Changes to 'refs/tags/389-admin-1.1.41'
by Noriko Hosoi
Changes since 389-admin-1.1.11:
Endi S. Dewata (3):
Bug 573889 - Migration does not remove deprecated schema
Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries
Bug 470576 - Migration could do addition checks before commiting actions
Ludwig (1):
Ticket 47563 - cannot restart directory server from console
Mark Reynolds (16):
Ticket #286 - compilation fixes for 'format-security'
Ticket 401 - Console login fails with anonymous access disabled
Ticket 400 - BIND operation result not checked properly in admin server
Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry
Ticket 47495 - admin express: wrong instance creation time
Ticket 47497 - Admin Express - remove "Security Level"
Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time
Ticket 47300 - Update man page for remove-ds-admin.pl
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain
Ticket 47548 - register-ds-admin does not register into remote config ds
Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot
Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c
Ticket 201 - nCipher HSM cannot be configured via the console
Ticket 47929 - Admin Server - disable SSLv3 by default
Ticket 47548 - register-ds-admin.pl fails to set local bind DN and password
Nathan Kinder (49):
Bug 648949 - Merge selinux policy into base OS
Regenerated autoconf files
Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled
Bug 668950 - Add posix group support to Console
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 618897 - Wrong permissions when creating instance from Console
Bug 493424 - remove unneeded modules for admin server apache config
Bug 614690 - Don't use exec to call genrb
Bug 699815 - (cov#10859) Add missing braces in mod_admserv code
Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi
Bug 699815 - (cov#10849,10851) Remove unused variables
Bug 699907 - (cov#10844) Uninitialized time struct
Bug 699907 - (cov#10843) Use of uninitialized variable in logging code
Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi
Bug 699907 - (cov#10836) Use of uninitialized var in http conn code
Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code
Bug 700532 - (cov#10832) Incorrect if condition in dsalib
Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib
Bug 700890 - (cov#10812) Check return value of open() properly in libadmin
Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi
Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication
Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi
Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 702150 - (cov#10823) File descriptors leaked in help cgi
Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi
Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi
Bug 702150 - leak of config array in dsalib
Bug 702150 - (cov#10816) file descriptor leak in dsalib
Bug 702150 - (cov#10817) Leak of string in libdsa
Bug 702150 - Resouce leaks in htmladmin.c
Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin
Bug 702705 - NULL pointer dereferences in viewlog cgi
Bug 702705 - (cov#10803) NULL pointer dereference in security cgi
Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl
Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib
Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy
Bug 724808 - startup CGIs write temp file to /
Bug 730079 - Update SELinux policy during upgrades
Ticket #329 - Port modules to httpd 2.4
Ticket #47333 - Relabel lockfile when starting Admin Server
Ticket #47334 - Avoid quoting all settings in console.conf
Ticket 47468 - Change security password validation error is out of order
Ticket 47466 - Importing CA cert with existing name crashes security CGI
Ticket 362 - Directory Console generates insufficient key strength
Ticket 47467 - Improve CRL import error messages
Noriko Hosoi (36):
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
start-ds-admin.in -- replaced "return 1" with "exit 1"
Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies
Bug 618858 - move start-ds-admin env file into main admin server
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 245278 - Changing to a password with a single quote does not work
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 158926 - Unable to install CA certificate when using
Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user
Bug 476925 - Admin Server: Do not allow 8-bit passwords for
Trac Ticket #307 - htmladmin keeps segfaulting
If htmladmin fails to connect to the server, the cgi could crash.
