ldap/servers/slapd/back-ldbm/import-threads.c | 5 ++-- ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c | 9 +++++++ ldap/servers/slapd/entry.c | 24 +++++++++++++++++-- ldap/servers/slapd/init.c | 2 + ldap/servers/slapd/slapi-private.h | 1 ldap/servers/slapd/tools/dbscan.c | 32 ++++++++++++++++---------- 6 files changed, 56 insertions(+), 17 deletions(-)

New commits: commit 72a3f9b8250a2e426bae432dc87377d2c4a21bd2 Author: Noriko Hosoi nhosoi@redhat.com Date: Thu Oct 10 11:28:14 2013 -0700

Ticket #47530 - dbscan on entryrdn should show all matching values

Bug description: 1) commit bded3015acdd5c71f05ceb10f10af220a02e6f74 was not a complete patch, which was failing in the case the entryrdn key is not given. 2) Coverity 13190: Logically dead code

Fix description: 1) If an entryrdn key is not given, it sets DB_NEXT to the db flag and continues scanning the entryrdn index. 2) The unnecessary checking 0 for the return code rc is removed.

https://fedorahosted.org/389/ticket/47530

Reviewed by rmeggins (Thank you, Rich!!)

diff --git a/ldap/servers/slapd/tools/dbscan.c b/ldap/servers/slapd/tools/dbscan.c index 09eebf4..023fade 100644 --- a/ldap/servers/slapd/tools/dbscan.c +++ b/ldap/servers/slapd/tools/dbscan.c @@ -953,6 +953,7 @@ display_entryrdn_item(DB *db, DBC *cursor, DBT *key) PRUint32 flags = 0; char buffer[RDN_BULK_FETCH_BUFFER_SIZE]; DBT dataret; + int find_key_flag = 0;

/* Setting the bulk fetch buffer */ memset(&data, 0, sizeof(data)); @@ -961,10 +962,11 @@ display_entryrdn_item(DB *db, DBC *cursor, DBT *key) data.data = buffer; data.flags = DB_DBT_USERMEM;

- if (key->data) { /* suffix, if not, dbscan fails. */ + if (key->data) { /* key is given */ /* Position cursor at the matching key */ flags = DB_SET|DB_MULTIPLE; - } else { + find_key_flag = 1; + } else { /* key is not given; scan all */ flags = DB_FIRST|DB_MULTIPLE; } do { @@ -1004,20 +1006,26 @@ display_entryrdn_item(DB *db, DBC *cursor, DBT *key) elem->rdn_elem_nrdn_rdn, indent); } rc = cursor->c_get(cursor, key, &data, DB_NEXT_DUP|DB_MULTIPLE); - if (0 != rc) { + if (rc) { break; } } - if (rc) { - if (DB_BUFFER_SMALL == rc) { - fprintf(stderr, "Entryrdn index is corrupt; " - "data item for key %s is too large for our " - "buffer (need=%d actual=%d)\n", - (char *)key->data, data.size, data.ulen); - } else if (rc != DB_NOTFOUND) { - fprintf(stderr, "Failed to position cursor at the key: %s: %s " - "(%d)\n", (char *)key->data, db_strerror(rc), rc); + /* When it comes here, rc is not 0. */ + if (DB_BUFFER_SMALL == rc) { + fprintf(stderr, "Entryrdn index is corrupt; " + "data item for key %s is too large for our " + "buffer (need=%d actual=%d)\n", + (char *)key->data, data.size, data.ulen); + goto bail; + } else if (rc == DB_NOTFOUND) { + if (find_key_flag) { /* key is given */ + goto bail; /* done */ + } else { /* otherwise, continue scanning. */ + rc = 0; } + } else { + fprintf(stderr, "Failed to position cursor at the key: %s: %s " + "(%d)\n", (char *)key->data, db_strerror(rc), rc); goto bail; } flags = DB_NEXT|DB_MULTIPLE;

commit 39ba12b4170d3d7ff65735dbac544c034eabe690 Author: Noriko Hosoi nhosoi@redhat.com Date: Thu Oct 10 10:38:34 2013 -0700

Ticket #47422 - With 1.3.04 and subtree-renaming OFF, when a user is deleted after restarting the server, the same entry can't be added

Bug description: 1) As reported by baburaje12, regardless of the nsslapd-subtree- rename-switch, "entrydn" was not stored in the id2entry db. The attribute value had to be stored in the db file if the switch was off. Attribute values to avoid storing in the db file are maintained in an array protected_attrs_all statically. "Entrydn" should be dynamic depending on the switch. 2) When the switch is off, import was skipping to generate the parentid index, which leads to skipping to create the entrydn, as well.

