| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| |
|
|
| |
Summary: HP-UX: warnings reported by the HP-UX compiler
|
| |
|
|
| |
Summary: Fixed small non-recurring memory leak at startup.
|
| |
|
|
|
|
|
|
| |
Summary: Migration/Upgrade fails when it's from 6.21 to 8.0 on the same OS/architecture
Description:
back-ldbm.h: added LDBM_VERSION_62
dblayer.c: fixed a bug to check the instance dir name
upgrade.c: added LDBM_VERSION_62
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Bug Description: uuid generator not initialized by import from command line
Reviewed by: nkinder (Thanks!)
Fix Description:
The unique ID generator is not initialized if import is run from the command
line. The bad effect of this is that the clock sequence and node fields are all
zeros. This could lead to duplicate unique IDs being assigned by two different
servers.
What happens is that the uuid values all look like this:
XXXXXXXX-XXXXXXXX-80000000-00000000
So the time based part is generally ok, but the clock seq and node ID part are never initialized, hence 0's for those fields.
The fix is to initialize the unique id generator in the same manner as we do for the server when it starts up in regular mode, except that we tell the generator to use the single threaded (st) mode rather than the multi threaded (mt) mode.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Bug Description: uuid generator truncates clock_seq_hi_and_reserved field
Reviewed by: nkinder (Thanks!)
Fix Description:
The uuid code has this code (where clock_seq is unsigned16 - 2 bytes and
uuid->clock_seq_hi_and_reserved is unsigned8 - 1 byte):
uuid->clock_seq_hi_and_reserved = (unsigned8)(clock_seq & 0x3F00) >> 8;
In this code, the cast to unsigned8 takes precedence over over the shift. So
what happens is that (clock_seq & 0x3F00) is first cast to an 8 bit quantity,
then shifted by 8 bits. The result is that the value is _always 0_. The code
also does this:
uuid->clock_seq_hi_and_reserved |= 0x80;
You can see this because every nsUniqueID looks like this:
XXXXXXXX-XXXXXXXX-80XXXXXXXX-XXXXXXXX
The first byte of the 3rd octet is always 80.
This may also be related to https://bugzilla.redhat.com/show_bug.cgi?id=197886 and may explain why the sequence numbers were exhausted so quickly. Without this fix, we only have 256 sequence numbers available. This fix adds another 6 bits.
The fix is to mask and shift as an unsigned16 quantity, then cast to unsigned8.
Platforms tested: RHEL5 x86_64
Flag Day: no - I think this will only impact new unique IDs that are generated. It will not affect existing unique IDs.
Doc impact: no
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Summary: "nested" filtered roles result in deadlock (Comment #12)
Description:
1. Changed cache_lock to the read-write lock.
2. Instead of using the local vattr_context in vattr_test_filter, use the one
set in pblock as much as possible. To achieve the goal, introduced
pb_vattr_context to pblock.
3. Increased VATTR_LOOP_COUNT_MAX from 50 to 256.
4. When the loop count hit VATTR_LOOP_COUNT_MAX, it sets
LDAP_UNWILLING_TO_PERFORM and returns it to the client.
|
| |
|
|
|
|
|
|
|
|
| |
Bug Description: add an view object inside a view object that has an improper nsviewfilter crashes the server
Reviewed by: nhosoi (Thanks!)
Fix Description: I could not reproduce the problem by simply adding the bogus nsviewfilter. The server seemed to run fine, but I didn't stress it. However, if I restarted the server, the server would core during startup. The last message in the error log would say something about recovering the database, which is probably why the bug reporter said that it will not recover the database. The problem doesn't appear to be with views specifically, but with any internal search which uses the search_internal_callback_pb() (as opposed to the non callback internal search) and there are search base rewriters (such as the views code). The aci code uses this type of search at startup to find the acis, and that's where I saw the crash. I could crash the server at startup regardless of whether the view filter was bogus or not. The problem is that we are not passing in the address of new_base to slapi_ch_free. The fix is to use slapi_ch_free_string and pass in the address of the string. That fixes the crash.