Ticket #293 - remove-ds-admin.pl does not remove everything
Ticket #476 - 389 ds do not start on F18 due to missing modules
bump version to 1.1.31
Ticket #567 - Restart of Admin server from console fails on segfault
bump version to 1.1.32
bump version to 1.1.33
bump version to 1.1.34
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.36
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket #47995 - Admin Server: source code cleaning
bump version to 1.1.37
Ticket #48024 - repl-monitor invoked from adminserver cgi fails
bump version to 1.1.38
Ticket #48153 - [adminserver] support NSS 3.18
bump version to 1.1.39
Ticket #48171 - remove-ds-admin.pl removes files in the rpm
Ticket #47467 - Improve Add CRL/CKL dialog and errors
bump version to 1.1.40
Ticket #48186 - register-ds-admin.pl script prints clear text password in the terminal
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.41
Rich Megginson (66):
bump version to 1.1.12.a1
initial support for openldap
add selinux policy for dsgw
skip LD_PRELOAD if using openldap
add more log information if nss init fails
add even more nss debugging
Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized
bump version to 1.1.12.a2
fix building with mozldap
bump version to 1.1.12.a3
fix autotool build issues with properties files
setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error
Bug 656441 - Missing library path entry causes LD_PRELOAD error
bump version to 1.1.13
bump version to 1.1.14.a1
Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required
bump version to 1.1.14
bump version to 1.1.15
bump version to 1.1.16
Bug 703990 - Support upgrade from Red Hat Directory Server
bump version to 1.1.17
add support for different skins
skip rebranding current brand
bump version to 1.1.18
look for separate openldap ldif library
bump version to 1.1.19
Bug 710372 - Not able to open the Manage Certificate from DS-console
better NSS error handling - reduce memory leaks
fix typo in NSS_Shutdown warning message
added tests for the security cgi
Bug 713000 - Migration stops if old admin server cannot be stopped
Bug 718079 - Perl errors when running migrate-ds-admin.pl
Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts
bump version to 1.1.20
bump version to 1.1.21
handle binary upgrade
add man pages for ds_removal and ds_unregister
bump version to 1.1.22
fix binary paths
bump version to 1.1.23
bump version to 1.1.24
Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd
Bug 740959 - 389-console put CA certificates into wrong database
bump version to 1.1.25
Bug 767823 - selinux: need to allow admin server to connect to ldap port
bump version to 1.1.26
Ticket #161 - Review and address latest Coverity issues
Ticket #281 - TLS not working with latest openldap
bump version to 1.1.27
bump version to 1.1.28
bump version to 1.1.29
bump version to 1.1.30
ignore files generated by Eclipse
Ticket #47486 compiler warnings in adminutil, admin, dsgw
Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw
add more debugging for SSL connection problems
Ticket #47413 389-admin fails to build with latest httpd
compiler warning - ldif_read_record lineno type depends on openldap version
add Eclipse and patch files
bump version to 1.1.35
Ticket #47498 Error Message for Failed to create the configuration directory server
Ticket #418 Error with register-ds-admin.pl
Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down.
Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>"
Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour
Ticket #47478 No groups file? error restarting Admin server
Wes Hardin (1):
fix for bug 377 - Unchecked use of SELinux command
noriko (1):
Ticket #47298 - remove-ds-admin.pl does not stop the admin server
---
.gitignore | 4
Makefile.am | 109
Makefile.in | 1767 -
VERSION.sh | 4
aclocal.m4 | 7258 ----
admserv/cfgstuff/console.conf.in | 2
admserv/cfgstuff/httpd-2.2.conf.in | 13
admserv/cfgstuff/httpd-2.4.conf.in | 742
admserv/cfgstuff/httpd.conf.in | 2
admserv/cfgstuff/initconfig.in | 5
admserv/cfgstuff/start-ds-admin.in | 83
admserv/cgi-ds/ds_listdb.c | 26
admserv/cgi-ds/ds_snmpctrl.c | 5
admserv/cgi-src40/ReadLog.c | 18
admserv/cgi-src40/admlib.mk | 119
admserv/cgi-src40/admpw.c | 79
admserv/cgi-src40/cgicommon.h | 1
admserv/cgi-src40/cgicommon.properties | 3
admserv/cgi-src40/config.c | 47
admserv/cgi-src40/dllglue.c | 42
admserv/cgi-src40/ds_create.in | 18
admserv/cgi-src40/dsconfig.c | 10
admserv/cgi-src40/head.html | 1
admserv/cgi-src40/help.c | 15
admserv/cgi-src40/htmladmin.c | 810
admserv/cgi-src40/htmladmin.properties | 42
admserv/cgi-src40/monreplication.c | 7
admserv/cgi-src40/repl-monitor-cgi.pl.in | 30
admserv/cgi-src40/restartsrv.c | 9
admserv/cgi-src40/sec-activate.c | 163
admserv/cgi-src40/security.c | 348
admserv/cgi-src40/security.properties | 8
admserv/cgi-src40/start_config_ds.c | 11
admserv/cgi-src40/statpingserv.c | 82
