[389-ds-base] branch 389-ds-base-1.4.0 updated: Ticket 50431 - Fix covscan warnings
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.0
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.0 by this push:
new d2545a9 Ticket 50431 - Fix covscan warnings
d2545a9 is described below
commit d2545a987d384ec313bd4daf66e87f0ea0b97968
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Wed Jun 5 14:09:52 2019 -0400
Ticket 50431 - Fix covscan warnings
Description: Most coverity errors happen when something fails.
https://pagure.io/389-ds-base/issue/50431
Reviewed by: firstyear & spichugi(Thanks!)
(cherry picked from commit 4934b57afbe68cb7a2d792608ef37b34adc2308b)
---
autogen.sh | 8 ++-
ldap/servers/plugins/acl/acl.c | 15 ++----
ldap/servers/plugins/acl/acleffectiverights.c | 12 +++--
ldap/servers/plugins/acl/acllist.c | 4 +-
ldap/servers/plugins/linkedattrs/linked_attrs.c | 4 +-
ldap/servers/plugins/memberof/memberof_config.c | 12 +++--
ldap/servers/plugins/posix-winsync/posix-winsync.c | 2 +-
ldap/servers/plugins/replication/cl5_api.c | 1 +
ldap/servers/plugins/replication/repl5_replica.c | 2 +-
.../plugins/replication/repl5_replica_config.c | 8 +--
ldap/servers/plugins/replication/urp.c | 1 +
ldap/servers/plugins/roles/roles_cache.c | 2 +
ldap/servers/plugins/views/views.c | 16 ++++--
ldap/servers/slapd/agtmmap.c | 2 +-
ldap/servers/slapd/back-ldbm/dblayer.c | 55 ++++++++++++---------
ldap/servers/slapd/back-ldbm/index.c | 9 ++--
ldap/servers/slapd/back-ldbm/ldbm_add.c | 3 +-
.../slapd/back-ldbm/ldbm_attrcrypt_config.c | 4 +-
ldap/servers/slapd/back-ldbm/ldbm_delete.c | 3 +-
ldap/servers/slapd/back-ldbm/ldif2ldbm.c | 4 +-
ldap/servers/slapd/back-ldbm/vlv_srch.c | 3 +-
ldap/servers/slapd/connection.c | 1 +
ldap/servers/slapd/dse.c | 7 +--
ldap/servers/slapd/entrywsi.c | 57 +++++++++++-----------
ldap/servers/slapd/main.c | 9 +---
ldap/servers/slapd/mapping_tree.c | 46 +++++++++--------
ldap/servers/slapd/modify.c | 6 ++-
ldap/servers/slapd/opshared.c | 3 +-
ldap/servers/slapd/plugin_internal_op.c | 3 +-
ldap/servers/slapd/plugin_syntax.c | 4 +-
ldap/servers/slapd/rdn.c | 5 +-
ldap/servers/slapd/sasl_map.c | 4 +-
ldap/servers/slapd/schema.c | 6 +--
ldap/servers/slapd/search.c | 7 +--
ldap/servers/slapd/tools/dbscan.c | 9 ++--
ldap/servers/slapd/tools/ldclt/ldapfct.c | 8 +--
ldap/servers/slapd/tools/ldclt/ldclt.c | 2 +-
ldap/servers/slapd/tools/ldif.c | 10 ++--
ldap/servers/slapd/tools/mmldif.c | 5 +-
ldap/servers/slapd/tools/pwenc.c | 1 +
ldap/servers/slapd/tools/rsearch/infadd.c | 2 +-
ldap/servers/slapd/tools/rsearch/rsearch.c | 5 +-
lib/ldaputil/certmap.c | 15 +++---
lib/libaccess/usrcache.cpp | 6 +--
.../389-console/src/lib/database/chaining.jsx | 2 +-
.../389-console/src/lib/database/suffix.jsx | 4 +-
src/cockpit/389-console/src/replication.js | 2 +-
src/lib389/lib389/agreement.py | 1 +
src/lib389/lib389/backend.py | 8 +--
src/lib389/lib389/cli_conf/backend.py | 2 +-
50 files changed, 229 insertions(+), 181 deletions(-)
diff --git a/autogen.sh b/autogen.sh
index 8bb628b..06a5fac 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -35,12 +35,16 @@ checkvers() {
vers="$1"; shift
needmaj="$1"; shift
needmin="$1"; shift
- needrev="$1"; shift
+ if [ "$#" != "0" ]; then
+ needrev="$1"; shift
+ fi
verslist=`echo $vers | tr '.' ' '`
set $verslist
maj=$1; shift
min=$1; shift
- rev=$1; shift
+ if [ "$#" != "0" ]; then
+ rev=$1; shift
+ fi
if [ "$maj" -gt "$needmaj" ] ; then return 0; fi
if [ "$maj" -lt "$needmaj" ] ; then return 1; fi
# if we got here, maj == needmaj
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 6d105f4..5680de6 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -644,7 +644,8 @@ cleanup_and_ret:
if (aclpb)
aclpb->aclpb_curr_attrEval = NULL;
- print_access_control_summary("main", ret_val, clientDn, aclpb, right,
+ print_access_control_summary("main", ret_val, clientDn, aclpb,
+ (right ? right : "NULL"),
(attr ? attr : "NULL"), n_edn,
&decision_reason);
TNF_PROBE_0_DEBUG(acl_cleanup_end, "ACL", "");
@@ -2590,12 +2591,9 @@ acl__resource_match_aci(Acl_PBlock *aclpb, aci_t *aci, int skip_attrEval, int *a
* that applies to the current attribute.
* Then the (attribute,value) pair being added/deleted better
* match that filter.
- *
- *
*/
-
Targetattrfilter **attrFilterArray = NULL;
- Targetattrfilter *attrFilter;
+ Targetattrfilter *attrFilter = NULL;
int found = 0;
if ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_ADD) &&
@@ -2606,15 +2604,13 @@ acl__resource_match_aci(Acl_PBlock *aclpb, aci_t *aci, int skip_attrEval, int *a
attrFilterArray = aci->targetAttrDelFilters;
}
-
/*
* Scan this filter list for an applicable filter.
*/
-
found = 0;
num_attrs = 0;
- while (attrFilterArray[num_attrs] && !found) {
+ while (attrFilterArray && attrFilterArray[num_attrs] && !found) {
attrFilter = attrFilterArray[num_attrs];
/* If this filter applies to the attribute, stop. */
@@ -2630,8 +2626,7 @@ acl__resource_match_aci(Acl_PBlock *aclpb, aci_t *aci, int skip_attrEval, int *a
* Here, if found an applicable filter, then apply the filter to the
* (attr,val) pair.
* Otherwise, ignore the targetattrfilters.
- */
-
+ */
if (found) {
if (acl__make_filter_test_entry(&aclpb->aclpb_filter_test_entry,
diff --git a/ldap/servers/plugins/acl/acleffectiverights.c b/ldap/servers/plugins/acl/acleffectiverights.c
index 8a0cb91..5dd46a0 100644
--- a/ldap/servers/plugins/acl/acleffectiverights.c
+++ b/ldap/servers/plugins/acl/acleffectiverights.c
@@ -869,14 +869,14 @@ _ger_generate_template_entry(
if (dntype) {
siz += strlen(dntype) + 30 + strlen(object) + strlen(dn);
} else {
- siz += strlen(attrs[0]) + 30 + strlen(object) + strlen(dn);
+ siz += strlen(attrs[0] ? attrs[0] : "") + 30 + strlen(object) + strlen(dn);
}
} else {
/* dn: <attr>=<template_name>\n\0 */
if (dntype) {
siz += strlen(dntype) + 30 + strlen(object);
} else {
- siz += strlen(attrs[0]) + 30 + strlen(object);
+ siz += strlen(attrs[0] ? attrs[0] : "") + 30 + strlen(object);
}
}
templateentry = (char *)slapi_ch_malloc(siz);
@@ -1030,7 +1030,9 @@ bailout:
* slapi_pblock_set() will free any previous data, and
* pblock_done() will free SLAPI_PB_RESULT_TEXT.
*/
- slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, gerstr);
+ if (gerstr) {
+ slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, gerstr);
+ }
if (!iscritical) {
/*
@@ -1040,7 +1042,7 @@ bailout:
rc = LDAP_SUCCESS;
}
- slapi_ch_free((void **)&subjectndn);
- slapi_ch_free((void **)&gerstr);
+ slapi_ch_free_string(&subjectndn);
+ slapi_ch_free_string(&gerstr);
return rc;
}
diff --git a/ldap/servers/plugins/acl/acllist.c b/ldap/servers/plugins/acl/acllist.c
index 79786b7..e80c567 100644
--- a/ldap/servers/plugins/acl/acllist.c
+++ b/ldap/servers/plugins/acl/acllist.c
@@ -255,7 +255,9 @@ __acllist_add_aci(aci_t *aci)
t_aci = t_aci->aci_next;
/* Now add the new one to the end of the list */
- t_aci->aci_next = aci;
+ if (t_aci) {
+ t_aci->aci_next = aci;
+ }
slapi_log_err(SLAPI_LOG_ACL, plugin_name, "__acllist_add_aci - Added the ACL:%s to existing container:[%d]%s\n",
aci->aclName, head->acic_index, slapi_sdn_get_ndn(head->acic_sdn));
diff --git a/ldap/servers/plugins/linkedattrs/linked_attrs.c b/ldap/servers/plugins/linkedattrs/linked_attrs.c
index f6eee19..4f9fb10 100644
--- a/ldap/servers/plugins/linkedattrs/linked_attrs.c
+++ b/ldap/servers/plugins/linkedattrs/linked_attrs.c
@@ -1256,7 +1256,9 @@ linked_attrs_del_backpointers(Slapi_PBlock *pb, char *linkdn, struct configEntry
slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &pre_e);
slapi_entry_attr_find(pre_e, config->linktype, &pre_attr);
- slapi_attr_get_valueset(pre_attr, &vals);
+ if (pre_attr) {
+ slapi_attr_get_valueset(pre_attr, &vals);
+ }
} else {
vals = slapi_valueset_new();
slapi_valueset_set_from_smod(vals, smod);
diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c
index 89fd012..124217e 100644
--- a/ldap/servers/plugins/memberof/memberof_config.c
+++ b/ldap/servers/plugins/memberof/memberof_config.c
@@ -550,13 +550,17 @@ memberof_apply_config(Slapi_PBlock *pb __attribute__((unused)),
}
/* Build the new list */
- for (i = 0; theConfig.group_slapiattrs && theConfig.groupattrs && theConfig.groupattrs[i]; i++) {
+ for (i = 0; theConfig.group_slapiattrs && theConfig.group_slapiattrs[i] &&
+ theConfig.groupattrs && theConfig.groupattrs[i]; i++)
+ {
theConfig.group_slapiattrs[i] = slapi_attr_new();
slapi_attr_init(theConfig.group_slapiattrs[i], theConfig.groupattrs[i]);
}
/* Terminate the list. */
- theConfig.group_slapiattrs[i] = NULL;
+ if (theConfig.group_slapiattrs) {
+ theConfig.group_slapiattrs[i] = NULL;
+ }
/* The filter is based off of the groupattr, so we update it here too. */
slapi_filter_free(theConfig.group_filter, 1);
@@ -736,7 +740,9 @@ memberof_copy_config(MemberOfConfig *dest, MemberOfConfig *src)
}
/* Terminate the array. */
- dest->group_slapiattrs[i] = NULL;
+ if (dest->group_slapiattrs) {
+ dest->group_slapiattrs[i] = NULL;
+ }
}
if (src->memberof_attr) {
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index 8e5ca4f..c56e55f 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -1114,7 +1114,7 @@ posix_winsync_pre_ds_mod_group_cb(void *cbdata __attribute__((unused)),
slapi_value_init_string(voc, "posixGroup");
slapi_entry_attr_find(ds_entry, "objectClass", &oc_attr);
- if (slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {
+ if (oc_attr && slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {
Slapi_ValueSet *oc_vs = NULL;
Slapi_Value *oc_nv = slapi_value_new();
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 65801bc..498893c 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -2770,6 +2770,7 @@ _cl5UpgradeMajor(char *fromVersion, char *toVersion)
if (rc != CL5_SUCCESS) {
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name_cl,
"_cl5UpgradeMajor - Failed to open the db env\n");
+ s_cl5Desc.dbOpenMode = backup;
return rc;
}
s_cl5Desc.dbOpenMode = backup;
diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c
index b3d6198..6a5363e 100644
--- a/ldap/servers/plugins/replication/repl5_replica.c
+++ b/ldap/servers/plugins/replication/repl5_replica.c
@@ -2317,7 +2317,7 @@ replica_check_for_tasks(time_t when __attribute__((unused)), void *arg)
"missing original task flag. Aborting abort task!\n",
clean_vals[i]);
replica_delete_task_config(e, (char *)type_replicaAbortCleanRUV, orig_val);
- goto done;
+ goto done2;
}
if (!is_cleaned_rid(rid)) {
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 02b645f..7649aa1 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -223,6 +223,7 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
}
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, "replica_config_add - "MSG_NOREPLICANORMRDN);
slapi_rdn_free(&replicardn);
+ slapi_ch_free_string(&replica_root);
*returncode = LDAP_UNWILLING_TO_PERFORM;
return SLAPI_DSE_CALLBACK_ERROR;
} else {
@@ -232,6 +233,7 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
}
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name,"replica_config_add - "MSG_CNREPLICA, nrdn, REPLICA_RDN);
slapi_rdn_free(&replicardn);
+ slapi_ch_free_string(&replica_root);
*returncode = LDAP_UNWILLING_TO_PERFORM;
return SLAPI_DSE_CALLBACK_ERROR;
}
@@ -242,6 +244,7 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
strcpy(errortext, MSG_NOREPLICARDN);
}
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, "replica_config_add - "MSG_NOREPLICARDN);
+ slapi_ch_free_string(&replica_root);
*returncode = LDAP_UNWILLING_TO_PERFORM;
return SLAPI_DSE_CALLBACK_ERROR;
}
@@ -287,7 +290,7 @@ done:
PR_Unlock(s_configLock);
/* slapi_ch_free accepts NULL pointer */
- slapi_ch_free((void **)&replica_root);
+ slapi_ch_free_string(&replica_root);
if (*returncode != LDAP_SUCCESS) {
if (mtnode_ext->replica)
@@ -2083,7 +2086,6 @@ check_replicas_are_done_cleaning(cleanruv_data *data)
while (not_all_cleaned && !is_task_aborted(data->rid) && !slapi_is_shutting_down()) {
agmt_obj = agmtlist_get_first_agreement_for_replica(data->replica);
if (agmt_obj == NULL) {
- not_all_cleaned = 0;
break;
}
while (agmt_obj && !slapi_is_shutting_down()) {
@@ -2196,7 +2198,6 @@ check_replicas_are_done_aborting(cleanruv_data *data)
while (not_all_aborted && !slapi_is_shutting_down()) {
agmt_obj = agmtlist_get_first_agreement_for_replica(data->replica);
if (agmt_obj == NULL) {
- not_all_aborted = 0;
break;
}
while (agmt_obj && !slapi_is_shutting_down()) {
@@ -2803,6 +2804,7 @@ delete_cleaned_rid_config(cleanruv_data *clean_data)
cleanruv_log(clean_data->task, clean_data->rid, CLEANALLRUV_ID, SLAPI_LOG_ERR,
"delete_cleaned_rid_config - Failed to remove task data from (%s) error (%d), rid (%d)",
edn, rc, clean_data->rid);
+ slapi_ch_array_free(attr_val);
goto bail;
}
}
diff --git a/ldap/servers/plugins/replication/urp.c b/ldap/servers/plugins/replication/urp.c
index 37fe773..b134409 100644
--- a/ldap/servers/plugins/replication/urp.c
+++ b/ldap/servers/plugins/replication/urp.c
@@ -1602,6 +1602,7 @@ urp_find_tombstone_for_glue (Slapi_PBlock *pb, char *sessionid, const Slapi_Entr
for (int i = 0; entries && (entries[i] != NULL); i++) {
char *tombstone_csn_value = slapi_entry_attr_get_charptr(entries[i], "nstombstonecsn");
if (tombstone_csn_value) {
+ csn_free(&tombstone_csn);
tombstone_csn = csn_new_by_string(tombstone_csn_value);
slapi_ch_free_string(&tombstone_csn_value);
if( csn_compare(tombstone_csn, conflict_csn) > 0 ) {
diff --git a/ldap/servers/plugins/roles/roles_cache.c b/ldap/servers/plugins/roles/roles_cache.c
index 1e5865a..4e3b0af 100644
--- a/ldap/servers/plugins/roles/roles_cache.c
+++ b/ldap/servers/plugins/roles/roles_cache.c
@@ -1276,6 +1276,8 @@ roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **resu
if (rc == 0) {
*result = this_role;
+ } else {
+ slapi_ch_free((void **)&this_role);
}
slapi_log_err(SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM,
diff --git a/ldap/servers/plugins/views/views.c b/ldap/servers/plugins/views/views.c
index 6f784f5..5d84647 100644
--- a/ldap/servers/plugins/views/views.c
+++ b/ldap/servers/plugins/views/views.c
@@ -783,10 +783,12 @@ views_cache_create_applied_filter(viewEntry *pView)
"views_cache_create_applied_filter - View filter [%s] in entry [%s] is not valid\n",
buf, current->pDn);
}
- if (pBuiltFilter && pCurrentFilter)
+ if (pBuiltFilter && pCurrentFilter) {
pBuiltFilter = slapi_filter_join_ex(LDAP_FILTER_AND, pBuiltFilter, pCurrentFilter, 0);
- else
+ } else {
+ slapi_filter_free(pBuiltFilter, 1);
pBuiltFilter = pCurrentFilter;
+ }
slapi_ch_free((void **)&buf);
@@ -952,10 +954,12 @@ views_cache_create_descendent_filter(viewEntry *ancestor, PRBool useEntryID)
"views_cache_create_descendent_filter - View filter [%s] in entry [%s] is invalid\n",
buf, currentChild->pDn);
}
- if (pOrSubFilter && pCurrentFilter)
+ if (pOrSubFilter && pCurrentFilter) {
pOrSubFilter = slapi_filter_join_ex(LDAP_FILTER_OR, pOrSubFilter, pCurrentFilter, 0);
- else
+ } else {
+ slapi_filter_free(pOrSubFilter, 1);
pOrSubFilter = pCurrentFilter;
+ }
PR_smprintf_free(buf);
}
@@ -1756,7 +1760,9 @@ view_search_rewrite_callback(Slapi_PBlock *pb)
#endif
/* make it happen */
- slapi_pblock_set(pb, SLAPI_SEARCH_FILTER, outFilter);
+ if (outFilter) {
+ slapi_pblock_set(pb, SLAPI_SEARCH_FILTER, outFilter);
+ }
ret = -2;
diff --git a/ldap/servers/slapd/agtmmap.c b/ldap/servers/slapd/agtmmap.c
index 352ccef..bc5fe1e 100644
--- a/ldap/servers/slapd/agtmmap.c
+++ b/ldap/servers/slapd/agtmmap.c
@@ -243,7 +243,7 @@ agt_mread_stats(int hdl, struct hdr_stats_t *pHdrInfo, struct ops_stats_t *pDsOp
return (EINVAL); /* Inavlid handle */
}
- if (mmap_tbl[hdl].fp <= (caddr_t)0) {
+ if (mmap_tbl[hdl].fp <= 0) {
return (EFAULT); /* Something got corrupted */
}
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index f813447..1fee805 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -3009,7 +3009,7 @@ dblayer_erase_index_file_ex(backend *be, struct attrinfo *a, PRBool use_lock, in
ldbm_instance *inst = NULL;
dblayer_handle *handle = NULL;
char dbName[MAXPATHLEN] = {0};
- char *dbNamep;
+ char *dbNamep = NULL;
char *p;
int dbbasenamelen, dbnamelen;
int rc = 0;
@@ -3102,11 +3102,12 @@ dblayer_erase_index_file_ex(backend *be, struct attrinfo *a, PRBool use_lock, in
sprintf(p, "%c%s%s", get_sep(dbNamep), a->ai_type, LDBM_FILENAME_SUFFIX);
rc = dblayer_db_remove_ex(pEnv, dbNamep, 0, 0);
a->ai_dblayer = NULL;
- if (dbNamep != dbName)
- slapi_ch_free_string(&dbNamep);
} else {
rc = -1;
}
+ if (dbNamep != dbName) {
+ slapi_ch_free_string(&dbNamep);
+ }
slapi_ch_free((void **)&handle);
} else {
/* no handle to close */
@@ -5661,7 +5662,9 @@ dblayer_copy_directory(struct ldbminfo *li,
inst_dir, MAXPATHLEN);
if (!inst_dirp || !*inst_dirp) {
slapi_log_err(SLAPI_LOG_ERR, "dblayer_copy_directory", "Instance dir is NULL.\n");
- slapi_ch_free_string(&inst_dirp);
+ if (inst_dirp != inst_dir) {
+ slapi_ch_free_string(&inst_dirp);
+ }
return return_value;
}
len = strlen(inst_dirp);
@@ -5975,7 +5978,9 @@ dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
slapi_task_log_notice(task,
"Backup: Instance dir is empty\n");
}
- slapi_ch_free_string(&inst_dirp);
+ if (inst_dirp != inst_dir) {
+ slapi_ch_free_string(&inst_dirp);
+ }
return_value = -1;
goto bail;
}
@@ -5993,8 +5998,9 @@ dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
"(%s -> %s): err=%d\n",
inst_dirp, dest_dir, return_value);
}
- if (inst_dirp != inst_dir)
+ if (inst_dirp != inst_dir) {
slapi_ch_free_string(&inst_dirp);
+ }
goto bail;
}
if (inst_dirp != inst_dir)
@@ -6292,7 +6298,6 @@ dblayer_copy_dirand_contents(char *src_dir, char *dst_dir, int mode, Slapi_Task
break;
}
-
PR_snprintf(filename1, MAXPATHLEN, "%s/%s", src_dir, direntry->name);
PR_snprintf(filename2, MAXPATHLEN, "%s/%s", dst_dir, direntry->name);
slapi_log_err(SLAPI_LOG_ERR, "dblayer_copy_dirand_contents", "Moving file %s\n",
@@ -6305,8 +6310,7 @@ dblayer_copy_dirand_contents(char *src_dir, char *dst_dir, int mode, Slapi_Task
mode, task);
if (return_value) {
if (task) {
- slapi_task_log_notice(task,
- "Failed to copy directory %s", filename1);
+ slapi_task_log_notice(task, "Failed to copy directory %s", filename1);
}
break;
}
@@ -6523,13 +6527,13 @@ dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *bena
return LDAP_UNWILLING_TO_PERFORM;
}
if (!dbversion_exists(li, src_dir)) {
- slapi_log_err(SLAPI_LOG_ERR, "dblayer_restore", "Backup directory %s does not "
- "contain a complete backup\n",
+ slapi_log_err(SLAPI_LOG_ERR, "dblayer_restore",
+ "Backup directory %s does not contain a complete backup\n",
src_dir);
if (task) {
- slapi_task_log_notice(task, "Restore: backup directory %s does not "
- "contain a complete backup",
- src_dir);
+ slapi_task_log_notice(task,
+ "Restore: backup directory %s does not contain a complete backup",
+ src_dir);
}
return LDAP_UNWILLING_TO_PERFORM;
}
@@ -6585,13 +6589,10 @@ dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *bena
}
if (slapd_comp_path(src_dir, inst->inst_parent_dir_name) == 0) {
slapi_log_err(SLAPI_LOG_ERR,
- "dblayer_restore", "Backup dir %s and target dir %s "
- "are identical\n",
+ "dblayer_restore", "Backup dir %s and target dir %s are identical\n",
src_dir, inst->inst_parent_dir_name);
if (task) {
slapi_task_log_notice(task,
- "Restore: backup dir %s and target dir %s "
- "are identical\n",
src_dir, inst->inst_parent_dir_name);
}
PR_CloseDir(dirhandle);
@@ -7060,8 +7061,12 @@ dblayer_get_instance_data_dir(backend *be)
full_namep = dblayer_get_full_inst_dir(inst->inst_li, inst,
full_name, MAXPATHLEN);
if (!full_namep || !*full_namep) {
+ if (full_namep != full_name) {
+ slapi_ch_free_string(&full_namep);
+ }
return ret;
}
+
/* Does this directory already exist? */
if ((db_dir = PR_OpenDir(full_namep)) != NULL) {
/* yep. */
@@ -7072,8 +7077,9 @@ dblayer_get_instance_data_dir(backend *be)
ret = mkdir_p(full_namep, 0700);
}
- if (full_name != full_namep)
+ if (full_name != full_namep) {
slapi_ch_free_string(&full_namep);
+ }
return ret;
}
@@ -7097,7 +7103,6 @@ dblayer_in_import(ldbm_instance *inst)
inst_dirp = dblayer_get_full_inst_dir(inst->inst_li, inst,
inst_dir, MAXPATHLEN);
if (!inst_dirp || !*inst_dirp) {
- slapi_ch_free_string(&inst_dirp);
rval = -1;
goto done;
}
@@ -7117,8 +7122,9 @@ dblayer_in_import(ldbm_instance *inst)
}
PR_CloseDir(dirhandle);
done:
- if (inst_dirp != inst_dir)
+ if (inst_dirp != inst_dir) {
slapi_ch_free_string(&inst_dirp);
+ }
return rval;
}
@@ -7149,7 +7155,9 @@ dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
if (NULL == inst_dirp || '\0' == *inst_dirp) {
slapi_log_err(SLAPI_LOG_ERR,
"dblayer_update_db_ext", "Instance dir is NULL\n");
- slapi_ch_free_string(&inst_dirp);
+ if (inst_dirp != inst_dir) {
+ slapi_ch_free_string(&inst_dirp);
+ }
return -1; /* non zero */
}
for (a = (struct attrinfo *)avl_getfirst(inst->inst_attrs);
@@ -7210,8 +7218,9 @@ dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
done:
slapi_ch_free_string(&ofile);
slapi_ch_free_string(&nfile);
- if (inst_dirp != inst_dir)
+ if (inst_dirp != inst_dir) {
slapi_ch_free_string(&inst_dirp);
+ }
return rval;
}
diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c
index f0b969f..2a7529b 100644
--- a/ldap/servers/slapd/back-ldbm/index.c
+++ b/ldap/servers/slapd/back-ldbm/index.c
@@ -1776,13 +1776,14 @@ index_range_read_ext(
}
#endif
error:
+ slapi_log_err(SLAPI_LOG_TRACE, "index_range_read_ext", "(%s,%s) %lu candidates\n",
+ type, prefix ? prefix : "", (u_long)IDL_NIDS(idl));
+
index_free_prefix(prefix);
DBT_FREE_PAYLOAD(cur_key);
DBT_FREE_PAYLOAD(upperkey);
-
dblayer_release_index_file(be, ai, db);
- slapi_log_err(SLAPI_LOG_TRACE, "index_range_read_ext", "(%s,%s) %lu candidates\n",
- type, prefix, (u_long)IDL_NIDS(idl));
+
return (idl);
}
@@ -2406,7 +2407,7 @@ index_free_prefix(char *prefix)
prefix == prefix_SUB) {
/* do nothing */
} else {
- slapi_ch_free((void **)&prefix);
+ slapi_ch_free_string(&prefix);
}
}
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c
index 0d82ae9..a258557 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_add.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c
@@ -162,7 +162,8 @@ ldbm_back_add(Slapi_PBlock *pb)
txn.back_txn_txn = parent_txn;
} else {
parent_txn = txn.back_txn_txn;
- slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
+ if (parent_txn)
+ slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
}
/* The dblock serializes writes to the database,
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
index 9ecb099..fd2c7db 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
@@ -142,7 +142,7 @@ ldbm_instance_attrcrypt_config_add_callback(Slapi_PBlock *pb __attribute__((unus
/* If the cipher was invalid, return unwilling to perform */
if (0 == cipher) {
- returntext = "invalid cipher";
+ PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "invalid cipher");
*returncode = LDAP_UNWILLING_TO_PERFORM;
ret = SLAPI_DSE_CALLBACK_ERROR;
} else {
@@ -167,7 +167,7 @@ ldbm_instance_attrcrypt_config_add_callback(Slapi_PBlock *pb __attribute__((unus
slapi_log_err(SLAPI_LOG_ERR, "ldbm_instance_attrcrypt_config_add_callback - "
"Attempt to encryption on a non-existent attribute: %s\n",
attribute_name, 0, 0);
- returntext = "attribute does not exist";
+ PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "attribute does not exist");
*returncode = LDAP_UNWILLING_TO_PERFORM;
ret = SLAPI_DSE_CALLBACK_ERROR;
}
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_delete.c b/ldap/servers/slapd/back-ldbm/ldbm_delete.c
index e9f3e32..76e37ae 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_delete.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_delete.c
@@ -113,7 +113,8 @@ ldbm_back_delete(Slapi_PBlock *pb)
txn.back_txn_txn = parent_txn;
} else {
parent_txn = txn.back_txn_txn;
- slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
