Branch '389-ds-base-1.3.1' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/rootdn_access/rootdn_access.c | 134 ++++++++++++---------
1 file changed, 80 insertions(+), 54 deletions(-)
New commits:
commit 1508e7270c85e83542130757138a6bcb97f75b95
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Feb 10 09:16:25 2015 -0500
Ticket 48027 - revise the rootdn plugin configuration validation
Bug Description: There are several issues with the config validation. The use of
strcspn() was not working as expected for all the config attributes.
Needed to use strspn instead(). Also, for many errors we simply
ignored the new value, and logged an error. There was also a
memory leak between plugin restarts
Fix Description: Created new function to check all the characters in a config value.
The plugin now returns an error when an invalid config setting is
encountered. Fixed the memory leak when restarting the plugin.
https://fedorahosted.org/389/ticket/48027
Valgrind: passed
Reviewed by: rmeggins(Thanks!)
(cherry picked from commit 53e34440a3c4cced2372e810c14e1743fa4c716c)
Conflicts:
ldap/servers/plugins/rootdn_access/rootdn_access.c
(cherry picked from commit 7944ed527093b125082c2707fc3bca4c652a87c9)
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 5328462..c20c9f7 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -220,10 +220,16 @@ static int
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
+ char *daysAllowed_tmp = NULL;
+ char **hosts_tmp = NULL;
+ char **hosts_to_deny_tmp = NULL;
+ char **ips_tmp = NULL;
+ char **ips_to_deny_tmp = NULL;
char *openTime = NULL;
char *closeTime = NULL;
char *token, *iter, *copy;
char hour[3], min[3];
+ size_t end;
int result = 0;
int time;
int i;
@@ -236,31 +242,32 @@ rootdn_load_config(Slapi_PBlock *pb)
*/
openTime = slapi_entry_attr_get_charptr(e, "rootdn-open-time");
closeTime = slapi_entry_attr_get_charptr(e, "rootdn-close-time");
- daysAllowed = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
- hosts = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
- hosts_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
- ips = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
- ips_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
+ daysAllowed_tmp = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
+ hosts_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
+ hosts_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
+ ips_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
+ ips_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
/*
* Validate out settings
*/
- if(daysAllowed){
- daysAllowed = strToLower(daysAllowed);
- if(strcspn(daysAllowed, "abcdefghijklmnopqrstuvwxyz ,")){
+ if(daysAllowed_tmp){
+ daysAllowed_tmp = strToLower(daysAllowed_tmp);
+ end = strspn(daysAllowed_tmp, "abcdefghijklmnopqrstuvwxyz ,");
+ if(!end || daysAllowed_tmp[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed);
- slapi_ch_free_string(&daysAllowed);
+ "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed_tmp);
+ slapi_ch_free_string(&daysAllowed_tmp);
result = -1;
goto free_and_return;
}
/* make sure the "days" are valid "days" */
- copy = slapi_ch_strdup(daysAllowed);
+ copy = slapi_ch_strdup(daysAllowed_tmp);
token = ldap_utf8strtok_r(copy, ", ", &iter);
while(token){
if(strstr("mon tue wed thu fri sat sun",token) == 0){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-days-allowed day value(%s), must be \"Mon, Tue, Wed, Thu, Fri, Sat, or Sun\".\n", token);
- slapi_ch_free_string(&daysAllowed);
+ slapi_ch_free_string(&daysAllowed_tmp);
slapi_ch_free_string(©);
result = -1;
goto free_and_return;
@@ -270,7 +277,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(©);
}
if(openTime){
- if (strcspn(openTime, "0123456789")){
+ end = strspn(openTime, "0123456789");
+ if (!end || openTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-open-time value (%s), must be all digits\n", openTime);
result = -1;
@@ -297,7 +305,8 @@ rootdn_load_config(Slapi_PBlock *pb)
open_time = (atoi(hour) * 3600) + (atoi(min) * 60);
}
if(closeTime){
- if (strcspn(closeTime, "0123456789")){
+ end = strspn(closeTime, "0123456789");
+ if (!end || closeTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-close-time value (%s), must be all digits, and should be HHMM\n",closeTime);
result = -1;
@@ -331,6 +340,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(&openTime);
open_time = 0;
close_time = 0;
+ result = -1;
+ goto free_and_return;
}
if(close_time && open_time && close_time <= open_time){
/* Make sure the closing time is greater than the open time */
@@ -339,70 +350,76 @@ rootdn_load_config(Slapi_PBlock *pb)
result = -1;
goto free_and_return;
}
- if(hosts){
- for(i = 0; hosts[i] != NULL; i++){
- if(strcspn(hosts[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_tmp){
+ for(i = 0; hosts_tmp[i] != NULL; i++){
+ end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts[i]);
- slapi_ch_free_string(&hosts[i]);
- hosts[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_tmp[i]);
+ slapi_ch_array_free(hosts_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(hosts_to_deny){
- for(i = 0; hosts_to_deny[i] != NULL; i++){
- if(strcspn(hosts_to_deny[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_to_deny_tmp){
+ for(i = 0; hosts_to_deny_tmp[i] != NULL; i++){
+ end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts_to_deny[i]);
- slapi_ch_free_string(&hosts_to_deny[i]);
- hosts_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_to_deny_tmp[i]);
+ slapi_ch_array_free(hosts_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(ips){
- for(i = 0; ips[i] != NULL; i++){
- if(strcspn(ips[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_tmp){
+ for(i = 0; ips_tmp[i] != NULL; i++){
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips[i],":") == 0){
+ if(strstr(ips_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips[i], "0123456789.*")){
+ end = strspn(ips_tmp[i], "0123456789.*");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
}
- if(ips_to_deny){
- for(i = 0; ips_to_deny[i] != NULL; i++){
- if(strcspn(ips_to_deny[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_to_deny_tmp){
+ for(i = 0; ips_to_deny_tmp[i] != NULL; i++){
+ end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips_to_deny[i],":") == 0){
+ if(strstr(ips_to_deny_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips_to_deny[i], "0123456789.*")){
+ end = strspn(ips_to_deny_tmp[i], "0123456789.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
@@ -413,6 +430,13 @@ rootdn_load_config(Slapi_PBlock *pb)
}
free_and_return:
+ if(result == 0){
+ daysAllowed = daysAllowed_tmp;
+ hosts = hosts_tmp;
+ hosts_to_deny = hosts_to_deny_tmp;
+ ips = ips_tmp;
+ ips_to_deny = ips_to_deny_tmp;
+ }
slapi_ch_free_string(&openTime);
slapi_ch_free_string(&closeTime);
@@ -470,8 +494,10 @@ rootdn_check_access(Slapi_PBlock *pb){
char *today = day;
timestr = asctime(timeinfo); // DDD MMM dd hh:mm:ss YYYY
+ memset(day, 0 ,sizeof(day));
memmove(day, timestr, 3); // we only want the day
today = strToLower(today);
+ daysAllowed = strToLower(daysAllowed);
if(!strstr(daysAllowed, today)){
slapi_log_error(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access: bind not allowed for today(%s), "
9 years, 1 month
Branch '389-ds-base-1.3.2' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/rootdn_access/rootdn_access.c | 134 ++++++++++++---------
1 file changed, 80 insertions(+), 54 deletions(-)
New commits:
commit 7944ed527093b125082c2707fc3bca4c652a87c9
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Feb 10 09:16:25 2015 -0500
Ticket 48027 - revise the rootdn plugin configuration validation
Bug Description: There are several issues with the config validation. The use of
strcspn() was not working as expected for all the config attributes.
Needed to use strspn instead(). Also, for many errors we simply
ignored the new value, and logged an error. There was also a
memory leak between plugin restarts
Fix Description: Created new function to check all the characters in a config value.
The plugin now returns an error when an invalid config setting is
encountered. Fixed the memory leak when restarting the plugin.
https://fedorahosted.org/389/ticket/48027
Valgrind: passed
Reviewed by: rmeggins(Thanks!)
