Branch '389-ds-base-1.3.3' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/replication/repl5_replica_config.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 14e2e340e872051d114125242d61da062f46890c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon May 18 14:51:55 2015 -0400
Ticket 48158 - cleanAllRUV task limit not being enforced correctly
Bug Description: The task limit check was only counting tasks that had
already begun the cleaning process. If the task was waiting
for a replica to be online before it starting the cleaning
process, then task count was not incremented, and limit
check was essentially bypassed.
Fix Description: Use the "pre-cleaned" rid list to determine the task count.
The pre-cleaned list is updated as soon a task request
comes in - not once the cleaning starts.
https://fedorahosted.org/389/ticket/48158
Reviwed by: nhosoi(Thanks!)
(cherry picked from commit d774b19fe6a1626cca3c92b125e56a22771bba5a)
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index d68abff..767853e 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -3453,7 +3453,7 @@ get_cleanruv_task_count()
slapi_rwlock_wrlock(rid_lock);
for(i = 0; i < CLEANRIDSIZ; i++){
- if(cleaned_rids[i] != 0){
+ if(pre_cleaned_rids[i] != 0){
count++;
}
}
8 years, 10 months
ldap/servers
by Mark Reynolds
ldap/servers/plugins/replication/repl5_replica_config.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit d774b19fe6a1626cca3c92b125e56a22771bba5a
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon May 18 14:51:55 2015 -0400
Ticket 48158 - cleanAllRUV task limit not being enforced correctly
Bug Description: The task limit check was only counting tasks that had
already begun the cleaning process. If the task was waiting
for a replica to be online before it starting the cleaning
process, then task count was not incremented, and limit
check was essentially bypassed.
Fix Description: Use the "pre-cleaned" rid list to determine the task count.
The pre-cleaned list is updated as soon a task request
comes in - not once the cleaning starts.
https://fedorahosted.org/389/ticket/48158
Reviwed by: nhosoi(Thanks!)
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 717a765..6d6c733 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -3459,7 +3459,7 @@ get_cleanruv_task_count()
slapi_rwlock_wrlock(rid_lock);
for(i = 0; i < CLEANRIDSIZ; i++){
- if(cleaned_rids[i] != 0){
+ if(pre_cleaned_rids[i] != 0){
count++;
}
}
8 years, 10 months
ldap/servers
by Mark Reynolds
ldap/servers/plugins/uiduniq/uid.c | 30 ++++++++++++++++--------------
1 file changed, 16 insertions(+), 14 deletions(-)
New commits:
commit c9220fe7bc0068c9cf22f2f291f5f2ba190a117c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue May 12 11:47:52 2015 -0400
Ticket 48026 - Fix memory leak in uniqueness plugin
Bug Description: The config free function did not free all of the
config properly
Fix Description: Need to free the "attrs" pointer and the "attr_friendly"
char string.
https://fedorahosted.org/389/ticket/48026
Reviewed by: rmeggins(Thanks!)
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index 85f3d9e..aef83b9 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -129,21 +129,23 @@ static char *moreInfo =
static void
free_uniqueness_config(struct attr_uniqueness_config *config)
{
- int i;
+ int i;
- for (i = 0; config->attrs && config->attrs[i]; i++) {
- slapi_ch_free_string((char **) &(config->attrs[i]));
- }
- for (i = 0; config->subtrees && config->subtrees[i]; i++) {
- slapi_sdn_free(&config->subtrees[i]);
- }
- for (i = 0; config->exclude_subtrees && config->exclude_subtrees[i]; i++) {
- slapi_sdn_free(&config->exclude_subtrees[i]);
- }
- slapi_ch_free((void **) &config->subtrees);
- slapi_ch_free((void **) &config->exclude_subtrees);
- slapi_ch_free_string((char **) &config->top_entry_oc);
- slapi_ch_free_string((char **) &config->subtree_entries_oc);
+ for (i = 0; config->attrs && config->attrs[i]; i++) {
+ slapi_ch_free_string((char **) &(config->attrs[i]));
+ }
+ for (i = 0; config->subtrees && config->subtrees[i]; i++) {
+ slapi_sdn_free(&config->subtrees[i]);
+ }
+ for (i = 0; config->exclude_subtrees && config->exclude_subtrees[i]; i++) {
+ slapi_sdn_free(&config->exclude_subtrees[i]);
+ }
+ slapi_ch_free((void **) &config->attrs);
+ slapi_ch_free((void **) &config->subtrees);
+ slapi_ch_free((void **) &config->exclude_subtrees);
+ slapi_ch_free_string(&config->attr_friendly);
+ slapi_ch_free_string((char **) &config->top_entry_oc);
+ slapi_ch_free_string((char **) &config->subtree_entries_oc);
}
/*
8 years, 10 months
ldap/servers
by Mark Reynolds
ldap/servers/plugins/uiduniq/uid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 48a9d16a43d38af1292a1f306d23243702286608
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue May 12 10:43:26 2015 -0400
Ticket 48026 - fix invalid write for friendly attribute names
Bug Description: When the friendly attribute names are read from the config
entry they are stored in an inproperly sized char pointer.
Fix Description: The attr_friendly char pointer needs one additional byte to
account for the final trailing space that is appended.
https://fedorahosted.org/389/ticket/48026
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index 5b57828..85f3d9e 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -395,7 +395,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry)
for (i = 0; tmp_config->attrs && (tmp_config->attrs)[i]; i++) {
attrLen += strlen((tmp_config->attrs)[i]) + 1;
}
- tmp_config->attr_friendly = (char *) slapi_ch_calloc(attrLen, sizeof(char));
+ tmp_config->attr_friendly = (char *) slapi_ch_calloc(attrLen + 1, sizeof(char));
fp = tmp_config->attr_friendly;
for (i = 0; tmp_config->attrs && (tmp_config->attrs)[i]; i++) {
strcpy(fp, (tmp_config->attrs)[i] );
8 years, 10 months
ldap/servers
by Richard Allen Megginson
ldap/servers/slapd/conntable.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
New commits:
commit 1bf67a4fff12aca953bbb5322737cb9ea0e5dadb
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Mon May 11 11:33:04 2015 -0600
Ticket #48122 nunc-stans FD leak
https://fedorahosted.org/389/ticket/48122
Reviewed by: mreynolds (Thanks!)
Branch: master
Fix Description: Called connection acquire from within a PR_ASSERT so
the code was only called with DEBUG active.
Platforms tested: Fedora 20, EL7
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/conntable.c b/ldap/servers/slapd/conntable.c
index e7ce5e5..cd05313 100644
--- a/ldap/servers/slapd/conntable.c
+++ b/ldap/servers/slapd/conntable.c
@@ -355,7 +355,9 @@ connection_table_move_connection_on_to_active_list(Connection_Table *ct,Connecti
PR_Lock(ct->table_mutex);
- PR_ASSERT(0 == connection_acquire_nolock (c));
+ if (connection_acquire_nolock (c)) {
+ PR_ASSERT(0);
+ }
#ifdef FOR_DEBUGGING
slapi_log_error(SLAPI_LOG_FATAL, "connection", "Moving connection into active list\n");
8 years, 10 months
3 commits - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/opshared.c | 93 ++++++++++++++++++--------------------
ldap/servers/slapd/pagedresults.c | 11 ++++
ldap/servers/slapd/proto-slap.h | 2
ldap/servers/slapd/result.c | 32 ++++++++++++-
4 files changed, 88 insertions(+), 50 deletions(-)
New commits:
commit 4051fe0eba4128bae88fecfbf2c9441aeb334796
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon May 4 14:06:43 2015 -0700
Ticket #48146 - async simple paged results issue
Description: Invalid index could cause Invalid read.
https://fedorahosted.org/389/ticket/48146
(cherry picked from commit 8e21bfbe4fcac79cf39e5c6b579c4bc88e05257e)
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index a3a5fc4..327da54 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -138,6 +138,13 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
memcpy(ptr, cookie.bv_val, cookie.bv_len);
*(ptr+cookie.bv_len) = '\0';
*index = strtol(ptr, NULL, 10);
+ if (conn->c_pagedresults.prl_maxlen <= *index) {
+ rc = LDAP_PROTOCOL_ERROR;
+ LDAPDebug1Arg(LDAP_DEBUG_ANY,
+ "pagedresults_parse_control_value: invalid cookie: %d\n",
+ *index);
+ goto bail;
+ }
slapi_ch_free_string(&ptr);
prp = conn->c_pagedresults.prl_list + *index;
if (!(prp->pr_search_result_set)) { /* freed and reused for the next backend. */
@@ -162,6 +169,7 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
"pagedresults_parse_control_value: invalid cookie: %d\n",
*index);
}
+bail:
PR_Unlock(conn->c_mutex);
LDAPDebug1Arg(LDAP_DEBUG_TRACE,
commit 5e9c4f1f09596dd076a6c3a0bb419580e8fd705e
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri May 1 12:01:13 2015 -0700
Ticket #48146 - async simple paged results issue; need to close a small window for a pr index competed among multiple threads.
Description: If multiple async simple paged results requests come in via one
connection simultaneously, the same slot in the paged results array in the
connection could be shared. If one of them has to do paging, the search
request object stashed in the paged result array slot could be freed by the
other request if it has the shorter life cycle.
These 3 reqs use the same paged results array slot.
req0: <--------------><----x
page1 page2
req1: <----->
req2: <------->
frees search result object of req0
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit 3cf85d1ad6cbc0feac5578dee5ce259c0f65055f)
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 272e550..1d454b7 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -408,6 +408,51 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
*/
operation_set_target_spec (pb->pb_op, basesdn);
+ if (be_name == NULL)
+ {
+ /* no specific backend was requested, use the mapping tree
+ */
+ err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
+ if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
+ || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
+ {
+ send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
+ rc = -1;
+ goto free_and_return;
+ }
+ if (be_list[0] != NULL)
+ {
+ index = 0;
+ if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
+ /* move the index in the be_list which matches pr_be */
+ while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
+ index++;
+ } else {
+ while (be_list[index] && be_list[index+1])
+ index++;
+ }
+ /* "be" is either pr_be or the last backend */
+ be = be_list[index];
+ }
+ else
+ be = pr_be?pr_be:NULL;
+ }
+ else
+ {
+ /* specific backend be_name was requested, use slapi_be_select_by_instance_name
+ */
+ if (pr_be) {
+ be_single = be = pr_be;
+ } else {
+ be_single = be = slapi_be_select_by_instance_name(be_name);
+ }
+ if (be_single)
+ slapi_be_Rlock(be_single);
+ be_list[0] = NULL;
+ referral_list[0] = NULL;
+ referral = NULL;
+ }
+
/* this is time to check if mapping tree specific control
* was used to specify that we want to parse only
* one backend
@@ -478,8 +523,7 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
if ( slapi_control_present (ctrlp, LDAP_CONTROL_PAGEDRESULTS,
&ctl_value, &iscritical) )
{
- rc = pagedresults_parse_control_value(pb, ctl_value,
- &pagesize, &pr_idx);
+ rc = pagedresults_parse_control_value(pb, ctl_value, &pagesize, &pr_idx, be);
/* Let's set pr_idx even if it fails; in case, pr_idx == -1. */
slapi_pblock_set(pb, SLAPI_PAGED_RESULTS_INDEX, &pr_idx);
if ((LDAP_SUCCESS == rc) ||
@@ -520,51 +564,6 @@ op_shared_search (Slapi_PBlock *pb, int send_result)
}
}
- if (be_name == NULL)
- {
- /* no specific backend was requested, use the mapping tree
- */
- err_code = slapi_mapping_tree_select_all(pb, be_list, referral_list, errorbuf);
- if (((err_code != LDAP_SUCCESS) && (err_code != LDAP_OPERATIONS_ERROR) && (err_code != LDAP_REFERRAL))
- || ((err_code == LDAP_OPERATIONS_ERROR) && (be_list[0] == NULL)))
- {
- send_ldap_result(pb, err_code, NULL, errorbuf, 0, NULL);
- rc = -1;
- goto free_and_return;
- }
- if (be_list[0] != NULL)
- {
- index = 0;
- if (pr_be) { /* PAGED RESULT: be is found from the previous paging. */
- /* move the index in the be_list which matches pr_be */
- while (be_list[index] && be_list[index+1] && pr_be != be_list[index])
- index++;
- } else {
- while (be_list[index] && be_list[index+1])
- index++;
- }
- /* "be" is either pr_be or the last backend */
- be = be_list[index];
- }
- else
- be = pr_be?pr_be:NULL;
- }
- else
- {
- /* specific backend be_name was requested, use slapi_be_select_by_instance_name
- */
- if (pr_be) {
- be_single = be = pr_be;
- } else {
- be_single = be = slapi_be_select_by_instance_name(be_name);
- }
- if (be_single)
- slapi_be_Rlock(be_single);
- be_list[0] = NULL;
- referral_list[0] = NULL;
- referral = NULL;
- }
-
slapi_pblock_set(pb, SLAPI_BACKEND_COUNT, &index);
if (be)
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index e61c000..a3a5fc4 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -58,7 +58,7 @@
int
pagedresults_parse_control_value( Slapi_PBlock *pb,
struct berval *psbvp, ber_int_t *pagesize,
- int *index )
+ int *index, Slapi_Backend *be )
{
int rc = LDAP_SUCCESS;
struct berval cookie = {0};
@@ -119,6 +119,7 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
} else {
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++) {
if (!conn->c_pagedresults.prl_list[i].pr_current_be) {
+ conn->c_pagedresults.prl_list[i].pr_current_be = be;
*index = i;
break;
}
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 408543e..ee32bd0 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1487,7 +1487,7 @@ int slapd_do_all_nss_ssl_init(int slapd_exemode, int importexport_encrypt,
* pagedresults.c
*/
int pagedresults_parse_control_value(Slapi_PBlock *pb, struct berval *psbvp,
- ber_int_t *pagesize, int *index);
+ ber_int_t *pagesize, int *index, Slapi_Backend *be);
void pagedresults_set_response_control(Slapi_PBlock *pb, int iscritical,
ber_int_t estimate,
int curr_search_count, int index);
commit 09c730bec94bfd5f40f46da467a93768ced061f6
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri May 1 10:50:39 2015 -0700
Ticket #48146 - async simple paged results issue; log pr index
Description: When the request is a simple paged results search,
log pr index in the access log.
Sample access log for "getent netgroup <name>":
[..] conn=23 op=521 SRCH base="cn=accounts,dc=testrelm,dc=test" scope=2 filter="(&(|(memberOf=ipaUniqueID=3036b6a0-ee18-11e4-b7dd-00215e2032c0,cn=ng,cn=alt,dc=testrelm,dc=test))(objectClass=ipaHost))" attrs="objectClass cn fqdn serverHostName memberOf ipaSshPubKey ipaUniqueID"
[..] conn=23 op=521 RESULT err=0 tag=101 nentries=200 etime=0 notes=P pr_idx=3
https://fedorahosted.org/389/ticket/48146
Reviewed by rmeggins(a)redhat.com (Thanks, Rich!!)
