{
+ return decode_path(inCipher, outPlain, NULL, mech, algid);
+}
+
+
+static int
+decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *base = NULL;
+ char *plain = NULL;
+ int err;
+ int len = 0;
+
+ *outPlain = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, algid) == SVRCORE_Success ){
+ /* it seems that there is memory leak in that function: bug 400170 */
+ base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
+ if ( base != NULL ){
+ if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ){
+ *outPlain = plain;
+ err = 0;
+ }
+ }
+ }
+
+ slapi_ch_free_string(&algid);
+ PORT_Free(base);
+ PORT_FreeArena(arena, PR_TRUE);
+ freePBE(context);
+
+ return(err);
+}
+
+static void
+freePBE(struct pk11ContextStore *store)
+{
+ if (store){
+ if (store->slot)
+ slapd_pk11_freeSlot(store->slot);
+ if (store->key)
+ slapd_pk11_freeSymKey(store->key);
+ if (store->params)
+ SECITEM_FreeItem(store->params, PR_TRUE);
+ slapi_ch_free((void **)&store->crypt);
+ slapi_ch_free_string(&store->algid_base64);
+ slapi_ch_free((void **)&store);
+ }
+}
+
+static SVRCOREError
+genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *alg)
+{
+ SVRCOREError err = SVRCORE_Success;
+ struct pk11ContextStore *store = NULL;
+ SECItem *pwitem = NULL;
+ SECItem *result = NULL;
+ SECItem *salt = NULL;
+ SECItem der_algid;
+ SECAlgorithmID *algid = NULL;
+ SECOidTag algoid;
+ CK_MECHANISM pbeMech;
+ CK_MECHANISM cryptoMech;
+ SECAlgorithmID my_algid;
+ char *configdir = NULL;
+ char *der_ascii = NULL;
+ char *iv = NULL;
+ int free_it = 0;
+
+ arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+
+ store = (struct pk11ContextStore*)slapi_ch_calloc(1, sizeof(*store));
+ if (store == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ *out = store;
+
+ /* Use the tokenName to find a PKCS11 slot */
+ store->slot = slapd_pk11_findSlotByName((char *)token);
+ if (store->slot == NULL){
+ err = SVRCORE_NoSuchToken_Error;
+ goto done;
+ }
+
+ /* Generate a key and parameters to do the encryption */
+ if(mech == AES_MECH){
+ store->mech = &AESmech;
+ algoid = SEC_OID_AES_256_CBC;
+ } else {
+ store->mech = &DESmech;
+ algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
+ }
+
+ /* Generate a unique id, used as salt for the key generation */
+ if ( path == NULL ){
+ configdir = config_get_configdir();
+ if ( configdir == NULL ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ } else {
+ configdir = slapi_ch_strdup(path);
+ }
+ if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (pwitem == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ pwitem->type = siBuffer;
+ pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if (pwitem->data == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)pwitem->data, iv);
+ pwitem->len = strlen(iv) + 1;
+
+ salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (salt == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ salt->type = siBuffer;
+ salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if ( salt->data == NULL ){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)salt->data, iv);
+ salt->len = strlen(iv) + 1;
+
+ PORT_Memset(&der_algid, 0, sizeof(der_algid));
+ if(!alg){
+ /*
+ * This is DES, or we are encoding AES - the process is the same.
+ */
+ algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
+ free_it = 1; /* we need to free this algid */
+
+ /*
+ * The following is only need for AES - we need to store
+ * algid for future decodings(unlike with DES). So convert
+ * algid to its DER encoding. Then convert the DER to ascii,
+ * and finally convert the DER ascii to base64 so we can store
+ * it in the cipher prefix.
+ */
+ SEC_ASN1EncodeItem(arena, &der_algid, algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate));
+ der_ascii = BTOA_ConvertItemToAscii(&der_algid);
+ store->algid_base64 = PL_Base64Encode(der_ascii,strlen(der_ascii), NULL);
+ slapi_ch_free_string(&der_ascii);
+ } else {
+ /*
+ * We are decoding AES - use the supplied algid
+ */
+ PORT_Memset(&my_algid, 0, sizeof(my_algid));
+
+ /* Decode the base64 der encoding */
+ der_ascii = PL_Base64Decode(alg, strlen(alg), NULL);
+
+ /* convert the der ascii to the SEC item */
+ ATOB_ConvertAsciiToItem(&der_algid, der_ascii);
+ SEC_ASN1DecodeItem(arena, &my_algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate), &der_algid);
+ SECITEM_FreeItem(&der_algid, PR_FALSE);
+ algid = &my_algid;
+ slapi_ch_free_string(&der_ascii);
+ }
+
+ slapi_lock_mutex(pbe_lock);
+ store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
+ if (store->key == 0){
+ slapi_unlock_mutex(pbe_lock);
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ slapi_unlock_mutex(pbe_lock);
+
+ if(mech == AES_MECH)
+ {
+ cryptoMech.mechanism = PK11_GetPBECryptoMechanism(algid, &store->params, pwitem);
+ if (cryptoMech.mechanism == CKM_INVALID_MECHANISM) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ }
+ else
+ {
+ /* DES */
+ pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
+ result = slapd_pk11_paramFromAlgid(algid);
+ if(result){
+ pbeMech.pParameter = result->data;
+ pbeMech.ulParameterLen = result->len;
+ }
+ if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
+ PR_FALSE) != CKR_OK){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (store->params == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ store->params->type = store->mech->type;
+ store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
+ if (store->params->data == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
+ store->params->len = cryptoMech.ulParameterLen;
+ PORT_Free(cryptoMech.pParameter);
+ }
+
+done:
+ SECITEM_FreeItem(result, PR_TRUE);
+ SECITEM_FreeItem(pwitem, PR_TRUE);
+ SECITEM_FreeItem(salt, PR_TRUE);
+ if(free_it){
+ secoid_destroyAlgorithmID(algid, PR_TRUE);
+ }
+ slapi_ch_free_string(&configdir);
+ slapi_ch_free_string(&iv);
+ if (arena) {
+ PORT_FreeArena(arena, PR_TRUE);
+ }
+ return (err);
+}
+
+static SVRCOREError
+decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
+{
+ SVRCOREError err = SVRCORE_Success;
+ unsigned char *plain = NULL;
+ unsigned char *cipher_with_padding = NULL;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ int outLen = 0;
+ int blocksize = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = len;
+
+ /*
+ * store->length is the max. length of the returned clear text -
+ * must be >= length of crypted bytes - also must be a multiple
+ * of blocksize
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /* plain will hold the returned clear text */
+ plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!plain){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /*
+ * create a buffer holding the original cipher bytes, padded with
+ * zeros to a multiple of blocksize - do not need +1 since buffer is not
+ * a string
+ */
+ cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length);
+ if (!cipher_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ memcpy(cipher_with_padding, cipher, len);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ /*
+ * Warning - there is a purify UMR in the NSS des code - you may see it when the
+ * password is not a multiple of 8 bytes long
+ */
+ rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
+ cipher_with_padding, store->length);
+ if (rv){
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err))
+ err = SVRCORE_System_Error;
+
+done:
+ if (err == SVRCORE_Success){
+ *out = (char *)plain;
+ } else {
+ slapi_ch_free((void **)&plain);
+ }
+
+ slapi_ch_free((void **)&cipher_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+static SVRCOREError
+cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
+{
+ SVRCOREError err = SVRCORE_Success;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
+ int blocksize = 0;
+ int outLen = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = strlen(clear);
+
+ /*
+ * The size of the clear text buffer passed to the encryption functions
+ * must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
+ * of this size, copy the clear text password into it, and pad the rest with
+ * zeros.
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /*
+ * store->crypt will hold the crypted password - it must be >= clear length
+ * store->crypt is freed in NSS; let's not use slapi_ch_calloc
+ */
+ store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!store->crypt) {
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /* Create a buffer big enough to hold the clear text password and padding */
+ clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!clear_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ /*
+ * Copy the clear text password into the buffer - the calloc insures the
+ * remainder is zero padded .
+ */
+ strcpy((char *)clear_with_padding, clear);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
+ clear_with_padding, store->length);
+ if (rv) {
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err)){
+ err = SVRCORE_System_Error;
+ }
+
+done:
+ if (err == SVRCORE_Success){
+ *out = store->crypt;
+ }
+
+ slapi_ch_free((void **)&clear_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+/*
+ * The UUID name based generator was broken on x86 platforms. We use
+ * this to generate the password encryption key. During migration,
+ * we have to fix this so we can use the fixed generator. The env.
+ * var USE_BROKEN_UUID tells the uuid generator to use the old
+ * broken method to create the UUID. That will allow us to decrypt
+ * the password to the correct clear text, then we can turn off
+ * the broken method and use the fixed method to encrypt the
+ * password.
+ */
+char *
+migrateCredentials(char *oldpath, char *newpath, char *oldcred)
+{
+ static char *useBrokenUUID = "USE_BROKEN_UUID=1";
+ static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
+ char *plain = NULL;
+ char *cipher = NULL;
+
+ init_pbe_plugin();
+
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
+ NSS_NoDB_Init(NULL);
+
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(useBrokenUUID);
+ }
+
+ if ( decode_path(oldcred, &plain, oldpath, DES_MECH, NULL) == 0 ){
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(disableBrokenUUID);
+ }
+ if ( encode_path(plain, &cipher, newpath, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return(cipher);
+ }
+ } else {
+ return(NULL);
+ }
+}
diff --git a/ldap/servers/plugins/rever/rever.c b/ldap/servers/plugins/rever/rever.c
index 9d7e82d..51d602f 100644
--- a/ldap/servers/plugins/rever/rever.c
+++ b/ldap/servers/plugins/rever/rever.c
@@ -43,25 +43,92 @@
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
-
#include "rever.h"
-static Slapi_PluginDesc pdesc = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_aes = { "aes-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "AES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_des = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+
static char *plugin_name = "ReverStoragePlugin";
+#define AES_MECH 1
+#define DES_MECH 2
+
+int
+aes_cmp( char *userpwd, char *dbpwd )
+{
+ char *cipher = NULL;
+ int rc = 0;
+
+ if ( encode(userpwd, &cipher, AES_MECH) != 0 ){
+ rc = 1;
+ } else {
+ rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
+
+ return rc;
+}
+
+char *
+aes_enc( char *pwd )
+{
+ char *cipher = NULL;
+
+ if ( encode(pwd, &cipher, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return( cipher );
+ }
+}
+
+char *
+aes_dec( char *pwd, char *alg )
+{
+ char *plain = NULL;
+
+ if ( decode(pwd, &plain, AES_MECH, alg) != 0 ){
+ return(NULL);
+ } else {
+ return( plain );
+ }
+}
+
+int
+aes_init( Slapi_PBlock *pb)
+{
+ char *name = slapi_ch_strdup(AES_REVER_SCHEME_NAME);
+ int rc;
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> aes_init\n" );
+
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_aes );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) aes_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) aes_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) aes_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= aes_init %d\n", rc );
+
+ return( rc );
+}
+
int
des_cmp( char *userpwd, char *dbpwd )
{
char *cipher = NULL;
int rc = 0;
- if ( encode(userpwd, &cipher) != 0 )
+ if ( encode(userpwd, &cipher, DES_MECH) != 0 ){
rc = 1;
- else
+ } else {
rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
- slapi_ch_free((void**)&cipher);
return rc;
}
@@ -70,10 +137,11 @@ des_enc( char *pwd )
{
char *cipher = NULL;
- if ( encode(pwd, &cipher) != 0 )
+ if ( encode(pwd, &cipher, DES_MECH ) != 0 ){
return(NULL);
- else
+ } else {
return( cipher );
+ }
}
char *
@@ -81,37 +149,31 @@ des_dec( char *pwd )
{
char *plain = NULL;
- if ( decode(pwd, &plain) != 0 )
+ if ( decode(pwd, &plain, DES_MECH, NULL) != 0 ){
return(NULL);
- else
+ } else {
return( plain );
+ }
}
int
des_init( Slapi_PBlock *pb )
{
+ char *name = slapi_ch_strdup(DES_REVER_SCHEME_NAME);
int rc;
- char *name;
slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> des_init\n" );
- rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
- (void *) SLAPI_PLUGIN_VERSION_01 );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION,
- (void *)&pdesc );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN,
- (void *) des_enc);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN,
- (void *) des_cmp );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN,
- (void *) des_dec );
- name = slapi_ch_strdup(REVER_SCHEME_NAME);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME,
- name );
-
- init_des_plugin();
-
- slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n\n", rc );
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_des );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) des_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) des_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) des_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n", rc );
return( rc );
}
diff --git a/ldap/servers/plugins/rever/rever.h b/ldap/servers/plugins/rever/rever.h
index 8ea6279..9edddd8 100644
--- a/ldap/servers/plugins/rever/rever.h
+++ b/ldap/servers/plugins/rever/rever.h
@@ -49,7 +49,10 @@
#include "slap.h"
#include "ldaplog.h"
-#define REVER_SCHEME_NAME "DES"
+#define AES_MECH 1
+#define DES_MECH 2
+#define AES_REVER_SCHEME_NAME "AES"
+#define DES_REVER_SCHEME_NAME "DES"
#define PWD_HASH_PREFIX_START '{'
#define PWD_HASH_PREFIX_END '}'
@@ -58,10 +61,10 @@ int rever_cmp( char *userpwd, char *dbpwd );
char *rever_enc( char *pwd );
char *rever_dec( char *pwd );
int rever_init( Slapi_PBlock *pb );
-void init_des_plugin();
+void init_pbe_plugin();
-int encode(char *inPlain, char ** outCipher);
-int decode(char *inCipher, char **outPlain);
+int encode(char *inPlain, char **outCipher, int mech);
+int decode(char *inCipher, char **outPlain, int mech, char *algid);
char *migrateCredentials(char *oldpath, char *newpath, char *oldcred);
typedef char *(*migrate_fn_type)(char *, char *, char *);
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 0c11238..3cb8451 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -937,6 +937,244 @@ handle_listeners(Connection_Table *ct, listener_info *listener_idxs, int n_liste
return;
}
+/*
+ * Convert any pre-existing DES passwords to AES.