(cherry picked from commit 53e34440a3c4cced2372e810c14e1743fa4c716c)
Conflicts:
ldap/servers/plugins/rootdn_access/rootdn_access.c
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 789fbb6..8dad73e 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -220,10 +220,16 @@ static int
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
+ char *daysAllowed_tmp = NULL;
+ char **hosts_tmp = NULL;
+ char **hosts_to_deny_tmp = NULL;
+ char **ips_tmp = NULL;
+ char **ips_to_deny_tmp = NULL;
char *openTime = NULL;
char *closeTime = NULL;
char *token, *iter = NULL, *copy;
char hour[3], min[3];
+ size_t end;
int result = 0;
int time;
int i;
@@ -236,31 +242,32 @@ rootdn_load_config(Slapi_PBlock *pb)
*/
openTime = slapi_entry_attr_get_charptr(e, "rootdn-open-time");
closeTime = slapi_entry_attr_get_charptr(e, "rootdn-close-time");
- daysAllowed = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
- hosts = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
- hosts_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
- ips = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
- ips_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
+ daysAllowed_tmp = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
+ hosts_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
+ hosts_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
+ ips_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
+ ips_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
/*
* Validate out settings
*/
- if(daysAllowed){
- daysAllowed = strToLower(daysAllowed);
- if(strcspn(daysAllowed, "abcdefghijklmnopqrstuvwxyz ,")){
+ if(daysAllowed_tmp){
+ daysAllowed_tmp = strToLower(daysAllowed_tmp);
+ end = strspn(daysAllowed_tmp, "abcdefghijklmnopqrstuvwxyz ,");
+ if(!end || daysAllowed_tmp[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed);
- slapi_ch_free_string(&daysAllowed);
+ "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed_tmp);
+ slapi_ch_free_string(&daysAllowed_tmp);
result = -1;
goto free_and_return;
}
/* make sure the "days" are valid "days" */
- copy = slapi_ch_strdup(daysAllowed);
+ copy = slapi_ch_strdup(daysAllowed_tmp);
token = ldap_utf8strtok_r(copy, ", ", &iter);
while(token){
if(strstr("mon tue wed thu fri sat sun",token) == 0){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-days-allowed day value(%s), must be \"Mon, Tue, Wed, Thu, Fri, Sat, or Sun\".\n", token);
- slapi_ch_free_string(&daysAllowed);
+ slapi_ch_free_string(&daysAllowed_tmp);
slapi_ch_free_string(©);
result = -1;
goto free_and_return;
@@ -270,7 +277,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(©);
}
if(openTime){
- if (strcspn(openTime, "0123456789")){
+ end = strspn(openTime, "0123456789");
+ if (!end || openTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-open-time value (%s), must be all digits\n", openTime);
result = -1;
@@ -297,7 +305,8 @@ rootdn_load_config(Slapi_PBlock *pb)
open_time = (atoi(hour) * 3600) + (atoi(min) * 60);
}
if(closeTime){
- if (strcspn(closeTime, "0123456789")){
+ end = strspn(closeTime, "0123456789");
+ if (!end || closeTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-close-time value (%s), must be all digits, and should be HHMM\n",closeTime);
result = -1;
@@ -331,6 +340,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(&openTime);
open_time = 0;
close_time = 0;
+ result = -1;
+ goto free_and_return;
}
if(close_time && open_time && close_time <= open_time){
/* Make sure the closing time is greater than the open time */
@@ -339,70 +350,76 @@ rootdn_load_config(Slapi_PBlock *pb)
result = -1;
goto free_and_return;
}
- if(hosts){
- for(i = 0; hosts[i] != NULL; i++){
- if(strcspn(hosts[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_tmp){
+ for(i = 0; hosts_tmp[i] != NULL; i++){
+ end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts[i]);
- slapi_ch_free_string(&hosts[i]);
- hosts[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_tmp[i]);
+ slapi_ch_array_free(hosts_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(hosts_to_deny){
- for(i = 0; hosts_to_deny[i] != NULL; i++){
- if(strcspn(hosts_to_deny[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_to_deny_tmp){
+ for(i = 0; hosts_to_deny_tmp[i] != NULL; i++){
+ end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts_to_deny[i]);
- slapi_ch_free_string(&hosts_to_deny[i]);
- hosts_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_to_deny_tmp[i]);
+ slapi_ch_array_free(hosts_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(ips){
- for(i = 0; ips[i] != NULL; i++){
- if(strcspn(ips[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_tmp){
+ for(i = 0; ips_tmp[i] != NULL; i++){
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips[i],":") == 0){
+ if(strstr(ips_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips[i], "0123456789.*")){
+ end = strspn(ips_tmp[i], "0123456789.*");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
}
- if(ips_to_deny){
- for(i = 0; ips_to_deny[i] != NULL; i++){
- if(strcspn(ips_to_deny[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_to_deny_tmp){
+ for(i = 0; ips_to_deny_tmp[i] != NULL; i++){
+ end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips_to_deny[i],":") == 0){
+ if(strstr(ips_to_deny_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips_to_deny[i], "0123456789.*")){
+ end = strspn(ips_to_deny_tmp[i], "0123456789.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
@@ -413,6 +430,13 @@ rootdn_load_config(Slapi_PBlock *pb)
}
free_and_return:
+ if(result == 0){
+ daysAllowed = daysAllowed_tmp;
+ hosts = hosts_tmp;
+ hosts_to_deny = hosts_to_deny_tmp;
+ ips = ips_tmp;
+ ips_to_deny = ips_to_deny_tmp;
+ }
slapi_ch_free_string(&openTime);
slapi_ch_free_string(&closeTime);
@@ -470,8 +494,10 @@ rootdn_check_access(Slapi_PBlock *pb){
char *today = day;
timestr = asctime(timeinfo); // DDD MMM dd hh:mm:ss YYYY
+ memset(day, 0 ,sizeof(day));
memmove(day, timestr, 3); // we only want the day
today = strToLower(today);
+ daysAllowed = strToLower(daysAllowed);
if(!strstr(daysAllowed, today)){
slapi_log_error(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access: bind not allowed for today(%s), "
9 years, 1 month
Branch '389-ds-base-1.3.3' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/rootdn_access/rootdn_access.c | 153 +++++++++++++--------
1 file changed, 96 insertions(+), 57 deletions(-)
New commits:
commit 8dc210da1b6a140d11e9cd2555b2bdc7cfa77ce6
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Feb 10 09:16:25 2015 -0500
Ticket 48027 - revise the rootdn plugin configuration validation
Bug Description: There are several issues with the config validation. The use of
strcspn() was not working as expected for all the config attributes.
Needed to use strspn instead(). Also, for many errors we simply
ignored the new value, and logged an error. There was also a
memory leak between plugin restarts
Fix Description: Created new function to check all the characters in a config value.
The plugin now returns an error when an invalid config setting is
encountered. Fixed the memory leak when restarting the plugin.
https://fedorahosted.org/389/ticket/48027
Valgrind: passed
Reviewed by: rmeggins(Thanks!)
