ldap/servers
by Mark Reynolds
ldap/servers/plugins/replication/repl5_plugins.c | 87 +++++++++++------------
1 file changed, 44 insertions(+), 43 deletions(-)
New commits:
commit d7b598da2eff95070936bf7c3e01bcd11c44ed60
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Thu Feb 11 16:18:00 2016 -0500
Ticket 47788 - Only check postop result if its a replication operation
Bug Description: With IPA tests, without using replication, an error is
being triggered that is stoipping nomral updates from
going through.
Fix Description: Move the error checking up into the code block above
which only executes for replicated operations.
https://fedorahosted.org/389/ticket/47788
Reviewed by: nhosoi & tbordaz(Thanks!!)
diff --git a/ldap/servers/plugins/replication/repl5_plugins.c b/ldap/servers/plugins/replication/repl5_plugins.c
index c2fa214..bb43b9b 100644
--- a/ldap/servers/plugins/replication/repl5_plugins.c
+++ b/ldap/servers/plugins/replication/repl5_plugins.c
@@ -1306,54 +1306,55 @@ process_postop (Slapi_PBlock *pb)
slapi_pblock_get( pb, SLAPI_OPERATION_PARAMETERS, &op_params );
slapi_ch_free((void **) &op_params->p.p_modrdn.modrdn_newsuperior_address.uniqueid);
}
- }
- if (!ignore_error_and_keep_going(retval)){
- /*
- * We have an error we can't ignore. Release the replica and close
- * the connection to stop the replication session.
- */
- consumer_connection_extension *connext = NULL;
- Slapi_Connection *conn = NULL;
- char csn_str[CSN_STRSIZE] = {'\0'};
- PRUint64 connid = 0;
- int opid = 0;
- slapi_pblock_get(pb, SLAPI_CONNECTION, &conn);
- slapi_pblock_get(pb, SLAPI_OPERATION_ID, &opid);
- slapi_pblock_get(pb, SLAPI_CONN_ID, &connid);
- if (conn)
- {
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
- "process_postop: Failed to apply update (%s) error (%d). "
- "Aborting replication session(conn=%" NSPRIu64 " op=%d)\n",
- csn_as_string(opcsn, PR_FALSE, csn_str), retval,
- connid, opid);
+ if (!ignore_error_and_keep_going(retval)){
/*
- * Release this replica so new sessions can begin
+ * We have an error we can't ignore. Release the replica and close
+ * the connection to stop the replication session.
*/
- connext = consumer_connection_extension_acquire_exclusive_access(conn, connid, opid);
- if (connext && connext->replica_acquired)
+ consumer_connection_extension *connext = NULL;
+ Slapi_Connection *conn = NULL;
+ char csn_str[CSN_STRSIZE] = {'\0'};
+ PRUint64 connid = 0;
+ int opid = 0;
+
+ slapi_pblock_get(pb, SLAPI_CONNECTION, &conn);
+ slapi_pblock_get(pb, SLAPI_OPERATION_ID, &opid);
+ slapi_pblock_get(pb, SLAPI_CONN_ID, &connid);
+ if (conn)
{
- int zero = 0;
- Replica *r = (Replica*)object_get_data ((Object*)connext->replica_acquired);
-
- replica_relinquish_exclusive_access(r, connid, opid);
- object_release ((Object*)connext->replica_acquired);
- connext->replica_acquired = NULL;
- connext->isreplicationsession = 0;
- slapi_pblock_set( pb, SLAPI_CONN_IS_REPLICATION_SESSION, &zero );
- }
- if (connext){
- consumer_connection_extension_relinquish_exclusive_access(conn, connid, opid, PR_FALSE);
- }
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
+ "process_postop: Failed to apply update (%s) error (%d). "
+ "Aborting replication session(conn=%" NSPRIu64 " op=%d)\n",
+ csn_as_string(opcsn, PR_FALSE, csn_str), retval,
+ connid, opid);
+ /*
+ * Release this replica so new sessions can begin
+ */
+ connext = consumer_connection_extension_acquire_exclusive_access(conn, connid, opid);
+ if (connext && connext->replica_acquired)
+ {
+ int zero = 0;
+ Replica *r = (Replica*)object_get_data ((Object*)connext->replica_acquired);
+
+ replica_relinquish_exclusive_access(r, connid, opid);
+ object_release ((Object*)connext->replica_acquired);
+ connext->replica_acquired = NULL;
+ connext->isreplicationsession = 0;
+ slapi_pblock_set( pb, SLAPI_CONN_IS_REPLICATION_SESSION, &zero );
+ }
+ if (connext){
+ consumer_connection_extension_relinquish_exclusive_access(conn, connid, opid, PR_FALSE);
+ }
- /*
- * Close the connection to end the current session with the
- * supplier. This prevents new updates from coming in and
- * updating the consumer RUV - which would cause this failed
- * update to be never be replayed.
