summaryrefslogtreecommitdiffstats
path: root/ldap
Commit message (Collapse)AuthorAgeFilesLines
...
* Bug 572677 - Memory leak in searches including GER controlRich Megginson2010-03-121-2/+0
| | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=572677 Resolves: bug 572677 Bug Description: Memory leak in searches including GER control Reviewed by: Andrey Ivanov (Thanks!) Branch: HEAD Fix Description: The per-operation acl pblocks are cached. In order to release the pblock back to the cache free list, the connection must be provided. The connection comes from the pblock. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 572649 - DS8.2 crashes on RHEL 4 (corresponding to bob, ber_2 test case)Noriko Hosoi2010-03-115-5/+15
| | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=572649 Fix Description: There was a chance to jump to error_return before back_txn structure was initialized. In the error handling, the transaction abort is called against the garbage address. Slapi_DN also gets freed without an initialization. Now these variables are initialized first.
* 570107 - The import of LDIFs with base-64 encoded DNs fails,Noriko Hosoi2010-03-111-2/+4
| | | | | | | | | | | modrdn with non-ASCII new rdn incorrect https://bugzilla.redhat.com/show_bug.cgi?id=570107 Description: When getting the DN value from the raw ldif file, it was strictly checking "dn: ", which was incomplete. We should have checked "dn:: " for the Base64 encoded DN. This patch is adding the case.
* 199923 - subtree search fails to find items under a dbNoriko Hosoi2010-03-113-61/+102
| | | | | | | | | | | | | | | | | | | | | | containing special characters https://bugzilla.redhat.com/show_bug.cgi?id=199923 Description: regression observed in the tests. > as of March 04, 2010, this is happening again. Fix Description: dn.c: Based upon RFC 4514, the following characters in the RDN values need to be escaped: '+', ';', '<', '>', and '=' for the intermediate characters '+', ';', '<', '>', '=', '#' and ' ' for leading characters '+', ';', '<', '>', '=', and ' ' for trailing characters validate.c: If an escaped character followed by another escaped character, e.g., \#\<, the pointer was moved twice skipping '\' before '<' and it makes the validation fail. ldbm_add.c: a local variable addr was not initialized.
* Bug 570542 - Root password cannot contain matching curly bracesEndi S. Dewata2010-03-112-2/+2
| | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=570542 Resolves: bug 570542 Bug Description: Root password cannot contain matching curly braces Branch: HEAD Fix Description: The scripts have been modified to check for matching curly braces only at the beginning of the password. Matching curly braces anywhere else would be accepted as a valid password.
* Bug 538525 - Ability to create instance as non-root userEndi S. Dewata2010-03-119-78/+145
| | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=538525 Resolves: bug 538525 Bug Description: Ability to create instance as non-root user Branch: HEAD Fix Description: By default for root user the init config file will be stored in /etc/sysconfig and for non-root user it will be stored in $HOME/.dirsrv folder. A new parameter [slapd] initconfig_dir is added to the .inf file to specify a non-default folder for the init config folder. This folder must exist prior to running the DS tools. The folder can also be specified via setup-ds.pl command-line parameter slapd.initconfig_dir. A new parameter -d is added to the start-dirsrv, restart-dirsrv, and stop-dirsrv to specify the non-default init config folder. A new parameter --initconfig_dir is added to remove-ds.pl to specify the non-default init config folder. The templates for start-slapd, restart-slapd, stop-slapd scripts have been modified to specify the init config folder.
