Resolves: bug 262021

Bug Description: Migration script does not migrate nsDS5ReplicaCredentials correctly.
Reviewed by: nkinder (Thanks!)
Fix Description: 7.1 and earlier chaining and replication credentials were stored incorrectly on little endian machines (x86 and itanium).  They were "accidentally" stored correctly on big endian machines (sparc, pa-risc) because val == ntohl(val) on those platforms.  When migrating from a little endian machine, we need to decode the password using the broken algorithm and re-encode it using the good method.  We determine if the password is encode incorrectly by the following method: we use migratecred to decode and encode using the old path.  If the values are equal, this means the password was already encoded correctly and we don't need to fix it.  Otherwise, we set the flag that tells migratecred to fix it.  In order to decode the broken password correctly on big endian machines, we have to swap the byte order to convert the values to little endian.
Platforms tested: RHEL5 x86_64, RHEL5 i386, Solaris 9
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none

2 files changed, 20 insertions, 13 deletions

diff --git a/ldap/admin/src/scripts/DSMigration.pm.in b/ldap/admin/src/scripts/DSMigration.pm.in
index b6d5a7f5..2be45860 100644
--- a/ldap/admin/src/scripts/DSMigration.pm.in
+++ b/ldap/admin/src/scripts/DSMigration.pm.in
@@ -179,10 +179,20 @@ sub getNewDbDir {
 sub migrateCredentials {
     my ($ent, $attr, $mig, $inst) = @_;
     my $oldval = $ent->getValues($attr);
+
+    # Older versions of the server on x86 systems and other systems that do not use network byte order
+    # stored the credentials incorrectly.  The first step is to determine if this is the case.  We
+    # migrate using the same server root to see if we get the same output as we input.
+    debug(3, "In migrateCredentials - see how old credentials were encoded.\n");
+    my $testval = `@bindir@/migratecred -o $mig->{actualsroot}/$inst -n $mig->{actualsroot}/$inst -c \'$oldval\'`;
+    if ($testval ne $oldval) { # need to turn on the special flag
+        debug(3, "Credentials not encoded correctly.  oldval $oldval not equal to testval $testval.  The value will be re-encoded correctly.\n");
+        $ENV{MIGRATE_BROKEN_PWD} = "1"; # decode and re-encode correctly
+    }
+        
     debug(3, "Executing @bindir@/migratecred -o $mig->{actualsroot}/$inst -n @instconfigdir@/$inst -c \'$oldval\' . . .\n");
-    $ENV{MIGRATE_BROKEN_PWD} = "1"; # passwords prior to 8.0 were encrypted incorrectly
     my $newval = `@bindir@/migratecred -o $mig->{actualsroot}/$inst -n @instconfigdir@/$inst -c \'$oldval\'`;
-    delete $ENV{MIGRATE_BROKEN_PWD}; # clear the flag
+    delete $ENV{MIGRATE_BROKEN_PWD}; # clear the flag, if set
     debug(3, "Converted old value [$oldval] to new value [$newval] for attr $attr in entry ", $ent->getDN(), "\n");
     return $newval;
 }
diff --git a/ldap/admin/src/scripts/Migration.pm.in b/ldap/admin/src/scripts/Migration.pm.in
index 0192b97c..aa26a843 100644
--- a/ldap/admin/src/scripts/Migration.pm.in
+++ b/ldap/admin/src/scripts/Migration.pm.in
@@ -128,17 +128,7 @@ e.g.
 or
     "slapd.Suffix=dc=example, dc=com"
 Values passed in this manner will override values in an .inf file
-given with the -f argument.  If you need to specify the cleartext
-directory manager password (e.g. in order to do remote migration),
-you must specify the password for each instance in a section whose
-name is the instance name e.g.
- [slapd-ldap1]
- RootDNPwd=ldap1password
- [slapd-ldap2]
- RootDNPwd=ldap2password
-or on the command line like this:
- command ... slapd-ldap1.RootDNPwd=ldap1password \
-    slapd-ldap2.RootDNPwd=ldap2password ...
+given with the -f argument.
 
 actualsroot:
 This is used when you must migrate from one machine to another.  The
@@ -373,3 +363,10 @@ sub migrateSecurityFiles {
 # Mandatory TRUE return value.
 #
 1;
+
+# emacs settings
+# Local Variables:
+# mode:perl
+# indent-tabs-mode: nil
+# tab-width: 4
+# End: