summaryrefslogtreecommitdiffstats
path: root/Makefile.am
Commit message (Collapse)AuthorAgeFilesLines
* Bug 631993 - Log authzid when proxy auth control is usedNathan Kinder2010-10-081-1/+1
| | | | | | This patch makes the access log entries for search, add, mod, del, and modrdn operations display the authzid that is used when the proxy authorization control is sent by the client.
* fix typos in Makefile.am, acctpolicy schemaacctpolicyRich Megginson2010-10-011-1/+1
| | | | Fixed some typos and copy/paste errors in Makefile.am and acctpolicy schema
* add the account policy plugin and related server code, schema, and configRich Megginson2010-10-011-1/+21
| | | | | | | | | | | Add the account policy plugin and related server code, schema, and config A new switch to configure has been added --enable-acctpolicy - this is enabled by default - so the plugin and the schema will be built and installed by default the plugin will be in dse.ldif, but will be disabled by default The original contribution had some minor problems with the schema and config entries - these have been cleaned up The original contribution had a few memory leaks - these have been cleaned up
* Bug 633168 - Share backend dbEnv with the replication changelogNoriko Hosoi2010-09-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=633168 Description: * cl5_api.c, cl5_api.h - fetches dbEnv from backend using slapi_back_get_info. - unused macros and DB helper functions and APIs are removed. * cl5_config.c - local changelog DB related config parameters are removed. * Added SLAPI_PLUGIN_BE_PRE_CLOSE_FN and SLAPI_PLUGIN_BE_POST_OPEN_FN to close changelog DB before dbEnv is closed and to open changelog DB after dbEnv is opened, respectively. * Added slapi APIs slapi_back_get_info and slapi_back_set_info to get/set the backend info. * back-ldbm - db2bak[.pl] and bak2db[.pl] backs up and restores the database files including changelog db. - changelog dir is backed up in <backupdir>/.repl_changelog_backup. - underlying implementation ldbm_back_get_info for slapi_back_get_info is added. * Added an upgrade script 81changelog.pl See also: http://directory.fedoraproject.org/wiki/Move_changelog
* add ldaptool_opts for the non BUNDLE case in Makefile.amRich Megginson2010-08-311-0/+1
| | | | forgot to add ldaptool_opts for the non BUNDLE case in Makefile.am
* openldap ldapsearch uses -LLL to suppress # version: NRich Megginson2010-08-311-1/+2
| | | | | mozldap uses -1 but openldap uses -LLL to suppress printing the in ldapsearch output - add a flag for this
* Add -x option to ldap tools when using openldapRich Megginson2010-08-311-0/+4
| | | | | | | | | | We have many scripts that use ldapsearch, ldapmodify, etc. All of these currently use simple auth. When using the openldap versions of these scripts, we have to pass the -x argument to use simple auth. A new configure parameter ldaptool_opts is used to pass this down into the scripts. Reviewed by: nkinder (Thanks!) Platforms tested: Fedora 14 (rawhide)
* Bug 617630 - fix coverity Defect Type: Resource leaks issues CID 12052 - 12093Noriko Hosoi2010-08-191-2/+2
| | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=617630 coverity 12062 . Getting rid of unused functions from plugins/shared/utils.c. . Moving plugins/shared/{utils.c,plugin-utils.h} to uiduniq.