* Add support for additional schema/matching rules included with 389Rich Megginson2010-03-092-6/+7
| | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=559315 Resolves: bug 559315 Bug Description: Searching some attributes are now case sensitive when they were previously case-insensitive Reviewed by: nhosoi (Thanks!) Fix Description: 1) The 60qmail.ldif schema we ship used integerMatch and IA5 syntax because we used not to support numericString syntax and matching rules - these have been changed to use the standard qmail definitions 2) Allow IA5String syntax to use caseExactSubstringsMatch - this is required by krbPrincipalName
* Bug 570905 - postalAddress syntax should allow empty lines (should allow $$)Rich Megginson2010-03-081-12/+16
| | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=570905 Resolves: bug 570905 Bug Description: postalAddress syntax should allow empty lines (should allow $$) Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Even though RFC 4517 says a postal address syntax value should not contain empty lines (e.g. $$), most, if not all, current applications expect to be able to store $$. This adds an internal switch to allow support for $$ for now. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* Bug 571514 - upgrade to 1.2.6 should upgrade 05rfc4523.ldif (cert schema)Rich Megginson2010-03-081-1/+1
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=571514 Resolves: bug 571514 Bug Description: upgrade to 1.2.6 should upgrade 05rfc4523.ldif (cert schema) Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Added 05rfc4523.ldif to the list of schema to upgrade. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* cleanup build warningsRich Megginson2010-03-0816-41/+45
| | | | | | This patch cleans up various build warnings found by compiling the code with -Wall on RHEL5. Reviewed by: nhosoi (Thanks!)
* Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from ↵Noriko Hosoi2010-03-084-2/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | sasl/external https://bugzilla.redhat.com/show_bug.cgi?id=554573 Resolves: bug 554573 Bug Description: ACIs use bind DN from bind req rather than cert mapped DN from sasl/external Reviewed by: ??? Branch: HEAD Fix Description: Added a new config option - nsslapd-force-sasl-external (on/off) default is off - when set to on, a SIMPLE bind on a connection that has set a DN from a cert will be changed to be a SASL/EXTERNAL bind. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: yes - new attribute to document Note: This commit is for reapplying the patch I accidentally reverted by the previous revert (031e725dce895bf2382ca7801cef772fe6b24c61). (see commit f4b90ed5e43fa06ea6185cf17073b7a32db6ef4c, as well) commit 031e725dce895bf2382ca7801cef772fe6b24c61 Author: Noriko Hosoi <nhosoi@redhat.com> Date: Fri Mar 5 16:09:28 2010 -0800 Revert "Merge branch '547503'" This reverts commit f2a04fdc45cc8a408267019990504354282c4303, reversing changes made to 0b95451c7e50cb6b2d0cb310dddca18336e1b2ac.
* Revert "Merge branch '547503'"Noriko Hosoi2010-03-054-51/+2
| | | | | This reverts commit f2a04fdc45cc8a408267019990504354282c4303, reversing changes made to 0b95451c7e50cb6b2d0cb310dddca18336e1b2ac.
* Merge branch '547503'Noriko Hosoi2010-03-053-0/+58
|\
| * 570667 - MMR: simultaneous total updates on the masters causeNoriko Hosoi2010-03-053-0/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | deadlock and data loss https://bugzilla.redhat.com/show_bug.cgi?id=570667 Description: In the MMR topology, if a master receives a total update request to initialize the other master and being initialized by the other master at the same time, the 2 replication threads hang and the replicated backend instance could be wiped out. To prevent the server running the total update supplier and the consumer at the same time, REPLICA_TOTAL_EXCL_SEND and _RECV bits have been introduced. If the server is sending the total update to other replicas, the server rejects the total update request on the backend. But the server can send multiple total updates to other replicas at the same time. If the total update from other master is in progress on the server, the server rejects another total update from yet another master as well as a request to initialize other replicas.
* | Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from ↵Rich Megginson2010-03-054-2/+51
|/ | | | | | | | | | | | | | | | sasl/external https://bugzilla.redhat.com/show_bug.cgi?id=554573 Resolves: bug 554573 Bug Description: ACIs use bind DN from bind req rather than cert mapped DN from sasl/external Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Added a new config option - nsslapd-force-sasl-external (on/off) default is off - when set to on, a SIMPLE bind on a connection that has set a DN from a cert will be changed to be a SASL/EXTERNAL bind. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: yes - new attribute to document
* Bug 551198 - LDAPI: incorrect logging to access log - part 2Rich Megginson2010-03-051-0/+1
| | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=551198 Resolves: bug 551198 Bug Description: LDAPI: incorrect logging to access log - part 2 Reviewed by: andrey.ivanov@polytechnique.fr (Thanks!) Branch: HEAD Fix Description: Initialize the from PRNetAddr to nulls. That way, if PR_Accept doesn't fill in the local fields, we can see that they are empty and set the printed from field to "local". Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* fix various memory leaksRich Megginson2010-03-046-4/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewed by: nhosoi (Thanks!) var/tmp/run_gssapi.vg.25032:Memory leak: 99 bytes duplicates: 5 > malloc() at vg_replace_malloc.c:207 > strdup() at /lib/libc-2.10.2.so > slapi_ch_strdup() at ch_malloc.c:277 > ids_sasl_check_bind() at saslbind.c:924 > do_bind() at bind.c:382 > connection_threadmain() at connection.c:554 > --unknown-- at /lib/libnspr4.so > start_thread() at /lib/libpthread-2.10.2.so > clone() at /lib/libc-2.10.2.so The problem is that ids_sasl_check_bind can reset SLAPI_BIND_TARGET to a malloc'd value. The do_bind() code should check for this condition and free it. var/tmp/entryusn.vg.5997:Memory leak: 8 bytes duplicates: 8 > calloc() at vg_replace_malloc.c:397 > slapi_ch_calloc() at ch_malloc.c:243 > slapi_counter_new() at slapi_counter.c:95 > ldbm_usn_init() at ldbm_usn.c:86 > ldbm_back_start() at start.c:223 > plugin_call_func() at plugin.c:1417 > plugin_dependency_startall.clone.0() at plugin.c:1385 > main() at main.c:1138 The backend cleanup code should free be_usn_counter. var/tmp/ipv6.vg.15561:Memory leak: 13 bytes duplicates: 3 > malloc() at vg_replace_malloc.c:207 > strdup() at /lib/libc-2.10.2.so > slapi_ch_strdup() at ch_malloc.c:277 > config_get_listenhost() at libglobs.c:3674 > main() at main.c:874 var/tmp/ipv6.vg.15561:Memory leak: 13 bytes duplicates: 3 > malloc() at vg_replace_malloc.c:207 > strdup() at /lib/libc-2.10.2.so > slapi_ch_strdup() at ch_malloc.c:277 > config_get_securelistenhost() at libglobs.c:3686 > main() at main.c:881 config_get_listenhost() and config_get_securelistenhost() return malloc'd memory which must be freed. var/tmp/dna_scen1.vg.4901:Memory leak: 248 bytes duplicates: 1 > malloc() at vg_replace_malloc.c:207 > nslberi_malloc() at io.c:1677 > ber_flatten() at io.c:1604 > create_NSDS50ReplicationExtopPayload() at repl_extop.c:218 > NSDS50EndReplicationRequest_new() at repl_extop.c:265 > release_replica() at repl5_protocol_util.c:469 > repl5_inc_run() at repl5_inc_protocol.c:1187 > prot_thread_main() at repl5_protocol.c:341 > --unknown-- at /lib/libnspr4.so > start_thread() at /lib/libpthread-2.10.2.so > clone() at /lib/libc-2.10.2.so The payload was not being freed under