- */
- slapi_disconnect_server(conn);
+ /*
+ * Close the connection to end the current session with the
+ * supplier. This prevents new updates from coming in and
+ * updating the consumer RUV - which would cause this failed
+ * update to be never be replayed.
+ */
+ slapi_disconnect_server(conn);
+ }
}
}
if (NULL == opcsn)
8 years, 2 months
Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/entry.c | 2 ++
1 file changed, 2 insertions(+)
New commits:
commit d1cf785b82235c2468002274f020efc1d8f3fcc3
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Fri Jan 9 13:28:05 2015 +0100
Ticket 47964 - 1.2.11 - Incorrect search result after replacing an empty attribute
Bug Description: when a replace operation for a nonexisting attribute is
done without providing new values the entry is stored
with incorrect meta data: an empty deleted value without
attribute deletion csn.
Fix Description: in the delete phase of the replace operation already create
the attribute to set the deletion csn. It would be created anyway
in the add part of the replace operation.
The function to calculate the required size to write the entry
needs also to be adjusted.
https://fedorahosted.org/389/ticket/47964
Reviewed by: Rich, thanks
Note for 389-ds-base-1.2.11: applying the patch just to entry2str_internal_size_attrlist (entry.c).
(cherry picked from commit 3182d2e8524c319393ab37ffcf6a8aefb9b92b54)
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 340844d..f3d9c86 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -1487,6 +1487,8 @@ entry2str_internal_size_attrlist( const Slapi_Attr *attrlist, int entry2str_ctrl
* We need to add the size for that.
*/
elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ /* need also space for ";deletedattribute;deleted" */
+ elen += DELETED_ATTR_STRSIZE + DELETED_VALUE_STRSIZE;
}
}
}
8 years, 2 months
ldap/servers
by William Brown
ldap/servers/plugins/acl/acl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 82abaf153e5522c10653e5a0090499c7171139fb
Author: William Brown <firstyear(a)redhat.com>
Date: Thu Feb 11 11:07:07 2016 +1000
Ticket 48566 - acl.c attrFilterArray maybe uninitialised.
Bug Description: warning: ���attrFilterArray��� may be used uninitialized in this
function [-Wmaybe-uninitialized]
Fix Description: Initilase the value of attrFilterArray.
https://fedorahosted.org/389/ticket/48566
Author: wibrown
Review by: nhosoi (Thanks)
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 7b7fea1..829fd7d 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -2460,7 +2460,7 @@ acl__resource_match_aci( Acl_PBlock *aclpb, aci_t *aci, int skip_attrEval, int *
((aclpb->aclpb_access & SLAPI_ACL_DELETE) &&
(aci->aci_type & ACI_TARGET_ATTR_DEL_FILTERS) ) ) {
- Targetattrfilter **attrFilterArray;
+ Targetattrfilter **attrFilterArray = NULL;
Targetattrfilter *attrFilter = NULL;
8 years, 2 months
2 commits - ldap/ldif ldap/servers m4/systemd.m4 rpm/389-ds-base.spec.in
by William Brown
ldap/ldif/template-dse.ldif.in | 2 +-
ldap/servers/slapd/log.c | 28 +++++++++++++---------------
m4/systemd.m4 | 2 +-
rpm/389-ds-base.spec.in | 5 +++++
4 files changed, 20 insertions(+), 17 deletions(-)
New commits:
commit 42a3a68dc144f483e1dfbdc837193345b6d0fe22
Author: William Brown <firstyear(a)redhat.com>
Date: Thu Feb 11 10:31:01 2016 +1000
Ticket 47968 - When systemd libs not found, error instead of continuing.