admserv/cgi-src40/stopsrv.c | 10
admserv/cgi-src40/ugdsconfig.c | 39
admserv/cgi-src40/viewdata.c | 264
admserv/cgi-src40/viewdata.properties | 2
admserv/cgi-src40/viewlog.c | 75
admserv/cgi-src40/viewlog.properties | 6
admserv/genrb_wrapper.sh | 2
admserv/html/admserv.html.in | 11
admserv/html/htmladmin.html.in | 13
admserv/html/monreplication.html | 20
admserv/html/viewdata.html | 6
admserv/html/viewlog.html | 14
admserv/makeUpgradeTar.sh | 30
admserv/newinst/src/25changefedorato389.pl | 250
admserv/newinst/src/25rebrand.pl.in | 413
admserv/newinst/src/30updateglobalpref.pl.in | 9
admserv/newinst/src/AdminMigration.pm.in | 79
admserv/newinst/src/AdminServer.pm.in | 270
admserv/newinst/src/AdminUtil.pm.in | 91
admserv/newinst/src/ConfigDSDialogs.pm | 42
admserv/newinst/src/dirserver.map.in | 1
admserv/newinst/src/register-ds-admin.pl.in | 719
admserv/newinst/src/register-ds-admin.res.in | 38
admserv/newinst/src/register_param.map.in | 4
admserv/newinst/src/register_server.pl.in | 6
admserv/newinst/src/remove-ds-admin.pl.in | 8
admserv/newinst/src/setup-ds-admin.pl.in | 6
admserv/newinst/src/setup-ds-admin.res.in | 20
admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49
admserv/schema/ldif/10dsdata.ldif.tmpl | 39
compile | 240
config.guess | 529
config.h.in | 33
config.sub | 379
configure |38698 +++++++++-------------
configure.ac | 111
depcomp | 343
include/base/file.h | 3
include/base/util.h | 3
include/libadmin/dbtlibadmin.h | 2
include/libadmin/libadmin.h | 92
include/libdsa/dsalib.h | 15
install-sh | 538
lib/base/file.cpp | 30
lib/base/nscputil.cpp | 51
lib/libadmin/dllglue.c | 77
lib/libadmin/httpcon.c | 5
lib/libadmin/referer.c | 4
lib/libadmin/template.c | 29
lib/libadmin/util.c | 973
lib/libdsa/dsalib_conf.c | 37
lib/libdsa/dsalib_confs.c | 93
lib/libdsa/dsalib_location.c | 56
lib/libdsa/dsalib_tailf.c | 1
lib/libdsa/dsalib_updown.c | 118
lib/libdsa/dsalib_util.c | 56
ltmain.sh |14878 +++++---
m4/adminutil.m4 | 4
m4/httpd.m4 | 3
m4/mozldap.m4 | 116
m4/openldap.m4 | 138
m4/selinux.m4 | 3
man/man8/ds_removal.8 | 54
man/man8/ds_unregister.8 | 48
man/man8/register-ds-admin.pl.8 | 139
man/man8/remove-ds-admin.pl.8 | 10
man/man8/restart-ds-admin.8 | 10
man/man8/start-ds-admin.8 | 10
man/man8/stop-ds-admin.8 | 10
missing | 234
mod_admserv/mod_admserv.c | 564
mod_admserv/mod_admserv.h | 15
mod_restartd/mod_restartd-2.2.c | 22
selinux/dirsrv-admin.fc.in | 5
selinux/dirsrv-admin.te | 2
tests/ds_create/testget.1 | 2
tests/htmladmin/testget.2 | 2
tests/htmladmin/testget.3 | 2
tests/htmladmin/testget.4 | 2
tests/htmladmin/testget.5 | 2
tests/htmladmin/testget.6 | 2
tests/htmladmin/testget.7 | 2
tests/htmladmin/testget.8 | 2
tests/security/testpost.1 | 1
tests/security/testpost.10 | 1
tests/security/testpost.11 | 1
tests/security/testpost.12 | 1
tests/security/testpost.13 | 1
tests/security/testpost.14 | 1
tests/security/testpost.15 | 1
tests/security/testpost.16 | 1
tests/security/testpost.17 | 1
tests/security/testpost.18 | 1
tests/security/testpost.19 | 1
tests/security/testpost.2 | 1
tests/security/testpost.20 | 1
tests/security/testpost.21 | 1
tests/security/testpost.3 | 1
tests/security/testpost.4 | 1
tests/security/testpost.5 | 1
tests/security/testpost.6 | 1
tests/security/testpost.7 | 1
tests/security/testpost.8 | 1
tests/security/testpost.9 | 1
tests/setup.sh | 250
tests/ugdsconfig/testget.10 | 2
tests/viewdata/testget.2 | 2
tests/viewdata/testget.3 | 2
tests/viewdata/testget.4 | 2
tests/viewlog/testget.3 | 2
tests/viewlog/testget.4 | 2
wrappers/initscript.in | 3
wrappers/systemd.service.in | 24
147 files changed, 35311 insertions(+), 38215 deletions(-)
---
8 years, 4 months
VERSION.sh
by Noriko Hosoi
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 220b91d6acc6c8fadabffbc3a11fcf20c7033f9c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed May 27 13:17:02 2015 -0700
bump version to 1.1.41
diff --git a/VERSION.sh b/VERSION.sh
index 765c91f..1f0d104 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -11,7 +11,7 @@ vendorurl=http://port389.org
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=1
-VERSION_MAINT=40
+VERSION_MAINT=41
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
8 years, 4 months
admserv/cgi-src40
by Noriko Hosoi
admserv/cgi-src40/security.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
New commits:
commit 8fc8d1dca1546a285dd7505a8ecb6602c748ac8b
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed May 27 13:10:53 2015 -0700
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
Description: To invoke Manage Certificate window, NSS slot needs to be
found by looking up the token name. When the token name is "internal
(software)", the slot is supposed to be found by PK11_GetInternalKeySlot
that provides the support for FIPS instead of PK11_FindSlotByName. This
patch calls the right api based upon the token type.
