summaryrefslogtreecommitdiffstats
path: root/ldap/servers
Commit message (Collapse)AuthorAgeFilesLines
...
* 539618 - Replication bulk import reports Invalid read/writeNoriko Hosoi2010-02-224-9/+37
| | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=539618 Descriptions: When a protocol is freed by prot_free, prot_close is supposed to have been called to stop the main thread prot_thread_main. But, there was no mechanism for the freeing thread whether the prot_thread_main has already quitted or not, it could have released the Repl_Protocol even though it was still being in use. This fix is adding a checking method. The same test revealed ldbm_back_modrdn had a chance to access a field of NULL entry structure.
* 527848 - make sure db upgrade to 4.7 and later works correctlyNoriko Hosoi2010-02-182-68/+61
| | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=527848 Change Description: 1. Replication Changelog 1-1. In the clean recover mode, transaction logs should not be removed. 1-2. When nsslapd-db-circular-logging is on (by default, it's on), call log_archive function with DB_ARCH_REMOVE, which removes log files that are no longer needed. 1-3. Call transaction checkpoint just before shutting down the server. 1-4. "From string" in the upbrade message had a flaw. 2. Backend dblayer 2-1. In checkpoint_threadmain, call log_archive with DB_ARCH_ABS, which returns the absolute path of the transaction log files. It eliminates the code which generates the absolute paths.
* change syntax plugins to register required matching rule pluginsRich Megginson2010-02-1715-104/+1134
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=559315 Resolves: 559315 Description: Searching some attributes are now case sensitive when they were previously case-insensitive Reviewed by: nhosoi (Thanks!) - also added some suggested comments I added code to allow the syntax plugins to register corresponding matching rules. That is, the functions that the syntax plugins use for filter matching and key generation can also be used for matching rules with the new wrapper code. I added some convenience functions and structures in the syntax plugin code to make it easier to add matching rules in the future. I also added a new feature to the matching rule code - in the LDAP spec definition of matching rule, the syntax provided in the matching rule definition is the syntax for the _assertion value_ used with the matching rule, which is not necessarily the same as the syntax of the _attribute values_ to which the matching rule can be applied. For example, matching rules that apply to syntax DirectoryString can also be applied in some cases to PrintableString, CountryString, and IA5String. There are several other cases like this as well. I also introduced the concept of a compat syntax that can be used with a matching rule. The server will now check, when reading in the schema, if the syntax and matching rules for an attribute are consistent. Finally, for 05rfc4523.ldif, I changed the attributes to use octetStringMatch instead of one of the unimplemented certificate matching rules.
* change extensible filter code to use new syntax function style mr funcsRich Megginson2010-02-172-100/+327
| | | | | | | | | | | Created wrappers around the new syntax style functions to make them look like the old style filter functions. There are a few caveats: 1) SUBSTRING extensible filter searches are not supported. There is no way currently to pass in the timelimit required by the syntax substring filter functions. 2) ORDERING only does greater than or equal. There is no standard way to do an extensible match with a standard ordering matching rule and specify less than or greater than.
* wrap new style matching rule plugins for use in old style indexing codeRich Megginson2010-02-176-46/+268
| | | | | | | Create wrappers for the new syntax plugin style matching rule code so that we can use the old matching rule indexing functions. Introduced a new type of indexer for Slapi_Value values. The old style used struct berval * values, but the syntax plugins and a lot of newer code work with Slapi_Value* instead.
* Do not use syntax plugins directly for filters, indexingRich Megginson2010-02-1723-195/+675
| | | | | | | | | | | There were many places in the server code that directly used the syntax plugin for the attribute. If the attribute schema definition specified a matching rule, we must use that matching rule for matching values of that attribute, filtering that attribute, and generating index keys for values of that attribute. New internal and plugin APIs have been added that use the Slapi_Attr* instead of using the syntax plugin directly. The new API will determine which matching rule to apply based on the schema definition.