+ if (parent_txn)
+ slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
}
if (pb_conn) {
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index 60437f1..fb0fc5d 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -1154,7 +1154,7 @@ ldbm_back_ldbm2ldif(Slapi_PBlock *pb)
int task_flags;
Slapi_Task *task;
int run_from_cmdline = 0;
- char *instance_name;
+ char *instance_name = NULL;
ldbm_instance *inst = NULL;
int str2entry_options = 0;
int retry;
@@ -1203,11 +1203,11 @@ ldbm_back_ldbm2ldif(Slapi_PBlock *pb)
goto bye;
}
+ slapi_pblock_get(pb, SLAPI_BACKEND_INSTANCE_NAME, &instance_name);
if (run_from_cmdline) {
/* Now that we have processed the config information, we look for
* the be that should do the db2ldif. */
- slapi_pblock_get(pb, SLAPI_BACKEND_INSTANCE_NAME, &instance_name);
inst = ldbm_instance_find_by_name(li, instance_name);
if (NULL == inst) {
slapi_task_log_notice(task, "Unknown backend instance: %s", instance_name);
diff --git a/ldap/servers/slapd/back-ldbm/vlv_srch.c b/ldap/servers/slapd/back-ldbm/vlv_srch.c
index c4c0875..a775550 100644
--- a/ldap/servers/slapd/back-ldbm/vlv_srch.c
+++ b/ldap/servers/slapd/back-ldbm/vlv_srch.c
@@ -168,7 +168,8 @@ vlvSearch_init(struct vlvSearch *p, Slapi_PBlock *pb, const Slapi_Entry *e, ldbm
/* switch context back to the DSE backend */
slapi_pblock_set(pb, SLAPI_BACKEND, oldbe);
- slapi_pblock_set(pb, SLAPI_PLUGIN, oldbe ? oldbe->be_database: NULL);
+ if (oldbe)
+ slapi_pblock_set(pb, SLAPI_PLUGIN, oldbe->be_database);
}
/* make (&(parentid=idofbase)(|(originalfilter)(objectclass=referral))) */
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index 49ee306..81d49e0 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -1883,6 +1883,7 @@ connection_threadmain()
signal_listner();
}
} else if (1 == is_timedout) {
+ /* covscan reports this code is unreachable (2019/6/4) */
connection_make_readable_nolock(conn);
signal_listner();
}
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index 74dfd90..66aeabb 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -2443,7 +2443,8 @@ dse_delete(Slapi_PBlock *pb) /* JCM There should only be one exit point from thi
dse_call_callback(pdse, pb, SLAPI_OPERATION_DELETE, DSE_FLAG_POSTOP, ec, NULL, &returncode, returntext);
done:
slapi_pblock_get(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, &orig_entry);
- slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, ec);
+ if (ec)
+ slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, ec);
/* make sure OPRETURN and RESULT_CODE are set */
slapi_pblock_get(pb, SLAPI_PLUGIN_OPRETURN, &rc);
if (returncode || rc) {
@@ -2484,8 +2485,8 @@ done:
rc = LDAP_UNWILLING_TO_PERFORM;
}
}
-
- slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, orig_entry);
+ if (orig_entry)
+ slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, orig_entry);
slapi_send_ldap_result(pb, returncode, NULL, returntext, 0, NULL);
return dse_delete_return(returncode, ec);
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 080eb15..5d1d723 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -359,7 +359,6 @@ entry_add_present_attribute_wsi(Slapi_Entry *e, Slapi_Attr *a)
* Preserves LDAP Information Model constraints,
* returning an LDAP result code.
*/
-static void entry_dump_stateinfo(char *msg, Slapi_Entry* e);
static Slapi_Value *attr_most_recent_deleted_value(Slapi_Attr *a);
static void resolve_single_valued_two_values(Slapi_Entry *e, Slapi_Attr *a, int attribute_state, Slapi_Value *current_value, Slapi_Value *second_current_value);
static void resolve_single_valued_check_restore_deleted_value(Slapi_Entry *e, Slapi_Attr *a);
@@ -397,6 +396,7 @@ entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **b
/* Used for debug purpose, it dumps into the error log the
* entry with the replication stateinfo
*/
+#if 0
static void
entry_dump_stateinfo(char *msg, Slapi_Entry* e)
{
@@ -407,6 +407,7 @@ entry_dump_stateinfo(char *msg, Slapi_Entry* e)
slapi_log_err(SLAPI_LOG_ERR, msg, "%s\n", s);
slapi_ch_free((void **)&s);
}
+#endif
static int
entry_add_present_values_wsi_single_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags)
@@ -1270,7 +1271,7 @@ attr_most_recent_deleted_value(Slapi_Attr *a)
most_recent_v = v;
while (i != -1) {
- vdcsn = value_get_csn(v, CSN_TYPE_VALUE_DELETED);
+ vdcsn = (CSN *)value_get_csn(v, CSN_TYPE_VALUE_DELETED);
if (csn_compare((const CSN *)most_recent_vdcsn, (const CSN *)vdcsn) < 0) {
most_recent_v = v;
@@ -1289,20 +1290,20 @@ static void
resolve_single_valued_two_values(Slapi_Entry *e, Slapi_Attr *a, int attribute_state, Slapi_Value *current_value, Slapi_Value *second_current_value)
{
- CSN *current_value_vucsn;
- CSN *second_current_value_vucsn;
+ const CSN *current_value_vucsn;
+ const CSN *second_current_value_vucsn;
Slapi_Value *value_to_zap;
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
second_current_value_vucsn = value_get_csn(second_current_value, CSN_TYPE_VALUE_UPDATED);
/* First determine which present value will be zapped */
- if (csn_compare((const CSN *)second_current_value_vucsn, (const CSN *)current_value_vucsn) < 0) {
+ if (csn_compare(second_current_value_vucsn, current_value_vucsn) < 0) {
/*
* The second value is older but was distinguished at the time the current value was added
* then the second value should become current
*/
- if (value_distinguished_at_csn(e, a, second_current_value, (const CSN *)current_value_vucsn)) {
+ if (value_distinguished_at_csn(e, a, second_current_value, current_value_vucsn)) {
value_to_zap = current_value;
} else {
/* The second value being not distinguished, zap it as it is a single valued attribute */
@@ -1311,7 +1312,7 @@ resolve_single_valued_two_values(Slapi_Entry *e, Slapi_Attr *a, int attribute_st
} else {
/* Here the current_value is older than the second_current_value */
- if (value_distinguished_at_csn(e, a, current_value, (const CSN *)second_current_value_vucsn)) {
+ if (value_distinguished_at_csn(e, a, current_value, second_current_value_vucsn)) {
/* current_value was distinguished at the time the second value was added
* then the current_value should become the current */
value_to_zap = second_current_value;
@@ -1348,17 +1349,17 @@ resolve_single_valued_check_restore_deleted_value(Slapi_Entry *e, Slapi_Attr *a)
/* An attribute needs a present value */
entry_deleted_value_to_present_value(a, deleted_value);
} else {
- CSN *current_value_vucsn;
- CSN *deleted_value_vucsn;
- CSN *deleted_value_vdcsn;
+ const CSN *current_value_vucsn;
+ const CSN *deleted_value_vucsn;
+ const CSN *deleted_value_vdcsn;
deleted_value_vucsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_UPDATED);
deleted_value_vdcsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_DELETED);
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
if (deleted_value_vucsn &&
- !value_distinguished_at_csn(e, a, current_value, (const CSN *)deleted_value_vucsn) &&
- (csn_compare((const CSN *)current_value_vucsn, (const CSN *)deleted_value_vucsn) < 0) &&
- (csn_compare((const CSN *)deleted_value_vdcsn, (const CSN *)current_value_vucsn) < 0)) {
+ !value_distinguished_at_csn(e, a, current_value, deleted_value_vucsn) &&
+ (csn_compare((const CSN *)current_value_vucsn, deleted_value_vucsn) < 0) &&
+ (csn_compare((const CSN *)deleted_value_vdcsn, current_value_vucsn) < 0)) {
/* the condition to resurrect the deleted value is
* - it is more recent than the current value
* - its value was deleted before the current value
@@ -1376,8 +1377,8 @@ static void
resolve_single_valued_zap_current(Slapi_Entry *e, Slapi_Attr *a)
{
Slapi_Value *current_value = NULL;
- CSN *current_value_vucsn;
- CSN *adcsn;
+ const CSN *current_value_vucsn;
+ const CSN *adcsn;
/* check if the current value should be deleted because
* older than adcsn and not distinguished
@@ -1386,7 +1387,7 @@ resolve_single_valued_zap_current(Slapi_Entry *e, Slapi_Attr *a)
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
adcsn = attr_get_deletion_csn(a);
if (current_value != NULL) {
- if (csn_compare((const CSN *)adcsn, (const CSN *) current_value_vucsn) > 0) {
+ if (csn_compare(adcsn, (const CSN *) current_value_vucsn) > 0) {
/* the attribute was deleted after the value was last updated */
if (!value_distinguished_at_csn(e, a, current_value, (const CSN *) current_value_vucsn)) {
entry_present_value_to_zapped_value(a, current_value);
@@ -1404,17 +1405,17 @@ resolve_single_valued_set_adcsn(Slapi_Attr *a)
{
Slapi_Value *deleted_value = NULL;
Slapi_Value *current_value = NULL;
- CSN *current_value_vucsn;
- CSN *deleted_value_vucsn;
- CSN *adcsn;
+ const CSN *current_value_vucsn;
+ const CSN *deleted_value_vucsn;
+ const CSN *adcsn;
slapi_attr_first_value(a, ¤t_value);
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
deleted_value = attr_most_recent_deleted_value(a);
deleted_value_vucsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_UPDATED);
adcsn = attr_get_deletion_csn(a);
- if ((deleted_value != NULL && (csn_compare(adcsn, (const CSN *) deleted_value_vucsn) < 0)) ||
- (deleted_value == NULL && (csn_compare(adcsn, (const CSN *) current_value_vucsn) < 0))) {
+ if ((deleted_value != NULL && (csn_compare(adcsn, deleted_value_vucsn) < 0)) ||
+ (deleted_value == NULL && (csn_compare(adcsn, current_value_vucsn) < 0))) {
attr_set_deletion_csn(a, NULL);
}
}
@@ -1430,10 +1431,10 @@ resolve_single_valued_zap_deleted(Slapi_Attr *a)
{
Slapi_Value *deleted_value = NULL;
Slapi_Value *current_value = NULL;
- CSN *current_value_vucsn;
- CSN *deleted_value_vucsn;
- CSN *deleted_value_vdcsn;
- CSN *deleted_value_csn;
+ const CSN *current_value_vucsn;
+ const CSN *deleted_value_vucsn;
+ const CSN *deleted_value_vdcsn;
+ const CSN *deleted_value_csn;
PRBool deleted_on_mod_del = PR_FALSE; /* flag if a value was deleted specifically */
/* Now determine if the deleted value worth to be kept */
@@ -1445,16 +1446,16 @@ resolve_single_valued_zap_deleted(Slapi_Attr *a)
deleted_value_vdcsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_DELETED);
/* get the appropriate csn to take into consideration: either from MOD_REPL or from MOD_DEL_specific */
- if (csn_compare((const CSN *) deleted_value_vdcsn, (const CSN *) deleted_value_vucsn) <= 0) {
+ if (csn_compare(deleted_value_vdcsn, deleted_value_vucsn) <= 0) {
deleted_value_csn = deleted_value_vucsn;
} else {
deleted_value_csn = deleted_value_vdcsn;
- if (0 == csn_compare_ext((const CSN *) current_value_vucsn, (const CSN *) deleted_value_vdcsn, CSN_COMPARE_SKIP_SUBSEQ)) {
+ if (0 == csn_compare_ext(current_value_vucsn, deleted_value_vdcsn, CSN_COMPARE_SKIP_SUBSEQ)) {
/* the deleted value was specifically delete in the same operation that set the current value */
deleted_on_mod_del = PR_TRUE;
}
}
- if ((csn_compare((const CSN *) deleted_value_csn, (const CSN *) current_value_vucsn) < 0) || deleted_on_mod_del) {
+ if ((csn_compare(deleted_value_csn, current_value_vucsn) < 0) || deleted_on_mod_del) {
entry_deleted_value_to_zapped_value(a, deleted_value);
}
}
diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c
index 33ca9ce..2c7b532 100644
--- a/ldap/servers/slapd/main.c
+++ b/ldap/servers/slapd/main.c
@@ -1220,6 +1220,7 @@ main(int argc, char **argv)
vattr_cleanup();
sasl_map_done();
cleanup:
+ slapi_ch_free_string(&(mcfg.myname));
compute_terminate();
SSL_ShutdownServerSessionIDCache();
SSL_ClearSessionCache();
@@ -2194,7 +2195,6 @@ slapd_exemode_ldif2db(struct main_config *mcfg)
return_value = -1;
}
slapi_pblock_destroy(pb);
- slapi_ch_free((void **)&(mcfg->myname));
charray_free(instances);
charray_free(mcfg->cmd_line_instance_names);
charray_free(mcfg->db2ldif_include);
@@ -2377,7 +2377,6 @@ slapd_exemode_db2ldif(int argc, char **argv, struct main_config *mcfg)
slapi_ch_free((void **)&my_ldiffile);
}
}
- slapi_ch_free((void **)&(mcfg->myname));
charray_free(mcfg->cmd_line_instance_names);
charray_free(mcfg->db2ldif_include);
if (mcfg->db2ldif_dump_replica) {
@@ -2505,8 +2504,6 @@ slapd_exemode_db2index(struct main_config *mcfg)
slapi_pblock_destroy(pb);
charray_free(mcfg->db2index_attrs);
- slapi_ch_free((void **)&(mcfg->myname));
-
charray_free(mcfg->db2ldif_include);
/* This frees mcfg->cmd_line_instance_name */
charray_free(instances);
@@ -2557,7 +2554,6 @@ slapd_exemode_db2archive(struct main_config *mcfg)
int32_t task_flags = SLAPI_TASK_RUNNING_FROM_COMMANDLINE;
slapi_pblock_set(pb, SLAPI_TASK_FLAGS, &task_flags);
return_value = (backend_plugin->plg_db2archive)(pb);
- slapi_ch_free((void **)&(mcfg->myname));
slapi_pblock_destroy(pb);
return return_value;
}
@@ -2605,7 +2601,6 @@ slapd_exemode_archive2db(struct main_config *mcfg)
slapi_pblock_set(pb, SLAPI_TASK_FLAGS, &task_flags);
slapi_pblock_set(pb, SLAPI_BACKEND_INSTANCE_NAME, mcfg->cmd_line_instance_name);
return_value = (backend_plugin->plg_archive2db)(pb);
- slapi_ch_free((void **)&(mcfg->myname));
slapi_pblock_destroy(pb);
return return_value;
}
@@ -2674,7 +2669,6 @@ slapd_exemode_upgradedb(struct main_config *mcfg)
return_value = -1;
}
slapi_pblock_destroy(pb);
- slapi_ch_free((void **)&(mcfg->myname));
return (return_value);
}
@@ -2747,7 +2741,6 @@ slapd_exemode_upgradednformat(struct main_config *mcfg)
}
slapi_pblock_destroy(pb);
bail:
- slapi_ch_free((void **)&(mcfg->myname));
return (rc);
}
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index 834949a..b904249 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -539,9 +539,6 @@ free_mapping_tree_node_arrays(backend ***be_list, char ***be_names, int **be_sta
{
int i;
- /* sanity check */
- PR_ASSERT(be_list != NULL && be_names != NULL && be_states != NULL && be_list_count != NULL);
-
if (*be_names != NULL)
for (i = 0; i < *be_list_count; ++i) {
slapi_ch_free((void **)&((*be_names)[i]));
@@ -647,9 +644,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
if (get_backends_from_attr(attr, &be_list, &be_names, &be_states,
&be_list_count, &be_list_size, NULL)) {
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- slapi_sdn_free(&subtree);
- return lderr;
+ goto free_and_return;
}
if (NULL == be_list) {
@@ -660,6 +655,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
}
} else if (!strcasecmp(type, "nsslapd-referral")) {
+ slapi_ch_array_free(referral);
referral = mtn_get_referral_from_entry(entry);
} else if (!strcasecmp(type, "nsslapd-state")) {
@@ -684,6 +680,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_entry_get_dn(entry));
continue;
}
+ slapi_ch_free_string(&plugin_lib);
plugin_lib = slapi_ch_strdup(slapi_value_get_string(val));
} else if (!strcasecmp(type, "nsslapd-distribution-funct")) {
slapi_attr_first_value(attr, &val);
@@ -693,6 +690,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_entry_get_dn(entry));
continue;
}
+ slapi_ch_free_string(&plugin_funct);
plugin_funct = slapi_ch_strdup(slapi_value_get_string(val));
} else if (!strcasecmp(type, "nsslapd-distribution-root-update")) {
const char *sval;
@@ -737,13 +735,16 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
if (be == NULL) {
slapi_log_err(SLAPI_LOG_ERR, "mapping_tree_entry_add",
"Default container has not been created for the NULL SUFFIX node.\n");
- slapi_sdn_free(&subtree);
- return -1;
+ lderr = -1;
+ goto free_and_return;
}
be_list_size = 1;
be_list_count = 0;
+ /* We're in a loop and potentially overwriting these pointers so free them first */
+ free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
+
be_list = (backend **)slapi_ch_calloc(1, sizeof(backend *));
be_names = (char **)slapi_ch_calloc(1, sizeof(char *));
be_states = (int *)slapi_ch_calloc(1, sizeof(int));
@@ -767,17 +768,13 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_log_err(SLAPI_LOG_ERR,
"Node %s must define a backend\n",
slapi_entry_get_dn(entry), 0, 0);
- slapi_sdn_free(&subtree);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
if (((state == MTN_REFERRAL) || (state == MTN_REFERRAL_ON_UPDATE)) && (referral == NULL)) {
slapi_log_err(SLAPI_LOG_ERR,
"Node %s must define referrals to be in referral state\n",
slapi_entry_get_dn(entry), 0, 0);
- slapi_sdn_free(&subtree);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
if (plugin_lib && plugin_funct) {
@@ -787,11 +784,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_log_err(SLAPI_LOG_ERR, "mapping_tree_entry_add",
"Node %s cannot find distribution plugin. " SLAPI_COMPONENT_NAME_NSPR " %d (%s)\n",
slapi_entry_get_dn(entry), PR_GetError(), slapd_pr_strerror(PR_GetError()));
- slapi_sdn_free(&subtree);
- slapi_ch_free((void **)&plugin_funct);
- slapi_ch_free((void **)&plugin_lib);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
} else if ((plugin_lib == NULL) && (plugin_funct == NULL)) {
/* nothing configured -> OK */
@@ -801,11 +794,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_log_err(SLAPI_LOG_ERR, "mapping_tree_entry_add",
"Node %s must define both lib and funct for distribution plugin\n",
slapi_entry_get_dn(entry));
- slapi_sdn_free(&subtree);
- slapi_ch_free((void **)&plugin_funct);
- slapi_ch_free((void **)&plugin_lib);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
/* Now we can create the node for this mapping tree entry. */
@@ -839,6 +828,15 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
}
return lderr;
+
+free_and_return:
+ slapi_sdn_free(&subtree);
+ slapi_ch_array_free(referral);
+ slapi_ch_free_string(&plugin_funct);
+ slapi_ch_free_string(&plugin_lib);
+ free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
+
+ return lderr;
}
/*
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index de46746..69ef485 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -1455,9 +1455,11 @@ optimize_mods(Slapi_Mods *smods)
prev_mod = slapi_mods_get_first_mod(smods);
while ((mod = slapi_mods_get_next_mod(smods))) {
- if ((SLAPI_IS_MOD_ADD(prev_mod->mod_op) || SLAPI_IS_MOD_DELETE(prev_mod->mod_op)) &&
+ if (prev_mod &&
+ (SLAPI_IS_MOD_ADD(prev_mod->mod_op) || SLAPI_IS_MOD_DELETE(prev_mod->mod_op)) &&
(prev_mod->mod_op == mod->mod_op) &&
- (!strcasecmp(prev_mod->mod_type, mod->mod_type))) {
+ (!strcasecmp(prev_mod->mod_type, mod->mod_type)))
+ {
/* Get the current number of mod values from the previous mod. Do it once per attr */
if (mod_count == 0) {
for (; prev_mod->mod_bvalues != NULL && prev_mod->mod_bvalues[mod_count] != NULL; mod_count++)
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index dd69173..dac42eb 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -998,7 +998,8 @@ free_and_return_nolock:
slapi_sdn_free(&sdn);
}
slapi_sdn_free(&basesdn);
- slapi_pblock_set(pb, SLAPI_SEARCH_TARGET_SDN, orig_sdn);
+ if (orig_sdn)
+ slapi_pblock_set(pb, SLAPI_SEARCH_TARGET_SDN, orig_sdn);
slapi_ch_free_string(&proxydn);
slapi_ch_free_string(&proxystr);
diff --git a/ldap/servers/slapd/plugin_internal_op.c b/ldap/servers/slapd/plugin_internal_op.c
index 9da266b..622daff 100644
--- a/ldap/servers/slapd/plugin_internal_op.c
+++ b/ldap/servers/slapd/plugin_internal_op.c
@@ -368,7 +368,8 @@ seq_internal_callback_pb(Slapi_PBlock *pb, void *callback_data, plugin_result_ca
slapi_pblock_set(pb, SLAPI_BACKEND, be);
slapi_pblock_set(pb, SLAPI_PLUGIN, be->be_database);
slapi_pblock_set(pb, SLAPI_SEQ_ATTRNAME, attrname);
- slapi_pblock_set(pb, SLAPI_SEQ_VAL, val);
+ if (val)
+ slapi_pblock_set(pb, SLAPI_SEQ_VAL, val);
slapi_pblock_set(pb, SLAPI_REQCONTROLS, controls);
/* set actions taken to process the operation */
diff --git a/ldap/servers/slapd/plugin_syntax.c b/ldap/servers/slapd/plugin_syntax.c
index e208442..dc7106d 100644
--- a/ldap/servers/slapd/plugin_syntax.c
+++ b/ldap/servers/slapd/plugin_syntax.c
@@ -247,7 +247,9 @@ plugin_call_syntax_filter_sub_sv(
Operation *op = NULL;
/* to pass SLAPI_SEARCH_TIMELIMIT & SLAPI_OPINITATED_TIME */
slapi_pblock_get(pb, SLAPI_OPERATION, &op);
- slapi_pblock_set(pipb, SLAPI_OPERATION, op);
+ if (op) {
+ slapi_pblock_set(pipb, SLAPI_OPERATION, op);
+ }
}
rc = (*sub_fn)(pipb, fsub->sf_initial, fsub->sf_any, fsub->sf_final, va);
} else {
diff --git a/ldap/servers/slapd/rdn.c b/ldap/servers/slapd/rdn.c
index 41c0750..fdb6b17 100644
--- a/ldap/servers/slapd/rdn.c
+++ b/ldap/servers/slapd/rdn.c
@@ -934,10 +934,7 @@ slapi_rdn_get_dn(Slapi_RDN *srdn, char **dn)
if (NULL == srdn || NULL == srdn->all_rdns || NULL == dn) {
return -1;
}
- for (rdnp = srdn->all_rdns; rdnp && *rdnp; rdnp++) {
- len += strlen(*rdnp) + 1; /* 1 for ',' */
- }
- len += 1;
+
len = slapi_rdn_get_dn_len(srdn);
*dn = (char *)slapi_ch_malloc(len);
enddn = *dn + len - 1;
diff --git a/ldap/servers/slapd/sasl_map.c b/ldap/servers/slapd/sasl_map.c
index 72bd010..9593fd0 100644
--- a/ldap/servers/slapd/sasl_map.c
+++ b/ldap/servers/slapd/sasl_map.c
@@ -336,7 +336,9 @@ _sasl_unescape_parenthesis(char *input)
*d++ = *s;
}
}
- *d = '\0';
+ if (d) {
+ *d = '\0';
+ }
return input;
}
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 68c9834..458e143 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2569,9 +2569,9 @@ schema_delete_attributes(Slapi_Entry *entryBefore __attribute__((unused)), LDAPM
attr_ldif[k] = tolower(attr_ldif[k]);
}
- sizedbuffer_allocate(psbAttrName, strlen(attr_ldif));
- sizedbuffer_allocate(psbAttrOid, strlen(attr_ldif));
- sizedbuffer_allocate(psbAttrSyntax, strlen(attr_ldif));
+ sizedbuffer_allocate(psbAttrName, strlen(attr_ldif) + 1);
+ sizedbuffer_allocate(psbAttrOid, strlen(attr_ldif) + 1);
+ sizedbuffer_allocate(psbAttrSyntax, strlen(attr_ldif) + 1);
sscanf(attr_ldif, "%s name %s syntax %s",
psbAttrOid->buffer, psbAttrName->buffer, psbAttrSyntax->buffer);
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index 2a99795..75accbb 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -37,7 +37,7 @@ do_search(Slapi_PBlock *pb)
{
Slapi_Operation *operation;
BerElement *ber;
- int i, err, attrsonly;
+ int i, err = 0, attrsonly;
ber_int_t scope, deref, sizelimit, timelimit;
char *rawbase = NULL;
int rawbase_set_in_pb = 0; /* was rawbase set in pb? */
@@ -233,6 +233,7 @@ do_search(Slapi_PBlock *pb)
log_search_access(pb, base, scope, fstr, "invalid attribute request");
send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL);
slapi_ch_free_string(&normaci);
+ err = 1; /* Make sure we free everything */
goto free_and_return;
}
}
@@ -358,8 +359,8 @@ do_search(Slapi_PBlock *pb)
ps_add(pb, changetypes, send_entchg_controls);
}
-free_and_return:;
- if (!psearch || rc != 0) {
+free_and_return:
+ if (!psearch || rc != 0 || err != 0) {
slapi_ch_free_string(&fstr);
slapi_filter_free(filter, 1);
slapi_pblock_get(pb, SLAPI_SEARCH_ATTRS, &attrs);
diff --git a/ldap/servers/slapd/tools/dbscan.c b/ldap/servers/slapd/tools/dbscan.c
index 53cdb89..c74d482 100644
--- a/ldap/servers/slapd/tools/dbscan.c
+++ b/ldap/servers/slapd/tools/dbscan.c
@@ -532,7 +532,7 @@ print_changelog(unsigned char *data, int len __attribute__((unused)))
replgen = ntohl(thetime32);
pos += sizeof(uint32_t);
thetime = (time_t)replgen;
- db_printf("\treplgen: %ld %s", replgen, ctime((time_t *)&thetime));
+ db_printf("\treplgen: %u %s", replgen, ctime((time_t *)&thetime));
/* read csn */
print_attr("csn", &pos);
@@ -717,12 +717,15 @@ display_item(DBC *cursor, DBT *key, DBT *data)
tmpbuflen = (key->size > data->size ? key->size : data->size) + 1024;
}
if (buflen < tmpbuflen) {
+ unsigned char *tmp = NULL;
buflen = tmpbuflen;
- buf = (unsigned char *)realloc(buf, buflen);
- if (NULL == buf) {
+ tmp = (unsigned char *)realloc(buf, buflen);
+ if (NULL == tmp) {
+ free(buf);
printf("\t(malloc failed -- %d bytes)\n", buflen);
return;
}
+ buf = tmp;
}
if (display_mode & RAWDATA) {
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index 0a9aba8..55f8a1b 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -1103,9 +1103,9 @@ buildVersatileAttribute(
break;
default:
/*
- * Should not happen, unless new variant parsed and not
- * integrated here, or "jardinage"....
