January 2014 - 389-devel - Fedora mailing-lists

Please review: Ticket 47451 - add/enable/disable/remove plugins without server restart
by Mark Reynolds 27 Feb '14

27 Feb '14

https://fedorahosted.org/389/ticket/47451 https://fedorahosted.org/389/attachment/ticket/47451/0001-Ticket-47451-add-… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 1

Please review: Ticket #471 logconv.pl tool removes the access logs contents if "-M" is not correctly used
by Rich Megginson 31 Jan '14

31 Jan '14

https://fedorahosted.org/389/attachment/ticket/471/0001-Ticket-471-logconv.…

1 0

Please review: Ticket #47374 - flush.pl is not included in perl5
by Rich Megginson 31 Jan '14

31 Jan '14

https://fedorahosted.org/389/attachment/ticket/47374/0001-Ticket-47374-flus…

1 0

Please review (take #3) ticket 47653: Need a way to allow users to create entries assigned to themselves
by thierry bordaz 31 Jan '14

31 Jan '14

Thanks Rich and Ludwig for your reviews. Here is the updated fix. https://fedorahosted.org/389/attachment/ticket/47653/0007-Ticket-47653-Need…

1 0

Please review (take #2) ticket 47653: Need a way to allow users to create entries assigned to themselves
by thierry bordaz 31 Jan '14

31 Jan '14

Change: having USERDN and SELFDN using the same DS_LASUserDnAttrEval routine fix: https://fedorahosted.org/389/attachment/ticket/47653/0006-Ticket-47653-Need… test case: https://fedorahosted.org/389/attachment/ticket/47653/0001-Ticket-47653-test…

1 0

Please review: [389 Project] #47570: slapi_ldap_init unusable during independent plugin development
by Noriko Hosoi 30 Jan '14

30 Jan '14

https://fedorahosted.org/389/ticket/47570 https://fedorahosted.org/389/attachment/ticket/47570/0001-Ticket-47570-slap… Description: RFE: making slapi_ldap_init callable without snmp_collator_init. The api slapi_ldap_init calls set_snmp_interaction_row, in which interaction_table_mutex is held. This patch replaces NSPR PR_(Un)Lock with slapi_(un)lock_mutex. The slapi_(un)lock_mutex skips locking if the mutex is not initialized.

1 0

Please review ticket 47653: Need a way to allow users to create entries assigned to themselves
by thierry bordaz 30 Jan '14

30 Jan '14

Finally the choice was to support a new SELFDN keyword in binding rules, as it is easier to read (than using targattrfilter). https://fedorahosted.org/389/attachment/ticket/47653/0005-Ticket-47653-Need…

2 1

Please review (take #2) ticket 47676: Replication of the schema fails 'master branch' -> 1.2.11 or 1.3.1
by thierry bordaz 29 Jan '14

29 Jan '14

In the previous review, the policies (to be applied during replication of the schema) were hardcoded. This new review, is to define them into specific entries under 'cn=replSchema,cn=config" so that it will be configurable. https://fedorahosted.org/389/attachment/ticket/47676/0002-Ticket-ticket4767…

1 0

Please review: [389 Project] #47659: ldbm_usn_init: Valgrind reports Invalid read / SIGSEGV
by Noriko Hosoi 27 Jan '14

27 Jan '14

https://fedorahosted.org/389/ticket/47659 https://fedorahosted.org/389/attachment/ticket/47659/0001-Ticket-47659-ldbm… Bug description: A suffix mapping tree could exist without the corresponding backend. The existing code did not properly check the backend returned from slapi_mapping_tree_find_backend_for_sdn. When NULL backend is returned, it triggers the NULL pointer dereference. Fix description: This patch added a NULL backend check to usn_get_last_usn, and moved a logging to the if clause where the backend is not NULL.

