summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Bug 511112 - Eliminate fixed length array in password history code.Nathan Kinder2009-11-091-12/+34
| | | | | | | | | | | | | | | The password history code was using a fixed length array to store the historical password values that are used to compare to the new password. The array was hardcoded to 25 values. The server will allow a maximum 24 password history values to be kept by limiting the passwordInHistory configuration value, though it would be possible to do something such as import an LDIF with more than 24 historical password values in an entry, causing the server to crash when the next password change occurs. This patch eliminates the fixed length array and dynamically allocates the array based off of the number of values that exist in the entry whose password is being modified.
* 387681 - Fix errors in mapping AD tombstonesNathan Kinder2009-11-061-4/+7
| | | | | | | | | | | | | | | The AD tombstone mapping code is not behaving correctly if a cn contains a comma (such as a "last, first" type value). The code is supposed to locate the first ":" in the tombstone DN, then scan for the first "," after that. Everything between is the GUID. The problem is that the code is starting at the beginning of the string when searching for the "," instead of starting at the ":" that was previously found. This causes the "," in the cn to be found instead, which makes us fail to find the GUID. The fix is to simply start searching for the "," from the ":" in the tombstone DN.
* Allow plugin execution order to be definedNathan Kinder2009-11-045-10/+103
| | | | | | | | | | | | | | | | | | This patch adds support for assigning a precedence to each plugin. This precedence value is used to determine what order the plugins should be called in within a given plugin type. The precedence value is an integer between 1 and 99. The value is set in the nsslapd-pluginPrecedence attribute in a plugin config entry in "cn=config". If a plugin does not have a precedence value set, the plugin is treated as if it has a precedence of 50. For more details, see the feature design document at: http://directory.fedoraproject.org/wiki/Plugin_Ordering I also removed an incorrect log message in the linked attrs plugin that I noticed while debugging this patch.
* 459181 - Add attreplacefile option to ldcltYi Zhang2009-11-025-12/+362
| | | | | | This option will accept format like "-e attreplacefile=jpegPhoto:/some/binary.file" to ldclt. The content of the given file will be used to replace the attribute "jpegPhoto" (in this case). The given file could be plain text or binary file.
* 529909 - Update SELinux policy for SASL GSSAPINathan Kinder2009-10-301-1/+5
| | | | | | | | The dirsrv SELinux policy needs some changes to allow SASL GSSAPI authentication to work. We need to allow ns-slapd to read the krb5.conf file and to create the in memory credentials cache. The kerberos libraries also attempt to open the krb5.conf in write mode, so we need to prevent those attempts from being audited.
* Make removeds.pl remove instance initconfig script389-ds-base-1.2.4Nathan Kinder2009-10-291-0/+10
| | | | | When removing an instance, we need to be sure to remove the instance specific initconfig script.
* bump version to 1.2.4Rich Megginson2009-10-292-11/+11
|
* Bug 529258 - Make upgrade remove obsolete schema from 99user.ldifNathan Kinder2009-10-282-1/+138
| | | | | | | | | | | | | Due to a previously fixed bug (bz 474254), standard schema may have been duplicated in 99user.ldif. When running an upgrade, we need to check the 99user.ldif file to see if any obsolete standard schema is defined there and remove it. This patch makes upgrade backup the original 99user.ldif, and scans it to see if any of the obsolete attributeTypes or objectClasses attributes that we are removing from the standard schema exist in 99user.ldif. We trim the obsolete definitions and write out a new 99user.ldif with the proper permissions.
* Remove blank line from 00core.ldif.Nathan Kinder2009-10-271-1/+0
| | | | | | | | There is an unnecessary blank line in 00core.ldif in the middle of an entry. This isn't causing any server issues since the line does have a space, making it count at part of the previous attribute, but it does through off Mozilla::LDAP::LDIF. The blank line should really be removed.
* BZ 221905 - Add SMD5 password storage support.Nathan Kinder2009-10-2610-39/+323
| | | | | | | This adds SMD5 password storage support to the existing password storage plug-in. Add upgrade LDIF has been added to ensure that this new functionality will be available to servers that are upgraded from previous versions.
