ldap/schema/01core389.ldif | 1
ldap/servers/slapd/libglobs.c | 46 +++++++++++++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 2 +
ldap/servers/slapd/saslbind.c | 2 -
ldap/servers/slapd/slap.h | 2 +
5 files changed, 51 insertions(+), 2 deletions(-)
New commits:
commit ac6d8e583c51e5935d697e254e3869c63cbd483f
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Mar 22 13:05:32 2013 -0400
Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC
Bug Description: When FreeIPA is configured with AD trust support, Kerberos
tickets may also contain PAC which makes them bigger than
usually expected (bigger than 2048 B)
Fix Description: Make the default 64k(65536), and allow it to be configurable
using: nsslapd-sasl-max-buffer-size
https://fedorahosted.org/389/ticket/632
Reviewed by: nkinder(Thanks!)
diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif
index ed25bd8..8ef702d 100644
--- a/ldap/schema/01core389.ldif
+++ b/ldap/schema/01core389.ldif
@@ -152,6 +152,7 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2151 NAME
'nsslapd-plugin-depends-on-typ
attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeout'
DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2154 NAME 'nsds5ReplicaBackoffMin' DESC
'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2155 NAME 'nsds5ReplicaBackoffMax' DESC
'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2156 NAME 'nsslapd-sasl-max-buffer-size'
DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
#
# objectclasses
#
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 13f5d8b..b7bc999 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -176,6 +176,8 @@ static int config_set_schemareplace ( const char *attrname, char
*value,
#define DEFAULT_PW_RESETFAILURECOUNT "600"
#define DEFAULT_PW_LOCKDURATION "3600"
#define DEFAULT_NDN_SIZE "20971520"
+#define DEFAULT_SASL_MAXBUFSIZE "65536"
+#define SLAPD_DEFAULT_SASL_MAXBUFSIZE 65536
#ifdef MEMPOOL_EXPERIMENTAL
#define DEFAULT_MEMPOOL_MAXFREELIST "1024"
#endif
@@ -1033,6 +1035,11 @@ static struct config_get_and_set {
CONFIG_SPECIAL_UNHASHED_PW_SWITCH,
(ConfigGetFunc)config_get_unhashed_pw_switch,
DEFAULT_UNHASHED_PW_SWITCH},
+ {CONFIG_SASL_MAXBUFSIZE, config_set_sasl_maxbufsize,
+ NULL, 0,
+ (void**)&global_slapdFrontendConfig.sasl_max_bufsize,
+ CONFIG_INT, (ConfigGetFunc)config_get_sasl_maxbufsize,
+ DEFAULT_SASL_MAXBUFSIZE},
{CONFIG_SEARCH_RETURN_ORIGINAL_TYPE, config_set_return_orig_type_switch,
NULL, 0,
(void**)&global_slapdFrontendConfig.return_orig_type,
@@ -1468,6 +1475,7 @@ FrontendConfig_init () {
cfg->ignore_vattrs = slapi_counter_new();
cfg->sasl_mapping_fallback = slapi_counter_new();
init_sasl_mapping_fallback = LDAP_OFF;
+ cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE;
cfg->unhashed_pw_switch = SLAPD_UNHASHED_PW_ON;
init_return_orig_type = cfg->return_orig_type = LDAP_OFF;
@@ -1731,8 +1739,8 @@ int
config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int
apply )
{
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
- long size;
int retVal = LDAP_SUCCESS;
+ long size;
size = atol(value);
if(size < 0){
@@ -1753,6 +1761,29 @@ config_set_ndn_cache_max_size(const char *attrname, char *value,
char *errorbuf,
}
int
+config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply
)
+{
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ int retVal = LDAP_SUCCESS;
+ int default_size = atoi(DEFAULT_SASL_MAXBUFSIZE);
+ int size;
+
+ size = atoi(value);
+ if(size < default_size){
+ PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
"nsslapd-sasl-max-buffer-size is too low (%d), "
+ "setting to default value (%d).\n",size, default_size);
+ size = default_size;
+ }
+ if(apply){
+ CFG_LOCK_WRITE(slapdFrontendConfig);
+ slapdFrontendConfig->sasl_max_bufsize = size;
+ CFG_UNLOCK_WRITE(slapdFrontendConfig);
+ }
+
+ return retVal;
+}
+
+int
config_set_return_orig_type_switch(const char *attrname, char *value, char *errorbuf, int
apply)
{
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
@@ -4228,6 +4259,19 @@ config_get_port(){
}
int
+config_get_sasl_maxbufsize()
+{
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ int retVal;
+
+ CFG_LOCK_READ(slapdFrontendConfig);
+ retVal = slapdFrontendConfig->sasl_max_bufsize;
+ CFG_UNLOCK_READ(slapdFrontendConfig);
+
+ return retVal;
+}
+
+int
config_get_ignore_vattrs()
{
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 0bb923f..0da266b 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -397,6 +397,7 @@ int config_set_ndn_cache_enabled(const char *attrname, char *value,
char *errorb
int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int
apply);
int config_set_unhashed_pw_switch(const char *attrname, char *value, char *errorbuf, int
apply);
int config_set_return_orig_type_switch(const char *attrname, char *value, char *errorbuf,
int apply);
+int config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int
apply );
#if !defined(_WIN32) && !defined(AIX)
int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int
apply );
@@ -564,6 +565,7 @@ int config_get_ignore_vattrs();
int config_set_sasl_mapping_fallback(const char *attrname, char *value, char *errorbuf,
int apply);
int config_get_sasl_mapping_fallback();
int config_get_unhashed_pw_switch();
+int config_get_sasl_maxbufsize();
PLHashNumber hashNocaseString(const void *key);
PRIntn hashNocaseCompare(const void *v1, const void *v2);
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 78031dc..9119c8a 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -674,7 +674,7 @@ void ids_sasl_server_new(Connection *conn)
}
/* Enable security for this connection */
- secprops.maxbufsize = 2048; /* DBDB: hack */
+ secprops.maxbufsize = config_get_sasl_maxbufsize();
secprops.max_ssf = 0xffffffff;
secprops.min_ssf = config_get_minssf();
/* If anonymous access is disabled, set the appropriate flag */
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index f1cd80e..a19e192 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -2073,6 +2073,7 @@ typedef struct _slapdEntryPoints {
#define CONFIG_ALLOWED_SASL_MECHS "nsslapd-allowed-sasl-mechanisms"
#define CONFIG_IGNORE_VATTRS "nsslapd-ignore-virtual-attrs"
#define CONFIG_SASL_MAPPING_FALLBACK "nsslapd-sasl-mapping-fallback"
+#define CONFIG_SASL_MAXBUFSIZE "nsslapd-sasl-max-buffer-size"
#define CONFIG_SEARCH_RETURN_ORIGINAL_TYPE
"nsslapd-search-return-original-type-switch"
#ifdef MEMPOOL_EXPERIMENTAL
@@ -2297,6 +2298,7 @@ typedef struct _slapdFrontendConfig {
int pagedsizelimit;
char *default_naming_context; /* Default naming context (normalized) */
char *allowed_sasl_mechs; /* comma/space separated list of allowed sasl mechs */
+ int sasl_max_bufsize; /* The max receive buffer size for SASL */
/* disk monitoring */
slapi_onoff_t disk_monitoring;