I also cleaned up a few places in the views code which was not checking to see if slapi_str2filter returned NULL, which would happen in the case of the bogus search filter. I also added an error message which will tell the user that filter X in entry Y is bogus.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
|
| |
|
|
|
|
|
|
|
| |
Bug Description: crash at startup with new ldap sdk on 64-bit platform
Reviewed by: nkinder (Thanks!)
Fix Description: I went ahead and cleaned up or removed the incorrect ber code. We do not need to use LBER_SOCKBUF_OPT_DESC or LBER_SOCKBUF_OPT_READ_FN or LBER_SOCKBUF_OPT_WRITE_FN. I removed an unnecessary malloc/free and just used the stack as we do everywhere else in the code. It looks as though the start_tls cleanup code is almost never used - the code assumes that when you do a start_tls, that stays in force throughout the lifetime of the connection. Removing this code now should insulate us from future ldap c sdk changes.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
|
| |
|
|
|
|
|
|
|
|
|
| |
Bug Description: Server hangs when adding a group with two password entries
Reviewed by: nhosoi (Thanks!)
Files: see diff
Branch: HEAD
Fix Description: The pw_encodevals() was not encoding each value, only the first one, then setting each new value to the same encoded value. The solution is to move char *enc into the loop so that it is allocated anew each time.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
|
| |
|
|
| |
Summary: Initialize backup directory name properly for all cases.
|
| |
|
|
| |
Summary: Added new operation flag to skip writing modifiresname and related attributes. Updated password policy internal operations to use this new flag.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Summary: Directory Server should shutdown if it fails to write logs (comment #7)
Change Description:
1. introduced a new static function log__error_emergency, which is called at
emergency to log to the syslog and at least try to log into the errors log one
more time.
2. added an error parameter to the macro LOG_WRITE_NOW to return if the writing
to the log was successful or not.
3. if opening an errors log or writing to an errors log failed, call
g_set_shutdown to shutdown the server gracefully.
4. log__error_emergency calls writing log function (LDAPDebug --> slapd_log_error_proc_internal) with ERROR_LOCK_WRITE unlocked, if locked.
|
| |
|
|
| |
Summary: Handle poorly formatted DN's when normalizing. Also only check modify values against authenticated DN for DN syntax attributes.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Bug Description: rhds71 - search filters returns too many entries on interger attributes value greater than 2 to the 31
Reviewed by: nkinder, nhosoi (Thanks!)
Fix Description: I found a bug in my previous patch. The bt_compare function is used not only for comparing the actual key values but also for comparing raw index keys - that is, keys with the leading '=' or '*'. If comparing two keys, we should only use the syntax specific compare function if we are comparing two valid equality keys. A valid equality key begins with EQ_PREFIX and has at least one character after that. In this case, we strip off the EQ_PREFIX and pass the values to the syntax specific compare function. Otherwise, we just use a simple berval compare function that is based on memcmp.
The code in index_range_read needs to use a similar comparison algorithm, so I beefed up DBTcmp.
Why is this necessary? When doing a >= search or a <= search, we need to get the upper (for >=) or lower (for <=) bound for the range, which will either be the last (for >=) or first (for <=) equality key in the index. The index code uses a key of '=' to find the lower bound (which is lower than any key "=value") and a key of '>' to find the upper bound. A '=' with no value will collate before any real eq key with a value, and the ascii value of '>' is one greater than the ascii value of '='.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Summary: logrotation time of -1 causes hang
Change description:
1. slapd_log_audit_proc, slapd_log_error_proc_internal, and log_flush_buffer:
use absolute value of rotationtime_secs to calculate the rotationsyncclock.
2. when the result of "atoi" for nsslapd-XXX-logrotationtime is 0 due to the
invalid setting, logrotation time is reset to -1 (no rotation).
3. if nsslapd-XXX-logrotationtime and nsslapd-XXX-logexpirationtime is large
(near MAXINT) and calculated rotationtime_secs and/or exptime_secs is
overflown, set MAXINT to the sec value.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Summary: db2bak fails if the archive path exists and ends with '/'
Fix description:
1. Use path normalize API rel2abspath to remove the trailing '/'s.
2. db2bak renames the archive dir if the directory exists, checks the directory
is the db dir or not. If it is, the command line rename back the existing db
to the original and exits with the error: db2archive: Cannot archive to the db
directory. Then, the original dir is renamed back. If the db2bak runs as a
task (db2bak.pl or console), the server is up and running. Although the
backend is disabled, we don't want to rename the db path even for a short time.