Bug Description: Systemd-devel isn't installed, we still build and weird
things happen.
Fix Description: Make sure to error if we have --with-systemd and no
systemd-devel package
https://fedorahosted.org/389/ticket/47968
Author: wibrown
Review by: One line patch
diff --git a/m4/systemd.m4 b/m4/systemd.m4
index 4f9533b..1c62076 100644
--- a/m4/systemd.m4
+++ b/m4/systemd.m4
@@ -30,7 +30,7 @@ if test "$with_systemd" = yes; then
systemd_lib=`$PKG_CONFIG --libs-only-l systemd libsystemd-journal libsystemd-daemon`
systemd_defs="-DWITH_SYSTEMD"
else
- AC_MSG_RESULT([no Systemd pkg-config files])
+ AC_MSG_ERROR([no Systemd pkg-config files])
fi
fi
commit ef53e0c70c6e67da971c0a1d999fa47730b0ce4f
Author: William Brown <firstyear(a)redhat.com>
Date: Tue Feb 9 11:47:17 2016 +1030
Ticket 47968 - Fix for issues with multiple log backends
Bug Description:
* Did not correctly use str formats in the output to journald_print
* Due to a change strcmp api, the values were not checked properly
* The default template did not have the correct backend value
Fix Description:
* Correctly use string formats to avoid compilation errors
* Fix the check for values of strcmp
* Fix the template to include dirsrv-log
* The rpm spec to include the correct systemd libraries
https://fedorahosted.org/389/ticket/47968
Author: wibrown
Review by: nhosoi (Thanks!)
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index 6c62aaa..f18c082 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -62,7 +62,7 @@ nsslapd-ndn-cache-enabled: on
nsslapd-sasl-mapping-fallback: off
nsslapd-dynamic-plugins: off
nsslapd-allow-hashed-passwords: off
-nsslapd-logging-backend: 1
+nsslapd-logging-backend: dirsrv-log
dn: cn=features,cn=config
objectclass: top
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 07bc762..8b22297 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -393,21 +393,18 @@ log_set_logging(const char *attrname, char *value, int logtype, char *errorbuf,
int
log_set_backend(const char *attrname, char *value, int logtype, char *errorbuf, int apply) {
- int retval = LDAP_SUCCESS;
int backend = 0;
char *backendstr = NULL; /* The backend we are looking at */
char *token = NULL; /* String to tokenise, need to dup value */
char *next = NULL; /* The next value */
-
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
/* We don't need to bother checking log type ... */
- if ( !apply || !value || !*value ) {
- return retval;
+ if ( !value || !*value ) {
+ return LDAP_OPERATIONS_ERROR;
}
-
/* We have a comma seperated list. So split it up */
token = slapi_ch_strdup(value);
for (backendstr = ldap_utf8strtok_r(token, ",", &next);
@@ -417,12 +414,12 @@ log_set_backend(const char *attrname, char *value, int logtype, char *errorbuf,
if(strlen(backendstr) == 0) {
/* Probably means someone did ",,"*/
continue;
- } else if (slapi_UTF8NCASECMP(backendstr, "dirsrv-log", 10) ) {
+ } else if (slapi_UTF8NCASECMP(backendstr, "dirsrv-log", 10) == 0 ) {
backend |= LOGGING_BACKEND_INTERNAL;
- } else if (slapi_UTF8NCASECMP(backendstr, "syslog", 6) ) {
+ } else if (slapi_UTF8NCASECMP(backendstr, "syslog", 6) == 0) {
backend |= LOGGING_BACKEND_SYSLOG;
#ifdef WITH_SYSTEMD
- } else if (slapi_UTF8NCASECMP(backendstr, "journald", 8) ) {
+ } else if (slapi_UTF8NCASECMP(backendstr, "journald", 8) == 0 ) {
backend |= LOGGING_BACKEND_JOURNALD;
#endif
}
@@ -436,20 +433,21 @@ log_set_backend(const char *attrname, char *value, int logtype, char *errorbuf,
#endif
) {
/* There is probably a better error here .... */
- retval = LDAP_OPERATIONS_ERROR;
- } else {
+ return LDAP_OPERATIONS_ERROR;
+ }
+ if ( apply ) {
/* We have a valid backend, set it */
/*
* We just need to use any lock here, doesn't matter which.