(cherry picked from commit 53e34440a3c4cced2372e810c14e1743fa4c716c)
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 5c530c6..ee5cc5b 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -210,27 +210,42 @@ rootdn_start(Slapi_PBlock *pb)
return 0;
}
-static int
-rootdn_close(Slapi_PBlock *pb)
+static void
+rootdn_free()
{
slapi_ch_free_string(&daysAllowed);
+ daysAllowed = NULL;
slapi_ch_array_free(hosts);
+ hosts = NULL;
slapi_ch_array_free(hosts_to_deny);
+ hosts_to_deny = NULL;
slapi_ch_array_free(ips);
+ ips = NULL;
slapi_ch_array_free(ips_to_deny);
+ ips_to_deny = NULL;
+}
+static int
+rootdn_close(Slapi_PBlock *pb)
+{
+ rootdn_free();
return 0;
}
-
static int
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
+ char *daysAllowed_tmp = NULL;
+ char **hosts_tmp = NULL;
+ char **hosts_to_deny_tmp = NULL;
+ char **ips_tmp = NULL;
+ char **ips_to_deny_tmp = NULL;
char *openTime = NULL;
char *closeTime = NULL;
char *token, *iter = NULL, *copy;
char hour[3], min[3];
+ size_t end;
int result = 0;
int time;
int i;
@@ -243,31 +258,32 @@ rootdn_load_config(Slapi_PBlock *pb)
*/
openTime = slapi_entry_attr_get_charptr(e, "rootdn-open-time");
closeTime = slapi_entry_attr_get_charptr(e, "rootdn-close-time");
- daysAllowed = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
- hosts = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
- hosts_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
- ips = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
- ips_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
+ daysAllowed_tmp = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
+ hosts_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
+ hosts_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
+ ips_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
+ ips_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
/*
* Validate out settings
*/
- if(daysAllowed){
- daysAllowed = strToLower(daysAllowed);
- if(strcspn(daysAllowed, "abcdefghijklmnopqrstuvwxyz ,")){
+ if(daysAllowed_tmp){
+ daysAllowed_tmp = strToLower(daysAllowed_tmp);
+ end = strspn(daysAllowed_tmp, "abcdefghijklmnopqrstuvwxyz ,");
+ if(!end || daysAllowed_tmp[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed);
- slapi_ch_free_string(&daysAllowed);
+ "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed_tmp);
+ slapi_ch_free_string(&daysAllowed_tmp);
result = -1;
goto free_and_return;
}
/* make sure the "days" are valid "days" */
- copy = slapi_ch_strdup(daysAllowed);
+ copy = slapi_ch_strdup(daysAllowed_tmp);
token = ldap_utf8strtok_r(copy, ", ", &iter);
while(token){
if(strstr("mon tue wed thu fri sat sun",token) == 0){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-days-allowed day value(%s), must be \"Mon, Tue, Wed, Thu, Fri, Sat, or Sun\".\n", token);
- slapi_ch_free_string(&daysAllowed);
+ slapi_ch_free_string(&daysAllowed_tmp);
slapi_ch_free_string(©);
result = -1;
goto free_and_return;
@@ -277,7 +293,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(©);
}
if(openTime){
- if (strcspn(openTime, "0123456789")){
+ end = strspn(openTime, "0123456789");
+ if (!end || openTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-open-time value (%s), must be all digits\n", openTime);
result = -1;
@@ -304,7 +321,8 @@ rootdn_load_config(Slapi_PBlock *pb)
open_time = (atoi(hour) * 3600) + (atoi(min) * 60);
}
if(closeTime){
- if (strcspn(closeTime, "0123456789")){
+ end = strspn(closeTime, "0123456789");
+ if (!end || closeTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-close-time value (%s), must be all digits, and should be HHMM\n",closeTime);
result = -1;
@@ -338,6 +356,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(&openTime);
open_time = 0;
close_time = 0;
+ result = -1;
+ goto free_and_return;
}
if(close_time && open_time && close_time <= open_time){
/* Make sure the closing time is greater than the open time */
@@ -346,70 +366,76 @@ rootdn_load_config(Slapi_PBlock *pb)
result = -1;
goto free_and_return;
}
- if(hosts){
- for(i = 0; hosts[i] != NULL; i++){
- if(strcspn(hosts[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_tmp){
+ for(i = 0; hosts_tmp[i] != NULL; i++){
+ end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts[i]);
- slapi_ch_free_string(&hosts[i]);
- hosts[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_tmp[i]);
+ slapi_ch_array_free(hosts_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(hosts_to_deny){
- for(i = 0; hosts_to_deny[i] != NULL; i++){
- if(strcspn(hosts_to_deny[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_to_deny_tmp){
+ for(i = 0; hosts_to_deny_tmp[i] != NULL; i++){
+ end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts_to_deny[i]);
- slapi_ch_free_string(&hosts_to_deny[i]);
- hosts_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_to_deny_tmp[i]);
+ slapi_ch_array_free(hosts_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(ips){
- for(i = 0; ips[i] != NULL; i++){
- if(strcspn(ips[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_tmp){
+ for(i = 0; ips_tmp[i] != NULL; i++){
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips[i],":") == 0){
+ if(strstr(ips_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips[i], "0123456789.*")){
+ end = strspn(ips_tmp[i], "0123456789.*");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
}
- if(ips_to_deny){
- for(i = 0; ips_to_deny[i] != NULL; i++){
- if(strcspn(ips_to_deny[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_to_deny_tmp){
+ for(i = 0; ips_to_deny_tmp[i] != NULL; i++){
+ end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips_to_deny[i],":") == 0){
+ if(strstr(ips_to_deny_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips_to_deny[i], "0123456789.*")){
+ end = strspn(ips_to_deny_tmp[i], "0123456789.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
@@ -422,6 +448,17 @@ rootdn_load_config(Slapi_PBlock *pb)
}
free_and_return:
+ if(result == 0){
+ /*
+ * Free the existing global vars, and move the new ones over
+ */
+ rootdn_free();
+ daysAllowed = daysAllowed_tmp;
+ hosts = hosts_tmp;
+ hosts_to_deny = hosts_to_deny_tmp;
+ ips = ips_tmp;
+ ips_to_deny = ips_to_deny_tmp;
+ }
slapi_ch_free_string(&openTime);
slapi_ch_free_string(&closeTime);
@@ -479,8 +516,10 @@ rootdn_check_access(Slapi_PBlock *pb){
char *today = day;
timestr = asctime(timeinfo); // DDD MMM dd hh:mm:ss YYYY
+ memset(day, 0 ,sizeof(day));
memmove(day, timestr, 3); // we only want the day
today = strToLower(today);
+ daysAllowed = strToLower(daysAllowed);
if(!strstr(daysAllowed, today)){
slapi_log_error(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access: bind not allowed for today(%s), "
9 years, 1 month
ldap/servers
by Mark Reynolds
ldap/servers/plugins/rootdn_access/rootdn_access.c | 153 +++++++++++++--------
1 file changed, 96 insertions(+), 57 deletions(-)
New commits:
commit 53e34440a3c4cced2372e810c14e1743fa4c716c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Feb 10 09:16:25 2015 -0500
Ticket 48027 - revise the rootdn plugin configuration validation
Bug Description: There are several issues with the config validation. The use of
strcspn() was not working as expected for all the config attributes.
Needed to use strspn instead(). Also, for many errors we simply
ignored the new value, and logged an error. There was also a
memory leak between plugin restarts
Fix Description: Created new function to check all the characters in a config value.
The plugin now returns an error when an invalid config setting is
encountered. Fixed the memory leak when restarting the plugin.
https://fedorahosted.org/389/ticket/48027
Valgrind: passed
Reviewed by: rmeggins(Thanks!)
diff --git a/ldap/servers/plugins/rootdn_access/rootdn_access.c b/ldap/servers/plugins/rootdn_access/rootdn_access.c
index 5c530c6..ee5cc5b 100644
--- a/ldap/servers/plugins/rootdn_access/rootdn_access.c
+++ b/ldap/servers/plugins/rootdn_access/rootdn_access.c
@@ -210,27 +210,42 @@ rootdn_start(Slapi_PBlock *pb)
return 0;
}
-static int
-rootdn_close(Slapi_PBlock *pb)
+static void
+rootdn_free()
{
slapi_ch_free_string(&daysAllowed);
+ daysAllowed = NULL;
slapi_ch_array_free(hosts);
+ hosts = NULL;
slapi_ch_array_free(hosts_to_deny);
+ hosts_to_deny = NULL;
slapi_ch_array_free(ips);
+ ips = NULL;
slapi_ch_array_free(ips_to_deny);
+ ips_to_deny = NULL;
+}
+static int