That being said, changed the order to: check if the archive dir is the same as
db dir or not. It exits immediately.
|
| |
|
|
|
|
|
| |
Description: double err=32 result sent when suffix doesn't exist
Reviewed by: nkinder (Thanks!)
Fix Description: The backend does not send back a result if the op is search and the err is NO_SUCH_OBJECT (32). The frontend should handle this case so that it knows to defer sending the result until all of the backend candidates have been scanned. We also need to change send_nobackend_ldap_result() to use slapi_send_ldap_result instead of send_ldap_result so that it has the same semantics as the regular backend code.
Platforms tested: RHEL5 x86_64
|
| |
|
|
|
|
| |
Summary: miscellaneous memory leaks
Description: 1) fixed memory leaks
2) cleaned up normalize_path code with fixing memory leaks
|
| |
|
|
|
| |
Summary: vlv: crash after repeated backend creation/deletion
Description: added a check code for the backend's existing.
|
| |
|
|
| |
Summary: Don't send result twice when searching against a non-existent suffix.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Bug Description: rhds71 - search filters returns too many entries on integer attributes value greater than 2 to the power of 31
Reviewed by: nkinder, nhosoi (Thanks!)
Fix Description: The way >= and <= searches are supposed to work in LDAP is that you are supposed to define an ORDERING matching rule for the attribute you want to use in the search filter. The way our code is written, most strings "just work" as a side effect of the way bdb sorts the keys by default - so you can do (uid>=jvedder) and get what you would expect, even though LDAP says this is illegal because the schema definition of the uid attribute does not have an ORDERING matching rule. And INTEGER worked with the old binary format for the same reason. The only attribute definitions we use with ORDERING are attributes that use Generalized Time syntax (e.g. createTimestamp, et. al.) and numSubordinates (which uses INTEGER, but this is a special case handled internally by the db code).
The way it works now is that the indexing code will honor the ORDERING matching rule specified in the schema definition. Or, if ORDERING is not specified, the user can use the nsMatchingRule index configuration. This will allow an existing customer that depends all integer syntax attributes (e.g. uidNumber) to allow range searches by default to enable range searches without editing the schema. The syntax definition for the attribute must also specify a compare function. This compare function will be used by the bdb bt_compare() function.
I also fixed a bug in the integer normalize code - a string of all zeros should normalize to a single "0". In all other cases, the leading zeros should be removed.
Platforms tested: RHEL5 x86_64
Flag Day: Yes. Integer indexes will need to be rebuilt (except for numsubordinates).
Doc impact: Yes - document slapi API additions
QA impact: Pay close attention to tests that use >= or <= search filters, both with and without index attributes. Also, pay close attention to greater/less than searches using i18n collations.
New Tests integrated into TET: Forthcoming
|
| |
|
|
| |
Summary: Add entries to entrycache after adding operational attributes.
|
| |
|
|
|
|
| |
Summary: server crash after deleting supposedly deleted attribute
Description:
index.c: if there is no attribute to delete, don't call index_addordel_values_svstring.c: changed string_values2keys to handle NULL bvals
|
| |
|
|
| |
Summary: Remove hard-coded SASL mappings and use config based regex mappings instead.
|
| |
|
|
| |
Summary: Fixed leak of Slapi_Value in index code.
|
| |
|
|
| |
Summary: Presence filter using attribute subtype returns incorrect search results.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Bug Description: reliab15: slapd hangs on goblin5
Reviewed by: nhosoi (Thanks!)
Fix Description: We are calling the mtn_lock() twice in the same thread. The proposed fix is to move the mtn_lock() so this doesn't happen.
Platforms tested: RHEL5
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
|
| |
|
|
|
| |
Summary: reset db statistics between restarts
Description: cleaning up the db stats when the server is shutdown
|
| |
|
|
|
|
| |
Summary: server crashes in schema replication
Description: resetting the global linked list head when the first objectclass
is removed from the list.
|
| |
|
|
| |
Summary: Make dbscan handle special RUV related changelog entries.
|
| |
|
|
|
|
|
|
|
|
|
| |
Bug Description: Migration script does not migrate nsDS5ReplicaCredentials correctly.