*/
- LOG_ACCESS_LOCK_WRITE( );
+ LOG_ACCESS_LOCK_WRITE( );
loginfo.log_backend = backend;
slapi_ch_free_string(&(slapdFrontendConfig->logging_backend));
slapdFrontendConfig->logging_backend = slapi_ch_strdup(value);
- LOG_ACCESS_UNLOCK_WRITE( );
+ LOG_ACCESS_UNLOCK_WRITE( );
}
- return retval;
+ return LDAP_SUCCESS;
}
/******************************************************************************
* Tell me the access log file name inc path
@@ -1985,7 +1983,7 @@ slapd_log_audit (
}
#ifdef WITH_SYSTEMD
if (lbackend & LOGGING_BACKEND_JOURNALD) {
- retval = sd_journal_print(LOG_NOTICE, buffer);
+ retval = sd_journal_print(LOG_NOTICE, "%s", buffer);
}
#endif
return retval;
@@ -2044,7 +2042,7 @@ slapd_log_auditfail (
}
#ifdef WITH_SYSTEMD
if (lbackend & LOGGING_BACKEND_JOURNALD) {
- retval = sd_journal_print(LOG_NOTICE, buffer);
+ retval = sd_journal_print(LOG_NOTICE, "%s", buffer);
}
#endif
return retval;
diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in
index 8cc2818..9adc6f0 100644
--- a/rpm/389-ds-base.spec.in
+++ b/rpm/389-ds-base.spec.in
@@ -78,6 +78,7 @@ BuildRequires: tcp_wrappers
# the following is for the pam passthru auth plug-in
BuildRequires: pam-devel
BuildRequires: systemd-units
+BuildRequires: systemd-devel
# this is needed for using semanage from our setup scripts
Requires: policycoreutils-python
@@ -122,6 +123,7 @@ Requires: perl-Socket6
Requires: perl-Socket
%endif
Requires: perl-NetAddr-IP
+Requires: systemd-libs
Source0: http://port389.org/sources/%{name}-%{version}%{?prerel}.tar.bz2
# 389-ds-git.sh should be used to generate the source tarball from git
@@ -169,6 +171,7 @@ BuildRequires: /usr/bin/xsltproc
BuildRequires: valgrind-devel
%endif
%endif
+BuildRequires: systemd-devel
%description libs
Core libraries for the 389 Directory Server base package. These libraries
@@ -193,6 +196,8 @@ Requires: libtalloc
Requires: libevent
Requires: libtevent
%endif
+Requires: systemd-libs
+
%description devel
Development Libraries and headers for the 389 Directory Server base package.
8 years, 2 months
Branch '389-ds-base-1.3.4' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/acl/acl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit 7fb593fe56dbbce06f707bd9807bf14748273ea2
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Feb 10 13:45:50 2016 -0800
Ticket #48536 - Crash in slapi_get_object_extension
Description: commit 091a5f5daf3fa378f029e293c5358ae9be9f548e introduced
a compier warning: format '%x' expects argument of type 'unsigned int',
but argument 4 has type 'Slapi_PBlock * {aka struct slapi_pblock *}
Replacing '%x' with '%p'.
