summaryrefslogtreecommitdiffstats
path: root/ldap
Commit message (Collapse)AuthorAgeFilesLines
...
* 204410 - Pick up new ldapcsdk, nspr, and sasl componentsNathan Kinder2006-08-286-14/+15
|
* 204355 - Remove winsync code from ldapserver treeNathan Kinder2006-08-2864-14017/+0
|
* [203214] RHDS fails to start on HP-UX 11.23.Noriko Hosoi2006-08-241-6/+14
| | | | Fix Descrition: Stopped using basename and dirname.
* 203043 - Optimizations in password generationNathan Kinder2006-08-211-21/+13
|
* 203043 - Support password generation when using the password modify extended ↵Nathan Kinder2006-08-181-42/+122
| | | | operation
* 202872 - Allow password modify extended operation when using SASL privacy layerNathan Kinder2006-08-176-4/+30
|
* use slapi_entry_attr_get_bool instead of slapi_entry_attr_get_int for the ↵Rich Megginson2006-05-251-4/+4
| | | | fallback and secure config attrs
* [192901] DS returns an entry that does not match the filterNoriko Hosoi2006-05-241-1/+1
| | | | If NOTFOUND is returned from new idl, keep ALLID to check with the filter later.
* Bug(s) fixed: 186280Rich Megginson2006-05-2214-1360/+45
| | | | | | | | | | | | | Bug Description: Close potential security vulnerabilities in CGI code - dsgw get/post arguments Reviewed by: Noriko and Nathan (Thanks!) Fix Description: Fortunately, the code was pretty clean already. There were just a few places I needed to add some file or path name checking. I also got rid of some code. Platforms tested: Fedora Core 5 Flag Day: no Doc impact: no QA impact: should be covered by regular nightly and manual testing New Tests integrated into TET: none
* [191832] changing password sometimes crashes the server [Admin Server ↵Noriko Hosoi2006-05-191-2/+2
| | | | | | password always remembers initial password on (part 2)] acl_access_allowed: changed to check the given entry address with the one in aclpb. If they don't match, even if the sdn's match, let acl re-evaluate.
* 190724 - Array initialization needed to be changed to fix a HP-UX PA ↵Nathan Kinder2006-05-051-1/+3
| | | | compilation error
* 190724 - Evaluate ACIs before checking password syntaxNathan Kinder2006-05-052-2/+47
|
* 16578 - Fixed off by one error in month in logconv.plNathan Kinder2006-04-181-12/+12
|
* [189264] 6.11->6.21 upgrade, no db housekeeping threadsNoriko Hosoi2006-04-181-6/+4
| | | | | | | | The problem was check_db_version finds the existing DBVERSION is old and set dblayer_private->blayer_recovery_required = 1. If it's set, DBLAYER_CLEAN_RECOVER_MODE is processed properly. Unfortunately, it was "reinitialized" in the function read_metadata, which is called after check_db_version.
* 189176 - Fixed aci for directory administrators group.Nathan Kinder2006-04-181-1/+1
|
* 188931 - Use system Net-SNMP libraries on Linux systemsNathan Kinder2006-04-133-9/+34
|
* [186642] Directory Server Makefile updates for Internal buildNoriko Hosoi2006-04-131-0/+9
| | | | Package 32-bit LDAPSDK, NSPR, and NSS libraries in shared32/lib for perldap (Solaris and PA-RISC only).
* Bug(s) fixed: 186280Rich Megginson2006-04-1173-304/+398
| | | | | | | | | | | | | | | | | | | | | | | | | | Bug Description: ldapserver: Close potential security vulnerabilities in CGI code Reviewed by: Nathan, Noriko, and Pete (Thanks!) Fix Description: Clean up usage of sprintf, strcpy, fgets instead of gets, fixed buffer usage, etc., mostly in the CGI code and other user facing code (i.e. setup). Also, Steve Grubb told me about a GCC trick to force it to check printf style varargs functions, to check the format string against the argument string, for type mismatches, missing arguments, and too many arguments. In the CGI form argument parsing code, we needed to be more careful about checking for bad input - good input is supposed to look like this: name=value&name=value&..... &name=value. I don't think the original code was checking properly for something like name&name=value. There was another place where we were not checking to see if a buffer had enough room before appending a string to it. I had to change a couple of functions to allow passing in the size of the buffer. Fixed some issues raised by Noriko and Nathan. Platforms tested: RHEL4 Flag Day: no Doc impact: no QA impact: should be covered by regular nightly and manual testing New Tests integrated into TET: none
* Moved the SMARTHEAP macro setting from slapd local Makefile to global ↵Noriko Hosoi2006-04-071-27/+0
| | | | nsconfig.mk so that the makefile used for packaging gets the info.