Reviewed by: nkinder (Thanks!)
Fix Description: 7.1 and earlier chaining and replication credentials were stored incorrectly on little endian machines (x86 and itanium). They were "accidentally" stored correctly on big endian machines (sparc, pa-risc) because val == ntohl(val) on those platforms. When migrating from a little endian machine, we need to decode the password using the broken algorithm and re-encode it using the good method. We determine if the password is encode incorrectly by the following method: we use migratecred to decode and encode using the old path. If the values are equal, this means the password was already encoded correctly and we don't need to fix it. Otherwise, we set the flag that tells migratecred to fix it. In order to decode the broken password correctly on big endian machines, we have to swap the byte order to convert the values to little endian.
Platforms tested: RHEL5 x86_64, RHEL5 i386, Solaris 9
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Summary: ldapsearch hung at browsing index creation (comment #4)
Fix Description:
1. instead of covering all the reindexing look, set vlv lock just around
vlv_update_index, where vlv update is executed.
2. actually, lock is not meant to use for excluding the operation against vlv
reconfiguration. This ldbm_back_ldbm2index function first calls
instance_set_busy_and_readonly and protects the backend from the operation done
by other threads. vlv delete was just ignoring the busy/readonly setting.
Thus, changed the vlv code to respect the setting. Found the backend is busy,
deleting a vlv index fails and returns.
3. cleaned up the instance_set_busy_and_readonly function not to leak memory.
4. fixed minor memory leak.
|
| |
|
|
|
|
|
|
|
|
|
| |
Bug Description: Migration script does not migrate nsDS5ReplicaCredentials correctly.
Reviewed by: nhosoi (Thanks!)
Fix Description: We still need to be able to decrypt passwords using the broken method. I guess it works on Solaris and HP because the values are already in network byte order. But when the values were encrypted on x86, they were encrypted the wrong way. It is safe to use MIGRATE_BROKEN_PWD on Solaris and HP because it is essentially a no-op. But this allows us to decrypt x86 passwords and store them correctly.
Platforms tested: RHEL4 i386, RHEL5 x86_64
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
|
| |
|
|
|
|
|
|
|
| |
Summary: Online browsing indexing hangs
Description:
1. adding more shutdown checks in the indexing code to achieve the swift
shutdown even in the long running browsing indexing.
2. in the error case, cleaning up the index file.
3. found minor memory leaks.
|
| |
|
|
|
|
|
|
|
|
| |
Summary: CRM 1474928 : ds7.1 db index/vlv not handling a stop-slapd, hangs slapd
Description:
1. moved active thread count from ns-slapd to libslapd for the task threads to
use.
2. provided APIs to increment/decrement/get the active thread count
3. let task threads increment the active thread count when it's spawned and
decrement it when it quits.
|
| |
|
|
|
|
|
|
|
|
|
| |
Bug Description: rhds71 - search filters returns too many entries on interger attributes value greater than 231
Reviewed by: nhosoi (Thanks!)
Fix Description: The problem is that the current code uses atol() to convert the string value to an integer. long is 4 bytes or 8 bytes depending on the underlying platform. These binary values are stored in the index as 4 or 8 byte values. Finally, the behavior of atol() is different on the platform in overflow cases. Instead of dealing with binary values, we must store the values in string format, and perform string comparison, string normalization, and string key generation on INTEGER syntax values. I added another syntax type to the list in syntax.h. The code in string.c and value.c was mostly usable. I had to add some code in value_normalize to handle cases like " -00000001" -> "-1" to make it work like atol(), and I had to add some code to value_cmp to handle the sign (e.g. positive is always greater than negative, no other comparison is necessary) and magnitude (longer number is larger/smaller than shorter number, depending on sign). Otherwise, strcmp() does the right thing (e.g. "50" > "49", the same as int(50) > int(49)). One problem I ran into was that the value_normalize code takes just a char *, rather than a berval* or a char * + size_t length. To be efficient, this function should return the new length of the normalized string. Fortunately, none of the existing code cares about the length, but I needed the length for magnitude comparison, so I just used strlen for those cases. Which should be fine. value_normalize always produces a correctly null terminated string. I rewrote the value_cmp code to use a simple if rather than the switch statement. This makes it much clearer - if syntax is case insensitive, use slapi_utf8casecmp - if case sensitive, use strcmp - otherwise, error.
