summaryrefslogtreecommitdiffstats
path: root/ldap/servers/slapd/slap.h
Commit message (Collapse)AuthorAgeFilesLines
* Clean up compiler warningssmallcleanupbasecleanupRich Megginson2009-07-071-2/+3
| | | | | | This cleans up all of the compiler warnings produced with -Wall on RHEL/Fedora platforms. The warnings about the %lld and %llu formats are still produced and cannot be helped. Reviewed by: nkinder (Thanks!)
* OpenLDAP supportcleanupRich Megginson2009-07-071-3/+4
| | | | | | | | | | These changes allow the server to be built with OpenLDAP (2.4.17+). A brief summary of the changes: * #defines not provided by OpenLDAP were copied into slapi-plugin.h and protected with #ifndef blocks * where it made sense, I created slapi wrapper functions for things like URL and LDIF processing to abstract way the differences in the APIs * I created a new file utf8.c which contains the UTF8 functions from MozLDAP - this is only compiled when using OpenLDAP * I tried to clean up the code - use the _ext versions of LDAP functions everywhere since the older versions should be considered deprecated * I removed some unused code NOTE that this should still be considered a work in progress since it depends on functionality not yet present in a released version of OpenLDAP, for NSS crypto and for the LDIF public API.
* Implement SASL I/O as an NSPR I/O layerRich Megginson2009-06-091-5/+0
| | | | | | | | | | | | | | | | | | | | | | This is part of the port to OpenLDAP, to simplify the code that interacts with the BER I/O layer. Ideally, since we only deal with NSPR I/O, not raw I/O, in the directory server, we can push any additional layers, such as SASL, as NSPR I/O layers. This is how NSS works, to push the SSL codec layer on top of the regular NSPR network I/O layer. Only 3 functions are implemented - PR_Send (sasl_io_send), PR_Recv (sasl_io_recv), and PR_Write (sasl_io_write). This simplified the code in saslbind.c and connection.c, and removed special handling for SASL connections - now they are just treated as regular NSPR connections - the app has not nor does not need to know the connection is a SASL connection. In addition, this gives us the ability to use SASL and SSL at the same time. The SASL I/O layer can be pushed on top of the SSL layer, so that we can use SSL for connection encryption, and SASL for authentication, without having to worry about mixing the two. Reviewed by: nkinder (Thanks!) Platforms tested: RHEL5 x86_64, Fedora 9 x86_64
* Add require secure binds switch.Nathan Kinder2009-05-291-0/+2
| | | | | | | | | | | | This adds a new configuration attribute named nsslapd-require-secure-binds. When enabled, a simple bind will only be allowed over a secure transport (SSL/TLS or a SASL privacy layer). An attempt to do a simple bind over an insecure transport will return a LDAP result of LDAP_CONFIDENTIALITY_REQUIRED. This new setting will not affect anonymous or unauthenticated binds. The default setting is to have this option disabled.
* Use thread aware library for complex regex searchesNoriko Hosoi2009-05-281-3/+4
| | | | | | | | For more details, see the design doc at http://directory.fedoraproject.org/wiki/Thread_Aware_Regex Additional 2 unrelated changes are being made: 1) dbgen.pl.in: secretary and manager are having a dn format value "cn=...". 2) slapi_counter_sunos_sparcv9.S: adding "#define _ASM 1" to force to set an assembler code macro _ASM.
* Add Simple Paged ResultsNoriko Hosoi2009-05-151-0/+19
| | | | For more details, see the design doc at http://directory.fedoraproject.org/wiki/Simple_Paged_Results_Design
* Add strict DN syntax enforcement option.Nathan Kinder2009-05-131-1/+3
| | | | | | | | | | | | | | | | | | | The DN syntax has become more restrictive over time, and the current rules are quite strict. Strict adherence to the rules defined in RFC 4514, section 3, would likely cause some pain to client applications. Things such as spaces between the RDN components are not allowed, yet many people use them still since they were allowed in the previous specification outlined in RFC 1779. To deal with the special circumstances around validation of the DN syntax, a configuration attribute is provided named nsslapd-dn-validate-strict. This configuration attribute will ensure that the value strictly adheres to the rules defined in RFC 4514, section 3 if it is set to on. If it is set to off, the server will normalize the value before checking it for syntax violations. Our current normalization function was designed to handle DN values adhering to RFC 1779 or RFC 2253
* Added capability to validate syntax of values being added to the database. ↵Nathan Kinder2009-05-081-6/+16
| | | | | | Also added numericstring syntax support. For more details, see the design doc at http://directory.fedoraproject.org/wiki/Syntax_Validation_Design
* Resolves: 201332Nathan Kinder2008-12-111-0/+1
| | | | Summary: Allow password modify extop when password reset is needed.