* 616618 - 389 v1.2.5 accepts 2 identical entries with different DN formatsNoriko Hosoi2010-07-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=616618 Change Description: . renamed 91upgradednformat.pl to 80upgradednformat.pl to run upgradednformat before 90subtreerename.pl. . ported following patches applied to Directory_Server_8_2_Branch to master and 389-ds-base-1.2.6. 612771 - RHDS 8.1/389 v1.2.5 accepts 2 identical entries with different DN formats * commit 50bb2ee6676e10cdda704982dfa831efa4011037 Fix Description: This patch fixes the upgradednformat utility to eliminate the duplicated DNs found in the upgrading period. Assuming DN: attr0=value0,attr1=value1,...,attrn=valuen exists in the DB and another identical DN is found, the second DN is renamed to nsuniqueid=<uuid>+attr0=value0,attr1=value1,...,attrn=valuen , where the <uuid> is the unique id assigned to the entry when the entry is added to the server. The modification is logged in the error log. In addition, there was a bug to handle multi-valued RDNs in slapi_dn_normalize_ext. In case multi-valued RDN appears with DN value (e.g., nsuniqueid=<uuid>+cn=uid\=<uid>\,o\=<org>,dc=<dc>), it was not normalized properly. Introduced second rdn_av_stack (subinitial_rdn_av_stack) for the nested DN value. See also: http://directory.fedoraproject.org/wiki/Upgrade_to_New_DN_Format#Another_Upgrade_Scenario * commit ebaa18adaf201f75c709e078abd8e32605eddb81 Fix Description: 1) In the previous commit 50bb2ee6676e10cdda704982dfa831efa4011037, there were 3 places to miss replacing rdn_av_count with subrdn_av_count. 2) A variable subtypestart is used to keep the head of nested multivalued RDNs. For instance, seeAlso=cn\=<CN>\+l\=<L>\,o\=<O>,dc=examle,dc=com ^ or ^ or ^ There was a bug to set the first position ("cn" in the above example). In addition, fixed a warning assigning "const char *" to "char *" in import_foreman (import-threads.c). * commit 472a2c0f2f21205390ba87c31c498b4419a932ba Fix Description: When newly creating an ancestorid index file, instead of opening the index file with DB_TRUNCATE option, delete the file then create it. 616135 - Upgrade failure on Solaris : tar: db/NetscapeRoot/{DBVERSION,*.db4}: No such file or directory * commit e6723421e6dc69408edb2a396eb22da361cff206 Fix Description: .../'{'DBVERSION,*.db4'}' is not a shell syntax. Process DBVERSION and *.db4 individually. Cherry-picked 700d7c1a199db4a690740636b8bd3e612304ce1e and 0b6ddc9b06845bdf385e749f2c5a99497df20d98 from 389-ds-base-1.2.6 branch.
* Bug 610177 - fix coverity Defect Type: Uninitialized variables issuesRich Megginson2010-07-061-1/+0
| | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=610177 Resolves: bug 610177 Bug Description: fix coverity Defect Type: Uninitialized variables issues Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Initialize variables to 0, NULL, or an appropriate error code. Got rid of the unused lexer code. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Bug 601433 - Add man pages for start-dirsrv and related commandsNathan Kinder2010-06-081-0/+3
| | | | | This adds man pages for the start-dirsrv, stop-dirsrv, and restart-dirsrv commands.
* Add replication session hooksNathan Kinder2010-05-191-0/+1
| | | | | | | | This adds the ability to write a plug-in to register callbacks for controlling when replication is allowed to occur. For details, please see the design document at: http://directory.fedoraproject.org/wiki/Replication_Session_Hooks
* 591336 - Implementing upgrade DN format toolNoriko Hosoi2010-05-171-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Change description: . adding upgradednformat utility to each server instance. . adding 91upgradednformat.pl for in-place-upgrade. . implementing ldbm_back_upgradednformat sharing the import/ reincexing codes. . adding a new DBVERSION ID "dn-4514" for the upgraded db. . fixing access logs (delete.c and modify.c) . fixing compiler warnings. . fixing memory leaks. . fixing a bug in syntax plugin to free strings. . adding templates for plugin id, version, vendor, and description, which are needed for the online upgrade. . dbversion_write takes an additional bit flags, which indicates which extra DBVERSION strings are written to the DBVERSION file. It was introduced for the upgrade tools not to intervene each other's tasks (e.g., dn2rdn for converting entrydn to entryrdn and upgradednformat for upgrading the DN format). . fixing a bug in entryrdn index code which was missing to normalize RDN. See also: https://bugzilla.redhat.com/show_bug.cgi?id=591336 http://directory.fedoraproject.org/wiki/Upgrade_to_New_DN_Format#Migration.2FUpgrade
* Bug 586571 - DS Console shows escaped DNsRich Megginson2010-05-051-0/+2
| | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=586571 Resolves: bug 586571 Bug Description: DS Console shows escaped DNs Reviewed by: nkinder (Thanks!) Branch: HEAD Fix Description: In order for the console fixed to be used to manage the correct directory server, the directory server needs to be able to specify the ds console jar file version down to 3 digits, as opposed to the current two digits. To support this, instead of overriding PACKAGE_BASE_VERSION, a new configure macro is introduced - CONSOLE_VERSION. This value is set in VERSION.sh, so it can be easily updated, and it is used to set the value for BaseVersion in slapd.inf, which is what the admin server setup uses to set the ds console jar file version corresponding to the directory server. Platforms tested: RHEL5 x86_64, Fedora 12 Flag Day: no Doc impact: no
* Bug 584156 - Remove ldapi socket file during upgradeNathan Kinder2010-04-211-0/+1
| | | | | | | | | | | | The ldapi socket file is only removed when ns-slapd is started since the server does not have permission to remove it at shutdown. The causes issues when upgrading to a recetn version that has SELinux policy since the newly confined ns-slapd daemon will not be allowed to remove the old ldapi socket file since it doesn't have a dirsrv specific label. To deal with this, I've added an upgrade scriptlet that will remove the ldapi socket file. When the newly confined ns-slapd starts up, it will create a new socket file with the proper label.