(cherry picked from commit 9eb20d89755160aa916544c7cfce0ad066e538f7)
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index d5984df..6ff70e3 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -1961,6 +1961,9 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie
CSN *operationcsn = NULL;
char csn_str[CSN_STRSIZE + 5];
char etime[ETIME_BUFSIZ];
+ int pr_idx = -1;
+
+ slapi_pblock_get(pb, SLAPI_PAGED_RESULTS_INDEX, &pr_idx);
internal_op = operation_is_flag_set( op, OP_FLAG_INTERNAL );
@@ -2054,7 +2057,34 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie
}
slapi_ch_free((void**)&dn);
} else {
- if ( !internal_op )
+ if (pr_idx > -1)
+ {
+ if ( !internal_op )
+ {
+ slapi_log_access( LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " op=%d RESULT err=%d"
+ " tag=%" BERTAG_T " nentries=%d etime=%s%s%s"
+ " pr_idx=%d\n",
+ op->o_connid,
+ op->o_opid,
+ err, tag, nentries,
+ etime,
+ notes_str, csn_str, pr_idx );
+ }
+ else
+ {
+ slapi_log_access( LDAP_DEBUG_ARGS,
+ "conn=%s op=%d RESULT err=%d"
+ " tag=%" BERTAG_T " nentries=%d etime=%s%s%s"
+ " pr_idx=%d\n",
+ LOG_INTERNAL_OP_CON_ID,
+ LOG_INTERNAL_OP_OP_ID,
+ err, tag, nentries,
+ etime,
+ notes_str, csn_str, pr_idx );
+ }
+ }
+ else if ( !internal_op )
{
slapi_log_access( LDAP_DEBUG_STATS,
"conn=%" NSPRIu64 " op=%d RESULT err=%d"
8 years, 10 months
Branch '389-ds-base-1.2.11' - ldap/admin
by Noriko Hosoi
ldap/admin/src/scripts/restart-dirsrv.in | 15 +++++++++++----
ldap/admin/src/scripts/start-dirsrv.in | 1 +
ldap/admin/src/scripts/stop-dirsrv.in | 1 +
3 files changed, 13 insertions(+), 4 deletions(-)
New commits:
commit 070037a3f9ac880c5c38e38419ad23bf4209eb47
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu May 7 15:42:18 2015 -0700
Ticket #48148 - start/stop/restart-dirsrv utilities should ignore admin-serv directory
Description:
1) The script restart-dirsrv also needed to skip /etc/sysconfig/dirsrv-admin.
This patch silently skips "dirsrv-admin" for restarting dirsrv, as well.
2) If the non-root user runs start/stop/restart-dirsrv, it checks ~/.dirsrv
to look for the dirsrv-* file. If the directory is empty, it accidentally
picks up a file name from the current directory, which is not right.
This patch checks the /etc/sysconfig or ~/.dirsrv directory whether the
dirsrv-* file exists or not. If it does not, the scripts just exit with
SUCCESS (== 0).
https://fedorahosted.org/389/ticket/48148
Reviewed and commentted by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/ldap/admin/src/scripts/restart-dirsrv.in b/ldap/admin/src/scripts/restart-dirsrv.in
index 76fb176..79fc1b1 100644
--- a/ldap/admin/src/scripts/restart-dirsrv.in
+++ b/ldap/admin/src/scripts/restart-dirsrv.in
@@ -10,6 +10,10 @@
restart_instance() {
SERV_ID=$1
+ if [ $SERV_ID == "admin" ]; then
+ #ignore admin
+ return 0
+ fi
server_already_stopped=0
@sbindir@/stop-dirsrv -d $initconfig_dir $SERV_ID
status=$?
@@ -48,12 +52,15 @@ if [ "$#" -eq 0 ]; then
# We're restarting all instances.
ret=0
for i in $initconfig_dir/@package_name@-*; do
+ if [ ! -f "$i" ] ; then break ; fi
regex=s,$initconfig_dir/@package_name@-,,g
inst=`echo $i | sed -e $regex`
- echo Restarting instance \"$inst\"
- restart_instance $inst
- if [ "$?" -ne 0 ]; then
- ret=$?
+ if [ $inst != "admin" ]; then
+ echo Restarting instance \"$inst\"
+ restart_instance $inst
+ if [ "$?" -ne 0 ]; then
+ ret=$?
+ fi
fi
done
exit $ret
diff --git a/ldap/admin/src/scripts/start-dirsrv.in b/ldap/admin/src/scripts/start-dirsrv.in
index 0a38c4c..4e36939 100755
--- a/ldap/admin/src/scripts/start-dirsrv.in
+++ b/ldap/admin/src/scripts/start-dirsrv.in
@@ -129,6 +129,7 @@ if [ "$#" -eq 0 ]; then
# We're starting all instances.
ret=0
for i in $initconfig_dir/@package_name@-*; do
+ if [ ! -f "$i" ] ; then break ; fi
regex=s,$initconfig_dir/@package_name@-,,g
inst=`echo $i | sed -e $regex`
start_instance $inst
diff --git a/ldap/admin/src/scripts/stop-dirsrv.in b/ldap/admin/src/scripts/stop-dirsrv.in
index 076af87..15a84a4 100755
--- a/ldap/admin/src/scripts/stop-dirsrv.in
+++ b/ldap/admin/src/scripts/stop-dirsrv.in
@@ -77,6 +77,7 @@ if [ "$#" -eq 0 ]; then
# We're stopping all instances.
ret=0
for i in $initconfig_dir/@package_name@-*; do
+ if [ ! -f "$i" ] ; then break ; fi
regex=s,$initconfig_dir/@package_name@-,,g
inst=`echo $i | sed -e $regex`
stop_instance $inst
8 years, 10 months
dirsrvtests/tickets ldap/servers
by thierry bordaz
dirsrvtests/tickets/ticket47823_test.py | 13 -
dirsrvtests/tickets/ticket47927_test.py | 300 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/uiduniq/uid.c | 97 ++++++++--
3 files changed, 389 insertions(+), 21 deletions(-)
New commits:
commit cd9afbbeb1570adf663acb5b8f043a2012b839aa
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Tue Apr 28 19:35:34 2015 +0200
Ticket 47927: Uniqueness plugin: should allow to exclude some subtrees from its scope
Bug Description:
Support excluding subtrees in uniqueness plugin
Fix Description:
Exclude subtrees from uniqueness check if they are specified in the
plugin config.
To exclude certain parts of the tree from uniqueness check,
set
uniqueness-exclude-subtrees: cn=subtree,dc=example,dc=com
in the plugin's configuration.
Only new style configuration is supported for specifying excludes.
https://fedorahosted.org/389/ticket/47927
Reviewed by: Rich (thanks !)