https://fedorahosted.org/389/ticket/47493
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/admserv/cgi-src40/security.c b/admserv/cgi-src40/security.c
index 34bf3a7..2d7f38d 100644
--- a/admserv/cgi-src40/security.c
+++ b/admserv/cgi-src40/security.c
@@ -890,13 +890,20 @@ static void listCert(char* tokenName) {
CERTCertList *certList;
CERTCertListNode *cln;
- PK11SlotInfo *slot = PK11_FindSlotByName(tokenName);
+ PK11SlotInfo *slot = NULL;
PK11SlotInfo *internal_slot;
char *internalTokenName;
+ if (tokenName && (!strcasecmp(tokenName, "internal") ||
+ !strcasecmp(tokenName, "internal (software)"))) {
+ slot = PK11_GetInternalKeySlot();
+ } else {
+ slot = PK11_FindSlotByName(tokenName);
+ }
+
if (!slot) {
- errorRpt(GENERAL_FAILURE, getResourceString(DBT_TOKEN_NAME));
- return;
+ errorRpt(GENERAL_FAILURE, getResourceString(DBT_TOKEN_NAME));
+ return;
}
if (PK11_IsInternal(slot)) {
8 years, 4 months
admserv/newinst
by Noriko Hosoi
admserv/newinst/src/register-ds-admin.pl.in | 11 ++++++-----
admserv/newinst/src/register-ds-admin.res.in | 2 ++
2 files changed, 8 insertions(+), 5 deletions(-)
New commits:
commit 6b0e7456d2a8b605e737a62010c0bf40d03441f1
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 26 23:05:11 2015 -0700
Ticket #48186 - register-ds-admin.pl script prints clear text password in the terminal
Description: Call reg_get_passwd for the remote DS password, as well.
https://fedorahosted.org/389/ticket/48186
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/admserv/newinst/src/register-ds-admin.pl.in b/admserv/newinst/src/register-ds-admin.pl.in
index aebe0ba..04e936a 100644
--- a/admserv/newinst/src/register-ds-admin.pl.in
+++ b/admserv/newinst/src/register-ds-admin.pl.in
@@ -62,8 +62,12 @@ sub reg_get_passwd
my $key = shift;
my $value0 = shift;
my $value1 = shift;
+ my $value2 = shift;
- print("\n==============================================================================\n");
+ if ( ! $value2 )
+ {
+ print("\n==============================================================================\n");
+ }
if ( $value1 )
{
$setup->msg(0, $key, $value0, $value1);
@@ -827,10 +831,7 @@ if ($silent eq "no")
chomp($remote_binddn = <>);
}
- $setup->msg(0, 'remote_prompt', "bind password");
- while($remote_bindpw eq ""){
- chomp($remote_bindpw = <>);
- }
+ $remote_bindpw = reg_get_passwd($setup, 'remote_prompt_bind_password', "", 0, 1);
$setup->msg(0, 'remote_conn_use_ssl');
chomp($local_certdir = <>);
diff --git a/admserv/newinst/src/register-ds-admin.res.in b/admserv/newinst/src/register-ds-admin.res.in
index 99cb3e3..f7c0e67 100644
--- a/admserv/newinst/src/register-ds-admin.res.in
+++ b/admserv/newinst/src/register-ds-admin.res.in
@@ -62,6 +62,8 @@ remote_register_direction = Register local servers to
remote_prompt = Enter Remote %s:
+remote_prompt_bind_password = Enter Remote bind password:
+
remote_conn_use_ssl = If using SSL, enter certificate db directory:
remote_register_completed = Successfully registered host '%s' with the configuration server on '%s'.\n
8 years, 4 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++--------------------
1 file changed, 57 insertions(+), 51 deletions(-)
New commits:
commit 52a7299d243278de0e1877714f5ff65a5c542b5e
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 26 10:41:03 2015 -0700
Ticket #48146 - async simple paged results issue
Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced
a regression. Handling backend "be" should be done after checking OID
MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control.