* Bug 434735 - Allow SASL ANONYMOUS mech to workNathan Kinder2010-02-171-1/+26
| | | | | | | | | | | | The SASL ANONYMOUS mechanism was broken since the SASL mapping code was invoked to map anonymous to a real user entry. This adds a special case to the canonify user callback that sets the bind DN to "" if the ANONYMOUS mechanism is being used. I also added a check to see if anonymous access is disabled when we set up the SASL secprops for a connection. If anonymous access is disabled, we set a SASL security flag to disallow mechanisms that would allow anonymous access.
* 565987 - redhat-ds-base fails to build due to undefined structNoriko Hosoi2010-02-173-16/+123
| | | | | | | | | | | | | | st_size and nsldapi_build_control et al. in ldclt.c https://bugzilla.redhat.com/show_bug.cgi?id=565987 Fix Description: 1. stat: sys/types.h and sys/stat.h need to be included. 2. nsldapi_build_control: duplicated nsldapi_build_control from the mozldap c library. 3. added the sub value [=deref:attr] of deref to the usage. 4. allow -e deref without the sub value. It used to be allowed, but it was forbidden by the previous change.
* 565664 - Incorrect parameter for CACHE_RETURN()Noriko Hosoi2010-02-151-1/+1
| | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=565664 Description: Special thanks to edewata@redhat.com for fixing the bug. > See ldap/servers/slapd/back-ldbm/id2entry.c line 196. > The second parameter should be a pointer to pointer, > but the current code passes a regular pointer: > CACHE_RETURN(&inst->inst_dncache, bdn);
* 563365 - Error handling problems in the backend functionsNoriko Hosoi2010-02-106-79/+132
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=563365 1) Error handling in ldbm_back_{add,delete,modify,modrdn} functions was incomplete. When any error occurs after the transaction begins, the changes made after that should be aborted. There were some cases the abort was not called. 2) If modrdn failed in ldbm_back_modrdn, new DN in the DN cache was not removed. 3) config_set_instancedir in libglobs.c was missing the function type.
* 548535 - memory leak in attrcryptNoriko Hosoi2010-02-083-2/+35
| | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=548535 Description: The attrcrypt module maintains the inst_attrcrypt_state_private field in the instance structure (ldbm_instance) to store the private keys. The area and the space for the private keys are allocated in attrcrypt_init which is called from dblayer_instance_start. A backend instance could be closed and restarted multiple times (for instance, in the bulk_import, which is used by the replica initialization), but the area had no chance to be freed. This patch is adding the clean-up code.
* Undo - 555577 - Syntax validation fails for "ou=NetscapeRoot" treeNoriko Hosoi2010-02-014-40/+25
| | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=555577 Undoing the previous checkin. The parameter "strict" is for the trength of the DN validation. It should be confusing to use it for turning on/off the validation itself.
* 555577 - Syntax validation fails for "ou=NetscapeRoot" treeNoriko Hosoi2010-02-014-25/+40
| | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=555577 [See comment 7 of the bug] DistinguishName validation slapi_dn_syntax_check should be called only when nsslapd-dn-validate-strict is on.
* 559016 - Attempting to rename suffix returns inappropriate errorsNoriko Hosoi2010-01-293-20/+60
| | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=559016 [Fix Description] If the target dn of the modrdn operation is a suffix, check if the new dn already exists or not. If it exists, it returns LDAP_ALREADY_EXISTS. If the backend associated with the new dn does not exist, it returns LDAP_NO_SUCH_OBJECT. Otherwise, it returns LDAP_NAMING_VIOLATION. If the target dn of the modrdn is attempted to move across backends, it returns LDAP_AFFECTS_MULTIPLE_DSAS instead of LDAP_UNWILLING_TO_PERFORM. Modrdn (op_shared_rename) was logging the parameter errors in the clients request as SLAPI_LOG_FATAL. Reduced the level to SLAPI_LOG_ARGS. Also, replaced ldap_explode_dn with slapi_dn_syntax_check to verify the newsuperior. By the replacement, 2 bugs in slapi_dn_syntax_check were found. 1) The key for the DN in the hashtable of the attribute syntax has to be "distinguishedName". 2) Argument type for plg_syntax_validate was not correct.