* Add managed entries plug-inNathan Kinder2010-04-051-1/+11
| | | | | | | | | | | This adds a new managed entries plug-in. This plug-in allows one to have the Directory Server automatically maintain a set of entries that are based off of another type of entry (such as user private group entries based off of user entries). For more details, see the design document at: http://directory.fedoraproject.org/wiki/Managed_Entry_Design
* Bug 568196 - Install DS8.2 on Solaris failsRich Megginson2010-02-261-0/+2
| | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=568196 Resolves: bug 568196 Bug Description: Install DS8.2 on Solaris fails Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Add pcre_libdir to script wrappers for programs that use pcre Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no (cherry picked from commit 3d27198f45b4b25df667d3f86dce66a44f4bc65d)
* Bug 460162 - FedoraDS "with-FHS" installs init.d StartupScript in wrong ↵Rich Megginson2010-02-261-1/+1
| | | | | | | | | | | | | | | | | | | location on non-RHEL/Fedora OS https://bugzilla.redhat.com/show_bug.cgi?id=460162 Resolves: bug 460162 Bug Description: FedoraDS "with-FHS" installs init.d StartupScript in wrong location on non-RHEL/Fedora OS Reviewed by: nkinder (Thanks!) Branch: HEAD Fix Description: There is no LSB or FHS standard for the init script location, and it varies widely across systems and even linux distros. I've added a --with-initddir (default $(sysconfig)/rc.d) so that the location can be specified. Note that this changes the initdir parameter to be an absolute path, instead of relative to sysconfdir. Some systems do not use /etc at all for this (e.g. HPUX uses /init.d). Platforms tested: RHEL5 x86_64 Flag Day: yes - autotool file change Doc impact: no
* problems linking with -z defsRich Megginson2010-02-251-10/+32
| | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=506206 Resolves: bug 506206 Bug Description: problems linking with -z defs Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Some platforms (debian) and some build checking tools (rpmlint, others) link with -z defs to look for any undefined references at link time. We had several of these in various directory server objects. 1) all of the plugins need to link against libslapd.la 2) most of the plugins need to link against ldapcsdk and nspr 3) the pwdstorage plugin needs to link against LIBCRYPT, which is platform dependent 4) various other link fixes Platforms tested: RHEL5 x86_64 Flag Day: yes - autotool file changes Doc impact: no
* fix dso linking issues found by fedora 13 linkingRich Megginson2010-02-251-3/+4
| | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=564876 Resolves: Bug 564876 Bug Description: FTBFS 389-ds-base-1.2.6-0.1.a1.fc13: ImplicitDSOLinking There are several programs that use pthread but do not link against it explicitly. We need to link against pthread explicitly. Reviewed by: nhosoi (Thanks!)