all function exit conditions. So, just free it immediately after use. var/tmp/dnarun.vg.2491:Memory leak: 27 bytes duplicates: 0 > malloc() at vg_replace_malloc.c:207 > slapi_ch_malloc() at ch_malloc.c:155 > slapi_entry_attr_get_charptr() at entry.c:2432 > dna_parse_config_entry() at dna.c:816 > dna_pre_op() at dna.c:2587 > plugin_call_func() at plugin.c:1417 > plugin_call_plugins() at plugin.c:1379 > op_shared_add() at add.c:606 > do_add() at add.c:232 > connection_threadmain() at connection.c:564 > --unknown-- at /lib/libnspr4.so > start_thread() at /lib/libpthread-2.10.2.so > clone() at /lib/libc-2.10.2.so The value was not being freed under all conditions. ==9877== 1,890 (252 direct, 1,638 indirect) bytes in 3 blocks are definitely lost in loss record 1,628 of 1,725 ==9877== at 0x47E0E5C: calloc (vg_replace_malloc.c:397) ==9877== by 0x4819D89: slapi_ch_calloc (ch_malloc.c:243) ==9877== by 0x48284A6: slapi_entry_alloc (entry.c:1686) ==9877== by 0x4829BA5: str2entry_dupcheck (entry.c:631) ==9877== by 0x482BB5D: slapi_str2entry_ext (entry.c:1194) ==9877== by 0xB2A8E9D: import_producer (import-threads.c:541) ==9877== by 0x72E1990: (within /lib/libnspr4.so) ==9877== by 0x731E8F4: start_thread (in /lib/libpthread-2.10.2.so) ==9877== by 0x75B2FCD: clone (in /lib/libc-2.10.2.so) Make sure the entry or backentry are freed.
* 539618 - Replication bulk import reports Invalid read/writeNoriko Hosoi2010-03-033-38/+27
| | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=539618 Back off this commit: commit 4205086e4f237a52eb9113cd95f9cf87b39e9ed4 Date: Mon Feb 22 08:49:49 2010 -0800 since this change could cause the deadlock between the thread eventually calling prot_free, which acquired the agreement lock, and other threads waiting for the agreement lock, which prevents the protocol stop. Instead of waiting for prot_thread_main done in prot_free, let prot_thread_main check the existence of the protocol field in the agreement. If it's not available, prot_thread_main quits.
* Bug 545620 - Password cannot start with minus signEndi S. Dewata2010-03-031-1/+1
| | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=545620 Previously getopt would interpret initial '-' in root password as an option which could lead to setup failure. Now a special argument '--' has been added before the password to distinguish it from other options.
* Bug 551198 - LDAPI: incorrect logging to access log389-ds-base-1.2.6.a2Rich Megginson2010-03-011-3/+23
| | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=551198 Resolves: bug 551198 Bug Description: LDAPI: incorrect logging to access log Reviewed by: nkinder (Thanks!) Branch: HEAD Fix Description: The connection logging code was not ldapi/unix socket aware. Now we check for the socket type, and check to see if there is a proper path name in the path field. The "server" side of the socket seems not to get the path name set correctly - not sure why, but it doesn't really matter, since the client side path name does seem to be set correctly. The access log will contain the server side path and the client side path, so something like "from local to /var/run/slapd-foo.socket" Platforms tested: RHEL5 x86_64, Fedora 11 x86_64 Flag Day: no Doc impact: no
* 555970 - missing read lock in the combination of cos and nsviewNoriko Hosoi2010-02-281-0/+4
| | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=555970 Description: view read lock was missing in a view api called from COS.