1 0

Please review (tests) 47628: port test cases to new DirSrv interface
by thierry bordaz 24 Jan '14

24 Jan '14

Ticket https://fedorahosted.org/389/ticket/47625 changes the interface of DirSrv. This ticket is the porting side of the test cases to the new interface https://fedorahosted.org/389/attachment/ticket/47628/0001-Ticket-47628-port…

2 10

389-ds-base: /bin/sh scripts should use "." instead of "source"
by Roberto Polli 24 Jan '14

24 Jan '14

Hi @all, iirc /bin/sh scripts should use "." instead of "source" (see http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#dot ) To use "source" you should change the interpreter to be "/bin/bash" lib389@rpolli:~/workspaces/389-ds-base/ds/ldap/admin/src/scripts$ git diff . diff --git a/ldap/admin/src/scripts/ldif2db.in b/ldap/admin/src/scripts/ldif2db.in index ce15349..fb24863 100755 --- a/ldap/admin/src/scripts/ldif2db.in +++ b/ldap/admin/src/scripts/ldif2db.in @@ -1,6 +1,6 @@ #!/bin/sh -source @datadir@/@package_name@/data/DSSharedLib +. @datadir@/@package_name@/data/DSSharedLib libpath_add "@libdir@/@package_name@/" libpath_add "@nss_libdir@" -- Roberto Polli Community Manager Babel - a business unit of Par-Tec S.p.A. - http://www.babel.it T: +39.06.9826.9651 M: +39.340.652.2736 F: +39.06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

3 4

Please review (take 3): [389 Project] #443: Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
by Noriko Hosoi 23 Jan '14

23 Jan '14

https://fedorahosted.org/389/ticket/443 https://fedorahosted.org/389/attachment/ticket/443/0001-Ticket-443-Deleting… Take 3 based upon the suggestions from Rich. This is much less invasive then the previous proposal. Thanks, --noriko

1 0

Please review (take 2): [389 Project] #443: Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
by Noriko Hosoi 22 Jan '14

22 Jan '14

https://fedorahosted.org/389/ticket/443 https://fedorahosted.org/389/attachment/ticket/443/0001-Ticket-443-Deleting… Description: commit 90dd9bb3c1411daca353d055d90618e67aa1fa7e introduced an Invalid read/write. The commit meant to allow "on" and "off" as well as integer 0 and 1 in on/off type of config parameters. But it caused the type mismatch. This patch strictly limits the value to "on" or "off" (in the case insensitive manner).

1 0

please review: Ticket 47641 - 7-bit check plugin not checking MODRDN operation
by Mark Reynolds 22 Jan '14

22 Jan '14

https://fedorahosted.org/389/ticket/47641 https://fedorahosted.org/389/attachment/ticket/47641/0001-Ticket-47641-7-bi… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 0

Please review ticket 47676: Replication of the schema fails 'master branch' -> 1.2.11 or 1.3.1
by thierry bordaz 22 Jan '14

22 Jan '14

https://fedorahosted.org/389/attachment/ticket/47676/0001-Ticket-47676-Repl…

1 0

please review: Ticket 47638 - Overflow in nsslapd-disk-monitoring-threshold on 32bit platforms
by Mark Reynolds 21 Jan '14

21 Jan '14

https://fedorahosted.org/389/ticket/47638 https://fedorahosted.org/389/attachment/ticket/47638/0001-Ticket-47638-Over… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 0

please review: Ticket 47678 - modify-delete userpassword
by Mark Reynolds 20 Jan '14

20 Jan '14

1.2.11 backport of ticket 394 https://fedorahosted.org/389/ticket/47678 https://fedorahosted.org/389/attachment/ticket/47678/0001-Ticket-47678-modi… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 0

Please review: [389 Project] #47677: Size returned by slapi_entry_size is not accurate
by Noriko Hosoi 17 Jan '14

17 Jan '14

https://fedorahosted.org/389/ticket/47677 https://fedorahosted.org/389/attachment/ticket/47677/0001-Ticket-47677-Size… 1) slapi_dn_size implemented as a static function in entry.c is obsolete. It can be replaced with a slapi api slapi_sdn_get_size. 2) size of e_virtual_lock could be added to the size.