+rootdn_close(Slapi_PBlock *pb)
+{
+ rootdn_free();
return 0;
}
-
static int
rootdn_load_config(Slapi_PBlock *pb)
{
Slapi_Entry *e = NULL;
+ char *daysAllowed_tmp = NULL;
+ char **hosts_tmp = NULL;
+ char **hosts_to_deny_tmp = NULL;
+ char **ips_tmp = NULL;
+ char **ips_to_deny_tmp = NULL;
char *openTime = NULL;
char *closeTime = NULL;
char *token, *iter = NULL, *copy;
char hour[3], min[3];
+ size_t end;
int result = 0;
int time;
int i;
@@ -243,31 +258,32 @@ rootdn_load_config(Slapi_PBlock *pb)
*/
openTime = slapi_entry_attr_get_charptr(e, "rootdn-open-time");
closeTime = slapi_entry_attr_get_charptr(e, "rootdn-close-time");
- daysAllowed = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
- hosts = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
- hosts_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
- ips = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
- ips_to_deny = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
+ daysAllowed_tmp = slapi_entry_attr_get_charptr(e, "rootdn-days-allowed");
+ hosts_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-host");
+ hosts_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-host");
+ ips_tmp = slapi_entry_attr_get_charray(e, "rootdn-allow-ip");
+ ips_to_deny_tmp = slapi_entry_attr_get_charray(e, "rootdn-deny-ip");
/*
* Validate out settings
*/
- if(daysAllowed){
- daysAllowed = strToLower(daysAllowed);
- if(strcspn(daysAllowed, "abcdefghijklmnopqrstuvwxyz ,")){
+ if(daysAllowed_tmp){
+ daysAllowed_tmp = strToLower(daysAllowed_tmp);
+ end = strspn(daysAllowed_tmp, "abcdefghijklmnopqrstuvwxyz ,");
+ if(!end || daysAllowed_tmp[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed);
- slapi_ch_free_string(&daysAllowed);
+ "invalid rootdn-days-allowed value (%s), must be all letters, and comma separators\n", daysAllowed_tmp);
+ slapi_ch_free_string(&daysAllowed_tmp);
result = -1;
goto free_and_return;
}
/* make sure the "days" are valid "days" */
- copy = slapi_ch_strdup(daysAllowed);
+ copy = slapi_ch_strdup(daysAllowed_tmp);
token = ldap_utf8strtok_r(copy, ", ", &iter);
while(token){
if(strstr("mon tue wed thu fri sat sun",token) == 0){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-days-allowed day value(%s), must be \"Mon, Tue, Wed, Thu, Fri, Sat, or Sun\".\n", token);
- slapi_ch_free_string(&daysAllowed);
+ slapi_ch_free_string(&daysAllowed_tmp);
slapi_ch_free_string(©);
result = -1;
goto free_and_return;
@@ -277,7 +293,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(©);
}
if(openTime){
- if (strcspn(openTime, "0123456789")){
+ end = strspn(openTime, "0123456789");
+ if (!end || openTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-open-time value (%s), must be all digits\n", openTime);
result = -1;
@@ -304,7 +321,8 @@ rootdn_load_config(Slapi_PBlock *pb)
open_time = (atoi(hour) * 3600) + (atoi(min) * 60);
}
if(closeTime){
- if (strcspn(closeTime, "0123456789")){
+ end = strspn(closeTime, "0123456789");
+ if (!end || closeTime[end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
"invalid rootdn-close-time value (%s), must be all digits, and should be HHMM\n",closeTime);
result = -1;
@@ -338,6 +356,8 @@ rootdn_load_config(Slapi_PBlock *pb)
slapi_ch_free_string(&openTime);
open_time = 0;
close_time = 0;
+ result = -1;
+ goto free_and_return;
}
if(close_time && open_time && close_time <= open_time){
/* Make sure the closing time is greater than the open time */
@@ -346,70 +366,76 @@ rootdn_load_config(Slapi_PBlock *pb)
result = -1;
goto free_and_return;
}
- if(hosts){
- for(i = 0; hosts[i] != NULL; i++){
- if(strcspn(hosts[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_tmp){
+ for(i = 0; hosts_tmp[i] != NULL; i++){
+ end = strspn(hosts_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts[i]);
- slapi_ch_free_string(&hosts[i]);
- hosts[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_tmp[i]);
+ slapi_ch_array_free(hosts_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(hosts_to_deny){
- for(i = 0; hosts_to_deny[i] != NULL; i++){
- if(strcspn(hosts_to_deny[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")){
+ if(hosts_to_deny_tmp){
+ for(i = 0; hosts_to_deny_tmp[i] != NULL; i++){
+ end = strspn(hosts_to_deny_tmp[i], "0123456789.*-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
+ if(!end || hosts_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "hostname (%s) contians invalid characters, skipping\n",hosts_to_deny[i]);
- slapi_ch_free_string(&hosts_to_deny[i]);
- hosts_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "hostname (%s) contains invalid characters, skipping\n",hosts_to_deny_tmp[i]);
+ slapi_ch_array_free(hosts_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
- if(ips){
- for(i = 0; ips[i] != NULL; i++){
- if(strcspn(ips[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_tmp){
+ for(i = 0; ips_tmp[i] != NULL; i++){
+ end = strspn(ips_tmp[i], "0123456789:ABCDEFabcdef.");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips[i],":") == 0){
+ if(strstr(ips_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips[i], "0123456789.*")){
+ end = strspn(ips_tmp[i], "0123456789.*");
+ if(!end || ips_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips[i]);
- slapi_ch_free_string(&ips[i]);
- ips[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_tmp[i]);
+ slapi_ch_array_free(ips_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
}
- if(ips_to_deny){
- for(i = 0; ips_to_deny[i] != NULL; i++){
- if(strcspn(ips_to_deny[i], "0123456789:ABCDEFabcdef.*")){
+ if(ips_to_deny_tmp){
+ for(i = 0; ips_to_deny_tmp[i] != NULL; i++){
+ end = strspn(ips_to_deny_tmp[i], "0123456789:ABCDEFabcdef.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IP address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IP address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
- if(strstr(ips_to_deny[i],":") == 0){
+ if(strstr(ips_to_deny_tmp[i],":") == 0){
/*
* IPv4 - make sure it's just numbers, dots, and wildcard
*/
- if(strcspn(ips_to_deny[i], "0123456789.*")){
+ end = strspn(ips_to_deny_tmp[i], "0123456789.*");
+ if(!end || ips_to_deny_tmp[i][end] != '\0'){
slapi_log_error(SLAPI_LOG_FATAL, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_load_config: "
- "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny[i]);
- slapi_ch_free_string(&ips_to_deny[i]);
- ips_to_deny[i] = slapi_ch_strdup("!invalid");
- continue;
+ "IPv4 address contains invalid characters (%s), skipping\n", ips_to_deny_tmp[i]);
+ slapi_ch_array_free(ips_to_deny_tmp);
+ result = -1;
+ goto free_and_return;
}
}
}
@@ -422,6 +448,17 @@ rootdn_load_config(Slapi_PBlock *pb)
}
free_and_return:
+ if(result == 0){
+ /*
+ * Free the existing global vars, and move the new ones over
+ */
+ rootdn_free();
+ daysAllowed = daysAllowed_tmp;
+ hosts = hosts_tmp;
+ hosts_to_deny = hosts_to_deny_tmp;
+ ips = ips_tmp;
+ ips_to_deny = ips_to_deny_tmp;
+ }
slapi_ch_free_string(&openTime);
slapi_ch_free_string(&closeTime);
@@ -479,8 +516,10 @@ rootdn_check_access(Slapi_PBlock *pb){
char *today = day;
timestr = asctime(timeinfo); // DDD MMM dd hh:mm:ss YYYY
+ memset(day, 0 ,sizeof(day));
memmove(day, timestr, 3); // we only want the day
today = strToLower(today);
+ daysAllowed = strToLower(daysAllowed);
if(!strstr(daysAllowed, today)){
slapi_log_error(SLAPI_LOG_PLUGIN, ROOTDN_PLUGIN_SUBSYSTEM, "rootdn_check_access: bind not allowed for today(%s), "
9 years, 1 month
ldap/servers
by Noriko Hosoi
ldap/servers/slapd/tools/rsearch/scripts/dbgen.pl.in | 95 ++++++++++++++++---
1 file changed, 82 insertions(+), 13 deletions(-)
New commits:
commit 71901e8edd28030cbb21b0a7f6cf68946093640e
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Feb 9 13:58:45 2015 -0800
Ticket #48025 - add an option '-u' to dbgen.pl for adding group entries with uniquemembers
Usage: /usr/bin/dbgen.pl [options] -o output_file -n number
-u add groups containing uniquemembers;
generate a group for every 100 user entries created that contains the 100 members.
https://fedorahosted.org/389/ticket/48025
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/slapd/tools/rsearch/scripts/dbgen.pl.in b/ldap/servers/slapd/tools/rsearch/scripts/dbgen.pl.in
index ddd21cc..56c5613 100755
--- a/ldap/servers/slapd/tools/rsearch/scripts/dbgen.pl.in
+++ b/ldap/servers/slapd/tools/rsearch/scripts/dbgen.pl.in
@@ -75,6 +75,7 @@ sub PrintUsage {