+ *
+ * Grab the "password" attributes and search all the backends for
+ * these attributes and convert them to AES if they are DES encoded.
+ */
+static void
+convert_pbe_des_to_aes()
+{
+ Slapi_PBlock *pb = NULL;
+ Slapi_Entry **entries = NULL;
+ struct slapdplugin *plugin = NULL;
+ char **attrs = NULL;
+ char **backends = NULL;
+ char *val = NULL;
+ int converted_des = 0;
+ int result = -1;
+ int have_aes = 0;
+ int have_des = 0;
+ int i = 0, ii = 0, be_idx = 0;
+
+ /*
+ * Check that AES plugin is enabled, and grab all the unique
+ * password attributes.
+ */
+ for ( plugin = get_plugin_list(PLUGIN_LIST_REVER_PWD_STORAGE_SCHEME);
+ plugin != NULL;
+ plugin = plugin->plg_next )
+ {
+ char *arg = NULL;
+
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "AES") == 0){
+ /* We have the AES plugin, and its enabled */
+ have_aes = 1;
+ }
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "DES") == 0){
+ /* We have the DES plugin, and its enabled */
+ have_des = 1;
+ }
+ /* Gather all the unique password attributes from all the PBE plugins */
+ for ( i = 0, arg = plugin->plg_argv[i];
+ i < plugin->plg_argc;
+ arg = plugin->plg_argv[++i] )
+ {
+ if(charray_inlist(attrs, arg)){
+ continue;
+ }
+ charray_add(&attrs, slapi_ch_strdup(arg));
+ }
+ }
+
+ if(have_aes && have_des){
+ /*
+ * Build a list of all the backend dn's
+ */
+ Slapi_Backend *be = NULL;
+ struct suffixlist *list;
+ char *cookie = NULL;
+
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Converting DES passwords to AES...\n",0,0,0);
+
+ be = slapi_get_first_backend(&cookie);
+ while (be){
+ int suffix_idx = 0;
+ int count = slapi_counter_get_value(be->be_suffixcounter);
+
+ list = be->be_suffixlist;
+ for (suffix_idx = 0; list && suffix_idx < count; suffix_idx++) {
+ char *suffix = (char *)slapi_sdn_get_ndn(list->be_suffix);
+ if(charray_inlist(backends, suffix) || strlen(suffix) == 0){
+ list = list->next;
+ continue;
+ }
+ charray_add(&backends, slapi_ch_strdup(suffix));
+ list = list->next;
+ }
+ be = slapi_get_next_backend (cookie);
+ }
+ slapi_ch_free ((void **)&cookie);
+
+ /*
+ * Search for the password attributes
+ */
+ for (i = 0; attrs && attrs[i]; i++){
+ char *filter = PR_smprintf("%s=*", attrs[i]);
+ /*
+ * Loop over all the backends looking for the password attribute
+ */
+ for(be_idx = 0; backends[be_idx]; be_idx++){
+ pb = slapi_pblock_new();
+ slapi_search_internal_set_pb(pb, backends[be_idx],
+ LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
+ (void *)plugin_get_default_component_id(),
+ SLAPI_OP_FLAG_IGNORE_UNINDEXED);
+ slapi_search_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to search for password on (%s) error (%d)\n",
+ backends[be_idx], result, 0);
+ goto done;
+ }
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
+ for (ii = 0; entries && entries[ii]; ii++){
+ if((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))){
+ if(strlen(val) >= 5 && strncmp(val,"{DES}", 5) == 0){
+ /*
+ * We have a DES encoded password, convert it AES
+ */
+ Slapi_PBlock *mod_pb = NULL;
+ Slapi_Value *sval = NULL;
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *passwd = NULL;
+
+ /* decode the DES password */
+ if(pw_rever_decode(val, &passwd, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to decode existing DES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* encode the password */
+ sval = slapi_value_new_string(passwd);
+ if(pw_rever_encode(&sval, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to encode AES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* replace the attribute in the entry */
+ replace_val[0] = (char *)slapi_value_get_string(sval);
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = attrs[i];
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ mod_pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(mod_pb, slapi_entry_get_dn(entries[ii]),
+ mods, 0, 0, (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(mod_pb);
+
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to convert password for (%s) error (%d)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = -1;
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "successfully converted password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = 1;
+
+ }
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ slapi_pblock_destroy(mod_pb);
+ if(result){
+ goto done;
+ }
+ }
+ slapi_ch_free_string(&val);
+ }
+ }
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+ pb = NULL;
+ }
+ slapi_ch_free_string(&filter);
+ }
+ }
+
+done:
+ charray_free(attrs);
+ charray_free(backends);
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+
+ if (have_aes && have_des){
+ /*
+ * If a conversion attempt did not fail, disable DES plugin
+ */
+ if(converted_des != -1){
+ /*
+ * Disable the DES plugin - this also prevents potentially expensive
+ * searches at every server startup.
+ */
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+
+ replace_val[0] = "off";
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = "nsslapd-pluginEnabled";
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(pb, des_dn, mods, 0, 0,
+ (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Failed to disable DES plugin (%s), error (%d)\n",
+ des_dn, result, 0);
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Successfully disabled DES plugin (%s)\n",
+ des_dn, 0, 0);
+ }
+ slapi_pblock_destroy(pb);
+ }
+ if(converted_des == 1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Finished - all DES passwords have been converted to AES.\n",
+ 0, 0, 0);
+ } else if (converted_des == 0){
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Finished - no DES passwords to convert.\n",0,0,0);
+ }
+ }
+}
+
void slapd_daemon( daemon_ports_t *ports )
{
/* We are passed some ports---one for regular connections, one
@@ -1140,7 +1378,6 @@ void slapd_daemon( daemon_ports_t *ports )
}
#endif /* ENABLE_LDAPI */
#endif
-
listener_idxs = (listener_info *)slapi_ch_calloc(n_listeners, sizeof(*listener_idxs));
/* Now we write the pid file, indicating that the server is finally and listening for connections */
write_pid_file();
@@ -1148,6 +1385,11 @@ void slapd_daemon( daemon_ports_t *ports )
/* The server is ready and listening for connections. Logging "slapd started" message. */
unfurl_banners(the_connection_table,ports,n_tcps,s_tcps,i_unix);
+ /*
+ * Convert old DES encoded passwords to AES
+ */
+ convert_pbe_des_to_aes();
+
/* The meat of the operation is in a loop on a call to select */
while(!g_get_shutdown())
{
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 48188ed..35b45e3 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1123,6 +1123,7 @@ void slapd_pk11_DestroyPublicKey(SECKEYPublicKey *key);
PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm);
PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx);
+CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem);
/*
* start_tls_extop.c
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 082f69a..43a11c7 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -384,9 +384,8 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
if ((!enc) && (( enc = (*pws_enc)( (char*)slapi_value_get_string(vals[ i ]) )) == NULL )) {
return( -1 );
}
-
- slapi_value_free(&vals[ i ]);
- vals[ i ] = slapi_value_new_string_passin(enc);
+ slapi_value_free(&vals[ i ]);
+ vals[ i ] = slapi_value_new_string_passin(enc);
}
return( 0 );
@@ -396,28 +395,57 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
* Check if the prefix of the cipher is the one that is supposed to be
* Extract from the whole cipher the encrypted password (remove the prefix)
*/
-int checkPrefix(char *cipher, char *schemaName, char **encrypt)
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid)
{
int namelen;
/* buf contains the extracted schema name */
char *end, buf[ 3*PWD_MAX_NAME_LEN + 1 ];
+ char *delim = NULL;
if ( (*cipher == PWD_HASH_PREFIX_START) &&
- ((end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) &&
- ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)) )
+ (end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL)
{
- memcpy( buf, cipher + 1, namelen );
- buf[ namelen ] = '\0';
- if ( strcasecmp( buf, schemaName) != 0 )
- {
- /* schema names are different, error */
- return 1;
- }
- else
- {
- /* extract the encrypted password */
- *encrypt = cipher + strlen(schemaName) + 2;
- return 0;
+ if((delim = strchr(cipher, PWD_PBE_DELIM)) != NULL){
+ /*
+ * We have an algid in the prefix:
+ *
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ if((namelen = delim - cipher - 1) <= (3*PWD_MAX_NAME_LEN)){
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+
+ if ( strcasecmp( buf, schemaName) != 0 ){
+ /* schema names are different, error */
+ return 1;
+ } else {
+ char algid_buf[256];
+
+ /* extract the algid (length is never greater than 216 */
+ memcpy(algid_buf, delim + 1 , (end - delim));
+ algid_buf[end - delim - 1] = '\0';
+ *algid = strdup(algid_buf);
+
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(*algid) + strlen (schemaName) + 3;
+ return 0;
+ }
+ }
+ } else if ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)){
+ /* no delimiter - must be old school DES */
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+ if ( strcasecmp( buf, schemaName) != 0 )
+ {
+ /* schema names are different, error */
+ return 1;
+ }
+ else
+ {
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(schemaName) + 2;
+ return 0;
+ }
}
}
/* cipher is not prefixed, already in clear ? */
@@ -443,6 +471,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
char *L_attr = NULL;
int i = 0;
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK = -1;
/* Get the appropriate decoding function */
@@ -450,10 +479,9 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
if (slapi_attr_types_equivalent(L_attr, attr_name))
{
- typedef char * (*ENCFP)(char *);
+ typedef char * (*ENCFP)(char *, char *);
pwsp = (struct pw_scheme *) slapi_ch_calloc (1, sizeof(struct pw_scheme));
-
pwsp->pws_dec = (ENCFP)p->plg_pwdstorageschemedec;
pwsp->pws_name = slapi_ch_strdup( p->plg_pwdstorageschemename );
pwsp->pws_len = strlen(pwsp->pws_name) ;
@@ -461,7 +489,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
/* check that the prefix of the cipher is the same name
as the scheme name */
- prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt);
+ prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt, &algid);
if ( prefixOK == -1 )
{
/* no prefix, already in clear ? */
@@ -471,13 +499,15 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
}
else if ( prefixOK == 1 )
{
- /* scheme names are different */
+ /* scheme names are different, try the next plugin */
ret_code = -1;
- goto free_and_return;
+ free_pw_scheme( pwsp );
+ pwsp = NULL;
+ continue;
}
else
{
- if ( ( *plain = (pwsp->pws_dec)( encrypt )) == NULL )
+ if ( ( *plain = (pwsp->pws_dec)( encrypt, algid )) == NULL )
{
/* pb during decoding */
ret_code = -1;
@@ -536,11 +566,13 @@ pw_rever_encode(Slapi_Value **vals, char * attr_name)
for ( i = 0; vals[i] != NULL; ++i )
{
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK;
prefixOK = checkPrefix((char*)slapi_value_get_string(vals[i]),
pwsp->pws_name,
- &encrypt);
+ &encrypt, &algid);
+ slapi_ch_free_string(&algid);
if ( prefixOK == 0 )
{
/* Don't touch already encoded value */
diff --git a/ldap/servers/slapd/pw.h b/ldap/servers/slapd/pw.h
index 7190a1d..79a90a0 100644
--- a/ldap/servers/slapd/pw.h
+++ b/ldap/servers/slapd/pw.h
@@ -61,7 +61,7 @@ struct pw_scheme *pw_name2scheme( char *name );
struct pw_scheme *pw_val2scheme( char *val, char **valpwdp, int first_is_default );
int pw_encodevals( Slapi_Value **vals );
int pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals );
-int checkPrefix(char *cipher, char *schemaName, char **encrypt);
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid);
struct passwordpolicyarray *new_passwdPolicy ( Slapi_PBlock *pb, const char *dn );
void delete_passwdPolicy( struct passwordpolicyarray **pwpolicy);
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 2198337..544a9c7 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -2083,7 +2083,8 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie
slapi_pblock_get( pb, SLAPI_OPERATION_TYPE, &optype );
if(optype == SLAPI_OPERATION_SEARCH && /* search, */
strcmp(notes_str,"") && /* that's unindexed, */
- !(config_get_accesslog_level() & LDAP_DEBUG_ARGS)) /* and not logged in access log */
+ !(config_get_accesslog_level() & LDAP_DEBUG_ARGS) && /* and not logged in access log */
+ !(op->o_flags & SLAPI_OP_FLAG_IGNORE_UNINDEXED) ) /* and not ignoring unindexed search */
{
struct slapdplugin *plugin = NULL;
struct slapi_componentid *cid = NULL;
diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c
index 33d512f..4ffda8b 100644
--- a/ldap/servers/slapd/security_wrappers.c
+++ b/ldap/servers/slapd/security_wrappers.c
@@ -409,3 +409,9 @@ PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot,
return PK11_TokenKeyGenWithFlags(slot, type, param, keySize, keyid,
opFlags, attrFlags, wincx);
}
+
+CK_MECHANISM_TYPE
+slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem)
+{
+ return PK11_GetPBECryptoMechanism(algid, params, pwitem );
+}
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index d234c13..3db8fe7 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -53,9 +53,9 @@
/* Used by SSL and DES plugin */
-#ifdef NEED_TOK_DES
-static char tokDes[34] = "Communicator Generic Crypto Svcs";
-static char ptokDes[34] = "Internal (Software) Token ";
+#ifdef NEED_TOK_PBE
+static char tokPBE[34] = "Communicator Generic Crypto Svcs";
+static char ptokPBE[34] = "Internal (Software) Token ";
#endif
/*
@@ -307,6 +307,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */
#define ATTR_NETSCAPEMDSUFFIX "netscapemdsuffix"
+#define PWD_PBE_DELIM '-'
+
#define REFERRAL_REMOVE_CMD "remove"
/* Filenames for DSE storage */
@@ -1592,7 +1594,7 @@ struct pw_scheme {
char *(*pws_enc)( char *pwd );
/* thread-safe decoding function (returns pointer to malloc'd string) */
- char *(*pws_dec)( char *pwd );
+ char *(*pws_dec)( char *pwd, char *algid);
};
typedef struct passwordpolicyarray {
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index a61d954..41dd2c8 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -222,6 +222,7 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...)