* Previous checkin introduced this bug: a whitespace is inserted by putting a ↵Noriko Hosoi2006-04-071-2/+2
| | | | comment at the end of the macro assignment for Solaris JDK Version; moved the comment to one line above.
* [186642] Directory Server Makefile updates for Internal build (Comment #6)Noriko Hosoi2006-04-075-59/+132
| | | | | | | | | | | | | 1) picked up the latest components including Cyrus SASL, Perldap, SetupUtil, and AdminServer 2) fixed the java paths for the internal build. 3) added an option -AA to HP-UX C++ compiler to adjust to SetupUtil build (use libstd 2) 4) replaced <iostream.h>, <strstream.h> and <fstream.h> with <iostream>, <strstream>, <fstream> respectively in ldap/cm/newinst/ux-dialog.cc 5) package svrcore and perldap, which were dropped in the current ldap/cm/Makefile 6) added a perl script genPerlDAPInf.pl to generate perldap.inf file
* setup.inf, setup.res, silent.inf, unzip_wrapper.pl, LICENSE.txt, README.txt ↵Noriko Hosoi2006-04-041-4/+10
| | | | were missing from the tar-gz package file.
* [186642] Directory Server Makefile updates for Internal buildNoriko Hosoi2006-03-2913-80/+108
| | | | | | | | | . removed the dependency on DBM . Updated components' RELDATEs. . Console jar file name adjustment: <brand>-<comp>-<dotversion>.jar . Fix for HP-UX IPF . Use non-branded SetupUtil; add resource file to change branding . Updated the code to call createSIE so that the right brand is passed to SetupUtil.
* 185811 - Missing const qualifiers were causing Windows compiler errorsNathan Kinder2006-03-201-4/+4
|
* 185811 - slapi_dn_find_parent needs to be added to libslapd.def for windows ↵Nathan Kinder2006-03-191-0/+1
| | | | build to compile
* 185811 - Don't check localuser config on WindowsNathan Kinder2006-03-191-0/+2
|
* 185811 - Need to exclude pwd.h include on windowsNathan Kinder2006-03-181-0/+2
|
* 185811 - Fixed windows build failures when compiling ↵Nathan Kinder2006-03-183-0/+6
| | | | slapd_chown_if_not_owner function
* [185364] Can't update scripts (e.g., start-slapd) in the instance directoryNoriko Hosoi2006-03-161-1/+3
| | | | Missing return at the end of create_scripts (success case)
* [185477] ldif2db allows entries without a parent to be importedNoriko Hosoi2006-03-161-6/+6
| | | | if idl is NULL, changed add_op_attrs to always set IMPORT_ADD_OP_ATTRS_NO_PARENT in non-error case (err == 0 or err == DB_NOTFOUND)
* [185477] ldif2db allows entries without a parent to be importedNoriko Hosoi2006-03-151-3/+1
| | | | | | | The problem is that the new IDL code is not exposing the DB_NOTFOUND error when the index key is not found. Import checks if the result was DB_NOTFOUND when checking for the parent entry's entrydn index. This works fine with the old IDL code. (nkinder@redhat.com)
* 184585 - Adjusted the location of the connection lock when doing a sasl_rebindNathan Kinder2006-03-141-3/+3
|
* 184585 - SASL context needs to be disposed of and a new one created when ↵Nathan Kinder2006-03-142-0/+35
| | | | re-binding
* [185364] Can't update scripts (e.g., start-slapd) in the instanceNoriko Hosoi2006-03-143-78/+141
| | | | | When ds_create is called with -r (update), scripts in the instance directory were not updated. They are recreated with this change.
