https://fedorahosted.org/389/ticket/603https://fedorahosted.org/389/attachment/ticket/603/0001-Ticket-603-A-logic-…
Fix description: str2simple sets the strdup'ed type this way:
if ( f->f_choice == LDAP_FILTER_PRESENT ) {
f->f_type = slapi_ch_strdup( str );
} else if ( unescape_filter ) {
f->f_avtype = slapi_ch_strdup( str );
} if ( !unescape_filter ) {
f->f_avtype = slapi_ch_strdup( str );
}
If f_choice is LDAP_FILTER_PRESENT and !unescape_filter is
true, the first strdup'ed string is leaked since f_type
and f_avtype share the same memory. But currently, str2simple
is not called with (unescape_filter == 0). Thus there is no
chance to satisfy the condition. This patch fixes the flaw.
https://fedorahosted.org/389/ticket/490https://fedorahosted.org/389/attachment/ticket/490/0001-Ticket-490-Slow-rol…
Bug description: Role uses the virtual attribute framework.
When the search with a filter including nsrole or a return
attribute list containing nsrole is being processed, the
virtual attribute code checks the entry if the vattr values
are valid or not by examining the watermark. If it is valid,
the values are used as if they are static. If it is not
valid, the entry is evaluated against the role definitions
and dynamically generated virtual attributes are set to the
list (e_virtual_attrs) with the proper watermark.
The current code additionally checks e_virtual_attrs to determine
the entry is already evaluated or not. If it is NULL, it
considers the entry is not yet evaluated and it returns SLAPI_
ENTRY_VATTR_NOT_RESOLVED even if the watermark is valid. That
is, all the entries which do not have virtual attributes are
unnecessarily evaluated every time search with nsrole is executed.
Fix description: This patch does not return SLAPI_ENTRY_VATTR_NOT_
RESOLVED but does SLAPI_ENTRY_VATTR_RESOLVED_ABSENT if e_virtual_
attrs is NULL AND the watermark is valid. By skipping the not-
needed nsrole evaluation, it speeds up the virtual search once
virutual attribute values are placed in the entries in memory.
Comment:
Using test data having 86568 entries in total; 98 nsRoleDefinition entries
and 61542 nsRoleDn among them...
Sample command line:
ldapsearch -LLLx -h localhost -p 389 -D 'cn=directory manager' -w password
-b "dc=example,dc=com" "(nsrole=cn=CN0,o=O0,dc=example,dc=com)" nsrole
It returns 3291 entries with 8321 nsrole attribute values.
With the patch:
nsslapd-ndn-cache-enabled: on
No entries in cache: 0m49.308s
All entries in cache: 0m0.181s
nsslapd-ndn-cache-enabled: off
No entries in cache: 0m51.792s
All entries in cache: 0m0.210s
Without the patch:
nsslapd-ndn-cache-enabled: on
No entries in cache: 0m50.579s
All entries in cache: 0m9.599s
nsslapd-ndn-cache-enabled: off
No entries in cache: 0m52.727s
All entries in cache: 0m9.857s
The patch has no impact on the elapsed time to generate virtual attributes
(No entries in cache). But once they are evaluated and placed in the
entry cache, we could see the improvement (All entries in cache). Please
note that if all the entries in the database have virtual attributes, this
patch would have no effect.
In addition, I tested with nsslapd-ndn-cache-enabled: on and off. It's
not huge, but we could recognize steady improvement. I recommend to
enable the functionality, by default or at least, advertise it more (on
1.3.0 or newer)...
https://fedorahosted.org/389/ticket/561https://fedorahosted.org/389/attachment/ticket/561/0001-Ticket-561-disable-…
Fix description: unhashed password was introduced to give an
opportunity to get the unhashed password to plugins. But it
is not always needed. If it is not, it is preferable to
disable the functionality.
1) Ticket #402 "unhashed#user#password in entry extension"
switched the way how the unhashed password is stored.
It used to be put in the attribute list in the entry.
The #402 patch changed it to store in the entry extension.
To provide the migration period, it has been stored in
the both places. This patch is disabling the old
attribute list method.
2) Introducing a config parameter nsslapd-unhashed-pw-switch
to cn=config. The parameter takes 3 values:
on - unhashed password is stored in the entry extension
and logged in the changelog.
nolog - unhashed password is stored in the entry extension
but not logged in the changelog.
off - unhashed password is not stored in the entry extension.
3) As reported in the ticket #577 "Attribute name unhashed#user
#password is not valid per RFC 4512", the pseudo attribute
type is violating the RFC. Once, disabling to store it in
the attribute list in the entry, the OID is not needed in
the schema any more. Thus, the pseudo attribute type is
eliminated from the schema.
(2013年02月19日 13:17), 389 Project wrote:
> #561: disable writing unhashed#user#password to changelog
> ------------------------------------------+---------------------------
> Reporter: rmeggins | Owner: nhosoi
> Type: enhancement | Status: assigned
> Priority: major | Milestone: 1.3.1
> Component: Replication - General | Version: 1.2.11
> Resolution: | Keywords:
> Blocked By: | Blocking:
> Review: | Ticket origin: Community
> Red Hat Bugzilla: | Screened: 1
> ------------------------------------------+---------------------------
>
> Comment (by nhosoi):
>
>
> }}}
>