1 0

Please review (reopened): [389 Project] #443: Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
by Noriko Hosoi 17 Jan '14

17 Jan '14

https://fedorahosted.org/389/ticket/443 https://fedorahosted.org/389/attachment/ticket/443/0003-Ticket-443-Deleting… Description: commit 90dd9bb3c1411daca353d055d90618e67aa1fa7e introduced an Invalid read. If an empty value is set to on/off type config param, it cannot be distinguished from the internal OFF value '0'. When checking the value other than "on" and "off", the pointer was casted to an integer and evaluated the value. When an empty value is given, it is an empty string "", which size is sizeof(char), not sizeof(int), which caused the Invalid read.

1 0

Please review (reopened): [389 Project] #342: better error message when cache overflows
by Noriko Hosoi 17 Jan '14

17 Jan '14

https://fedorahosted.org/389/ticket/342 https://fedorahosted.org/389/attachment/ticket/342/0001-Ticket-342-better-e… Description: commit 892bf12c1bb8b10afea3d6ff711059bf04e362cc introduced an invalid memory read/write. This patch prepares one extra aclpblock for the acl cache overflow.

1 0

Please review: Ticket #47516 replication stops with excessive clock skew
by Rich Megginson 17 Jan '14

17 Jan '14

https://fedorahosted.org/389/attachment/ticket/47516/0001-Ticket-47516-repl… With the previous patch, the CSN generator was not updated. The server with the greater timestamp could issue update operations that the consumer could not "overrule". With the new patch, the csn generator on the consumer is immediately updated. Note that with this patch, if there is some sort of ntp or vm problem that causes a large system time difference, the large time skews will be immediately propagated everywhere. We need to figure out some way to safely "repair" or "reset" the CSN time generator, or, figure out some way to avoid large time skews altogether.

1 0

please review: Ticket 47620 - Unable to delete replication protocol timeout attribute from agreement
by Mark Reynolds 17 Jan '14

17 Jan '14

https://fedorahosted.org/389/ticket/47620 https://fedorahosted.org/389/attachment/ticket/47620/0001-Ticket-47620-Unab… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 0

plugin problem using slapi_entry_attr_find
by Deas, Jim 17 Jan '14

17 Jan '14

My bet, a rookie mistake. Am I forgetting to init a pointer etc??? Adding the line surrounded by ****** in this routine makes dirsrv unstable and crashes it after a few queries. /* Registered preop_result routine */ int gnest_preop_results( Slapi_PBlock *pb){ Slapi_Entry *e; Slapi_Attr **a; If (slapi_pblock_get( pb, SLAPI_SEARCH_ATTRS, &e) !=0 )return (-1); /*****************This line makes the server unstable and crashes it after one or two queries ********************/ If(slapi_entry_attr_find(e, "memberUid",&a) == 0) slapi_log_error(SLAPI_LOG_PLUGIN, "gnest preop","memberUid found in record); /******************************************************************************************************/ Return (0); } JD

3 11

please review: Ticket 47654 - fix double free when stopping server
by Mark Reynolds 17 Jan '14

17 Jan '14

https://fedorahosted.org/389/ticket/47654 https://fedorahosted.org/389/attachment/ticket/47654/0001-Ticket-47654-fix-… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 0

please review: Ticket 408 - crash when disabling/enabling the normalized dn cache
by Mark Reynolds 17 Jan '14

17 Jan '14

https://fedorahosted.org/389/ticket/408 https://fedorahosted.org/389/attachment/ticket/408/0001-Ticket-408-Fix-cras… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 0

Please review: Ticket #47675 logconv errors when search has invalid bind dn
by Rich Megginson 16 Jan '14

16 Jan '14

https://fedorahosted.org/389/attachment/ticket/47675/0001-Ticket-47675-logc…

1 0

Please review: Ticket #47674 various cleanup - multiple backends, legacy support
by Rich Megginson 15 Jan '14

