ldap/servers
by William Brown
ldap/servers/slapd/fedse.c | 1 -
1 file changed, 1 deletion(-)
New commits:
commit 617b64faad36e9dedf13a5bef6748e602f82c4c2
Author: William Brown <firstyear(a)redhat.com>
Date: Fri Sep 30 14:08:55 2016 +1000
Ticket 48982 - One line fix, remove unused variable.
Bug Description: I forgot to remove the variable resolved_path from fedse.c :(
Fix Description: Remove the un-needed code.
https://fedorahosted.org/389/ticket/48982
Author: wibrown
Review by: one line fix rule.
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 6988521..09f292a 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -1948,7 +1948,6 @@ check_plugin_path(Slapi_PBlock *pb,
for (j = 0; vals && vals[j]; j++) {
void *handle;
char *full_path = NULL;
- char *resolved_path = NULL;
char *res = NULL;
if ( *vals[j] == '/' ) { /* absolute path */
7 years, 2 months
2 commits - ldap/servers
by William Brown
ldap/servers/plugins/uiduniq/uid.c | 4 ++--
ldap/servers/slapd/fedse.c | 12 +++++++++---
2 files changed, 11 insertions(+), 5 deletions(-)
New commits:
commit 31c0425599b13e492cdadff5ea64da6e1696b6bc
Author: William Brown <william(a)blackhats.net.au>
Date: Wed Sep 28 11:16:38 2016 +1000
Ticket 48982 - Enabling a plugin that has a versioned so causes overflow
Bug Description: Enabling a plugin that has a versioned.so causes overflow.
This is becuase we assumed that all plugins are "libname.so", and were not
symlinks. So we used a fixed size buffer to realpath.
Fix Description: Realpath can dynamically allocate the correct size buffer
for the resolved path, so we use that. Additionally, we need to use "free" instead
because realpath uses malloc not slapi_ch_malloc.
https://fedorahosted.org/389/ticket/48982
Author: wibrown
Reviewed by: nhosoi (Thanks so much!)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index a7c2a0e..6988521 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -1956,8 +1956,13 @@ check_plugin_path(Slapi_PBlock *pb,
} else { /* relative path */
full_path = slapi_get_plugin_name(PLUGINDIR, vals[j]);
}
- resolved_path = slapi_ch_malloc(strlen(full_path) + 1);
- res = realpath( full_path, resolved_path );
+ /*
+ * See man 3 realpath. We have to pass in NULL here, because we don't
+ * know if the library is versioned, it could be *any* length when
+ * resolved. The quirk is that this uses malloc, not slapi_ch_malloc,
+ * so we need to free res with free() only!
+ */
+ res = realpath( full_path, NULL );
if (res) {
if ((handle = dlopen(res, RTLD_NOW)) == NULL) {
*returncode = LDAP_UNWILLING_TO_PERFORM;
@@ -1972,7 +1977,8 @@ check_plugin_path(Slapi_PBlock *pb,
rc = SLAPI_DSE_CALLBACK_ERROR;
}
slapi_ch_free_string(&full_path);
- slapi_ch_free_string(&resolved_path);
+ /* See comment above. Must free res from realpath with free() only! */
+ free(res);
}
slapi_ch_array_free(vals);
commit ffda694dd622b31277da07be76d3469fad86150f
Author: William Brown <william(a)blackhats.net.au>
Date: Wed Sep 28 10:46:21 2016 +1000
Ticket 48986 - 47808 triggers overflow in uiduniq.c
Bug Description: Certain configurations of uiduniq.c would cause an overflow
when running with Address Sanitiser
Fix Description: Increase the size of the allocation to tmp_config->attrs.
https://fedorahosted.org/389/ticket/48986
Author: nhosoi
Reviewed by: wibrown
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index d1d0162..2aba17a 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -302,7 +302,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry)
}
/* Store attrName in the config */
- tmp_config->attrs = (const char **) slapi_ch_calloc(1, sizeof(char *));
+ tmp_config->attrs = (const char **) slapi_ch_calloc(2, sizeof(char *));
tmp_config->attrs[0] = slapi_ch_strdup(attrName);
argc--;
argv++; /* First argument was attribute name and remaining are subtrees */
@@ -345,7 +345,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry)
* - requiredObjectClass
*/
/* Store attrName in the config */
- tmp_config->attrs = (const char **) slapi_ch_calloc(1, sizeof(char *));
+ tmp_config->attrs = (const char **) slapi_ch_calloc(2, sizeof(char *));
tmp_config->attrs[0] = slapi_ch_strdup(attrName);
/* There is no subtrees */
7 years, 2 months
ldap/servers
by Mark Reynolds
ldap/servers/plugins/posix-winsync/posix-group-func.c | 2 +-
ldap/servers/plugins/replication/repl5_replica_config.c | 2 ++
ldap/servers/slapd/daemon.c | 4 ++++
ldap/servers/slapd/log.c | 2 +-
ldap/servers/slapd/slapi-plugin.h | 11 ++++++++++-
5 files changed, 18 insertions(+), 3 deletions(-)
New commits:
commit 04a9c896a99be843e531f989352f39687518c4e8
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Sep 28 14:11:03 2016 -0400
Ticket 48978 - Convert slapi_log_error() to a variadic macro
Description: In order to replace the LDAPDebug() logging functions with
slapi_log_error() we need make slapi_log_error behave as the
LDAPDebug() marco does. The benefit of having the logging
function macro is that you can completely remove the presence
of error logging. This is very beneficial when investigating
a performance issue.