* Extend dirsrv SELinux policy interface.Nathan Kinder2009-10-221-4/+25
| | | | | | The dirsrv SELinux policy interface needed to be extended to allow the confined Admin Server the proper permissions to interact with the Directory Server.
* Expose dirsrv SELinux policy interface.Nathan Kinder2009-10-152-1/+168
| | | | | | | | | | This adds a number of interface macros to the dirsrv SELinux policy module. These macros are intended for use by the Administration Server SELinux policy that is currently being developed. I also made some changes to the setup code that labels newly created directories. When the first instance is created, some top-level directories are created that were not being labeled properly.
* more updates - add missing rundir - remove ldapiautodnsuffix389-ds-base-1.2.3Rich Megginson2009-10-076-1/+116
| | | | | | | | | | | | | | Some older releases did not have nsslapd-rundir - upgrading from those releases will cause the server not to start - we must add nsslapd-rundir if it is missing We also got rid of nsslapd-ldapiautodnsuffix, so remove that from the config - it doesn't hurt anything to leave it, but the error message is annoying I also added back a mostly truncated version of 28pilot.ldif because some apps still use pilotObject - those apps should change to use a different objectclass ASAP. Tested on Fedora 11 i386 and x86_64 Reviewed by: nkinder (Thanks!)
* Allow anonymous bind resource limits to be set.Nathan Kinder2009-10-054-3/+53
| | | | | | | | | | | | | This patch adds a new config setting named nsslapd-anonlimitsdn that one can set to the DN of an entry containing the bind-based resource limit attributes to use for operations performed by an anonymous user. This allows the defaults to still be used for all other actual bound users who do not have any user specific resource settings. This implementation approach allows any resource limits that are registered via the reslimit API to work with this anonymous limits template entry.
* Add ssf bind rule to access control plug-in.Nathan Kinder2009-10-0210-19/+225
| | | | | | | | | | | This patch adds a new ssf bind rule keyword to the access control plug-in. This allows you to write ACIs that require a specific level of encryption for the rule to apply. The new keyword can be used with '=', '!=', '<', '>', '<=' and '>=' comparators. I added code that stores the SSF in effect for an operation into the operation struct. The value that we store is the higher of the two between the SASL SSF and the SSL/TLS SSF.
* Add minimum SSF settingNathan Kinder2009-09-3012-4/+162
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a new configuration setting to the cn=config entry named nsslapd-minssf. This can be set to a non-negative integer representing the minimum key strength required to process operations. The default setting will be 0. The SSF for a particular connection will be determined by the key strength cipher used to protect the connection. If the SSF used for a connection does not meet the minimum requirement, the operation will be rejected with an error code of LDAP_UNWILLING_TO_PERFORM (53) along with a message stating that the minimum SSF was not met. Notable exceptions to this are operations that attempt to protect a connection. These operations are: * SASL BIND * startTLS These operations will be allowed to occur on a connection with a SSF less than the minimum. If the results of these operations end up with a SSF smaller than the minimum, they will be rejected. Additionally, we allow UNBIND and ABANDON operations to go through. I also corrected a few issues with the anonymous access switch code that I noticed while testing. We need to allow the startTLS extended operation to go through when sent by an anonymous user since it is common to send startTLS prior to a BIND to protect the credentials. I also noticed that we were using the authtype from the operation struct to determine is a user was anonymous when we really should have been using the DN. This was causing anonymous operations to get through on SSL/TLS connections.
* Updated man page with the new update options and documentation.Rich Megginson2009-09-302-1/+28
|
* Add comment to 00core.ldif to explain why we changedRich Megginson2009-09-301-0/+8
| | | | | the standard definitions of groupOfNames and groupOfUniqueNames to allow empty groups.