(cherry picked from commit b31749f2a0bed838712719b2e6533bed0a4144e0)
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index d56bed6..7b7fea1 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -319,7 +319,7 @@ acl_access_allowed(
if (pb != aclpb->aclpb_pblock) {
slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
- "acl_access_allowed: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ "acl_access_allowed: Resetting aclpb_pblock %p to pblock addr %p\n",
aclpb->aclpb_pblock, pb);
aclpb->aclpb_pblock = pb;
}
@@ -942,7 +942,7 @@ acl_read_access_allowed_on_entry (
if (pb != aclpb->aclpb_pblock) {
slapi_log_error(SLAPI_LOG_ACL, plugin_name,
- "acl_read_access_allowed_on_entry: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ "acl_read_access_allowed_on_entry: Resetting aclpb_pblock %p to pblock addr %p\n",
aclpb->aclpb_pblock, pb);
aclpb->aclpb_pblock = pb;
}
8 years, 2 months
ldap/servers
by Noriko Hosoi
ldap/servers/plugins/acl/acl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit b31749f2a0bed838712719b2e6533bed0a4144e0
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Feb 10 13:45:50 2016 -0800
Ticket #48536 - Crash in slapi_get_object_extension
Description: commit 091a5f5daf3fa378f029e293c5358ae9be9f548e introduced
a compier warning: format '%x' expects argument of type 'unsigned int',
but argument 4 has type 'Slapi_PBlock * {aka struct slapi_pblock *}
Replacing '%x' with '%p'.
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index d56bed6..7b7fea1 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -319,7 +319,7 @@ acl_access_allowed(
if (pb != aclpb->aclpb_pblock) {
slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
- "acl_access_allowed: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ "acl_access_allowed: Resetting aclpb_pblock %p to pblock addr %p\n",
aclpb->aclpb_pblock, pb);
aclpb->aclpb_pblock = pb;
}
@@ -942,7 +942,7 @@ acl_read_access_allowed_on_entry (
if (pb != aclpb->aclpb_pblock) {
slapi_log_error(SLAPI_LOG_ACL, plugin_name,
- "acl_read_access_allowed_on_entry: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ "acl_read_access_allowed_on_entry: Resetting aclpb_pblock %p to pblock addr %p\n",
aclpb->aclpb_pblock, pb);
aclpb->aclpb_pblock = pb;
}
8 years, 2 months
Branch '389-ds-base-1.3.4' - ldap/servers
by Noriko Hosoi
ldap/servers/plugins/acl/acl.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
New commits:
commit 8a83a93977f13db36e42798a5eed041c1b3868a9
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Feb 9 16:12:07 2016 -0800
Ticket #48536 - Crash in slapi_get_object_extension
Description: The crashed was caused by the combination of psearch and
updating one of these group values: groupOfNames, groupOfUniqueNames,
groupOfCertificates, groupOfURL.
In the psearch, it creates aclpb in the acl plug-in and sets the original
pblock address in the aclpb. Then, psearch creates a copy of the pblock and
sets it in the psearch structure. Now, the pblock address in aclpb and the
pblock address in the psearch structure do not match. The original pblock
itself is freed and the pblock area which address is stored in aclpb is not
guaranteed what is in it.
If nothing occurs, the freed pblock in aclpb is not accessed. But once one
of the group values is updated, the acl plug-in signature is updated and it
triggers to get aclpb from the pblock.
The acl_get_aclpb call accesses the freed pblock (e.g., NULL op) and it
crashes the server.
This patch checks the current pblock address and the pblock address in aclpb.