* Resolves: bug 454030Rich Megginson2008-12-051-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | Bug Description: Need to address 64-bit compiler warnings - again Reviewed by: nhosoi (Thanks!) Fix Description: This patch cleans up most of the other remaining compiler warnings. I compiled the directory server code with these flags on RHEL5 x86_64: -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic I also enabled argument/format match checking for most of the commonly used varadic functions. Most of the problems I found fell into these categories: 1) Too many or not enough arguments e.g. most everything that uses or did use LDAPDebug had extra 0,0 arguments. If they had been switched to use slapi_log_error, I removed the extra arguments - for those places still using LDAPDebug, I introduced more macros to handle the number of arguments, since C macros cannot be varadic. 2) When using NSPR formatting functions, we have to use %llu or %lld for 64-bit values, even on 64-bit systems. However, for regular system formatting functions, we have to use %ld or %lu. I introduced two new macros NSPRIu64 and NSPRI64 to handle cases where we are passing explicit 64-bit values to NSPR formatting functions, so that we can use the regular PRIu64 and PRI64 macros for regular system formatting functions. I also made sure we used NSPRI* only with NSPR functions, and used PRI* only with system functions. 3) use %lu for size_t and %ld for time_t I did find a few "real" errors, places that the code was doing something definitely not right: https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/acl/aclinit.c_sec4 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/acl/acllas.c_sec17 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/http/http_impl.c_sec1 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/memberof/memberof.c_sec1 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/pam_passthru/pam_ptimpl.c_sec1 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/replication/cl5_api.c_sec5 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/replication/cl5_clcache.c_sec2 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/plugins/replication/replutil.c_sec1 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/slapd/libglobs.c_sec1 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/slapd/back-ldbm/dbverify.c_sec2 https://bugzilla.redhat.com/attachment.cgi?id=325774&action=diff#ldapserver/ldap/servers/slapd/back-ldbm/ldif2ldbm.c_sec3 This is why it's important to use this compiler checking, and why it's important to fix compiler warnings, if for no other reason than the sheer noise from so many warnings can mask real errors. Platforms tested: RHEL5 Flag Day: no Doc impact: no
* Resolves: bug 469261Rich Megginson2008-12-021-2/+0
| | | | | | | | | | | | | Bug Description: Support server-to-server SASL - console chaining, server cleanup Reviewed by: nkinder (Thanks!) Fix Description: There are two sets of diffs here. The first set adds tls, gssapi, and digest to the chaining database (aka database link) panels in the console. I had to add support for revert to some of the code to make the Reset button work without having to retrieve the values from the server each time. We already store the original values locally in the _origModel - I added code to allow the use of that in the Reset button. The second set of diffs is for the server. 1) I had to add support for "SIMPLE" for bindMechanism - this translates to LDAP_SASL_SIMPLE for the actual mechanism. This value is NULL, so I had to add handling for NULL values in the cb config code (slapi_ch_* work fine with NULL values). 2) Added some more debugging/tracing code 3) The server to server SSL code would only work if the server were configured to be an SSL server. But for the server to be an SSL client, it only needs NSS initialized and to have the CA cert. It also needs to configured some of the SSL settings and install the correct policy. I changed the server code to do this. Platforms tested: RHEL5 Flag Day: no Doc impact: Yes
* Resolves: 387851Nathan Kinder2008-11-261-0/+1
| | | | Summary: Added validation for nsslapd-maxsasliosize value.
* Resolves: 387851Nathan Kinder2008-11-251-2/+4
| | | | Summary: Add configuration parameter to limit maximum allowed incoming SASL IO packet size.
* Resolves: 316241Nathan Kinder2008-11-071-0/+2
| | | | Summary: Add config setting to disable unauthenticated binds.
* Resolves: 207457Nathan Kinder2008-10-241-43/+45
| | | | Summary: Convert counters to 64-bit capable Slapi_Counter type.
* Related: 207457Nathan Kinder2008-10-171-3/+20
| | | | Summary: Add support for 64-bit counters (phase 1).
* Resolves: #466702Noriko Hosoi2008-10-151-0/+11
| | | | | Summary: Memory usage research: checking in the experimental code See also: http://directory.fedoraproject.org/wiki/Memory_Usage_Research
* Resolves: #447353Noriko Hosoi2008-07-151-0/+10
| | | | | | | | | | | | | | | | Summary: RFE: search optimization and single character substring searches Description: extended the substring key to have 3 types: * begin (e.g., *^a) * middle (e.g., *abc) * end (e.g., *xy$) * Usage: turn an index object to extensibleobject and set an integer value as follows: * dn: cn=sn, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config * objectClass: extensibleObject * nsSubStrBegin: 2 * nsSubStrMiddle: 3 * nsSubStrEnd: 2 * [...]