* Bug 568196 - Install DS8.2 on Solaris fails - part 2Rich Megginson2010-02-2611-16/+16
| | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=568196 Resolves: bug 568196 Bug Description: Install DS8.2 on Solaris fails - part 2 Reviewed by: self Branch: HEAD Fix Description: Add pcre_libdir to all script wrappers that call ns-slapd, such as ldif2db, etc. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no (cherry picked from commit 24245075d03955f26b6c827b123ac002ff16c012)
* Bug 568196 - Install DS8.2 on Solaris failsRich Megginson2010-02-261-2/+2
| | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=568196 Resolves: bug 568196 Bug Description: Install DS8.2 on Solaris fails Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Add pcre_libdir to script wrappers for programs that use pcre Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no (cherry picked from commit 3d27198f45b4b25df667d3f86dce66a44f4bc65d)
* 389 DS segfaults on libsyntax-plugin.so - part 3Rich Megginson2010-02-261-1/+1
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=516611 Resolves: bug 516611 Bug Description: 389 DS segfaults on libsyntax-plugin.so - part 3 Reviewed by: nkinder (Thanks!) Branch: HEAD Fix Description: bin_filter_ava should check for null bvals Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 389 DS segfaults on libsyntax-plugin.so - part 2Rich Megginson2010-02-261-1/+3
| | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=516611 Resolves: bug 516611 Bug Description: 389 DS segfaults on libsyntax-plugin.so - part 2 Reviewed by: nkinder (Thanks!) Branch: HEAD Fix Description: If there is an empty mod/replace of a non-existent attribute following a real modify operation, the server will allow it, and the code in entry_delete_present_values_wsi() would create an empty Slapi_Attr. LDAP says that an empty mod/replace of a non-existent attribute should be ignored, as it is in the non-repl case. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 389 DS segfaults on libsyntax-plugin.so - part 1Rich Megginson2010-02-261-3/+3
| | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=516611 Resolves: bug 516611 Bug Description: 389 DS segfaults on libsyntax-plugin.so - part 1 Reviewed by: nkinder (Thanks!) Branch: HEAD Fix Description: Check for NULL bvals in the string syntax filter functions ava, sub, and key generation Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 548115 - memory leak in schema reloadNoriko Hosoi2010-02-252-8/+13
| | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=548115 Description: dse.c: 1) dse_add_entry_pb is supposed to free the given the schema entry e. Although the function never consumes the entry, it was only freeing it when the entry was added. (If it was merged or rejected, it was not freed.) schema.c: 1) when allocating a work buffer with sizedbuffer_allocate, the space for the NULL termination was not counted. 2) DSE returned from slapi_validate_schema_files must have been freed regardless of the return value.
* problems linking with -z defsRich Megginson2010-02-253-77/+76
| | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=506206 Resolves: bug 506206 Bug Description: problems linking with -z defs Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: Some platforms (debian) and some build checking tools (rpmlint, others) link with -z defs to look for any undefined references at link time. We had several of these in various directory server objects. 1) all of the plugins need to link against libslapd.la 2) most of the plugins need to link against ldapcsdk and nspr 3) the pwdstorage plugin needs to link against LIBCRYPT, which is platform dependent 4) various other link fixes Platforms tested: RHEL5 x86_64 Flag Day: yes - autotool file changes Doc impact: no
* fix memory leak in attr replace when replacement failsRich Megginson2010-02-241-4/+13
| | | | | | | | | | if replacement of the attribute values fails (e.g. due to duplicate values) the valstoreplace is not freed - the caller expects the valueset_replace function to own the values passed in. The function will now free the values if there was an error In addition, valueset_replace should not free the old values in case of error - it should leave the old values in the attribute Reviewed by: nhosoi (Thanks!)
* crash looking up compat syntax; numeric string syntax using integer; make ↵Rich Megginson2010-02-234-20/+47
| | | | | | | | | | | | | | octet string ordering work correctly https://bugzilla.redhat.com/show_bug.cgi?id=559315 Resolves: bug 559315 Bug Description: Searching some attributes are now case sensitive when they were previously case-insensitive Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: slapi_matchingrule_is_compat() was not checking for NULL; the matching rule syntax plugin was registering with the INTEGER syntax oid; the bin_filter_ava() function needs to be ordering aware to implement the octetStringOrderingMatch; in default_mr_filter_create(), make sure the requested matching rule is provided by the given plugin Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
* 567370 - dncache: assertion failure in id2entry_deleteNoriko Hosoi2010-02-221-4/+8
| | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=567370 Descriptino: When deleting an entry, if the dn is in the dn cache, it should be removed. The original code was trying to remove it regardless of the existence in the dn cache. Fixed it so that only when the dn is in the cache, it's removed.