https://fedorahosted.org/389/ticket/48146
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5)
(cherry picked from commit 0c7b38abfb4c5c02286efd5e698616534a798993)
(cherry picked from commit 2003d79eb3fbd3850c9a2590c65fbe146e96853d)
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 15b81b6..bfacb9e 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -407,57 +407,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
*/
operation_set_target_spec (pb->pb_op, basesdn);
- if (be_name == NULL)
- {
- /* no specific backend was requested, use the mapping tree
- */
- err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
- if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
- || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
- {
- send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
- rc = -1;
- goto free_and_return;
- }
- if (be_list[0] != NULL)
- {
- index = 0;
- if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
- /* move the index in the be_list which matches pr_be */
- while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
- index++;
- } else {
- while (be_list[index] && be_list[index+1])
- index++;
- }
- /* "be" is either pr_be or the last backend */
- be = be_list[index];
- }
- else
- be = pr_be?pr_be:NULL;
- }
- else
- {
- /* specific backend be_name was requested, use slapi_be_select_by_instance_name
- */
- if (pr_be) {
- be_single = be = pr_be;
- } else {
- be_single = be = slapi_be_select_by_instance_name(be_name);
- }
- if (be_single)
- slapi_be_Rlock(be_single);
- be_list[0] = NULL;
- referral_list[0] = NULL;
- referral = NULL;
- }
-
- /* this is time to check if mapping tree specific control
- * was used to specify that we want to parse only
- * one backend
+ /*
+ * this is time to check if mapping tree specific control was used to
+ * specify that we want to parse only one backend.
*/
slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp);
- if (NULL != ctrlp)
+ if (ctrlp)
{
if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID,
&ctl_value, &iscritical))
@@ -506,7 +461,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
}
}
}
+ }
+
+ if (be_name == NULL)
+ {
+ /* no specific backend was requested, use the mapping tree
+ */
+ err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
+ if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
+ || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
+ {
+ send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
+ rc = -1;
+ goto free_and_return;
+ }
+ if (be_list[0] != NULL)
+ {
+ index = 0;
+ if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
+ /* move the index in the be_list which matches pr_be */
+ while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
+ index++;
+ } else {
+ while (be_list[index] && be_list[index+1])
+ index++;
+ }
+ /* "be" is either pr_be or the last backend */
+ be = be_list[index];
+ }
+ else
+ be = pr_be?pr_be:NULL;
+ }
+ else
+ {
+ /* specific backend be_name was requested, use slapi_be_select_by_instance_name
+ */
+ if (pr_be) {
+ be_single = be = pr_be;
+ } else {
+ be_single = be = slapi_be_select_by_instance_name(be_name);
+ }
+ if (be_single) {
+ slapi_be_Rlock(be_single);
+ }
+ be_list[0] = NULL;
+ referral_list[0] = NULL;
+ referral = NULL;
+ }
+ /* Handle the rest of the controls. */
+ if (ctrlp)
+ {
if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS,
&ctl_value, &iscritical) )
{
@@ -1017,10 +1022,11 @@ next_be:
}
free_and_return:
- if ((be_list[0] != NULL) || (referral_list[0] != NULL))
+ if ((be_list[0] != NULL) || (referral_list[0] != NULL)) {
slapi_mapping_tree_free_all(be_list, referral_list);
- else if (be_single)
+ } else if (be_single) {
slapi_be_Unlock(be_single);
+ }
free_and_return_nolock:
slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);
8 years, 4 months
Branch '389-ds-base-1.3.2' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++--------------------
1 file changed, 57 insertions(+), 51 deletions(-)
New commits:
commit 2003d79eb3fbd3850c9a2590c65fbe146e96853d
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 26 10:41:03 2015 -0700
Ticket #48146 - async simple paged results issue
Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced
a regression. Handling backend "be" should be done after checking OID
MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control.