* Resolves: #436837 (comment #9)Noriko Hosoi2008-06-061-1/+1
| | | | Summary: Dynamically reload schema via task interface
* Resolves: #436837Noriko Hosoi2008-06-041-2/+6
| | | | | | Summary: Dynamically reload schema via task interface Description: implemented task based schema file reloading (see also http://directory.fedoraproject.org/wiki/Dynamically_Reload_Schema)
* Resolves: #436390Noriko Hosoi2008-05-161-3/+4
| | | | | | | | | | | | | | | Summary: LDAPI: support auto-bind Description: 1) Debugged the basic code of slapd_get_socket_peer, which is used for Solaris9 and HP-UX. The recvmsg call returns an error immediately if no data is waiting to be received since the socket is set PR_SockOpt_Nonblocking (O_NONBLOCK). To make slapd_get_socket_peer more robust, we have to retry recvmsg if it returns EAGAIN. But set a retry count not to hang there. 2) Introduced c_local_valid in the Connection handle to tell the autobind code that the uid/gid pair is valid or not. 3) Stops the automagic/unconditional auto-bind (the code used to be in daemon.c). 4) Auto-bind is effective only when the client passes the SASL/EXTERNAL request.
* Resolves: 439907Nathan Kinder2008-04-031-4/+21
| | | | Summary: Enhanced SLAPI task API and ported existing tasks to use new API.
* Resolves: bug 250179Rich Megginson2007-10-181-0/+2
| | | | | | | Description: tmpwatch whacks stats Reviewed by: nkinder (Thanks!) Fix Description: move the snmp slapd.stats file to run_dir (/var/run/dirsrv) and rename to slapd-instance.stats. Had to add nsslapd-rundir to cn=config in order for ldap-agent to be able to get it. Doc: Yes, we need to document the new attribute nsslapd-rundir.
* Resolves: #188320Noriko Hosoi2007-10-181-1/+0
| | | | Summary: HP-UX: warnings reported by the HP-UX compiler
* Resolves: #193724Noriko Hosoi2007-10-121-0/+1
| | | | | | | | | | | | Summary: "nested" filtered roles result in deadlock (Comment #12) Description: 1. Changed cache_lock to the read-write lock. 2. Instead of using the local vattr_context in vattr_test_filter, use the one set in pblock as much as possible. To achieve the goal, introduced pb_vattr_context to pblock. 3. Increased VATTR_LOOP_COUNT_MAX from 50 to 256. 4. When the loop count hit VATTR_LOOP_COUNT_MAX, it sets LDAP_UNWILLING_TO_PERFORM and returns it to the client.
* Resolves: bug 249366Rich Megginson2007-10-021-9/+0
| | | | | | | | | | | | | Bug Description: rhds71 - search filters returns too many entries on integer attributes value greater than 2 to the power of 31 Reviewed by: nkinder, nhosoi (Thanks!) Fix Description: The way >= and <= searches are supposed to work in LDAP is that you are supposed to define an ORDERING matching rule for the attribute you want to use in the search filter. The way our code is written, most strings "just work" as a side effect of the way bdb sorts the keys by default - so you can do (uid>=jvedder) and get what you would expect, even though LDAP says this is illegal because the schema definition of the uid attribute does not have an ORDERING matching rule. And INTEGER worked with the old binary format for the same reason. The only attribute definitions we use with ORDERING are attributes that use Generalized Time syntax (e.g. createTimestamp, et. al.) and numSubordinates (which uses INTEGER, but this is a special case handled internally by the db code). The way it works now is that the indexing code will honor the ORDERING matching rule specified in the schema definition. Or, if ORDERING is not specified, the user can use the nsMatchingRule index configuration. This will allow an existing customer that depends all integer syntax attributes (e.g. uidNumber) to allow range searches by default to enable range searches without editing the schema. The syntax definition for the attribute must also specify a compare function. This compare function will be used by the bdb bt_compare() function. I also fixed a bug in the integer normalize code - a string of all zeros should normalize to a single "0". In all other cases, the leading zeros should be removed. Platforms tested: RHEL5 x86_64 Flag Day: Yes. Integer indexes will need to be rebuilt (except for numsubordinates). Doc impact: Yes - document slapi API additions QA impact: Pay close attention to tests that use >= or <= search filters, both with and without index attributes. Also, pay close attention to greater/less than searches using i18n collations. New Tests integrated into TET: Forthcoming
* Resolves: #236256Noriko Hosoi2007-09-071-5/+8
| | | | | | | | Summary: verify-db.pl (db_verify) does not work on a little endian machine (comment #1-#4) Description: 1) introducing dbverify mode to ns-slapd. 2) providing new script dbverify to call "ns-slapd dbverify" 3) fixing verify-db.pl to call dbverify instead of db_verify from BDB
* Resolves: #253069Noriko Hosoi2007-08-171-0/+3
| | | | | | Summary: cyclic dependency from getpwnam() in log rotation code Description: Moved getpwnam call to the startup time, store the info in slapdFrontendConfig to reuse.