Platforms tested: F17
Flag Day: no
Doc impact: yes (new uniqueness attribute uniqueness-exclude-subtrees)
diff --git a/dirsrvtests/tickets/ticket47823_test.py b/dirsrvtests/tickets/ticket47823_test.py
index 317ebf5..e685fbf 100644
--- a/dirsrvtests/tickets/ticket47823_test.py
+++ b/dirsrvtests/tickets/ticket47823_test.py
@@ -59,11 +59,11 @@ def topology(request):
'''
global installation_prefix
- if installation_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation_prefix
- standalone = DirSrv(verbose=False)
+ standalone = DirSrv(verbose=False)
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
@@ -629,6 +629,7 @@ def test_ticket47823_invalid_config_1(topology):
topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
# Check the server did not restart
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '65536')])
try:
topology.standalone.restart(timeout=5)
ent = topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
@@ -640,7 +641,7 @@ def test_ticket47823_invalid_config_1(topology):
pass
# Check the expected error message
- regex = re.compile("Config info: attribute name not defined")
+ regex = re.compile("Config fail: unable to parse old style")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -732,6 +733,7 @@ def test_ticket47823_invalid_config_3(topology):
topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
# Check the server did not restart
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '65536')])
try:
topology.standalone.restart(timeout=5)
ent = topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
@@ -743,7 +745,7 @@ def test_ticket47823_invalid_config_3(topology):
pass
# Check the expected error message
- regex = re.compile("Config info: objectclass for subtree entries is not defined")
+ regex = re.compile("Config fail: unable to parse old style")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -925,6 +927,7 @@ def test_ticket47823_invalid_config_7(topology):
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1="this_is dummy DN", subtree_2="an other=dummy DN", type_config='new', across_subtrees=False)
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '65536')])
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
diff --git a/dirsrvtests/tickets/ticket47927_test.py b/dirsrvtests/tickets/ticket47927_test.py
new file mode 100644
index 0000000..ee1f130
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47927_test.py
@@ -0,0 +1,300 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+installation1_prefix = None
+
+EXCLUDED_CONTAINER_CN = "excluded_container"
+EXCLUDED_CONTAINER_DN = "cn=%s,%s" % (EXCLUDED_CONTAINER_CN, SUFFIX)
+
+EXCLUDED_BIS_CONTAINER_CN = "excluded_bis_container"
+EXCLUDED_BIS_CONTAINER_DN = "cn=%s,%s" % (EXCLUDED_BIS_CONTAINER_CN, SUFFIX)
+
+ENFORCED_CONTAINER_CN = "enforced_container"
+ENFORCED_CONTAINER_DN = "cn=%s,%s" % (ENFORCED_CONTAINER_CN, SUFFIX)
+
+USER_1_CN = "test_1"
+USER_1_DN = "cn=%s,%s" % (USER_1_CN, ENFORCED_CONTAINER_DN)
+USER_2_CN = "test_2"
+USER_2_DN = "cn=%s,%s" % (USER_2_CN, ENFORCED_CONTAINER_DN)
+USER_3_CN = "test_3"
+USER_3_DN = "cn=%s,%s" % (USER_3_CN, EXCLUDED_CONTAINER_DN)
+USER_4_CN = "test_4"
+USER_4_DN = "cn=%s,%s" % (USER_4_CN, EXCLUDED_BIS_CONTAINER_DN)
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ global installation1_prefix
+
+ # Creating standalone instance ...
+ standalone = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ standalone.delete()
+ standalone.create()
+ standalone.open()
+
+ # Clear out the tmp dir
+ standalone.clearTmpDir(__file__)
+
+ return TopologyStandalone(standalone)
+
+def test_ticket47927_init(topology):
+ topology.standalone.plugins.enable(name=PLUGIN_ATTR_UNIQUENESS)
+ try:
+ topology.standalone.modify_s('cn=' + PLUGIN_ATTR_UNIQUENESS + ',cn=plugins,cn=config',
+ [(ldap.MOD_REPLACE, 'uniqueness-attribute-name', 'telephonenumber'),
+ (ldap.MOD_REPLACE, 'uniqueness-subtrees', DEFAULT_SUFFIX),
+ ])
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927: Failed to configure plugin for "telephonenumber": error ' + e.message['desc'])
+ assert False
+ topology.standalone.restart(timeout=120)
+
+ topology.standalone.add_s(Entry((EXCLUDED_CONTAINER_DN, {'objectclass': "top nscontainer".split(),
+ 'cn': EXCLUDED_CONTAINER_CN})))
+ topology.standalone.add_s(Entry((EXCLUDED_BIS_CONTAINER_DN, {'objectclass': "top nscontainer".split(),
+ 'cn': EXCLUDED_BIS_CONTAINER_CN})))
+ topology.standalone.add_s(Entry((ENFORCED_CONTAINER_DN, {'objectclass': "top nscontainer".split(),
+ 'cn': ENFORCED_CONTAINER_CN})))
+
+ # adding an entry on a stage with a different 'cn'
+ topology.standalone.add_s(Entry((USER_1_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': USER_1_CN,
+ 'cn': USER_1_CN})))
+ # adding an entry on a stage with a different 'cn'
+ topology.standalone.add_s(Entry((USER_2_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': USER_2_CN,
+ 'cn': USER_2_CN})))
+ topology.standalone.add_s(Entry((USER_3_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': USER_3_CN,
+ 'cn': USER_3_CN})))
+ topology.standalone.add_s(Entry((USER_4_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': USER_4_CN,
+ 'cn': USER_4_CN})))
+
+def test_ticket47927_one(topology):
+ '''
+ Check that uniqueness is enforce on all SUFFIX
+ '''
+ UNIQUE_VALUE='1234'
+ try:
+ topology.standalone.modify_s(USER_1_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_one: Failed to set the telephonenumber for %s: %s' % (USER_1_DN, e.message['desc']))
+ assert False
+
+ # we expect to fail because user1 is in the scope of the plugin
+ try:
+ topology.standalone.modify_s(USER_2_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_one: unexpected success to set the telephonenumber for %s' % (USER_2_DN))
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_one: Failed (expected) to set the telephonenumber for %s: %s' % (USER_2_DN, e.message['desc']))
+ pass
+
+
+ # we expect to fail because user1 is in the scope of the plugin
+ try:
+ topology.standalone.modify_s(USER_3_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_one: unexpected success to set the telephonenumber for %s' % (USER_3_DN))
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_one: Failed (expected) to set the telephonenumber for %s: %s' % (USER_3_DN, e.message['desc']))
+ pass
+
+
+def test_ticket47927_two(topology):
+ '''
+ Exclude the EXCLUDED_CONTAINER_DN from the uniqueness plugin
+ '''
+ try:
+ topology.standalone.modify_s('cn=' + PLUGIN_ATTR_UNIQUENESS + ',cn=plugins,cn=config',