https://fedorahosted.org/389/ticket/48146
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5)
(cherry picked from commit 0c7b38abfb4c5c02286efd5e698616534a798993)
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index b82a171..c42aaa0 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -408,57 +408,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
*/
operation_set_target_spec (pb->pb_op, basesdn);
- if (be_name == NULL)
- {
- /* no specific backend was requested, use the mapping tree
- */
- err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
- if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
- || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
- {
- send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
- rc = -1;
- goto free_and_return;
- }
- if (be_list[0] != NULL)
- {
- index = 0;
- if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
- /* move the index in the be_list which matches pr_be */
- while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
- index++;
- } else {
- while (be_list[index] && be_list[index+1])
- index++;
- }
- /* "be" is either pr_be or the last backend */
- be = be_list[index];
- }
- else
- be = pr_be?pr_be:NULL;
- }
- else
- {
- /* specific backend be_name was requested, use slapi_be_select_by_instance_name
- */
- if (pr_be) {
- be_single = be = pr_be;
- } else {
- be_single = be = slapi_be_select_by_instance_name(be_name);
- }
- if (be_single)
- slapi_be_Rlock(be_single);
- be_list[0] = NULL;
- referral_list[0] = NULL;
- referral = NULL;
- }
-
- /* this is time to check if mapping tree specific control
- * was used to specify that we want to parse only
- * one backend
+ /*
+ * this is time to check if mapping tree specific control was used to
+ * specify that we want to parse only one backend.
*/
slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp);
- if (NULL != ctrlp)
+ if (ctrlp)
{
if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID,
&ctl_value, &iscritical))
@@ -513,7 +468,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
}
}
}
+ }
+
+ if (be_name == NULL)
+ {
+ /* no specific backend was requested, use the mapping tree
+ */
+ err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
+ if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
+ || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
+ {
+ send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
+ rc = -1;
+ goto free_and_return;
+ }
+ if (be_list[0] != NULL)
+ {
+ index = 0;
+ if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
+ /* move the index in the be_list which matches pr_be */
+ while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
+ index++;
+ } else {
+ while (be_list[index] && be_list[index+1])
+ index++;
+ }
+ /* "be" is either pr_be or the last backend */
+ be = be_list[index];
+ }
+ else
+ be = pr_be?pr_be:NULL;
+ }
+ else
+ {
+ /* specific backend be_name was requested, use slapi_be_select_by_instance_name
+ */
+ if (pr_be) {
+ be_single = be = pr_be;
+ } else {
+ be_single = be = slapi_be_select_by_instance_name(be_name);
+ }
+ if (be_single) {
+ slapi_be_Rlock(be_single);
+ }
+ be_list[0] = NULL;
+ referral_list[0] = NULL;
+ referral = NULL;
+ }
+ /* Handle the rest of the controls. */
+ if (ctrlp)
+ {
if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS,
&ctl_value, &iscritical) )
{
@@ -1024,10 +1029,11 @@ next_be:
}
free_and_return:
- if ((be_list[0] != NULL) || (referral_list[0] != NULL))
+ if ((be_list[0] != NULL) || (referral_list[0] != NULL)) {
slapi_mapping_tree_free_all(be_list, referral_list);
- else if (be_single)
+ } else if (be_single) {
slapi_be_Unlock(be_single);
+ }
free_and_return_nolock:
slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);
8 years, 4 months
Branch '389-ds-base-1.3.3' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++--------------------
1 file changed, 57 insertions(+), 51 deletions(-)
New commits:
commit 0c7b38abfb4c5c02286efd5e698616534a798993
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 26 10:41:03 2015 -0700
Ticket #48146 - async simple paged results issue
Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced
a regression. Handling backend "be" should be done after checking OID
MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control.
https://fedorahosted.org/389/ticket/48146
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5)
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 1d454b7..bb053c1 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -408,57 +408,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
*/
operation_set_target_spec (pb->pb_op, basesdn);
- if (be_name == NULL)
- {
- /* no specific backend was requested, use the mapping tree
- */
- err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
- if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
- || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
- {
- send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
- rc = -1;
- goto free_and_return;
- }
- if (be_list[0] != NULL)
- {
- index = 0;
- if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
- /* move the index in the be_list which matches pr_be */
- while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
- index++;
- } else {
- while (be_list[index] && be_list[index+1])
- index++;
- }
- /* "be" is either pr_be or the last backend */
- be = be_list[index];
- }
- else
- be = pr_be?pr_be:NULL;
- }
- else
- {
- /* specific backend be_name was requested, use slapi_be_select_by_instance_name
- */
- if (pr_be) {
- be_single = be = pr_be;
- } else {
- be_single = be = slapi_be_select_by_instance_name(be_name);
- }
- if (be_single)
- slapi_be_Rlock(be_single);
- be_list[0] = NULL;
- referral_list[0] = NULL;
- referral = NULL;
- }
-
- /* this is time to check if mapping tree specific control
- * was used to specify that we want to parse only
- * one backend
+ /*
+ * this is time to check if mapping tree specific control was used to
+ * specify that we want to parse only one backend.