#define SLAPI_OP_FLAG_NO_ACCESS_CHECK 0x10000 /* Do not check for access control - bypass them */
#define SLAPI_OP_FLAG_BYPASS_REFERRALS 0x40000 /* Useful for performing internal operations on read-only replica */
#define SLAPI_OP_FLAG_NEVER_CACHE 0x200000 /* added entry should not be kept in cache */
+#define SLAPI_OP_FLAG_IGNORE_UNINDEXED 0x800000 /* Do not log unindexed search */
#define SLAPI_OC_FLAG_REQUIRED 0x0001
#define SLAPI_OC_FLAG_ALLOWED 0x0002
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 6b51e0c..67d01cd 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -64,7 +64,7 @@
#include <string.h>
#include <errno.h>
-#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */
+#define NEED_TOK_PBE /* defines tokPBE and ptokPBE - see slap.h */
#include "slap.h"
#include "svrcore.h"
@@ -1108,7 +1108,7 @@ slapd_nss_init(int init_ssl, int config_available)
/******** Initialise NSS *********/
nssFlags &= (~NSS_INIT_READONLY);
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags);
dongle_file_name = PR_smprintf("%s/pin.txt", certdir);
9 years, 3 months
aclocal.m4 config.guess config.sub dirsrvtests/tickets ldap/admin ldap/ldif ldap/servers Makefile.am Makefile.in
by Mark Reynolds
Makefile.am | 14
Makefile.in | 104 ++--
aclocal.m4 | 15
config.guess | 192 +-------
config.sub | 40 +
dirsrvtests/tickets/ticket47462_test.py | 452 +++++++++++++++++++
ldap/admin/src/scripts/50AES-pbe-plugin.ldif | 16
ldap/admin/src/scripts/52updateAESplugin.pl | 84 +++
ldap/ldif/50replication-plugins.ldif | 2
ldap/ldif/template-dse.ldif.in | 16
ldap/servers/plugins/rever/des.c | 551 -----------------------
ldap/servers/plugins/rever/pbe.c | 621 +++++++++++++++++++++++++++
ldap/servers/plugins/rever/rever.c | 116 +++--
ldap/servers/plugins/rever/rever.h | 11
ldap/servers/slapd/daemon.c | 244 ++++++++++
ldap/servers/slapd/proto-slap.h | 1
ldap/servers/slapd/pw.c | 82 ++-
ldap/servers/slapd/pw.h | 2
ldap/servers/slapd/result.c | 3
ldap/servers/slapd/security_wrappers.c | 6
ldap/servers/slapd/slap.h | 10
ldap/servers/slapd/slapi-plugin.h | 1
ldap/servers/slapd/ssl.c | 4
23 files changed, 1731 insertions(+), 856 deletions(-)
New commits:
commit a57494fcaffccb6fdd060a93ba605d432e38bc09
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 10:59:05 2015 -0500
Ticket 47462 - Stop using DES in the reversible password
encryption plug-in
Bug Description: DES is not a safe cipher to use for Password Based Encryption(pbe).
AES should be used instead.
Fix Description: Use AES for all new password encodings. AES requires that the
algorithm ID used to encode the password, must also be used to
decode it. So, the algorithm ID is now stored in the cipher prefix:
{AES-<BASE64 encoded alg ID>}<ENCODED PASSWORD>
Since DES is no longer being used, the library has been renamed to a
more apprpriate name:
libdes-plugin -> libpbe-plugin
During upgrades the DES plugin entry has its library path updated
to use libpbe-plugin. The MMR plugin changes its dependency from
DES to AES, and the AES plugin entry is added, and all the password
attributes found in the old DES Plugin are migrated over to the new
AES Plugin entry.
When the server is restarted it checks for any DES passwords in the
database and cn=config. If any are found they are converted to AES,
and the DES plugin is disabled.
Also created a new operation flag: SLAPI_OP_FLAG_IGNORE_UNINDEXED
This flag prevents an internal unnidexed search from being logged
in the "errors" log. When the server starts up it can potentially
do unindexed searches while looking for DES passwords. We don't
want this log "noise" in the errors log everytime the server starts.
https://fedorahosted.org/389/ticket/47462
Design Doc: http://www.port389.org/docs/389ds/design/pbe.html
Valgrind: Passed
Reviewed by: nhosoi(Thanks!)
diff --git a/Makefile.am b/Makefile.am
index 049ff74..17aadff 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -225,7 +225,7 @@ endif
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -583,7 +583,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -1016,14 +1018,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
diff --git a/Makefile.in b/Makefile.in
index 24a9ddf..dff7462 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -396,15 +396,6 @@ libderef_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libderef_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
-libdes_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
-am_libdes_plugin_la_OBJECTS = \
- ldap/servers/plugins/rever/libdes_plugin_la-des.lo \
- ldap/servers/plugins/rever/libdes_plugin_la-rever.lo
-libdes_plugin_la_OBJECTS = $(am_libdes_plugin_la_OBJECTS)
-libdes_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
- $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libdes_plugin_la_LDFLAGS) $(LDFLAGS) \
- -o $@
libdistrib_plugin_la_DEPENDENCIES = libslapd.la
am_libdistrib_plugin_la_OBJECTS = \
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo
@@ -548,6 +539,15 @@ libpassthru_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libpassthru_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
+libpbe_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
+am_libpbe_plugin_la_OBJECTS = \
+ ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo \
+ ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo
+libpbe_plugin_la_OBJECTS = $(am_libpbe_plugin_la_OBJECTS)
+libpbe_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+ $(AM_CFLAGS) $(CFLAGS) $(libpbe_plugin_la_LDFLAGS) $(LDFLAGS) \
+ -o $@
libposix_winsync_plugin_la_DEPENDENCIES = libslapd.la \
$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1)
am_libposix_winsync_plugin_la_OBJECTS = ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo \
@@ -1154,14 +1154,13 @@ SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1190,14 +1189,13 @@ DIST_SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1637,7 +1635,7 @@ server_LTLIBRARIES = libslapd.la libns-dshttpd.la
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -1991,7 +1989,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -2363,14 +2363,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
@@ -3596,21 +3596,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: \
libderef-plugin.la: $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_DEPENDENCIES) $(EXTRA_libderef_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libderef_plugin_la_LINK) -rpath $(serverplugindir) $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_LIBADD) $(LIBS)
-ldap/servers/plugins/rever/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever
- @: > ldap/servers/plugins/rever/$(am__dirstamp)
-ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
- @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-
-libdes-plugin.la: $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_DEPENDENCIES) $(EXTRA_libdes_plugin_la_DEPENDENCIES)
- $(AM_V_CCLD)$(libdes_plugin_la_LINK) -rpath $(serverplugindir) $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/distrib/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/distrib
@: > ldap/servers/plugins/distrib/$(am__dirstamp)
@@ -3900,6 +3885,21 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: \
libpassthru-plugin.la: $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_DEPENDENCIES) $(EXTRA_libpassthru_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libpassthru_plugin_la_LINK) -rpath $(serverplugindir) $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_LIBADD) $(LIBS)
+ldap/servers/plugins/rever/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever
+ @: > ldap/servers/plugins/rever/$(am__dirstamp)
+ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
+ @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+
+libpbe-plugin.la: $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_DEPENDENCIES) $(EXTRA_libpbe_plugin_la_DEPENDENCIES)
+ $(AM_V_CCLD)$(libpbe_plugin_la_LINK) -rpath $(serverplugindir) $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/posix-winsync/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/posix-winsync
@: > ldap/servers/plugins/posix-winsync/$(am__dirstamp)
@@ -5441,8 +5441,8 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_po.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_rootdse.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_trim.Plo(a)am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo(a)am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo(a)am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo(a)am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_cache.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_plugin.Plo(a)am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rootdn_access/$(DEPDIR)/librootdn_access_plugin_la-rootdn_access.Plo(a)am__quote@
@@ -6739,20 +6739,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: ldap/servers/plugins/der
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libderef_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/deref/libderef_plugin_la-deref.lo `test -f 'ldap/servers/plugins/deref/deref.c' || echo '$(srcdir)/'`ldap/servers/plugins/deref/deref.c
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-des.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/des.c' object='ldap/servers/plugins/rever/libdes_plugin_la-des.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libdes_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo: ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdistrib_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo -MD -MP -MF ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo -c -o ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo `test -f 'ldap/servers/plugins/distrib/distrib.c' || echo '$(srcdir)/'`ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Plo
@@ -6991,6 +6977,20 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: ldap/servers/plug
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpassthru_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo `test -f 'ldap/servers/plugins/passthru/ptutil.c' || echo '$(srcdir)/'`ldap/servers/plugins/passthru/ptutil.c
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/pbe.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+
ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo: ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libposix_winsync_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo -MD -MP -MF ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo -c -o ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo `test -f 'ldap/servers/plugins/posix-winsync/posix-winsync.c' || echo '$(srcdir)/'`ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Plo
diff --git a/aclocal.m4 b/aclocal.m4
index 8136dd1..7afd01a 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -220,6 +220,21 @@ m4_popdef([pkg_default])
m4_popdef([pkg_description])
]) dnl PKG_NOARCH_INSTALLDIR
+
+# PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+# -------------------------------------------
+# Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])# PKG_CHECK_VAR
+
# Copyright (C) 2002-2013 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
diff --git a/config.guess b/config.guess
index b79252d..1f5c50c 100755
--- a/config.guess
+++ b/config.guess
@@ -1,8 +1,8 @@
#! /bin/sh
# Attempt to guess a canonical system name.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-06-10'
+timestamp='2014-03-23'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -50,7 +50,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -149,7 +149,7 @@ Linux|GNU|GNU/*)
LIBC=gnu
#endif
EOF
- eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+ eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
;;
esac
@@ -826,7 +826,7 @@ EOF
*:MINGW*:*)
echo ${UNAME_MACHINE}-pc-mingw32
exit ;;
- i*:MSYS*:*)
+ *:MSYS*:*)
echo ${UNAME_MACHINE}-pc-msys
exit ;;
i*:windows32*:*)
@@ -969,10 +969,10 @@ EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
;;
- or1k:Linux:*:*)
- echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+ openrisc*:Linux:*:*)
+ echo or1k-unknown-linux-${LIBC}
exit ;;
- or32:Linux:*:*)
+ or32:Linux:*:* | or1k*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
padre:Linux:*:*)
@@ -1260,16 +1260,26 @@ EOF
if test "$UNAME_PROCESSOR" = unknown ; then
UNAME_PROCESSOR=powerpc
fi
- if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
- if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
- (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
- grep IS_64BIT_ARCH >/dev/null
- then
- case $UNAME_PROCESSOR in
- i386) UNAME_PROCESSOR=x86_64 ;;
- powerpc) UNAME_PROCESSOR=powerpc64 ;;
- esac
+ if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
+ if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+ if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+ grep IS_64BIT_ARCH >/dev/null
+ then
+ case $UNAME_PROCESSOR in
+ i386) UNAME_PROCESSOR=x86_64 ;;
+ powerpc) UNAME_PROCESSOR=powerpc64 ;;
+ esac
+ fi
fi
+ elif test "$UNAME_PROCESSOR" = i386 ; then
+ # Avoid executing cc on OS X 10.9, as it ships with a stub
+ # that puts up a graphical alert prompting to install
+ # developer tools. Any system running Mac OS X 10.7 or
+ # later (Darwin 11 and later) is required to have a 64-bit
+ # processor. This is not true of the ARM version of Darwin
+ # that Apple uses in portable devices.