+ [(ldap.MOD_REPLACE, 'uniqueness-exclude-subtrees', EXCLUDED_CONTAINER_DN)])
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_two: Failed to configure plugin for to exclude %s: error %s' % (EXCLUDED_CONTAINER_DN, e.message['desc']))
+ assert False
+ topology.standalone.restart(timeout=120)
+
+def test_ticket47927_three(topology):
+ '''
+ Check that uniqueness is enforced on full SUFFIX except EXCLUDED_CONTAINER_DN
+ First case: it exists an entry (with the same attribute value) in the scope
+ of the plugin and we set the value in an entry that is in an excluded scope
+ '''
+ UNIQUE_VALUE='9876'
+ try:
+ topology.standalone.modify_s(USER_1_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_three: Failed to set the telephonenumber ' + e.message['desc'])
+ assert False
+
+ # we should not be allowed to set this value (because user1 is in the scope)
+ try:
+ topology.standalone.modify_s(USER_2_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_three: unexpected success to set the telephonenumber for %s' % (USER_2_DN))
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_three: Failed (expected) to set the telephonenumber for %s: %s' % (USER_2_DN , e.message['desc']))
+
+
+ # USER_3_DN is in EXCLUDED_CONTAINER_DN so update should be successful
+ try:
+ topology.standalone.modify_s(USER_3_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_three: success to set the telephonenumber for %s' % (USER_3_DN))
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_three: Failed (unexpected) to set the telephonenumber for %s: %s' % (USER_3_DN, e.message['desc']))
+ assert False
+
+
+def test_ticket47927_four(topology):
+ '''
+ Check that uniqueness is enforced on full SUFFIX except EXCLUDED_CONTAINER_DN
+ Second case: it exists an entry (with the same attribute value) in an excluded scope
+ of the plugin and we set the value in an entry is in the scope
+ '''
+ UNIQUE_VALUE='1111'
+ # USER_3_DN is in EXCLUDED_CONTAINER_DN so update should be successful
+ try:
+ topology.standalone.modify_s(USER_3_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_four: success to set the telephonenumber for %s' % USER_3_DN)
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_four: Failed (unexpected) to set the telephonenumber for %s: %s' % (USER_3_DN, e.message['desc']))
+ assert False
+
+
+ # we should be allowed to set this value (because user3 is excluded from scope)
+ try:
+ topology.standalone.modify_s(USER_1_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_four: Failed to set the telephonenumber for %s: %s' % (USER_1_DN, e.message['desc']))
+ assert False
+
+ # we should not be allowed to set this value (because user1 is in the scope)
+ try:
+ topology.standalone.modify_s(USER_2_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_four: unexpected success to set the telephonenumber %s' % USER_2_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_four: Failed (expected) to set the telephonenumber for %s: %s' % (USER_2_DN, e.message['desc']))
+ pass
+
+def test_ticket47927_five(topology):
+ '''
+ Exclude the EXCLUDED_BIS_CONTAINER_DN from the uniqueness plugin
+ '''
+ try:
+ topology.standalone.modify_s('cn=' + PLUGIN_ATTR_UNIQUENESS + ',cn=plugins,cn=config',
+ [(ldap.MOD_ADD, 'uniqueness-exclude-subtrees', EXCLUDED_BIS_CONTAINER_DN)])
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_five: Failed to configure plugin for to exclude %s: error %s' % (EXCLUDED_BIS_CONTAINER_DN, e.message['desc']))
+ assert False
+ topology.standalone.restart(timeout=120)
+ topology.standalone.getEntry('cn=' + PLUGIN_ATTR_UNIQUENESS + ',cn=plugins,cn=config', ldap.SCOPE_BASE)
+
+def test_ticket47927_six(topology):
+ '''
+ Check that uniqueness is enforced on full SUFFIX except EXCLUDED_CONTAINER_DN
+ and EXCLUDED_BIS_CONTAINER_DN
+ First case: it exists an entry (with the same attribute value) in the scope
+ of the plugin and we set the value in an entry that is in an excluded scope
+ '''
+ UNIQUE_VALUE='222'
+ try:
+ topology.standalone.modify_s(USER_1_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_six: Failed to set the telephonenumber ' + e.message['desc'])
+ assert False
+
+ # we should not be allowed to set this value (because user1 is in the scope)
+ try:
+ topology.standalone.modify_s(USER_2_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_six: unexpected success to set the telephonenumber for %s' % (USER_2_DN))
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_six: Failed (expected) to set the telephonenumber for %s: %s' % (USER_2_DN , e.message['desc']))
+
+
+ # USER_3_DN is in EXCLUDED_CONTAINER_DN so update should be successful
+ try:
+ topology.standalone.modify_s(USER_3_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_six: success to set the telephonenumber for %s' % (USER_3_DN))
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_six: Failed (unexpected) to set the telephonenumber for %s: %s' % (USER_3_DN, e.message['desc']))
+ assert False
+ # USER_4_DN is in EXCLUDED_CONTAINER_DN so update should be successful
+ try:
+ topology.standalone.modify_s(USER_4_DN,
+ [(ldap.MOD_REPLACE, 'telephonenumber', UNIQUE_VALUE)])
+ log.fatal('test_ticket47927_six: success to set the telephonenumber for %s' % (USER_4_DN))
+ except ldap.LDAPError, e:
+ log.fatal('test_ticket47927_six: Failed (unexpected) to set the telephonenumber for %s: %s' % (USER_4_DN, e.message['desc']))
+ assert False
+
+
+def test_ticket47927_final(topology):
+ topology.standalone.delete()
+ log.info('Testcase PASSED')
+
+
+def run_isolated():
+ global installation1_prefix
+ installation1_prefix = None
+
+ topo = topology(True)
+ test_ticket47927_init(topo)
+ test_ticket47927_one(topo)
+ test_ticket47927_two(topo)
+ test_ticket47927_three(topo)
+ test_ticket47927_four(topo)
+ test_ticket47927_five(topo)
+ test_ticket47927_six(topo)
+ test_ticket47927_final(topo)
+
+
+if __name__ == '__main__':
+ run_isolated()
+
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index b9c4e72..5b57828 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -70,7 +70,7 @@ int ldap_quote_filter_value(
static int search_one_berval(Slapi_DN *baseDN, const char **attrNames,
- const struct berval *value, const char *requiredObjectClass, Slapi_DN *target);
+ const struct berval *value, const char *requiredObjectClass, Slapi_DN *target, Slapi_DN **excludes);
/*
* ISSUES:
@@ -103,6 +103,7 @@ typedef struct attr_uniqueness_config {
const char **attrs;
char *attr_friendly;
Slapi_DN **subtrees;
+ Slapi_DN **exclude_subtrees;
PRBool unique_in_all_subtrees;