* change syntax plugins to register required matching rule pluginsRich Megginson2010-02-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=559315 Resolves: 559315 Description: Searching some attributes are now case sensitive when they were previously case-insensitive Reviewed by: nhosoi (Thanks!) - also added some suggested comments I added code to allow the syntax plugins to register corresponding matching rules. That is, the functions that the syntax plugins use for filter matching and key generation can also be used for matching rules with the new wrapper code. I added some convenience functions and structures in the syntax plugin code to make it easier to add matching rules in the future. I also added a new feature to the matching rule code - in the LDAP spec definition of matching rule, the syntax provided in the matching rule definition is the syntax for the _assertion value_ used with the matching rule, which is not necessarily the same as the syntax of the _attribute values_ to which the matching rule can be applied. For example, matching rules that apply to syntax DirectoryString can also be applied in some cases to PrintableString, CountryString, and IA5String. There are several other cases like this as well. I also introduced the concept of a compat syntax that can be used with a matching rule. The server will now check, when reading in the schema, if the syntax and matching rules for an attribute are consistent. Finally, for 05rfc4523.ldif, I changed the attributes to use octetStringMatch instead of one of the unimplemented certificate matching rules.
* Allow modrdn to move subtree and rename non-leaf nodeNoriko Hosoi2010-01-221-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | This patch includes - replacing the entrydn index with the entryrdn index - replacing a full DN in each entry in the DB with an RDN - extending Slapi_Entry, entry2str, and str2entry to absorb the changes made on the entry - adding DN/RDN helper functions - adding DN cache - adding a utility and a migration script to convert the DN format database to the RDN format - extending a database dump utility dbscan to support the entryrdn - slapi_dn_syntax_check by nkinder@redhat.com is added to check the dn before modify operations - big fix for 171338 - Enhancement: winsync modrdn not synced In addition to the above, compile warnings and memory leaks found in testing the new feature are fixed. For more details, see the feature design document at: http://directory.fedoraproject.org/wiki/Subtree_Rename and bugzilla at: https://bugzilla.redhat.com/show_bug.cgi?id=171338
* Bug 518084 - Fix out of order retro changelog entriesNathan Kinder2009-12-151-0/+1
| | | | | | | | | | | | | | | | | When using the retro changelog plugin, post-op plugins that perform internal operations (such as memberOf) can result in the internal operation preceeding the original operation in the changelog. The fix is to give the retro changelog a higher precedence than the other post-op plugins. This required some core server changes to be made around the plugin precedence to allow an object plugin to pass it's precedence into it's calls to slapi_register_plugin() when it registers other plugin types. I added an update LDIF to set the plugin precedence when running "setup-ds.pl -u". I also noticed an AVC when restarting after the update due to the schema.bak directory that is created. I've adjusted the dirsrv SELinux policy to deal with this AVC.
* Add Named Pipe Log Script, plugins, man pageRich Megginson2009-11-251-2/+6
| | | | | | | | | | | | | | The Named Pipe Log Script allows you to replace a log file with a named pipe attached to a script. The server can then send the log output to a script instead of to a log file. This allows you to do many different things such as: * log only certain events e.g. failed binds, connections from certain ip addresses, etc. * log only lines that match a certain pattern * log only the last N lines - useful for enabling full error log debug levels in production environments * send an email or other notification when a certain event is detected The script is written in python, and allows plugins. By default, the script will log the last N lines (default 1000). There are two plugins provided - one to log only failed bind attempts, and one that will log only lines that match given regular expressions. Reviewed by: nkinder (Thanks!) - found a bug in a comment Resolves: bug 486171 Bug Description: [RFE] Access log - Failed binds
* Implement support for versioning and release engineering procedures - ↵389-ds-base-1.2.5.a1Rich Megginson2009-11-161-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | version 1.2.5.a1 Instead of changing configure.ac AC_INIT for each version change, there is a new file - VERSION.sh. This file also contains support for creating version numbers for pre-releases, and pre-release strings containing git commit hashes. One of the complications is that AC_INIT does not allow you to override the version and package tarname fields. We can override them after the fact everywhere except in config.h. AC_INIT defines the following which we would like to override but cannot: PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_STRING PACKAGE_BUGREPORT Instead, we define DS_ versions of these e.g. DS_PACKAGE_VERSION etc. and make these available with AC_DEFINE(DS_PACKAGE_VERSION,...) etc. As an extra added precaution, we undefine these in Makefile.am like this: DS_DEFINES = ... \ -UPACKAGE_VERSION -UPACKAGE_TARNAME -UPACKAGE_STRING -UPACKAGE_BUGREPORT If someone tries to use PACKAGE_VERSION in C code, they will not be able to, and will have to use DS_PACKAGE_VERSION instead. All of the DS code that used PACKAGE_VERSION has been changed to use DS_PACKAGE_VERSION instead. There is a new make target - git-archive - as a convenience for creating source tarballs from git. By default, the source archive will be placed in the build directory - you can specify SRCDISTDIR=/path/to/SOURCES to use an alternate dir (e.g. make SRCDISTDIR=/path/to/rpmbuild/SOURCES git-archive to make a source tarball for rpmbuild) configure will print the branded package name and version Reviewed by: nkinder (Thanks!)