* allow empty groupsRich Megginson2009-09-301-6/+6
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=526141 Resolves: bug 526141 Bug Description: allow empty groups Reviewed by: nhosoi (Thanks!) Fix Description: Change groupOfNames and groupOfUniqueNames to allow empty groups by changing the member/uniqueMember attribute from MUST to MAY. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Config schema not included in core schemaRich Megginson2009-09-295-23/+24
| | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=520921 Resolves: bug 520921 Bug Description: Config schema not included in core schema Reviewed by: nkinder (Thanks!) Fix Description: Just had to move a few schema from 02common and 30ns-common into 01core389.ldif. I also added 01core389.ldif to the list of schema installed when install_full_schema=0 is specified with setup-ds.pl. I also added these schema files to the list of schema files to upgrade. With these changes, the server starts up fine. The only error is this: [29/Sep/2009:16:47:53 -0600] - Entry "cn=PAM Pass Through Auth,cn=plugins,cn=config" has unknown object class "pamConfig" This is because the pam pass through plugin is included in the default config. I'd rather not move that schema file. That plugin can be removed from the default config during setup by specifying a slapd.ConfigFile directive with contents like this: dn: cn=PAM Pass Through Auth,cn=plugins,cn=config changetype: delete Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* SASL IO sometimes loops with "error: would block"Rich Megginson2009-09-292-15/+31
| | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=526319 Resolves: bug 526319 Bug Description: SASL IO sometimes loops with "error: would block" Reviewed by: nkinder (Thanks!) Fix Description: The semantics for recv() are that it returns -1 for errors, 0 for connection closed, and non-zero for some bytes received. The sasl code was not using those semantics - it was returning 0 for successful read and -1 for error. Although I have not been able to reproduce the exact failure, what I believe is happening is that the initial read of the packet length in sasl_io_start_packet() works, and the sasl IO is received. At some point, the connection is closed by the client, and the PR_Recv return of 0 is not handled correctly, and somehow the errno gets set to EWOULDBLOCK. From this point on, PR_Recv() will return -1 (since the socket has been closed) and errno is not reset from EWOULDBLOCK. The fix is to make sure the sasl IO code handles the PR_Recv() return value correctly. Note that with CONNS (8) error log level, you may still occasionally see "would block" errors, but as long as they are not endlessly repeating, this should be ok. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 525007 ldif2db replaces existing modify/create name and timestampsNoriko Hosoi2009-09-251-7/+12
| | | | | | | | | | | | | | | | | | | | | Fix contributed by Ulf Weltman (ulf.weltman@hp.com) Description From Ulf Weltman (ulf.weltman@hp.com) In previous releases, if LDIF being imported contained createTimestamp, creatorsName, modifyTimestamp, or modifiersName, those values would be kept in the imported entries. BZ# 462922 added code to insert those attributes during import but it clobbers any values existing in the LDIF being imported. I think the imported values should take precedence, this would be useful during migration for example. If anyone wants to take advantage of the new behavior where the server provisions new values, they can strip out the values from the LDIF before importing or they can set nsslapd-exclude-from-export to not export those attributes before importing. See also https://bugzilla.redhat.com/show_bug.cgi?id=525007 Reviewed by richm, nkinder, and nhosoi
* Bitwise Plugin: Bitwise filter doesn't return except the first entry if its ↵Rich Megginson2009-09-251-5/+9
| | | | | | | | | | | | | | multi-valued http://bugzilla.redhat.com/show_bug.cgi?id=518514 Resolves: bug 518514 Bug Description: Bitwise Plugin: Bitwise filter doesn't return except the first entry if its multi-valued Reviewed by: nhosoi (Thanks!) Fix Description: Get the values as a char ** - look through each one until we find one that matches. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Allow anonymous access to be disabled.Nathan Kinder2009-09-248-5/+75
| | | | | | | | | | | This adds a new config switch (nsslapd-allow-anonymous-access) that allows one to restrict all anonymous access. When this is enabled, the connection displatch code will only allow BIND operations through for an unauthenticated user. The BIND code will only allow the operation through if it's not an anonymous or unauthenticated BIND. I also fixed a missing capability in the SELinux policy that I ran into while testing this patch.