char *top_entry_oc;
char *subtree_entries_oc;
@@ -111,6 +112,7 @@ typedef struct attr_uniqueness_config {
#define ATTR_UNIQUENESS_ATTRIBUTE_NAME "uniqueness-attribute-name"
#define ATTR_UNIQUENESS_SUBTREES "uniqueness-subtrees"
+#define ATTR_UNIQUENESS_EXCLUDE_SUBTREES "uniqueness-exclude-subtrees"
#define ATTR_UNIQUENESS_ACROSS_ALL_SUBTREES "uniqueness-across-all-subtrees"
#define ATTR_UNIQUENESS_TOP_ENTRY_OC "uniqueness-top-entry-oc"
#define ATTR_UNIQUENESS_SUBTREE_ENTRIES_OC "uniqueness-subtree-entries-oc"
@@ -135,7 +137,11 @@ free_uniqueness_config(struct attr_uniqueness_config *config)
for (i = 0; config->subtrees && config->subtrees[i]; i++) {
slapi_sdn_free(&config->subtrees[i]);
}
+ for (i = 0; config->exclude_subtrees && config->exclude_subtrees[i]; i++) {
+ slapi_sdn_free(&config->exclude_subtrees[i]);
+ }
slapi_ch_free((void **) &config->subtrees);
+ slapi_ch_free((void **) &config->exclude_subtrees);
slapi_ch_free_string((char **) &config->top_entry_oc);
slapi_ch_free_string((char **) &config->subtree_entries_oc);
}
@@ -147,6 +153,7 @@ free_uniqueness_config(struct attr_uniqueness_config *config)
* uniqueness-attribute-name: uid
* uniqueness-subtrees: dc=people,dc=example,dc=com
* uniqueness-subtrees: dc=sales, dc=example,dc=com
+ * uniqueness-exclude-subtrees: dc=machines, dc=examples, dc=com
* uniqueness-across-all-subtrees: on
*
* or
@@ -256,6 +263,27 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry)
values = NULL;
}
+ /* Subtrees where uniqueness is explicitly ignored */
+ values = slapi_entry_attr_get_charray(config_entry, ATTR_UNIQUENESS_EXCLUDE_SUBTREES);
+ if (values) {
+ for (i = 0; values && values[i]; i++);
+ /* slapi_ch_calloc never returns NULL unless the 2 args are 0 or negative. */
+ tmp_config->exclude_subtrees = (Slapi_DN **) slapi_ch_calloc(i + 1, sizeof (Slapi_DN *));
+ /* copy the valid subtree DN into the config */
+ for (i = 0, nb_subtrees = 0; values && values[i]; i++) {
+ if (slapi_dn_syntax_check(pb, values[i], 1)) { /* syntax check failed */
+ slapi_log_error(SLAPI_LOG_FATAL, plugin_name, "Config info: Invalid DN (skipped): %s\n", values[i]);
+ continue;
+ }
+ tmp_config->exclude_subtrees[nb_subtrees] = slapi_sdn_new_dn_byval(values[i]);
+ nb_subtrees++;
+
+ }
+
+ slapi_ch_array_free(values);
+ values = NULL;
+ }
+
/* Uniqueness may be enforced accross all the subtrees, by default it is not */
tmp_config->unique_in_all_subtrees = slapi_entry_attr_get_bool(config_entry, ATTR_UNIQUENESS_ACROSS_ALL_SUBTREES);
@@ -376,6 +404,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry)
fp++;
}
+ /* Only ensure subtrees are set, no need to check excluded subtrees as setting exclusion without actual subtrees make little sense */
if (tmp_config->subtrees == NULL) {
/* Uniqueness is enforced on entries matching objectclass */
if (tmp_config->subtree_entries_oc == NULL) {
@@ -569,7 +598,7 @@ create_filter(const char **attributes, const struct berval *value, const char *r
static int
search(Slapi_DN *baseDN, const char **attrNames, Slapi_Attr *attr,
struct berval **values, const char *requiredObjectClass,
- Slapi_DN *target)
+ Slapi_DN *target, Slapi_DN **excludes)
{
int result;
@@ -604,7 +633,7 @@ search(Slapi_DN *baseDN, const char **attrNames, Slapi_Attr *attr,
{
result = search_one_berval(baseDN, attrNames,
slapi_value_get_berval(v),
- requiredObjectClass, target);
+ requiredObjectClass, target, excludes);
}
}
else
@@ -612,7 +641,7 @@ search(Slapi_DN *baseDN, const char **attrNames, Slapi_Attr *attr,
for (;*values != NULL && LDAP_SUCCESS == result; values++)
{
result = search_one_berval(baseDN, attrNames, *values, requiredObjectClass,
- target);
+ target, excludes);
}
}
@@ -628,7 +657,7 @@ search(Slapi_DN *baseDN, const char **attrNames, Slapi_Attr *attr,
static int
search_one_berval(Slapi_DN *baseDN, const char **attrNames,
const struct berval *value, const char *requiredObjectClass,
- Slapi_DN *target)
+ Slapi_DN *target, Slapi_DN **excludes)
{
int result;
char *filter;
@@ -695,8 +724,28 @@ search_one_berval(Slapi_DN *baseDN, const char **attrNames,
*/
if (!target || slapi_sdn_compare(slapi_entry_get_sdn(*entries), target) != 0)
{
+ int i;
result = LDAP_CONSTRAINT_VIOLATION;
- break;
+ if (excludes == NULL || *excludes == NULL)
+ {
+ break;
+ }
+
+ /* Do the same check for excluded subtrees as resulted entries may have matched them */
+ for (i = 0;excludes && excludes[i]; i++)
+ {
+ Slapi_DN *entry_dn = slapi_entry_get_sdn(*entries);
+ if (slapi_sdn_issuffix(entry_dn, excludes[i]))
+ {
+ result = LDAP_SUCCESS;
+ break;
+ }
+ }
+
+ if (result == LDAP_CONSTRAINT_VIOLATION)
+ {
+ break;
+ }
}
}
@@ -734,7 +783,7 @@ search_one_berval(Slapi_DN *baseDN, const char **attrNames,
* LDAP_OPERATIONS_ERROR - a server failure.
*/
static int
-searchAllSubtrees(Slapi_DN **subtrees, const char **attrNames,
+searchAllSubtrees(Slapi_DN **subtrees, Slapi_DN **exclude_subtrees, const char **attrNames,
Slapi_Attr *attr, struct berval **values, const char *requiredObjectClass,
Slapi_DN *dn, PRBool unique_in_all_subtrees)
{
@@ -762,6 +811,22 @@ searchAllSubtrees(Slapi_DN **subtrees, const char **attrNames,
return result;
}
}
+
+ /* If DN is in the excluded subtrees, we should ignore it in any case, not only
+ * in the case of uniqueness in all subtrees. */
+ if (exclude_subtrees != NULL)
+ {
+ PRBool in_a_subtree = PR_FALSE;
+ for (i = 0;exclude_subtrees && exclude_subtrees[i]; i++) {
+ if (slapi_sdn_issuffix(dn, exclude_subtrees[i])) {
+ in_a_subtree = PR_TRUE;
+ break;
+ }
+ }
+ if (in_a_subtree) {
+ return result;
+ }
+ }
/*
* For each DN in the managed list, do uniqueness checking if
@@ -775,7 +840,7 @@ searchAllSubtrees(Slapi_DN **subtrees, const char **attrNames,
* worry about that here.
*/
if (unique_in_all_subtrees || slapi_sdn_issuffix(dn, sufdn)) {
- result = search(sufdn, attrNames, attr, values, requiredObjectClass, dn);
+ result = search(sufdn, attrNames, attr, values, requiredObjectClass, dn, exclude_subtrees);
if (result) break;
}
}
@@ -865,7 +930,7 @@ getArguments(Slapi_PBlock *pb, char **attrName, char **markerObjectClass,
static int
findSubtreeAndSearch(Slapi_DN *parentDN, const char **attrNames, Slapi_Attr *attr,
struct berval **values, const char *requiredObjectClass, Slapi_DN *target,
- const char *markerObjectClass)
+ const char *markerObjectClass, Slapi_DN **excludes)
{
int result = LDAP_SUCCESS;
Slapi_PBlock *spb = NULL;
@@ -883,7 +948,7 @@ findSubtreeAndSearch(Slapi_DN *parentDN, const char **attrNames, Slapi_Attr *att
* to have the attribute already.