* 247413 - Incorrect error on multiple identical value addNoriko Hosoi2010-01-281-1/+3
| | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=247413 [Problem Description] Adding multiple identical values returns "Operations error (LDAP_OPERATIONS_ERROR == 0x1)" instead of "Type or value exists (LDAP_TYPE_OR_VALUE_EXISTS == 0x14)" E.g., dn: ou=test,dc=example,dc=com changetype: modify replace: description description: test description: test modifying entry "ou=test,dc=example,dc=com" ldap_modify: Operations error (1) [Fix Description] API valueset_replace used to override any error from the lower layer with LDAP_OPERATIONS_ERROR. If the error is LDAP_TYPE_OR_VALUE_EXISTS, the error is now returned as is.
* 557224 - subtree rename breaks the referential integrity plug-inNoriko Hosoi2010-01-281-209/+493
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=557224 Fix Description: The referential integrity plugin has not supported the subtree rename (modrdn with newsuperior). This patch is adding the support. There are 2 typical cases. (case 1) DN that modrdn modifies matches the value of attributes which is the target of the referential integrity. E.g., modrdn: uid=A,ou=B,o=C --> uid=AA,ou=BB,o=C then, member: uid=A,ou=B,ou=C --> uid=AA,ou=BB,ou=C seeAlso: uid=A,ou=B,ou=C --> uid=AA,ou=BB,ou=C (case 2) DN that modrdn modifies is the ancestor of the value of attributes which is the target of the referential integrity. E.g., modrdn: ou=B,o=C --> ou=BB,o=C then, member: uid=A,ou=B,ou=C --> uid=A,ou=BB,ou=C seeAlso: uid=A,ou=B,ou=C --> uid=A,ou=BB,ou=C
* Bug 549554 - Trim single-valued attributes before sending to ADNathan Kinder2010-01-271-44/+159
| | | | | | | | | | | | | | | | | There are a number of attributes that AD defines as single-valued that are multi-valued in the LDAP RFCs. We already had a few special cases in the winsync code where we only send one attribute to AD to allow the change to be accepted. We then simply check if the value in AD is present in DS when comparing entries for further changes. This fix cleans up that old implementation a bit by adding a static list of these single-valued attributes and a helper function to check if a particular type is in that list. I also had to extend the attr_compare_present() function to allow a length to be passed in for limiting the comparison to a portion of the values. This is needed for the initials attribute, which is single-valued and length constrained in AD.
* Bug 537466 - nsslapd-distribution-plugin should not require plugin name to ↵Rich Megginson2010-01-261-7/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | begin with "lib" https://bugzilla.redhat.com/show_bug.cgi?id=537466 Resolves: bug 537466 Bug Description: nsslapd-distribution-plugin should not require plugin name to begin with "lib" Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: We use the function PL_GetLibraryName from NSPR to get the platform specific DLL/shared lib filename suffix. Unfortunately, this function also prepends the string "lib" to the given name if the given file has no suffix. If the given name already has the correct suffix, it does not prepend the "lib" to the name. get_plugin_name() should look for the original library name in the string returned by PL_GetLibraryName. If it is there, and has something before it in the string, see if it is "/lib" - if so, remove the extraneous "lib" string. If "/lib" is not there, then just pass the string through as is. To summarize: /full/path/to/name.so -> /full/path/to/name.so - error if /full/path/to/name.so does not exist name -> /default/plugin/path/libname.so -> /default/plugin/path/name.so name.so -> /default/plugin/path/name.so Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Bug 543080 - Bitwise plugin fails to return the exact matched entries for ↵Rich Megginson2010-01-261-2/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Bitwise search filter https://bugzilla.redhat.com/show_bug.cgi?id=543080 Resolves: bug 543080 Bug Description: Bitwise plugin fails to return the exact matched entries for Bitwise search filter Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: The Microsoft Windows AD bitwise filters do not work exactly like the usual bitwise AND (&) and OR (|) operators. For the AND case the matching rule is true only if all bits from the value given in the filter value match the value from the entry. For the OR case, the matching rule is true if any bits from the value given in the filter match the value from the entry. For the AND case, this means that even though (a & b) is True, if (a & b) != b, the matching rule will return False. For the OR case, this means that even though (a | b) is True, this may be because there are bits in a. But we only care about bits in a that are also in b. So we do (a & b) - this will return what we want, which is to return True if any of the bits in b are also in a. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Clean up assert for entrydnRich Megginson2010-01-261-1/+1