https://fedorahosted.org/389/ticket/48978
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/servers/plugins/posix-winsync/posix-group-func.c b/ldap/servers/plugins/posix-winsync/posix-group-func.c
index 44ebeef..61e4aa5 100644
--- a/ldap/servers/plugins/posix-winsync/posix-group-func.c
+++ b/ldap/servers/plugins/posix-winsync/posix-group-func.c
@@ -18,8 +18,8 @@
$Id: posix-group-func.c 28 2011-05-13 14:35:29Z grzemba $
*/
#include <string.h>
-#include <nspr.h>
#include "slapi-plugin.h"
+#include <nspr.h>
#include "posix-wsp-ident.h"
#include "posix-group-func.h"
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index f125037..20a9433 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -3630,6 +3630,7 @@ stop_ruv_cleaning()
void
cleanruv_log(Slapi_Task *task, int rid, char *task_type, int sev_level, char *fmt, ...)
{
+#ifdef LDAP_DEBUG
va_list ap1;
va_list ap2;
va_list ap3;
@@ -3654,6 +3655,7 @@ cleanruv_log(Slapi_Task *task, int rid, char *task_type, int sev_level, char *fm
va_end(ap2);
va_end(ap3);
va_end(ap4);
+#endif
}
char *
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 8061f3b..9f8a183 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1192,7 +1192,11 @@ void slapd_daemon( daemon_ports_t *ports )
tp_config.stacksize = 0;
tp_config.event_queue_size = config_get_maxdescriptors();
tp_config.work_queue_size = config_get_maxdescriptors();
+#ifdef LDAP_DEBUG
tp_config.log_fct = nunc_stans_logging;
+#else
+ tp_config.log_fct = NULL;
+#endif
tp_config.log_start_fct = NULL;
tp_config.log_close_fct = NULL;
tp_config.malloc_fct = nunc_stans_malloc;
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 564d7c7..880233f 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -2420,7 +2420,7 @@ vslapd_log_error(
* severity - LOG_ERR, LOG_WARNING, LOG_INFO, etc
*/
int
-slapi_log_error( int loglevel, char *subsystem, char *fmt, ... )
+slapi_log_err( int loglevel, char *subsystem, char *fmt, ... )
{
va_list ap_err;
va_list ap_file;
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 0d3277a..c1a9acf 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -27,6 +27,7 @@
extern "C" {
#endif
+#include "portable.h"
#include "prtypes.h"
#include "ldap.h"
#include "prprf.h"
@@ -57,6 +58,13 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...)
;
#endif
+/* Define our logging macros */
+#define slapi_log_error(level, subsystem, fmt, ...)
+#ifdef LDAP_DEBUG
+# undef slapi_log_error
+# define slapi_log_error(level, subsystem, ...) slapi_log_err(level, subsystem, __VA_ARGS__)
+#endif
+
/* NSPR uses the print macros a bit differently than ANSI C. We
* need to use ll for a 64-bit integer, even when a long is 64-bit.
*/
@@ -6062,12 +6070,13 @@ int slapi_register_plugin_ext( const char *plugintype, int enabled,
/*
* logging
*/
-int slapi_log_error( int loglevel, char *subsystem, char *fmt, ... )
+int slapi_log_err( int loglevel, char *subsystem, char *fmt, ... )
#ifdef __GNUC__
__attribute__ ((format (printf, 3, 4)));
#else
;
#endif
+
int slapi_log_error_ext( int loglevel, char *subsystem, char *fmt, va_list varg1, va_list varg2);
/* allowed values for the "severity" parameter */
7 years, 2 months
src/com
by Mark Reynolds
src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit d2c5e8cd2fb53d642e09f200d93861b142f9615a
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Sep 27 11:31:37 2016 -0400
Ticket 48926 - fix "expiresin" entry definition
Bug Description: The "expiresin" component incorrectly set the model to "0",
which causes unexpected behaviors in the account policy tab.