- */
+ * Should not happen, unless new variant parsed and not
+ * integrated here, or "jardinage"....
+ */
field = NULL;
field->how = 22; /* Crash !!! */
break;
@@ -3348,7 +3348,7 @@ doExactSearch(
case LDAP_RES_SEARCH_ENTRY:
nentries++;
/* get dereferenced value into resctrls: deref parsing */
- parse_rc = ldap_get_entry_controls(tttctx->ldapCtx, e, &resctrls);
+ ldap_get_entry_controls(tttctx->ldapCtx, e, &resctrls);
if (resctrls != NULL) { /* parse it only when we have return saved in server control */
/* get dn */
if ((dn = ldap_get_dn(tttctx->ldapCtx, e)) != NULL) {
diff --git a/ldap/servers/slapd/tools/ldclt/ldclt.c b/ldap/servers/slapd/tools/ldclt/ldclt.c
index 9128e8d..2690158 100644
--- a/ldap/servers/slapd/tools/ldclt/ldclt.c
+++ b/ldap/servers/slapd/tools/ldclt/ldclt.c
@@ -825,7 +825,7 @@ trapVector(
int
initMainThread(void)
{
- struct sigaction act;
+ struct sigaction act = {0};
/*
* Trap SIGINT.
diff --git a/ldap/servers/slapd/tools/ldif.c b/ldap/servers/slapd/tools/ldif.c
index 5ae5de4..b8c910f 100644
--- a/ldap/servers/slapd/tools/ldif.c
+++ b/ldap/servers/slapd/tools/ldif.c
@@ -94,11 +94,13 @@ main(int argc, char **argv)
}
if (nread + cur > max) {
max += BUFSIZ;
- if ((val = (char *)realloc(val, max)) ==
- NULL) {
+ char *tmp = NULL;
+ if ((tmp = (char *)realloc(val, max)) == NULL) {
+ free(val);
perror("realloc");
return (1);
}
+ val = tmp;
}
memcpy(val + cur, buf, nread);
cur += nread;
@@ -127,12 +129,14 @@ main(int argc, char **argv)
/* if buffer was filled, expand and keep reading unless last char
is linefeed, in which case it is OK for buffer to be full */
while (((curlen = strlen(buf)) == (maxlen - 1)) && buf[curlen - 1] != '\n') {
+ char *tmp = NULL;
maxlen *= 2;
- if ((buf = (char *)realloc(buf, maxlen)) == NULL) {
+ if ((tmp = (char *)realloc(buf, maxlen)) == NULL) {
perror("realloc");
free(buf);
return (1);
}
+ buf = tmp;
if (NULL == fgets(buf + curlen, maxlen / 2 + 1, stdin)) {
/* no more input to read. */
break;
diff --git a/ldap/servers/slapd/tools/mmldif.c b/ldap/servers/slapd/tools/mmldif.c
index cdcf4b1..96b606a 100644
--- a/ldap/servers/slapd/tools/mmldif.c
+++ b/ldap/servers/slapd/tools/mmldif.c
@@ -700,7 +700,6 @@ readrec(edfFILE *edf1, attrib1_t **attrib)
attrib1_t *freelist = *attrib;
attrib1_t *newlist = NULL;
attrib1_t *a;
- int ignore_rec = FALSE;
int free_it = 0;
*attrib = NULL;
@@ -758,7 +757,7 @@ readrec(edfFILE *edf1, attrib1_t **attrib)
if (!stricmp(line, "authoritative"))
continue;
if (!freelist) {
- att = (attrib1_t *)malloc(sizeof(attrib1_t));
+ att = (attrib1_t *)calloc(1, sizeof(struct attrib1_t *));
free_it = 1;
} else {
att = freelist;
@@ -881,8 +880,6 @@ readrec(edfFILE *edf1, attrib1_t **attrib)
}
*attrib = newlist;
freefreelist(freelist);
- if (ignore_rec)
- return IDDS_MM_ABSENT;
return IDDS_MM_OK;
}
diff --git a/ldap/servers/slapd/tools/pwenc.c b/ldap/servers/slapd/tools/pwenc.c
index d92e94e..87ca174 100644
--- a/ldap/servers/slapd/tools/pwenc.c
+++ b/ldap/servers/slapd/tools/pwenc.c
@@ -362,6 +362,7 @@ slapd_config(const char *configdir, const char *givenconfigfile)
}
} else if (slapi_sdn_compare(&config_dn, slapi_entry_get_sdn_const(e)) == 0) {
/* Get the root scheme out and initialise it (if it exists) */
+ slapi_ch_free_string(&rootschemename);
rootschemename = slapi_entry_attr_get_charptr(e, CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE);
}
diff --git a/ldap/servers/slapd/tools/rsearch/infadd.c b/ldap/servers/slapd/tools/rsearch/infadd.c
index db6fb23..6fe84f9 100644
--- a/ldap/servers/slapd/tools/rsearch/infadd.c
+++ b/ldap/servers/slapd/tools/rsearch/infadd.c
@@ -309,7 +309,7 @@ main(int argc, char **argv)
at_getThread(threads[x], NULL), min, max, count,
ntot);
}
- if (!quiet && (numThreads > 1 || !verbose)) {
+ if (numThreads > 1 && !quiet && !verbose) {
double val = 1000.0 * (double)total / (double)sampleInterval;
fprintf(stdout, "Rate: %7.2f/thr (%6.2f/sec =%7.4fms/op), "
"total: %u (%d thr)\n",
diff --git a/ldap/servers/slapd/tools/rsearch/rsearch.c b/ldap/servers/slapd/tools/rsearch/rsearch.c
index 7602b16..347c84d 100644
--- a/ldap/servers/slapd/tools/rsearch/rsearch.c
+++ b/ldap/servers/slapd/tools/rsearch/rsearch.c
@@ -467,7 +467,10 @@ main(int argc, char **argv)
printf("T%d min=%4ums, max=%4ums, count = %u\n",
st_getThread(threads[x], NULL), min, max, count);
}
- rate = (double)total / (double)numThreads;
+ rate = 0.0;
+ if (numThreads) {
+ rate = (double)total / (double)numThreads;
+ }
val = 1000.0 * (double)total / (double)sampleInterval;
cumrate += rate;
if ((numThreads > 1) || (!verbose)) {
diff --git a/lib/ldaputil/certmap.c b/lib/ldaputil/certmap.c
index efe531a..dc2fdde 100644
--- a/lib/ldaputil/certmap.c
+++ b/lib/ldaputil/certmap.c
@@ -374,6 +374,7 @@ dbinfo_to_certinfo(DBConfDBInfo_t *db_info,
rv = ldapu_list_add_info(propval_list, propval);
if (rv != LDAPU_SUCCESS) {
+ ldapu_propval_free((void *)propval, (void *)propval);
goto error;
}
@@ -700,15 +701,14 @@ certmap_read_certconfig_file(const char *file)
while (curdb) {
nextdb = curdb->next;
rv = dbinfo_to_certinfo(curdb, &certinfo);
-
if (rv != LDAPU_SUCCESS) {
dbconf_free_confinfo(conf_info);
return rv;
}
rv = process_certinfo(certinfo);
-
if (rv != LDAPU_SUCCESS) {
+ ldapu_certinfo_free(certinfo);
dbconf_free_confinfo(conf_info);
return rv;
}
@@ -1330,8 +1330,11 @@ ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage *
rv = (*mapfn)(cert, ld, certmap_info, &ldapDN, &filter);
- if (rv != LDAPU_SUCCESS)
+ if (rv != LDAPU_SUCCESS) {
+ free(ldapDN);
+ free(filter);
return rv;
+ }
/* Get the search function from the certmap_info - certinfo maybe NULL */
searchfn = ldapu_get_cert_searchfn_sub(certmap_info);
@@ -1339,10 +1342,8 @@ ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage *
rv = (*searchfn)(cert, ld, certmap_info, basedn, ldapDN, filter,
certmap_attrs, &res_array);
- if (ldapDN)
- free(ldapDN);
- if (filter)
- free(filter);
+ free(ldapDN);
+ free(filter);
/*
* Get the verify cert function & call it.
diff --git a/lib/libaccess/usrcache.cpp b/lib/libaccess/usrcache.cpp
index 5ea8259..b6ac58d 100644
--- a/lib/libaccess/usrcache.cpp
+++ b/lib/libaccess/usrcache.cpp
@@ -157,11 +157,11 @@ int acl_usr_cache_init ()
}
else {
singleDbTable = 0;
- databaseUserCacheTable = PR_NewHashTable(0,
+ databaseUserCacheTable = PR_NewHashTable(0,
PR_HashCaseString,
PR_CompareCaseStrings,
PR_CompareValues,
- &ACLPermAllocOps,
+ &ACLPermAllocOps,
usrcache_pool);
}
@@ -176,7 +176,7 @@ int acl_usr_cache_init ()
for(i = 0; i < num_usrobj; i++){
usrobj = (UserCacheObj *)pool_malloc(usrcache_pool,
sizeof(UserCacheObj));
-
+
if (!usrobj) return -1;
memset((void *)usrobj, 0, sizeof(UserCacheObj));
PR_INSERT_AFTER(&usrobj->list, usrobj_list);
diff --git a/src/cockpit/389-console/src/lib/database/chaining.jsx b/src/cockpit/389-console/src/lib/database/chaining.jsx
index 3dd3ec4..c169e7b 100644
--- a/src/cockpit/389-console/src/lib/database/chaining.jsx
+++ b/src/cockpit/389-console/src/lib/database/chaining.jsx
@@ -916,7 +916,7 @@ export class ChainingConfig extends React.Component {
</Checkbox>;
} else {
proxiedAuth =
- <Checkbox id="nsproxiedauthorization" onChange={this.handleChange} defaultChecked
+ <Checkbox id="nsproxiedauthorization" onChange={this.handleChange}
title="Allow proxied authentication to the remote server. (nsproxiedauthorization).">
Allow Proxied Authentication
</Checkbox>;
diff --git a/src/cockpit/389-console/src/lib/database/suffix.jsx b/src/cockpit/389-console/src/lib/database/suffix.jsx
index 9cfb95b..3f3bc82 100644
--- a/src/cockpit/389-console/src/lib/database/suffix.jsx
+++ b/src/cockpit/389-console/src/lib/database/suffix.jsx
@@ -254,10 +254,10 @@ export class Suffix extends React.Component {
// Do import
let export_cmd = [
"dsconf", "-j", "ldapi://%2fvar%2frun%2fslapd-" + this.props.serverId + ".socket",
- "backend", "export", this.props.suffix, "--ldif=" + this.state.ldifLocation, "--encrypted"
+ "backend", "export", this.props.suffix, "--ldif=" + this.state.ldifLocation
];
- if (this.state.attrEncrpytion) {
+ if (this.state.attrEncryption) {
export_cmd.push("--encrypted");
}
diff --git a/src/cockpit/389-console/src/replication.js b/src/cockpit/389-console/src/replication.js
index 6ef3635..2fe3a6e 100644
--- a/src/cockpit/389-console/src/replication.js
+++ b/src/cockpit/389-console/src/replication.js
@@ -1185,7 +1185,7 @@ $(document).ready( function() {
}
} else {
if ( !('nsds5replicatedattributelisttotal' in repl_agmt_values) ||
- agmt_tot_exclude != repl_agmt_values['nsds5replicatedattributelisttotal'].replace(frac_prefix, ""));
+ agmt_tot_exclude != repl_agmt_values['nsds5replicatedattributelisttotal'].replace(frac_prefix, ""))
{
cmd_args.push('--frac-list-total=' + frac_prefix + ' ' + agmt_tot_exclude);
}
diff --git a/src/lib389/lib389/agreement.py b/src/lib389/lib389/agreement.py
index cea9234..9edd514 100644
--- a/src/lib389/lib389/agreement.py
+++ b/src/lib389/lib389/agreement.py
@@ -266,6 +266,7 @@ class Agreement(DSLdapObject):
# Extract the csn timstamps and compare them
agmt_time = 0
+ con_time = 0
match = Agreement.csnre.match(agmt_maxcsn)
if match:
agmt_time = int(match.group(1), 16)
diff --git a/src/lib389/lib389/backend.py b/src/lib389/lib389/backend.py
index 64a40c1..353a3e1 100644
--- a/src/lib389/lib389/backend.py
+++ b/src/lib389/lib389/backend.py
@@ -480,6 +480,9 @@ class Backend(DSLdapObject):
:returns: DSLdapObject of the created entry
"""
+ sample_entries = False
+ parent_suffix = False
+
# normalize suffix (remove spaces between comps)
if dn is not None:
dn_comps = ldap.dn.explode_dn(dn.lower())
@@ -490,9 +493,8 @@ class Backend(DSLdapObject):
dn_comps = ldap.dn.explode_dn(suffix_dn)
ndn = ",".join(dn_comps)
properties['nsslapd-suffix'] = ndn
-
- sample_entries = properties.pop(BACKEND_SAMPLE_ENTRIES, False)
- parent_suffix = properties.pop('parent', False)
+ sample_entries = properties.pop(BACKEND_SAMPLE_ENTRIES, False)
+ parent_suffix = properties.pop('parent', False)
# Okay, now try to make the backend.
super(Backend, self).create(dn, properties, basedn)
diff --git a/src/lib389/lib389/cli_conf/backend.py b/src/lib389/lib389/cli_conf/backend.py
index 77ce3dd..36e32ec 100644
--- a/src/lib389/lib389/cli_conf/backend.py
+++ b/src/lib389/lib389/cli_conf/backend.py
@@ -422,7 +422,7 @@ def backend_set(inst, basedn, log, args):
if args.add_referral:
be.add('nsslapd-referral', args.add_referral)
if args.del_referral:
- be.remove('nsslapd-referral', args.add_referral)
+ be.remove('nsslapd-referral', args.del_referral)
if args.cache_size:
be.set('nsslapd-cachesize', args.cache_size)
if args.cache_memsize:
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch master updated: Ticket 50431 - Fix covscan warnings
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch master
in repository 389-ds-base.
The following commit(s) were added to refs/heads/master by this push:
new 4934b57 Ticket 50431 - Fix covscan warnings
4934b57 is described below
commit 4934b57afbe68cb7a2d792608ef37b34adc2308b
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Wed Jun 5 14:09:52 2019 -0400
Ticket 50431 - Fix covscan warnings
Description: Most coverity errors happen when something fails.
https://pagure.io/389-ds-base/issue/50431
Reviewed by: firstyear & spichugi(Thanks!)
---
autogen.sh | 8 ++-
ldap/servers/plugins/acl/acl.c | 15 ++----
ldap/servers/plugins/acl/acleffectiverights.c | 12 +++--
ldap/servers/plugins/acl/acllist.c | 4 +-
ldap/servers/plugins/linkedattrs/linked_attrs.c | 4 +-
ldap/servers/plugins/memberof/memberof_config.c | 12 +++--
ldap/servers/plugins/posix-winsync/posix-winsync.c | 2 +-
ldap/servers/plugins/replication/cl5_api.c | 1 +
ldap/servers/plugins/replication/repl5_replica.c | 2 +-
.../plugins/replication/repl5_replica_config.c | 8 +--
ldap/servers/plugins/replication/urp.c | 1 +
ldap/servers/plugins/roles/roles_cache.c | 2 +
ldap/servers/plugins/views/views.c | 16 ++++--
ldap/servers/slapd/agtmmap.c | 2 +-
ldap/servers/slapd/back-ldbm/dblayer.c | 55 ++++++++++++---------
ldap/servers/slapd/back-ldbm/index.c | 9 ++--
ldap/servers/slapd/back-ldbm/ldbm_add.c | 3 +-
.../slapd/back-ldbm/ldbm_attrcrypt_config.c | 4 +-
ldap/servers/slapd/back-ldbm/ldbm_delete.c | 3 +-
ldap/servers/slapd/back-ldbm/ldif2ldbm.c | 4 +-
ldap/servers/slapd/back-ldbm/vlv_srch.c | 3 +-
ldap/servers/slapd/connection.c | 1 +
ldap/servers/slapd/dse.c | 7 +--
ldap/servers/slapd/entrywsi.c | 57 +++++++++++-----------
ldap/servers/slapd/main.c | 9 +---
ldap/servers/slapd/mapping_tree.c | 46 +++++++++--------
ldap/servers/slapd/modify.c | 6 ++-
ldap/servers/slapd/opshared.c | 3 +-
ldap/servers/slapd/plugin_internal_op.c | 3 +-
ldap/servers/slapd/plugin_syntax.c | 4 +-
ldap/servers/slapd/rdn.c | 5 +-
ldap/servers/slapd/sasl_map.c | 4 +-
ldap/servers/slapd/schema.c | 6 +--
ldap/servers/slapd/search.c | 7 +--
ldap/servers/slapd/tools/dbscan.c | 9 ++--
ldap/servers/slapd/tools/ldclt/ldapfct.c | 8 +--
ldap/servers/slapd/tools/ldclt/ldclt.c | 2 +-
ldap/servers/slapd/tools/ldif.c | 10 ++--
ldap/servers/slapd/tools/mmldif.c | 5 +-
ldap/servers/slapd/tools/pwenc.c | 1 +
ldap/servers/slapd/tools/rsearch/infadd.c | 2 +-
ldap/servers/slapd/tools/rsearch/rsearch.c | 5 +-
lib/ldaputil/certmap.c | 15 +++---
lib/libaccess/usrcache.cpp | 6 +--
.../389-console/src/lib/database/chaining.jsx | 2 +-
.../389-console/src/lib/database/suffix.jsx | 4 +-
src/cockpit/389-console/src/replication.js | 2 +-
src/lib389/lib389/agreement.py | 1 +
src/lib389/lib389/backend.py | 8 +--
src/lib389/lib389/cli_conf/backend.py | 2 +-
50 files changed, 229 insertions(+), 181 deletions(-)
diff --git a/autogen.sh b/autogen.sh
index 8bb628b..06a5fac 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -35,12 +35,16 @@ checkvers() {
vers="$1"; shift
needmaj="$1"; shift
needmin="$1"; shift
- needrev="$1"; shift
+ if [ "$#" != "0" ]; then
+ needrev="$1"; shift
+ fi
verslist=`echo $vers | tr '.' ' '`
set $verslist
maj=$1; shift
min=$1; shift
- rev=$1; shift
+ if [ "$#" != "0" ]; then
+ rev=$1; shift
+ fi
if [ "$maj" -gt "$needmaj" ] ; then return 0; fi
if [ "$maj" -lt "$needmaj" ] ; then return 1; fi
# if we got here, maj == needmaj
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 6d105f4..5680de6 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -644,7 +644,8 @@ cleanup_and_ret:
if (aclpb)
aclpb->aclpb_curr_attrEval = NULL;
- print_access_control_summary("main", ret_val, clientDn, aclpb, right,
+ print_access_control_summary("main", ret_val, clientDn, aclpb,
+ (right ? right : "NULL"),
(attr ? attr : "NULL"), n_edn,
&decision_reason);
TNF_PROBE_0_DEBUG(acl_cleanup_end, "ACL", "");
@@ -2590,12 +2591,9 @@ acl__resource_match_aci(Acl_PBlock *aclpb, aci_t *aci, int skip_attrEval, int *a
* that applies to the current attribute.