| | | | Use entryrdn instead
* Net::LDAP password modify extop breaks; msgid in response is 0xFFRich Megginson2010-01-261-1/+3
| | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=554887 Resolves: bug 554887 Bug Description: Net::LDAP password modify extop breaks; msgid in response is 0xFF Reviewed by: ??? Branch: HEAD Fix Description: We use a fake conn for the internal password modify operation so that we can use the real credentials. Unfortunately, this messes up the result code - because there is a real, non-NULL conn, it thinks it needs to send the result back to a real client rather than handle it as an internal operation. It looks as though o_result_handler is only used for internal operations. The fix is to change the result handling code to check for an internal op OR conn == NULL to see if we should use the result handler instead. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 544089 - Referential Integrity Plugin does not take into account the attributeNoriko Hosoi2010-01-251-68/+84
| | | | | | | | | | | | | | | | | | | | | subtypes Bug Description: Referential Integrity Plugin does not change the references in subtyped attributes like "manager;en" or "ou;19" Fix Description: The problem is in the way the function int update_integrity (char **argv, char *origDN, char *newrDN, int logChanges) in referint.c makes the changes. The initial search with the filter ldap_create_filter( filter, filtlen, "(%a=%e)", NULL, NULL, argv[i], origDN, NULL) finds the entries with attributes and with attribute subtypes. But after that when generating the necessary changes (attribute1.mod_type = argv[i] and attribute2.mod_type = argv[i]) the function takes care only of the "base" attributes listed in the plugin arguments. We should parse each found entry to find all the attribute subtypes with the value concerned and then make changes to them all. Note: This bug was reported by andrey.ivanov@polytechnique.fr, and the bug fix was also provided by him. The patch was reviewed by rmeggins@redhat.com as well as nhosoi@redhat.com.
* several spelling errors389-ds-base-1.2.6.a1Rich Megginson2010-01-257-11/+11
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=558518 Resolves: bug 558518 Bug Description: several spelling errors Reviewed by: ??? Branch: HEAD Fix Description: Fix several spelling errors in error messages and man pages. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Allow modrdn to move subtree and rename non-leaf nodeNoriko Hosoi2010-01-2269-2510/+9832
| | | | | | | | | | | | | | | | | | | | | | | | | This patch includes - replacing the entrydn index with the entryrdn index - replacing a full DN in each entry in the DB with an RDN - extending Slapi_Entry, entry2str, and str2entry to absorb the changes made on the entry - adding DN/RDN helper functions - adding DN cache - adding a utility and a migration script to convert the DN format database to the RDN format - extending a database dump utility dbscan to support the entryrdn - slapi_dn_syntax_check by nkinder@redhat.com is added to check the dn before modify operations - big fix for 171338 - Enhancement: winsync modrdn not synced In addition to the above, compile warnings and memory leaks found in testing the new feature are fixed. For more details, see the feature design document at: http://directory.fedoraproject.org/wiki/Subtree_Rename and bugzilla at: https://bugzilla.redhat.com/show_bug.cgi?id=171338
* Bug 536703 - Don't send empty mod to AD for mapped DN valuesNathan Kinder2010-01-221-1/+5
| | | | | | | | | | | | | | | When using winsync, setting a mapped DN attribute (such as seeAlso) to a DN outside the scope of the sync agreement causes an empty modify operation to be sent to AD. This causes AD to respond with LDAP error 89, which triggers the update to abort. The problem is that windows_update_remote_entry() uses a flag to determine if it has a modify to send to AD. This flag is set by windows_generate_update_mods(), but the mods are empty since it is detecting that the DN used in seeAlso is not in the scope of the sync agreement. The fix is to only set the modify flag if we actually have mods to send.