* BZ 221905 - Add SMD5 password storage support.Nathan Kinder2009-10-261-0/+3
| | | | | | | This adds SMD5 password storage support to the existing password storage plug-in. Add upgrade LDIF has been added to ensure that this new functionality will be available to servers that are upgraded from previous versions.
* more updates - add missing rundir - remove ldapiautodnsuffix389-ds-base-1.2.3Rich Megginson2009-10-071-0/+3
| | | | | | | | | | | | | | Some older releases did not have nsslapd-rundir - upgrading from those releases will cause the server not to start - we must add nsslapd-rundir if it is missing We also got rid of nsslapd-ldapiautodnsuffix, so remove that from the config - it doesn't hurt anything to leave it, but the error message is annoying I also added back a mostly truncated version of 28pilot.ldif because some apps still use pilotObject - those apps should change to use a different objectclass ASAP. Tested on Fedora 11 i386 and x86_64 Reviewed by: nkinder (Thanks!)
* Don't build policy module from Makefile.Nathan Kinder2009-09-221-9/+3
| | | | | | | | | | | | | | This removes the Makefile rule that builds the SELinux policy module. The removed rule was only building and installing the module for the targeted policy. There are different base policies (targeted, strict, mls) on different systems, so it makes more sense to build the policy module from the spec file where we can define the available base policy types for the platform in question. We still need a "--with-selinux" option to enable the SELinux specific setup code as well as creating the policy .fc file with the proper paths that are defined at build time.
* 389-ds-base/glibmm24: conflicting perl providesRich Megginson2009-09-211-2/+2
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=523476 Resolves: bug 523476 Bug Description: 389-ds-base/glibmm24: conflicting perl provides Reviewed by: nhosoi (Thanks!) Files: see diff Fix Description: Rename "Util" to "DSUtil" Platforms tested: Fedora 11 x86_64 Flag Day: no Doc impact: no
* Add update code - make setup-ds.pl -u do updatesRich Megginson2009-09-211-3/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updates are implemented in: perl - code that plugs in to setup - scriptlets that are imported into the setup perl interpreter and executed in process, giving access to all of the packages and context provided by setup ldif - applied to instances, in the same manner as ConfigFile directives to setup other - any executable file, shell script, etc. can be invoked, with a limited amount of context from the setup process An update directory is added to the package - /usr/share/dirsrv/update - this directory contains the update files - the update filenames begin with two digits and are executed in numeric order (00 first, then 01, etc. up to 99) which should provide enough flexibility In addition, there are 5 stages of update: pre - invoked before any instance specific code preinst, runinst, postinst - invoked for each instance post - invoked after any instance specific code Example files are provided which demonstrate how to get the context. There are two different modes of operation for update: online - must supply a bind dn and password for each instance - servers must be up and running offline - operates directly on the dse.ldif - servers must be shutdown first A new section is added to the .inf file that can be passed in [slapd-instancename] RootDN = binddn RootDNPwd = bindpw The RootDN is optional - if not supplied, it will get the nsslapd-rootdn attribute from the dse.ldif for the instance. I also fixed some problems with error messages. The pam pta plugin entry was giving object class violations, so I added the missing attributes - note that these are replaced by the plugin code when the plugin is loaded - they are only needed during setup. Fixed usage of $_ - $_ behaves like a dynamically scoped variable - which means if you use it in an outer context, you cannot use it in an inner context, even if it is used in a different function. Rather than attempting to figure out how to use $_ safely in lower level functions, I just removed the use of it altogether, which also makes the code easier to read. Reviewed by: nhosoi (Thanks!) - fixed minor issues found Platforms tested: Fedora 11