* Then the (attribute,value) pair being added/deleted better
* match that filter.
- *
- *
*/
-
Targetattrfilter **attrFilterArray = NULL;
- Targetattrfilter *attrFilter;
+ Targetattrfilter *attrFilter = NULL;
int found = 0;
if ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_ADD) &&
@@ -2606,15 +2604,13 @@ acl__resource_match_aci(Acl_PBlock *aclpb, aci_t *aci, int skip_attrEval, int *a
attrFilterArray = aci->targetAttrDelFilters;
}
-
/*
* Scan this filter list for an applicable filter.
*/
-
found = 0;
num_attrs = 0;
- while (attrFilterArray[num_attrs] && !found) {
+ while (attrFilterArray && attrFilterArray[num_attrs] && !found) {
attrFilter = attrFilterArray[num_attrs];
/* If this filter applies to the attribute, stop. */
@@ -2630,8 +2626,7 @@ acl__resource_match_aci(Acl_PBlock *aclpb, aci_t *aci, int skip_attrEval, int *a
* Here, if found an applicable filter, then apply the filter to the
* (attr,val) pair.
* Otherwise, ignore the targetattrfilters.
- */
-
+ */
if (found) {
if (acl__make_filter_test_entry(&aclpb->aclpb_filter_test_entry,
diff --git a/ldap/servers/plugins/acl/acleffectiverights.c b/ldap/servers/plugins/acl/acleffectiverights.c
index 8a0cb91..5dd46a0 100644
--- a/ldap/servers/plugins/acl/acleffectiverights.c
+++ b/ldap/servers/plugins/acl/acleffectiverights.c
@@ -869,14 +869,14 @@ _ger_generate_template_entry(
if (dntype) {
siz += strlen(dntype) + 30 + strlen(object) + strlen(dn);
} else {
- siz += strlen(attrs[0]) + 30 + strlen(object) + strlen(dn);
+ siz += strlen(attrs[0] ? attrs[0] : "") + 30 + strlen(object) + strlen(dn);
}
} else {
/* dn: <attr>=<template_name>\n\0 */
if (dntype) {
siz += strlen(dntype) + 30 + strlen(object);
} else {
- siz += strlen(attrs[0]) + 30 + strlen(object);
+ siz += strlen(attrs[0] ? attrs[0] : "") + 30 + strlen(object);
}
}
templateentry = (char *)slapi_ch_malloc(siz);
@@ -1030,7 +1030,9 @@ bailout:
* slapi_pblock_set() will free any previous data, and
* pblock_done() will free SLAPI_PB_RESULT_TEXT.
*/
- slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, gerstr);
+ if (gerstr) {
+ slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, gerstr);
+ }
if (!iscritical) {
/*
@@ -1040,7 +1042,7 @@ bailout:
rc = LDAP_SUCCESS;
}
- slapi_ch_free((void **)&subjectndn);
- slapi_ch_free((void **)&gerstr);
+ slapi_ch_free_string(&subjectndn);
+ slapi_ch_free_string(&gerstr);
return rc;
}
diff --git a/ldap/servers/plugins/acl/acllist.c b/ldap/servers/plugins/acl/acllist.c
index 79786b7..e80c567 100644
--- a/ldap/servers/plugins/acl/acllist.c
+++ b/ldap/servers/plugins/acl/acllist.c
@@ -255,7 +255,9 @@ __acllist_add_aci(aci_t *aci)
t_aci = t_aci->aci_next;
/* Now add the new one to the end of the list */
- t_aci->aci_next = aci;
+ if (t_aci) {
+ t_aci->aci_next = aci;
+ }
slapi_log_err(SLAPI_LOG_ACL, plugin_name, "__acllist_add_aci - Added the ACL:%s to existing container:[%d]%s\n",
aci->aclName, head->acic_index, slapi_sdn_get_ndn(head->acic_sdn));
diff --git a/ldap/servers/plugins/linkedattrs/linked_attrs.c b/ldap/servers/plugins/linkedattrs/linked_attrs.c
index f6eee19..4f9fb10 100644
--- a/ldap/servers/plugins/linkedattrs/linked_attrs.c
+++ b/ldap/servers/plugins/linkedattrs/linked_attrs.c
@@ -1256,7 +1256,9 @@ linked_attrs_del_backpointers(Slapi_PBlock *pb, char *linkdn, struct configEntry
slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &pre_e);
slapi_entry_attr_find(pre_e, config->linktype, &pre_attr);
- slapi_attr_get_valueset(pre_attr, &vals);
+ if (pre_attr) {
+ slapi_attr_get_valueset(pre_attr, &vals);
+ }
} else {
vals = slapi_valueset_new();
slapi_valueset_set_from_smod(vals, smod);
diff --git a/ldap/servers/plugins/memberof/memberof_config.c b/ldap/servers/plugins/memberof/memberof_config.c
index 89fd012..124217e 100644
--- a/ldap/servers/plugins/memberof/memberof_config.c
+++ b/ldap/servers/plugins/memberof/memberof_config.c
@@ -550,13 +550,17 @@ memberof_apply_config(Slapi_PBlock *pb __attribute__((unused)),
}
/* Build the new list */
- for (i = 0; theConfig.group_slapiattrs && theConfig.groupattrs && theConfig.groupattrs[i]; i++) {
+ for (i = 0; theConfig.group_slapiattrs && theConfig.group_slapiattrs[i] &&
+ theConfig.groupattrs && theConfig.groupattrs[i]; i++)
+ {
theConfig.group_slapiattrs[i] = slapi_attr_new();
slapi_attr_init(theConfig.group_slapiattrs[i], theConfig.groupattrs[i]);
}
/* Terminate the list. */
- theConfig.group_slapiattrs[i] = NULL;
+ if (theConfig.group_slapiattrs) {
+ theConfig.group_slapiattrs[i] = NULL;
+ }
/* The filter is based off of the groupattr, so we update it here too. */
slapi_filter_free(theConfig.group_filter, 1);
@@ -736,7 +740,9 @@ memberof_copy_config(MemberOfConfig *dest, MemberOfConfig *src)
}
/* Terminate the array. */
- dest->group_slapiattrs[i] = NULL;
+ if (dest->group_slapiattrs) {
+ dest->group_slapiattrs[i] = NULL;
+ }
}
if (src->memberof_attr) {
diff --git a/ldap/servers/plugins/posix-winsync/posix-winsync.c b/ldap/servers/plugins/posix-winsync/posix-winsync.c
index 8e5ca4f..c56e55f 100644
--- a/ldap/servers/plugins/posix-winsync/posix-winsync.c
+++ b/ldap/servers/plugins/posix-winsync/posix-winsync.c
@@ -1114,7 +1114,7 @@ posix_winsync_pre_ds_mod_group_cb(void *cbdata __attribute__((unused)),
slapi_value_init_string(voc, "posixGroup");
slapi_entry_attr_find(ds_entry, "objectClass", &oc_attr);
- if (slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {
+ if (oc_attr && slapi_attr_value_find(oc_attr, slapi_value_get_berval(voc)) != 0) {
Slapi_ValueSet *oc_vs = NULL;
Slapi_Value *oc_nv = slapi_value_new();
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index c035db2..6b5b28b 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -2749,6 +2749,7 @@ _cl5UpgradeMajor(char *fromVersion, char *toVersion)
if (rc != CL5_SUCCESS) {
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name_cl,
"_cl5UpgradeMajor - Failed to open the db env\n");
+ s_cl5Desc.dbOpenMode = backup;
return rc;
}
s_cl5Desc.dbOpenMode = backup;
diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c
index b3d6198..6a5363e 100644
--- a/ldap/servers/plugins/replication/repl5_replica.c
+++ b/ldap/servers/plugins/replication/repl5_replica.c
@@ -2317,7 +2317,7 @@ replica_check_for_tasks(time_t when __attribute__((unused)), void *arg)
"missing original task flag. Aborting abort task!\n",
clean_vals[i]);
replica_delete_task_config(e, (char *)type_replicaAbortCleanRUV, orig_val);
- goto done;
+ goto done2;
}
if (!is_cleaned_rid(rid)) {
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 02b645f..7649aa1 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -223,6 +223,7 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
}
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, "replica_config_add - "MSG_NOREPLICANORMRDN);
slapi_rdn_free(&replicardn);
+ slapi_ch_free_string(&replica_root);
*returncode = LDAP_UNWILLING_TO_PERFORM;
return SLAPI_DSE_CALLBACK_ERROR;
} else {
@@ -232,6 +233,7 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
}
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name,"replica_config_add - "MSG_CNREPLICA, nrdn, REPLICA_RDN);
slapi_rdn_free(&replicardn);
+ slapi_ch_free_string(&replica_root);
*returncode = LDAP_UNWILLING_TO_PERFORM;
return SLAPI_DSE_CALLBACK_ERROR;
}
@@ -242,6 +244,7 @@ replica_config_add(Slapi_PBlock *pb __attribute__((unused)),
strcpy(errortext, MSG_NOREPLICARDN);
}
slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name, "replica_config_add - "MSG_NOREPLICARDN);
+ slapi_ch_free_string(&replica_root);
*returncode = LDAP_UNWILLING_TO_PERFORM;
return SLAPI_DSE_CALLBACK_ERROR;
}
@@ -287,7 +290,7 @@ done:
PR_Unlock(s_configLock);
/* slapi_ch_free accepts NULL pointer */
- slapi_ch_free((void **)&replica_root);
+ slapi_ch_free_string(&replica_root);
if (*returncode != LDAP_SUCCESS) {
if (mtnode_ext->replica)
@@ -2083,7 +2086,6 @@ check_replicas_are_done_cleaning(cleanruv_data *data)
while (not_all_cleaned && !is_task_aborted(data->rid) && !slapi_is_shutting_down()) {
agmt_obj = agmtlist_get_first_agreement_for_replica(data->replica);
if (agmt_obj == NULL) {
- not_all_cleaned = 0;
break;
}
while (agmt_obj && !slapi_is_shutting_down()) {
@@ -2196,7 +2198,6 @@ check_replicas_are_done_aborting(cleanruv_data *data)
while (not_all_aborted && !slapi_is_shutting_down()) {
agmt_obj = agmtlist_get_first_agreement_for_replica(data->replica);
if (agmt_obj == NULL) {
- not_all_aborted = 0;
break;
}
while (agmt_obj && !slapi_is_shutting_down()) {
@@ -2803,6 +2804,7 @@ delete_cleaned_rid_config(cleanruv_data *clean_data)
cleanruv_log(clean_data->task, clean_data->rid, CLEANALLRUV_ID, SLAPI_LOG_ERR,
"delete_cleaned_rid_config - Failed to remove task data from (%s) error (%d), rid (%d)",
edn, rc, clean_data->rid);
+ slapi_ch_array_free(attr_val);
goto bail;
}
}
diff --git a/ldap/servers/plugins/replication/urp.c b/ldap/servers/plugins/replication/urp.c
index 37fe773..b134409 100644
--- a/ldap/servers/plugins/replication/urp.c
+++ b/ldap/servers/plugins/replication/urp.c
@@ -1602,6 +1602,7 @@ urp_find_tombstone_for_glue (Slapi_PBlock *pb, char *sessionid, const Slapi_Entr
for (int i = 0; entries && (entries[i] != NULL); i++) {
char *tombstone_csn_value = slapi_entry_attr_get_charptr(entries[i], "nstombstonecsn");
if (tombstone_csn_value) {
+ csn_free(&tombstone_csn);
tombstone_csn = csn_new_by_string(tombstone_csn_value);
slapi_ch_free_string(&tombstone_csn_value);
if( csn_compare(tombstone_csn, conflict_csn) > 0 ) {
diff --git a/ldap/servers/plugins/roles/roles_cache.c b/ldap/servers/plugins/roles/roles_cache.c
index 1e5865a..4e3b0af 100644
--- a/ldap/servers/plugins/roles/roles_cache.c
+++ b/ldap/servers/plugins/roles/roles_cache.c
@@ -1276,6 +1276,8 @@ roles_cache_create_object_from_entry(Slapi_Entry *role_entry, role_object **resu
if (rc == 0) {
*result = this_role;
+ } else {
+ slapi_ch_free((void **)&this_role);
}
slapi_log_err(SLAPI_LOG_PLUGIN, ROLES_PLUGIN_SUBSYSTEM,
diff --git a/ldap/servers/plugins/views/views.c b/ldap/servers/plugins/views/views.c
index 6f784f5..5d84647 100644
--- a/ldap/servers/plugins/views/views.c
+++ b/ldap/servers/plugins/views/views.c
@@ -783,10 +783,12 @@ views_cache_create_applied_filter(viewEntry *pView)
"views_cache_create_applied_filter - View filter [%s] in entry [%s] is not valid\n",
buf, current->pDn);
}
- if (pBuiltFilter && pCurrentFilter)
+ if (pBuiltFilter && pCurrentFilter) {
pBuiltFilter = slapi_filter_join_ex(LDAP_FILTER_AND, pBuiltFilter, pCurrentFilter, 0);
- else
+ } else {
+ slapi_filter_free(pBuiltFilter, 1);
pBuiltFilter = pCurrentFilter;
+ }
slapi_ch_free((void **)&buf);
@@ -952,10 +954,12 @@ views_cache_create_descendent_filter(viewEntry *ancestor, PRBool useEntryID)
"views_cache_create_descendent_filter - View filter [%s] in entry [%s] is invalid\n",
buf, currentChild->pDn);
}
- if (pOrSubFilter && pCurrentFilter)
+ if (pOrSubFilter && pCurrentFilter) {
pOrSubFilter = slapi_filter_join_ex(LDAP_FILTER_OR, pOrSubFilter, pCurrentFilter, 0);
- else
+ } else {
+ slapi_filter_free(pOrSubFilter, 1);
pOrSubFilter = pCurrentFilter;
+ }
PR_smprintf_free(buf);
}
@@ -1756,7 +1760,9 @@ view_search_rewrite_callback(Slapi_PBlock *pb)
#endif
/* make it happen */
- slapi_pblock_set(pb, SLAPI_SEARCH_FILTER, outFilter);
+ if (outFilter) {
+ slapi_pblock_set(pb, SLAPI_SEARCH_FILTER, outFilter);
+ }
ret = -2;
diff --git a/ldap/servers/slapd/agtmmap.c b/ldap/servers/slapd/agtmmap.c
index 352ccef..bc5fe1e 100644
--- a/ldap/servers/slapd/agtmmap.c
+++ b/ldap/servers/slapd/agtmmap.c
@@ -243,7 +243,7 @@ agt_mread_stats(int hdl, struct hdr_stats_t *pHdrInfo, struct ops_stats_t *pDsOp
return (EINVAL); /* Inavlid handle */
}
- if (mmap_tbl[hdl].fp <= (caddr_t)0) {
+ if (mmap_tbl[hdl].fp <= 0) {
return (EFAULT); /* Something got corrupted */
}
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index f813447..1fee805 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -3009,7 +3009,7 @@ dblayer_erase_index_file_ex(backend *be, struct attrinfo *a, PRBool use_lock, in
ldbm_instance *inst = NULL;
dblayer_handle *handle = NULL;
char dbName[MAXPATHLEN] = {0};
- char *dbNamep;
+ char *dbNamep = NULL;
char *p;
int dbbasenamelen, dbnamelen;
int rc = 0;
@@ -3102,11 +3102,12 @@ dblayer_erase_index_file_ex(backend *be, struct attrinfo *a, PRBool use_lock, in
sprintf(p, "%c%s%s", get_sep(dbNamep), a->ai_type, LDBM_FILENAME_SUFFIX);
rc = dblayer_db_remove_ex(pEnv, dbNamep, 0, 0);
a->ai_dblayer = NULL;
- if (dbNamep != dbName)
- slapi_ch_free_string(&dbNamep);
} else {
rc = -1;
}
+ if (dbNamep != dbName) {
+ slapi_ch_free_string(&dbNamep);
+ }
slapi_ch_free((void **)&handle);
} else {
/* no handle to close */
@@ -5661,7 +5662,9 @@ dblayer_copy_directory(struct ldbminfo *li,
inst_dir, MAXPATHLEN);
if (!inst_dirp || !*inst_dirp) {
slapi_log_err(SLAPI_LOG_ERR, "dblayer_copy_directory", "Instance dir is NULL.\n");
- slapi_ch_free_string(&inst_dirp);
+ if (inst_dirp != inst_dir) {
+ slapi_ch_free_string(&inst_dirp);
+ }
return return_value;
}
len = strlen(inst_dirp);
@@ -5975,7 +5978,9 @@ dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
slapi_task_log_notice(task,
"Backup: Instance dir is empty\n");
}
- slapi_ch_free_string(&inst_dirp);
+ if (inst_dirp != inst_dir) {
+ slapi_ch_free_string(&inst_dirp);
+ }
return_value = -1;
goto bail;
}
@@ -5993,8 +5998,9 @@ dblayer_backup(struct ldbminfo *li, char *dest_dir, Slapi_Task *task)
"(%s -> %s): err=%d\n",
inst_dirp, dest_dir, return_value);
}
- if (inst_dirp != inst_dir)
+ if (inst_dirp != inst_dir) {
slapi_ch_free_string(&inst_dirp);
+ }
goto bail;
}
if (inst_dirp != inst_dir)
@@ -6292,7 +6298,6 @@ dblayer_copy_dirand_contents(char *src_dir, char *dst_dir, int mode, Slapi_Task
break;
}
-
PR_snprintf(filename1, MAXPATHLEN, "%s/%s", src_dir, direntry->name);
PR_snprintf(filename2, MAXPATHLEN, "%s/%s", dst_dir, direntry->name);
slapi_log_err(SLAPI_LOG_ERR, "dblayer_copy_dirand_contents", "Moving file %s\n",
@@ -6305,8 +6310,7 @@ dblayer_copy_dirand_contents(char *src_dir, char *dst_dir, int mode, Slapi_Task
mode, task);
if (return_value) {
if (task) {
- slapi_task_log_notice(task,
- "Failed to copy directory %s", filename1);
+ slapi_task_log_notice(task, "Failed to copy directory %s", filename1);
}
break;
}
@@ -6523,13 +6527,13 @@ dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *bena
return LDAP_UNWILLING_TO_PERFORM;
}
if (!dbversion_exists(li, src_dir)) {
- slapi_log_err(SLAPI_LOG_ERR, "dblayer_restore", "Backup directory %s does not "
- "contain a complete backup\n",
+ slapi_log_err(SLAPI_LOG_ERR, "dblayer_restore",
+ "Backup directory %s does not contain a complete backup\n",
src_dir);
if (task) {
- slapi_task_log_notice(task, "Restore: backup directory %s does not "
- "contain a complete backup",
- src_dir);
+ slapi_task_log_notice(task,
+ "Restore: backup directory %s does not contain a complete backup",
+ src_dir);
}
return LDAP_UNWILLING_TO_PERFORM;
}
@@ -6585,13 +6589,10 @@ dblayer_restore(struct ldbminfo *li, char *src_dir, Slapi_Task *task, char *bena
}
if (slapd_comp_path(src_dir, inst->inst_parent_dir_name) == 0) {
slapi_log_err(SLAPI_LOG_ERR,
- "dblayer_restore", "Backup dir %s and target dir %s "
- "are identical\n",
+ "dblayer_restore", "Backup dir %s and target dir %s are identical\n",
src_dir, inst->inst_parent_dir_name);
if (task) {
slapi_task_log_notice(task,
- "Restore: backup dir %s and target dir %s "
- "are identical\n",
src_dir, inst->inst_parent_dir_name);
}
PR_CloseDir(dirhandle);
@@ -7060,8 +7061,12 @@ dblayer_get_instance_data_dir(backend *be)
full_namep = dblayer_get_full_inst_dir(inst->inst_li, inst,
full_name, MAXPATHLEN);
if (!full_namep || !*full_namep) {
+ if (full_namep != full_name) {
+ slapi_ch_free_string(&full_namep);
+ }
return ret;
}
+
/* Does this directory already exist? */
if ((db_dir = PR_OpenDir(full_namep)) != NULL) {
/* yep. */
@@ -7072,8 +7077,9 @@ dblayer_get_instance_data_dir(backend *be)
ret = mkdir_p(full_namep, 0700);
}
- if (full_name != full_namep)
+ if (full_name != full_namep) {
slapi_ch_free_string(&full_namep);
+ }
return ret;
}
@@ -7097,7 +7103,6 @@ dblayer_in_import(ldbm_instance *inst)
inst_dirp = dblayer_get_full_inst_dir(inst->inst_li, inst,
inst_dir, MAXPATHLEN);
if (!inst_dirp || !*inst_dirp) {
- slapi_ch_free_string(&inst_dirp);
rval = -1;
goto done;
}
@@ -7117,8 +7122,9 @@ dblayer_in_import(ldbm_instance *inst)
}
PR_CloseDir(dirhandle);
done:
- if (inst_dirp != inst_dir)
+ if (inst_dirp != inst_dir) {
slapi_ch_free_string(&inst_dirp);
+ }
return rval;
}
@@ -7149,7 +7155,9 @@ dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
if (NULL == inst_dirp || '\0' == *inst_dirp) {
slapi_log_err(SLAPI_LOG_ERR,
"dblayer_update_db_ext", "Instance dir is NULL\n");
- slapi_ch_free_string(&inst_dirp);
+ if (inst_dirp != inst_dir) {
+ slapi_ch_free_string(&inst_dirp);
+ }
return -1; /* non zero */
}
for (a = (struct attrinfo *)avl_getfirst(inst->inst_attrs);
@@ -7210,8 +7218,9 @@ dblayer_update_db_ext(ldbm_instance *inst, char *oldext, char *newext)
done:
slapi_ch_free_string(&ofile);
slapi_ch_free_string(&nfile);
- if (inst_dirp != inst_dir)
+ if (inst_dirp != inst_dir) {
slapi_ch_free_string(&inst_dirp);
+ }
return rval;
}
diff --git a/ldap/servers/slapd/back-ldbm/index.c b/ldap/servers/slapd/back-ldbm/index.c
index f0b969f..2a7529b 100644
--- a/ldap/servers/slapd/back-ldbm/index.c
+++ b/ldap/servers/slapd/back-ldbm/index.c
@@ -1776,13 +1776,14 @@ index_range_read_ext(
}
#endif
error:
+ slapi_log_err(SLAPI_LOG_TRACE, "index_range_read_ext", "(%s,%s) %lu candidates\n",
+ type, prefix ? prefix : "", (u_long)IDL_NIDS(idl));
+
index_free_prefix(prefix);
DBT_FREE_PAYLOAD(cur_key);
DBT_FREE_PAYLOAD(upperkey);
-
dblayer_release_index_file(be, ai, db);
- slapi_log_err(SLAPI_LOG_TRACE, "index_range_read_ext", "(%s,%s) %lu candidates\n",
- type, prefix, (u_long)IDL_NIDS(idl));
+
return (idl);
}
@@ -2406,7 +2407,7 @@ index_free_prefix(char *prefix)
prefix == prefix_SUB) {
/* do nothing */
} else {
- slapi_ch_free((void **)&prefix);
+ slapi_ch_free_string(&prefix);
}
}
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c
index 0d82ae9..a258557 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_add.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c
@@ -162,7 +162,8 @@ ldbm_back_add(Slapi_PBlock *pb)
txn.back_txn_txn = parent_txn;
} else {
parent_txn = txn.back_txn_txn;
- slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
+ if (parent_txn)
+ slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
}
/* The dblock serializes writes to the database,
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
index 9ecb099..fd2c7db 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c
@@ -142,7 +142,7 @@ ldbm_instance_attrcrypt_config_add_callback(Slapi_PBlock *pb __attribute__((unus
/* If the cipher was invalid, return unwilling to perform */
if (0 == cipher) {
- returntext = "invalid cipher";
+ PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "invalid cipher");
*returncode = LDAP_UNWILLING_TO_PERFORM;
ret = SLAPI_DSE_CALLBACK_ERROR;
} else {
@@ -167,7 +167,7 @@ ldbm_instance_attrcrypt_config_add_callback(Slapi_PBlock *pb __attribute__((unus
slapi_log_err(SLAPI_LOG_ERR, "ldbm_instance_attrcrypt_config_add_callback - "
"Attempt to encryption on a non-existent attribute: %s\n",
attribute_name, 0, 0);
- returntext = "attribute does not exist";
+ PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "attribute does not exist");
*returncode = LDAP_UNWILLING_TO_PERFORM;
ret = SLAPI_DSE_CALLBACK_ERROR;
}
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_delete.c b/ldap/servers/slapd/back-ldbm/ldbm_delete.c
index e9f3e32..76e37ae 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_delete.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_delete.c
@@ -113,7 +113,8 @@ ldbm_back_delete(Slapi_PBlock *pb)
txn.back_txn_txn = parent_txn;
} else {
parent_txn = txn.back_txn_txn;
- slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
+ if (parent_txn)
+ slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
}
if (pb_conn) {
diff --git a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
index 60437f1..fb0fc5d 100644
--- a/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
+++ b/ldap/servers/slapd/back-ldbm/ldif2ldbm.c
@@ -1154,7 +1154,7 @@ ldbm_back_ldbm2ldif(Slapi_PBlock *pb)
int task_flags;
Slapi_Task *task;
int run_from_cmdline = 0;
- char *instance_name;
+ char *instance_name = NULL;
ldbm_instance *inst = NULL;
int str2entry_options = 0;
int retry;
@@ -1203,11 +1203,11 @@ ldbm_back_ldbm2ldif(Slapi_PBlock *pb)
goto bye;
}
+ slapi_pblock_get(pb, SLAPI_BACKEND_INSTANCE_NAME, &instance_name);
if (run_from_cmdline) {
/* Now that we have processed the config information, we look for
* the be that should do the db2ldif. */
- slapi_pblock_get(pb, SLAPI_BACKEND_INSTANCE_NAME, &instance_name);
inst = ldbm_instance_find_by_name(li, instance_name);
if (NULL == inst) {
slapi_task_log_notice(task, "Unknown backend instance: %s", instance_name);
diff --git a/ldap/servers/slapd/back-ldbm/vlv_srch.c b/ldap/servers/slapd/back-ldbm/vlv_srch.c
index 3684174..1ac3e00 100644
--- a/ldap/servers/slapd/back-ldbm/vlv_srch.c
+++ b/ldap/servers/slapd/back-ldbm/vlv_srch.c
@@ -168,7 +168,8 @@ vlvSearch_init(struct vlvSearch *p, Slapi_PBlock *pb, const Slapi_Entry *e, ldbm
/* switch context back to the DSE backend */
slapi_pblock_set(pb, SLAPI_BACKEND, oldbe);
- slapi_pblock_set(pb, SLAPI_PLUGIN, oldbe ? oldbe->be_database: NULL);
+ if (oldbe)
+ slapi_pblock_set(pb, SLAPI_PLUGIN, oldbe->be_database);
}
/* make (&(parentid=idofbase)(|(originalfilter)(objectclass=referral))) */
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index 1dc5343..d502dff 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -1860,6 +1860,7 @@ connection_threadmain()
signal_listner();
}
} else if (1 == is_timedout) {
+ /* covscan reports this code is unreachable (2019/6/4) */
connection_make_readable_nolock(conn);
signal_listner();
}
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index 1f1f516..1256843 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -2530,7 +2530,8 @@ dse_delete(Slapi_PBlock *pb) /* JCM There should only be one exit point from thi
dse_call_callback(pdse, pb, SLAPI_OPERATION_DELETE, DSE_FLAG_POSTOP, ec, NULL, &returncode, returntext);
done:
slapi_pblock_get(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, &orig_entry);
- slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, ec);
+ if (ec)
+ slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, ec);
/* make sure OPRETURN and RESULT_CODE are set */
slapi_pblock_get(pb, SLAPI_PLUGIN_OPRETURN, &rc);
if (returncode || rc) {
@@ -2571,8 +2572,8 @@ done:
rc = LDAP_UNWILLING_TO_PERFORM;
}
}
-
- slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, orig_entry);
+ if (orig_entry)
+ slapi_pblock_set(pb, SLAPI_DELETE_BEPOSTOP_ENTRY, orig_entry);
slapi_send_ldap_result(pb, returncode, NULL, returntext, 0, NULL);
return dse_delete_return(returncode, ec);
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 080eb15..5d1d723 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -359,7 +359,6 @@ entry_add_present_attribute_wsi(Slapi_Entry *e, Slapi_Attr *a)
* Preserves LDAP Information Model constraints,
* returning an LDAP result code.