"\t -x suppress printing pre amble\n",
"\t -y suppress printing organizational units\n",
"\t -l location of directory containing data files, default is @templatedir@\n",
+ "\t -u add groups containing uniquemembers;\n\t generate a group for every 100 user entries created that contains the 100 members.\n",
"\t -v verbose\n",
"\t -q quiet\n",
"\n";
@@ -560,6 +561,12 @@ $opt_x = 0;
$opt_y = 0;
$opt_z = "";
+# group + uniquemember
+$opt_u = 0;
+$gid = 0;
+$gnum = 0;
+$membercount = 100; # default member count in a group
+
GetOptions('number=i' => \$Number_To_Generate,
'output=s' => \$Output_File_Name,
'random=i' => \$Random_Seed,
@@ -577,6 +584,7 @@ GetOptions('number=i' => \$Number_To_Generate,
'verbose' => \$Verbose,
'debug' => \$debug,
'quiet' => \$Quiet,
+ 'uniqueMember' => \$opt_u,
);
$Random_Seed = $Random_Seed || 0xdbdbdbdb;
@@ -600,6 +608,13 @@ if ("" != $opt_y)
$printorgunit = 0;
}
+if (0 != $opt_u) {
+ if ($membercount > $Number_To_Generate) {
+ $membercount = $Number_To_Generate;
+ }
+ @members = ();
+}
+
if ($Suffix =~ /o=/) {
($Organization) = $Suffix =~ /o=([^,]+)/;
$objectvalue = "organization";
@@ -649,10 +664,10 @@ print "Done\n" if $Verbose;
if ($printpreamble)
{
if ($piranha) {
- &PrintPreAmblePiranha($Output_File_Name);
+ &PrintPreAmblePiranha($Output_File_Name);
}
else {
- &PrintPreAmbleBarracuda($Output_File_Name);
+ &PrintPreAmbleBarracuda($Output_File_Name);
}
}
@@ -778,17 +793,20 @@ for ($x= $BeginNum; $x < ($Number_To_Generate+$BeginNum); $x++) {
$userPassword = "$uid\n";
}
- if ($PrintOrgChartDat or !$printorgunit) {
- $dnstr = "dn: $NamingType=$rdn,ou=People,$Suffix\n",
- } else {
- $dnstr = "dn: $NamingType=$rdn,ou=$OrgUnit,$Suffix\n";
- }
+ if ($PrintOrgChartDat or !$printorgunit) {
+ $dnstr = "$NamingType=$rdn,ou=People,$Suffix";
+ } else {
+ $dnstr = "$NamingType=$rdn,ou=$OrgUnit,$Suffix";
+ }
- print OUTPUT_FILE
- $dnstr,
+ if ($opt_u) {
+ # with group + memof
+ print OUTPUT_FILE
+ "dn: $dnstr\n",
"objectClass: top\n",
"objectClass: person\n",
"objectClass: organizationalPerson\n",
+ "objectClass: inetAdmin\n",
$inetOrgPerson, $ExtraObjClasses,
"cn: $cn\n",
"sn: $sn\n",
@@ -815,7 +833,58 @@ for ($x= $BeginNum; $x < ($Number_To_Generate+$BeginNum); $x++) {
"title: $title\n",
$mycert,
"\n";
-
+ push(@members, $dnstr);
+ $gnum += 1;
+ if ($gnum >= $membercount) {
+ my $gdnstr = "dn: cn=Group$gid,$Suffix\n";
+ print OUTPUT_FILE
+ $gdnstr,
+ "objectClass: top\n",
+ "objectClass: groupOfUniqueNames\n",
+ "cn: Group$gid\n";
+ foreach $member (@members) {
+ print OUTPUT_FILE "uniqueMember: $member\n";
+ }
+ print OUTPUT_FILE "\n";
+ @members = ();
+ $gid += 1;
+ $gnum = 0;
+ }
+ } else {
+ # no group + memof
+ print OUTPUT_FILE
+ "dn: $dnstr\n",
+ "objectClass: top\n",
+ "objectClass: person\n",
+ "objectClass: organizationalPerson\n",
+ $inetOrgPerson, $ExtraObjClasses,
+ "cn: $cn\n",
+ "sn: $sn\n",
+ "uid: $uid\n",
+ "givenName: $givenName\n",
+ "description: $description\n",
+ "userPassword: $userPassword",
+ $departmentNumber,
+ $employeeType,
+ $homePhone,
+ $initials,
+ "telephoneNumber: $telephoneNumber\n",
+ "facsimileTelephoneNumber: $facsimileTelephoneNumber\n",
+ $mobile,
+ $pager,
+ $manager,
+ $secretary,
+ $roomNumber,
+ $carLicense,
+ "l: $locality\n",
+ "ou: $OrgUnit\n",
+ "mail: $mail\n",
+ "postalAddress: $postalAddress\n",
+ "title: $title\n",
+ $mycert,
+ "\n";
+ }
+
if (!$Quiet) {
if ($x % 1000 == 0) {
print "." if $Verbose;
@@ -833,7 +902,7 @@ if ($Verbose) {
}
exit 0;
-
+
sub ReadOrgUnits {
open (ORG_UNITS, $OrgUnitsFile) ||
@@ -976,13 +1045,13 @@ sub PrintManagers {
$userPassword = "$uid\n";
}
- $dnstr = "dn: $NamingType=$rdn,ou=People,$Suffix\n";
+ $dnstr = "$NamingType=$rdn,ou=People,$Suffix";
if ("" ne $orgUnit) {
$oustr = "ou: $orgUnit\n";
}
print OUTPUT_FILE
- $dnstr,
+ "dn: $dnstr\n",
"objectClass: top\n",
"objectClass: person\n",
"objectClass: organizationalPerson\n",
9 years, 1 month
Branch '389-ds-base-1.3.3' - dirsrvtests/suites ldap/servers
by Mark Reynolds
dirsrvtests/suites/dynamic-plugins/plugin_tests.py | 18 ++++
ldap/servers/slapd/dse.c | 85 ++++++++++-----------
ldap/servers/slapd/plugin.c | 56 +++++++------
3 files changed, 91 insertions(+), 68 deletions(-)
New commits:
commit a61c3cb754f1f4831d74b67d7a692a75b448f36f
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Feb 9 16:23:04 2015 -0500
Ticket 47451 - dynamic plugins - fix crash caused by invalid
plugin config
Bug Description: After making an invalid plugin change, that should cause the
old plugin entry to be reloaded, the server will crash.
Fix Description: If a plugin fails to start after applying invalid config
changes, we need to make sure it is removed from the global
plugin lists, or else a freed plugin can be deferenced later.
Also moved the plugin validation check in dse_modify to happen
in the preop stage, so invalid configurations do not persist
in the dse.ldif
https://fedorahosted.org/389/ticket/47451
Valgrind: passed
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit d7be25e108a9ef57a4ccae38c88550d2fbe85578)
diff --git a/dirsrvtests/suites/dynamic-plugins/plugin_tests.py b/dirsrvtests/suites/dynamic-plugins/plugin_tests.py
index e147be5..189a943 100644
--- a/dirsrvtests/suites/dynamic-plugins/plugin_tests.py
+++ b/dirsrvtests/suites/dynamic-plugins/plugin_tests.py
@@ -2177,6 +2177,8 @@ def test_rootdn(inst, args=None):
PLUGIN_DN = 'cn=' + PLUGIN_ROOTDN_ACCESS + ',cn=plugins,cn=config'
+ log.info('Testing ' + PLUGIN_ROOTDN_ACCESS + '...')
+
############################################################################
# Configure plugin
############################################################################
@@ -2226,12 +2228,28 @@ def test_rootdn(inst, args=None):
# Change the config
############################################################################
+ # Bind as the user who can make updates to the config
try:
inst.simple_bind_s(USER1_DN, 'password')
except ldap.LDAPError, e:
log.error('test_rootdn: failed to bind as user1')
assert False
+ # First, test that invalid plugin changes are rejected
+ try:
+ inst.modify_s(PLUGIN_DN, [(ldap.MOD_REPLACE, 'rootdn-deny-ip', '12.12.ZZZ.12')])
+ log.fatal('test_rootdn: Incorrectly allowed to add invalid "rootdn-deny-ip: 12.12.ZZZ.12"')
+ assert False
+ except ldap.LDAPError:
+ pass
+
+ try:
+ inst.modify_s(PLUGIN_DN, [(ldap.MOD_REPLACE, 'rootdn-allow-host', 'host._.com')])
+ log.fatal('test_rootdn: Incorrectly allowed to add invalid "rootdn-allow-host: host._.com"')
+ assert False
+ except ldap.LDAPError:
+ pass
+
# Remove the restriction
try:
inst.modify_s(PLUGIN_DN, [(ldap.MOD_DELETE, 'rootdn-allow-ip', None)])
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index f80178e..9bb5914 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -157,7 +157,7 @@ static struct dse_node *dse_find_node( struct dse* pdse, const Slapi_DN *dn );
static int dse_modify_plugin(Slapi_Entry *pre_entry, Slapi_Entry *post_entry, char *returntext);
static int dse_add_plugin(Slapi_Entry *entry, char *returntext);
static int dse_delete_plugin(Slapi_Entry *entry, char *returntext);
-static void dse_post_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods);
+static int dse_pre_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods);
/*
richm: In almost all modes e.g. db2ldif, ldif2db, etc. we do not need/want
@@ -1916,13 +1916,41 @@ dse_modify(Slapi_PBlock *pb) /* JCM There should only be one exit point from thi
}
} else {
/*
- * Check if we are enabling/disabling a plugin
+ * If we are using dynamic plugins, and we are modifying a plugin
+ * we need to do some additional checks. First, check if we are
+ * enabling/disabling a plugin. Then make sure the plugin still
+ * starts after applying the plugin changes.
*/
- if((plugin_started = dse_modify_plugin(ec, ecc, returntext)) == -1){
- returncode = LDAP_UNWILLING_TO_PERFORM;
- rc = SLAPI_DSE_CALLBACK_ERROR;
- } else {
- rc = SLAPI_DSE_CALLBACK_OK;
+ rc = SLAPI_DSE_CALLBACK_OK;
+ if(config_get_dynamic_plugins() &&
+ slapi_entry_attr_hasvalue(ec, SLAPI_ATTR_OBJECTCLASS, "nsSlapdPlugin") )
+ {
+ if((plugin_started = dse_modify_plugin(ec, ecc, returntext)) == -1){
+ returncode = LDAP_UNWILLING_TO_PERFORM;
+ rc = SLAPI_DSE_CALLBACK_ERROR;
+ retval = -1;
+ goto done;
+ }
+ /*
+ * If this is not a internal operation, make sure the plugin
+ * can be restarted.