If they don't match, the address in aclpb is reassigned to the current pblock
address.
https://fedorahosted.org/389/ticket/48536
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 091a5f5daf3fa378f029e293c5358ae9be9f548e)
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 678a999..d56bed6 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -317,6 +317,13 @@ acl_access_allowed(
goto cleanup_and_ret;
}
+ if (pb != aclpb->aclpb_pblock) {
+ slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
+ "acl_access_allowed: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ aclpb->aclpb_pblock, pb);
+ aclpb->aclpb_pblock = pb;
+ }
+
if ( !aclpb->aclpb_curr_entry_sdn ) {
slapi_log_error ( SLAPI_LOG_FATAL, plugin_name, "NULL aclpb_curr_entry_sdn \n" );
ret_val = LDAP_OPERATIONS_ERROR;
@@ -932,6 +939,13 @@ acl_read_access_allowed_on_entry (
tnf_string,end,"aclpb error");
return LDAP_OPERATIONS_ERROR;
}
+
+ if (pb != aclpb->aclpb_pblock) {
+ slapi_log_error(SLAPI_LOG_ACL, plugin_name,
+ "acl_read_access_allowed_on_entry: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ aclpb->aclpb_pblock, pb);
+ aclpb->aclpb_pblock = pb;
+ }
/*
* Am I a anonymous dude ? then we can use our anonympous profile
8 years, 2 months
ldap/servers
by Noriko Hosoi
ldap/servers/plugins/acl/acl.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
New commits:
commit 091a5f5daf3fa378f029e293c5358ae9be9f548e
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Feb 9 16:12:07 2016 -0800
Ticket #48536 - Crash in slapi_get_object_extension
Description: The crashed was caused by the combination of psearch and
updating one of these group values: groupOfNames, groupOfUniqueNames,
groupOfCertificates, groupOfURL.
In the psearch, it creates aclpb in the acl plug-in and sets the original
pblock address in the aclpb. Then, psearch creates a copy of the pblock and
sets it in the psearch structure. Now, the pblock address in aclpb and the
pblock address in the psearch structure do not match. The original pblock
itself is freed and the pblock area which address is stored in aclpb is not
guaranteed what is in it.
If nothing occurs, the freed pblock in aclpb is not accessed. But once one
of the group values is updated, the acl plug-in signature is updated and it
triggers to get aclpb from the pblock.
The acl_get_aclpb call accesses the freed pblock (e.g., NULL op) and it
crashes the server.
This patch checks the current pblock address and the pblock address in aclpb.
If they don't match, the address in aclpb is reassigned to the current pblock
address.
https://fedorahosted.org/389/ticket/48536
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 678a999..d56bed6 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -317,6 +317,13 @@ acl_access_allowed(
goto cleanup_and_ret;
}
+ if (pb != aclpb->aclpb_pblock) {
+ slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
+ "acl_access_allowed: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ aclpb->aclpb_pblock, pb);
+ aclpb->aclpb_pblock = pb;
+ }
+
if ( !aclpb->aclpb_curr_entry_sdn ) {
slapi_log_error ( SLAPI_LOG_FATAL, plugin_name, "NULL aclpb_curr_entry_sdn \n" );
ret_val = LDAP_OPERATIONS_ERROR;
@@ -932,6 +939,13 @@ acl_read_access_allowed_on_entry (
tnf_string,end,"aclpb error");
return LDAP_OPERATIONS_ERROR;
}
+
+ if (pb != aclpb->aclpb_pblock) {
+ slapi_log_error(SLAPI_LOG_ACL, plugin_name,
+ "acl_read_access_allowed_on_entry: Resetting aclpb_pblock 0x%x to pblock addr 0x%x\n",
+ aclpb->aclpb_pblock, pb);
+ aclpb->aclpb_pblock = pb;
+ }
/*
* Am I a anonymous dude ? then we can use our anonympous profile
8 years, 2 months
Branch '389-ds-base-1.3.4' - ldap/servers
by Noriko Hosoi
ldap/servers/slapd/attrsyntax.c | 3 +++
ldap/servers/slapd/schema.c | 16 +++++++++++++++-
2 files changed, 18 insertions(+), 1 deletion(-)
New commits:
commit 9bd53c297683e691fef174bf1aed6842f475fb9f
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Feb 10 11:36:32 2016 -0800
Ticket #48492 - heap corruption at schema replication.
Description: 389-ds-base-1.3.2 and newer uses openldap schema parser,
which is more strict with the definition. For instance, the older
389-ds-base could have a schema such as SINTAX OID in single quotes,
which is not acceptable on the newer version. There was a bug to
handle the error case that caused a crash.