* Bug 557185 - Unterminated string after strncpy in Retro Changelog PluginEndi S. Dewata2010-01-201-0/+1
| | | | | | | | According to the strncpy() manual, if there is no null byte among the first n bytes of src, the string placed in dest will not be null terminated. To fix the problem the null byte should be added manually. Reviewed by: rmeggins Pushed by: rmeggins
* ldclt: -e randombinddnfromfile fails with LDAP_UNWILLING_TO_PERFORM (53)Noriko Hosoi2010-01-143-21/+38
| | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=555189 Resolves: bug 555189 Bug Description: ldclt code is not passing the password correctly to ldap_sasl_bind_s. The server receives NULL credential. Due to the default configuration: nsslapd-allow-unauthenticated-binds: off the unauthenticated bind fails with LDAP_UNWILLING_TO_PERFORM. Reviewed by: rmeggins@redhat.com Files: see diff Branch: HEAD Fix Description: When "-e randombinddnfromfile=file" is given, bind dn and password pair is retrieved from the file and is supposed to pass to ldap_sasl_bind_s. Although the password was read from the file, but it was not set to the berval "cred" which was passed to ldap_sasl_bind_s. Therefore, the bind operation tried to bind with bind dn and NULL password, which now fails since it's considered as an unauthenticated bind. This change fixes the problem. Also, a usage typo is being fixed. Platforms tested: Fedora 11 Flag Day: no Doc impact: no
* Add Doxygen comments for SLAPI attr, value, and valueset functions.Nathan Kinder2010-01-131-4/+1085
| | | | | This adds Doxygen comment blocks to the public header file for the attr, value, and valueset related fucntions and defines.
* Bug 553027 - Support for nsUniqueId and alias in Retro Changelog.bug509201andV3quotesEndi S. Dewata2010-01-133-11/+93
| | | | This patch adds support for storing the target's nsUniqueId in change log record and renaming any additional attribute using an alias.
* Uninitialized mutex in Retro Changelog Plugin. ↵Endi S. Dewata2010-01-132-17/+4
| | | | https://bugzilla.redhat.com/show_bug.cgi?id=554841 Resolves: bug 554841 Bug Description: Enabling Retro Changelog Plugin on a DS instance provisioned by Samba will crash slapd during startup. Branch: HEAD Fix Description: Apparently the retrocl_internal_lock is still NULL when it's used in retrocl_get_first_changenumber(). The solution is to initialize the lock in the retrocl_plugin_init(). Platforms tested: F12 i386
* Workaround bogus base64 encoded passwords that end in newlineRich Megginson2010-01-114-7/+20
| | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=552421 Resolves: bug 552421 Bug Description: Cannot log into admin server after upgrade (fedora-ds-admin-1.1.6 -> 389-admin-1.1.9 Reviewed by: nkinder (Thanks!) Branch: HEAD Fix Description: Some older versions of setup encoded the admin password in SHA and added a trailing newline to the userPassword attribute when adding the admin entry. This changes the SHA passsword compare routine to ignore a trailing newline character in the dbpwd. newline is not a valid base64 character. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Bug 553455 - fix segfault when changing a passwordNathan Kinder2010-01-081-2/+6
| | | | | | | | If a local password policy is set that does not have a storage scheme specified, the server can crash since it tries to dereference a NULL pointer to access the hashing function. This fix simply checks if the storage scheme is set before trying to access the hashing function.
* Password replication from 389DS to AD failsRich Megginson2010-01-041-1/+1
| | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=537956 Resolves: bug 537956 Bug Description: Password replication from 389DS to AD2008(64bit) fails, all other replication continues Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Broken during adding support for openldap API. I added the function slapi_ldap_bind which returns the result code. The old function being used by the winsync code expected the function to return the msgid, which is now returned as one of the function arguments instead. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Bug 548537 - Fix memory leaks in DNA pluginNathan Kinder2009-12-171-0/+4
| | | | | | | This fixes three small memory leaks in the DNA plugin. We were leaking the extended operation request data and response data for range requests as well as an attribute value for ADD operations when checking for the magic value.