15 Jan '14

https://fedorahosted.org/389/ticket/47674

1 0

Preop plugin for nested posix groups
by Deas, Jim 15 Jan '14

15 Jan '14

Current and legacy Linux boxes are using posix (memberuid) for rights management. I need to alter this to add one layer of nested groups. The best solution I can currently think of is to write a preop plugin. This plugin would need to find all returned memberuid values starting with a dot and treat them like a nested group, expanding the returned memberuid list with that subgroups memberuid values as well. I.E. two users and two subgroups to expand into users frankJ joycek .engineering .finance Is there a better solution already known? JD

1 0

Please review 47573: schema push can be erroneously prevented
by thierry bordaz 14 Jan '14

14 Jan '14

https://fedorahosted.org/389/attachment/ticket/47573/0001-Ticket-47573-sche…

1 0

Please review: 47629 random crash in send_ldap_search_entry_ext()
by Ludwig Krispenz 14 Jan '14

14 Jan '14

https://fedorahosted.org/389/ticket/47629 https://fedorahosted.org/389/attachment/ticket/47629/0001-Ticket-47629-rand…

1 0

Please review (fixing coverity issues): [389 Project] #47571: targetattr ACIs ignore subtype
by Noriko Hosoi 13 Jan '14

13 Jan '14

https://fedorahosted.org/389/ticket/47571 https://fedorahosted.org/389/attachment/ticket/47571/0001-Ticket-47571-targ… Description: commit 85a78741dfeb636a1cf7cced1576278e65f5bb58 <https://fedorahosted.org/389/changeset/85a78741dfeb636a1cf7cced1576278e65f5…> introduced 2 coverity issues: 12423: Explicit null dereferenced do_search (slapd/search.c) If attribute list contains multiple "*"s and "aci"s in ldapsearch, the previous code attempted to add "aci" once for "*" and replacing "aci" with normalized aci (if any) once and eliminating the duplicated "aci"s. The code contained a null dereferenced bug. Even if duplicated attributes are included in the attribute list, they are removed later in send_specific_attrs. Thus, this patch simplifies the logic to avoid the null dereference. 12422: Logically dead code comp_cmp (slapd/attr.c) Eliminated the dead code (case s1 == NULL AND s2 == NULL).

1 0

Please review ticket 47671 (CI lib389): allow to open a DirSrv without having to create the instance
by thierry bordaz 13 Jan '14

13 Jan '14

https://fedorahosted.org/389/attachment/ticket/47671/0001-Ticket-47671-CI-l…

1 0

Please review 47668 (CI test): port ticket47490_test to Replica/Agreement interface (47600)
by thierry bordaz 13 Jan '14

13 Jan '14

https://fedorahosted.org/389/attachment/ticket/47668/0001-Ticket-47668-test…

1 0

Please review (one line fix): [389 Project] #47660: config_set_allowed_to_delete_attrs: Valgrind reports Invalid read
by Noriko Hosoi 10 Jan '14

10 Jan '14

https://fedorahosted.org/389/ticket/47660 https://fedorahosted.org/389/attachment/ticket/47660/0001-Ticket-47660-conf…

1 0

Re: [389-devel] [Freeipa-devel] [PATCH 0032] Update ACIs to permit users to add/delete their own tokens
by Nathaniel McCallum 10 Jan '14