* Add SELinux policy for ldap-agent.Nathan Kinder2009-09-171-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds SELinux policy to confine the SNMP subagent (ldap-agent). There were some changes required around the aubagent to make it work in a more standard fashion. I moved the ldap-agent binary and wrapper to sbindir. It was previously in bindir, yet it is not a user command. The location really should be sbindir per FHS. I added init scripts for the subagent, so it can now be managed using "service dirsrv-snmp [start|stop|restart|condrestart|status]". While doing this, I found that the parent process was exiting with 1 on success instead of 0, so I fixed that. I added a default config file for the subagent as well. When using the init script, the config file is hardcoded into this standard location. Having this config template should also hopefully cut down on configuration errors since it's self documenting. The pid file location was also changed to go into /var/run per FHS. Previously, it was written to the same directory as the log file. There are a few notes in the policy .te file about some bugs that we are working around for now. These bugs are mainly minor issues in the snmp policy that is a part of the selinux-policy pacakge. Once those bugs are fixed, we can clean our policy .te file up.
* Add selinux policy for ns-slapdNathan Kinder2009-09-091-0/+23
| | | | | | | | | | | | | | | | | This adds a "dirsrv" selinux policy module to confine the ns-slapd daemon. The setup and migration perl modules were changed to take care of any relabeling of installed files if selinux support was compiled in. The build system now takes a "--with-selinux" option that will compile the dirsrv policy module and enable any selinux specific setup code. To use the dirsrv policy module, the module will need to be loaded using the semodule utility. It is also necessary to relabel the installed files using restorecon after performing a make install. All of this will be taken care of in the spec file when in the case of using a RPM package.
* Add centralized start/stop/restart scipts.Nathan Kinder2009-08-141-7/+13
| | | | | | | | | | | | | | This adds centralized start, stop, and restart scripts for ns-slapd. These scripts live in the sbin directory and will act upon all instances if an instance identifier is not specified (similar to the init script). The instance specific scripts have been modified to call the new centralized scripts. The instance specific parameters needed by the new scripts are located in the instance specific initconfig scripts, which are now created by setup-ds.pl with values mapped from the inf file.
* fix pcre build issuesRich Megginson2009-08-121-2/+2
| | | | Reviewed by: nkinder (Thanks!)
* Change default branding to 389 - remove lite codeRich Megginson2009-08-111-9/+5
| | | | | | | | | | | | | | | | | | | The vendor, brand, and capbrand are set in configure - we should use those everywhere rather than have to run some sort of script over the code to change vendor, brand, version, etc. I've added VENDOR, BRAND, CAPBRAND to the default defines passed to the compiler, and changed the code to use these defines. And instead of the unintuitively named PRODUCTTEXT macro, we should use the already defined PRODUCT_VERSION. This allowed me to get rid of some code. The version was from a generated file called dirver.h which we don't need anymore, and we don't need the perl script dirver.pl which generated it. The vendor string was coming from the dirlite header file. So I also used this as an excuse to get rid of all references to dirlite once and for all (yay!). For the places in plain text files which are not substituted, I just used the generic name Dirsrv or Directory Server instead of having an explicit brand and/or version in there. Reviewed by: nkinder (Thanks!)
* Dereference supportRich Megginson2009-07-291-1/+9
| | | | | | | | | | | | | | | | | | | | This adds support for the newly proposed LDAP Dereference feature (not to be confused with alias dereferencing). The details of the proposed feature can be found here: http://www.openldap.org/devel/cvsweb.cgi/~checkout~/doc/drafts/draft-masarati-ldap-deref-xx.txt This adds a new deref plugin to the directory server. This is a pre op search plugin. In order to allow the plugin to rewrite the controls sent back with each entry, I changed the way pre-search and pre-entry plugins work. They now have the ability to alter the entry and controls just before being sent back to the client. This plugin does not currently support internal operations. It should be easy to add a call to register the plugin for internal ops if we need to do that. The code supports real, computed (e.g. memberOf), and virtual attributes both as the attibute to dereference and in the list of attributes to return from each dereferenced entry. This will allow us to use attributes such as nsRole as the derefattr. Tested on RHEL5 x86_64 with various openldap 2.4.15+ and Net::LDAP clients. valgrind output is clean
* Entry USNNoriko Hosoi2009-07-211-3/+15
| | | | | | | | First cut for implementing Entry USN. See http://directory.fedoraproject.org/wiki/Entry_USN for the design details. This change includes a bug fix for "db2ldif -r"; event queue system was not shutdown before the plugins are closed, which could have crashed the command line utility.