* Add missing paran from fix for bug 518084Nathan Kinder2009-12-161-1/+1
| | | | | The fix for bug 518084 was missing a paran on one line of source for the pblock functions. This corrects the syntax error.
* Document SLAPI DN related functions.Nathan Kinder2009-12-151-8/+913
| | | | | This patch adds Doxygen comment blocks for the DN related functions in slapi-plugin.h.
* Bug 518084 - Fix out of order retro changelog entriesNathan Kinder2009-12-154-6/+36
| | | | | | | | | | | | | | | | | When using the retro changelog plugin, post-op plugins that perform internal operations (such as memberOf) can result in the internal operation preceeding the original operation in the changelog. The fix is to give the retro changelog a higher precedence than the other post-op plugins. This required some core server changes to be made around the plugin precedence to allow an object plugin to pass it's precedence into it's calls to slapi_register_plugin() when it registers other plugin types. I added an update LDIF to set the plugin precedence when running "setup-ds.pl -u". I also noticed an AVC when restarting after the update due to the schema.bak directory that is created. I've adjusted the dirsrv SELinux policy to deal with this AVC.
* Set unknown attribute syntax to Octet String.Nathan Kinder2009-12-113-5/+5
| | | | | | | | | | | When an unknown attribute type is used (when adding an entry using the extensibleObject objectclass for example), the syntax of the attribute defaults to "Directory String". This places syntax restrictions on the attribute, limiting the attribtues use to specific types of values. This patch changes the syntax for unknown attribute to "Octet String", which allows 0 or more UTF-8 bytes. This will allow unknown attributes to store binary or empty values.
* Bug 497556 - LDAPI connections cause TCP performance degradationNathan Kinder2009-12-091-0/+1
| | | | | | | | | | If a slot from the connection table had previously been used for an LDAPI connection, it would cause serious performance degradation (20 times worse on my system) to a TCP connection that reused the same slot. The problem was that we were not clearing the flag that indicates that a connection is a UNIX local socket in the connection cleanup function. Clearing this flag makes the reused slots perform as expected.
* Bug 195302 - Fix crash regression from previous fixNathan Kinder2009-12-071-1/+1
| | | | | | The previous fix for bug 195302 caused a crash during import. We need to check if sdn is NULL before trying to get the dn member from it in pw_encodevals_ext().
* Bug 201275 - Make SASL EXTERNAL bind obey account lockNathan Kinder2009-12-021-0/+12
| | | | | | | | This patch makes SASL EXTERNAL binds obey the account lock. The previous code was allowing the bind through even if the account was locked. This patch was contributed by Ulf Weltman of Hewlett Packard.
* Bug 193297 - Call bind pre-op and post-op plug-ins for SASL bindsNathan Kinder2009-12-022-2/+33
| | | | | | | This patch makes SASL binds call the pre-op and post-op plug-ins. The previous code was not calling the plug-ins for SASL binds. This fix was contributed by Ulf Weltman of Hewlett Packard.
* Bug 195302 - Allow fine-grained password storage scheme to be setNathan Kinder2009-12-016-32/+117
| | | | | | | | | This patch makes the server use the password storage scheme set in the appropriate fine-grained password policy (if it is set). The previous code was always using the global storage scheme. This fix was based off of a fix contributed by Ulf Weltman of Hewlett Packard.
* Add bounds checking in DN unescape functionNathan Kinder2009-11-181-2/+4
| | | | | | | My previous patch for bug 504817 could cause us to read past the end of the RDN string if it ended with a single escape character. This fix adds a bounds check to ensure that we don't read past the end of the string.
* Avoid freeing NULL trimmed passwords listNathan Kinder2009-11-161-9/+9
| | | | | | My previous patch for removing the fixed length buffer used in the password history checking code introduced a problem where we could attempt to free a NULL pointer.