*/
-static void entry_dump_stateinfo(char *msg, Slapi_Entry* e);
static Slapi_Value *attr_most_recent_deleted_value(Slapi_Attr *a);
static void resolve_single_valued_two_values(Slapi_Entry *e, Slapi_Attr *a, int attribute_state, Slapi_Value *current_value, Slapi_Value *second_current_value);
static void resolve_single_valued_check_restore_deleted_value(Slapi_Entry *e, Slapi_Attr *a);
@@ -397,6 +396,7 @@ entry_add_present_values_wsi(Slapi_Entry *e, const char *type, struct berval **b
/* Used for debug purpose, it dumps into the error log the
* entry with the replication stateinfo
*/
+#if 0
static void
entry_dump_stateinfo(char *msg, Slapi_Entry* e)
{
@@ -407,6 +407,7 @@ entry_dump_stateinfo(char *msg, Slapi_Entry* e)
slapi_log_err(SLAPI_LOG_ERR, msg, "%s\n", s);
slapi_ch_free((void **)&s);
}
+#endif
static int
entry_add_present_values_wsi_single_valued(Slapi_Entry *e, const char *type, struct berval **bervals, const CSN *csn, int urp, long flags)
@@ -1270,7 +1271,7 @@ attr_most_recent_deleted_value(Slapi_Attr *a)
most_recent_v = v;
while (i != -1) {
- vdcsn = value_get_csn(v, CSN_TYPE_VALUE_DELETED);
+ vdcsn = (CSN *)value_get_csn(v, CSN_TYPE_VALUE_DELETED);
if (csn_compare((const CSN *)most_recent_vdcsn, (const CSN *)vdcsn) < 0) {
most_recent_v = v;
@@ -1289,20 +1290,20 @@ static void
resolve_single_valued_two_values(Slapi_Entry *e, Slapi_Attr *a, int attribute_state, Slapi_Value *current_value, Slapi_Value *second_current_value)
{
- CSN *current_value_vucsn;
- CSN *second_current_value_vucsn;
+ const CSN *current_value_vucsn;
+ const CSN *second_current_value_vucsn;
Slapi_Value *value_to_zap;
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
second_current_value_vucsn = value_get_csn(second_current_value, CSN_TYPE_VALUE_UPDATED);
/* First determine which present value will be zapped */
- if (csn_compare((const CSN *)second_current_value_vucsn, (const CSN *)current_value_vucsn) < 0) {
+ if (csn_compare(second_current_value_vucsn, current_value_vucsn) < 0) {
/*
* The second value is older but was distinguished at the time the current value was added
* then the second value should become current
*/
- if (value_distinguished_at_csn(e, a, second_current_value, (const CSN *)current_value_vucsn)) {
+ if (value_distinguished_at_csn(e, a, second_current_value, current_value_vucsn)) {
value_to_zap = current_value;
} else {
/* The second value being not distinguished, zap it as it is a single valued attribute */
@@ -1311,7 +1312,7 @@ resolve_single_valued_two_values(Slapi_Entry *e, Slapi_Attr *a, int attribute_st
} else {
/* Here the current_value is older than the second_current_value */
- if (value_distinguished_at_csn(e, a, current_value, (const CSN *)second_current_value_vucsn)) {
+ if (value_distinguished_at_csn(e, a, current_value, second_current_value_vucsn)) {
/* current_value was distinguished at the time the second value was added
* then the current_value should become the current */
value_to_zap = second_current_value;
@@ -1348,17 +1349,17 @@ resolve_single_valued_check_restore_deleted_value(Slapi_Entry *e, Slapi_Attr *a)
/* An attribute needs a present value */
entry_deleted_value_to_present_value(a, deleted_value);
} else {
- CSN *current_value_vucsn;
- CSN *deleted_value_vucsn;
- CSN *deleted_value_vdcsn;
+ const CSN *current_value_vucsn;
+ const CSN *deleted_value_vucsn;
+ const CSN *deleted_value_vdcsn;
deleted_value_vucsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_UPDATED);
deleted_value_vdcsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_DELETED);
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
if (deleted_value_vucsn &&
- !value_distinguished_at_csn(e, a, current_value, (const CSN *)deleted_value_vucsn) &&
- (csn_compare((const CSN *)current_value_vucsn, (const CSN *)deleted_value_vucsn) < 0) &&
- (csn_compare((const CSN *)deleted_value_vdcsn, (const CSN *)current_value_vucsn) < 0)) {
+ !value_distinguished_at_csn(e, a, current_value, deleted_value_vucsn) &&
+ (csn_compare((const CSN *)current_value_vucsn, deleted_value_vucsn) < 0) &&
+ (csn_compare((const CSN *)deleted_value_vdcsn, current_value_vucsn) < 0)) {
/* the condition to resurrect the deleted value is
* - it is more recent than the current value
* - its value was deleted before the current value
@@ -1376,8 +1377,8 @@ static void
resolve_single_valued_zap_current(Slapi_Entry *e, Slapi_Attr *a)
{
Slapi_Value *current_value = NULL;
- CSN *current_value_vucsn;
- CSN *adcsn;
+ const CSN *current_value_vucsn;
+ const CSN *adcsn;
/* check if the current value should be deleted because
* older than adcsn and not distinguished
@@ -1386,7 +1387,7 @@ resolve_single_valued_zap_current(Slapi_Entry *e, Slapi_Attr *a)
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
adcsn = attr_get_deletion_csn(a);
if (current_value != NULL) {
- if (csn_compare((const CSN *)adcsn, (const CSN *) current_value_vucsn) > 0) {
+ if (csn_compare(adcsn, (const CSN *) current_value_vucsn) > 0) {
/* the attribute was deleted after the value was last updated */
if (!value_distinguished_at_csn(e, a, current_value, (const CSN *) current_value_vucsn)) {
entry_present_value_to_zapped_value(a, current_value);
@@ -1404,17 +1405,17 @@ resolve_single_valued_set_adcsn(Slapi_Attr *a)
{
Slapi_Value *deleted_value = NULL;
Slapi_Value *current_value = NULL;
- CSN *current_value_vucsn;
- CSN *deleted_value_vucsn;
- CSN *adcsn;
+ const CSN *current_value_vucsn;
+ const CSN *deleted_value_vucsn;
+ const CSN *adcsn;
slapi_attr_first_value(a, ¤t_value);
current_value_vucsn = value_get_csn(current_value, CSN_TYPE_VALUE_UPDATED);
deleted_value = attr_most_recent_deleted_value(a);
deleted_value_vucsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_UPDATED);
adcsn = attr_get_deletion_csn(a);
- if ((deleted_value != NULL && (csn_compare(adcsn, (const CSN *) deleted_value_vucsn) < 0)) ||
- (deleted_value == NULL && (csn_compare(adcsn, (const CSN *) current_value_vucsn) < 0))) {
+ if ((deleted_value != NULL && (csn_compare(adcsn, deleted_value_vucsn) < 0)) ||
+ (deleted_value == NULL && (csn_compare(adcsn, current_value_vucsn) < 0))) {
attr_set_deletion_csn(a, NULL);
}
}
@@ -1430,10 +1431,10 @@ resolve_single_valued_zap_deleted(Slapi_Attr *a)
{
Slapi_Value *deleted_value = NULL;
Slapi_Value *current_value = NULL;
- CSN *current_value_vucsn;
- CSN *deleted_value_vucsn;
- CSN *deleted_value_vdcsn;
- CSN *deleted_value_csn;
+ const CSN *current_value_vucsn;
+ const CSN *deleted_value_vucsn;
+ const CSN *deleted_value_vdcsn;
+ const CSN *deleted_value_csn;
PRBool deleted_on_mod_del = PR_FALSE; /* flag if a value was deleted specifically */
/* Now determine if the deleted value worth to be kept */
@@ -1445,16 +1446,16 @@ resolve_single_valued_zap_deleted(Slapi_Attr *a)
deleted_value_vdcsn = value_get_csn(deleted_value, CSN_TYPE_VALUE_DELETED);
/* get the appropriate csn to take into consideration: either from MOD_REPL or from MOD_DEL_specific */
- if (csn_compare((const CSN *) deleted_value_vdcsn, (const CSN *) deleted_value_vucsn) <= 0) {
+ if (csn_compare(deleted_value_vdcsn, deleted_value_vucsn) <= 0) {
deleted_value_csn = deleted_value_vucsn;
} else {
deleted_value_csn = deleted_value_vdcsn;
- if (0 == csn_compare_ext((const CSN *) current_value_vucsn, (const CSN *) deleted_value_vdcsn, CSN_COMPARE_SKIP_SUBSEQ)) {
+ if (0 == csn_compare_ext(current_value_vucsn, deleted_value_vdcsn, CSN_COMPARE_SKIP_SUBSEQ)) {
/* the deleted value was specifically delete in the same operation that set the current value */
deleted_on_mod_del = PR_TRUE;
}
}
- if ((csn_compare((const CSN *) deleted_value_csn, (const CSN *) current_value_vucsn) < 0) || deleted_on_mod_del) {
+ if ((csn_compare(deleted_value_csn, current_value_vucsn) < 0) || deleted_on_mod_del) {
entry_deleted_value_to_zapped_value(a, deleted_value);
}
}
diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c
index 33ca9ce..2c7b532 100644
--- a/ldap/servers/slapd/main.c
+++ b/ldap/servers/slapd/main.c
@@ -1220,6 +1220,7 @@ main(int argc, char **argv)
vattr_cleanup();
sasl_map_done();
cleanup:
+ slapi_ch_free_string(&(mcfg.myname));
compute_terminate();
SSL_ShutdownServerSessionIDCache();
SSL_ClearSessionCache();
@@ -2194,7 +2195,6 @@ slapd_exemode_ldif2db(struct main_config *mcfg)
return_value = -1;
}
slapi_pblock_destroy(pb);
- slapi_ch_free((void **)&(mcfg->myname));
charray_free(instances);
charray_free(mcfg->cmd_line_instance_names);
charray_free(mcfg->db2ldif_include);
@@ -2377,7 +2377,6 @@ slapd_exemode_db2ldif(int argc, char **argv, struct main_config *mcfg)
slapi_ch_free((void **)&my_ldiffile);
}
}
- slapi_ch_free((void **)&(mcfg->myname));
charray_free(mcfg->cmd_line_instance_names);
charray_free(mcfg->db2ldif_include);
if (mcfg->db2ldif_dump_replica) {
@@ -2505,8 +2504,6 @@ slapd_exemode_db2index(struct main_config *mcfg)
slapi_pblock_destroy(pb);
charray_free(mcfg->db2index_attrs);
- slapi_ch_free((void **)&(mcfg->myname));
-
charray_free(mcfg->db2ldif_include);
/* This frees mcfg->cmd_line_instance_name */
charray_free(instances);
@@ -2557,7 +2554,6 @@ slapd_exemode_db2archive(struct main_config *mcfg)
int32_t task_flags = SLAPI_TASK_RUNNING_FROM_COMMANDLINE;
slapi_pblock_set(pb, SLAPI_TASK_FLAGS, &task_flags);
return_value = (backend_plugin->plg_db2archive)(pb);
- slapi_ch_free((void **)&(mcfg->myname));
slapi_pblock_destroy(pb);
return return_value;
}
@@ -2605,7 +2601,6 @@ slapd_exemode_archive2db(struct main_config *mcfg)
slapi_pblock_set(pb, SLAPI_TASK_FLAGS, &task_flags);
slapi_pblock_set(pb, SLAPI_BACKEND_INSTANCE_NAME, mcfg->cmd_line_instance_name);
return_value = (backend_plugin->plg_archive2db)(pb);
- slapi_ch_free((void **)&(mcfg->myname));
slapi_pblock_destroy(pb);
return return_value;
}
@@ -2674,7 +2669,6 @@ slapd_exemode_upgradedb(struct main_config *mcfg)
return_value = -1;
}
slapi_pblock_destroy(pb);
- slapi_ch_free((void **)&(mcfg->myname));
return (return_value);
}
@@ -2747,7 +2741,6 @@ slapd_exemode_upgradednformat(struct main_config *mcfg)
}
slapi_pblock_destroy(pb);
bail:
- slapi_ch_free((void **)&(mcfg->myname));
return (rc);
}
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index 834949a..b904249 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -539,9 +539,6 @@ free_mapping_tree_node_arrays(backend ***be_list, char ***be_names, int **be_sta
{
int i;
- /* sanity check */
- PR_ASSERT(be_list != NULL && be_names != NULL && be_states != NULL && be_list_count != NULL);
-
if (*be_names != NULL)
for (i = 0; i < *be_list_count; ++i) {
slapi_ch_free((void **)&((*be_names)[i]));
@@ -647,9 +644,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
if (get_backends_from_attr(attr, &be_list, &be_names, &be_states,
&be_list_count, &be_list_size, NULL)) {
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- slapi_sdn_free(&subtree);
- return lderr;
+ goto free_and_return;
}
if (NULL == be_list) {
@@ -660,6 +655,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
}
} else if (!strcasecmp(type, "nsslapd-referral")) {
+ slapi_ch_array_free(referral);
referral = mtn_get_referral_from_entry(entry);
} else if (!strcasecmp(type, "nsslapd-state")) {
@@ -684,6 +680,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_entry_get_dn(entry));
continue;
}
+ slapi_ch_free_string(&plugin_lib);
plugin_lib = slapi_ch_strdup(slapi_value_get_string(val));
} else if (!strcasecmp(type, "nsslapd-distribution-funct")) {
slapi_attr_first_value(attr, &val);
@@ -693,6 +690,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_entry_get_dn(entry));
continue;
}
+ slapi_ch_free_string(&plugin_funct);
plugin_funct = slapi_ch_strdup(slapi_value_get_string(val));
} else if (!strcasecmp(type, "nsslapd-distribution-root-update")) {
const char *sval;
@@ -737,13 +735,16 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
if (be == NULL) {
slapi_log_err(SLAPI_LOG_ERR, "mapping_tree_entry_add",
"Default container has not been created for the NULL SUFFIX node.\n");
- slapi_sdn_free(&subtree);
- return -1;
+ lderr = -1;
+ goto free_and_return;
}
be_list_size = 1;
be_list_count = 0;
+ /* We're in a loop and potentially overwriting these pointers so free them first */
+ free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
+
be_list = (backend **)slapi_ch_calloc(1, sizeof(backend *));
be_names = (char **)slapi_ch_calloc(1, sizeof(char *));
be_states = (int *)slapi_ch_calloc(1, sizeof(int));
@@ -767,17 +768,13 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_log_err(SLAPI_LOG_ERR,
"Node %s must define a backend\n",
slapi_entry_get_dn(entry), 0, 0);
- slapi_sdn_free(&subtree);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
if (((state == MTN_REFERRAL) || (state == MTN_REFERRAL_ON_UPDATE)) && (referral == NULL)) {
slapi_log_err(SLAPI_LOG_ERR,
"Node %s must define referrals to be in referral state\n",
slapi_entry_get_dn(entry), 0, 0);
- slapi_sdn_free(&subtree);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
if (plugin_lib && plugin_funct) {
@@ -787,11 +784,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_log_err(SLAPI_LOG_ERR, "mapping_tree_entry_add",
"Node %s cannot find distribution plugin. " SLAPI_COMPONENT_NAME_NSPR " %d (%s)\n",
slapi_entry_get_dn(entry), PR_GetError(), slapd_pr_strerror(PR_GetError()));
- slapi_sdn_free(&subtree);
- slapi_ch_free((void **)&plugin_funct);
- slapi_ch_free((void **)&plugin_lib);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
} else if ((plugin_lib == NULL) && (plugin_funct == NULL)) {
/* nothing configured -> OK */
@@ -801,11 +794,7 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
slapi_log_err(SLAPI_LOG_ERR, "mapping_tree_entry_add",
"Node %s must define both lib and funct for distribution plugin\n",
slapi_entry_get_dn(entry));
- slapi_sdn_free(&subtree);
- slapi_ch_free((void **)&plugin_funct);
- slapi_ch_free((void **)&plugin_lib);
- free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
- return lderr;
+ goto free_and_return;
}
/* Now we can create the node for this mapping tree entry. */
@@ -839,6 +828,15 @@ mapping_tree_entry_add(Slapi_Entry *entry, mapping_tree_node **newnodep)
}
return lderr;
+
+free_and_return:
+ slapi_sdn_free(&subtree);
+ slapi_ch_array_free(referral);
+ slapi_ch_free_string(&plugin_funct);
+ slapi_ch_free_string(&plugin_lib);
+ free_mapping_tree_node_arrays(&be_list, &be_names, &be_states, &be_list_count);
+
+ return lderr;
}
/*
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 896cccf..bbc0ab7 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -1444,9 +1444,11 @@ optimize_mods(Slapi_Mods *smods)
prev_mod = slapi_mods_get_first_mod(smods);
while ((mod = slapi_mods_get_next_mod(smods))) {
- if ((SLAPI_IS_MOD_ADD(prev_mod->mod_op) || SLAPI_IS_MOD_DELETE(prev_mod->mod_op)) &&
+ if (prev_mod &&
+ (SLAPI_IS_MOD_ADD(prev_mod->mod_op) || SLAPI_IS_MOD_DELETE(prev_mod->mod_op)) &&
(prev_mod->mod_op == mod->mod_op) &&
- (!strcasecmp(prev_mod->mod_type, mod->mod_type))) {
+ (!strcasecmp(prev_mod->mod_type, mod->mod_type)))
+ {
/* Get the current number of mod values from the previous mod. Do it once per attr */
if (mod_count == 0) {
for (; prev_mod->mod_bvalues != NULL && prev_mod->mod_bvalues[mod_count] != NULL; mod_count++)
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index dd69173..dac42eb 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -998,7 +998,8 @@ free_and_return_nolock:
slapi_sdn_free(&sdn);
}
slapi_sdn_free(&basesdn);
- slapi_pblock_set(pb, SLAPI_SEARCH_TARGET_SDN, orig_sdn);
+ if (orig_sdn)
+ slapi_pblock_set(pb, SLAPI_SEARCH_TARGET_SDN, orig_sdn);
slapi_ch_free_string(&proxydn);
slapi_ch_free_string(&proxystr);
diff --git a/ldap/servers/slapd/plugin_internal_op.c b/ldap/servers/slapd/plugin_internal_op.c
index 9da266b..622daff 100644
--- a/ldap/servers/slapd/plugin_internal_op.c
+++ b/ldap/servers/slapd/plugin_internal_op.c
@@ -368,7 +368,8 @@ seq_internal_callback_pb(Slapi_PBlock *pb, void *callback_data, plugin_result_ca
slapi_pblock_set(pb, SLAPI_BACKEND, be);
slapi_pblock_set(pb, SLAPI_PLUGIN, be->be_database);
slapi_pblock_set(pb, SLAPI_SEQ_ATTRNAME, attrname);
- slapi_pblock_set(pb, SLAPI_SEQ_VAL, val);
+ if (val)
+ slapi_pblock_set(pb, SLAPI_SEQ_VAL, val);
slapi_pblock_set(pb, SLAPI_REQCONTROLS, controls);
/* set actions taken to process the operation */
diff --git a/ldap/servers/slapd/plugin_syntax.c b/ldap/servers/slapd/plugin_syntax.c
index e208442..dc7106d 100644
--- a/ldap/servers/slapd/plugin_syntax.c
+++ b/ldap/servers/slapd/plugin_syntax.c
@@ -247,7 +247,9 @@ plugin_call_syntax_filter_sub_sv(
Operation *op = NULL;
/* to pass SLAPI_SEARCH_TIMELIMIT & SLAPI_OPINITATED_TIME */
slapi_pblock_get(pb, SLAPI_OPERATION, &op);
- slapi_pblock_set(pipb, SLAPI_OPERATION, op);
+ if (op) {
+ slapi_pblock_set(pipb, SLAPI_OPERATION, op);
+ }
}
rc = (*sub_fn)(pipb, fsub->sf_initial, fsub->sf_any, fsub->sf_final, va);
} else {
diff --git a/ldap/servers/slapd/rdn.c b/ldap/servers/slapd/rdn.c
index 41c0750..fdb6b17 100644
--- a/ldap/servers/slapd/rdn.c
+++ b/ldap/servers/slapd/rdn.c
@@ -934,10 +934,7 @@ slapi_rdn_get_dn(Slapi_RDN *srdn, char **dn)
if (NULL == srdn || NULL == srdn->all_rdns || NULL == dn) {
return -1;
}
- for (rdnp = srdn->all_rdns; rdnp && *rdnp; rdnp++) {
- len += strlen(*rdnp) + 1; /* 1 for ',' */
- }
- len += 1;
+
len = slapi_rdn_get_dn_len(srdn);
*dn = (char *)slapi_ch_malloc(len);
enddn = *dn + len - 1;
diff --git a/ldap/servers/slapd/sasl_map.c b/ldap/servers/slapd/sasl_map.c
index 72bd010..9593fd0 100644
--- a/ldap/servers/slapd/sasl_map.c
+++ b/ldap/servers/slapd/sasl_map.c
@@ -336,7 +336,9 @@ _sasl_unescape_parenthesis(char *input)
*d++ = *s;
}
}
- *d = '\0';
+ if (d) {
+ *d = '\0';
+ }
return input;
}
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 379fe20..f609c22 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2363,9 +2363,9 @@ schema_delete_attributes(Slapi_Entry *entryBefore __attribute__((unused)), LDAPM
attr_ldif[k] = tolower(attr_ldif[k]);
}
- sizedbuffer_allocate(psbAttrName, strlen(attr_ldif));
- sizedbuffer_allocate(psbAttrOid, strlen(attr_ldif));
- sizedbuffer_allocate(psbAttrSyntax, strlen(attr_ldif));
+ sizedbuffer_allocate(psbAttrName, strlen(attr_ldif) + 1);
+ sizedbuffer_allocate(psbAttrOid, strlen(attr_ldif) + 1);
+ sizedbuffer_allocate(psbAttrSyntax, strlen(attr_ldif) + 1);
sscanf(attr_ldif, "%s name %s syntax %s",
psbAttrOid->buffer, psbAttrName->buffer, psbAttrSyntax->buffer);
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index 2a99795..75accbb 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -37,7 +37,7 @@ do_search(Slapi_PBlock *pb)
{
Slapi_Operation *operation;
BerElement *ber;
- int i, err, attrsonly;
+ int i, err = 0, attrsonly;
ber_int_t scope, deref, sizelimit, timelimit;
char *rawbase = NULL;
int rawbase_set_in_pb = 0; /* was rawbase set in pb? */
@@ -233,6 +233,7 @@ do_search(Slapi_PBlock *pb)
log_search_access(pb, base, scope, fstr, "invalid attribute request");
send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL);
slapi_ch_free_string(&normaci);
+ err = 1; /* Make sure we free everything */
goto free_and_return;
}
}
@@ -358,8 +359,8 @@ do_search(Slapi_PBlock *pb)
ps_add(pb, changetypes, send_entchg_controls);
}
-free_and_return:;
- if (!psearch || rc != 0) {
+free_and_return:
+ if (!psearch || rc != 0 || err != 0) {
slapi_ch_free_string(&fstr);
slapi_filter_free(filter, 1);
slapi_pblock_get(pb, SLAPI_SEARCH_ATTRS, &attrs);
diff --git a/ldap/servers/slapd/tools/dbscan.c b/ldap/servers/slapd/tools/dbscan.c
index 53cdb89..c74d482 100644
--- a/ldap/servers/slapd/tools/dbscan.c
+++ b/ldap/servers/slapd/tools/dbscan.c
@@ -532,7 +532,7 @@ print_changelog(unsigned char *data, int len __attribute__((unused)))
replgen = ntohl(thetime32);
pos += sizeof(uint32_t);
thetime = (time_t)replgen;
- db_printf("\treplgen: %ld %s", replgen, ctime((time_t *)&thetime));
+ db_printf("\treplgen: %u %s", replgen, ctime((time_t *)&thetime));
/* read csn */
print_attr("csn", &pos);
@@ -717,12 +717,15 @@ display_item(DBC *cursor, DBT *key, DBT *data)
tmpbuflen = (key->size > data->size ? key->size : data->size) + 1024;
}
if (buflen < tmpbuflen) {
+ unsigned char *tmp = NULL;
buflen = tmpbuflen;
- buf = (unsigned char *)realloc(buf, buflen);
- if (NULL == buf) {
+ tmp = (unsigned char *)realloc(buf, buflen);
+ if (NULL == tmp) {
+ free(buf);
printf("\t(malloc failed -- %d bytes)\n", buflen);
return;
}
+ buf = tmp;
}
if (display_mode & RAWDATA) {
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index 3730765..ca0912d 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -986,9 +986,9 @@ buildVersatileAttribute(
break;
default:
/*
- * Should not happen, unless new variant parsed and not
- * integrated here, or "jardinage"....