* 539618 - Replication bulk import reports Invalid read/writeNoriko Hosoi2010-02-224-9/+37
| | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=539618 Descriptions: When a protocol is freed by prot_free, prot_close is supposed to have been called to stop the main thread prot_thread_main. But, there was no mechanism for the freeing thread whether the prot_thread_main has already quitted or not, it could have released the Repl_Protocol even though it was still being in use. This fix is adding a checking method. The same test revealed ldbm_back_modrdn had a chance to access a field of NULL entry structure.
* 527848 - make sure db upgrade to 4.7 and later works correctlyNoriko Hosoi2010-02-182-68/+61
| | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=527848 Change Description: 1. Replication Changelog 1-1. In the clean recover mode, transaction logs should not be removed. 1-2. When nsslapd-db-circular-logging is on (by default, it's on), call log_archive function with DB_ARCH_REMOVE, which removes log files that are no longer needed. 1-3. Call transaction checkpoint just before shutting down the server. 1-4. "From string" in the upbrade message had a flaw. 2. Backend dblayer 2-1. In checkpoint_threadmain, call log_archive with DB_ARCH_ABS, which returns the absolute path of the transaction log files. It eliminates the code which generates the absolute paths.
* change syntax plugins to register required matching rule pluginsRich Megginson2010-02-1716-111/+1141
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=559315 Resolves: 559315 Description: Searching some attributes are now case sensitive when they were previously case-insensitive Reviewed by: nhosoi (Thanks!) - also added some suggested comments I added code to allow the syntax plugins to register corresponding matching rules. That is, the functions that the syntax plugins use for filter matching and key generation can also be used for matching rules with the new wrapper code. I added some convenience functions and structures in the syntax plugin code to make it easier to add matching rules in the future. I also added a new feature to the matching rule code - in the LDAP spec definition of matching rule, the syntax provided in the matching rule definition is the syntax for the _assertion value_ used with the matching rule, which is not necessarily the same as the syntax of the _attribute values_ to which the matching rule can be applied. For example, matching rules that apply to syntax DirectoryString can also be applied in some cases to PrintableString, CountryString, and IA5String. There are several other cases like this as well. I also introduced the concept of a compat syntax that can be used with a matching rule. The server will now check, when reading in the schema, if the syntax and matching rules for an attribute are consistent. Finally, for 05rfc4523.ldif, I changed the attributes to use octetStringMatch instead of one of the unimplemented certificate matching rules.
* change extensible filter code to use new syntax function style mr funcsRich Megginson2010-02-172-100/+327
| | | | | | | | | | | Created wrappers around the new syntax style functions to make them look like the old style filter functions. There are a few caveats: 1) SUBSTRING extensible filter searches are not supported. There is no way currently to pass in the timelimit required by the syntax substring filter functions. 2) ORDERING only does greater than or equal. There is no standard way to do an extensible match with a standard ordering matching rule and specify less than or greater than.
* wrap new style matching rule plugins for use in old style indexing codeRich Megginson2010-02-176-46/+268
| | | | | | | Create wrappers for the new syntax plugin style matching rule code so that we can use the old matching rule indexing functions. Introduced a new type of indexer for Slapi_Value values. The old style used struct berval * values, but the syntax plugins and a lot of newer code work with Slapi_Value* instead.
* Do not use syntax plugins directly for filters, indexingRich Megginson2010-02-1723-195/+675
| | | | | | | | | | | There were many places in the server code that directly used the syntax plugin for the attribute. If the attribute schema definition specified a matching rule, we must use that matching rule for matching values of that attribute, filtering that attribute, and generating index keys for values of that attribute. New internal and plugin APIs have been added that use the Slapi_Attr* instead of using the syntax plugin directly. The new API will determine which matching rule to apply based on the schema definition.