*/
slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp);
- if (NULL != ctrlp)
+ if (ctrlp)
{
if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID,
&ctl_value, &iscritical))
@@ -513,7 +468,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
}
}
}
+ }
+
+ if (be_name == NULL)
+ {
+ /* no specific backend was requested, use the mapping tree
+ */
+ err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
+ if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
+ || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
+ {
+ send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
+ rc = -1;
+ goto free_and_return;
+ }
+ if (be_list[0] != NULL)
+ {
+ index = 0;
+ if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
+ /* move the index in the be_list which matches pr_be */
+ while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
+ index++;
+ } else {
+ while (be_list[index] && be_list[index+1])
+ index++;
+ }
+ /* "be" is either pr_be or the last backend */
+ be = be_list[index];
+ }
+ else
+ be = pr_be?pr_be:NULL;
+ }
+ else
+ {
+ /* specific backend be_name was requested, use slapi_be_select_by_instance_name
+ */
+ if (pr_be) {
+ be_single = be = pr_be;
+ } else {
+ be_single = be = slapi_be_select_by_instance_name(be_name);
+ }
+ if (be_single) {
+ slapi_be_Rlock(be_single);
+ }
+ be_list[0] = NULL;
+ referral_list[0] = NULL;
+ referral = NULL;
+ }
+ /* Handle the rest of the controls. */
+ if (ctrlp)
+ {
if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS,
&ctl_value, &iscritical) )
{
@@ -1024,10 +1029,11 @@ next_be:
}
free_and_return:
- if ((be_list[0] != NULL) || (referral_list[0] != NULL))
+ if ((be_list[0] != NULL) || (referral_list[0] != NULL)) {
slapi_mapping_tree_free_all(be_list, referral_list);
- else if (be_single)
+ } else if (be_single) {
slapi_be_Unlock(be_single);
+ }
free_and_return_nolock:
slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);
8 years, 4 months
ldap/servers
by Noriko Hosoi
ldap/servers/slapd/opshared.c | 108 ++++++++++++++++++++++--------------------
1 file changed, 57 insertions(+), 51 deletions(-)
New commits:
commit bd2c0d0b6a499d7f91a36e8a9feb83e4fbd3dac5
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue May 26 10:41:03 2015 -0700
Ticket #48146 - async simple paged results issue
Description: commit 5060d11f5039efa8534a8b65392ac6e10cbd2168 introduced
a regression. Handling backend "be" should be done after checking OID
MTN_CONTROL_USE_ONE_BACKEND_EXT_OID in the request control.
https://fedorahosted.org/389/ticket/48146
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 1d454b7..bb053c1 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -408,57 +408,12 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
*/
operation_set_target_spec (pb->pb_op, basesdn);
- if (be_name == NULL)
- {
- /* no specific backend was requested, use the mapping tree
- */
- err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
- if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
- || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
- {
- send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
- rc = -1;
- goto free_and_return;
- }
- if (be_list[0] != NULL)
- {
- index = 0;
- if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
- /* move the index in the be_list which matches pr_be */
- while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
- index++;
- } else {
- while (be_list[index] && be_list[index+1])
- index++;
- }
- /* "be" is either pr_be or the last backend */
- be = be_list[index];
- }
- else
- be = pr_be?pr_be:NULL;
- }
- else
- {
- /* specific backend be_name was requested, use slapi_be_select_by_instance_name
- */
- if (pr_be) {
- be_single = be = pr_be;
- } else {
- be_single = be = slapi_be_select_by_instance_name(be_name);
- }
- if (be_single)
- slapi_be_Rlock(be_single);
- be_list[0] = NULL;
- referral_list[0] = NULL;
- referral = NULL;
- }
-
- /* this is time to check if mapping tree specific control
- * was used to specify that we want to parse only
- * one backend
+ /*
+ * this is time to check if mapping tree specific control was used to
+ * specify that we want to parse only one backend.