Fix Description: Set the model to "null" to trigger the correct behavior for this
component type.
https://fedorahosted.org/389/ticket/48926
Reviewed by: nhosoi(Thanks!)
diff --git a/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java b/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java
index 0050b39..1a94362 100644
--- a/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java
+++ b/src/com/netscape/admin/dirserv/panel/PasswordPolicyPanel.java
@@ -512,7 +512,7 @@ public class PasswordPolicyPanel extends BlankPanel {
DSEntrySet entries = getDSEntrySet();
- DSEntryExpire expiresInDSEntry = new DSEntryExpire("0", _rbExpiresIn);
+ DSEntryExpire expiresInDSEntry = new DSEntryExpire(null, _rbExpiresIn);
entries.add(_policyspecdn, EXPIRES_ATTR_NAME,
expiresInDSEntry);
setComponentTable(_rbExpiresIn, expiresInDSEntry);
7 years, 2 months
Branch '389-ds-base-1.3.5' - ldap/servers
by thierry bordaz
ldap/servers/slapd/schema.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
New commits:
commit e2bc8fd60bf232cd4c1bc9a6860b7bd570a9dff1
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Thu Sep 22 20:48:13 2016 +0200
Ticket 48992: Total init may fail if the pushed schema is rejected
Bug Description:
In the early phase of total update (or incremental update), the supplier may send its schema.
A supplier will send its schema to the consumer at the condition its nsSchemaCSN is greater than
the consumer nsSchemaCSN.
If it is the case, a 1.2.11 supplier will systematically send its schema, while a 1.3 supplier will
check that its schema is a superset of the consumer schema before sending it.
If a 1.2.11 supplier sends its schema and that schema is a subset of consumer one, then
the >1.3 consumer will detect it is a subset and reject the update.
In that case the >1.3 consumer rejects a replicated update.
On the consumer side, with the fix https://fedorahosted.org/389/ticket/47788, if a
replication operation fails, it may trigger the closure of the replication connection.
The fix decides, based on the type of failure, if the failure can be ignored (leave the connection
opened) or is fatal (close the connection).
This is detected, on the consumer side, in multimaster_postop_*->process_postop->ignore_error_and_keep_going.
In the current version, if a replicated update of the schema fails it return LDAP_UNWILLING_TO_PERFORM.
This is a fatal error regarding ignore_error_and_keep_going that then close the connection
and interrupt the total/incremental update.
Note this bug can be transient as, the schema learning mechanism (on consumer) may learn from
the received schema (even if it is rejected) and update its local schema that increase
nsSchemaCSN. If this occur, a later replication session finding a greater nsSchemaCSN on the
consumer side will not push the schema
Fix Description:
When the update of the schema is rejected make it not fatal, switching the returned
code from LDAP_UNWILLING_TO_PERFORM to LDAP_CONSTRAINT_VIOLATION
https://fedorahosted.org/389/ticket/48992
Reviewed by: Noriko Hosoi, Ludwig Krispenz (thanks to you !)
Platforms tested: 7.3
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 7689aa9..4b8910d 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2120,7 +2120,24 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
slapi_log_error(SLAPI_LOG_FATAL, "schema",
"[C] Local %s must not be overwritten (set replication log for additional info)\n",
attr_name);
- *returncode = LDAP_UNWILLING_TO_PERFORM;
+ /*
+ * If the update (replicated) of the schema is rejected then
+ * process_postop->ignore_error_and_keep_going will decide if
+ * this failure is fatal or can be ignored.
+ * LDAP_UNWILLING_TO_PERFORM is considered as fatal error --> close the connection
+ *
+ * A 6.x supplier may send a subset schema and trigger this error, that
+ * will break the replication session.
+ *
+ * With new "learning" mechanism this is not that important if the
+ * update of the schema is successful or not. Just be permissive
+ * ignoring that failure to let the full replication session going on
+ * So return LDAP_CONSTRAINT_VIOLATION (in place of LDAP_UNWILLING_TO_PERFORM)
+ * is pick up as best choice of non fatal returncode.
+ * (others better choices UNWILLING_TO_PERFORM, OPERATION_ERROR or ldap_error
+ * are unfortunately all fatal).
+ */
+ *returncode = LDAP_CONSTRAINT_VIOLATION;
return (SLAPI_DSE_CALLBACK_ERROR);
}
}
7 years, 2 months
ldap/servers
by thierry bordaz
ldap/servers/slapd/schema.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
New commits:
commit 1b486220105eacf4bd9d5145114e0b1fec78544d
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Thu Sep 22 20:48:13 2016 +0200
Ticket 48992: Total init may fail if the pushed schema is rejected
Bug Description:
In the early phase of total update (or incremental update), the supplier may send its schema.
A supplier will send its schema to the consumer at the condition its nsSchemaCSN is greater than
the consumer nsSchemaCSN.
If it is the case, a 1.2.11 supplier will systematically send its schema, while a 1.3 supplier will
check that its schema is a superset of the consumer schema before sending it.
If a 1.2.11 supplier sends its schema and that schema is a subset of consumer one, then
the >1.3 consumer will detect it is a subset and reject the update.
In that case the >1.3 consumer rejects a replicated update.
On the consumer side, with the fix https://fedorahosted.org/389/ticket/47788, if a
replication operation fails, it may trigger the closure of the replication connection.
The fix decides, based on the type of failure, if the failure can be ignored (leave the connection
opened) or is fatal (close the connection).
This is detected, on the consumer side, in multimaster_postop_*->process_postop->ignore_error_and_keep_going.
In the current version, if a replicated update of the schema fails it return LDAP_UNWILLING_TO_PERFORM.