- */
+ * Should not happen, unless new variant parsed and not
+ * integrated here, or "jardinage"....
+ */
field = NULL;
field->how = 22; /* Crash !!! */
break;
@@ -3231,7 +3231,7 @@ doExactSearch(
case LDAP_RES_SEARCH_ENTRY:
nentries++;
/* get dereferenced value into resctrls: deref parsing */
- parse_rc = ldap_get_entry_controls(tttctx->ldapCtx, e, &resctrls);
+ ldap_get_entry_controls(tttctx->ldapCtx, e, &resctrls);
if (resctrls != NULL) { /* parse it only when we have return saved in server control */
/* get dn */
if ((dn = ldap_get_dn(tttctx->ldapCtx, e)) != NULL) {
diff --git a/ldap/servers/slapd/tools/ldclt/ldclt.c b/ldap/servers/slapd/tools/ldclt/ldclt.c
index e72b775..586a147 100644
--- a/ldap/servers/slapd/tools/ldclt/ldclt.c
+++ b/ldap/servers/slapd/tools/ldclt/ldclt.c
@@ -816,7 +816,7 @@ trapVector(
int
initMainThread(void)
{
- struct sigaction act;
+ struct sigaction act = {0};
/*
* Trap SIGINT.
diff --git a/ldap/servers/slapd/tools/ldif.c b/ldap/servers/slapd/tools/ldif.c
index 3548c7d..a13e99f 100644
--- a/ldap/servers/slapd/tools/ldif.c
+++ b/ldap/servers/slapd/tools/ldif.c
@@ -92,11 +92,13 @@ main(int argc, char **argv)
}
if (nread + cur > max) {
max += BUFSIZ;
- if ((val = (char *)realloc(val, max)) ==
- NULL) {
+ char *tmp = NULL;
+ if ((tmp = (char *)realloc(val, max)) == NULL) {
+ free(val);
perror("realloc");
return (1);
}
+ val = tmp;
}
memcpy(val + cur, buf, nread);
cur += nread;
@@ -125,12 +127,14 @@ main(int argc, char **argv)
/* if buffer was filled, expand and keep reading unless last char
is linefeed, in which case it is OK for buffer to be full */
while (((curlen = strlen(buf)) == (maxlen - 1)) && buf[curlen - 1] != '\n') {
+ char *tmp = NULL;
maxlen *= 2;
- if ((buf = (char *)realloc(buf, maxlen)) == NULL) {
+ if ((tmp = (char *)realloc(buf, maxlen)) == NULL) {
perror("realloc");
free(buf);
return (1);
}
+ buf = tmp;
if (NULL == fgets(buf + curlen, maxlen / 2 + 1, stdin)) {
/* no more input to read. */
break;
diff --git a/ldap/servers/slapd/tools/mmldif.c b/ldap/servers/slapd/tools/mmldif.c
index cdcf4b1..96b606a 100644
--- a/ldap/servers/slapd/tools/mmldif.c
+++ b/ldap/servers/slapd/tools/mmldif.c
@@ -700,7 +700,6 @@ readrec(edfFILE *edf1, attrib1_t **attrib)
attrib1_t *freelist = *attrib;
attrib1_t *newlist = NULL;
attrib1_t *a;
- int ignore_rec = FALSE;
int free_it = 0;
*attrib = NULL;
@@ -758,7 +757,7 @@ readrec(edfFILE *edf1, attrib1_t **attrib)
if (!stricmp(line, "authoritative"))
continue;
if (!freelist) {
- att = (attrib1_t *)malloc(sizeof(attrib1_t));
+ att = (attrib1_t *)calloc(1, sizeof(struct attrib1_t *));
free_it = 1;
} else {
att = freelist;
@@ -881,8 +880,6 @@ readrec(edfFILE *edf1, attrib1_t **attrib)
}
*attrib = newlist;
freefreelist(freelist);
- if (ignore_rec)
- return IDDS_MM_ABSENT;
return IDDS_MM_OK;
}
diff --git a/ldap/servers/slapd/tools/pwenc.c b/ldap/servers/slapd/tools/pwenc.c
index d92e94e..87ca174 100644
--- a/ldap/servers/slapd/tools/pwenc.c
+++ b/ldap/servers/slapd/tools/pwenc.c
@@ -362,6 +362,7 @@ slapd_config(const char *configdir, const char *givenconfigfile)
}
} else if (slapi_sdn_compare(&config_dn, slapi_entry_get_sdn_const(e)) == 0) {
/* Get the root scheme out and initialise it (if it exists) */
+ slapi_ch_free_string(&rootschemename);
rootschemename = slapi_entry_attr_get_charptr(e, CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE);
}
diff --git a/ldap/servers/slapd/tools/rsearch/infadd.c b/ldap/servers/slapd/tools/rsearch/infadd.c
index db6fb23..6fe84f9 100644
--- a/ldap/servers/slapd/tools/rsearch/infadd.c
+++ b/ldap/servers/slapd/tools/rsearch/infadd.c
@@ -309,7 +309,7 @@ main(int argc, char **argv)
at_getThread(threads[x], NULL), min, max, count,
ntot);
}
- if (!quiet && (numThreads > 1 || !verbose)) {
+ if (numThreads > 1 && !quiet && !verbose) {
double val = 1000.0 * (double)total / (double)sampleInterval;
fprintf(stdout, "Rate: %7.2f/thr (%6.2f/sec =%7.4fms/op), "
"total: %u (%d thr)\n",
diff --git a/ldap/servers/slapd/tools/rsearch/rsearch.c b/ldap/servers/slapd/tools/rsearch/rsearch.c
index 7602b16..347c84d 100644
--- a/ldap/servers/slapd/tools/rsearch/rsearch.c
+++ b/ldap/servers/slapd/tools/rsearch/rsearch.c
@@ -467,7 +467,10 @@ main(int argc, char **argv)
printf("T%d min=%4ums, max=%4ums, count = %u\n",
st_getThread(threads[x], NULL), min, max, count);
}
- rate = (double)total / (double)numThreads;
+ rate = 0.0;
+ if (numThreads) {
+ rate = (double)total / (double)numThreads;
+ }
val = 1000.0 * (double)total / (double)sampleInterval;
cumrate += rate;
if ((numThreads > 1) || (!verbose)) {
diff --git a/lib/ldaputil/certmap.c b/lib/ldaputil/certmap.c
index efe531a..dc2fdde 100644
--- a/lib/ldaputil/certmap.c
+++ b/lib/ldaputil/certmap.c
@@ -374,6 +374,7 @@ dbinfo_to_certinfo(DBConfDBInfo_t *db_info,
rv = ldapu_list_add_info(propval_list, propval);
if (rv != LDAPU_SUCCESS) {
+ ldapu_propval_free((void *)propval, (void *)propval);
goto error;
}
@@ -700,15 +701,14 @@ certmap_read_certconfig_file(const char *file)
while (curdb) {
nextdb = curdb->next;
rv = dbinfo_to_certinfo(curdb, &certinfo);
-
if (rv != LDAPU_SUCCESS) {
dbconf_free_confinfo(conf_info);
return rv;
}
rv = process_certinfo(certinfo);
-
if (rv != LDAPU_SUCCESS) {
+ ldapu_certinfo_free(certinfo);
dbconf_free_confinfo(conf_info);
return rv;
}
@@ -1330,8 +1330,11 @@ ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage *
rv = (*mapfn)(cert, ld, certmap_info, &ldapDN, &filter);
- if (rv != LDAPU_SUCCESS)
+ if (rv != LDAPU_SUCCESS) {
+ free(ldapDN);
+ free(filter);
return rv;
+ }
/* Get the search function from the certmap_info - certinfo maybe NULL */
searchfn = ldapu_get_cert_searchfn_sub(certmap_info);
@@ -1339,10 +1342,8 @@ ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage *
rv = (*searchfn)(cert, ld, certmap_info, basedn, ldapDN, filter,
certmap_attrs, &res_array);
- if (ldapDN)
- free(ldapDN);
- if (filter)
- free(filter);
+ free(ldapDN);
+ free(filter);
/*
* Get the verify cert function & call it.
diff --git a/lib/libaccess/usrcache.cpp b/lib/libaccess/usrcache.cpp
index 5ea8259..b6ac58d 100644
--- a/lib/libaccess/usrcache.cpp
+++ b/lib/libaccess/usrcache.cpp
@@ -157,11 +157,11 @@ int acl_usr_cache_init ()
}
else {
singleDbTable = 0;
- databaseUserCacheTable = PR_NewHashTable(0,
+ databaseUserCacheTable = PR_NewHashTable(0,
PR_HashCaseString,
PR_CompareCaseStrings,
PR_CompareValues,
- &ACLPermAllocOps,
+ &ACLPermAllocOps,
usrcache_pool);
}
@@ -176,7 +176,7 @@ int acl_usr_cache_init ()
for(i = 0; i < num_usrobj; i++){
usrobj = (UserCacheObj *)pool_malloc(usrcache_pool,
sizeof(UserCacheObj));
-
+
if (!usrobj) return -1;
memset((void *)usrobj, 0, sizeof(UserCacheObj));
PR_INSERT_AFTER(&usrobj->list, usrobj_list);
diff --git a/src/cockpit/389-console/src/lib/database/chaining.jsx b/src/cockpit/389-console/src/lib/database/chaining.jsx
index 3dd3ec4..c169e7b 100644
--- a/src/cockpit/389-console/src/lib/database/chaining.jsx
+++ b/src/cockpit/389-console/src/lib/database/chaining.jsx
@@ -916,7 +916,7 @@ export class ChainingConfig extends React.Component {
</Checkbox>;
} else {
proxiedAuth =
- <Checkbox id="nsproxiedauthorization" onChange={this.handleChange} defaultChecked
+ <Checkbox id="nsproxiedauthorization" onChange={this.handleChange}
title="Allow proxied authentication to the remote server. (nsproxiedauthorization).">
Allow Proxied Authentication
</Checkbox>;
diff --git a/src/cockpit/389-console/src/lib/database/suffix.jsx b/src/cockpit/389-console/src/lib/database/suffix.jsx
index 9cfb95b..3f3bc82 100644
--- a/src/cockpit/389-console/src/lib/database/suffix.jsx
+++ b/src/cockpit/389-console/src/lib/database/suffix.jsx
@@ -254,10 +254,10 @@ export class Suffix extends React.Component {
// Do import
let export_cmd = [
"dsconf", "-j", "ldapi://%2fvar%2frun%2fslapd-" + this.props.serverId + ".socket",
- "backend", "export", this.props.suffix, "--ldif=" + this.state.ldifLocation, "--encrypted"
+ "backend", "export", this.props.suffix, "--ldif=" + this.state.ldifLocation
];
- if (this.state.attrEncrpytion) {
+ if (this.state.attrEncryption) {
export_cmd.push("--encrypted");
}
diff --git a/src/cockpit/389-console/src/replication.js b/src/cockpit/389-console/src/replication.js
index 6ef3635..2fe3a6e 100644
--- a/src/cockpit/389-console/src/replication.js
+++ b/src/cockpit/389-console/src/replication.js
@@ -1185,7 +1185,7 @@ $(document).ready( function() {
}
} else {
if ( !('nsds5replicatedattributelisttotal' in repl_agmt_values) ||
- agmt_tot_exclude != repl_agmt_values['nsds5replicatedattributelisttotal'].replace(frac_prefix, ""));
+ agmt_tot_exclude != repl_agmt_values['nsds5replicatedattributelisttotal'].replace(frac_prefix, ""))
{
cmd_args.push('--frac-list-total=' + frac_prefix + ' ' + agmt_tot_exclude);
}
diff --git a/src/lib389/lib389/agreement.py b/src/lib389/lib389/agreement.py
index dcab900..84e2f8c 100644
--- a/src/lib389/lib389/agreement.py
+++ b/src/lib389/lib389/agreement.py
@@ -266,6 +266,7 @@ class Agreement(DSLdapObject):
# Extract the csn timstamps and compare them
agmt_time = 0
+ con_time = 0
match = Agreement.csnre.match(agmt_maxcsn)
if match:
agmt_time = int(match.group(1), 16)
diff --git a/src/lib389/lib389/backend.py b/src/lib389/lib389/backend.py
index 64a40c1..353a3e1 100644
--- a/src/lib389/lib389/backend.py
+++ b/src/lib389/lib389/backend.py
@@ -480,6 +480,9 @@ class Backend(DSLdapObject):
:returns: DSLdapObject of the created entry
"""
+ sample_entries = False
+ parent_suffix = False
+
# normalize suffix (remove spaces between comps)
if dn is not None:
dn_comps = ldap.dn.explode_dn(dn.lower())
@@ -490,9 +493,8 @@ class Backend(DSLdapObject):
dn_comps = ldap.dn.explode_dn(suffix_dn)
ndn = ",".join(dn_comps)
properties['nsslapd-suffix'] = ndn
-
- sample_entries = properties.pop(BACKEND_SAMPLE_ENTRIES, False)
- parent_suffix = properties.pop('parent', False)
+ sample_entries = properties.pop(BACKEND_SAMPLE_ENTRIES, False)
+ parent_suffix = properties.pop('parent', False)
# Okay, now try to make the backend.
super(Backend, self).create(dn, properties, basedn)
diff --git a/src/lib389/lib389/cli_conf/backend.py b/src/lib389/lib389/cli_conf/backend.py
index 77ce3dd..36e32ec 100644
--- a/src/lib389/lib389/cli_conf/backend.py
+++ b/src/lib389/lib389/cli_conf/backend.py
@@ -422,7 +422,7 @@ def backend_set(inst, basedn, log, args):
if args.add_referral:
be.add('nsslapd-referral', args.add_referral)
if args.del_referral:
- be.remove('nsslapd-referral', args.add_referral)
+ be.remove('nsslapd-referral', args.del_referral)
if args.cache_size:
be.set('nsslapd-cachesize', args.cache_size)
if args.cache_memsize:
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch master updated: Revert "Issue 49960 - Core schema contains strings instead of numer oids"
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch master
in repository 389-ds-base.
The following commit(s) were added to refs/heads/master by this push:
new 3ca307d Revert "Issue 49960 - Core schema contains strings instead of numer oids"
3ca307d is described below
commit 3ca307d23d9ca3ccbec940e59d241bc4e0974b90
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Fri Jun 7 14:38:50 2019 -0400
Revert "Issue 49960 - Core schema contains strings instead of numer oids"
This reverts commit 2738fd00ffd7b9bced16e2e9ce61da80eec51206.
---
ldap/schema/01core389.ldif | 28 +++++------
ldap/schema/30ns-common.ldif | 102 +++++++++++++++++++-------------------
ldap/schema/50ns-admin.ldif | 62 +++++++++++------------
ldap/schema/50ns-certificate.ldif | 4 +-
ldap/schema/50ns-directory.ldif | 4 +-
ldap/schema/50ns-mail.ldif | 4 +-
6 files changed, 102 insertions(+), 102 deletions(-)
diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif
index 993fa4a..a595b76 100644
--- a/ldap/schema/01core389.ldif
+++ b/ldap/schema/01core389.ldif
@@ -86,26 +86,26 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2064 NAME 'nsSaslMapRegexString' DESC 'N
attributeTypes: ( 2.16.840.1.113730.3.1.2065 NAME 'nsSaslMapBaseDNTemplate' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2066 NAME 'nsSaslMapFilterTemplate' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2142 NAME 'nsSaslMapPriority' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
-attributeTypes: ( 2.16.840.1.113730.3.1.309 NAME 'nsCertfile' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.310 NAME 'nsKeyfile' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.311 NAME 'nsSSL2' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.312 NAME 'nsSSL3' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsCertfile-oid NAME 'nsCertfile' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsKeyfile-oid NAME 'nsKeyfile' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSL2-oid NAME 'nsSSL2' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSL3-oid NAME 'nsSSL3' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( nsTLS1-oid NAME 'nsTLS1' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( nsTLS10-oid NAME 'nsTLS10' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( nsTLS11-oid NAME 'nsTLS11' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( nsTLS12-oid NAME 'nsTLS12' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( sslVersionMin-oid NAME 'sslVersionMin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( sslVersionMax-oid NAME 'sslVersionMax' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.313 NAME 'nsSSLClientAuth' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.314 NAME 'nsSSLSessionTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.315 NAME 'nsSSL3SessionTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.316 NAME 'nsSSL2Ciphers' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.317 NAME 'nsSSL3Ciphers' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSLClientAuth-oid NAME 'nsSSLClientAuth' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSLSessionTimeout-oid NAME 'nsSSLSessionTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSL3SessionTimeout-oid NAME 'nsSSL3SessionTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSL2Ciphers-oid NAME 'nsSSL2Ciphers' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSL3Ciphers-oid NAME 'nsSSL3Ciphers' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( nsSSLSupportedCiphers-oid NAME 'nsSSLSupportedCiphers' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( allowWeakCipher-oid NAME 'allowWeakCipher' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.318 NAME 'nsSSLToken' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.319 NAME 'nsSSLPersonalitySSL' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.320 NAME 'nsSSLActivation' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSLToken-oid NAME 'nsSSLToken' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSLPersonalitySSL-oid NAME 'nsSSLPersonalitySSL' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSSLActivation-oid NAME 'nsSSLActivation' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( CACertExtractFile-oid NAME 'CACertExtractFile' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( nsTLSAllowClientRenegotiation-oid NAME 'nsTLSAllowClientRenegotiation' DESC 'Allow clients to renegotiate open TLS connections using RFC 5746 secure renegotiation' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( ServerKeyExtractFile-oid NAME 'ServerKeyExtractFile' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
@@ -327,8 +327,8 @@ objectClasses: ( 2.16.840.1.113730.3.2.103 NAME 'nsDS5ReplicationAgreement' DESC
objectClasses: ( 2.16.840.1.113730.3.2.39 NAME 'nsslapdConfig' DESC 'Netscape defined objectclass' SUP top MAY ( cn ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.317 NAME 'nsSaslMapping' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ nsSaslMapRegexString $ nsSaslMapBaseDNTemplate $ nsSaslMapFilterTemplate ) MAY ( nsSaslMapPriority ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.43 NAME 'nsSNMP' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ nsSNMPEnabled ) MAY ( nsSNMPOrganization $ nsSNMPLocation $ nsSNMPContact $ nsSNMPDescription $ nsSNMPName $ nsSNMPMasterHost $ nsSNMPMasterPort ) X-ORIGIN 'Netscape Directory Server' )
-objectClasses: ( 2.16.840.1.113730.3.2.60 NAME 'nsEncryptionConfig' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsCertfile $ nsKeyfile $ nsSSL2 $ nsSSL3 $ nsTLS1 $ nsTLS10 $ nsTLS11 $ nsTLS12 $ sslVersionMin $ sslVersionMax $ nsSSLSessionTimeout $ nsSSL3SessionTimeout $ nsSSLClientAuth $ nsSSL2Ciphers $ nsSSL3Ciphers $ nsSSLSupportedCiphers $ allowWeakCipher $ CACertExtractFile $ allowWeakDHParam $ nsTLSAllowClientRenegotiation ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.61 NAME 'nsEncryptionModule' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsSSLToken $ nsSSLPersonalityssl $ nsSSLActivation $ ServerKeyExtractFile $ ServerCertExtractFile ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsEncryptionConfig-oid NAME 'nsEncryptionConfig' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsCertfile $ nsKeyfile $ nsSSL2 $ nsSSL3 $ nsTLS1 $ nsTLS10 $ nsTLS11 $ nsTLS12 $ sslVersionMin $ sslVersionMax $ nsSSLSessionTimeout $ nsSSL3SessionTimeout $ nsSSLClientAuth $ nsSSL2Ciphers $ nsSSL3Ciphers $ nsSSLSupportedCiphers $ allowWeakCipher $ CACertExtractFile $ allowWeakDHParam $ nsTLSAllowClientRenegotiation ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsEncryptionModule-oid NAME 'nsEncryptionModule' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsSSLToken $ nsSSLPersonalityssl $ nsSSLActivation $ ServerKeyExtractFile $ ServerCertExtractFile ) X-ORIGIN 'Netscape' )
objectClasses: ( 2.16.840.1.113730.3.2.327 NAME 'rootDNPluginConfig' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( rootdn-open-time $ rootdn-close-time $ rootdn-days-allowed $ rootdn-allow-host $ rootdn-deny-host $ rootdn-allow-ip $ rootdn-deny-ip ) X-ORIGIN 'Netscape' )
objectClasses: ( 2.16.840.1.113730.3.2.328 NAME 'nsSchemaPolicy' DESC 'Netscape defined objectclass' SUP top MAY ( cn $ schemaUpdateObjectclassAccept $ schemaUpdateObjectclassReject $ schemaUpdateAttributeAccept $ schemaUpdateAttributeReject) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.332 NAME 'nsChangelogConfig' DESC 'Configuration of the changelog5 object' SUP top MUST ( cn $ nsslapd-changelogdir ) MAY ( nsslapd-changelogmaxage $ nsslapd-changelogtrim-interval $ nsslapd-changelogmaxentries $ nsslapd-changelogsuffix $ nsslapd-changelogcompactdb-interval $ nsslapd-encryptionalgorithm $ nsSymmetricKey ) X-ORIGIN '389 Directory Server' )