* [183222] Directory Server hangs when running VLV search and update ↵Noriko Hosoi2006-03-081-10/+15
| | | | | | operations simultaneously. Demoted the write lock to the read lock in vlv_update_all_indexes
* Bug(s) fixed: 179723Rich Megginson2006-03-062-6/+4
| | | | | | | | | | | | | | Bug Description: crash after succesful pwdchange via ldappasswd Reviewed by: Pete, Nathan (Thanks!) Fix Description: The passwd_extop code does an internal operation to change the password. Some of this code is only intended to be called for external operations where you have a conn structure. The one place in particular which caused this bug is in update_pw_info, where it is only triggered if you must change the password or password expiration is in effect. The fix is to just check to see if the pb_conn is not null. Platforms tested: Fedora Core 4 Flag Day: no Doc impact: no
* Fixing Solaris buildNoriko Hosoi2006-02-281-0/+3
| | | | | 1) NSCONFIG accidentally got a white space (for non-Linux platforms) 2) Solaris needs to include limits.h explicitly
* Some DSGW programs must not be linked with SSL, including the LDAP ssl ↵Rich Megginson2006-02-251-1/+1
| | | | library. On RHEL3, this causes a linker error, but appears to be fine on other platforms. So, just use the LDAP_NOSSL_LINK macro for those programs, and use the LDAPLINK macro for the other programs.
* Bug: 179810Rich Megginson2006-02-231-1/+1
| | | | | | Description: crash: modify/delete when attr name doesn't match database Reviewed by: All (Thanks!) Fix description: Use case insensitive comparison for attribute names.
* Bug(s) fixed: 179137Rich Megginson2006-02-233-63/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug Description: recursion causes OOM with bad DN in dn2ancestor Reviewed by: All (Thanks!) Fix Description: The fix looks scary, but I thought it would be best to get rid of recursion entirely (ugh - recursion in a multi threaded server - this isn't lisp . . .). Along with eliminating recursion, I created a new function called slapi_dn_find_parent that just returns a pointer to the beginning of the parent of the given dn, rather than returning a copy (as in slapi_dn_parent), to eliminate malloc/free in cases where it is unnecessary such as iterating through the parents in an DN. The new function is basically just the guts of slapi_dn_parent with one twist, specifically to address the bug in question - it skips through consecutive runs of DN separator characters. We should probably have a function like const char *slapi_dn_is_valid(const char *) that returns NULL if the given DN is valid or returns a pointer to the first invalid character if not. We could probably save a lot of time in processing bad or malicious client requests. Anyway, back to dn2ancestor. The given ancestordn must contain the _unnormalized_ parent DN, since some clients get irritated when they get back an DN in a different form than given. However, we need to have a normalized DN to pass to dn2entry, and we cannot use a single Slapi_DN that has both a dn and a ndn that are passed in byval (unless we add a new API or skip the API altogether), so the variable ancestorndn holds the normalized DN. Using the original pointer to the given sdn also allows us to avoid malloc/free entirely. Platforms tested: Fedora Core 4 Flag Day: no Doc impact: no QA impact: should be covered by regular nightly and manual testing New Tests integrated into TET: We need a test case that calls moddn and modify operations with really bad DNs, consisting of nothing but thousands of ',', '+', and '=' chars.
* Bug(s) fixed: 179135Rich Megginson2006-02-2312-28/+51
| | | | | | | | | | | | | | | | | | | | | | | Bug Description: memory leaks using ber_scanf when handling bad BER packets Reviewed by: All (Thanks!) Files: https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=123783 Branch: HEAD Fix Description: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135#c0 I basically did a search through our code for all calls to ber_scanf, ber_get_stringa, and ber_get_stringal and made sure we properly free any arguments that may have been allocated. There was a bug in the ldapsdk https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135 that causes us to free uninitialized memory when trying to clean up the result of ber_get_stringal (or ber_scanf with 'V'). I had to initialize some variables to NULL so that we could properly clean them up, and added some additional clean ups that were missing. Also, in repl_extop.c, we were calling free on an array that we should have been calling ch_array_free on. Yet another lesson in the evils of slapi_ch_free and disabling compiler type checks in general. Platforms tested: Fedora Core 4 Flag Day: no Doc impact: no
* Bug(s) fixed: 182613Rich Megginson2006-02-236-53/+118
| | | | | | | | | | | | | | | | | | | | Bug Description: Upgrade wipes out sectool wrappers Reviewed by: Pete and Nathan (Thanks!) Fix Description: It's better if we just package those wrappers instead of creating them on the fly. The new file sec_tools_wrappers is a simple shell script that assumes it's being run out of a parent/bin directory which contains a program called $0-bin, and the shared libs it needs are in parent/lib. This shell script is copied to shared/bin/certutil, shared/bin/modutil, etc. I had to create another makefile packaging macro to handle the case where you want to package a file under a different name than the original. Also 1) Add Red Hat and Fedora DS to upgradeServer 2) adminutil property directory is now adminutil-properties instead of property 3) General clean up of some upgrade install things Platforms tested: Fedora Core 4 Flag Day: no Doc impact: no
* Change version to 1.0.2Rich Megginson2006-02-2310-12/+12
| | | | | | RPM post install adds a new patch to fix the httpd module load order, removes the console patch Tell the user to run setup/setup after upgrade installation.