* Bug 434735 - Allow SASL ANONYMOUS mech to workNathan Kinder2010-02-171-1/+26
| | | | | | | | | | | | The SASL ANONYMOUS mechanism was broken since the SASL mapping code was invoked to map anonymous to a real user entry. This adds a special case to the canonify user callback that sets the bind DN to "" if the ANONYMOUS mechanism is being used. I also added a check to see if anonymous access is disabled when we set up the SASL secprops for a connection. If anonymous access is disabled, we set a SASL security flag to disallow mechanisms that would allow anonymous access.
* 565987 - redhat-ds-base fails to build due to undefined structNoriko Hosoi2010-02-173-16/+123
| | | | | | | | | | | | | | st_size and nsldapi_build_control et al. in ldclt.c https://bugzilla.redhat.com/show_bug.cgi?id=565987 Fix Description: 1. stat: sys/types.h and sys/stat.h need to be included. 2. nsldapi_build_control: duplicated nsldapi_build_control from the mozldap c library. 3. added the sub value [=deref:attr] of deref to the usage. 4. allow -e deref without the sub value. It used to be allowed, but it was forbidden by the previous change.
* 565664 - Incorrect parameter for CACHE_RETURN()Noriko Hosoi2010-02-151-1/+1
| | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=565664 Description: Special thanks to edewata@redhat.com for fixing the bug. > See ldap/servers/slapd/back-ldbm/id2entry.c line 196. > The second parameter should be a pointer to pointer, > but the current code passes a regular pointer: > CACHE_RETURN(&inst->inst_dncache, bdn);
* 563365 - Error handling problems in the backend functionsNoriko Hosoi2010-02-106-79/+132
| | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=563365 1) Error handling in ldbm_back_{add,delete,modify,modrdn} functions was incomplete. When any error occurs after the transaction begins, the changes made after that should be aborted. There were some cases the abort was not called. 2) If modrdn failed in ldbm_back_modrdn, new DN in the DN cache was not removed. 3) config_set_instancedir in libglobs.c was missing the function type.
* 548535 - memory leak in attrcryptNoriko Hosoi2010-02-083-2/+35
| | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=548535 Description: The attrcrypt module maintains the inst_attrcrypt_state_private field in the instance structure (ldbm_instance) to store the private keys. The area and the space for the private keys are allocated in attrcrypt_init which is called from dblayer_instance_start. A backend instance could be closed and restarted multiple times (for instance, in the bulk_import, which is used by the replica initialization), but the area had no chance to be freed. This patch is adding the clean-up code.
* 560827 - Admin Server templates: DistinguishName validation failsNoriko Hosoi2010-02-031-0/+31
| | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=560827 Description: adding a perl subroutine dnEscape to escape special characters and eliminate spaces around ',', which is to make the given dn compliant with RFC4514.
* Undo - 555577 - Syntax validation fails for "ou=NetscapeRoot" treeNoriko Hosoi2010-02-014-40/+25
| | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=555577 Undoing the previous checkin. The parameter "strict" is for the trength of the DN validation. It should be confusing to use it for turning on/off the validation itself.
* 555577 - Syntax validation fails for "ou=NetscapeRoot" treeNoriko Hosoi2010-02-014-25/+40
| | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=555577 [See comment 7 of the bug] DistinguishName validation slapi_dn_syntax_check should be called only when nsslapd-dn-validate-strict is on.
* 559016 - Attempting to rename suffix returns inappropriate errorsNoriko Hosoi2010-01-293-20/+60
| | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=559016 [Fix Description] If the target dn of the modrdn operation is a suffix, check if the new dn already exists or not. If it exists, it returns LDAP_ALREADY_EXISTS. If the backend associated with the new dn does not exist, it returns LDAP_NO_SUCH_OBJECT. Otherwise, it returns LDAP_NAMING_VIOLATION. If the target dn of the modrdn is attempted to move across backends, it returns LDAP_AFFECTS_MULTIPLE_DSAS instead of LDAP_UNWILLING_TO_PERFORM. Modrdn (op_shared_rename) was logging the parameter errors in the clients request as SLAPI_LOG_FATAL. Reduced the level to SLAPI_LOG_ARGS. Also, replaced ldap_explode_dn with slapi_dn_syntax_check to verify the newsuperior. By the replacement, 2 bugs in slapi_dn_syntax_check were found. 1) The key for the DN in the hashtable of the attribute syntax has to be "distinguishedName". 2) Argument type for plg_syntax_validate was not correct.