* Resolves: #250702Noriko Hosoi2007-08-031-7/+8
| | | | Summary: not all the addresses associated with listenhost are bound to listen sockets (comment #10)
* Resolves: #247215Noriko Hosoi2007-07-111-0/+1
| | | | | | Summary: Reimplement ds_remove without setuputil code (comment #6) Description: adding nsslapd-instancedir to dse.ldif for ds_remove to find out the instance dir path.
* Resolves: #245407Noriko Hosoi2007-06-221-0/+4
| | | | | | Summary: Add config attributes to cn=config to support Console (comment #1) Description: Console needs to know the default paths for ldif_dir and bak_dir. Adding the paths to cn=config.
* Add LDAPIPete Rowley2007-02-271-0/+32
|
* Resolves: #214533Noriko Hosoi2006-11-101-0/+5
| | | | | | | | | | Summary: configure needs to support --with-fhs (Comment #6) Changes: Added the following include next to the end of the copyright block. + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif +
* Resolves: #214728Noriko Hosoi2006-11-101-10/+0
| | | | | Summary: Cleaning up obsolete macros in the build Changes: eliminated macro NET_SSL (Comment #5)
* Resolves: #199923Noriko Hosoi2006-11-061-0/+1
| | | | | Summary: subtree search fails to find items under a db containing special characters (Comment#16) Description: When dn contains rdn which includes '\\', it was escaped twice to generate a key for entrydn and caused mismatch in forming ancestorid index. It ends up the subtree search fail.
* Resolves: 214238Nathan Kinder2006-11-061-0/+2
| | | | Summary: Added new config parameter for setting the SASL plug-in path.
* [208672] parameterizing the hardcoded paths (phase 2. db, log, lock, pid, ↵Noriko Hosoi2006-10-131-9/+12
| | | | | | | | | | | | cert, and instance dir) 1) introduced these 3 new config attributes: nsslapd-lockdir, nsslapd-tmpdir, nsslapd-certdir, and eliminated: nsslapd-instancedir. 2) replaced the hardcoded paths with the corresponding attribute value in the server as well as in the create/remove instance codes. 3) moved snmp stats file to the nsslapd-tmpdir 4) moved the server instance dir to <prefix>/lib/<brand>-ds/slapd-<id>
* [207427] parameterizing the hardcoded paths (Comment #15)Noriko Hosoi2006-09-271-0/+3
| | | | phase 1. parameterizing config, schema and ldif directory
* 204517 - Use new ber types throughout the server code.Nathan Kinder2006-08-311-3/+3
|
* 202872 - Allow password modify extended operation when using SASL privacy layerNathan Kinder2006-08-171-0/+1
|
* 184585 - SASL context needs to be disposed of and a new one created when ↵Nathan Kinder2006-03-141-0/+3
| | | | re-binding
* Fixing Solaris buildNoriko Hosoi2006-02-281-0/+3
| | | | | 1) NSCONFIG accidentally got a white space (for non-Linux platforms) 2) Solaris needs to include limits.h explicitly
* 178867 - Enhanced password syntax checkingNathan Kinder2006-01-251-0/+18
|
* Fixed licensing typoNathan Kinder2005-04-191-1/+3
|
* 155068 - Added license to source filesNathan Kinder2005-04-151-0/+30
|
* [Bug 146919] Directory Server rebrandingNoriko Hosoi2005-03-251-2/+2
| | | | | | | | | | 1) Brandx -> Fedora 2) Pick up new internal component set (Admin SDK, Setup SDK, Admin Server) 3) Use JRE from the Admin Server package 4) Docs a) Componentize Docs b) Rebrand Docs c) Drop packaging Administration Guide in the external version
* clean up sprintf usage and many other flawfinder issues; clean up compiler ↵Rich Megginson2005-03-051-2/+1
| | | | warnings on Linux; remove pam_passthru from DS 7.1
* 149951 - Updated source code copyrightsNathan Kinder2005-02-281-2/+2
|
* New net-snmp subagentNathan Kinder2005-02-251-35/+35
|
* [146919] De-brand the Directory Server as "brandx"Noriko Hosoi2005-02-021-2/+2
|
generated by cgit (git 2.34.1) at 2024-06-28 08:41:50 +0000