dirsrvtests/suites/mep_plugin/mep_test.py | 93 ------------------------------ ldap/admin/src/scripts/DSCreate.pm.in | 9 +- ldap/servers/slapd/daemon.c | 23 ++++++- 3 files changed, 25 insertions(+), 100 deletions(-)

New commits: commit 49aaf98732d1e16dde3edb81272de8203aded21c Author: William Brown firstyear@redhat.com Date: Fri Nov 6 14:56:44 2015 +1000

Ticket 48311 -nunc-stans: Attempt to release connection that is not acquired https://fedorahosted.org/389/ticket/48311

Bug Description: DS with nunc stans enabled produces lots of messages like [13/Oct/2015:11:29:24 -0400] connection - conn=98 fd=161 Attempt to release connection that is not acquired

FixDescription: From the original patch: * Do not call connection_acquire_nolock() inside a PR_ASSERT call. * Also changed other PR_ASSERTs to only be called if DEBUG is set

This additionally guarantees the return codes of these functions since we have removed the PR_ASSERT that previously wrapped these function calls. If these assertions fail, we log to the error log in all cases.

Author: wibrown

Review by: mreynolds, nhosoi (Thanks!)

diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index 90f0523..5d70647 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -1836,7 +1836,12 @@ ns_handle_closure(struct ns_job_t *job) #ifdef DEBUG PR_ASSERT(0 == NS_JOB_IS_THREAD(ns_job_get_type(job))); #else - NS_JOB_IS_THREAD(ns_job_get_type(job)); + /* This doesn't actually confirm it's in the event loop thread, but it's a start */ + if (NS_JOB_IS_THREAD(ns_job_get_type(job)) != 0) { + LDAPDebug2Args(LDAP_DEBUG_ANY, "ns_handle_closure: Attempt to close outside of event loop thread %" NSPRIu64 " for fd=%d\n", + c->c_connid, c->c_sd); + return; + } #endif PR_Lock(c->c_mutex); connection_release_nolock_ext(c, 1); /* release ref acquired for event framework */ @@ -1893,7 +1898,14 @@ ns_connection_post_io_or_closing(Connection *conn) #ifdef DEBUG PR_ASSERT(0 == connection_acquire_nolock(conn)); #else - connection_acquire_nolock(conn); /* event framework now has a reference */ + if (connection_acquire_nolock(conn) != 0) { /* event framework now has a reference */ + /* + * This has already been logged as an error in ./ldap/servers/slapd/connection.c + * The error occurs when we get a connection in a closing state. + * For now we return, but there is probably a better way to handle the error case. + */ + return; + } #endif ns_add_io_timeout_job(conn->c_tp, conn->c_prfd, &tv, NS_JOB_READ|NS_JOB_PRESERVE_FD, @@ -1919,7 +1931,12 @@ ns_handle_pr_read_ready(struct ns_job_t *job) #ifdef DEBUG PR_ASSERT(0 == NS_JOB_IS_THREAD(ns_job_get_type(job))); #else - NS_JOB_IS_THREAD(ns_job_get_type(job)); + /* This doesn't actually confirm it's in the event loop thread, but it's a start */ + if (NS_JOB_IS_THREAD(ns_job_get_type(job)) != 0) { + LDAPDebug2Args(LDAP_DEBUG_ANY, "ns_handle_pr_read_ready: Attempt to handle read ready outside of event loop thread %" NSPRIu64 " for fd=%d\n", + c->c_connid, c->c_sd); + return; + } #endif

PR_Lock(c->c_mutex);

commit 7bb6a9a856600a99d9865b3aea02fb59ac975c66 Author: William Brown firstyear@redhat.com Date: Tue Nov 3 09:19:54 2015 +1000

Ticket #48317: SELinux port labeling retry attempts are excessive

https://fedorahosted.org/389/ticket/48317

Bug Description: In dscreate.pm we attempt to label the ldap_port_t type 60 times in the case of a failure. This is excessive, and it means the setup-ds.pl appears to hang in certain cases.

Fix Description: Reduce this number to 5 attempts, and when debug is enabled, display the amount of attempts remaining.