* MODIFY/replace with empty values does not ignore missing or unknown attributesRich Megginson2009-09-241-2/+5
| | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=516305 Resolves: bug 516305 Bug Description: MODIFY/replace with empty values does not ignore missing or unknown attributes Reviewed by: nhosoi (Thanks!) Fix Description: The function mods_have_effect() did not work correctly. It would set the flag have_effect = 0 the first time a type was not found. Then if a subsequent mod would apply, it would still return have_effect = 0. What it should do is keep looking for all mod types in the list of mods to see if any of them would apply, and return have_effect = 1 if at least one of them would apply. This corresponds to RFC 4511 section 4.6: replace: replace all existing values of the modification attribute with the new values listed, creating the attribute if it did not already exist. A replace with no value will delete the entire attribute if it exists, and it is ignored if the attribute does not exist. So the proper behavior is to ignore attributes that do not exist, and to apply the rest. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 518112 rhds 81 el53 64b ns-slapd seg faultNoriko Hosoi2009-09-232-14/+24
| | | | | | | | | | | | | | | | | | Fixing the contention over LAS_cookie. Considering the case 2 threads try to evaluate the IP/DNS aci almost at the same time, one comes in first and creates context in the critical section (between ACL_CritEnter and ACL_CritExit); another thread sees *LAS_cookie is non NULL and assumes the context is already made. But it could be half baked then since the second thread does not respect the critical section. This patch is putting the line assigning *LAS_cookie to context into the critical section, which prevents for the second thread to pick up the half baked *LAS_cookie. Fix proposed in the comment#19 by Rich Megginson is included, as well: Because what if *LAS_cookie is set to a valid value after the first if() test and before the call to ACL_CritEnter(); ? There is similar code in LASIpEval() too.
* empty principal name used when using server to server sasl for db chainingRich Megginson2009-09-231-3/+6
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=513308 Resolves: bug 513308 Bug Description: empty principal name used when using server to server sasl for db chaining Reviewed by: nhosoi (Thanks!) Fix Description: Change the logic to check if the username is a valid principal name. A valid principal name in this context will be a non-empty string that does not contain the '=' character (which will be a bind DN in this context). Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Should not attempt to pop SASL IO layer if not using SASL IORich Megginson2009-09-232-2/+13
| | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=519455 Resolves: bug 519455 Bug Description: Should not attempt to pop SASL IO layer if not using SASL IO Reviewed by: nkinder (Thanks!) Fix Description: Before attempting to pop the SASL IO layer from the prfd, first make sure we are using sasl IO, the prfd is not NULL, and the prfd has a SASL IO layer on it. This also fixes a bug with setting nsslapd-localhost in the bootstrap code - if you are using a system that does not have DNS configured correctly, you may want to force the SASL code to use the nsslapd-localhost for the FQDN. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* logs created at startup can get wrong file modeRich Megginson2009-09-231-10/+38
| | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=518279 Resolves: bug 518279 Bug Description: logs created at startup can get wrong file mode Reviewed by: nkinder (Thanks!) Fix Description: Try to apply the mode using chmod() if a log file has been specified. If and only if the log file has not been set, or if the chmod() succeeds, apply the changes to the internal config. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Start script hardcodes file permissions mask to 077 (600), so the ↵Rich Megginson2009-09-221-0/+1
| | | | | | | | | | | | | nsslapd-*log-mode configuration attributes don't work https://bugzilla.redhat.com/show_bug.cgi?id=495522 Resolves: bug 495522 Bug Description: Start script hardcodes file permissions mask to 077 (600), so the nsslapd-*log-mode configuration attributes don't work Reviewed by: nkinder (Thanks!) Fix Description: Use umask 002 for the directory server process Platforms tested: Fedora 11 x86_64 Flag Day: no Doc impact: no
* Don't build policy module from Makefile.Nathan Kinder2009-09-222-53/+22
| | | | | | | | | | | | | | This removes the Makefile rule that builds the SELinux policy module. The removed rule was only building and installing the module for the targeted policy. There are different base policies (targeted, strict, mls) on different systems, so it makes more sense to build the policy module from the spec file where we can define the available base policy types for the platform in question. We still need a "--with-selinux" option to enable the SELinux specific setup code as well as creating the policy .fc file with the proper paths that are defined at build time.