* Bug 515329 - Correct attribute value inconsistency on replicaNathan Kinder2009-11-161-9/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When performing operations with multiple mods to the same multi-valued attribute on a single modify operation, a replica was not resolving the attribute values correctly. This would lead to an inconsistency between the master the change was initially performed against and the replicas. The problem would occur with a modify operation such as this: dn: uid=testuser,dc=example,dc=com changetype: modify add: cn cn: 2 - replace: cn cn: 3 The problem is that we use the CSNs from the attribute state data to determine which values should remain after the operation (this is done to merge with later occuring changes from other masters). The CSN for all mods within the same modify operation is exactly the same. The old code was looking for attributes older than the deletion that occurs as a part of the replace, then deleting those values. This would cause the value of "2" in the above example to remain. Simply changing this comparision to look for values with the same or older CSN to delete would cause the new value of "3" to be removed as well when we get around to resolving the attribute after the second half of the replace operation. The fix is to use a different CSN comparison when we are removing all values of an attribute during attribute resolution (remove values with the same or older CSN). This is safe becuse the only present values at this time are older values or values added in a previous mod in the same modify operation. When processing other mods that are not removing all values of an attribute, we only want to remove values with a CSN older that that of the current modify operation. This prevents us from removing a newly added value, such as "3" in the example above. This is safe since we resolve the attribute after each mod in the modify operation.
* Implement support for versioning and release engineering procedures - ↵389-ds-base-1.2.5.a1Rich Megginson2009-11-1657-96/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | version 1.2.5.a1 Instead of changing configure.ac AC_INIT for each version change, there is a new file - VERSION.sh. This file also contains support for creating version numbers for pre-releases, and pre-release strings containing git commit hashes. One of the complications is that AC_INIT does not allow you to override the version and package tarname fields. We can override them after the fact everywhere except in config.h. AC_INIT defines the following which we would like to override but cannot: PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_STRING PACKAGE_BUGREPORT Instead, we define DS_ versions of these e.g. DS_PACKAGE_VERSION etc. and make these available with AC_DEFINE(DS_PACKAGE_VERSION,...) etc. As an extra added precaution, we undefine these in Makefile.am like this: DS_DEFINES = ... \ -UPACKAGE_VERSION -UPACKAGE_TARNAME -UPACKAGE_STRING -UPACKAGE_BUGREPORT If someone tries to use PACKAGE_VERSION in C code, they will not be able to, and will have to use DS_PACKAGE_VERSION instead. All of the DS code that used PACKAGE_VERSION has been changed to use DS_PACKAGE_VERSION instead. There is a new make target - git-archive - as a convenience for creating source tarballs from git. By default, the source archive will be placed in the build directory - you can specify SRCDISTDIR=/path/to/SOURCES to use an alternate dir (e.g. make SRCDISTDIR=/path/to/rpmbuild/SOURCES git-archive to make a source tarball for rpmbuild) configure will print the branded package name and version Reviewed by: nkinder (Thanks!)
* Bug 504817 - Handle LDAPv2 quoted RDN values correctlyNathan Kinder2009-11-111-28/+26
| | | | | | | | | | | | The bug fix for bug 438139 introduced a regression that causes the server to not handle LDAPv2 quoted RDN values correctly. We were including the '"' characters used to contain an unescaped value in the actual value itself. The proper thing to do is to eliminate any '"' characters that are not escaped when we unescape the value. I have tested this new fix with the oringinal issue from bug 438139 to ensure that it does not introduce a regression for that bug.
* Bug 497199 - Skip dirsync if disconnected during incremental updateNathan Kinder2009-11-101-2/+6
| | | | | | | | | | | If some sort of error occurs during the sending updates to AD phase of an incremental winsync update, we still attempt to send the dirsync control to AD. This can cause spurious error messages to be logged to the errors log stating that we can't send the control since we are not connected to AD anymore. This patch simply skips sending the dirsync control if we encountered an error sending updates to AD.
* 516089 - add dereference search option into ldcltYi Zhang2009-11-104-11/+136
| | | | | | | This option will accept format like "-e deref=derefAttr:attr" to ldclt when "-e esearch" is requested. example: -e esearch -e deref=secretary:mail search will dereference the "secretary" attribute and then return the "mail" attribute value
generated by cgit (git 2.34.1) at 2025-09-26 21:36:09 +0000