10 Jan '14

On Thu, 2014-01-09 at 17:37 -0500, Simo Sorce wrote: > On Thu, 2014-01-09 at 16:32 -0500, Nathaniel McCallum wrote: > > This patch is independent from my patches 0028-0031 and can be merged in > > any order. > > > > This patch has a bug, but I can't figure it out. We need to set > > nsslapd-access-userattr-strict on cn=config to "off". > > Uhmm what is the effect on ACL evaluation of changing this boolean ? > I can;t figure out from your commit not from 389ds commit what exactly > changes and how it impacts the security of the directory. > > I ask because I was planning on using userattr to protect some > operations in the password plugin but was waiting due to bug: > https://fedorahosted.org/389/ticket/47571 which is beeing resolved. > > I want to make sure your change won't change what this ACIs would allow. > > Is this option simply allowing the use of add/delete ACIs to be > specified in conjunction with userattr, so that a user can add an attr > only if it contains its own DN ? > > Will it allow the user to add multiple values to the same attr as long > as one of the is the userDN ? O will it restrict that case ? > > (I know that ipaTokenOwner is a single-value attribute, but the > mechanism you are enabling here is general, and I want to be sure of > what the semantics are) After testing, it was determined that the 389DS patch #47653 does in fact permit addition if any of the multi-valued attributes match the condition. This is definitely problematic. After discussion today with nkinder, simo, nhosoi, we agreed to roll-back patch #47653 and find an alternate approach. This also invalidates patch freeipa-npmccallum-0032. Simo will follow up this email with an alternate proposal. Nathaniel

1 0

Please review lib389 ticket 47600 (follow up) :Replica/Agreement/Changelog not conform to the design
by thierry bordaz 10 Jan '14

10 Jan '14

Hi, Rich already reviewed the Replica/RA/Changelog code for lib389. This follow up review is to: * add unit tests for Replica/RA * Fix some bugs found while running the unit tests https://fedorahosted.org/389/attachment/ticket/47600/0001-Ticket-47600-foll…

1 0

Please review (take 2): [389 Project] #47571: targetattr ACIs ignore subtype
by Noriko Hosoi 09 Jan '14

09 Jan '14

https://fedorahosted.org/389/ticket/47571 https://fedorahosted.org/389/attachment/ticket/47571/0001-Ticket-47571-targ… Description: Subtypes in targetattr, userattr in aci as well as filter and attribute list in the search are supported. * If targetattr contains subtypes, the base type only as well as other subtypes are not allowed to access (or denied to access). * If userattr contains subtypes, the base type as well as other subtypes in entries do not match the userattr value. * If attribute list in search has a base type attribute, and a targetattr has a type with subtypes, then only the subtyped value is returned. E.g., attribute list: sn targetattr: sn;en ==> sn;en: <sn-en-value> and sn;en;phonetic: <sn-en-phonetic-value> are returned but sn or sn;fr is not. If attribute list has a type with subtype, then if the targetattr allows the subtype, the value is returned. E.g., attribute list: sn;en targetattr: sn;en ==> sn;en: <sn-en-value> and sn;en;phonetic: <sn-en-phonetic-value> are returned but sn or sn;fr is not. 1) slapd/attr.c * slapi_attr_type_cmp assumed the subtype order in 2 args are identical, but it is not always guaranteed. Removed the assumption. * Added another compare type SLAPI_TYPE_CMP_SUBTYPES to comp_cmp which is called by slapi_attr_type_cmp to support full subtypes comparison. 2) plugin/acl.c: * Changed to call slapi_attr_type_cmp with human readable macros, e.g., SLAPI_TYPE_CMP_BASE, SLAPI_TYPE_CMP_SUBTYPE, etc. * Replaced strcasecmp with slapi_attr_type_cmp for attribute type comparison. * Changed to call slapi_attr_type_cmp with SLAPI_TYPE_CMP_SUBTYPES (full subtype comparison) in acl__get_attrEval, where the next attribute to compare is determined. 3) slapd/search.c,result.c send_all_attrs/send_specific_attrs use a dontsendattr array to control the duplicate attribute types. Replaced the logic with a simpler one by creating an charray with no duplicates.