This is a fatal error regarding ignore_error_and_keep_going that then close the connection
and interrupt the total/incremental update.
Note this bug can be transient as, the schema learning mechanism (on consumer) may learn from
the received schema (even if it is rejected) and update its local schema that increase
nsSchemaCSN. If this occur, a later replication session finding a greater nsSchemaCSN on the
consumer side will not push the schema
Fix Description:
When the update of the schema is rejected make it not fatal, switching the returned
code from LDAP_UNWILLING_TO_PERFORM to LDAP_CONSTRAINT_VIOLATION
https://fedorahosted.org/389/ticket/48992
Reviewed by: Noriko Hosoi, Ludwig Krispenz (thanks to you !)
Platforms tested: 7.3
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 164dd78..c0581b7 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2120,7 +2120,24 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
slapi_log_error(SLAPI_LOG_ERR, "modify_schema_dse",
"[C] Local %s must not be overwritten (set replication log for additional info)\n",
attr_name);
- *returncode = LDAP_UNWILLING_TO_PERFORM;
+ /*
+ * If the update (replicated) of the schema is rejected then
+ * process_postop->ignore_error_and_keep_going will decide if
+ * this failure is fatal or can be ignored.
+ * LDAP_UNWILLING_TO_PERFORM is considered as fatal error --> close the connection
+ *
+ * A 6.x supplier may send a subset schema and trigger this error, that
+ * will break the replication session.
+ *
+ * With new "learning" mechanism this is not that important if the
+ * update of the schema is successful or not. Just be permissive
+ * ignoring that failure to let the full replication session going on
+ * So return LDAP_CONSTRAINT_VIOLATION (in place of LDAP_UNWILLING_TO_PERFORM)
+ * is pick up as best choice of non fatal returncode.
+ * (others better choices UNWILLING_TO_PERFORM, OPERATION_ERROR or ldap_error
+ * are unfortunately all fatal).
+ */
+ *returncode = LDAP_CONSTRAINT_VIOLATION;
return (SLAPI_DSE_CALLBACK_ERROR);
}
}
7 years, 2 months
Changes to 'refs/tags/389-admin-1.1.45'
by Noriko Hosoi
Changes since 389-admin-1.1.11:
Endi S. Dewata (3):
Bug 573889 - Migration does not remove deprecated schema
Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries
Bug 470576 - Migration could do addition checks before commiting actions
Ludwig (1):
Ticket 47563 - cannot restart directory server from console
Mark Reynolds (22):
Ticket #286 - compilation fixes for 'format-security'
Ticket 401 - Console login fails with anonymous access disabled
Ticket 400 - BIND operation result not checked properly in admin server
Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry
Ticket 47495 - admin express: wrong instance creation time
Ticket 47497 - Admin Express - remove "Security Level"
Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time
Ticket 47300 - Update man page for remove-ds-admin.pl
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain
Ticket 47548 - register-ds-admin does not register into remote config ds
Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot
Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c
Ticket 201 - nCipher HSM cannot be configured via the console
Ticket 47929 - Admin Server - disable SSLv3 by default
Ticket 47548 - register-ds-admin.pl fails to set local bind DN and password
Ticket 47548 - register-ds-admin - silent file incorrectly processed
Ticket 48213 - Admin server registration requires anonymous binds
Ticket 48306 - perl module conditional test is not conditional when checking SELinux policies
Ticket 48907 - register-ds-admin fails to find local config DS
TIcket 48823 - Admin Server - Add IPv6 support
Ticket 48932 - stopping admin server stops all httpd processes
Nathan Kinder (49):
Bug 648949 - Merge selinux policy into base OS
Regenerated autoconf files
Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled
Bug 668950 - Add posix group support to Console
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 618897 - Wrong permissions when creating instance from Console
Bug 493424 - remove unneeded modules for admin server apache config
Bug 614690 - Don't use exec to call genrb
Bug 699815 - (cov#10859) Add missing braces in mod_admserv code
Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi
Bug 699815 - (cov#10849,10851) Remove unused variables
Bug 699907 - (cov#10844) Uninitialized time struct
Bug 699907 - (cov#10843) Use of uninitialized variable in logging code
Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi
Bug 699907 - (cov#10836) Use of uninitialized var in http conn code
Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code
Bug 700532 - (cov#10832) Incorrect if condition in dsalib
Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib
Bug 700890 - (cov#10812) Check return value of open() properly in libadmin
Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi
Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication
Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi
Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 702150 - (cov#10823) File descriptors leaked in help cgi
Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi
Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi
Bug 702150 - leak of config array in dsalib
Bug 702150 - (cov#10816) file descriptor leak in dsalib
Bug 702150 - (cov#10817) Leak of string in libdsa
Bug 702150 - Resouce leaks in htmladmin.c
Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin
Bug 702705 - NULL pointer dereferences in viewlog cgi
Bug 702705 - (cov#10803) NULL pointer dereference in security cgi
Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl
Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib
Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy
Bug 724808 - startup CGIs write temp file to /
Bug 730079 - Update SELinux policy during upgrades
Ticket #329 - Port modules to httpd 2.4
Ticket #47333 - Relabel lockfile when starting Admin Server
Ticket #47334 - Avoid quoting all settings in console.conf
Ticket 47468 - Change security password validation error is out of order
Ticket 47466 - Importing CA cert with existing name crashes security CGI
Ticket 362 - Directory Console generates insufficient key strength
Ticket 47467 - Improve CRL import error messages
Noriko Hosoi (46):
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
start-ds-admin.in -- replaced "return 1" with "exit 1"
Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies
Bug 618858 - move start-ds-admin env file into main admin server
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 245278 - Changing to a password with a single quote does not work
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 158926 - Unable to install CA certificate when using
Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user
Bug 476925 - Admin Server: Do not allow 8-bit passwords for
Trac Ticket #307 - htmladmin keeps segfaulting
If htmladmin fails to connect to the server, the cgi could crash.