I also found a problem with the ldif2db code, which I uncovered because I added my integer indexes online and did an online import. The db2index code will correctly clear the INDEX_OFFLINE bit after the index is completed, but the ldif2db code will not.
Platforms tested: RHEL5 x86_64
Flag Day: Yes, if you are upgrading and you have integer valued indexes, you will have to remove them and recreate them.
Doc impact: We will have to document this in the release notes.
|
| |
|
|
| |
Summary: Don't try to dlopen ldap SSL libs in ldclt.
|
| |
|
|
| |
Summary: Allow server to start if descriptor related attributes are set too high.
|
| |
|
|
| |
Summary: Performance cleanup of sync code. Improve tombstone search performance.
|
| |
|
|
|
|
|
|
|
| |
Bug Description: crash at startup with new ldap sdk on 64-bit platform
Reviewed by: nkinder (Thanks!)
Fix Description: Use LBER_SOCKET as the socket type instead of int. There was also a place in ldclt where we were doing the same thing.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
|
| |
|
|
|
|
|
|
| |
Summary: verify-db.pl (db_verify) does not work on a little endian machine
(comment #1-#4)
Description: 1) introducing dbverify mode to ns-slapd.
2) providing new script dbverify to call "ns-slapd dbverify"
3) fixing verify-db.pl to call dbverify instead of db_verify from BDB
|
| |
|
|
| |
Summary: Handle syncing multi-valued street attribute to AD.
|
| |
|
|
|
|
|
|
|
|
|
| |
Bug Description: Migration script does not migrate nsDS5ReplicaCredentials correctly.
Reviewed by: nhosoi (Thanks!)
Fix Description: This was a big endian vs. little endian issue. We only use name based UUID generation with the reversible password code. This code was not doing the ntoh with the numeric values generated. I'm sure there is probably a compiler warning about this on some platform.
Platforms tested: RHEL5 x86_64, Solaris 9 64-bit
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
|
| |
|
|
|
|
|
|
|
| |
Bug Description: enabling chain-on-update causes replica to act as a master
Reviewed by: nkinder (Thanks!)
Fix Description: This fix is only minor - we must use sym_load() to look up plugins, including the entry distribution plugin we use for chain on update. But I don't believe this was causing the problem. Chain on update does not work if you BIND as directory manager. You must bind as a regular user. It may be difficult to change this. We need to do more testing to see if, in general, proxy BIND and operations work with directory manager. The chaining backend cannot use directory manager as the proxy user.
Platforms tested: RHEL5
Flag Day: no
Doc impact: Yes, we need to make sure we document exactly how chain on update is to be used.
|
| |
|
|
|
|
| |
Summary: cyclic dependency from getpwnam() in log rotation code
Description: Moved getpwnam call to the startup time, store the info in
slapdFrontendConfig to reuse.
|
| |
|
|
|
|
|
|
| |
Bug Description: Does not build on Fedora 8
Fix Description: If using the O_CREAT flag with open(), the file mode must also be given. Also, the bdb calls to use ->open() must use parentheses around the function pointer access e.g. (DB->open)(args...) instead of just DB->open(args).
Platforms tested: RHEL4, Fedora 8
Flag Day: no
Doc impact: no
|
| |
|
|
|
|
|
|
|
|
| |
Bug Description: Change filesystem path naming from "fedora-ds" to "dirsrv"
Reviewed by: nkinder (Thanks!)
Fix Description: Mostly just changing the package name in configure.ac, and making sure we consistently use that in path naming (e.g. /etc/@PACKAGE_NAME@ or /etc/@PACKAGE_NAME_BASE@ for adminserver).
Platforms tested: RHEL4, FC6
Flag Day: no
Doc impact: Oh yes.
QA impact: Any existing tests that depend on /path/brand-ds will need to change to use dirsrv. It is highly encouraged to use a macro or variable for the package name in any scripts to minimize the impact of future package name changes.
|
| |
|
|
| |
Windows.
|
| |
|
|
| |
Summary: not all the addresses associated with listenhost are bound to listen sockets (comment #10)
|