* Bug: 479753 - Update core schemaNathan Kinder2009-07-151-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch updates and reorganizes our core schema to follow the most recently defined standards. The layout of the core schema files is as follows: 00core.ldif - RFC 4512, RFC 4519, LDAP Subentry Internet Draft 01core389.ldif - 389 specific schema (required to start server) 02common.ldif - 389 specific schema (highly recommended, Changelog Internet Draft, plug-in schema) 05rfc2927.ldif - MIME Directory Profile for LDAP Schema 05rfc4523.ldif - Schema Definitions for X.509 Certificates 05rfc4524.ldif - Cosine LDAP/X.500 Schema 06inetorgperson.ldif - RFC 2798 (pulls in RFC 2079 and part of the obsolete RFC 1274 due to required attributes) There are still a handful of syntaxes that we don't support, so I've substituted syntaxes for about 15 attributes. The schema and DIT related description syntaxes are not supported, so I've used the "Directory String" syntax instead in 00core.ldif. The certificate syntaxes defined in 4523 are not supported, so I've used the "Octet String" syntax instead. All of these deviations are commented with a "TODO" listing the syntax that we need to implement. I have also updated the Mozilla address book schema to the latest from upstream for a minor bug fix. I changed the nsSymmetricKey attribute to use the "Octet String" syntax since the "Binary" syntax is deprecated.
* Add additional standard syntaxes.Nathan Kinder2009-07-141-1/+7
| | | | | | | | | | | | | | | | | | | | | | | This adds support for the following standard syntaxes, complete with validation functions: Bit String Delivery Method Enhanced Guide Facsimile Telephone Number Fax Guide Name And Optional UID Printable String Teletex Terminal Identifier Telex Number This patch does not change the schema to use any of these syntaxes yet. That will come when we update to the current versions of the standard schema from the LDAP RFCs. I also fixed an error in makefile.am where Setup.pm was listed twice in perl_DATA.
* OpenLDAP supportcleanupRich Megginson2009-07-071-14/+18
| | | | | | | | | | These changes allow the server to be built with OpenLDAP (2.4.17+). A brief summary of the changes: * #defines not provided by OpenLDAP were copied into slapi-plugin.h and protected with #ifndef blocks * where it made sense, I created slapi wrapper functions for things like URL and LDIF processing to abstract way the differences in the APIs * I created a new file utf8.c which contains the UTF8 functions from MozLDAP - this is only compiled when using OpenLDAP * I tried to clean up the code - use the _ext versions of LDAP functions everywhere since the older versions should be considered deprecated * I removed some unused code NOTE that this should still be considered a work in progress since it depends on functionality not yet present in a released version of OpenLDAP, for NSS crypto and for the LDIF public API.
* Add linked attributes plug-in.Nathan Kinder2009-06-251-36/+47
| | | | | | | | | | | | | | | This patch implements a linked attribute plug-in. Details of the plug-in features and design are available on the 389 wiki at: http://directory.fedoraproject.org/wiki/Linked_Attributes_Design In addition, I encountered a memory leak when testing the new plug-in with valgrind. There was a fix to the dse add code for a double free a few months back, which causes a leak in certain situations. This previous fix was for bz#489763. The proper thing to do is to make the dse backend add function consume the passed in entry upon success and leave it for the caller to deal with upon failure. This is the way the back-ldbm add function works.