+ UNAME_PROCESSOR=x86_64
fi
echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
exit ;;
@@ -1361,154 +1371,6 @@ EOF
exit ;;
esac
-eval $set_cc_for_build
-cat >$dummy.c <<EOF
-#ifdef _SEQUENT_
-# include <sys/types.h>
-# include <sys/utsname.h>
-#endif
-main ()
-{
-#if defined (sony)
-#if defined (MIPSEB)
- /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed,
- I don't know.... */
- printf ("mips-sony-bsd\n"); exit (0);
-#else
-#include <sys/param.h>
- printf ("m68k-sony-newsos%s\n",
-#ifdef NEWSOS4
- "4"
-#else
- ""
-#endif
- ); exit (0);
-#endif
-#endif
-
-#if defined (__arm) && defined (__acorn) && defined (__unix)
- printf ("arm-acorn-riscix\n"); exit (0);
-#endif
-
-#if defined (hp300) && !defined (hpux)
- printf ("m68k-hp-bsd\n"); exit (0);
-#endif
-
-#if defined (NeXT)
-#if !defined (__ARCHITECTURE__)
-#define __ARCHITECTURE__ "m68k"
-#endif
- int version;
- version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
- if (version < 4)
- printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
- else
- printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
- exit (0);
-#endif
-
-#if defined (MULTIMAX) || defined (n16)
-#if defined (UMAXV)
- printf ("ns32k-encore-sysv\n"); exit (0);
-#else
-#if defined (CMU)
- printf ("ns32k-encore-mach\n"); exit (0);
-#else
- printf ("ns32k-encore-bsd\n"); exit (0);
-#endif
-#endif
-#endif
-
-#if defined (__386BSD__)
- printf ("i386-pc-bsd\n"); exit (0);
-#endif
-
-#if defined (sequent)
-#if defined (i386)
- printf ("i386-sequent-dynix\n"); exit (0);
-#endif
-#if defined (ns32000)
- printf ("ns32k-sequent-dynix\n"); exit (0);
-#endif
-#endif
-
-#if defined (_SEQUENT_)
- struct utsname un;
-
- uname(&un);
-
- if (strncmp(un.version, "V2", 2) == 0) {
- printf ("i386-sequent-ptx2\n"); exit (0);
- }
- if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
- printf ("i386-sequent-ptx1\n"); exit (0);
- }
- printf ("i386-sequent-ptx\n"); exit (0);
-
-#endif
-
-#if defined (vax)
-# if !defined (ultrix)
-# include <sys/param.h>
-# if defined (BSD)
-# if BSD == 43
- printf ("vax-dec-bsd4.3\n"); exit (0);
-# else
-# if BSD == 199006
- printf ("vax-dec-bsd4.3reno\n"); exit (0);
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# endif
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# else
- printf ("vax-dec-ultrix\n"); exit (0);
-# endif
-#endif
-
-#if defined (alliant) && defined (i860)
- printf ("i860-alliant-bsd\n"); exit (0);
-#endif
-
- exit (1);
-}
-EOF
-
-$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
- { echo "$SYSTEM_NAME"; exit; }
-
-# Apollos put the system type in the environment.
-
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
-
-# Convex versions that predate uname can use getsysinfo(1)
-
-if [ -x /usr/convex/getsysinfo ]
-then
- case `getsysinfo -f cpu_type` in
- c1*)
- echo c1-convex-bsd
- exit ;;
- c2*)
- if getsysinfo -f scalar_acc
- then echo c32-convex-bsd
- else echo c2-convex-bsd
- fi
- exit ;;
- c34*)
- echo c34-convex-bsd
- exit ;;
- c38*)
- echo c38-convex-bsd
- exit ;;
- c4*)
- echo c4-convex-bsd
- exit ;;
- esac
-fi
-
cat >&2 <<EOF
$0: unable to guess system type
diff --git a/config.sub b/config.sub
index c765b34..66c5074 100755
--- a/config.sub
+++ b/config.sub
@@ -1,8 +1,8 @@
#! /bin/sh
# Configuration validation subroutine script.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-04-24'
+timestamp='2014-07-28'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -68,7 +68,7 @@ Report bugs and patches to <config-patches(a)gnu.org>."
version="\
GNU config.sub ($timestamp)
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -257,7 +257,7 @@ case $basic_machine in
| avr | avr32 \
| be32 | be64 \
| bfin \
- | c4x | clipper \
+ | c4x | c8051 | clipper \
| d10v | d30v | dlx | dsp16xx \
| epiphany \
| fido | fr30 | frv \
@@ -265,6 +265,7 @@ case $basic_machine in
| hexagon \
| i370 | i860 | i960 | ia64 \
| ip2k | iq2000 \
+ | k1om \
| le32 | le64 \
| lm32 \
| m32c | m32r | m32rle | m68000 | m68k | m88k \
@@ -282,8 +283,10 @@ case $basic_machine in
| mips64vr5900 | mips64vr5900el \
| mipsisa32 | mipsisa32el \
| mipsisa32r2 | mipsisa32r2el \
+ | mipsisa32r6 | mipsisa32r6el \
| mipsisa64 | mipsisa64el \
| mipsisa64r2 | mipsisa64r2el \
+ | mipsisa64r6 | mipsisa64r6el \
| mipsisa64sb1 | mipsisa64sb1el \
| mipsisa64sr71k | mipsisa64sr71kel \
| mipsr5900 | mipsr5900el \
@@ -295,8 +298,7 @@ case $basic_machine in
| nds32 | nds32le | nds32be \
| nios | nios2 | nios2eb | nios2el \
| ns16k | ns32k \
- | open8 \
- | or1k | or32 \
+ | open8 | or1k | or1knd | or32 \
| pdp10 | pdp11 | pj | pjl \
| powerpc | powerpc64 | powerpc64le | powerpcle \
| pyramid \
@@ -324,7 +326,7 @@ case $basic_machine in
c6x)
basic_machine=tic6x-unknown
;;
- m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip)
+ m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
basic_machine=$basic_machine-unknown
os=-none
;;
@@ -372,7 +374,7 @@ case $basic_machine in
| be32-* | be64-* \
| bfin-* | bs2000-* \
| c[123]* | c30-* | [cjt]90-* | c4x-* \
- | clipper-* | craynv-* | cydra-* \
+ | c8051-* | clipper-* | craynv-* | cydra-* \
| d10v-* | d30v-* | dlx-* \
| elxsi-* \
| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
@@ -381,6 +383,7 @@ case $basic_machine in
| hexagon-* \
| i*86-* | i860-* | i960-* | ia64-* \
| ip2k-* | iq2000-* \
+ | k1om-* \
| le32-* | le64-* \
| lm32-* \
| m32c-* | m32r-* | m32rle-* \
@@ -400,8 +403,10 @@ case $basic_machine in
| mips64vr5900-* | mips64vr5900el-* \
| mipsisa32-* | mipsisa32el-* \
| mipsisa32r2-* | mipsisa32r2el-* \
+ | mipsisa32r6-* | mipsisa32r6el-* \
| mipsisa64-* | mipsisa64el-* \
| mipsisa64r2-* | mipsisa64r2el-* \
+ | mipsisa64r6-* | mipsisa64r6el-* \
| mipsisa64sb1-* | mipsisa64sb1el-* \
| mipsisa64sr71k-* | mipsisa64sr71kel-* \
| mipsr5900-* | mipsr5900el-* \
@@ -413,6 +418,7 @@ case $basic_machine in
| nios-* | nios2-* | nios2eb-* | nios2el-* \
| none-* | np1-* | ns16k-* | ns32k-* \
| open8-* \
+ | or1k*-* \
| orion-* \
| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
@@ -794,7 +800,7 @@ case $basic_machine in
os=-mingw64
;;
mingw32)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-mingw32
;;
mingw32ce)
@@ -822,6 +828,10 @@ case $basic_machine in
basic_machine=powerpc-unknown
os=-morphos
;;
+ moxiebox)
+ basic_machine=moxie-unknown
+ os=-moxiebox
+ ;;
msdos)
basic_machine=i386-pc
os=-msdos
@@ -830,7 +840,7 @@ case $basic_machine in
basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
;;
msys)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-msys
;;
mvs)
@@ -1367,14 +1377,14 @@ case $os in
| -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
| -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
| -linux-newlib* | -linux-musl* | -linux-uclibc* \
- | -uxpv* | -beos* | -mpeix* | -udk* \
+ | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
| -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
| -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
| -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
| -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
| -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
| -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
- | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
+ | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
# Remember, each alternative MUST END IN *, to match a version number.
;;
-qnx*)
@@ -1546,6 +1556,9 @@ case $basic_machine in
c4x-* | tic4x-*)
os=-coff
;;
+ c8051-*)
+ os=-elf
+ ;;
hexagon-*)
os=-elf
;;
@@ -1589,9 +1602,6 @@ case $basic_machine in
mips*-*)
os=-elf
;;
- or1k-*)
- os=-elf
- ;;
or32-*)
os=-coff
;;
diff --git a/dirsrvtests/tickets/ticket47462_test.py b/dirsrvtests/tickets/ticket47462_test.py
new file mode 100644
index 0000000..a909b37
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47462_test.py
@@ -0,0 +1,452 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import time
+import logging
+import pytest
+import re
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+from lib389._constants import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
+installation1_prefix = None
+installation2_prefix = None
+
+DES_PLUGIN = 'cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config'
+AES_PLUGIN = 'cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config'
+MMR_PLUGIN = 'cn=Multimaster Replication Plugin,cn=plugins,cn=config'
+AGMT_DN = ''
+USER_DN = 'cn=test_user,' + DEFAULT_SUFFIX
+USER1_DN = 'cn=test_user1,' + DEFAULT_SUFFIX
+TEST_REPL_DN = 'cn=test repl,' + DEFAULT_SUFFIX
+
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ At the beginning, It may exists a master2 instance and/or a master2 instance.
+ It may also exists a backup for the master1 and/or the master2.
+
+ Principle:
+ If master1 instance exists:
+ restart it
+ If master2 instance exists:
+ restart it
+ If backup of master1 AND backup of master2 exists:
+ create or rebind to master1
+ create or rebind to master2
+
+ restore master1 from backup
+ restore master2 from backup
+ else:
+ Cleanup everything
+ remove instances
+ remove backups
+ Create instances
+ Initialize replication
+ Create backups
+ '''
+ global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+ # Get the status of the backups
+ backup_master1 = master1.checkBackupFS()
+ backup_master2 = master2.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.stop(timeout=10)
+ master1.start(timeout=10)
+
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.stop(timeout=10)
+ master2.start(timeout=10)
+
+ if backup_master1 and backup_master2:
+ # The backups exist, assuming they are correct
+ # we just re-init the instances with them
+ if not instance_master1:
+ master1.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master1.open()
+
+ if not instance_master2:
+ master2.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master2.open()
+
+ # restore master1 from backup
+ master1.stop(timeout=10)
+ master1.restoreFS(backup_master1)
+ master1.start(timeout=10)
+
+ # restore master2 from backup
+ master2.stop(timeout=10)
+ master2.restoreFS(backup_master2)
+ master2.start(timeout=10)
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve master-consumer
+ # so we need to create everything
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove all the backups. So even if we have a specific backup file
+ # (e.g backup_master) we clear all backups that an instance my have created
+ if backup_master1:
+ master1.clearBackupFS()
+ if backup_master2:
+ master2.clearBackupFS()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ AGMT_DN = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ master1.agreement
+ if not AGMT_DN:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % AGMT_DN)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=DEFAULT_SUFFIX, host=master1.host, port=master1.port, properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(AGMT_DN)
+
+ # Check replication is working fine
+ master1.add_s(Entry((TEST_REPL_DN, {'objectclass': "top person".split(),
+ 'sn': 'test_repl',
+ 'cn': 'test_repl'})))
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication is not working!')
+ assert False
+
+ # Time to create the backups
+ master1.stop(timeout=10)
+ master1.backupfile = master1.backupFS()
+ master1.start(timeout=10)
+
+ master2.stop(timeout=10)
+ master2.backupfile = master2.backupFS()
+ master2.start(timeout=10)
+
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
+
+ #
+ # Here we have two instances master and consumer
+ # with replication working. Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyMaster1Master2(master1, master2)
+
+
+def test_ticket47462(topology):
+ """
+ Test that AES properly replaces DES during an update/restart, and that
+ replication also works correctly.
+ """
+
+ #
+ # First set config as if it's an older version. Set DES to use libdes-plugin,
+ # MMR to depend on DES, delete the existing AES plugin, and set a DES password
+ # for the replication agreement.
+ #
+
+ #
+ # Add an extra attribute to the DES plugin args
+ #
+ try:
+ topology.master1.modify_s(DES_PLUGIN,
+ [(ldap.MOD_REPLACE, 'nsslapd-pluginPath', 'libdes-plugin'),
+ (ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')])
+
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.master1.modify_s(MMR_PLUGIN,
+ [(ldap.MOD_DELETE, 'nsslapd-plugin-depends-on-named', 'AES')])
+
+ except ldap.NO_SUCH_ATTRIBUTE:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ #
+ # Delete the AES plugin
+ #
+ try:
+ topology.master1.delete_s(AES_PLUGIN)
+ except ldap.NO_SUCH_OBJECT:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to delete AES plugin, error: ' + e.message['desc'])
+ assert False
+
+ # restart the server so we must use DES plugin
+ topology.master1.restart(timeout=10)
+
+ #
+ # Get the agmt dn, and set the password
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'objectclass=nsDS5ReplicationAgreement')
+ if entry:
+ agmt_dn = entry[0].dn
+ log.info('Found agmt dn (%s)' % agmt_dn)
+ else:
+ log.fatal('No replication agreements!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ try:
+ properties = {RA_BINDPW: "password"}
+ topology.master1.agreement.setProperties(None, agmt_dn, None, properties)
+ log.info('Successfully modified replication agreement')
+ except ValueError:
+ log.error('Failed to update replica agreement: ' + AGMT_DN)
+ assert False
+
+ #
+ # Check replication works with the new DES password
+ #
+ try:
+ topology.master1.add_s(Entry((USER1_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER1_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed fo user1!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # Run the upgrade...