diff --git a/ldap/schema/30ns-common.ldif b/ldap/schema/30ns-common.ldif
index 58eeae5..80b8cf6 100644
--- a/ldap/schema/30ns-common.ldif
+++ b/ldap/schema/30ns-common.ldif
@@ -12,60 +12,60 @@
# Common Netscape schema.
#
dn: cn=schema
-attributeTypes: ( 2.16.840.1.113730.3.1.276 NAME 'nsServerID' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.277 NAME 'nsBaseDN' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.278 NAME 'nsBindDN' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.279 NAME 'nsBindPassword' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.280 NAME 'nsServerPort' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.281 NAME 'nsServerAddress' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.282 NAME 'nsDirectoryInfoRef' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.283 NAME 'nsDirectoryURL' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape' )
-attributeTypes: ( 1.3.6.1.4.1.42.2.27.10.1.31 NAME 'nsDirectoryFailoverList' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.284 NAME 'nsAdminDomainName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.285 NAME 'nsHostLocation' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.286 NAME 'nsHardwarePlatform' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.287 NAME 'nsOsVersion' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.288 NAME 'nsAdminGroupName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.289 NAME 'nsConfigRoot' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 1.3.6.1.4.1.42.2.27.10.1.72 NAME 'nsAdminSIEDN' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.290 NAME 'nsVendor' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.291 NAME 'nsProductName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.292 NAME 'nsNickName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.293 NAME 'nsProductVersion' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.294 NAME 'nsBuildNumber' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.295 NAME 'nsRevisionNumber' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.296 NAME 'nsSerialNumber' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.297 NAME 'nsInstalledLocation' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.298 NAME 'nsExpirationDate' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.299 NAME 'nsBuildSecurity' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.300 NAME 'nsServerMigrationClassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.301 NAME 'nsServerCreationClassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.302 NAME 'nsLdapSchemaVersion' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.303 NAME 'nsSuiteSpotUser' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.304 NAME 'nsErrorLog' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.305 NAME 'nsPidLog' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.306 NAME 'nsAccessLog' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.307 NAME 'nsDefaultAcceptLanguage' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.308 NAME 'nsServerSecurity' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.321 NAME 'nsTaskLabel' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.322 NAME 'nsHelpRef' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.323 NAME 'nsExecRef' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.329 NAME 'nsLogSuppress' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.324 NAME 'nsJarfilename' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
-attributeTypes: ( 2.16.840.1.113730.3.1.325 NAME 'nsClassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsServerID-oid NAME 'nsServerID' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsBaseDN-oid NAME 'nsBaseDN' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsBindDN-oid NAME 'nsBindDN' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsBindPassword-oid NAME 'nsBindPassword' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsServerPort-oid NAME 'nsServerPort' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsServerAddress-oid NAME 'nsServerAddress' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsDirectoryInfoRef-oid NAME 'nsDirectoryInfoRef' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsDirectoryURL-oid NAME 'nsDirectoryURL' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsDirectoryFailoverList-oid NAME 'nsDirectoryFailoverList' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsAdminDomainName-oid NAME 'nsAdminDomainName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsHostLocation-oid NAME 'nsHostLocation' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsHardwarePlatform-oid NAME 'nsHardwarePlatform' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsOsVersion-oid NAME 'nsOsVersion' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsAdminGroupName-oid NAME 'nsAdminGroupName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsConfigRoot-oid NAME 'nsConfigRoot' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsAdminSIEDN-oid NAME 'nsAdminSIEDN' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsVendor-oid NAME 'nsVendor' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsProductName-oid NAME 'nsProductName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsNickName-oid NAME 'nsNickName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsProductVersion-oid NAME 'nsProductVersion' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsBuildNumber-oid NAME 'nsBuildNumber' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsRevisionNumber-oid NAME 'nsRevisionNumber' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSerialNumber-oid NAME 'nsSerialNumber' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsInstalledLocation-oid NAME 'nsInstalledLocation' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsExpirationDate-oid NAME 'nsExpirationDate' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsBuildSecurity-oid NAME 'nsBuildSecurity' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsServerMigrationClassname-oid NAME 'nsServerMigrationClassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsServerCreationClassname-oid NAME 'nsServerCreationClassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsLdapSchemaVersion-oid NAME 'nsLdapSchemaVersion' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsSuiteSpotUser-oid NAME 'nsSuiteSpotUser' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsErrorLog-oid NAME 'nsErrorLog' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsPidLog-oid NAME 'nsPidLog' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsAccessLog-oid NAME 'nsAccessLog' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsDefaultAcceptLanguage-oid NAME 'nsDefaultAcceptLanguage' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsServerSecurity-oid NAME 'nsServerSecurity' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsTaskLabel-oid NAME 'nsTaskLabel' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsHelpRef-oid NAME 'nsHelpRef' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsExecRef-oid NAME 'nsExecRef' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsLogSuppress-oid NAME 'nsLogSuppress' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsJarfilename-oid NAME 'nsJarfilename' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
+attributeTypes: ( nsClassname-oid NAME 'nsClassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape' )
attributeTypes: ( 2.16.840.1.113730.3.1.2337 NAME 'nsCertSubjectDN' DESC 'An x509 DN from a certificate used to map during a TLS bind process' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN '389 Directory Server Project' )
attributeTypes: ( 2.16.840.1.113730.3.1.2342 NAME 'nsSshPublicKey' DESC 'An nsSshPublicKey record' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN '389 Directory Server Project' )
attributeTypes: ( 2.16.840.1.113730.3.1.2343 NAME 'legalName' DESC 'An individuals legalName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN '389 Directory Server Project' )
-objectClasses: ( 2.16.840.1.113730.3.2.56 NAME 'nsAdminDomain' DESC 'Netscape defined objectclass' SUP organizationalUnit MAY ( nsAdminDomainName ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.57 NAME 'nsHost' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( serverHostName $ description $ l $ nsHostLocation $ nsHardwarePlatform $ nsOsVersion ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.58 NAME 'nsAdminGroup' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsAdminGroupName $ description $ nsConfigRoot $ nsAdminSIEDN ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.59 NAME 'nsApplication' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsVendor $ description $ nsProductName $ nsNickName $ nsProductVersion $ nsBuildNumber $ nsRevisionNumber $ nsSerialNumber $ nsInstalledLocation $ installationTimeStamp $ nsExpirationDate $ nsBuildSecurity $ nsLdapSchemaVersion $ nsServerMigrationClassname $ nsServerCreationClassname ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.62 NAME 'nsResourceRef' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( seeAlso ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.63 NAME 'nsTask' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsTaskLabel $ nsHelpref $ nsExecref $ nsLogSuppress ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.64 NAME 'nsTaskGroup' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsTaskLabel ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.65 NAME 'nsAdminObject' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsJarFilename $ nsClassName ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.66 NAME 'nsConfig' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( description $ nsServerPort $ nsServerAddress $ nsSuiteSpotUser $ nsErrorLog $ nsPidLog $ nsAccessLog $ nsDefaultAcceptLanguage $ nsServerSecurity ) X-ORIGIN 'Netscape' )
-objectClasses: ( 2.16.840.1.113730.3.2.67 NAME 'nsDirectoryInfo' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsBindDN $ nsBindPassword $ nsDirectoryURL $ nsDirectoryFailoverList $ nsDirectoryInfoRef ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsAdminDomain-oid NAME 'nsAdminDomain' DESC 'Netscape defined objectclass' SUP organizationalUnit MAY ( nsAdminDomainName ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsHost-oid NAME 'nsHost' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( serverHostName $ description $ l $ nsHostLocation $ nsHardwarePlatform $ nsOsVersion ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsAdminGroup-oid NAME 'nsAdminGroup' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsAdminGroupName $ description $ nsConfigRoot $ nsAdminSIEDN ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsApplication-oid NAME 'nsApplication' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsVendor $ description $ nsProductName $ nsNickName $ nsProductVersion $ nsBuildNumber $ nsRevisionNumber $ nsSerialNumber $ nsInstalledLocation $ installationTimeStamp $ nsExpirationDate $ nsBuildSecurity $ nsLdapSchemaVersion $ nsServerMigrationClassname $ nsServerCreationClassname ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsResourceRef-oid NAME 'nsResourceRef' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( seeAlso ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsTask-oid NAME 'nsTask' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsTaskLabel $ nsHelpref $ nsExecref $ nsLogSuppress ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsTaskGroup-oid NAME 'nsTaskGroup' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsTaskLabel ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsAdminObject-oid NAME 'nsAdminObject' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsJarFilename $ nsClassName ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsConfig-oid NAME 'nsConfig' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( description $ nsServerPort $ nsServerAddress $ nsSuiteSpotUser $ nsErrorLog $ nsPidLog $ nsAccessLog $ nsDefaultAcceptLanguage $ nsServerSecurity ) X-ORIGIN 'Netscape' )
+objectClasses: ( nsDirectoryInfo-oid NAME 'nsDirectoryInfo' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsBindDN $ nsBindPassword $ nsDirectoryURL $ nsDirectoryFailoverList $ nsDirectoryInfoRef ) X-ORIGIN 'Netscape' )
objectClasses: ( 2.16.840.1.113730.3.2.329 NAME 'nsMemberOf' DESC 'Allow memberOf assignment on groups for nesting and users' SUP top AUXILIARY MAY ( memberOf ) X-ORIGIN '389 Directory Server Project' )
objectClasses: ( 2.16.840.1.113730.3.2.331 NAME 'nsAccount' DESC 'A representation of a binding user in a directory server' SUP top AUXILIARY MAY ( userCertificate $ nsCertSubjectDN $ nsSshPublicKey $ userPassword ) X-ORIGIN '389 Directory Server Project' )
objectClasses: ( 2.16.840.1.113730.3.2.333 NAME 'nsPerson' DESC 'A representation of a person in a directory server' SUP top STRUCTURAL MUST ( displayName $ cn ) MAY ( userPassword $ seeAlso $ description $ legalName $ mail $ preferredLanguage ) X-ORIGIN '389 Directory Server Project' )
diff --git a/ldap/schema/50ns-admin.ldif b/ldap/schema/50ns-admin.ldif
index a553c58..aceaf75 100644
--- a/ldap/schema/50ns-admin.ldif
+++ b/ldap/schema/50ns-admin.ldif
@@ -12,34 +12,34 @@
# Schema used by Netscape Administration Services
#
dn: cn=schema
-attributeTypes: ( 2.16.840.1.113730.3.1.255 NAME 'nsAdminCgiWaitPid' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.256 NAME 'nsAdminUsers' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.257 NAME 'nsAdminAccessHosts' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.258 NAME 'nsAdminAccessAddresses' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.259 NAME 'nsAdminOneACLDir' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.260 NAME 'nsAdminEnableDSGW' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.261 NAME 'nsAdminEnableEnduser' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.262 NAME 'nsAdminCacheLifetime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.263 NAME 'nsAdminAccountInfo' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.264 NAME 'nsDeleteclassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.265 NAME 'nsAdminEndUserHTMLIndex' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.266 NAME 'nsUniqueAttribute' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.267 NAME 'nsUserIDFormat' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.268 NAME 'nsUserRDNComponent' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.269 NAME 'nsGroupRDNComponent' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.270 NAME 'nsWellKnownJarfiles' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.271 NAME 'nsNYR' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.272 NAME 'nsDefaultObjectClass' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.273 NAME 'nsPreference' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.274 NAME 'nsDisplayName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-attributeTypes: ( 2.16.840.1.113730.3.1.275 NAME 'nsViewConfiguration' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.46 NAME 'nsAdminServer' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ nsServerID ) MAY ( description ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.47 NAME 'nsAdminConfig' DESC 'Netscape defined objectclass' SUP nsConfig MAY ( nsAdminCgiWaitPid $ nsAdminUsers $ nsAdminAccessHosts $ nsAdminAccessAddresses $ nsAdminOneACLDir $ nsAdminEnableDSGW $ nsAdminEnableEnduser $ nsAdminCacheLifetime ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.48 NAME 'nsAdminResourceEditorExtension' DESC 'Netscape defined objectclass' SUP nsAdminObject MUST ( cn ) MAY ( nsAdminAccountInfo $ nsDeleteclassname ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.49 NAME 'nsAdminGlobalParameters' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsAdminEndUserHTMLIndex $ nsNickname ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.50 NAME 'nsGlobalParameters' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsUniqueAttribute $ nsUserIDFormat $ nsUserRDNComponent $ nsGroupRDNComponent $ nsWellKnownJarFiles $ nsNYR ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.51 NAME 'nsDefaultObjectClasses' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsDefaultObjectClass ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.52 NAME 'nsAdminConsoleUser' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsPreference ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.53 NAME 'nsCustomView' DESC 'Netscape defined objectclass' SUP nsAdminObject MAY ( nsDisplayName ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.54 NAME 'nsTopologyCustomView' DESC 'Netscape defined objectclass' SUP nsCustomView MUST ( cn ) MAY ( nsViewConfiguration ) X-ORIGIN 'Netscape Administration Services' )
-objectClasses: ( 2.16.840.1.113730.3.2.55 NAME 'nsTopologyPlugin' DESC 'Netscape defined objectclass' SUP nsAdminObject X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminCgiWaitPid-oid NAME 'nsAdminCgiWaitPid' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminUsers-oid NAME 'nsAdminUsers' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminAccessHosts-oid NAME 'nsAdminAccessHosts' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminAccessAddresses-oid NAME 'nsAdminAccessAddresses' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminOneACLDir-oid NAME 'nsAdminOneACLDir' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminEnableDSGW-oid NAME 'nsAdminEnableDSGW' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminEnableEnduser-oid NAME 'nsAdminEnableEnduser' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminCacheLifetime-oid NAME 'nsAdminCacheLifetime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminAccountInfo-oid NAME 'nsAdminAccountInfo' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsDeleteclassname-oid NAME 'nsDeleteclassname' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsAdminEndUserHTMLIndex-oid NAME 'nsAdminEndUserHTMLIndex' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsUniqueAttribute-oid NAME 'nsUniqueAttribute' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsUserIDFormat-oid NAME 'nsUserIDFormat' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsUserRDNComponent-oid NAME 'nsUserRDNComponent' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsGroupRDNComponent-oid NAME 'nsGroupRDNComponent' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsWellKnownJarfiles-oid NAME 'nsWellKnownJarfiles' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsNYR-oid NAME 'nsNYR' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsDefaultObjectClass-oid NAME 'nsDefaultObjectClass' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsPreference-oid NAME 'nsPreference' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsDisplayName-oid NAME 'nsDisplayName' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+attributeTypes: ( nsViewConfiguration-oid NAME 'nsViewConfiguration' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsAdminServer-oid NAME 'nsAdminServer' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ nsServerID ) MAY ( description ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsAdminConfig-oid NAME 'nsAdminConfig' DESC 'Netscape defined objectclass' SUP nsConfig MAY ( nsAdminCgiWaitPid $ nsAdminUsers $ nsAdminAccessHosts $ nsAdminAccessAddresses $ nsAdminOneACLDir $ nsAdminEnableDSGW $ nsAdminEnableEnduser $ nsAdminCacheLifetime ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsAdminResourceEditorExtension-oid NAME 'nsAdminResourceEditorExtension' DESC 'Netscape defined objectclass' SUP nsAdminObject MUST ( cn ) MAY ( nsAdminAccountInfo $ nsDeleteclassname ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsAdminGlobalParameters-oid NAME 'nsAdminGlobalParameters' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsAdminEndUserHTMLIndex $ nsNickname ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsGlobalParameters-oid NAME 'nsGlobalParameters' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsUniqueAttribute $ nsUserIDFormat $ nsUserRDNComponent $ nsGroupRDNComponent $ nsWellKnownJarFiles $ nsNYR ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsDefaultObjectClasses-oid NAME 'nsDefaultObjectClasses' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsDefaultObjectClass ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsAdminConsoleUser-oid NAME 'nsAdminConsoleUser' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsPreference ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsCustomView-oid NAME 'nsCustomView' DESC 'Netscape defined objectclass' SUP nsAdminObject MAY ( nsDisplayName ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsTopologyCustomView-oid NAME 'nsTopologyCustomView' DESC 'Netscape defined objectclass' SUP nsCustomView MUST ( cn ) MAY ( nsViewConfiguration ) X-ORIGIN 'Netscape Administration Services' )
+objectClasses: ( nsTopologyPlugin-oid NAME 'nsTopologyPlugin' DESC 'Netscape defined objectclass' SUP nsAdminObject X-ORIGIN 'Netscape Administration Services' )
diff --git a/ldap/schema/50ns-certificate.ldif b/ldap/schema/50ns-certificate.ldif
index 42d0f3e..e89680a 100644
--- a/ldap/schema/50ns-certificate.ldif
+++ b/ldap/schema/50ns-certificate.ldif
@@ -12,6 +12,6 @@
# Schema for Netscape Certificate Management System
#
dn: cn=schema
-attributeTypes: ( 1.3.6.1.4.1.42.2.27.10.1.190 NAME 'nsCertConfig' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Certificate Management System' )
+attributeTypes: ( nsCertConfig-oid NAME 'nsCertConfig' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Certificate Management System' )
objectClasses: ( 2.16.840.1.113730.3.2.18 NAME 'netscapeCertificateServer' DESC 'Netscape defined objectclass' SUP top MUST ( objectclass ) X-ORIGIN 'Netscape Certificate Management System' )
-objectClasses: ( 1.3.6.1.4.1.42.2.27.10.2.32 NAME 'nsCertificateServer' DESC 'Netscape defined objectclass' SUP top MUST ( objectclass $ nsServerID ) MAY ( serverHostName $ nsServerPort $ nsCertConfig ) X-ORIGIN 'Netscape Certificate Management System' )
+objectClasses: ( nsCertificateServer-oid NAME 'nsCertificateServer' DESC 'Netscape defined objectclass' SUP top MUST ( objectclass $ nsServerID ) MAY ( serverHostName $ nsServerPort $ nsCertConfig ) X-ORIGIN 'Netscape Certificate Management System' )
diff --git a/ldap/schema/50ns-directory.ldif b/ldap/schema/50ns-directory.ldif
index 6350248..298d607 100644
--- a/ldap/schema/50ns-directory.ldif
+++ b/ldap/schema/50ns-directory.ldif
@@ -12,7 +12,7 @@
# Additional schema used by Netscape Directory Server 4.x
#
dn: cn=schema
-attributeTypes: ( 1.3.6.1.4.1.42.2.27.10.1.73 NAME 'nsSecureServerPort' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( nsSecureServerPort-oid NAME 'nsSecureServerPort' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.206 NAME 'filterInfo' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.48 NAME 'replicaPort' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.49 NAME 'replicaUpdateFailedAt' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
@@ -83,7 +83,7 @@ attributeTypes: ( 2.16.840.1.113730.3.1.57 NAME 'replicaRoot' DESC 'Netscape def
attributeTypes: ( 2.16.840.1.113730.3.1.58 NAME 'replicaBindDn' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.69 NAME 'subtreeACI' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Directory Server 1.0' )
objectClasses: ( 2.16.840.1.113730.3.2.23 NAME 'netscapeDirectoryServer' DESC 'Netscape defined objectclass' SUP top MUST ( objectclass ) X-ORIGIN 'Netscape Directory Server' )
-objectClasses: ( 1.3.6.1.4.1.42.2.27.10.2.31 NAME 'nsDirectoryServer' DESC 'Netscape defined objectclass' SUP top MUST ( objectclass $ nsServerID ) MAY ( serverHostName $ nsServerPort $ nsSecureServerPort $ nsBindPassword $ nsBindDN $ nsBaseDN ) X-ORIGIN 'Netscape Directory Server' )
+objectClasses: ( nsDirectoryServer-oid NAME 'nsDirectoryServer' DESC 'Netscape defined objectclass' SUP top MUST ( objectclass $ nsServerID ) MAY ( serverHostName $ nsServerPort $ nsSecureServerPort $ nsBindPassword $ nsBindDN $ nsBaseDN ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.8 NAME 'ntUser' DESC 'Netscape defined objectclass' SUP top MUST ( ntUserDomainId ) MAY ( description $ l $ ou $ seeAlso $ ntUserPriv $ ntUserHomeDir $ ntUserComment $ ntUserFlags $ ntUserScriptPath $ ntUserAuthFlags $ ntUserUsrComment $ ntUserParms $ ntUserWorkstations $ ntUserLastLogon $ ntUserLastLogoff $ ntUserAcctExpires $ ntUserMaxStorage $ ntUserUnitsPerWeek $ ntUserLogonHours $ ntUserBadPwCount $ ntUserNumLogons $ ntUserLogonServer $ ntUserC [...]
objectClasses: ( 2.16.840.1.113730.3.2.9 NAME 'ntGroup' DESC 'Netscape defined objectclass' SUP top MUST ( ntUserDomainId ) MAY ( description $ l $ ou $ seeAlso $ ntGroupId $ ntGroupAttributes $ ntGroupCreateNewGroup $ ntGroupDeleteGroup $ ntGroupType $ ntUniqueId $ mail ) X-ORIGIN 'Netscape NT Synchronization' )
objectClasses: ( 2.16.840.1.113730.3.2.82 NAME 'nsChangelog4Config' DESC 'Netscape defined objectclass' SUP top MAY ( cn ) X-ORIGIN 'Netscape Directory Server' )
diff --git a/ldap/schema/50ns-mail.ldif b/ldap/schema/50ns-mail.ldif
index 3e4783e..53d7669 100644
--- a/ldap/schema/50ns-mail.ldif
+++ b/ldap/schema/50ns-mail.ldif
@@ -18,7 +18,7 @@ attributeTypes: ( 2.16.840.1.113730.3.1.707 NAME ( 'vacationstartdate' ) DESC 'N
attributeTypes: ( 2.16.840.1.113730.3.1.18 NAME ( 'mailHost' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.33 NAME ( 'mgrpModerator' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.25 NAME ( 'mgrpDeliverTo' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
-attributeTypes: ( 1.3.6.1.4.1.42.2.27.10.1.81 NAME ( 'mgrpApprovePassword' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( mgrpApprovePassword-oid NAME ( 'mgrpApprovePassword' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.31 NAME ( 'mailEnhancedUniqueMember' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.781 NAME ( 'mgrpAddHeader' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.22 NAME ( 'mgrpAllowedBroadcaster' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
@@ -39,7 +39,7 @@ attributeTypes: ( 2.16.840.1.113730.3.1.520 NAME ( 'nswmExtendedUserPrefs' ) DES
attributeTypes: ( 2.16.840.1.113730.3.1.26 NAME ( 'mgrpErrorsTo' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.23 NAME ( 'mgrpAllowedDomain' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.28 NAME ( 'mgrpMsgRejectAction' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
-attributeTypes: ( 1.3.6.1.4.1.42.2.27.10.1.79 NAME ( 'nsmsgDisallowAccess' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
+attributeTypes: ( nsmsgDisallowAccess-oid NAME ( 'nsmsgDisallowAccess' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.17 NAME ( 'mailForwardingAddress' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.32 NAME ( 'mgrpMsgMaxSize' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Messaging Server 4.x' )
attributeTypes: ( 2.16.840.1.113730.3.1.29 NAME ( 'mgrpMsgRejectText' ) DESC 'Netscape Messaging Server 4.x defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape Messaging Server 4.x' )
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch 389-ds-base-1.3.9 updated: Issue 50426 - nsSSL3Ciphers is limited to 1024 characters
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.3.9
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push:
new 6a28647 Issue 50426 - nsSSL3Ciphers is limited to 1024 characters
6a28647 is described below
commit 6a28647a42cc550d62fd05e7db3a2f630ff6e55c
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Fri Jun 7 09:21:31 2019 -0400
Issue 50426 - nsSSL3Ciphers is limited to 1024 characters
Bug Description: There was a hardcoded buffer for processing TLS ciphers.
Anything over 1024 characters was truncated and was not
applied.