+ */
+ if(!internal_op){
+ if(dse_pre_modify_plugin(ec, ecc, mods)){
+ char *errtext;
+ slapi_pblock_get(pb, SLAPI_PB_RESULT_TEXT, &errtext);
+ if (errtext) {
+ PL_strncpyz(returntext,
+ "Failed to apply plugin config change, "
+ "check the errors log for more info.",
+ sizeof(returntext));
+ }
+ returncode = LDAP_UNWILLING_TO_PERFORM;
+ rc = SLAPI_DSE_CALLBACK_ERROR;
+ retval = -1;
+ goto done;
+ }
+ }
}
}
}
@@ -2041,44 +2069,20 @@ dse_modify(Slapi_PBlock *pb) /* JCM There should only be one exit point from thi
}
}
}
- /*
- * Perform postop plugin configuration changes unless this is an internal operation
- */
- if(!internal_op){
- if(returncode == LDAP_SUCCESS){
- dse_post_modify_plugin(ec, ecc, mods);
- } else if(plugin_started){
- if(plugin_started == 1){
- /* the op failed, turn the plugin off */
- plugin_delete(ecc, returntext, 0 /* not locked */);
- } else if (plugin_started == 2){
- /*
- * This probably can't happen, but...
- * the op failed, turn the plugin back on.
- */
- plugin_add(ecc, returntext, 0 /* not locked */);
- }
- }
- }
slapi_send_ldap_result( pb, returncode, NULL, returntext[0] ? returntext : NULL, 0, NULL );
return dse_modify_return(retval, ec, ecc);
}
-static void
-dse_post_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods)
+static int
+dse_pre_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods)
{
char *enabled = NULL;
int restart_plugin = 1;
+ int rc = 0;
int i;
- if (!slapi_entry_attr_hasvalue(entryBefore, SLAPI_ATTR_OBJECTCLASS, "nsSlapdPlugin") ||
- !config_get_dynamic_plugins() ){
- /* not a plugin, or we aren't applying updates dynamically - just move on */
- return;
- }
-
/*
* Only check the mods if the plugin is enabled - no need to restart a plugin if it's not running.
*/
@@ -2094,14 +2098,15 @@ dse_post_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMo
}
if(restart_plugin){ /* for all other plugin config changes, restart the plugin */
if(plugin_restart(entryBefore, entryAfter) != LDAP_SUCCESS){
- slapi_log_error(SLAPI_LOG_FATAL,"dse_post_modify_plugin", "The configuration change "
- "for plugin (%s) could not be applied dynamically, and will be ignored until "
- "the server is restarted.\n",
+ slapi_log_error(SLAPI_LOG_FATAL,"dse_pre_modify_plugin",
+ "The configuration change for plugin (%s) could not be applied.\n",
slapi_entry_get_dn(entryBefore));
+ rc = -1;
}
}
}
slapi_ch_free_string(&enabled);
+ return rc;
}
/*
@@ -2118,12 +2123,6 @@ dse_modify_plugin(Slapi_Entry *pre_entry, Slapi_Entry *post_entry, char *returnt
{
int rc = LDAP_SUCCESS;
- if (!slapi_entry_attr_hasvalue(post_entry, SLAPI_ATTR_OBJECTCLASS, "nsSlapdPlugin") ||
- !config_get_dynamic_plugins() )
- {
- return rc;
- }
-
if( slapi_entry_attr_hasvalue(pre_entry, "nsslapd-pluginEnabled", "on") &&
slapi_entry_attr_hasvalue(post_entry, "nsslapd-pluginEnabled", "off") )
{
diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c
index b0b18e7..94aba7f 100644
--- a/ldap/servers/slapd/plugin.c
+++ b/ldap/servers/slapd/plugin.c
@@ -99,6 +99,7 @@ static int plugin_delete_check_dependency(struct slapdplugin *plugin_entry, int
static char *plugin_get_type_str( int type );
static void plugin_cleanup_list();
static int plugin_remove_plugins(struct slapdplugin *plugin_entry, char *plugin_type);
+static void plugin_remove_from_shutdown(struct slapdplugin *plugin_entry);
static PLHashTable *global_plugin_dns = NULL;
@@ -2310,39 +2311,39 @@ plugin_restart(Slapi_Entry *pentryBefore, Slapi_Entry *pentryAfter)
/* We can not restart the critical plugins */
if(plugin_is_critical(pentryBefore)){
LDAPDebug(LDAP_DEBUG_PLUGIN, "plugin_restart: Plugin (%s) is critical to server operation. "
- "Any changes will not take effect until the server is restarted.\n",
- slapi_entry_get_dn(pentryBefore),0,0);
+ "Any changes will not take effect until the server is restarted.\n",
+ slapi_entry_get_dn(pentryBefore),0,0);
return 1; /* failure - dse code will log a fatal message */
}
slapi_rwlock_wrlock(global_rwlock);
slapi_td_set_plugin_locked();
- if(plugin_delete(pentryBefore, returntext, 1) == LDAP_SUCCESS){
- if(plugin_add(pentryAfter, returntext, 1) == LDAP_SUCCESS){
- LDAPDebug(LDAP_DEBUG_PLUGIN, "plugin_restart: Plugin (%s) has been successfully "
- "restarted after configuration change.\n",
- slapi_entry_get_dn(pentryAfter),0,0);
- } else {
- LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to restart after "
- "configuration change (%s). Reverting to original plugin entry.\n",
- slapi_entry_get_dn(pentryAfter), returntext, 0);
- if(plugin_add(pentryBefore, returntext, 1) == LDAP_SUCCESS){
- LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to reload "
- "original plugin (%s)\n",slapi_entry_get_dn(pentryBefore), returntext, 0);
- }
- rc = 1;
- }
- } else {
- LDAPDebug(LDAP_DEBUG_ANY,"plugin_restart: failed to disable/stop the plugin (%s): %s\n",
- slapi_entry_get_dn(pentryBefore), returntext, 0);
- rc = 1;
- }
+ if(plugin_delete(pentryBefore, returntext, 1) == LDAP_SUCCESS){
+ if(plugin_add(pentryAfter, returntext, 1) == LDAP_SUCCESS){
+ LDAPDebug(LDAP_DEBUG_PLUGIN, "plugin_restart: Plugin (%s) has been successfully "
+ "restarted after configuration change.\n",
+ slapi_entry_get_dn(pentryAfter),0,0);
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to restart after "
+ "configuration change (%s). Reverting to original plugin entry.\n",
+ slapi_entry_get_dn(pentryAfter), returntext, 0);
+ if(plugin_add(pentryBefore, returntext, 1) != LDAP_SUCCESS){
+ LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to reload "
+ "original plugin (%s)\n",slapi_entry_get_dn(pentryBefore), returntext, 0);
+ }
+ rc = 1;
+ }
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"plugin_restart: failed to disable/stop the plugin (%s): %s\n",
+ slapi_entry_get_dn(pentryBefore), returntext, 0);
+ rc = 1;
+ }
- slapi_rwlock_unlock(global_rwlock);
- slapi_td_set_plugin_unlocked();
+ slapi_rwlock_unlock(global_rwlock);
+ slapi_td_set_plugin_unlocked();
- return rc;
+ return rc;
}
static int
@@ -2946,6 +2947,11 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group,
PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE,"Init function \"%s\" for \"%s\" plugin in "
"library \"%s\" failed.",plugin->plg_initfunc, plugin->plg_name, plugin->plg_libpath);
status = -1;
+ /*
+ * The init function might have added the plugin to the global list before
+ * it failed - attempt to remove it just in case it was added.
+ */
+ plugin_remove_plugins(plugin, value);
slapi_ch_free((void**)&value);
goto PLUGIN_CLEANUP;
}
9 years, 1 month
dirsrvtests/suites ldap/servers
by Mark Reynolds
dirsrvtests/suites/dynamic-plugins/plugin_tests.py | 18 ++++
ldap/servers/slapd/dse.c | 85 ++++++++++-----------
ldap/servers/slapd/plugin.c | 56 +++++++------
3 files changed, 91 insertions(+), 68 deletions(-)
New commits:
commit d7be25e108a9ef57a4ccae38c88550d2fbe85578
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Feb 9 16:23:04 2015 -0500
Ticket 47451 - dynamic plugins - fix crash caused by invalid
plugin config
Bug Description: After making an invalid plugin change, that should cause the
old plugin entry to be reloaded, the server will crash.
Fix Description: If a plugin fails to start after applying invalid config
changes, we need to make sure it is removed from the global
plugin lists, or else a freed plugin can be deferenced later.
Also moved the plugin validation check in dse_modify to happen
in the preop stage, so invalid configurations do not persist
in the dse.ldif
https://fedorahosted.org/389/ticket/47451
Valgrind: passed
Reviewed by: nhosoi(Thanks!)
diff --git a/dirsrvtests/suites/dynamic-plugins/plugin_tests.py b/dirsrvtests/suites/dynamic-plugins/plugin_tests.py
index 315547b..a552142 100644
--- a/dirsrvtests/suites/dynamic-plugins/plugin_tests.py
+++ b/dirsrvtests/suites/dynamic-plugins/plugin_tests.py
@@ -2174,6 +2174,8 @@ def test_rootdn(inst, args=None):
PLUGIN_DN = 'cn=' + PLUGIN_ROOTDN_ACCESS + ',cn=plugins,cn=config'
+ log.info('Testing ' + PLUGIN_ROOTDN_ACCESS + '...')