+ #
+ topology.master1.upgrade('online')
+ topology.master1.restart(timeout=10)
+ topology.master2.restart(timeout=10)
+
+ #
+ # Check that the restart converted existing DES credentials
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'nsDS5ReplicaCredentials=*')
+ if entry:
+ val = entry[0].getValue('nsDS5ReplicaCredentials')
+ if val.startswith('{AES-'):
+ log.info('The DES credentials have been converted to AES')
+ else:
+ log.fatal('Failed to convert credentials from DES to AES!')
+ assert False
+ else:
+ log.fatal('Failed to find any entries with nsDS5ReplicaCredentials ')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the AES plugin exists, and has all the attributes listed in DES plugin.
+ # The attributes might not be in the expected order so check all the attributes.
+ #
+ try:
+ entry = topology.master1.search_s(AES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginarg0', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg1', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg2', 'description'):
+ log.fatal('The AES plugin did not have the DES attribute copied over correctly')
+ assert False
+ else:
+ log.info('The AES plugin was correctly setup')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the MMR plugin was updated
+ #
+ try:
+ entry = topology.master1.search_s(MMR_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-plugin-depends-on-named', 'AES'):
+ log.fatal('The MMR Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The MMR plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the DES plugin was correctly updated
+ #
+ try:
+ entry = topology.master1.search_s(DES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginPath', 'libpbe-plugin'):
+ log.fatal('The DES Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The DES plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check replication one last time
+ #
+ try:
+ topology.master1.add_s(Entry((USER_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # If we got here the test passed
+ #
+ log.info('Test PASSED')
+
+
+def test_ticket47462_final(topology):
+ topology.master1.stop(timeout=10)
+ topology.master2.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation1_prefix
+ global installation2_prefix
+ installation1_prefix = None
+ installation2_prefix = None
+
+ topo = topology(True)
+ test_ticket47462(topo)
+
+if __name__ == '__main__':
+ run_isolated()
diff --git a/ldap/admin/src/scripts/50AES-pbe-plugin.ldif b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
new file mode 100644
index 0000000..564ceae
--- /dev/null
+++ b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
@@ -0,0 +1,16 @@
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginprecedence: 1
+nsslapd-pluginid: ID
+nsslapd-pluginDescription: DESC
+nsslapd-pluginVersion: PACKAGE_VERSION
+nsslapd-pluginVendor: VENDOR
diff --git a/ldap/admin/src/scripts/52updateAESplugin.pl b/ldap/admin/src/scripts/52updateAESplugin.pl
new file mode 100644
index 0000000..6a8a885
--- /dev/null
+++ b/ldap/admin/src/scripts/52updateAESplugin.pl
@@ -0,0 +1,84 @@
+use Mozilla::LDAP::Conn;
+use Mozilla::LDAP::Entry;
+use Mozilla::LDAP::Utils qw(normalizeDN);
+use Mozilla::LDAP::API qw(:constant ldap_url_parse ldap_explode_dn);
+use File::Basename;
+use File::Copy;
+use DSUtil qw(debug serverIsRunning);
+
+#
+# Check if there is a DES plugin and make sure the AES plugin contains the same attributes
+#
+sub runinst {
+ my ($inf, $inst, $dseldif, $conn) = @_;
+ my @attrs;
+ my @attrs_to_add;
+ my $aes_count = 0;
+ my $des_count = 0;
+ my $i = 0;
+
+ my $aes_dn = "cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $aes_entry = $conn->search($aes_dn, "base", "(cn=*)");
+ if (!$aes_entry) {
+ # No AES plugin - nothing to do
+ return ();
+ }
+
+ # We need to grab the AES plugin args...
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $aes_entry->getValues($argattr);
+ if($val ne ""){
+ $attrs[$aes_count] = $val;
+ $aes_count++;
+ } else {
+ last;
+ }
+ $i++;
+ }
+
+ # Grab the DES plugin
+ my $des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $des_entry = $conn->search($des_dn, "base", "(cn=*)");
+ if (!$des_entry) {
+ # No DES plugin - nothing to do
+ return ();
+ }
+
+ # We need to check the DES plugin args against the AES args.
+ $i = 0;
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $des_entry->getValues($argattr);
+ if($val eq ""){
+ last;
+ }
+ if(!($val ~~ @attrs) ){
+ $attrs_to_add[$des_count] = $val;
+ $des_count++;
+ }
+ $i++;
+ }
+
+ # Add the missing attributes to the AES plugin
+ if($#attrs_to_add >= 0){
+ foreach $val (@attrs_to_add){
+ $aes_entry->addValue("nsslapd-pluginarg" . $aes_count, $val);
+ $aes_count++;
+ }
+ $conn->update($aes_entry);
+ }
+
+ # Change replication plugin dependency from DES to AES
+ my $mmr_entry = $conn->search("cn=Multimaster Replication Plugin,cn=plugins,cn=config", "base", "(cn=*)");
+ $mmr_entry->removeValue("nsslapd-plugin-depends-on-named", "DES");
+ $mmr_entry->addValue("nsslapd-plugin-depends-on-named", "AES");
+ $conn->update($mmr_entry);
+
+ # Change the des plugin to use the new libpbe-plugin library
+ $des_entry->{"nsslapd-pluginPath"} = [ "libpbe-plugin" ];
+ $conn->update($des_entry);
+
+ return ();
+}
+
diff --git a/ldap/ldif/50replication-plugins.ldif b/ldap/ldif/50replication-plugins.ldif
index 0b4924c..71afbea 100644
--- a/ldap/ldif/50replication-plugins.ldif
+++ b/ldap/ldif/50replication-plugins.ldif
@@ -22,6 +22,6 @@ nsslapd-plugintype: object
nsslapd-pluginbetxn: on
nsslapd-pluginenabled: on
nsslapd-plugin-depends-on-named: ldbm database
-nsslapd-plugin-depends-on-named: DES
+nsslapd-plugin-depends-on-named: AES
nsslapd-plugin-depends-on-named: Class of Service
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index 720ebad..6acbfae 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -207,12 +207,26 @@ nsslapd-plugininitfunc: ns_mta_md5_pwd_storage_scheme_init
nsslapd-plugintype: pwdstoragescheme
nsslapd-pluginenabled: on
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginid: aes-storage-scheme
+nsslapd-pluginprecedence: 1
+
dn: cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config
objectclass: top
objectclass: nsSlapdPlugin
objectclass: extensibleObject
cn: DES
-nsslapd-pluginpath: libdes-plugin
+nsslapd-pluginpath: libpbe-plugin
nsslapd-plugininitfunc: des_init
nsslapd-plugintype: reverpwdstoragescheme
nsslapd-pluginenabled: on
diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c
deleted file mode 100644
index 73830f0..0000000
--- a/ldap/servers/plugins/rever/des.c
+++ /dev/null
@@ -1,551 +0,0 @@
-/** BEGIN COPYRIGHT BLOCK
- * This Program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; version 2 of the License.
- *
- * This Program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place, Suite 330, Boston, MA 02111-1307 USA.
- *
- * In addition, as a special exception, Red Hat, Inc. gives You the additional
- * right to link the code of this Program with code not covered under the GNU
- * General Public License ("Non-GPL Code") and to distribute linked combinations
- * including the two, subject to the limitations in this paragraph. Non-GPL Code
- * permitted under this exception must only link to the code of this Program
- * through those well defined interfaces identified in the file named EXCEPTION
- * found in the source code files (the "Approved Interfaces"). The files of
- * Non-GPL Code may instantiate templates or use macros or inline functions from
- * the Approved Interfaces without causing the resulting work to be covered by
- * the GNU General Public License. Only Red Hat, Inc. may make changes or
- * additions to the list of Approved Interfaces. You must obey the GNU General
- * Public License in all respects for all of the Program code and other code used
- * in conjunction with the Program except the Non-GPL Code covered by this
- * exception. If you modify this file, you may extend this exception to your
- * version of the file, but you are not obligated to do so. If you do not wish to
- * provide this exception without modification, you must delete this exception
- * statement from your version and license this file solely under the GPL without
- * exception.
- *
- *
- * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
- * Copyright (C) 2005 Red Hat, Inc.
- * All rights reserved.
- * END COPYRIGHT BLOCK **/
-
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-#endif
-
-/* from /usr/project/iplanet/ws/ds5.ke/ns/svrcore/pkcs7/tstarchive.c */
-
-#include <string.h>
-#include <stdio.h>
-
-#include <ldap.h>
-#include <nspr.h>
-#include <nss.h>
-#include <secmod.h>
-/*
-#include <secasn1.h>
-#include <secpkcs7.h>
-*/
-#include <key.h>
-#include <certdb.h>
-#include <cert.h>
-#include <svrcore.h>
-#include <secmodt.h>
-#include <prtypes.h>
-#include <seccomon.h>
-#include <pk11func.h>
-
-#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */
-#include "rever.h"
-#include <slap.h>
-#include "slapi-plugin.h"
-#include <uuid.h>
-
-
-struct pk11MechItem
-{
- CK_MECHANISM_TYPE type;
- const char *mechName;
-};
-static const struct pk11MechItem mymech = { CKM_DES_CBC, "DES CBC encryption" };
-
-
-static Slapi_Mutex *mylock = NULL;
-
-struct pk11ContextStore
-{
- PK11SlotInfo *slot;
- const struct pk11MechItem *mech;
-
- PK11SymKey *key;
- SECItem *params;
-
- int length;
- unsigned char *crypt;
-};
-
-static int encode_path(char *inPlain, char **outCipher, char *path);
-static int decode_path(char *inCipher, char **outPlain, char *path);
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path);
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
-static void freeDes(struct pk11ContextStore *out);
-
-void
-init_des_plugin()
-{
- mylock = slapi_new_mutex();
-}
-
-int
-encode(char *inPlain, char **outCipher)
-{
- return encode_path(inPlain, outCipher, NULL);
-}
-
-static int
-encode_path(char *inPlain, char **outCipher, char *path)
-{
- struct pk11ContextStore *context = NULL;
- int err;
-
- unsigned char *cipher = NULL;
- char *tmp = NULL;
- char *base = NULL;
-
-
- *outCipher = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* Try an encryption */
- if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success )
- {
- base = BTOA_DataToAscii(cipher, context->length);
- if ( base != NULL )
- {
- tmp = slapi_ch_malloc( 3 + strlen(REVER_SCHEME_NAME) + strlen(base));
- if ( tmp != NULL )
- {
- sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, REVER_SCHEME_NAME, PWD_HASH_PREFIX_END, base);
- *outCipher = tmp;
- tmp = NULL;
- err = 0;
- }
- PORT_Free(base);
- }
- }
- }
-
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-int
-decode(char *inCipher, char **outPlain)
-{
- return decode_path(inCipher, outPlain, NULL);
-}
-
-
-static int
-decode_path(char *inCipher, char **outPlain, char *path)
-{
- struct pk11ContextStore *context = NULL;
- char *plain= NULL;
- int err;
-
- unsigned char *base = NULL;
- int len = 0;
-
-
- *outPlain = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* it seems that there is memory leak in that function: bug 400170 */
-
- base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
- if ( base != NULL )
- {
- if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success )
- {
- *outPlain = plain;
- err = 0;
- }
- }
- }
-
- PORT_Free(base);
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-static void freeDes(struct pk11ContextStore *out)
-{
- if (out)
- {
- if (out->slot)
- slapd_pk11_freeSlot(out->slot);
- if (out->key)
- slapd_pk11_freeSymKey(out->key);
- if (out->params)
- SECITEM_FreeItem(out->params,PR_TRUE);
- if (out->crypt)
- free(out->crypt);
- }
-}
-
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path)
-{
- SVRCOREError err = SVRCORE_Success;
- struct pk11ContextStore *store = NULL;
- SECItem *pwitem = NULL;
- SECItem *result = NULL;
- SECAlgorithmID *algid = NULL;
- SECOidTag algoid;
- SECItem *salt = NULL;
- CK_MECHANISM pbeMech;
- CK_MECHANISM cryptoMech;
-
- char *configdir = NULL;
- char *iv = NULL;
-
- store = (struct pk11ContextStore*)slapi_ch_malloc(sizeof(*store));
- if (store == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- *out = store;
-
- /* Low-level init */
- store->slot = NULL;
- store->key = NULL;
- store->params = NULL;
- store->crypt = NULL;
-
- /* Use the tokenName to find a PKCS11 slot */
- store->slot = slapd_pk11_findSlotByName((char *)token);
- if (store->slot == NULL)
- {
- err = SVRCORE_NoSuchToken_Error;
- goto done;
- }
-
- /* Generate a key and parameters to do the encryption */
- store->mech = &mymech;
-
- /* Generate a unique id, used as salt for the key generation */
- if ( path == NULL )
- {
- configdir = config_get_configdir();
- if ( configdir == NULL )
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- }
- else
- {
- configdir = slapi_ch_strdup(path);
- }
- if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS )
- {
- slapi_ch_free((void**)&configdir);
- err = SVRCORE_System_Error;
- goto done;
- }
- slapi_ch_free((void**)&configdir);
-
- pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (pwitem == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- pwitem->type = siBuffer;
- pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if (pwitem->data == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)pwitem->data, iv);
- pwitem->len = strlen(iv) + 1;
-
- algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
-
- salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (salt == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- salt->type = siBuffer;
- salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if ( salt->data == NULL )
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)salt->data, iv);
- salt->len = strlen(iv) + 1;
-
- algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
-
- slapi_lock_mutex(mylock);
- store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
- if (store->key == 0)
- {
- slapi_unlock_mutex(mylock);
- err = SVRCORE_System_Error;
- goto done;
- }
-
- slapi_unlock_mutex(mylock);
- pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
- result = slapd_pk11_paramFromAlgid(algid);
- secoid_destroyAlgorithmID(algid, PR_TRUE);
- pbeMech.pParameter = result->data;
- pbeMech.ulParameterLen = result->len;
- if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
- PR_FALSE) != CKR_OK)
- {
- SECITEM_FreeItem(result, PR_TRUE);
- err = SVRCORE_System_Error;
- goto done;
- }
- SECITEM_FreeItem(result, PR_TRUE);
- SECITEM_FreeItem(pwitem, PR_TRUE);
- SECITEM_FreeItem(salt, PR_TRUE);
- store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (store->params == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- store->params->type = store->mech->type;
- store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
- if (store->params->data == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
- store->params->len = cryptoMech.ulParameterLen;
- PORT_Free(cryptoMech.pParameter);
-
-done:
- slapi_ch_free((void**)&iv);
- return (err);
-}
-
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
-{
- SVRCOREError err = SVRCORE_Success;
- unsigned char *plain = NULL;
- unsigned char *cipher_with_padding = NULL;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = len;
-
- /* store->length is the max. length of the returned clear text -
- must be >= length of crypted bytes - also must be a multiple
- of blocksize */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* plain will hold the returned clear text */
- plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!plain)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer holding the original cipher bytes, padded with
- zeros to a multiple of blocksize - do not need +1 since buffer is not
- a string */
- cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length);
- if (!cipher_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- memcpy(cipher_with_padding, cipher, len);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- /* warning - there is a purify UMR in the NSS des code - you may see it when the
- password is not a multiple of 8 bytes long */
- rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
- cipher_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- {
- *out = (char *)plain;
- }
- else
- {
- slapi_ch_free((void **)&plain);
- }
-
- slapi_ch_free((void **)&cipher_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
-{
- SVRCOREError err = SVRCORE_Success;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
- unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = strlen(clear);
-
- /* the size of the clear text buffer passed to the des encryption functions
- must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
- of this size, copy the clear text password into it, and pad the rest with
- zeros */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* store->crypt will hold the crypted password - it must be >= clear length */
- /* store->crypt is freed in NSS; let's not use slapi_ch_calloc */
- store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
- store->length+1);
- if (!store->crypt)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer big enough to hold the clear text password and padding */
- clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!clear_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- /* copy the clear text password into the buffer - the calloc insures the
- remainder is zero padded */
- strcpy((char *)clear_with_padding, clear);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
- clear_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- *out = store->crypt;
-
- slapi_ch_free((void **)&clear_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-/*
- The UUID name based generator was broken on x86 platforms. We use
- this to generate the password encryption key. During migration,
- we have to fix this so we can use the fixed generator. The env.