* Use thread aware library for complex regex searchesNoriko Hosoi2009-05-281-2/+3
| | | | | | | | For more details, see the design doc at http://directory.fedoraproject.org/wiki/Thread_Aware_Regex Additional 2 unrelated changes are being made: 1) dbgen.pl.in: secretary and manager are having a dn format value "cn=...". 2) slapi_counter_sunos_sparcv9.S: adding "#define _ASM 1" to force to set an assembler code macro _ASM.
* fix rpmlint issues - config files and perl modules should not be executableRich Megginson2009-05-171-2/+4
|
* Add Simple Paged ResultsNoriko Hosoi2009-05-151-0/+2
| | | | For more details, see the design doc at http://directory.fedoraproject.org/wiki/Simple_Paged_Results_Design
* Generated autotools files for syntax validation feature.Nathan Kinder2009-05-111-2/+2
| | | | | | | A change was also made to Makefile.am to avoid library versioning for our C++ plug-in libraries. This change should allow us to use autogen.sh on recent platforms without running into issues during build-time.
* Added capability to validate syntax of values being added to the database. ↵Nathan Kinder2009-05-081-7/+21
| | | | | | Also added numericstring syntax support. For more details, see the design doc at http://directory.fedoraproject.org/wiki/Syntax_Validation_Design
* Resolves: 446697Nathan Kinder2009-02-131-3/+5
| | | | Summary: Added new remove-ds.pl script and manpage.
* Resolves: bug 202134Rich Megginson2009-01-141-0/+1
| | | | | Description: add sudo and hostObject schemas by default Fix Description: added 60nss-ldap.ldif for the hostObject and other nss ldap schema
* Resolves: bug 469261Rich Megginson2008-11-041-2/+3
| | | | | | | | | | | | | | | Bug Description: Support server-to-server SASL - part 1 Reviewed by: nkinder, nhosoi, ssorce (Thanks!) Fix Description: I've created two new functions to handle the client side of LDAP in the server - slapi_ldap_init_ext and slapi_ldap_bind. These two functions are designed to work with any connection type (ldap, ldaps, ldap+starttls, and eventually ldapi) and bind type (plain, sasl, client cert). The secure flag has been extended to use a value of 2 to mean use startTLS. One tricky part is that there is no place to store the startTLS flag in init to pass to bind, so we store that in the clientcontrols field which is currently unused. We do that because the semantics of ldap_init are not to do any network traffic, but defer that until the bind operation (or whatever the first actual operation is e.g. start_tls). I plan to replace all of the places in the code that do ldap init and bind with these functions. I started with replication. I extended the transport to add tls for startTLS and the bind method to add sasl/gssapi and sasl/digest-md5. I removed a lot of code from repl5_connection that is now done with just slapi_ldap_init_ext and slapi_ldap_bind. One tricky part of the replication code is that it polls the connection for write available, using some ldap sdk internals. I had to fix that code to work within the public ldap api since nspr and sasl muck with the internals in different incompatible ways. Finally, there is a lot of new kerberos code in the server. The way the server does sasl/gssapi auth with its keytab is similar to the way it does client cert auth with its ssl server cert. One big difference is that the server cannot pass the kerberos identity and credentials through the ldap/sasl/gssapi layers directly. Instead, we have to create a memory credentials cache and set the environment variable to point to it. This allows the sasl/gssapi layer to grab the credentials for use with kerberos. The way the code is written, it should also allow "external" kerberos auth e.g. if someone really wants to do some script which does a periodic kinit to refresh the file based cache, that should also work. I added some kerberos configure options. configure tries to first use krb5-config to get the compiler and linker information. If that fails, it just looks for some standard system libraries. Note that Solaris does not allow direct use of the kerberos api until Solaris 11, so most likely Solaris builds will have to use --without-kerberos (--with-kerberos is on by default). Fixed a bug in kerberos.m4 found by nkinder. ssorce has pointed out a few problems with my kerberos usage that will be addressed in the next patch. Changed the log level in ldap_sasl_get_val - pointed out by nkinder Platforms tested: Fedora 9, Fedora 8 Flag Day: yes Doc impact: oh yes
* Fixing the build on Solaris (ldap_agent_bin-main.o)Noriko Hosoi2008-10-261-0/+4
|
generated by cgit (git 2.34.1) at 2024-05-04 06:48:43 +0000