* Bug(s) fixed: 181827Nathan Kinder2006-02-202-12/+80
| | | | | | | | | | | | | | | | | | Bug Description: If you delete an attribute from an entry on AD, the attribute doesn't get deleted on the DS side. The replication code doesn't even notice that the entry changed. Reviewed by: Rich, Noriko, Pete (thanks!) Files: see diffs Branch: HEAD, Directory71Branch Fix Description: The dirsync search control passes back deleted attributes with no values. If you try to add a Slapi_Attr with no values to a Slapi_Entry, it doesn't get added. This fix stuffs the deleted attributes into the deleted attributes list in the Slapi_Entry and checks for them when creating the modification operations to be performed on the local entry. Flag Day: no Doc impact: no QA impact: A regression test needs to be added New Tests integrated into TET: none
* Don't attempt to package 32 bit NSS apps/libs with the 64 bit package on ↵Rich Megginson2006-02-171-1/+13
| | | | rhel/linux - assume everything is native 64 bit.
* Reviewed by Nathan (Thanks!)Rich Megginson2006-02-171-3/+6
| | | | NSS 3.11 introduces a new library (libfreebl3.so) that is loaded as part of NSS initialization. With Fedora DS 1.0, we moved NSS initialization to occur after the setuid from root to the runtime uid so that the files created during NSS init would have the correct ownership. However, the bin/slapd/server directory is set to 0700 meaning no execute permission for the runtime uid. The OS requires this directory to be 711 to allow the slapd process to load in the shared libraries needed by NSS. We use 711 to disallow reading in this directory because if slapd crashes shortly after startup, a core file may go in this directory which may contain secret information.
* Fix build-time issue of lib_dsadmin.so for x86_64 supportNathan Kinder2006-02-171-7/+0
|
* Bug(s) fixed: 181776Rich Megginson2006-02-162-24/+26
| | | | | | | | | | | | Bug Description: 64bit issues with normalize_path(), make_dn(), and add_aci_v() Reviewed by: Nathan and Noriko (Thanks!) Fix Description: 1) use sizeof(char *) as the elemsize to pass to slapi_ch_calloc(). 2) create a variable const char *NULLSTR = 0 to pass as the last argument to the varargs functions. Platforms tested: RHEL4 64 Flag Day: no Doc impact: no
* The correct naming convention for RHEL isRich Megginson2006-02-155-24/+13
| | | | | | | | | | | | | | | | | | | | | | RHEL4_x86_64_gcc3_OPT.OBJ The makefiles were assuming that if the string 86 was found in uname -m it should use x86 for the arch. However, it should only do this if uname -m is not x86_64. Also, for RHEL/Linux, we do not have to add the NS64TAG just before the _OPT (or _DBG) since it's already in the arch. Other platforms continue to use the other naming convention. The default naming convention for the mozilla components is Linux2.6_x86_64_glibc_PTH_64_OPT.OBJ. I considered using Wan-Teh's instructions about source builds, but that would cause many changes to be made to our makefiles, so I just changed the way we calculate the mozilla OBJDIR name from the regular OBJDIR name. These changes are pretty much the same for adminutil, setuputil, adminserver, and ldapserver. For ldapserver, I had to change nsarch (adminserver changed nsarch in a different way). I also got rid of the 32 bit specific setup stuff. I assume this was due to 32 bit NES admin server, so we can get rid of this for the future, because we will have all native 64 bit apps. I also went ahead and rolled in the gcc4 changes since they are safe for gcc3 as well.
* Bug(s) fixed: 181587Rich Megginson2006-02-151-29/+45
| | | | | | | | | | | | | | | | Bug Description: Password Modify LDAPv3 extended operation erroneously forces the client to supply old password Reviewed by: Pete & Nathan (Thanks!) Fix Description: If the BIND operation was successful, the CONN_DN field is always set to the proper DN. This is even the case during a SASL or client cert DN if the authentication was successful AND the given identity could be mapped to a real user in the directory. Also, the authmethod will be something other than NULL or none. So, if the old password was not given, that is ok if there is a non-anonymous bind DN and a real authmethod. The rest of the operation passes through the usual access control. Platforms tested: Fedora Core 4 Flag Day: no Doc impact: no
generated by cgit (git 2.34.1) at 2025-09-28 05:06:24 +0000