- var USE_BROKEN_UUID tells the uuid generator to use the old
- broken method to create the UUID. That will allow us to decrypt
- the password to the correct clear text, then we can turn off
- the broken method and use the fixed method to encrypt the
- password.
-*/
-char *
-migrateCredentials(char *oldpath, char *newpath, char *oldcred)
-{
- static char *useBrokenUUID = "USE_BROKEN_UUID=1";
- static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
- char *plain = NULL;
- char *cipher = NULL;
-
- init_des_plugin();
-
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
- NSS_NoDB_Init(NULL);
-
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(useBrokenUUID);
- }
-
- if ( decode_path(oldcred, &plain, oldpath) == 0 )
- {
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(disableBrokenUUID);
- }
- if ( encode_path(plain, &cipher, newpath) != 0 )
- return(NULL);
- else
- return(cipher);
- }
- else
- return(NULL);
-}
diff --git a/ldap/servers/plugins/rever/pbe.c b/ldap/servers/plugins/rever/pbe.c
new file mode 100644
index 0000000..abb8d1b
--- /dev/null
+++ b/ldap/servers/plugins/rever/pbe.c
@@ -0,0 +1,621 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This Program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; version 2 of the License.
+ *
+ * This Program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * In addition, as a special exception, Red Hat, Inc. gives You the additional
+ * right to link the code of this Program with code not covered under the GNU
+ * General Public License ("Non-GPL Code") and to distribute linked combinations
+ * including the two, subject to the limitations in this paragraph. Non-GPL Code
+ * permitted under this exception must only link to the code of this Program
+ * through those well defined interfaces identified in the file named EXCEPTION
+ * found in the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline functions from
+ * the Approved Interfaces without causing the resulting work to be covered by
+ * the GNU General Public License. Only Red Hat, Inc. may make changes or
+ * additions to the list of Approved Interfaces. You must obey the GNU General
+ * Public License in all respects for all of the Program code and other code used
+ * in conjunction with the Program except the Non-GPL Code covered by this
+ * exception. If you modify this file, you may extend this exception to your
+ * version of the file, but you are not obligated to do so. If you do not wish to
+ * provide this exception without modification, you must delete this exception
+ * statement from your version and license this file solely under the GPL without
+ * exception.
+ *
+ *
+ * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
+ * Copyright (C) 2015 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <string.h>
+#include <stdio.h>
+
+#include <ldap.h>
+#include <nspr.h>
+#include <nss.h>
+#include <secmod.h>
+/*
+#include <secasn1.h>
+#include <secpkcs7.h>
+*/
+#include <key.h>
+#include <certdb.h>
+#include <cert.h>
+#include <svrcore.h>
+#include <secmodt.h>
+#include <prtypes.h>
+#include <seccomon.h>
+#include <pk11func.h>
+
+#define NEED_TOK_PBE /* see slap.h - defines tokPBE and ptokPBE */
+#include "rever.h"
+#include <slap.h>
+#include "slapi-plugin.h"
+#include <uuid.h>
+#include <plbase64.h>
+
+struct pk11MechItem
+{
+ CK_MECHANISM_TYPE type;
+ const char *mechName;
+};
+
+static const struct pk11MechItem DESmech = { CKM_DES_CBC, "DES CBC encryption" };
+static const struct pk11MechItem AESmech = { CKM_AES_CBC, "AES CBC encryption" };
+static Slapi_Mutex *pbe_lock = NULL;
+
+struct pk11ContextStore
+{
+ PK11SlotInfo *slot;
+ const struct pk11MechItem *mech;
+ PK11SymKey *key;
+ SECItem *params;
+ int length;
+ unsigned char *crypt;
+ char *algid_base64;
+};
+
+/*
+ * der_algid converting functions:
+ *
+ * SECStatus ATOB_ConvertAsciiToItem(SECItem *binary_item, const char *ascii);
+ * char * BTOA_ConvertItemToAscii(SECItem *binary_item);
+ *
+ */
+
+static int encode_path(char *inPlain, char **outCipher, char *path, int mech);
+static int decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid);
+static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *algid);
+static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
+static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
+static void freePBE(struct pk11ContextStore *store);
+
+void
+init_pbe_plugin()
+{
+ if(!pbe_lock){
+ pbe_lock = slapi_new_mutex();
+ }
+}
+
+int
+encode(char *inPlain, char **outCipher, int mech)
+{
+ return encode_path(inPlain, outCipher, NULL, mech);
+}
+
+static int
+encode_path(char *inPlain, char **outCipher, char *path, int mech)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *cipher = NULL;
+ char *tmp = NULL;
+ char *base = NULL;
+ int len = 0;
+ int err;
+
+ *outCipher = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, NULL) == SVRCORE_Success ){
+ /* Try an encryption */
+ if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ){
+ base = BTOA_DataToAscii(cipher, context->length);
+ if ( base != NULL ){
+ const char *scheme;
+ if (mech == AES_MECH){
+ scheme = AES_REVER_SCHEME_NAME;
+ len = 3 + strlen(scheme)+ strlen(context->algid_base64) + strlen(base) + 1;
+ if( (tmp = slapi_ch_malloc( len )) ){
+ /*
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ sprintf( tmp, "%c%s-%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ context->algid_base64,PWD_HASH_PREFIX_END, base);
+ }
+ } else {
+ /* Old school DES */
+ scheme = DES_REVER_SCHEME_NAME;
+ if((tmp = slapi_ch_malloc( 3 + strlen(scheme) + strlen(base)))){
+ sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ PWD_HASH_PREFIX_END, base);
+ }
+ }
+ if ( tmp != NULL ){
+ *outCipher = tmp;
+ tmp = NULL;
+ err = 0;
+ }
+ PORT_Free(base);
+ }
+ }
+ }
+ freePBE(context);
+
+ return(err);
+}
+
+int
+decode(char *inCipher, char **outPlain, int mech, char *algid)
+{
+ return decode_path(inCipher, outPlain, NULL, mech, algid);
+}
+
+
+static int
+decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *base = NULL;
+ char *plain = NULL;
+ int err;
+ int len = 0;
+
+ *outPlain = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, algid) == SVRCORE_Success ){
+ /* it seems that there is memory leak in that function: bug 400170 */
+ base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
+ if ( base != NULL ){
+ if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ){
+ *outPlain = plain;
+ err = 0;
+ }
+ }
+ }
+
+ slapi_ch_free_string(&algid);
+ PORT_Free(base);
+ PORT_FreeArena(arena, PR_TRUE);
+ freePBE(context);
+
+ return(err);
+}
+
+static void
+freePBE(struct pk11ContextStore *store)
+{
+ if (store){
+ if (store->slot)
+ slapd_pk11_freeSlot(store->slot);
+ if (store->key)
+ slapd_pk11_freeSymKey(store->key);
+ if (store->params)
+ SECITEM_FreeItem(store->params, PR_TRUE);
+ slapi_ch_free((void **)&store->crypt);
+ slapi_ch_free_string(&store->algid_base64);
+ slapi_ch_free((void **)&store);
+ }
+}
+
+static SVRCOREError
+genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *alg)
+{
+ SVRCOREError err = SVRCORE_Success;
+ struct pk11ContextStore *store = NULL;
+ SECItem *pwitem = NULL;
+ SECItem *result = NULL;
+ SECItem *salt = NULL;
+ SECItem der_algid;
+ SECAlgorithmID *algid = NULL;
+ SECOidTag algoid;
+ CK_MECHANISM pbeMech;
+ CK_MECHANISM cryptoMech;
+ SECAlgorithmID my_algid;
+ char *configdir = NULL;
+ char *der_ascii = NULL;
+ char *iv = NULL;
+ int free_it = 0;
+
+ arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+
+ store = (struct pk11ContextStore*)slapi_ch_calloc(1, sizeof(*store));
+ if (store == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ *out = store;
+
+ /* Use the tokenName to find a PKCS11 slot */
+ store->slot = slapd_pk11_findSlotByName((char *)token);
+ if (store->slot == NULL){
+ err = SVRCORE_NoSuchToken_Error;
+ goto done;
+ }
+
+ /* Generate a key and parameters to do the encryption */
+ if(mech == AES_MECH){
+ store->mech = &AESmech;
+ algoid = SEC_OID_AES_256_CBC;
+ } else {
+ store->mech = &DESmech;
+ algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
+ }
+
+ /* Generate a unique id, used as salt for the key generation */
+ if ( path == NULL ){
+ configdir = config_get_configdir();
+ if ( configdir == NULL ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ } else {
+ configdir = slapi_ch_strdup(path);
+ }
+ if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (pwitem == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ pwitem->type = siBuffer;
+ pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if (pwitem->data == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)pwitem->data, iv);
+ pwitem->len = strlen(iv) + 1;
+
+ salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (salt == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ salt->type = siBuffer;
+ salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if ( salt->data == NULL ){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)salt->data, iv);
+ salt->len = strlen(iv) + 1;
+
+ PORT_Memset(&der_algid, 0, sizeof(der_algid));
+ if(!alg){
+ /*
+ * This is DES, or we are encoding AES - the process is the same.
+ */
+ algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
+ free_it = 1; /* we need to free this algid */
+
+ /*
+ * The following is only need for AES - we need to store
+ * algid for future decodings(unlike with DES). So convert
+ * algid to its DER encoding. Then convert the DER to ascii,
+ * and finally convert the DER ascii to base64 so we can store
+ * it in the cipher prefix.