* 389-ds-base/glibmm24: conflicting perl providesRich Megginson2009-09-2114-23/+22
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=523476 Resolves: bug 523476 Bug Description: 389-ds-base/glibmm24: conflicting perl provides Reviewed by: nhosoi (Thanks!) Files: see diff Fix Description: Rename "Util" to "DSUtil" Platforms tested: Fedora 11 x86_64 Flag Day: no Doc impact: no
* Add update code - make setup-ds.pl -u do updatesRich Megginson2009-09-2143-130/+1628
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updates are implemented in: perl - code that plugs in to setup - scriptlets that are imported into the setup perl interpreter and executed in process, giving access to all of the packages and context provided by setup ldif - applied to instances, in the same manner as ConfigFile directives to setup other - any executable file, shell script, etc. can be invoked, with a limited amount of context from the setup process An update directory is added to the package - /usr/share/dirsrv/update - this directory contains the update files - the update filenames begin with two digits and are executed in numeric order (00 first, then 01, etc. up to 99) which should provide enough flexibility In addition, there are 5 stages of update: pre - invoked before any instance specific code preinst, runinst, postinst - invoked for each instance post - invoked after any instance specific code Example files are provided which demonstrate how to get the context. There are two different modes of operation for update: online - must supply a bind dn and password for each instance - servers must be up and running offline - operates directly on the dse.ldif - servers must be shutdown first A new section is added to the .inf file that can be passed in [slapd-instancename] RootDN = binddn RootDNPwd = bindpw The RootDN is optional - if not supplied, it will get the nsslapd-rootdn attribute from the dse.ldif for the instance. I also fixed some problems with error messages. The pam pta plugin entry was giving object class violations, so I added the missing attributes - note that these are replaced by the plugin code when the plugin is loaded - they are only needed during setup. Fixed usage of $_ - $_ behaves like a dynamically scoped variable - which means if you use it in an outer context, you cannot use it in an inner context, even if it is used in a different function. Rather than attempting to figure out how to use $_ safely in lower level functions, I just removed the use of it altogether, which also makes the code easier to read. Reviewed by: nhosoi (Thanks!) - fixed minor issues found Platforms tested: Fedora 11
* Don't use admin_pattern macro in SELinux policy.Nathan Kinder2009-09-171-1/+1
| | | | | | | The admin_pattern macro is not available on RHEL5, so we shouldn't attempt to use it. Aside from that, we don't need all of the permission that admin_pattern grants. We should just use the manage_files_pattern macro instead.
* Add SELinux policy for ldap-agent.Nathan Kinder2009-09-179-36/+387
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds SELinux policy to confine the SNMP subagent (ldap-agent). There were some changes required around the aubagent to make it work in a more standard fashion. I moved the ldap-agent binary and wrapper to sbindir. It was previously in bindir, yet it is not a user command. The location really should be sbindir per FHS. I added init scripts for the subagent, so it can now be managed using "service dirsrv-snmp [start|stop|restart|condrestart|status]". While doing this, I found that the parent process was exiting with 1 on success instead of 0, so I fixed that. I added a default config file for the subagent as well. When using the init script, the config file is hardcoded into this standard location. Having this config template should also hopefully cut down on configuration errors since it's self documenting. The pid file location was also changed to go into /var/run per FHS. Previously, it was written to the same directory as the log file. There are a few notes in the policy .te file about some bugs that we are working around for now. These bugs are mainly minor issues in the snmp policy that is a part of the selinux-policy pacakge. Once those bugs are fixed, we can clean our policy .te file up.
* SELinux policy change for LDAPINathan Kinder2009-09-101-2/+5
| | | | | We need to allow ns-slapd to manage the ldapi socket in the dirsrv SELinux policy. This patch adds the proper rules.
* Add selinux policy for ns-slapdNathan Kinder2009-09-0913-50/+512
| | | | | | | | | | | | | | | | | This adds a "dirsrv" selinux policy module to confine the ns-slapd daemon. The setup and migration perl modules were changed to take care of any relabeling of installed files if selinux support was compiled in. The build system now takes a "--with-selinux" option that will compile the dirsrv policy module and enable any selinux specific setup code. To use the dirsrv policy module, the module will need to be loaded using the semodule utility. It is also necessary to relabel the installed files using restorecon after performing a make install. All of this will be taken care of in the spec file when in the case of using a RPM package.
* Add EntryUSN to the nsslapd-exclude-from-export listNoriko Hosoi2009-09-031-1/+1
| | | | See also http://directory.fedoraproject.org/wiki/Entry_USN#Standalone.