Fix Description: Don't use a fixed size buffer and just use the entire
string. When printing errors about invalid format then
we must use a fixed sized buffer, but we will truncate
that log value as to not exceed the ssl logging function's
buffer, and still output a useful message.
ASAN approved
https://pagure.io/389-ds-base/issue/50426
Reviewed by: firstyear, tbordaz, and spichugi (Thanks!!!)
(cherry picked from commit 22f2f9a1502e63bb169b7d599b5a3b35ddb31b8a)
---
dirsrvtests/tests/suites/tls/cipher_test.py | 51 +++++++++++++++++++++++++++++
ldap/servers/slapd/ssl.c | 34 +++++++++----------
2 files changed, 66 insertions(+), 19 deletions(-)
diff --git a/dirsrvtests/tests/suites/tls/cipher_test.py b/dirsrvtests/tests/suites/tls/cipher_test.py
new file mode 100644
index 0000000..0589310
--- /dev/null
+++ b/dirsrvtests/tests/suites/tls/cipher_test.py
@@ -0,0 +1,51 @@
+import pytest
+import os
+from lib389.config import Encryption
+from lib389.topologies import topology_st as topo
+
+
+def test_long_cipher_list(topo):
+ """Test a long cipher list, and makre sure it is not truncated
+
+ :id: bc400f54-3966-49c8-b640-abbf4fb2377d
+ :setup: Standalone Instance
+ :steps:
+ 1. Set nsSSL3Ciphers to a very long list of ciphers
+ 2. Ciphers are applied correctly
+ :expectedresults:
+ 1. Success
+ 2. Success
+ """
+ ENABLED_CIPHER = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256"
+ DISABLED_CIPHER = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128"
+ CIPHER_LIST = (
+ "-all,-SSL_CK_RC4_128_WITH_MD5,-SSL_CK_RC4_128_EXPORT40_WITH_MD5,-SSL_CK_RC2_128_CBC_WITH_MD5,"
+ "-SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL_CK_DES_64_CBC_WITH_MD5,-SSL_CK_DES_192_EDE3_CBC_WITH_MD5,"
+ "-TLS_RSA_WITH_RC4_128_MD5,-TLS_RSA_WITH_RC4_128_SHA,-TLS_RSA_WITH_3DES_EDE_CBC_SHA,"
+ "-TLS_RSA_WITH_DES_CBC_SHA,-SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,"
+ "-TLS_RSA_EXPORT_WITH_RC4_40_MD5,-TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-TLS_RSA_WITH_NULL_MD5,"
+ "-TLS_RSA_WITH_NULL_SHA,-TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,-SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,"
+ "-SSL_FORTEZZA_DMS_WITH_RC4_128_SHA,-SSL_FORTEZZA_DMS_WITH_NULL_SHA,-TLS_DHE_DSS_WITH_DES_CBC_SHA,"
+ "-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_DES_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,"
+ "+TLS_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,"
+ "+TLS_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,"
+ "-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_DHE_DSS_WITH_RC4_128_SHA,-TLS_ECDHE_RSA_WITH_RC4_128_SHA,"
+ "-TLS_RSA_WITH_NULL_SHA,-TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,-SSL_CK_DES_192_EDE3_CBC_WITH_MD5,"
+ "-TLS_RSA_WITH_RC4_128_MD5,-TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,"
+ "-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+ )
+
+ topo.standalone.enable_tls()
+ enc = Encryption(topo.standalone)
+ enc.set('nsSSL3Ciphers', CIPHER_LIST)
+ topo.standalone.restart()
+ enabled_ciphers = enc.get_attr_vals_utf8('nssslenabledciphers')
+ assert ENABLED_CIPHER in enabled_ciphers
+ assert DISABLED_CIPHER not in enabled_ciphers
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main(["-s", CURRENT_FILE])
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index b8eba2d..ed054db 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -95,7 +95,6 @@ static char *configDN = "cn=encryption,cn=config";
#define CIPHER_SET_ALLOWWEAKDHPARAM 0x200 /* allowWeakDhParam is on */
#define CIPHER_SET_DISALLOWWEAKDHPARAM 0x400 /* allowWeakDhParam is off */
-
#define CIPHER_SET_ISDEFAULT(flag) \
(((flag)&CIPHER_SET_DEFAULT) ? PR_TRUE : PR_FALSE)
#define CIPHER_SET_ISALL(flag) \
@@ -689,10 +688,12 @@ _conf_setciphers(char *setciphers, int flags)
active = 0;
break;
default:
- PR_snprintf(err, sizeof(err), "invalid ciphers <%s>: format is "
- "+cipher1,-cipher2...",
- raw);
- return slapi_ch_strdup(err);
+ if (strlen(raw) > MAGNUS_ERROR_LEN) {
+ PR_snprintf(err, sizeof(err) - 3, "%s...", raw);
+ return slapi_ch_smprintf("invalid ciphers <%s>: format is +cipher1,-cipher2...", err);
+ } else {
+ return slapi_ch_smprintf("invalid ciphers <%s>: format is +cipher1,-cipher2...", raw);
+ }
}
if ((t = strchr(setciphers, ',')))
*t++ = '\0';
@@ -1689,7 +1690,6 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
PRUint16 NSSVersionMax = enabledNSSVersions.max;
char mymin[VERSION_STR_LENGTH], mymax[VERSION_STR_LENGTH];
char newmax[VERSION_STR_LENGTH];
- char cipher_string[1024];
int allowweakcipher = CIPHER_SET_DEFAULTWEAKCIPHER;
int_fast16_t renegotiation = (int_fast16_t)SSL_RENEGOTIATE_REQUIRES_XTN;
@@ -1730,21 +1730,17 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
"Ignoring it and set it to default.", val, configDN);
}
}
- slapi_ch_free((void **)&val);
+ slapi_ch_free_string(&val);
/* Set SSL cipher preferences */
- *cipher_string = 0;
- if (ciphers && (*ciphers) && PL_strcmp(ciphers, "blank"))
- PL_strncpyz(cipher_string, ciphers, sizeof(cipher_string));
- slapi_ch_free((void **)&ciphers);
-
- if (NULL != (val = _conf_setciphers(cipher_string, allowweakcipher))) {
+ if (NULL != (val = _conf_setciphers(ciphers, allowweakcipher))) {
errorCode = PR_GetError();
slapd_SSL_warn("Failed to set SSL cipher "
"preference information: %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
val, errorCode, slapd_pr_strerror(errorCode));
- slapi_ch_free((void **)&val);
+ slapi_ch_free_string(&val);
}
+ slapi_ch_free_string(&ciphers);
freeConfigEntry(&e);
/* Import pr fd into SSL */
@@ -1815,12 +1811,12 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
activation = slapi_entry_attr_get_charptr(e, "nssslactivation");
if ((!activation) || (!PL_strcasecmp(activation, "off"))) {
/* this family was turned off, goto next */
- slapi_ch_free((void **)&activation);
+ slapi_ch_free_string(&activation);
freeConfigEntry(&e);
continue;
}
- slapi_ch_free((void **)&activation);
+ slapi_ch_free_string(&activation);
token = slapi_entry_attr_get_charptr(e, "nsssltoken");
personality = slapi_entry_attr_get_charptr(e, "nssslpersonalityssl");
@@ -1837,8 +1833,8 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
"family information. Missing nsssltoken or"
"nssslpersonalityssl in %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
*family, errorCode, slapd_pr_strerror(errorCode));
- slapi_ch_free((void **)&token);
- slapi_ch_free((void **)&personality);
+ slapi_ch_free_string(&token);
+ slapi_ch_free_string(&personality);
freeConfigEntry(&e);
continue;
}
@@ -1865,7 +1861,7 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
"private key for cert %s of family %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
cert_name, *family,
errorCode, slapd_pr_strerror(errorCode));
- slapi_ch_free((void **)&personality);
+ slapi_ch_free_string(&personality);
CERT_DestroyCertificate(cert);
cert = NULL;
freeConfigEntry(&e);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch 389-ds-base-1.4.0 updated: Issue 50426 - nsSSL3Ciphers is limited to 1024 characters
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.0
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.0 by this push:
new 1cb4e7d Issue 50426 - nsSSL3Ciphers is limited to 1024 characters
1cb4e7d is described below
commit 1cb4e7d007a349feda78371bb9558befa8ac3392
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Fri Jun 7 09:21:31 2019 -0400
Issue 50426 - nsSSL3Ciphers is limited to 1024 characters
Bug Description: There was a hardcoded buffer for processing TLS ciphers.
Anything over 1024 characters was truncated and was not
applied.
Fix Description: Don't use a fixed size buffer and just use the entire
string. When printing errors about invalid format then
we must use a fixed sized buffer, but we will truncate
that log value as to not exceed the ssl logging function's
buffer, and still output a useful message.
ASAN approved
https://pagure.io/389-ds-base/issue/50426
Reviewed by: firstyear, tbordaz, and spichugi (Thanks!!!)
(cherry picked from commit 22f2f9a1502e63bb169b7d599b5a3b35ddb31b8a)
---
dirsrvtests/tests/suites/tls/cipher_test.py | 51 +++++++++++++++++++++++++++++
ldap/servers/slapd/ssl.c | 34 +++++++++----------
2 files changed, 66 insertions(+), 19 deletions(-)
diff --git a/dirsrvtests/tests/suites/tls/cipher_test.py b/dirsrvtests/tests/suites/tls/cipher_test.py
new file mode 100644
index 0000000..0589310
--- /dev/null
+++ b/dirsrvtests/tests/suites/tls/cipher_test.py
@@ -0,0 +1,51 @@
+import pytest
+import os
+from lib389.config import Encryption
+from lib389.topologies import topology_st as topo
+
+
+def test_long_cipher_list(topo):
+ """Test a long cipher list, and makre sure it is not truncated
+
+ :id: bc400f54-3966-49c8-b640-abbf4fb2377d
+ :setup: Standalone Instance
+ :steps:
+ 1. Set nsSSL3Ciphers to a very long list of ciphers
+ 2. Ciphers are applied correctly
+ :expectedresults:
+ 1. Success
+ 2. Success
+ """
+ ENABLED_CIPHER = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384::AES-GCM::AEAD::256"
+ DISABLED_CIPHER = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256::AES-GCM::AEAD::128"
+ CIPHER_LIST = (
+ "-all,-SSL_CK_RC4_128_WITH_MD5,-SSL_CK_RC4_128_EXPORT40_WITH_MD5,-SSL_CK_RC2_128_CBC_WITH_MD5,"
+ "-SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL_CK_DES_64_CBC_WITH_MD5,-SSL_CK_DES_192_EDE3_CBC_WITH_MD5,"
+ "-TLS_RSA_WITH_RC4_128_MD5,-TLS_RSA_WITH_RC4_128_SHA,-TLS_RSA_WITH_3DES_EDE_CBC_SHA,"
+ "-TLS_RSA_WITH_DES_CBC_SHA,-SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,"
+ "-TLS_RSA_EXPORT_WITH_RC4_40_MD5,-TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-TLS_RSA_WITH_NULL_MD5,"
+ "-TLS_RSA_WITH_NULL_SHA,-TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,-SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,"
+ "-SSL_FORTEZZA_DMS_WITH_RC4_128_SHA,-SSL_FORTEZZA_DMS_WITH_NULL_SHA,-TLS_DHE_DSS_WITH_DES_CBC_SHA,"
+ "-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_DES_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,"
+ "+TLS_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,"
+ "+TLS_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,"
+ "-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_DHE_DSS_WITH_RC4_128_SHA,-TLS_ECDHE_RSA_WITH_RC4_128_SHA,"
+ "-TLS_RSA_WITH_NULL_SHA,-TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,-SSL_CK_DES_192_EDE3_CBC_WITH_MD5,"
+ "-TLS_RSA_WITH_RC4_128_MD5,-TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,"
+ "-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+ )
+
+ topo.standalone.enable_tls()
+ enc = Encryption(topo.standalone)
+ enc.set('nsSSL3Ciphers', CIPHER_LIST)
+ topo.standalone.restart()
+ enabled_ciphers = enc.get_attr_vals_utf8('nssslenabledciphers')
+ assert ENABLED_CIPHER in enabled_ciphers
+ assert DISABLED_CIPHER not in enabled_ciphers
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main(["-s", CURRENT_FILE])
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 2d7bc2b..a89b1de 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -95,7 +95,6 @@ static char *configDN = "cn=encryption,cn=config";
#define CIPHER_SET_ALLOWWEAKDHPARAM 0x200 /* allowWeakDhParam is on */
#define CIPHER_SET_DISALLOWWEAKDHPARAM 0x400 /* allowWeakDhParam is off */
-
#define CIPHER_SET_ISDEFAULT(flag) \
(((flag)&CIPHER_SET_DEFAULT) ? PR_TRUE : PR_FALSE)
#define CIPHER_SET_ISALL(flag) \
@@ -694,10 +693,12 @@ _conf_setciphers(char *setciphers, int flags)
active = 0;
break;
default:
- PR_snprintf(err, sizeof(err), "invalid ciphers <%s>: format is "
- "+cipher1,-cipher2...",
- raw);
- return slapi_ch_strdup(err);
+ if (strlen(raw) > MAGNUS_ERROR_LEN) {
+ PR_snprintf(err, sizeof(err) - 3, "%s...", raw);
+ return slapi_ch_smprintf("invalid ciphers <%s>: format is +cipher1,-cipher2...", err);
+ } else {
+ return slapi_ch_smprintf("invalid ciphers <%s>: format is +cipher1,-cipher2...", raw);
+ }
}
if ((t = strchr(setciphers, ',')))
*t++ = '\0';
@@ -1694,7 +1695,6 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
PRUint16 NSSVersionMax = enabledNSSVersions.max;
char mymin[VERSION_STR_LENGTH], mymax[VERSION_STR_LENGTH];
char newmax[VERSION_STR_LENGTH];
- char cipher_string[1024];
int allowweakcipher = CIPHER_SET_DEFAULTWEAKCIPHER;
int_fast16_t renegotiation = (int_fast16_t)SSL_RENEGOTIATE_REQUIRES_XTN;
@@ -1735,21 +1735,17 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
"Ignoring it and set it to default.", val, configDN);
}
}
- slapi_ch_free((void **)&val);
+ slapi_ch_free_string(&val);
/* Set SSL cipher preferences */
- *cipher_string = 0;
- if (ciphers && (*ciphers) && PL_strcmp(ciphers, "blank"))
- PL_strncpyz(cipher_string, ciphers, sizeof(cipher_string));
- slapi_ch_free((void **)&ciphers);
-
- if (NULL != (val = _conf_setciphers(cipher_string, allowweakcipher))) {
+ if (NULL != (val = _conf_setciphers(ciphers, allowweakcipher))) {
errorCode = PR_GetError();
slapd_SSL_warn("Failed to set SSL cipher "
"preference information: %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
val, errorCode, slapd_pr_strerror(errorCode));
- slapi_ch_free((void **)&val);
+ slapi_ch_free_string(&val);
}
+ slapi_ch_free_string(&ciphers);
freeConfigEntry(&e);
/* Import pr fd into SSL */
@@ -1820,12 +1816,12 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
activation = slapi_entry_attr_get_charptr(e, "nssslactivation");
if ((!activation) || (!PL_strcasecmp(activation, "off"))) {
/* this family was turned off, goto next */
- slapi_ch_free((void **)&activation);
+ slapi_ch_free_string(&activation);
freeConfigEntry(&e);
continue;
}
- slapi_ch_free((void **)&activation);
+ slapi_ch_free_string(&activation);
token = slapi_entry_attr_get_charptr(e, "nsssltoken");
personality = slapi_entry_attr_get_charptr(e, "nssslpersonalityssl");
@@ -1842,8 +1838,8 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
"family information. Missing nsssltoken or"
"nssslpersonalityssl in %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
*family, errorCode, slapd_pr_strerror(errorCode));
- slapi_ch_free((void **)&token);
- slapi_ch_free((void **)&personality);
+ slapi_ch_free_string(&token);
+ slapi_ch_free_string(&personality);
freeConfigEntry(&e);
continue;
}
@@ -1870,7 +1866,7 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
"private key for cert %s of family %s (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
cert_name, *family,
errorCode, slapd_pr_strerror(errorCode));
- slapi_ch_free((void **)&personality);
+ slapi_ch_free_string(&personality);
CERT_DestroyCertificate(cert);
cert = NULL;
freeConfigEntry(&e);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch 389-ds-base-1.3.9 updated: Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
tbordaz pushed a commit to branch 389-ds-base-1.3.9
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push:
new f00f35c Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
f00f35c is described below
commit f00f35c43fc5cd23ebd21bd0bddd005679c73b11
Author: Thierry Bordaz <tbordaz(a)redhat.com>
AuthorDate: Fri Jun 7 11:35:46 2019 +0200
Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
Bug Description:
When a search request contains invalid parameters (attribute list with empty attribute
name, unknown scope, invalid filter..) the search is rejected but the access log
contains a wrong base search: ... SRCH base="(null)"...
This is because it does not use for logging the variable that gather the actual base ('rawbase')
Fix Description:
Use 'rawbase' value for logging
https://pagure.io/389-ds-base/issue/50428
Reviewed by: Mark Reynolds
Platforms tested: F28
Flag Day: no
Doc impact: no
---
ldap/servers/slapd/search.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index 7e253f5..2a99795 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -154,6 +154,7 @@ do_search(Slapi_PBlock *pb)
goto free_and_return;
}
}
+ base = rawbase;
/*
* ignore negative time and size limits since they make no sense
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch 389-ds-base-1.4.0 updated: Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
tbordaz pushed a commit to branch 389-ds-base-1.4.0
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.0 by this push:
new 9349a24 Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
9349a24 is described below
commit 9349a248369a923591747bb9ded8b35770d24116
Author: Thierry Bordaz <tbordaz(a)redhat.com>
AuthorDate: Fri Jun 7 11:35:46 2019 +0200
Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
Bug Description:
When a search request contains invalid parameters (attribute list with empty attribute
name, unknown scope, invalid filter..) the search is rejected but the access log
contains a wrong base search: ... SRCH base="(null)"...
This is because it does not use for logging the variable that gather the actual base ('rawbase')
Fix Description:
Use 'rawbase' value for logging
https://pagure.io/389-ds-base/issue/50428
Reviewed by: Mark Reynolds
Platforms tested: F28
Flag Day: no
Doc impact: no
---
ldap/servers/slapd/search.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index 7e253f5..2a99795 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -154,6 +154,7 @@ do_search(Slapi_PBlock *pb)
goto free_and_return;
}
}
+ base = rawbase;
/*
* ignore negative time and size limits since they make no sense
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch 389-ds-base-1.3.9 updated: Ticket 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
tbordaz pushed a commit to branch 389-ds-base-1.3.9
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push:
new 33ac4f5 Ticket 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS
33ac4f5 is described below
commit 33ac4f5a78d1a42385d1c011d88cef26771e99f5
Author: Thierry Bordaz <tbordaz(a)redhat.com>
AuthorDate: Wed May 15 17:46:14 2019 +0200
Ticket 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS
Bug Description:
A secure socket is configured in blocking mode. If an event
is detected on a secure socket a worker tries to receive the request.
If handshake occurs during the read, it can hang longer than
ioblocktimeout because it takes into account the socket option
rather than the timeout used for the ssl_Recv
Fix Description:
The fix is specific to secure socket and set this socket option
to do non blocking IO.
https://pagure.io/389-ds-base/issue/50329
Reviewed by: ?
Platforms tested: F28, RHEL7.6
Flag Day: no
Doc impact: no
---
ldap/servers/slapd/daemon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 4841a8a..afe0fb7 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -3193,7 +3193,7 @@ configure_pr_socket(PRFileDesc **pr_socket, int secure, int local)
if (secure) {
pr_socketoption.option = PR_SockOpt_Nonblocking;
- pr_socketoption.value.non_blocking = 0;
+ pr_socketoption.value.non_blocking = 1;
if (PR_SetSocketOption(*pr_socket, &pr_socketoption) == PR_FAILURE) {
PRErrorCode prerr = PR_GetError();
slapi_log_err(SLAPI_LOG_ERR,
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch 389-ds-base-1.4.0 updated: Ticket 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
tbordaz pushed a commit to branch 389-ds-base-1.4.0
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.0 by this push:
new 7b0e7f6 Ticket 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS
7b0e7f6 is described below
commit 7b0e7f6f51f6a117f6a40aa3967cad656eafb811
Author: Thierry Bordaz <tbordaz(a)redhat.com>
AuthorDate: Wed May 15 17:46:14 2019 +0200
Ticket 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS
Bug Description:
A secure socket is configured in blocking mode. If an event
is detected on a secure socket a worker tries to receive the request.
If handshake occurs during the read, it can hang longer than
ioblocktimeout because it takes into account the socket option
rather than the timeout used for the ssl_Recv
Fix Description:
The fix is specific to secure socket and set this socket option
to do non blocking IO.
https://pagure.io/389-ds-base/issue/50329
Reviewed by: ?
Platforms tested: F28, RHEL7.6
Flag Day: no
Doc impact: no
---
ldap/servers/slapd/daemon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index c77e1f1..b1d41c8 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -3191,7 +3191,7 @@ configure_pr_socket(PRFileDesc **pr_socket, int secure, int local)
if (secure) {
pr_socketoption.option = PR_SockOpt_Nonblocking;
- pr_socketoption.value.non_blocking = 0;
+ pr_socketoption.value.non_blocking = 1;
if (PR_SetSocketOption(*pr_socket, &pr_socketoption) == PR_FAILURE) {
PRErrorCode prerr = PR_GetError();
slapi_log_err(SLAPI_LOG_ERR,
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months
[389-ds-base] branch 389-ds-base-1.3.9 updated: Ticket 50389 - ns-slapd craches while two threads are polling the same connection
by pagure@pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.3.9
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.3.9 by this push:
new 5f40c02 Ticket 50389 - ns-slapd craches while two threads are polling the same connection
5f40c02 is described below
commit 5f40c02e7dffca61e675a1e4771971c683f1c404
Author: Thierry Bordaz <tbordaz(a)redhat.com>
AuthorDate: Fri May 17 14:31:45 2019 +0200
Ticket 50389 - ns-slapd craches while two threads are polling the same connection
Bug Description:
nspr IO is not multi-threaded safe.
389-ds should not be in a situation where several threads are polling
a same connection at the same time.
The scenario is a worker send back an operation result at the same time
another worker wants to read an incoming request.
Fix Description:
The fix consist in synchonizing polling with c_pdumutex.
The thread that sends data (flush_ber) hold c_pdumutex.
The thread that reads the data does a non blocking read. It then
enforce ioblocktimeout with iteration of poll.
The reading thread must hold c_pdumutex during poll to synchronize
with the reader thread.
The reading thread must poll with a small timeout
(CONN_TURBO_TIMEOUT_INTERVAL). In order to not block
the thread that send back data, the fix reduces the delay to 0.1s.
https://pagure.io/389-ds-base/issue/50389
Reviewed by: Mark Reynolds, Matus Honek, William Brown
Platforms tested: F28
Flag Day: no
Doc impact: no
(cherry picked from commit 2886ba77f664e4734a7ddfe4146f229caca49ce4)
---
ldap/servers/slapd/connection.c | 5 ++++-
ldap/servers/slapd/daemon.c | 2 ++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index 53d2c51..845a670 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -932,7 +932,8 @@ connection_free_private_buffer(Connection *conn)
#define CONN_DONE 3
#define CONN_TIMEDOUT 4
-#define CONN_TURBO_TIMEOUT_INTERVAL 1000 /* milliseconds */
+#define CONN_TURBO_TIMEOUT_INTERVAL 100 /* milliseconds */
+#define CONN_TURBO_TIMEOUT_MAXIMUM 5 /* attempts * interval IE 2000ms with 400 * 5 */
#define CONN_TURBO_CHECK_INTERVAL 5 /* seconds */
#define CONN_TURBO_PERCENTILE 50 /* proportion of threads allowed to be in turbo mode */
#define CONN_TURBO_HYSTERESIS 0 /* avoid flip flopping in and out of turbo mode */
@@ -1208,7 +1209,9 @@ connection_read_operation(Connection *conn, Operation *op, ber_tag_t *tag, int *
pr_pd.fd = (PRFileDesc *)conn->c_prfd;
pr_pd.in_flags = PR_POLL_READ;
pr_pd.out_flags = 0;
+ PR_Lock(conn->c_pdumutex);
ret = PR_Poll(&pr_pd, 1, timeout);
+ PR_Unlock(conn->c_pdumutex);
waits_done++;
/* Did we time out ? */
if (0 == ret) {
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index c77e1f1..4841a8a 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1943,6 +1943,8 @@ ns_handle_pr_read_ready(struct ns_job_t *job)
* or something goes seriously wrong. Otherwise, return 0.
* If -1 is returned, PR_GetError() explains why.
* Revision: handle changed to void * to allow 64bit support
+ *
+ * Caller (flush_ber) must hold conn->c_pdumutex
*/
static int
slapd_poll(void *handle, int output)
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 10 months