+
############################################################################
# Configure plugin
############################################################################
@@ -2223,12 +2225,28 @@ def test_rootdn(inst, args=None):
# Change the config
############################################################################
+ # Bind as the user who can make updates to the config
try:
inst.simple_bind_s(USER1_DN, 'password')
except ldap.LDAPError, e:
log.error('test_rootdn: failed to bind as user1')
assert False
+ # First, test that invalid plugin changes are rejected
+ try:
+ inst.modify_s(PLUGIN_DN, [(ldap.MOD_REPLACE, 'rootdn-deny-ip', '12.12.ZZZ.12')])
+ log.fatal('test_rootdn: Incorrectly allowed to add invalid "rootdn-deny-ip: 12.12.ZZZ.12"')
+ assert False
+ except ldap.LDAPError:
+ pass
+
+ try:
+ inst.modify_s(PLUGIN_DN, [(ldap.MOD_REPLACE, 'rootdn-allow-host', 'host._.com')])
+ log.fatal('test_rootdn: Incorrectly allowed to add invalid "rootdn-allow-host: host._.com"')
+ assert False
+ except ldap.LDAPError:
+ pass
+
# Remove the restriction
try:
inst.modify_s(PLUGIN_DN, [(ldap.MOD_DELETE, 'rootdn-allow-ip', None)])
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index f80178e..9bb5914 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -157,7 +157,7 @@ static struct dse_node *dse_find_node( struct dse* pdse, const Slapi_DN *dn );
static int dse_modify_plugin(Slapi_Entry *pre_entry, Slapi_Entry *post_entry, char *returntext);
static int dse_add_plugin(Slapi_Entry *entry, char *returntext);
static int dse_delete_plugin(Slapi_Entry *entry, char *returntext);
-static void dse_post_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods);
+static int dse_pre_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods);
/*
richm: In almost all modes e.g. db2ldif, ldif2db, etc. we do not need/want
@@ -1916,13 +1916,41 @@ dse_modify(Slapi_PBlock *pb) /* JCM There should only be one exit point from thi
}
} else {
/*
- * Check if we are enabling/disabling a plugin
+ * If we are using dynamic plugins, and we are modifying a plugin
+ * we need to do some additional checks. First, check if we are
+ * enabling/disabling a plugin. Then make sure the plugin still
+ * starts after applying the plugin changes.
*/
- if((plugin_started = dse_modify_plugin(ec, ecc, returntext)) == -1){
- returncode = LDAP_UNWILLING_TO_PERFORM;
- rc = SLAPI_DSE_CALLBACK_ERROR;
- } else {
- rc = SLAPI_DSE_CALLBACK_OK;
+ rc = SLAPI_DSE_CALLBACK_OK;
+ if(config_get_dynamic_plugins() &&
+ slapi_entry_attr_hasvalue(ec, SLAPI_ATTR_OBJECTCLASS, "nsSlapdPlugin") )
+ {
+ if((plugin_started = dse_modify_plugin(ec, ecc, returntext)) == -1){
+ returncode = LDAP_UNWILLING_TO_PERFORM;
+ rc = SLAPI_DSE_CALLBACK_ERROR;
+ retval = -1;
+ goto done;
+ }
+ /*
+ * If this is not a internal operation, make sure the plugin
+ * can be restarted.
+ */
+ if(!internal_op){
+ if(dse_pre_modify_plugin(ec, ecc, mods)){
+ char *errtext;
+ slapi_pblock_get(pb, SLAPI_PB_RESULT_TEXT, &errtext);
+ if (errtext) {
+ PL_strncpyz(returntext,
+ "Failed to apply plugin config change, "
+ "check the errors log for more info.",
+ sizeof(returntext));
+ }
+ returncode = LDAP_UNWILLING_TO_PERFORM;
+ rc = SLAPI_DSE_CALLBACK_ERROR;
+ retval = -1;
+ goto done;
+ }
+ }
}
}
}
@@ -2041,44 +2069,20 @@ dse_modify(Slapi_PBlock *pb) /* JCM There should only be one exit point from thi
}
}
}
- /*
- * Perform postop plugin configuration changes unless this is an internal operation
- */
- if(!internal_op){
- if(returncode == LDAP_SUCCESS){
- dse_post_modify_plugin(ec, ecc, mods);
- } else if(plugin_started){
- if(plugin_started == 1){
- /* the op failed, turn the plugin off */
- plugin_delete(ecc, returntext, 0 /* not locked */);
- } else if (plugin_started == 2){
- /*
- * This probably can't happen, but...
- * the op failed, turn the plugin back on.
- */
- plugin_add(ecc, returntext, 0 /* not locked */);
- }
- }
- }
slapi_send_ldap_result( pb, returncode, NULL, returntext[0] ? returntext : NULL, 0, NULL );
return dse_modify_return(retval, ec, ecc);
}
-static void
-dse_post_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods)
+static int
+dse_pre_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMod **mods)
{
char *enabled = NULL;
int restart_plugin = 1;
+ int rc = 0;
int i;
- if (!slapi_entry_attr_hasvalue(entryBefore, SLAPI_ATTR_OBJECTCLASS, "nsSlapdPlugin") ||
- !config_get_dynamic_plugins() ){
- /* not a plugin, or we aren't applying updates dynamically - just move on */
- return;
- }
-
/*
* Only check the mods if the plugin is enabled - no need to restart a plugin if it's not running.
*/
@@ -2094,14 +2098,15 @@ dse_post_modify_plugin(Slapi_Entry *entryBefore, Slapi_Entry *entryAfter, LDAPMo
}
if(restart_plugin){ /* for all other plugin config changes, restart the plugin */
if(plugin_restart(entryBefore, entryAfter) != LDAP_SUCCESS){
- slapi_log_error(SLAPI_LOG_FATAL,"dse_post_modify_plugin", "The configuration change "
- "for plugin (%s) could not be applied dynamically, and will be ignored until "
- "the server is restarted.\n",
+ slapi_log_error(SLAPI_LOG_FATAL,"dse_pre_modify_plugin",
+ "The configuration change for plugin (%s) could not be applied.\n",
slapi_entry_get_dn(entryBefore));
+ rc = -1;
}
}
}
slapi_ch_free_string(&enabled);
+ return rc;
}
/*
@@ -2118,12 +2123,6 @@ dse_modify_plugin(Slapi_Entry *pre_entry, Slapi_Entry *post_entry, char *returnt
{
int rc = LDAP_SUCCESS;
- if (!slapi_entry_attr_hasvalue(post_entry, SLAPI_ATTR_OBJECTCLASS, "nsSlapdPlugin") ||
- !config_get_dynamic_plugins() )
- {
- return rc;
- }
-
if( slapi_entry_attr_hasvalue(pre_entry, "nsslapd-pluginEnabled", "on") &&
slapi_entry_attr_hasvalue(post_entry, "nsslapd-pluginEnabled", "off") )
{
diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c
index b0b18e7..94aba7f 100644
--- a/ldap/servers/slapd/plugin.c
+++ b/ldap/servers/slapd/plugin.c
@@ -99,6 +99,7 @@ static int plugin_delete_check_dependency(struct slapdplugin *plugin_entry, int
static char *plugin_get_type_str( int type );
static void plugin_cleanup_list();
static int plugin_remove_plugins(struct slapdplugin *plugin_entry, char *plugin_type);
+static void plugin_remove_from_shutdown(struct slapdplugin *plugin_entry);
static PLHashTable *global_plugin_dns = NULL;
@@ -2310,39 +2311,39 @@ plugin_restart(Slapi_Entry *pentryBefore, Slapi_Entry *pentryAfter)
/* We can not restart the critical plugins */
if(plugin_is_critical(pentryBefore)){
LDAPDebug(LDAP_DEBUG_PLUGIN, "plugin_restart: Plugin (%s) is critical to server operation. "
- "Any changes will not take effect until the server is restarted.\n",
- slapi_entry_get_dn(pentryBefore),0,0);
+ "Any changes will not take effect until the server is restarted.\n",
+ slapi_entry_get_dn(pentryBefore),0,0);
return 1; /* failure - dse code will log a fatal message */
}
slapi_rwlock_wrlock(global_rwlock);
slapi_td_set_plugin_locked();
- if(plugin_delete(pentryBefore, returntext, 1) == LDAP_SUCCESS){
- if(plugin_add(pentryAfter, returntext, 1) == LDAP_SUCCESS){
- LDAPDebug(LDAP_DEBUG_PLUGIN, "plugin_restart: Plugin (%s) has been successfully "
- "restarted after configuration change.\n",
- slapi_entry_get_dn(pentryAfter),0,0);
- } else {
- LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to restart after "
- "configuration change (%s). Reverting to original plugin entry.\n",
- slapi_entry_get_dn(pentryAfter), returntext, 0);
- if(plugin_add(pentryBefore, returntext, 1) == LDAP_SUCCESS){
- LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to reload "
- "original plugin (%s)\n",slapi_entry_get_dn(pentryBefore), returntext, 0);
- }