* 516089 RFE: ldclt utility should support new dereferencing control searchesNoriko Hosoi2009-09-014-46/+158
| | | | | | | | | | | | | | Adding "-e deref" option to ldclt. Add mode (-e add): "-e deref" adds "secretary: <DN>" to the entry. This is true when the entry's objectclass is inetOrgPerson (-e inetOrgPerson"). Search mode (-e esearch): "-e deref" sets dereference control to the search, where the dereference attribute and dereferenced attribute are hardcoded to "secretary" and "cn", respectively. Usage: ldclt [...] -e add -e random -e inetOrgPerson -e deref -f test_XX ldclt [...] -e esearch -e random -e inetOrgPerson -e deref -f test_XX
* Clean up build warningsRich Megginson2009-08-316-7/+7
| | | | | | | | | | | | | | | This cleans up the following warnings: ds.git/ldap/servers/slapd/back-ldbm/ldbm_usn.c:102: warning: unused variable 'li' ds.git/ldap/servers/plugins/replication/repl5_agmt.c:1184: warning: too many arguments for format ds.git/ldap/servers/plugins/syntaxes/dn.c:143: warning: unused variable 'val_copy' ds.git/ldap/servers/plugins/syntaxes/deliverymethod.c:264: warning: unused variable 'p' ds.git/ldap/servers/plugins/syntaxes/facsimile.c:269: warning: unused variable 'p' ds.git/ldap/servers/plugins/usn/usn.c:107: warning: value computed is not used ds.git/ldap/servers/plugins/usn/usn.c:263: warning: control reaches end of non-void function ds.git/ldap/servers/plugins/usn/usn.c:525: warning: control reaches end of non-void function The only one I'm not sure about is changing usn_get_attr to always return a 0 - please review that usage. With these fixes, I only see the llu and lld format warnings on RHEL5 with the default rpmbuild compiler flags. Reviewed by: nhosoi (Thanks!)
* Plugin Default Config EntryNoriko Hosoi2009-08-318-40/+330
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Design doc: http://directory.fedoraproject.org/wiki/Entry_USN#Plugin_Default_Config_Entr New slapi APIs in libslapd: int slapi_set_plugin_default_config(const char *type, Slapi_Value *value); Description: Add given "type: value" to the plugin default config entry (cn=plugin default config,cn=config) unless the same "type: value" pair already exists in the entry. Parameters: type - Attribute type to add to the default config entry value - Attribute value to add to the default config entry Return Value: 0 if the operation was successful non-0 if the operation was not successful int slapi_get_plugin_default_config(char *type, Slapi_ValueSet **valueset); Description: Get attribute values of given type from the plugin default config entry (cn=plugin default config,cn=config). Parameters: type - Attribute type to get from the default config entry valueset - Valueset holding the attribute values Return Value: 0 if the operation was successful non-0 if the operation was not successful warning: Caller is responsible to free attrs by slapi_ch_array_free Changes in the Replication plugin: 1) Functions to set replicated attributes agmt_set_replicated_attributes_from_attr and agmt_set_replicated_attributes_from_entry call _agmt_set_default_fractional_attrs to sets the default excluded attribute list from the plugin default config entry before setting them from each replication agreement. To support it, agmt_parse_excluded_attrs_config_attr is changed to be re-entrant. 2) Fixed a minor memory leak in the fractional attributes (ra->frac_attrs). 3) Added a check for the duplicated fractional attributes. Changes in the USN plugin: 1) usn_start calls slapi_set_plugin_default_config to add "entryusn" to the EXCLUDE list of the value of nsds5ReplicatedAttributeList in the plugin default config entry. 2) fix for the bug 518673 - entryusn: wrong lastusn value; When the entryusn is not assigned yet, the next value to be set is 0. Lastusn is calculate as (the next entryusn - 1). Although the entryusn is 64-bit unsigned long, it should be printed as a 64-bit signed integer for lastusn. Other: Fixed a compiler error in ldap/servers/slapd/dse.c.