*/
slapi_pblock_get(pb, SLAPI_REQCONTROLS, &ctrlp);
- if (NULL != ctrlp)
+ if (ctrlp)
{
if (slapi_control_present(ctrlp, MTN_CONTROL_USE_ONE_BACKEND_EXT_OID,
&ctl_value, &iscritical))
@@ -513,7 +468,57 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
}
}
}
+ }
+
+ if (be_name == NULL)
+ {
+ /* no specific backend was requested, use the mapping tree
+ */
+ err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
+ if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
+ || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
+ {
+ send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
+ rc = -1;
+ goto free_and_return;
+ }
+ if (be_list[0] != NULL)
+ {
+ index = 0;
+ if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
+ /* move the index in the be_list which matches pr_be */
+ while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
+ index++;
+ } else {
+ while (be_list[index] && be_list[index+1])
+ index++;
+ }
+ /* "be" is either pr_be or the last backend */
+ be = be_list[index];
+ }
+ else
+ be = pr_be?pr_be:NULL;
+ }
+ else
+ {
+ /* specific backend be_name was requested, use slapi_be_select_by_instance_name
+ */
+ if (pr_be) {
+ be_single = be = pr_be;
+ } else {
+ be_single = be = slapi_be_select_by_instance_name(be_name);
+ }
+ if (be_single) {
+ slapi_be_Rlock(be_single);
+ }
+ be_list[0] = NULL;
+ referral_list[0] = NULL;
+ referral = NULL;
+ }
+ /* Handle the rest of the controls. */
+ if (ctrlp)
+ {
if ( slapi_control_present (ctrlp, LDAP_CONTROL_GET_EFFECTIVE_RIGHTS,
&ctl_value, &iscritical) )
{
@@ -1024,10 +1029,11 @@ next_be:
}
free_and_return:
- if ((be_list[0] != NULL) || (referral_list[0] != NULL))
+ if ((be_list[0] != NULL) || (referral_list[0] != NULL)) {
slapi_mapping_tree_free_all(be_list, referral_list);
- else if (be_single)
+ } else if (be_single) {
slapi_be_Unlock(be_single);
+ }
free_and_return_nolock:
slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &rc);
8 years, 4 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/bind.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
New commits:
commit 164cb2460538d63ee2b2cde3e28323e51dc9741c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Sat May 9 18:55:39 2015 -0700
Ticket #48183 - bind on db chained to AD returns err=32
Description by rmeggins(a)redhat.com: bind is doing a search for the entry
post bind, which fails because we don't enable password policy chaining
by default. I think in this case, we should not look up password policy,
because if the remote is AD or some other non-389 server, we can't use
the password policy information. We should instead rely on the remote
server to evaluate the password policy.
The commit 4fc53e1a63222d0ff67c30a59f2cff4b535f90a8 introduced the bug.
Ticket #47748 - Simultaneous adding a user and binding as the user could
fail in the password policy check
https://fedorahosted.org/389/ticket/48183
Revewed by nhosoi(a)redhat.com.
(cherry picked from commit eb46e6f1975b19956bb38d5e070e6eb5159200b4)
(cherry picked from commit 03bee0a0d4dbe313bca88cfafc605f6cb01b9fdc)
(cherry picked from commit 46242d88b62716d99641eceac26476a9c842c149)
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index edb36c4..11ec22e 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -777,7 +777,8 @@ do_bind( Slapi_PBlock *pb )
* was in be_bind. Since be_bind returned SLAPI_BIND_SUCCESS,
* the entry is in the DS. So, we need to retrieve it once more.
*/
- if (!bind_target_entry) {
+ if (!slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA) &&
+ !bind_target_entry) {
bind_target_entry = get_entry(pb, slapi_sdn_get_ndn(sdn));
if (bind_target_entry) {
myrc = slapi_check_account_lock(pb, bind_target_entry,
8 years, 4 months
Branch '389-ds-base-1.3.2' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/bind.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
New commits:
commit 46242d88b62716d99641eceac26476a9c842c149
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Sat May 9 18:55:39 2015 -0700
Ticket #48183 - bind on db chained to AD returns err=32
Description by rmeggins(a)redhat.com: bind is doing a search for the entry
post bind, which fails because we don't enable password policy chaining
by default. I think in this case, we should not look up password policy,
because if the remote is AD or some other non-389 server, we can't use
the password policy information. We should instead rely on the remote
server to evaluate the password policy.
The commit 4fc53e1a63222d0ff67c30a59f2cff4b535f90a8 introduced the bug.
Ticket #47748 - Simultaneous adding a user and binding as the user could
fail in the password policy check
https://fedorahosted.org/389/ticket/48183
Revewed by nhosoi(a)redhat.com.
(cherry picked from commit eb46e6f1975b19956bb38d5e070e6eb5159200b4)
(cherry picked from commit 03bee0a0d4dbe313bca88cfafc605f6cb01b9fdc)
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index bc4aa24..2b9d67c 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -777,7 +777,8 @@ do_bind( Slapi_PBlock *pb )
* was in be_bind. Since be_bind returned SLAPI_BIND_SUCCESS,
* the entry is in the DS. So, we need to retrieve it once more.
*/
- if (!bind_target_entry) {
+ if (!slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA) &&
+ !bind_target_entry) {
bind_target_entry = get_entry(pb, slapi_sdn_get_ndn(sdn));
if (bind_target_entry) {
myrc = slapi_check_account_lock(pb, bind_target_entry,
8 years, 4 months