+ */
+ SEC_ASN1EncodeItem(arena, &der_algid, algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate));
+ der_ascii = BTOA_ConvertItemToAscii(&der_algid);
+ store->algid_base64 = PL_Base64Encode(der_ascii,strlen(der_ascii), NULL);
+ slapi_ch_free_string(&der_ascii);
+ } else {
+ /*
+ * We are decoding AES - use the supplied algid
+ */
+ PORT_Memset(&my_algid, 0, sizeof(my_algid));
+
+ /* Decode the base64 der encoding */
+ der_ascii = PL_Base64Decode(alg, strlen(alg), NULL);
+
+ /* convert the der ascii to the SEC item */
+ ATOB_ConvertAsciiToItem(&der_algid, der_ascii);
+ SEC_ASN1DecodeItem(arena, &my_algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate), &der_algid);
+ SECITEM_FreeItem(&der_algid, PR_FALSE);
+ algid = &my_algid;
+ slapi_ch_free_string(&der_ascii);
+ }
+
+ slapi_lock_mutex(pbe_lock);
+ store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
+ if (store->key == 0){
+ slapi_unlock_mutex(pbe_lock);
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ slapi_unlock_mutex(pbe_lock);
+
+ if(mech == AES_MECH)
+ {
+ cryptoMech.mechanism = PK11_GetPBECryptoMechanism(algid, &store->params, pwitem);
+ if (cryptoMech.mechanism == CKM_INVALID_MECHANISM) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ }
+ else
+ {
+ /* DES */
+ pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
+ result = slapd_pk11_paramFromAlgid(algid);
+ if(result){
+ pbeMech.pParameter = result->data;
+ pbeMech.ulParameterLen = result->len;
+ }
+ if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
+ PR_FALSE) != CKR_OK){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (store->params == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ store->params->type = store->mech->type;
+ store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
+ if (store->params->data == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
+ store->params->len = cryptoMech.ulParameterLen;
+ PORT_Free(cryptoMech.pParameter);
+ }
+
+done:
+ SECITEM_FreeItem(result, PR_TRUE);
+ SECITEM_FreeItem(pwitem, PR_TRUE);
+ SECITEM_FreeItem(salt, PR_TRUE);
+ if(free_it){
+ secoid_destroyAlgorithmID(algid, PR_TRUE);
+ }
+ slapi_ch_free_string(&configdir);
+ slapi_ch_free_string(&iv);
+ if (arena) {
+ PORT_FreeArena(arena, PR_TRUE);
+ }
+ return (err);
+}
+
+static SVRCOREError
+decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
+{
+ SVRCOREError err = SVRCORE_Success;
+ unsigned char *plain = NULL;
+ unsigned char *cipher_with_padding = NULL;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ int outLen = 0;
+ int blocksize = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = len;
+
+ /*
+ * store->length is the max. length of the returned clear text -
+ * must be >= length of crypted bytes - also must be a multiple
+ * of blocksize
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /* plain will hold the returned clear text */
+ plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!plain){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /*
+ * create a buffer holding the original cipher bytes, padded with
+ * zeros to a multiple of blocksize - do not need +1 since buffer is not
+ * a string
+ */
+ cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length);
+ if (!cipher_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ memcpy(cipher_with_padding, cipher, len);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ /*
+ * Warning - there is a purify UMR in the NSS des code - you may see it when the
+ * password is not a multiple of 8 bytes long
+ */
+ rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
+ cipher_with_padding, store->length);
+ if (rv){
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err))
+ err = SVRCORE_System_Error;
+
+done:
+ if (err == SVRCORE_Success){
+ *out = (char *)plain;
+ } else {
+ slapi_ch_free((void **)&plain);
+ }
+
+ slapi_ch_free((void **)&cipher_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+static SVRCOREError
+cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
+{
+ SVRCOREError err = SVRCORE_Success;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
+ int blocksize = 0;
+ int outLen = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = strlen(clear);
+
+ /*
+ * The size of the clear text buffer passed to the encryption functions
+ * must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
+ * of this size, copy the clear text password into it, and pad the rest with
+ * zeros.
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /*
+ * store->crypt will hold the crypted password - it must be >= clear length
+ * store->crypt is freed in NSS; let's not use slapi_ch_calloc
+ */
+ store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!store->crypt) {
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /* Create a buffer big enough to hold the clear text password and padding */
+ clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!clear_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ /*
+ * Copy the clear text password into the buffer - the calloc insures the
+ * remainder is zero padded .
+ */
+ strcpy((char *)clear_with_padding, clear);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
+ clear_with_padding, store->length);
+ if (rv) {
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err)){
+ err = SVRCORE_System_Error;
+ }
+
+done:
+ if (err == SVRCORE_Success){
+ *out = store->crypt;
+ }
+
+ slapi_ch_free((void **)&clear_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+/*
+ * The UUID name based generator was broken on x86 platforms. We use
+ * this to generate the password encryption key. During migration,
+ * we have to fix this so we can use the fixed generator. The env.
+ * var USE_BROKEN_UUID tells the uuid generator to use the old
+ * broken method to create the UUID. That will allow us to decrypt
+ * the password to the correct clear text, then we can turn off
+ * the broken method and use the fixed method to encrypt the
+ * password.
+ */
+char *
+migrateCredentials(char *oldpath, char *newpath, char *oldcred)
+{
+ static char *useBrokenUUID = "USE_BROKEN_UUID=1";
+ static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
+ char *plain = NULL;
+ char *cipher = NULL;
+
+ init_pbe_plugin();
+
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
+ NSS_NoDB_Init(NULL);
+
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(useBrokenUUID);
+ }
+
+ if ( decode_path(oldcred, &plain, oldpath, DES_MECH, NULL) == 0 ){
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(disableBrokenUUID);
+ }
+ if ( encode_path(plain, &cipher, newpath, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return(cipher);
+ }
+ } else {
+ return(NULL);
+ }
+}
diff --git a/ldap/servers/plugins/rever/rever.c b/ldap/servers/plugins/rever/rever.c
index 9d7e82d..51d602f 100644
--- a/ldap/servers/plugins/rever/rever.c
+++ b/ldap/servers/plugins/rever/rever.c
@@ -43,25 +43,92 @@
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
-
#include "rever.h"
-static Slapi_PluginDesc pdesc = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_aes = { "aes-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "AES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_des = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+
static char *plugin_name = "ReverStoragePlugin";
+#define AES_MECH 1
+#define DES_MECH 2
+
+int
+aes_cmp( char *userpwd, char *dbpwd )
+{
+ char *cipher = NULL;
+ int rc = 0;
+
+ if ( encode(userpwd, &cipher, AES_MECH) != 0 ){
+ rc = 1;
+ } else {
+ rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
+
+ return rc;
+}
+
+char *
+aes_enc( char *pwd )
+{
+ char *cipher = NULL;
+
+ if ( encode(pwd, &cipher, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return( cipher );
+ }
+}
+
+char *
+aes_dec( char *pwd, char *alg )
+{
+ char *plain = NULL;
+
+ if ( decode(pwd, &plain, AES_MECH, alg) != 0 ){
+ return(NULL);
+ } else {
+ return( plain );
+ }
+}
+
+int
+aes_init( Slapi_PBlock *pb)
+{
+ char *name = slapi_ch_strdup(AES_REVER_SCHEME_NAME);
+ int rc;
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> aes_init\n" );
+
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_aes );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) aes_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) aes_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) aes_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= aes_init %d\n", rc );
+
+ return( rc );
+}
+
int
des_cmp( char *userpwd, char *dbpwd )
{
char *cipher = NULL;
int rc = 0;
- if ( encode(userpwd, &cipher) != 0 )
+ if ( encode(userpwd, &cipher, DES_MECH) != 0 ){
rc = 1;
- else
+ } else {
rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
- slapi_ch_free((void**)&cipher);
return rc;
}
@@ -70,10 +137,11 @@ des_enc( char *pwd )
{
char *cipher = NULL;
- if ( encode(pwd, &cipher) != 0 )
+ if ( encode(pwd, &cipher, DES_MECH ) != 0 ){
return(NULL);
- else
+ } else {
return( cipher );
+ }
}
char *
@@ -81,37 +149,31 @@ des_dec( char *pwd )
{
char *plain = NULL;
- if ( decode(pwd, &plain) != 0 )
+ if ( decode(pwd, &plain, DES_MECH, NULL) != 0 ){
return(NULL);
- else
+ } else {
return( plain );
+ }
}
int
des_init( Slapi_PBlock *pb )
{
+ char *name = slapi_ch_strdup(DES_REVER_SCHEME_NAME);
int rc;
- char *name;
slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> des_init\n" );
- rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
- (void *) SLAPI_PLUGIN_VERSION_01 );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION,
- (void *)&pdesc );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN,
- (void *) des_enc);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN,
- (void *) des_cmp );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN,
- (void *) des_dec );
- name = slapi_ch_strdup(REVER_SCHEME_NAME);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME,
- name );
-
- init_des_plugin();
-
- slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n\n", rc );
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_des );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) des_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) des_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) des_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n", rc );
return( rc );
}
diff --git a/ldap/servers/plugins/rever/rever.h b/ldap/servers/plugins/rever/rever.h
index 8ea6279..9edddd8 100644
--- a/ldap/servers/plugins/rever/rever.h
+++ b/ldap/servers/plugins/rever/rever.h
@@ -49,7 +49,10 @@
#include "slap.h"
#include "ldaplog.h"
-#define REVER_SCHEME_NAME "DES"
+#define AES_MECH 1
+#define DES_MECH 2
+#define AES_REVER_SCHEME_NAME "AES"
+#define DES_REVER_SCHEME_NAME "DES"
#define PWD_HASH_PREFIX_START '{'
#define PWD_HASH_PREFIX_END '}'
@@ -58,10 +61,10 @@ int rever_cmp( char *userpwd, char *dbpwd );
char *rever_enc( char *pwd );
char *rever_dec( char *pwd );
int rever_init( Slapi_PBlock *pb );
-void init_des_plugin();
+void init_pbe_plugin();
-int encode(char *inPlain, char ** outCipher);
-int decode(char *inCipher, char **outPlain);
+int encode(char *inPlain, char **outCipher, int mech);
+int decode(char *inCipher, char **outPlain, int mech, char *algid);
char *migrateCredentials(char *oldpath, char *newpath, char *oldcred);
typedef char *(*migrate_fn_type)(char *, char *, char *);
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 0c11238..3cb8451 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -937,6 +937,244 @@ handle_listeners(Connection_Table *ct, listener_info *listener_idxs, int n_liste
return;
}
+/*
+ * Convert any pre-existing DES passwords to AES.
+ *
+ * Grab the "password" attributes and search all the backends for
+ * these attributes and convert them to AES if they are DES encoded.
+ */
+static void
+convert_pbe_des_to_aes()
+{
+ Slapi_PBlock *pb = NULL;
+ Slapi_Entry **entries = NULL;
+ struct slapdplugin *plugin = NULL;
+ char **attrs = NULL;
+ char **backends = NULL;
+ char *val = NULL;
+ int converted_des = 0;
+ int result = -1;
+ int have_aes = 0;
+ int have_des = 0;
+ int i = 0, ii = 0, be_idx = 0;
+
+ /*
+ * Check that AES plugin is enabled, and grab all the unique
+ * password attributes.
+ */
+ for ( plugin = get_plugin_list(PLUGIN_LIST_REVER_PWD_STORAGE_SCHEME);
+ plugin != NULL;
+ plugin = plugin->plg_next )
+ {
+ char *arg = NULL;
+
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "AES") == 0){
+ /* We have the AES plugin, and its enabled */
+ have_aes = 1;
+ }
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "DES") == 0){
+ /* We have the DES plugin, and its enabled */
+ have_des = 1;
+ }
+ /* Gather all the unique password attributes from all the PBE plugins */
+ for ( i = 0, arg = plugin->plg_argv[i];
+ i < plugin->plg_argc;
+ arg = plugin->plg_argv[++i] )
+ {
+ if(charray_inlist(attrs, arg)){
+ continue;
+ }
+ charray_add(&attrs, slapi_ch_strdup(arg));
+ }
+ }
+
+ if(have_aes && have_des){
+ /*
+ * Build a list of all the backend dn's
+ */
+ Slapi_Backend *be = NULL;
+ struct suffixlist *list;
+ char *cookie = NULL;
+
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Converting DES passwords to AES...\n",0,0,0);
+
+ be = slapi_get_first_backend(&cookie);
+ while (be){
+ int suffix_idx = 0;
+ int count = slapi_counter_get_value(be->be_suffixcounter);
+
+ list = be->be_suffixlist;
+ for (suffix_idx = 0; list && suffix_idx < count; suffix_idx++) {
+ char *suffix = (char *)slapi_sdn_get_ndn(list->be_suffix);
+ if(charray_inlist(backends, suffix) || strlen(suffix) == 0){
+ list = list->next;
+ continue;
+ }
+ charray_add(&backends, slapi_ch_strdup(suffix));
+ list = list->next;
+ }
+ be = slapi_get_next_backend (cookie);
+ }
+ slapi_ch_free ((void **)&cookie);
+
+ /*
+ * Search for the password attributes
+ */
+ for (i = 0; attrs && attrs[i]; i++){
+ char *filter = PR_smprintf("%s=*", attrs[i]);
+ /*
+ * Loop over all the backends looking for the password attribute
+ */
+ for(be_idx = 0; backends[be_idx]; be_idx++){
+ pb = slapi_pblock_new();
+ slapi_search_internal_set_pb(pb, backends[be_idx],
+ LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
+ (void *)plugin_get_default_component_id(),
+ SLAPI_OP_FLAG_IGNORE_UNINDEXED);
+ slapi_search_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to search for password on (%s) error (%d)\n",
+ backends[be_idx], result, 0);
+ goto done;
+ }
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
+ for (ii = 0; entries && entries[ii]; ii++){
+ if((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))){
+ if(strlen(val) >= 5 && strncmp(val,"{DES}", 5) == 0){
+ /*
+ * We have a DES encoded password, convert it AES
+ */
+ Slapi_PBlock *mod_pb = NULL;
+ Slapi_Value *sval = NULL;
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *passwd = NULL;
+
+ /* decode the DES password */
+ if(pw_rever_decode(val, &passwd, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to decode existing DES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* encode the password */
+ sval = slapi_value_new_string(passwd);
+ if(pw_rever_encode(&sval, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to encode AES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* replace the attribute in the entry */
+ replace_val[0] = (char *)slapi_value_get_string(sval);
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = attrs[i];
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ mod_pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(mod_pb, slapi_entry_get_dn(entries[ii]),
+ mods, 0, 0, (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(mod_pb);
+
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to convert password for (%s) error (%d)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = -1;
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "successfully converted password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = 1;
+
+ }
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ slapi_pblock_destroy(mod_pb);
+ if(result){
+ goto done;
+ }
+ }
+ slapi_ch_free_string(&val);
+ }
+ }
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+ pb = NULL;
+ }
+ slapi_ch_free_string(&filter);
+ }
+ }
+
+done:
+ charray_free(attrs);
+ charray_free(backends);
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+
+ if (have_aes && have_des){
+ /*
+ * If a conversion attempt did not fail, disable DES plugin
+ */
+ if(converted_des != -1){
+ /*
+ * Disable the DES plugin - this also prevents potentially expensive
+ * searches at every server startup.