1 0

ACL: Adding object based on owner attribute
by Nathaniel McCallum 08 Jan '14

08 Jan '14

I'm working on this project: http://www.freeipa.org/page/V3/OTP Users need to be able to create, edit and delete their own tokens. Each token has an attribute: ipatokenOwner. I attempted creating this ACL: (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=example,dc=com")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "token-add-delete"; allow (add, delete) userattr = "ipatokenOwner#USERDN";) After much debugging I found out this is impossible because of this: https://git.fedorahosted.org/cgit/389/ds.git/tree/ldap/servers/plugins/acl/… Now, in the general case, I can very much understand why this shouldn't be allowed by default. What alternatives are there with the current code? Would 389DS be willing to accept a patch to enable this (with a I_KNOW_WHAT_I_AM_DOING flag)? The general reason why this feature works in my case is that each object created restricts the user, rather than granting new privileges. This seems like a valid use case. Nathaniel

3 3

Please review lib389 ticket 47600 :Replica/Agreement/Changelog not conform to the design
by thierry bordaz 07 Jan '14

07 Jan '14

Hi, This review is to adapt the replication interface of lib389 to the design. It only covers lib389 code but not the related unit tests that still need to be implemented. https://fedorahosted.org/389/attachment/ticket/47600/0001-Ticket-47600-Repl…

1 0

ISO 8601 parser
by Nathaniel McCallum 06 Jan '14

06 Jan '14

I just posted this patch: https://www.redhat.com/archives/freeipa-devel/2013-December/msg00229.html 389ds may be interested in the ISO 8601 parser contained in the patch. It offers two main advantages to the one already contained in the 389ds tree: 1. It is *far* more flexible in what it can parse. 2. It is thoroughly tested (currently ~15k tests). Nathaniel

2 1

Please review: Ticket #47657 add schema test suite and tests for Ticket #47634
by Rich Megginson 06 Jan '14

06 Jan '14

https://fedorahosted.org/389/attachment/ticket/47657/0001-Ticket-47657-add-…

1 0

Please review: [389 Project] #47571: targetattr ACIs ignore subtype
by Noriko Hosoi 03 Jan '14

03 Jan '14

https://fedorahosted.org/389/ticket/47571 https://fedorahosted.org/389/attachment/ticket/47571/0001-Ticket-47571-targ… Description: Subtypes in targetattr, userattr in aci as well as filter and attribute list in the search are supported. * If targetattr contains subtypes, the base type only as well as other subtypes are not allowed to access (or denied to access). * If userattr contains subtypes, the base type as well as other subtypes in entries do not match the userattr value. * If attribute list in search has a base type attribute, and a targetattr has a type with subtypes, then only the subtyped value is returned. E.g., attribute list: sn targetattr: sn;en ==> sn;en: <sn-en-value> is returned but sn or sn;fr is not. If attribute list has a type with subtype, then if the targetattr allows the subtype, the value is returned. E.g., attribute list: sn;en targetattr: sn;en ==> sn;en: <sn-en-value> is returned but sn or sn;fr is not. 1) slapd/attr.c Added another compare type SLAPI_TYPE_CMP_SUBTYPES to comp_cmp which is called by slapi_attr_type_cmp to support full compare subtypes. 2) plugin/acl.c: Added a helper function acl__attr_subtype_cmp, which calls slapi_attr_type_ cmp with SLAPI_TYPE_CMP_SUBTYPES if a type in aci contains subtypes. Some slapi_attr_type_cmp takes SLAPI_TYPE_CMP_SUBTYPES instead of BASE, which was one of the causes of ignoring subtypes. 3) slapd/search.c,result.c send_all_attrs/send_specific_attrs use a dontsendattr array to control the duplicate attribute types. Replaced the logic with a simpler one by creating an charray with no duplicates.

1 0

please review: Ticket 47653 - Need a way to allow users to create entries assigned to themselves
by Mark Reynolds 03 Jan '14

03 Jan '14

https://fedorahosted.org/389/ticket/47653 https://fedorahosted.org/389/attachment/ticket/47653/0001-Ticket-47653-Need… -- Mark Reynolds 389 Development Team Red Hat, Inc mreynolds(a)redhat.com

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-devel January 2014