- rc = 1;
- }
- } else {
- LDAPDebug(LDAP_DEBUG_ANY,"plugin_restart: failed to disable/stop the plugin (%s): %s\n",
- slapi_entry_get_dn(pentryBefore), returntext, 0);
- rc = 1;
- }
+ if(plugin_delete(pentryBefore, returntext, 1) == LDAP_SUCCESS){
+ if(plugin_add(pentryAfter, returntext, 1) == LDAP_SUCCESS){
+ LDAPDebug(LDAP_DEBUG_PLUGIN, "plugin_restart: Plugin (%s) has been successfully "
+ "restarted after configuration change.\n",
+ slapi_entry_get_dn(pentryAfter),0,0);
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to restart after "
+ "configuration change (%s). Reverting to original plugin entry.\n",
+ slapi_entry_get_dn(pentryAfter), returntext, 0);
+ if(plugin_add(pentryBefore, returntext, 1) != LDAP_SUCCESS){
+ LDAPDebug(LDAP_DEBUG_ANY, "plugin_restart: Plugin (%s) failed to reload "
+ "original plugin (%s)\n",slapi_entry_get_dn(pentryBefore), returntext, 0);
+ }
+ rc = 1;
+ }
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"plugin_restart: failed to disable/stop the plugin (%s): %s\n",
+ slapi_entry_get_dn(pentryBefore), returntext, 0);
+ rc = 1;
+ }
- slapi_rwlock_unlock(global_rwlock);
- slapi_td_set_plugin_unlocked();
+ slapi_rwlock_unlock(global_rwlock);
+ slapi_td_set_plugin_unlocked();
- return rc;
+ return rc;
}
static int
@@ -2946,6 +2947,11 @@ plugin_setup(Slapi_Entry *plugin_entry, struct slapi_componentid *group,
PR_snprintf (returntext, SLAPI_DSE_RETURNTEXT_SIZE,"Init function \"%s\" for \"%s\" plugin in "
"library \"%s\" failed.",plugin->plg_initfunc, plugin->plg_name, plugin->plg_libpath);
status = -1;
+ /*
+ * The init function might have added the plugin to the global list before
+ * it failed - attempt to remove it just in case it was added.
+ */
+ plugin_remove_plugins(plugin, value);
slapi_ch_free((void**)&value);
goto PLUGIN_CLEANUP;
}
9 years, 1 month
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/posix-winsync/posix-winsync.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
New commits:
commit 42c3ced7868fc66989d8249d52254c4a46988919
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Feb 9 09:50:15 2015 -0800
Ticket #48001 - ns-activate.pl fails to activate account if it was disabled on AD
Description: commit 345d2c0870d7e8b1005a13cc9cf93865ff0cb53d
introduced a coverity defect - 12989 Dereference after null check.
(cherry picked from commit 9300e96ae0409ea5b6d24b9af0a218ac00c03ecc)
(cherry picked from commit 411a8e7a2a0c2317d20c32ccbf7b801d3a11b80c)
(cherry picked from commit 4488604146ca0fc63853ad5790cb8797c2d95024)
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index 872abca..446532a 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -133,7 +133,6 @@ enum
* Mostly copied from check_account_lock in the server code.
* Returns: 0 - account is disabled (lock == "true")
* 1 - account is enabled (lock == "false" or empty)
- * -1 - some sort of error
*/
static int
check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
@@ -151,7 +150,9 @@ check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
/* first, see if the attribute is a "real" attribute */
strval = slapi_entry_attr_get_charptr(ds_entry, "nsAccountLock");
if (strval) { /* value is real */
- *isvirt = 0; /* value is real */
+ if (isvirt) {
+ *isvirt = 0; /* value is real */
+ }
rc = 1; /* default to enabled */
if (PL_strncasecmp(strval, "true", 4) == 0) {
rc = 0; /* account is disabled */
@@ -172,7 +173,9 @@ check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
const struct berval *bvp = NULL;
rc = 1; /* default is enabled */
- *isvirt = 1; /* value is virtual */
+ if (isvirt) {
+ *isvirt = 1; /* value is virtual */
+ }
if ((slapi_valueset_first_value(values, &v) != -1) &&
((bvp = slapi_value_get_berval(v)) != NULL)) {
if ((bvp != NULL) && (PL_strncasecmp(bvp->bv_val, "true", 4) == 0)) {
9 years, 1 month
Branch '389-ds-base-1.3.2' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/posix-winsync/posix-winsync.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
New commits:
commit 4488604146ca0fc63853ad5790cb8797c2d95024
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Feb 9 09:50:15 2015 -0800
Ticket #48001 - ns-activate.pl fails to activate account if it was disabled on AD
Description: commit 345d2c0870d7e8b1005a13cc9cf93865ff0cb53d
introduced a coverity defect - 12989 Dereference after null check.
(cherry picked from commit 9300e96ae0409ea5b6d24b9af0a218ac00c03ecc)
(cherry picked from commit 411a8e7a2a0c2317d20c32ccbf7b801d3a11b80c)
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index f9efcc4..6f4d2ac 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -133,7 +133,6 @@ enum
* Mostly copied from check_account_lock in the server code.
* Returns: 0 - account is disabled (lock == "true")
* 1 - account is enabled (lock == "false" or empty)
- * -1 - some sort of error
*/
static int
_check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
@@ -151,7 +150,9 @@ _check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
/* first, see if the attribute is a "real" attribute */
strval = slapi_entry_attr_get_charptr(ds_entry, "nsAccountLock");
if (strval) { /* value is real */
- *isvirt = 0; /* value is real */
+ if (isvirt) {
+ *isvirt = 0; /* value is real */
+ }
rc = 1; /* default to enabled */
if (PL_strncasecmp(strval, "true", 4) == 0) {
rc = 0; /* account is disabled */
@@ -172,7 +173,9 @@ _check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
const struct berval *bvp = NULL;
rc = 1; /* default is enabled */
- *isvirt = 1; /* value is virtual */
+ if (isvirt) {
+ *isvirt = 1; /* value is virtual */
+ }
if ((slapi_valueset_first_value(values, &v) != -1) &&
((bvp = slapi_value_get_berval(v)) != NULL)) {
if ((bvp != NULL) && (PL_strncasecmp(bvp->bv_val, "true", 4) == 0)) {
9 years, 1 month
Branch '389-ds-base-1.3.3' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/posix-winsync/posix-winsync.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
New commits:
commit 411a8e7a2a0c2317d20c32ccbf7b801d3a11b80c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Feb 9 09:50:15 2015 -0800
Ticket #48001 - ns-activate.pl fails to activate account if it was disabled on AD
Description: commit 345d2c0870d7e8b1005a13cc9cf93865ff0cb53d
introduced a coverity defect - 12989 Dereference after null check.
(cherry picked from commit 9300e96ae0409ea5b6d24b9af0a218ac00c03ecc)
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index 9a70244..5e36792 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -140,7 +140,6 @@ enum
* Mostly copied from check_account_lock in the server code.
* Returns: 0 - account is disabled (lock == "true")
* 1 - account is enabled (lock == "false" or empty)
- * -1 - some sort of error
*/
static int
_check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
@@ -158,7 +157,9 @@ _check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
/* first, see if the attribute is a "real" attribute */
strval = slapi_entry_attr_get_charptr(ds_entry, "nsAccountLock");
if (strval) { /* value is real */
- *isvirt = 0; /* value is real */
+ if (isvirt) {
+ *isvirt = 0; /* value is real */
+ }
rc = 1; /* default to enabled */
if (PL_strncasecmp(strval, "true", 4) == 0) {
rc = 0; /* account is disabled */
@@ -179,7 +180,9 @@ _check_account_lock(Slapi_Entry *ds_entry, int *isvirt)
const struct berval *bvp = NULL;
rc = 1; /* default is enabled */
- *isvirt = 1; /* value is virtual */
+ if (isvirt) {
+ *isvirt = 1; /* value is virtual */
+ }
if ((slapi_valueset_first_value(values, &v) != -1) &&
((bvp = slapi_value_get_berval(v)) != NULL)) {
if ((bvp != NULL) && (PL_strncasecmp(bvp->bv_val, "true", 4) == 0)) {
9 years, 1 month