This patch adds
1) the null reference check to attr_syntax_free (attrsyntax.c),
2) a null init to the output arg in parse_at_str and parse_oc_str
(schema.c) and
3) an error logging to schema_berval_to_atlist & schema_berval_to_oclist
(schema.c) for troubleshooting.
https://fedorahosted.org/389/ticket/48492
Reviewed by wibrown(a)redhat.com and mreynolds(a)redhat.com (Thank you, William and Mark!)
(cherry picked from commit b5bfa2a0386e168ce2196a077169382ae53a94b4)
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index 4cdcf86..8b2a77a 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -189,6 +189,9 @@ attr_syntax_check_oids()
void
attr_syntax_free( struct asyntaxinfo *a )
{
+ if (!a) {
+ return;
+ }
cool_charray_free( a->asi_aliases );
slapi_ch_free_string(&a->asi_name );
slapi_ch_free_string(&a->asi_desc );
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 65cbad5..dd56599 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -263,6 +263,9 @@ static PRCallOnceType schema_dse_mandatory_init_callonce = { 0, 0, 0 };
static int parse_at_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf, size_t errorbufsize,
PRUint32 schema_flags, int is_user_defined, int schema_ds4x_compat, int is_remote)
{
+ if (asipp) {
+ *asipp = NULL;
+ }
#ifdef USE_OPENLDAP
return parse_attr_str(input, asipp, errorbuf, errorbufsize, schema_flags, is_user_defined,schema_ds4x_compat,is_remote);
#else
@@ -274,6 +277,9 @@ static int parse_oc_str(const char *input, struct objclass **oc, char *errorbuf,
size_t errorbufsize, PRUint32 schema_flags, int is_user_defined,
int schema_ds4x_compat, struct objclass* private_schema )
{
+ if (oc) {
+ *oc = NULL;
+ }
#ifdef USE_OPENLDAP
return parse_objclass_str (input, oc, errorbuf, errorbufsize, schema_flags, is_user_defined, schema_ds4x_compat, private_schema );
#else
@@ -7146,11 +7152,15 @@ schema_berval_to_oclist(struct berval **oc_berval)
oc_list = NULL;
oc_tail = NULL;
if (oc_berval != NULL) {
+ errorbuf[0] = '\0';
for (i = 0; oc_berval[i] != NULL; i++) {
/* parse the objectclass value */
if (LDAP_SUCCESS != (rc = parse_oc_str(oc_berval[i]->bv_val, &oc,
errorbuf, sizeof (errorbuf), DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_USE_PRIV_SCHEMA, 0,
schema_ds4x_compat, oc_list))) {
+ slapi_log_error(SLAPI_LOG_FATAL, "schema",
+ "parse_oc_str returned error: %s\n",
+ errorbuf[0]?errorbuf:"unknown");
oc_free(&oc);
rc = 1;
break;
@@ -7184,11 +7194,15 @@ schema_berval_to_atlist(struct berval **at_berval)
schema_ds4x_compat = config_get_ds4_compatible_schema();
if (at_berval != NULL) {
+ errorbuf[0] = '\0';
for (i = 0; at_berval[i] != NULL; i++) {
/* parse the objectclass value */
rc = parse_at_str(at_berval[i]->bv_val, &at, errorbuf, sizeof (errorbuf),
DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_USE_PRIV_SCHEMA, 0, schema_ds4x_compat, 0);
- if(rc){
+ if (rc) {
+ slapi_log_error(SLAPI_LOG_FATAL, "schema",
+ "parse_oc_str returned error: %s\n",
+ errorbuf[0]?errorbuf:"unknown");
attr_syntax_free(at);
break;
}
8 years, 2 months
ldap/servers
by Noriko Hosoi
ldap/servers/slapd/attrsyntax.c | 3 +++
ldap/servers/slapd/schema.c | 16 +++++++++++++++-
2 files changed, 18 insertions(+), 1 deletion(-)
New commits:
commit b5bfa2a0386e168ce2196a077169382ae53a94b4
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Feb 10 11:36:32 2016 -0800
Ticket #48492 - heap corruption at schema replication.