* Need to store additional attributes in Retro ChangelogRich Megginson2009-08-255-16/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=504651 Resolves: 504651 Bug Description: Need to store additional attributes in Retro Changelog Submitted by: Endi Sukma Dewata <edewata@redhat.com> Reviewed by: rmeggins (thanks!) Platforms tested: FC10 x86_64 Fix Description: The fix allows recording some user-defined attributes from the target entry of the operation (e.g. objectGUID) and built-in attributes generated by the plugin (e.g. isReplicated) into the change log entry. The attributes should be specified in the configuration entry: dn: cn=Retro Changelog Plugin,cn=plugins,cn=config ... nsslapd-attribute: objectGUID nsslapd-attribute: isReplicated The change log entry will contain the additional attributes: dn: changeNumber=...,cn=changelog ... objectGUID: ... isReplicated: ... ---
* Fails to start if attrcrypt can't unwrap keysRich Megginson2009-08-251-0/+4
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=519065 Resolves: 519065 Bug Description: Fails to start if attrcrypt can't unwrap keys Reviewed by: nhosoi (Thanks!) Fix Description: If not using the attrcrypt feature, just return success if the keys could not be unwrapped. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* https://bugzilla.redhat.com/show_bug.cgi?id=487425Rich Megginson2009-08-252-2/+1
| | | | | | | | | | | Resolves: bug 487425 Bug Description: slapd crashes after changelog is moved Reviewed by: rmeggins Fix Description: Call clcache_set_config after the global changelog cache pool has been allocated. Platforms tested: HPUX 11 (PA-RISC 2.0 64-bit) Flag Day: no Doc impact: no <diffs>
* Retry SASL writes if buffer not fully sentRich Megginson2009-08-212-25/+71
| | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=518544 Resolves: bug 518544 Bug Description: large entries cause server SASL responses to fail Reviewed by: nhosoi (Thanks!) Branch: HEAD and 1.2 Fix Description: The SASL server code was broken when we switched over to use NSPR I/O for the SASL IO layer. If the entire encrypted buffer could not be sent to the client, the server was just failing. Instead, the server must keep track of how many encrypted bytes were sent. If all of the encrypted bytes could not be sent, we must return the appropriate error to the caller to let them know the operation would block. The caller in this case is the write_function() which does a poll() to see if the socket is available for writing again, then will attempt the send again. I also cleaned up usage of the various Debug macros. Finally, I discovered that the sasl init code was calling config_get_localhost() before that value could be set. In most cases, it is ok, because it will fall back to the default hostname from the system. However, if for some reason you want to use a different localhost, it will fail. Now it will be set in the boostrap config code. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* bump version to 1.2.2Rich Megginson2009-08-204-11/+11
| | | | Reviewed by: nhosoi (Thanks!)
* Fix usage of pre-hashed salted passwordsRich Megginson2009-08-201-13/+26
| | | | | | | | | | | | | Pre-hashed passwords may not use the standard internal salt length. The old ldif base64 decode function would return the number of bytes in the decoded string - the new NSPR function does not. We can't use strlen on the decoded value since it is binary and may contain nulls. The solution is to use a function to calculate exactly how many bytes the encode string will have when decoded, taking into account padding. Since we know exactly how many bytes are decoded, and we know exactly how many bytes of that decoded value are the hash, the remainder must be the salt, however many bytes that is. I tested this code with salt lengths from 1 to 99. Reviewed by: nkinder (Thanks!)
* 509472 db2index all does not reindex all the db backends correctlyNoriko Hosoi2009-08-201-4/+6
| | | | | | The commit a26ba73fb5040383c27872997bc07ab0c2006459 made to fix the bug 509472 put the assertion at the wrong place. It should be applied just for the worker thread.
* Add centralized start/stop/restart scipts.Nathan Kinder2009-08-1413-142/+318
| | | | | | | | | | | | | | This adds centralized start, stop, and restart scripts for ns-slapd. These scripts live in the sbin directory and will act upon all instances if an instance identifier is not specified (similar to the init script). The instance specific scripts have been modified to call the new centralized scripts. The instance specific parameters needed by the new scripts are located in the instance specific initconfig scripts, which are now created by setup-ds.pl with values mapped from the inf file.
* 506786 Index maintenance mechanism causes wrong search results whenNoriko Hosoi2009-08-121-0/+3
| | | | | | | | | | | modifying attributes with subtypes Andrey Ivanov (andrey.ivanov@polytechnique.fr) pointed out my previous check-in for bug 506786 had an inefficient code. To determine whether to delete an equality index key or not, the code checks the key still exists in the value array having the same attribute type. The check should be done as soon as one value is found in the value array instead of checking through all of them.
generated by cgit (git 2.34.1) at 2025-09-26 20:08:24 +0000