Author: wibrown@redhat.com

Review by: nhosoi@redhat.com (Thank you Noriko!)

diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in index 3ce5a73..7f272f6 100644 --- a/ldap/admin/src/scripts/DSCreate.pm.in +++ b/ldap/admin/src/scripts/DSCreate.pm.in @@ -1011,10 +1011,11 @@ sub updateSelinuxPolicy { if ($need_label == 1) { my $semanage_err; my $rc; - my $retry = 60; + # 60 is a bit excessive, we should fail faster. + my $retry = 5; $ENV{LANG} = "C"; while (($retry > 0) && ($semanage_err = `semanage port -a -t ldap_port_t -p tcp $inf->{slapd}->{ServerPort} 2>&1`) && ($rc = $?)) { - debug(1, "Adding port $inf->{slapd}->{ServerPort} to selinux policy failed - $semanage_err (return code: $rc).\n"); + debug(1, "Adding port $inf->{slapd}->{ServerPort} to selinux policy failed - $semanage_err (return code: $rc, $retry attempts remain).\n"); debug(1, "Retrying in 5 seconds\n"); sleep(5); $retry--; @@ -1413,13 +1414,13 @@ sub removeDSInstance { { my $semanage_err; my $rc; - my $retry = 60; + my $retry = 5; $ENV{LANG} = "C"; while (($retry > 0) && ($semanage_err = `semanage port -d -t ldap_port_t -p tcp $port 2>&1`) && ($rc = $?)) { if (($semanage_err =~ /defined in policy, cannot be deleted/) || ($semanage_err =~ /is not defined/)) { $retry = -1; } else { - debug(1, "Warning: Port $port not removed from selinux policy correctly. Error: $semanage_err\n"); + debug(1, "Warning: Port $port not removed from selinux policy correctly, $retry attempts remain. Error: $semanage_err\n"); debug(1, "Retrying in 5 seconds\n"); sleep(5); $retry--;

commit 02d7b19be95764255f5d948aa5eebf4af49c4ed9 Author: William Brown wibrown@redhat.com Date: Wed Oct 28 09:31:06 2015 +1000

Ticket 48313 - MEP suite tests for major functionality https://fedorahosted.org/389/ticket/48313

http://directory.fedoraproject.org/docs/389ds/design/mep-rework.html http://www.port389.org/docs/389ds/design/managed-entry-design.html

Bug Description: The managed entries plugin works well for the IPA use case, but has a number of shortcomings when used with existing objects. Before the rewrite as described can be carried out, a complete functional test suite of MEP is required to validate the changes made to the plugin do not break existing use cases.

Fix Description: This patch provides tests that cover the current states MEP is capable of handling. This does not cover the states that will be covered by the rework of the plugin.

Author: wibrown

Reviewed by: spichugi (Thank you!)

diff --git a/dirsrvtests/suites/mep_plugin/mep_test.py b/dirsrvtests/suites/mep_plugin/mep_test.py deleted file mode 100644 index 2bda08d..0000000 --- a/dirsrvtests/suites/mep_plugin/mep_test.py +++ /dev/null @@ -1,93 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2015 Red Hat, Inc. -# All rights reserved. -# -# License: GPL (version 3 or any later version). -# See LICENSE for details. -# --- END COPYRIGHT BLOCK --- -# -import os -import sys -import time -import ldap -import logging -import pytest -from lib389 import DirSrv, Entry, tools, tasks -from lib389.tools import DirSrvTools -from lib389._constants import * -from lib389.properties import * -from lib389.tasks import * -from lib389.utils import * - -logging.getLogger(__name__).setLevel(logging.DEBUG) -log = logging.getLogger(__name__) - -installation1_prefix = None - - -class TopologyStandalone(object): - def __init__(self, standalone): - standalone.open() - self.standalone = standalone - - -@pytest.fixture(scope="module") -def topology(request): - global installation1_prefix - if installation1_prefix: - args_instance[SER_DEPLOYED_DIR] = installation1_prefix - - # Creating standalone instance ... - standalone = DirSrv(verbose=False) - args_instance[SER_HOST] = HOST_STANDALONE - args_instance[SER_PORT] = PORT_STANDALONE - args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE - args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX - args_standalone = args_instance.copy() - standalone.allocate(args_standalone) - instance_standalone = standalone.exists() - if instance_standalone: - standalone.delete() - standalone.create() - standalone.open() - - # Clear out the tmp dir - standalone.clearTmpDir(__file__) - - return TopologyStandalone(standalone) - - -def test_mep_init(topology): - ''' - Write any test suite initialization here(if needed) - ''' - - return - - -def test_mep_(topology): - ''' - Write a single test here... - ''' - - return - - -def test_mep_final(topology): - topology.standalone.delete() - log.info('mep test suite PASSED') - - -def run_isolated(): - global installation1_prefix - installation1_prefix = None - - topo = topology(True) - test_mep_init(topo) - test_mep_(topo) - test_mep_final(topo) - - -if __name__ == '__main__': - run_isolated() -