+ */
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+
+ replace_val[0] = "off";
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = "nsslapd-pluginEnabled";
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(pb, des_dn, mods, 0, 0,
+ (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Failed to disable DES plugin (%s), error (%d)\n",
+ des_dn, result, 0);
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Successfully disabled DES plugin (%s)\n",
+ des_dn, 0, 0);
+ }
+ slapi_pblock_destroy(pb);
+ }
+ if(converted_des == 1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Finished - all DES passwords have been converted to AES.\n",
+ 0, 0, 0);
+ } else if (converted_des == 0){
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Finished - no DES passwords to convert.\n",0,0,0);
+ }
+ }
+}
+
void slapd_daemon( daemon_ports_t *ports )
{
/* We are passed some ports---one for regular connections, one
@@ -1140,7 +1378,6 @@ void slapd_daemon( daemon_ports_t *ports )
}
#endif /* ENABLE_LDAPI */
#endif
-
listener_idxs = (listener_info *)slapi_ch_calloc(n_listeners, sizeof(*listener_idxs));
/* Now we write the pid file, indicating that the server is finally and listening for connections */
write_pid_file();
@@ -1148,6 +1385,11 @@ void slapd_daemon( daemon_ports_t *ports )
/* The server is ready and listening for connections. Logging "slapd started" message. */
unfurl_banners(the_connection_table,ports,n_tcps,s_tcps,i_unix);
+ /*
+ * Convert old DES encoded passwords to AES
+ */
+ convert_pbe_des_to_aes();
+
/* The meat of the operation is in a loop on a call to select */
while(!g_get_shutdown())
{
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 48188ed..35b45e3 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1123,6 +1123,7 @@ void slapd_pk11_DestroyPublicKey(SECKEYPublicKey *key);
PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm);
PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx);
+CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem);
/*
* start_tls_extop.c
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 082f69a..43a11c7 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -384,9 +384,8 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
if ((!enc) && (( enc = (*pws_enc)( (char*)slapi_value_get_string(vals[ i ]) )) == NULL )) {
return( -1 );
}
-
- slapi_value_free(&vals[ i ]);
- vals[ i ] = slapi_value_new_string_passin(enc);
+ slapi_value_free(&vals[ i ]);
+ vals[ i ] = slapi_value_new_string_passin(enc);
}
return( 0 );
@@ -396,28 +395,57 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
* Check if the prefix of the cipher is the one that is supposed to be
* Extract from the whole cipher the encrypted password (remove the prefix)
*/
-int checkPrefix(char *cipher, char *schemaName, char **encrypt)
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid)
{
int namelen;
/* buf contains the extracted schema name */
char *end, buf[ 3*PWD_MAX_NAME_LEN + 1 ];
+ char *delim = NULL;
if ( (*cipher == PWD_HASH_PREFIX_START) &&
- ((end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) &&
- ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)) )
+ (end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL)
{
- memcpy( buf, cipher + 1, namelen );
- buf[ namelen ] = '\0';
- if ( strcasecmp( buf, schemaName) != 0 )
- {
- /* schema names are different, error */
- return 1;
- }
- else
- {
- /* extract the encrypted password */
- *encrypt = cipher + strlen(schemaName) + 2;
- return 0;
+ if((delim = strchr(cipher, PWD_PBE_DELIM)) != NULL){
+ /*
+ * We have an algid in the prefix:
+ *
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ if((namelen = delim - cipher - 1) <= (3*PWD_MAX_NAME_LEN)){
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+
+ if ( strcasecmp( buf, schemaName) != 0 ){
+ /* schema names are different, error */
+ return 1;
+ } else {
+ char algid_buf[256];
+
+ /* extract the algid (length is never greater than 216 */
+ memcpy(algid_buf, delim + 1 , (end - delim));
+ algid_buf[end - delim - 1] = '\0';
+ *algid = strdup(algid_buf);
+
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(*algid) + strlen (schemaName) + 3;
+ return 0;
+ }
+ }
+ } else if ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)){
+ /* no delimiter - must be old school DES */
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+ if ( strcasecmp( buf, schemaName) != 0 )
+ {
+ /* schema names are different, error */
+ return 1;
+ }
+ else
+ {
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(schemaName) + 2;
+ return 0;
+ }
}
}
/* cipher is not prefixed, already in clear ? */
@@ -443,6 +471,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
char *L_attr = NULL;
int i = 0;
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK = -1;
/* Get the appropriate decoding function */
@@ -450,10 +479,9 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
if (slapi_attr_types_equivalent(L_attr, attr_name))
{
- typedef char * (*ENCFP)(char *);
+ typedef char * (*ENCFP)(char *, char *);
pwsp = (struct pw_scheme *) slapi_ch_calloc (1, sizeof(struct pw_scheme));
-
pwsp->pws_dec = (ENCFP)p->plg_pwdstorageschemedec;
pwsp->pws_name = slapi_ch_strdup( p->plg_pwdstorageschemename );
pwsp->pws_len = strlen(pwsp->pws_name) ;
@@ -461,7 +489,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
/* check that the prefix of the cipher is the same name
as the scheme name */
- prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt);
+ prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt, &algid);
if ( prefixOK == -1 )
{
/* no prefix, already in clear ? */
@@ -471,13 +499,15 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
}
else if ( prefixOK == 1 )
{
- /* scheme names are different */
+ /* scheme names are different, try the next plugin */
ret_code = -1;
- goto free_and_return;
+ free_pw_scheme( pwsp );
+ pwsp = NULL;
+ continue;
}
else
{
- if ( ( *plain = (pwsp->pws_dec)( encrypt )) == NULL )
+ if ( ( *plain = (pwsp->pws_dec)( encrypt, algid )) == NULL )
{
/* pb during decoding */
ret_code = -1;
@@ -536,11 +566,13 @@ pw_rever_encode(Slapi_Value **vals, char * attr_name)
for ( i = 0; vals[i] != NULL; ++i )
{
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK;
prefixOK = checkPrefix((char*)slapi_value_get_string(vals[i]),
pwsp->pws_name,
- &encrypt);
+ &encrypt, &algid);
+ slapi_ch_free_string(&algid);
if ( prefixOK == 0 )
{
/* Don't touch already encoded value */
diff --git a/ldap/servers/slapd/pw.h b/ldap/servers/slapd/pw.h
index 7190a1d..79a90a0 100644
--- a/ldap/servers/slapd/pw.h
+++ b/ldap/servers/slapd/pw.h
@@ -61,7 +61,7 @@ struct pw_scheme *pw_name2scheme( char *name );
struct pw_scheme *pw_val2scheme( char *val, char **valpwdp, int first_is_default );
int pw_encodevals( Slapi_Value **vals );
int pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals );
-int checkPrefix(char *cipher, char *schemaName, char **encrypt);
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid);
struct passwordpolicyarray *new_passwdPolicy ( Slapi_PBlock *pb, const char *dn );
void delete_passwdPolicy( struct passwordpolicyarray **pwpolicy);
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 2198337..544a9c7 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -2083,7 +2083,8 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie
slapi_pblock_get( pb, SLAPI_OPERATION_TYPE, &optype );
if(optype == SLAPI_OPERATION_SEARCH && /* search, */
strcmp(notes_str,"") && /* that's unindexed, */
- !(config_get_accesslog_level() & LDAP_DEBUG_ARGS)) /* and not logged in access log */
+ !(config_get_accesslog_level() & LDAP_DEBUG_ARGS) && /* and not logged in access log */
+ !(op->o_flags & SLAPI_OP_FLAG_IGNORE_UNINDEXED) ) /* and not ignoring unindexed search */
{
struct slapdplugin *plugin = NULL;
struct slapi_componentid *cid = NULL;
diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c
index 33d512f..4ffda8b 100644
--- a/ldap/servers/slapd/security_wrappers.c
+++ b/ldap/servers/slapd/security_wrappers.c
@@ -409,3 +409,9 @@ PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot,
return PK11_TokenKeyGenWithFlags(slot, type, param, keySize, keyid,
opFlags, attrFlags, wincx);
}
+
+CK_MECHANISM_TYPE
+slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem)
+{
+ return PK11_GetPBECryptoMechanism(algid, params, pwitem );
+}
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index d234c13..3db8fe7 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -53,9 +53,9 @@
/* Used by SSL and DES plugin */
-#ifdef NEED_TOK_DES
-static char tokDes[34] = "Communicator Generic Crypto Svcs";
-static char ptokDes[34] = "Internal (Software) Token ";
+#ifdef NEED_TOK_PBE
+static char tokPBE[34] = "Communicator Generic Crypto Svcs";
+static char ptokPBE[34] = "Internal (Software) Token ";
#endif
/*
@@ -307,6 +307,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */
#define ATTR_NETSCAPEMDSUFFIX "netscapemdsuffix"
+#define PWD_PBE_DELIM '-'
+
#define REFERRAL_REMOVE_CMD "remove"
/* Filenames for DSE storage */
@@ -1592,7 +1594,7 @@ struct pw_scheme {
char *(*pws_enc)( char *pwd );
/* thread-safe decoding function (returns pointer to malloc'd string) */
- char *(*pws_dec)( char *pwd );
+ char *(*pws_dec)( char *pwd, char *algid);
};
typedef struct passwordpolicyarray {
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index a61d954..41dd2c8 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -222,6 +222,7 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...)
#define SLAPI_OP_FLAG_NO_ACCESS_CHECK 0x10000 /* Do not check for access control - bypass them */
#define SLAPI_OP_FLAG_BYPASS_REFERRALS 0x40000 /* Useful for performing internal operations on read-only replica */
#define SLAPI_OP_FLAG_NEVER_CACHE 0x200000 /* added entry should not be kept in cache */
+#define SLAPI_OP_FLAG_IGNORE_UNINDEXED 0x800000 /* Do not log unindexed search */
#define SLAPI_OC_FLAG_REQUIRED 0x0001
#define SLAPI_OC_FLAG_ALLOWED 0x0002
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 6b51e0c..67d01cd 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -64,7 +64,7 @@
#include <string.h>
#include <errno.h>
-#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */
+#define NEED_TOK_PBE /* defines tokPBE and ptokPBE - see slap.h */
#include "slap.h"
#include "svrcore.h"
@@ -1108,7 +1108,7 @@ slapd_nss_init(int init_ssl, int config_available)
/******** Initialise NSS *********/
nssFlags &= (~NSS_INIT_READONLY);
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags);
dongle_file_name = PR_smprintf("%s/pin.txt", certdir);
9 years, 3 months
Branch '389-ds-base-1.3.3' - ldap/servers
by Mark Reynolds
ldap/servers/slapd/extendop.c | 2 ++
1 file changed, 2 insertions(+)
New commits:
commit 8a8e1fc6b3fd4662ba3d5828934d2c0a4dab9373
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 14:37:59 2015 -0500
Ticket 47807 - SLAPI_REQUESTOR_ISROOT not set for extended operation plugins
Bug Description: SLAPI_REQUESTOR_ISROOT not set for extended operation plugins
Fix Description: Added the appropriate call to slapi_pblock_set just before
the plugin functions get called in extendop.c
https://fedorahosted.org/389/ticket/47807
Patch proivded by: Jochen Schneider <scne59(a)gmail.com> (Thanks!!)
Reviewed by: mreynolds
(cherry picked from commit ce4ff66498c66a3dd0d59dc2537cc95035c95fd1)
diff --git a/ldap/servers/slapd/extendop.c b/ldap/servers/slapd/extendop.c
index ced632d..4710c98 100644
--- a/ldap/servers/slapd/extendop.c
+++ b/ldap/servers/slapd/extendop.c
@@ -361,6 +361,8 @@ do_extended( Slapi_PBlock *pb )
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_OID, extoid );
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_VALUE, &extval );
+ slapi_pblock_set( pb, SLAPI_REQUESTOR_ISROOT, &pb->pb_op->o_isroot);
+
rc = plugin_call_exop_plugins( pb, extoid );
if ( SLAPI_PLUGIN_EXTENDED_SENT_RESULT != rc ) {
9 years, 3 months