Description: 389-ds-base-1.3.2 and newer uses openldap schema parser,
which is more strict with the definition. For instance, the older
389-ds-base could have a schema such as SINTAX OID in single quotes,
which is not acceptable on the newer version. There was a bug to
handle the error case that caused a crash.
This patch adds
1) the null reference check to attr_syntax_free (attrsyntax.c),
2) a null init to the output arg in parse_at_str and parse_oc_str
(schema.c) and
3) an error logging to schema_berval_to_atlist & schema_berval_to_oclist
(schema.c) for troubleshooting.
https://fedorahosted.org/389/ticket/48492
Reviewed by wibrown(a)redhat.com and mreynolds(a)redhat.com (Thank you, William and Mark!)
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index 4cdcf86..8b2a77a 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -189,6 +189,9 @@ attr_syntax_check_oids()
void
attr_syntax_free( struct asyntaxinfo *a )
{
+ if (!a) {
+ return;
+ }
cool_charray_free( a->asi_aliases );
slapi_ch_free_string(&a->asi_name );
slapi_ch_free_string(&a->asi_desc );
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 65cbad5..dd56599 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -263,6 +263,9 @@ static PRCallOnceType schema_dse_mandatory_init_callonce = { 0, 0, 0 };
static int parse_at_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf, size_t errorbufsize,
PRUint32 schema_flags, int is_user_defined, int schema_ds4x_compat, int is_remote)
{
+ if (asipp) {
+ *asipp = NULL;
+ }
#ifdef USE_OPENLDAP
return parse_attr_str(input, asipp, errorbuf, errorbufsize, schema_flags, is_user_defined,schema_ds4x_compat,is_remote);
#else
@@ -274,6 +277,9 @@ static int parse_oc_str(const char *input, struct objclass **oc, char *errorbuf,
size_t errorbufsize, PRUint32 schema_flags, int is_user_defined,
int schema_ds4x_compat, struct objclass* private_schema )
{
+ if (oc) {
+ *oc = NULL;
+ }
#ifdef USE_OPENLDAP
return parse_objclass_str (input, oc, errorbuf, errorbufsize, schema_flags, is_user_defined, schema_ds4x_compat, private_schema );
#else
@@ -7146,11 +7152,15 @@ schema_berval_to_oclist(struct berval **oc_berval)
oc_list = NULL;
oc_tail = NULL;
if (oc_berval != NULL) {
+ errorbuf[0] = '\0';
for (i = 0; oc_berval[i] != NULL; i++) {
/* parse the objectclass value */
if (LDAP_SUCCESS != (rc = parse_oc_str(oc_berval[i]->bv_val, &oc,
errorbuf, sizeof (errorbuf), DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_USE_PRIV_SCHEMA, 0,
schema_ds4x_compat, oc_list))) {
+ slapi_log_error(SLAPI_LOG_FATAL, "schema",
+ "parse_oc_str returned error: %s\n",
+ errorbuf[0]?errorbuf:"unknown");
oc_free(&oc);
rc = 1;
break;
@@ -7184,11 +7194,15 @@ schema_berval_to_atlist(struct berval **at_berval)
schema_ds4x_compat = config_get_ds4_compatible_schema();
if (at_berval != NULL) {
+ errorbuf[0] = '\0';
for (i = 0; at_berval[i] != NULL; i++) {
/* parse the objectclass value */
rc = parse_at_str(at_berval[i]->bv_val, &at, errorbuf, sizeof (errorbuf),
DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_USE_PRIV_SCHEMA, 0, schema_ds4x_compat, 0);
- if(rc){
+ if (rc) {
+ slapi_log_error(SLAPI_LOG_FATAL, "schema",
+ "parse_oc_str returned error: %s\n",
+ errorbuf[0]?errorbuf:"unknown");
attr_syntax_free(at);
break;
}
8 years, 2 months