Ticket #293 - remove-ds-admin.pl does not remove everything
Ticket #476 - 389 ds do not start on F18 due to missing modules
bump version to 1.1.31
Ticket #567 - Restart of Admin server from console fails on segfault
bump version to 1.1.32
bump version to 1.1.33
bump version to 1.1.34
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.36
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket #47995 - Admin Server: source code cleaning
bump version to 1.1.37
Ticket #48024 - repl-monitor invoked from adminserver cgi fails
bump version to 1.1.38
Ticket #48153 - [adminserver] support NSS 3.18
bump version to 1.1.39
Ticket #48171 - remove-ds-admin.pl removes files in the rpm
Ticket #47467 - Improve Add CRL/CKL dialog and errors
bump version to 1.1.40
Ticket #48186 - register-ds-admin.pl script prints clear text password in the terminal
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.41
bump version to 1.1.42
Ticket #48409 - RHDS upgrade change Ownership of certificate files upon upgrade.
Ticket #48410 - 389-admin - Unable to remove / unregister a DS instance from admin server
Ticket #48429 - running remove-ds-admin.pl multiple times will make it so you cannot install DS
bump version to 1.1.43
Ticket #47413 - 389-admin fails to build with latest httpd
Bug 1236635 - 389-admin TPS srpmtest failure
bump version to 1.1.44
Ticket #48988 - ds_removal and ds_unregister should support prompting for password
bump version to 1.1.45
Rich Megginson (66):
bump version to 1.1.12.a1
initial support for openldap
add selinux policy for dsgw
skip LD_PRELOAD if using openldap
add more log information if nss init fails
add even more nss debugging
Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized
bump version to 1.1.12.a2
fix building with mozldap
bump version to 1.1.12.a3
fix autotool build issues with properties files
setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error
Bug 656441 - Missing library path entry causes LD_PRELOAD error
bump version to 1.1.13
bump version to 1.1.14.a1
Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required
bump version to 1.1.14
bump version to 1.1.15
bump version to 1.1.16
Bug 703990 - Support upgrade from Red Hat Directory Server
bump version to 1.1.17
add support for different skins
skip rebranding current brand
bump version to 1.1.18
look for separate openldap ldif library
bump version to 1.1.19
Bug 710372 - Not able to open the Manage Certificate from DS-console
better NSS error handling - reduce memory leaks
fix typo in NSS_Shutdown warning message
added tests for the security cgi
Bug 713000 - Migration stops if old admin server cannot be stopped
Bug 718079 - Perl errors when running migrate-ds-admin.pl
Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts
bump version to 1.1.20
bump version to 1.1.21
handle binary upgrade
add man pages for ds_removal and ds_unregister
bump version to 1.1.22
fix binary paths
bump version to 1.1.23
bump version to 1.1.24
Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd
Bug 740959 - 389-console put CA certificates into wrong database
bump version to 1.1.25
Bug 767823 - selinux: need to allow admin server to connect to ldap port
bump version to 1.1.26
Ticket #161 - Review and address latest Coverity issues
Ticket #281 - TLS not working with latest openldap
bump version to 1.1.27
bump version to 1.1.28
bump version to 1.1.29
bump version to 1.1.30
ignore files generated by Eclipse
Ticket #47486 compiler warnings in adminutil, admin, dsgw
Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw
add more debugging for SSL connection problems
Ticket #47413 389-admin fails to build with latest httpd
compiler warning - ldif_read_record lineno type depends on openldap version
add Eclipse and patch files
bump version to 1.1.35
Ticket #47498 Error Message for Failed to create the configuration directory server
Ticket #418 Error with register-ds-admin.pl
Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down.
Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>"
Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour
Ticket #47478 No groups file? error restarting Admin server
Wes Hardin (1):
fix for bug 377 - Unchecked use of SELinux command
William Brown (2):
Ticket 47840 - Fix setup-ds-admin.pl to create adm.conf with sbin scripts
Ticket 48931 - start-ds-admin should use systemctl
noriko (1):
Ticket #47298 - remove-ds-admin.pl does not stop the admin server
---
.gitignore | 4
Makefile.am | 113
Makefile.in | 2110 -
VERSION.sh | 4
aclocal.m4 | 7614 ----
admserv/cfgstuff/console.conf.in | 6
admserv/cfgstuff/ds_removal.in | 7
admserv/cfgstuff/ds_unregister.in | 7
admserv/cfgstuff/httpd-2.2.conf.in | 13
admserv/cfgstuff/httpd-2.4.conf.in | 742
admserv/cfgstuff/httpd.conf.in | 2
admserv/cfgstuff/initconfig.in | 5
admserv/cfgstuff/restart-ds-admin.in | 12
admserv/cfgstuff/start-ds-admin.in | 114
admserv/cfgstuff/stop-ds-admin.in | 55
admserv/cgi-ds/ds_listdb.c | 26
admserv/cgi-ds/ds_snmpctrl.c | 5
admserv/cgi-src40/ReadLog.c | 18
admserv/cgi-src40/admlib.mk | 119
admserv/cgi-src40/admpw.c | 79
admserv/cgi-src40/cgicommon.h | 1
admserv/cgi-src40/cgicommon.properties | 3
admserv/cgi-src40/config.c | 47
admserv/cgi-src40/dllglue.c | 42
admserv/cgi-src40/ds_create.in | 18
admserv/cgi-src40/ds_remove.in | 6
admserv/cgi-src40/dsconfig.c | 10
admserv/cgi-src40/head.html | 1
admserv/cgi-src40/help.c | 15
admserv/cgi-src40/htmladmin.c | 810
admserv/cgi-src40/htmladmin.properties | 42
admserv/cgi-src40/monreplication.c | 7
admserv/cgi-src40/repl-monitor-cgi.pl.in | 30
admserv/cgi-src40/restartsrv.c | 9
admserv/cgi-src40/sec-activate.c | 163
admserv/cgi-src40/security.c | 348
admserv/cgi-src40/security.properties | 8
admserv/cgi-src40/start_config_ds.c | 11
admserv/cgi-src40/statpingserv.c | 82
admserv/cgi-src40/stopsrv.c | 10
admserv/cgi-src40/ugdsconfig.c | 39
admserv/cgi-src40/viewdata.c | 264
admserv/cgi-src40/viewdata.properties | 2
admserv/cgi-src40/viewlog.c | 75
admserv/cgi-src40/viewlog.properties | 6
admserv/genrb_wrapper.sh | 2
admserv/html/admserv.html.in | 11
admserv/html/htmladmin.html.in | 13
admserv/html/monreplication.html | 20
admserv/html/viewdata.html | 6
admserv/html/viewlog.html | 14
admserv/makeUpgradeTar.sh | 30
admserv/newinst/src/25changefedorato389.pl | 250
admserv/newinst/src/25rebrand.pl.in | 413
admserv/newinst/src/30updateglobalpref.pl.in | 9
admserv/newinst/src/AdminMigration.pm.in | 79
admserv/newinst/src/AdminServer.pm.in | 299
admserv/newinst/src/AdminUtil.pm.in | 183
admserv/newinst/src/ConfigDSDialogs.pm | 42
admserv/newinst/src/dirserver.map.in | 1
admserv/newinst/src/register-ds-admin.pl.in | 719
admserv/newinst/src/register-ds-admin.res.in | 38
admserv/newinst/src/register_param.map.in | 4
admserv/newinst/src/register_server.pl.in | 6
admserv/newinst/src/remove-ds-admin.pl.in | 8
admserv/newinst/src/setup-ds-admin.pl.in | 6
admserv/newinst/src/setup-ds-admin.res.in | 20
admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49
admserv/schema/ldif/10dsdata.ldif.tmpl | 39
compile | 245
config.guess | 768
config.h.in | 36
config.sub | 452
configure |38679 +++++++++-------------
configure.ac | 111
depcomp | 637
include/base/file.h | 3
include/base/util.h | 3
include/libadmin/dbtlibadmin.h | 2
include/libadmin/libadmin.h | 92
include/libdsa/dsalib.h | 15
install-sh | 526
lib/base/file.cpp | 30
lib/base/nscputil.cpp | 51
lib/libadmin/dllglue.c | 77
lib/libadmin/httpcon.c | 5
lib/libadmin/referer.c | 4
lib/libadmin/template.c | 29
lib/libadmin/util.c | 973
lib/libdsa/dsalib_conf.c | 37
lib/libdsa/dsalib_confs.c | 93
lib/libdsa/dsalib_location.c | 56
lib/libdsa/dsalib_tailf.c | 1
lib/libdsa/dsalib_updown.c | 118
lib/libdsa/dsalib_util.c | 56
ltmain.sh |14878 +++++---
m4/adminutil.m4 | 4
m4/httpd.m4 | 3
m4/mod_nss.m4 | 2
m4/mozldap.m4 | 116
m4/openldap.m4 | 138
m4/selinux.m4 | 3
man/man8/ds_removal.8 | 54
man/man8/ds_unregister.8 | 48
man/man8/register-ds-admin.pl.8 | 139
man/man8/remove-ds-admin.pl.8 | 10
man/man8/restart-ds-admin.8 | 10
man/man8/start-ds-admin.8 | 10
man/man8/stop-ds-admin.8 | 10
missing | 453
mod_admserv/mod_admserv.c | 564
mod_admserv/mod_admserv.h | 15
mod_restartd/mod_restartd-2.2.c | 22
selinux/dirsrv-admin.fc.in | 5
selinux/dirsrv-admin.te | 2