*/
result = search(curpar, attrNames, attr, values, requiredObjectClass,
- target);
+ target, excludes);
break;
}
newpar = slapi_sdn_new();
@@ -995,11 +1060,11 @@ preop_add(Slapi_PBlock *pb)
/* Subtree defined by location of marker object class */
result = findSubtreeAndSearch(sdn, attrNames, attr, NULL,
requiredObjectClass, sdn,
- markerObjectClass);
+ markerObjectClass, config->exclude_subtrees);
} else
{
/* Subtrees listed on invocation line */
- result = searchAllSubtrees(config->subtrees, attrNames, attr, NULL,
+ result = searchAllSubtrees(config->subtrees, config->exclude_subtrees, attrNames, attr, NULL,
requiredObjectClass, sdn, config->unique_in_all_subtrees);
}
if (result != LDAP_SUCCESS) {
@@ -1164,11 +1229,11 @@ preop_modify(Slapi_PBlock *pb)
/* Subtree defined by location of marker object class */
result = findSubtreeAndSearch(sdn, attrNames, NULL,
mod->mod_bvalues, requiredObjectClass,
- sdn, markerObjectClass);
+ sdn, markerObjectClass, config->exclude_subtrees);
} else
{
/* Subtrees listed on invocation line */
- result = searchAllSubtrees(config->subtrees, attrNames, NULL,
+ result = searchAllSubtrees(config->subtrees, config->exclude_subtrees, attrNames, NULL,
mod->mod_bvalues, requiredObjectClass, sdn, config->unique_in_all_subtrees);
}
}
@@ -1326,11 +1391,11 @@ preop_modrdn(Slapi_PBlock *pb)
/* Subtree defined by location of marker object class */
result = findSubtreeAndSearch(slapi_entry_get_sdn(e), attrNames, attr, NULL,
requiredObjectClass, sdn,
- markerObjectClass);
+ markerObjectClass, config->exclude_subtrees);
} else
{
/* Subtrees listed on invocation line */
- result = searchAllSubtrees(config->subtrees, attrNames, attr, NULL,
+ result = searchAllSubtrees(config->subtrees, config->exclude_subtrees, attrNames, attr, NULL,
requiredObjectClass, sdn, config->unique_in_all_subtrees);
}
if (result != LDAP_SUCCESS) {
8 years, 10 months
Changes to 'refs/tags/389-admin-1.1.40'
by Noriko Hosoi
Changes since 389-admin-1.1.11:
Endi S. Dewata (3):
Bug 573889 - Migration does not remove deprecated schema
Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries
Bug 470576 - Migration could do addition checks before commiting actions
Ludwig (1):
Ticket 47563 - cannot restart directory server from console
Mark Reynolds (15):
Ticket #286 - compilation fixes for 'format-security'
Ticket 401 - Console login fails with anonymous access disabled
Ticket 400 - BIND operation result not checked properly in admin server
Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry
Ticket 47495 - admin express: wrong instance creation time
Ticket 47497 - Admin Express - remove "Security Level"
Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time
Ticket 47300 - Update man page for remove-ds-admin.pl
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain
Ticket 47548 - register-ds-admin does not register into remote config ds
Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot
Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c
Ticket 201 - nCipher HSM cannot be configured via the console
Ticket 47929 - Admin Server - disable SSLv3 by default
Nathan Kinder (49):
Bug 648949 - Merge selinux policy into base OS
Regenerated autoconf files
Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled
Bug 668950 - Add posix group support to Console
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 618897 - Wrong permissions when creating instance from Console
Bug 493424 - remove unneeded modules for admin server apache config
Bug 614690 - Don't use exec to call genrb
Bug 699815 - (cov#10859) Add missing braces in mod_admserv code
Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi
Bug 699815 - (cov#10849,10851) Remove unused variables
Bug 699907 - (cov#10844) Uninitialized time struct
Bug 699907 - (cov#10843) Use of uninitialized variable in logging code
Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi
Bug 699907 - (cov#10836) Use of uninitialized var in http conn code
Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code
Bug 700532 - (cov#10832) Incorrect if condition in dsalib
Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib
Bug 700890 - (cov#10812) Check return value of open() properly in libadmin
Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi
Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication
Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi
Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 702150 - (cov#10823) File descriptors leaked in help cgi
Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi
Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi
Bug 702150 - leak of config array in dsalib
Bug 702150 - (cov#10816) file descriptor leak in dsalib
Bug 702150 - (cov#10817) Leak of string in libdsa
Bug 702150 - Resouce leaks in htmladmin.c
Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin
Bug 702705 - NULL pointer dereferences in viewlog cgi
Bug 702705 - (cov#10803) NULL pointer dereference in security cgi
Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl
Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib
Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy
Bug 724808 - startup CGIs write temp file to /
Bug 730079 - Update SELinux policy during upgrades
Ticket #329 - Port modules to httpd 2.4
Ticket #47333 - Relabel lockfile when starting Admin Server
Ticket #47334 - Avoid quoting all settings in console.conf
Ticket 47468 - Change security password validation error is out of order
Ticket 47466 - Importing CA cert with existing name crashes security CGI
Ticket 362 - Directory Console generates insufficient key strength
Ticket 47467 - Improve CRL import error messages
Noriko Hosoi (33):
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
start-ds-admin.in -- replaced "return 1" with "exit 1"
Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies
Bug 618858 - move start-ds-admin env file into main admin server
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 245278 - Changing to a password with a single quote does not work
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 158926 - Unable to install CA certificate when using
Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user
Bug 476925 - Admin Server: Do not allow 8-bit passwords for
Trac Ticket #307 - htmladmin keeps segfaulting
If htmladmin fails to connect to the server, the cgi could crash.
Ticket #293 - remove-ds-admin.pl does not remove everything
Ticket #476 - 389 ds do not start on F18 due to missing modules
bump version to 1.1.31
Ticket #567 - Restart of Admin server from console fails on segfault
bump version to 1.1.32
bump version to 1.1.33
bump version to 1.1.34
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.36
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket #47995 - Admin Server: source code cleaning
bump version to 1.1.37
Ticket #48024 - repl-monitor invoked from adminserver cgi fails
bump version to 1.1.38
Ticket #48153 - [adminserver] support NSS 3.18
bump version to 1.1.39
Ticket #48171 - remove-ds-admin.pl removes files in the rpm
Ticket #47467 - Improve Add CRL/CKL dialog and errors
bump version to 1.1.40
Rich Megginson (66):
bump version to 1.1.12.a1
initial support for openldap
add selinux policy for dsgw
skip LD_PRELOAD if using openldap
add more log information if nss init fails
add even more nss debugging
Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized
bump version to 1.1.12.a2
fix building with mozldap
bump version to 1.1.12.a3
fix autotool build issues with properties files
setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error
Bug 656441 - Missing library path entry causes LD_PRELOAD error
bump version to 1.1.13
bump version to 1.1.14.a1
Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required
bump version to 1.1.14
bump version to 1.1.15
bump version to 1.1.16
Bug 703990 - Support upgrade from Red Hat Directory Server
bump version to 1.1.17
add support for different skins
skip rebranding current brand
bump version to 1.1.18
look for separate openldap ldif library
bump version to 1.1.19
Bug 710372 - Not able to open the Manage Certificate from DS-console
better NSS error handling - reduce memory leaks
fix typo in NSS_Shutdown warning message
added tests for the security cgi
Bug 713000 - Migration stops if old admin server cannot be stopped
Bug 718079 - Perl errors when running migrate-ds-admin.pl
Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts
bump version to 1.1.20
bump version to 1.1.21
handle binary upgrade
add man pages for ds_removal and ds_unregister
bump version to 1.1.22
fix binary paths
bump version to 1.1.23
bump version to 1.1.24
Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd
Bug 740959 - 389-console put CA certificates into wrong database
bump version to 1.1.25
Bug 767823 - selinux: need to allow admin server to connect to ldap port
bump version to 1.1.26
Ticket #161 - Review and address latest Coverity issues
Ticket #281 - TLS not working with latest openldap
bump version to 1.1.27
bump version to 1.1.28
bump version to 1.1.29
bump version to 1.1.30
ignore files generated by Eclipse
Ticket #47486 compiler warnings in adminutil, admin, dsgw
Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw
add more debugging for SSL connection problems
Ticket #47413 389-admin fails to build with latest httpd
compiler warning - ldif_read_record lineno type depends on openldap version
add Eclipse and patch files
bump version to 1.1.35
Ticket #47498 Error Message for Failed to create the configuration directory server
Ticket #418 Error with register-ds-admin.pl
Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down.
Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>"
Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour
Ticket #47478 No groups file? error restarting Admin server
Wes Hardin (1):
fix for bug 377 - Unchecked use of SELinux command
noriko (1):
Ticket #47298 - remove-ds-admin.pl does not stop the admin server
---
.gitignore | 4
Makefile.am | 109
Makefile.in | 1767 -
VERSION.sh | 4
aclocal.m4 | 7258 ----
admserv/cfgstuff/console.conf.in | 2
admserv/cfgstuff/httpd-2.2.conf.in | 13
admserv/cfgstuff/httpd-2.4.conf.in | 742
admserv/cfgstuff/httpd.conf.in | 2
admserv/cfgstuff/initconfig.in | 5
admserv/cfgstuff/start-ds-admin.in | 83
admserv/cgi-ds/ds_listdb.c | 26
admserv/cgi-ds/ds_snmpctrl.c | 5
admserv/cgi-src40/ReadLog.c | 18
admserv/cgi-src40/admlib.mk | 119
admserv/cgi-src40/admpw.c | 79
admserv/cgi-src40/cgicommon.h | 1
admserv/cgi-src40/cgicommon.properties | 3
admserv/cgi-src40/config.c | 47
admserv/cgi-src40/dllglue.c | 42
admserv/cgi-src40/ds_create.in | 18
admserv/cgi-src40/dsconfig.c | 10
admserv/cgi-src40/head.html | 1
admserv/cgi-src40/help.c | 15
admserv/cgi-src40/htmladmin.c | 810
admserv/cgi-src40/htmladmin.properties | 42
admserv/cgi-src40/monreplication.c | 7
admserv/cgi-src40/repl-monitor-cgi.pl.in | 30
admserv/cgi-src40/restartsrv.c | 9
admserv/cgi-src40/sec-activate.c | 163
admserv/cgi-src40/security.c | 335
admserv/cgi-src40/security.properties | 8
admserv/cgi-src40/start_config_ds.c | 11
admserv/cgi-src40/statpingserv.c | 82
admserv/cgi-src40/stopsrv.c | 10
admserv/cgi-src40/ugdsconfig.c | 39
admserv/cgi-src40/viewdata.c | 264
admserv/cgi-src40/viewdata.properties | 2
admserv/cgi-src40/viewlog.c | 75
admserv/cgi-src40/viewlog.properties | 6
admserv/genrb_wrapper.sh | 2
admserv/html/admserv.html.in | 11
admserv/html/htmladmin.html.in | 13
admserv/html/monreplication.html | 20
admserv/html/viewdata.html | 6
admserv/html/viewlog.html | 14
admserv/makeUpgradeTar.sh | 30
admserv/newinst/src/25changefedorato389.pl | 250
admserv/newinst/src/25rebrand.pl.in | 413
admserv/newinst/src/30updateglobalpref.pl.in | 9
admserv/newinst/src/AdminMigration.pm.in | 79
admserv/newinst/src/AdminServer.pm.in | 270
admserv/newinst/src/AdminUtil.pm.in | 91
admserv/newinst/src/ConfigDSDialogs.pm | 42
admserv/newinst/src/dirserver.map.in | 1
admserv/newinst/src/register-ds-admin.pl.in | 714
admserv/newinst/src/register-ds-admin.res.in | 36
admserv/newinst/src/register_param.map.in | 4
admserv/newinst/src/register_server.pl.in | 6
admserv/newinst/src/remove-ds-admin.pl.in | 8
admserv/newinst/src/setup-ds-admin.pl.in | 6
admserv/newinst/src/setup-ds-admin.res.in | 20
admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49
admserv/schema/ldif/10dsdata.ldif.tmpl | 39
compile | 240
config.guess | 529
config.h.in | 33
config.sub | 379
configure |38698 +++++++++-------------
configure.ac | 111
depcomp | 343
include/base/file.h | 3
include/base/util.h | 3
include/libadmin/dbtlibadmin.h | 2
include/libadmin/libadmin.h | 92
include/libdsa/dsalib.h | 15
install-sh | 538
lib/base/file.cpp | 30
lib/base/nscputil.cpp | 51
lib/libadmin/dllglue.c | 77
lib/libadmin/httpcon.c | 5
lib/libadmin/referer.c | 4
lib/libadmin/template.c | 29
lib/libadmin/util.c | 973
lib/libdsa/dsalib_conf.c | 37
lib/libdsa/dsalib_confs.c | 93
lib/libdsa/dsalib_location.c | 56
lib/libdsa/dsalib_tailf.c | 1
lib/libdsa/dsalib_updown.c | 118
lib/libdsa/dsalib_util.c | 56
ltmain.sh |14878 +++++---
m4/adminutil.m4 | 4
m4/httpd.m4 | 3
m4/mozldap.m4 | 116
m4/openldap.m4 | 138
m4/selinux.m4 | 3
man/man8/ds_removal.8 | 54
man/man8/ds_unregister.8 | 48
man/man8/register-ds-admin.pl.8 | 139
man/man8/remove-ds-admin.pl.8 | 10
man/man8/restart-ds-admin.8 | 10
man/man8/start-ds-admin.8 | 10
man/man8/stop-ds-admin.8 | 10
missing | 234
mod_admserv/mod_admserv.c | 564
mod_admserv/mod_admserv.h | 15
mod_restartd/mod_restartd-2.2.c | 22
selinux/dirsrv-admin.fc.in | 5
selinux/dirsrv-admin.te | 2
tests/ds_create/testget.1 | 2
tests/htmladmin/testget.2 | 2
tests/htmladmin/testget.3 | 2
tests/htmladmin/testget.4 | 2
tests/htmladmin/testget.5 | 2
tests/htmladmin/testget.6 | 2
tests/htmladmin/testget.7 | 2
tests/htmladmin/testget.8 | 2
tests/security/testpost.1 | 1
tests/security/testpost.10 | 1
tests/security/testpost.11 | 1
tests/security/testpost.12 | 1
tests/security/testpost.13 | 1
tests/security/testpost.14 | 1
tests/security/testpost.15 | 1
tests/security/testpost.16 | 1
tests/security/testpost.17 | 1
tests/security/testpost.18 | 1
tests/security/testpost.19 | 1
tests/security/testpost.2 | 1
tests/security/testpost.20 | 1
tests/security/testpost.21 | 1
tests/security/testpost.3 | 1
tests/security/testpost.4 | 1
tests/security/testpost.5 | 1
tests/security/testpost.6 | 1
tests/security/testpost.7 | 1
tests/security/testpost.8 | 1
tests/security/testpost.9 | 1
tests/setup.sh | 250
tests/ugdsconfig/testget.10 | 2
tests/viewdata/testget.2 | 2
tests/viewdata/testget.3 | 2
tests/viewdata/testget.4 | 2
tests/viewlog/testget.3 | 2
tests/viewlog/testget.4 | 2
wrappers/initscript.in | 3
wrappers/systemd.service.in | 24
147 files changed, 35295 insertions(+), 38211 deletions(-)
---
8 years, 10 months
VERSION.sh
by Noriko Hosoi
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 66fe23d1f3ba4d253ad6f1d51099cdb802d20073
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed May 6 13:27:01 2015 -0700
bump version to 1.1.40
diff --git a/VERSION.sh b/VERSION.sh
index 6a2ede6..765c91f 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -11,7 +11,7 @@ vendorurl=http://port389.org
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=1
-VERSION_MAINT=39
+VERSION_MAINT=40
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
8 years, 10 months