Fix description: 1) Instead of keeping "entrydn" in the protected_attrs_all statically, this patch introduces an api set_attr_to_protected_list to add or remove "entrydn" based upon the value of nsslapd-subtree-rename- switch. 2) The condition to create a parentid index is fixed to always create it if the nsslapd-subtree-rename-switch is off.

https://fedorahosted.org/389/ticket/47422

Reviewed by rmeggins (Thank you, Rich!)

diff --git a/ldap/servers/slapd/back-ldbm/import-threads.c b/ldap/servers/slapd/back-ldbm/import-threads.c index 3a3aab8..9191ee3 100644 --- a/ldap/servers/slapd/back-ldbm/import-threads.c +++ b/ldap/servers/slapd/back-ldbm/import-threads.c @@ -2713,9 +2713,10 @@ next: goto error; }

- if (entryrdn_get_switch() /* subtree-rename: on */ && + if ((entryrdn_get_switch() /* subtree-rename: on */ && !slapi_entry_flag_is_set(fi->entry->ep_entry, - SLAPI_ENTRY_FLAG_TOMBSTONE)) { + SLAPI_ENTRY_FLAG_TOMBSTONE)) || + !entryrdn_get_switch()) { /* parentid index * (we have to do this here, because the parentID is dependent on * looking up by entrydn/entryrdn.) diff --git a/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c b/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c index d381166..2550bc9 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c @@ -136,6 +136,15 @@ void entryrdn_set_switch(int val) { entryrdn_switch = val; + + if (entryrdn_switch) { /* entryrdn on */ + /* Don't store entrydn in the db */ + set_attr_to_protected_list(SLAPI_ATTR_ENTRYDN, 0); + } else { /* entryrdn off */ + /* Store entrydn in the db */ + set_attr_to_protected_list(SLAPI_ATTR_ENTRYDN, 1); + } + return; }

diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c index 549f294..59f2340 100644 --- a/ldap/servers/slapd/entry.c +++ b/ldap/servers/slapd/entry.c @@ -76,9 +76,27 @@ static void entry_vattr_free_nolock(Slapi_Entry *e);

/* protected attributes which are not included in the flattened entry, * which will be stored in the db. */ -static char *protected_attrs_all [] = {PSEUDO_ATTR_UNHASHEDUSERPASSWORD, - SLAPI_ATTR_ENTRYDN, - NULL}; +static char **protected_attrs_all = NULL; + +/* + * add or delete attr to or from protected_attr_all list depending on the flag. + * flag: 0 -- add + * 1 -- delete + */ +void +set_attr_to_protected_list(char *attr, int flag) +{ + if (charray_inlist(protected_attrs_all, attr)) { /* attr is in the list */ + if (flag) { /* delete */ + charray_remove(protected_attrs_all, attr, 1); + } + } else { /* attr is not in the list */ + if (!flag) { /* add */ + charray_add(&protected_attrs_all, slapi_ch_strdup(attr)); + } + } +} + #if defined(USE_OLD_UNHASHED) static char *forbidden_attrs [] = {PSEUDO_ATTR_UNHASHEDUSERPASSWORD, NULL}; diff --git a/ldap/servers/slapd/init.c b/ldap/servers/slapd/init.c index 3bf0ea2..e7c8ab8 100644 --- a/ldap/servers/slapd/init.c +++ b/ldap/servers/slapd/init.c @@ -83,6 +83,8 @@ slapd_init() exit( -1 ); }

+ /* Add PSEUDO_ATTR_UNHASHEDUSERPASSWORD to the protected attribute list */ + set_attr_to_protected_list(PSEUDO_ATTR_UNHASHEDUSERPASSWORD, 0); #ifndef HAVE_TIME_R if ((time_func_mutex = PR_NewLock()) == NULL ) { LDAPDebug( LDAP_DEBUG_ANY, diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h index f459e9d..2c60cc4 100644 --- a/ldap/servers/slapd/slapi-private.h +++ b/ldap/servers/slapd/slapi-private.h @@ -337,6 +337,7 @@ int entry_apply_mods( Slapi_Entry *e, LDAPMod **mods ); int is_type_protected(const char *type); int entry_apply_mods_ignore_error( Slapi_Entry *e, LDAPMod **mods, int ignore_error ); int slapi_entries_diff(Slapi_Entry **old_entries, Slapi_Entry **new_entries, int testall, const char *logging_prestr, const int force_update, void *plg_id); +void set_attr_to_protected_list(char *attr, int flag);

/* entrywsi.c */ CSN* entry_assign_operation_csn ( Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *parententry );