tests/ds_create/testget.1 | 2
tests/htmladmin/testget.2 | 2
tests/htmladmin/testget.3 | 2
tests/htmladmin/testget.4 | 2
tests/htmladmin/testget.5 | 2
tests/htmladmin/testget.6 | 2
tests/htmladmin/testget.7 | 2
tests/htmladmin/testget.8 | 2
tests/security/testpost.1 | 1
tests/security/testpost.10 | 1
tests/security/testpost.11 | 1
tests/security/testpost.12 | 1
tests/security/testpost.13 | 1
tests/security/testpost.14 | 1
tests/security/testpost.15 | 1
tests/security/testpost.16 | 1
tests/security/testpost.17 | 1
tests/security/testpost.18 | 1
tests/security/testpost.19 | 1
tests/security/testpost.2 | 1
tests/security/testpost.20 | 1
tests/security/testpost.21 | 1
tests/security/testpost.3 | 1
tests/security/testpost.4 | 1
tests/security/testpost.5 | 1
tests/security/testpost.6 | 1
tests/security/testpost.7 | 1
tests/security/testpost.8 | 1
tests/security/testpost.9 | 1
tests/setup.sh | 250
tests/ugdsconfig/testget.10 | 2
tests/viewdata/testget.2 | 2
tests/viewdata/testget.3 | 2
tests/viewdata/testget.4 | 2
tests/viewlog/testget.3 | 2
tests/viewlog/testget.4 | 2
wrappers/initscript.in | 3
wrappers/systemd.service.in | 24
153 files changed, 36308 insertions(+), 38968 deletions(-)
---
7 years, 2 months
VERSION.sh
by Noriko Hosoi
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit b55fec15335baf5443bb0ccfbbc1ea8041f199eb
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Sep 26 16:55:14 2016 -0700
bump version to 1.1.45
diff --git a/VERSION.sh b/VERSION.sh
index 497fa68..4e1f314 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -11,7 +11,7 @@ vendorurl=http://port389.org
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=1
-VERSION_MAINT=44
+VERSION_MAINT=45
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
7 years, 2 months
Branch '389-ds-base-1.3.4' - ldap/servers
by Ludwig Krispenz
ldap/servers/plugins/replication/cl5_clcache.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
New commits:
commit fba9d48c4a6bf5ca2b148ed2e544e9b65f67dcbc
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Thu Sep 8 11:38:15 2016 +0200
use a consumer maxcsn only as anchor if supplier is more advanced
diff --git a/ldap/servers/plugins/replication/cl5_clcache.c b/ldap/servers/plugins/replication/cl5_clcache.c
index 74f0fec..ca8b841 100644
--- a/ldap/servers/plugins/replication/cl5_clcache.c
+++ b/ldap/servers/plugins/replication/cl5_clcache.c
@@ -717,24 +717,22 @@ clcache_adjust_anchorcsn ( CLC_Buffer *buf, int *flag )
curr, conmaxcsn);
}
- if (csn_compare (cscb->local_maxcsn, cscb->prev_local_maxcsn) == 0 ||
- csn_compare (cscb->prev_local_maxcsn, buf->buf_current_csn) > 0 ) {
- if (csn_compare (cscb->local_maxcsn, cscb->consumer_maxcsn) > 0 ) {
+ if (csn_compare(cscb->local_maxcsn, cscb->consumer_maxcsn) > 0) {
+ /* We have something to send for this RID */
+
+ if (csn_compare(cscb->local_maxcsn, cscb->prev_local_maxcsn) == 0 ||
+ csn_compare(cscb->prev_local_maxcsn, buf->buf_current_csn) > 0) {
+ /* No new changes or it remains, in the buffer, updates to send */
rid_anchor = buf->buf_current_csn;
- }
- } else {
- /* prev local max csn < csnBuffer AND different from local maxcsn */
- if (cscb->prev_local_maxcsn == NULL) {
+ } else {
+ /* prev local max csn < csnBuffer AND different from local maxcsn */
if (cscb->consumer_maxcsn == NULL) {
/* the consumer hasn't seen changes for this RID */
rid_anchor = cscb->local_mincsn;
rid_flag = DB_SET;
- } else if ( csn_compare (cscb->local_maxcsn, cscb->consumer_maxcsn) > 0 ) {
+ } else {
rid_anchor = cscb->consumer_maxcsn;
}
- } else {
- /* csnPrevMaxSup > 0 */
- rid_anchor = cscb->consumer_maxcsn;
}
}
7 years, 2 months
dirsrvtests/tests ldap/servers
by Mark Reynolds
dirsrvtests/tests/tickets/ticket47431_test.py | 2 +-
dirsrvtests/tests/tickets/ticket47823_test.py | 14 +++++++-------
dirsrvtests/tests/tickets/ticket48784_test.py | 2 +-
ldap/servers/plugins/uiduniq/uid.c | 2 +-
4 files changed, 10 insertions(+), 10 deletions(-)
New commits:
commit b3a167557c65036eee98b2bcce90e3e86869b368
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Sep 26 10:25:44 2016 -0400
Ticket 48978 - Fix CI test to account for new logging format
Description: There are some tests that check for error log messages,
but those messages have slightly changed in the new format.