* 247413 - Incorrect error on multiple identical value addNoriko Hosoi2010-01-281-1/+3
| | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=247413 [Problem Description] Adding multiple identical values returns "Operations error (LDAP_OPERATIONS_ERROR == 0x1)" instead of "Type or value exists (LDAP_TYPE_OR_VALUE_EXISTS == 0x14)" E.g., dn: ou=test,dc=example,dc=com changetype: modify replace: description description: test description: test modifying entry "ou=test,dc=example,dc=com" ldap_modify: Operations error (1) [Fix Description] API valueset_replace used to override any error from the lower layer with LDAP_OPERATIONS_ERROR. If the error is LDAP_TYPE_OR_VALUE_EXISTS, the error is now returned as is.
* 557224 - subtree rename breaks the referential integrity plug-inNoriko Hosoi2010-01-281-209/+493
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.redhat.com/show_bug.cgi?id=557224 Fix Description: The referential integrity plugin has not supported the subtree rename (modrdn with newsuperior). This patch is adding the support. There are 2 typical cases. (case 1) DN that modrdn modifies matches the value of attributes which is the target of the referential integrity. E.g., modrdn: uid=A,ou=B,o=C --> uid=AA,ou=BB,o=C then, member: uid=A,ou=B,ou=C --> uid=AA,ou=BB,ou=C seeAlso: uid=A,ou=B,ou=C --> uid=AA,ou=BB,ou=C (case 2) DN that modrdn modifies is the ancestor of the value of attributes which is the target of the referential integrity. E.g., modrdn: ou=B,o=C --> ou=BB,o=C then, member: uid=A,ou=B,ou=C --> uid=A,ou=BB,ou=C seeAlso: uid=A,ou=B,ou=C --> uid=A,ou=BB,ou=C
* Bug 549554 - Trim single-valued attributes before sending to ADNathan Kinder2010-01-271-44/+159
| | | | | | | | | | | | | | | | | There are a number of attributes that AD defines as single-valued that are multi-valued in the LDAP RFCs. We already had a few special cases in the winsync code where we only send one attribute to AD to allow the change to be accepted. We then simply check if the value in AD is present in DS when comparing entries for further changes. This fix cleans up that old implementation a bit by adding a static list of these single-valued attributes and a helper function to check if a particular type is in that list. I also had to extend the attr_compare_present() function to allow a length to be passed in for limiting the comparison to a portion of the values. This is needed for the initials attribute, which is single-valued and length constrained in AD.
* Bug 537466 - nsslapd-distribution-plugin should not require plugin name to ↵Rich Megginson2010-01-261-7/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | begin with "lib" https://bugzilla.redhat.com/show_bug.cgi?id=537466 Resolves: bug 537466 Bug Description: nsslapd-distribution-plugin should not require plugin name to begin with "lib" Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: We use the function PL_GetLibraryName from NSPR to get the platform specific DLL/shared lib filename suffix. Unfortunately, this function also prepends the string "lib" to the given name if the given file has no suffix. If the given name already has the correct suffix, it does not prepend the "lib" to the name. get_plugin_name() should look for the original library name in the string returned by PL_GetLibraryName. If it is there, and has something before it in the string, see if it is "/lib" - if so, remove the extraneous "lib" string. If "/lib" is not there, then just pass the string through as is. To summarize: /full/path/to/name.so -> /full/path/to/name.so - error if /full/path/to/name.so does not exist name -> /default/plugin/path/libname.so -> /default/plugin/path/name.so name.so -> /default/plugin/path/name.so Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no
generated by cgit (git 2.34.1) at 2024-11-20 09:23:23 +0000