Updated the tests to account for the new log messages.
https://fedorahosted.org/389/ticket/48978
Reviewed by: spichugi(Thanks!)
diff --git a/dirsrvtests/tests/tickets/ticket47431_test.py b/dirsrvtests/tests/tickets/ticket47431_test.py
index 00d3f98..27a52b9 100644
--- a/dirsrvtests/tests/tickets/ticket47431_test.py
+++ b/dirsrvtests/tests/tickets/ticket47431_test.py
@@ -81,7 +81,7 @@ def test_ticket47431_1(topology):
'''
log.info("Ticket 47431 - 1: Check 26 duplicate values are treated as one...")
- expected = "str2entry_dupcheck: .* duplicate values for attribute type nsslapd-pluginarg2 detected in entry cn=7-bit check,cn=plugins,cn=config."
+ expected = "str2entry_dupcheck - .* duplicate values for attribute type nsslapd-pluginarg2 detected in entry cn=7-bit check,cn=plugins,cn=config."
log.debug('modify_s %s' % DN_7BITPLUGIN)
try:
diff --git a/dirsrvtests/tests/tickets/ticket47823_test.py b/dirsrvtests/tests/tickets/ticket47823_test.py
index ba5d110..4d6058a 100644
--- a/dirsrvtests/tests/tickets/ticket47823_test.py
+++ b/dirsrvtests/tests/tickets/ticket47823_test.py
@@ -643,7 +643,7 @@ def test_ticket47823_invalid_config_1(topology):
pass
# Check the expected error message
- regex = re.compile("Config fail: unable to parse old style")
+ regex = re.compile("Unable to parse old style")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -694,7 +694,7 @@ def test_ticket47823_invalid_config_2(topology):
pass
# Check the expected error message
- regex = re.compile("Config info: No valid subtree is defined")
+ regex = re.compile("No valid subtree is defined")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -747,7 +747,7 @@ def test_ticket47823_invalid_config_3(topology):
pass
# Check the expected error message
- regex = re.compile("Config fail: unable to parse old style")
+ regex = re.compile("Unable to parse old style")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -799,7 +799,7 @@ def test_ticket47823_invalid_config_4(topology):
pass
# Check the expected error message
- regex = re.compile("Config info: No valid subtree is defined")
+ regex = re.compile("No valid subtree is defined")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -850,7 +850,7 @@ def test_ticket47823_invalid_config_5(topology):
pass
# Check the expected error message
- regex = re.compile("Config info: attribute name not defined")
+ regex = re.compile("Attribute name not defined")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -901,7 +901,7 @@ def test_ticket47823_invalid_config_6(topology):
pass
# Check the expected error message
- regex = re.compile("Config info: objectclass for subtree entries is not defined")
+ regex = re.compile("Objectclass for subtree entries is not defined")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
@@ -952,7 +952,7 @@ def test_ticket47823_invalid_config_7(topology):
pass
# Check the expected error message
- regex = re.compile("Config info: No valid subtree is defined")
+ regex = re.compile("No valid subtree is defined")
res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
diff --git a/dirsrvtests/tests/tickets/ticket48784_test.py b/dirsrvtests/tests/tickets/ticket48784_test.py
index fca6d9e..bc69308 100644
--- a/dirsrvtests/tests/tickets/ticket48784_test.py
+++ b/dirsrvtests/tests/tickets/ticket48784_test.py
@@ -426,7 +426,7 @@ def test_ticket48784(topology):
log.info('##### Searching for entries on master1...')
entries = topology.master1.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, '(uid=*)')
- assert 12 == len(entries)
+ assert 11 == len(entries) # This is supposed to be "1" less than master 2's entry count
log.info('##### Searching for entries on master2...')
entries = topology.master2.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, '(uid=*)')
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index f05e15c..d1d0162 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -384,7 +384,7 @@ uniqueness_entry_to_config(Slapi_PBlock *pb, Slapi_Entry *config_entry)
if (tmp_config->subtrees == NULL) {
/* Uniqueness is enforced on entries matching objectclass */
if (tmp_config->subtree_entries_oc == NULL) {
- slapi_log_error(SLAPI_LOG_ERR, plugin_name, "uniqueness_entry_to_config - objectclass for subtree entries is not defined\n");
+ slapi_log_error(SLAPI_LOG_ERR, plugin_name, "uniqueness_entry_to_config - Objectclass for subtree entries is not defined\n");
rc = SLAPI_PLUGIN_FAILURE;
goto done;
}
7 years, 2 months