[Fedora-directory-commits] mod_nss Makefile.am, 1.10, 1.11 Makefile.in, 1.17, 1.18 configure, 1.14, 1.15 configure.in, 1.10, 1.11 mod_nss.c, 1.10, 1.11 mod_nss.h, 1.9, 1.10 nss.conf.in, 1.7, 1.8 nss_engine_config.c, 1.9, 1.10 nss_engine_init.c, 1.16, 1.17 nss_engine_io.c, 1.4, 1.5 nss_engine_kernel.c, 1.3, 1.4 nss_engine_vars.c, 1.4, 1.5
by Doctor Conrad
Author: rcritten
Update of /cvs/dirsec/mod_nss
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv29295
Modified Files:
Makefile.am Makefile.in configure configure.in mod_nss.c
mod_nss.h nss.conf.in nss_engine_config.c nss_engine_init.c
nss_engine_io.c nss_engine_kernel.c nss_engine_vars.c
Log Message:
Add support for Elliptical Curve Cryptography (ECC). This is disabled
by default. To enable it, pass --enable-ecc to configure.
Index: Makefile.am
===================================================================
RCS file: /cvs/dirsec/mod_nss/Makefile.am,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- Makefile.am 26 Feb 2006 00:30:56 -0000 1.10
+++ Makefile.am 2 Mar 2006 19:21:54 -0000 1.11
@@ -12,7 +12,6 @@
## Set the includes and libraries needed
INCLUDES = -I@apache_inc@ @nspr_inc@ @nss_inc@ @apr_inc@
LIBS = @nspr_lib@ @nss_lib@ -lssl3 -lsmime3 -lnss3 -lsoftokn3 -lplc4 -lplds4 -lnspr4
-@SSL2_TRUE@AM_CFLAGS=-DWANT_SSL2
EXTRA_CPPFLAGS=@extra_cppflags@
install-libLTLIBRARIES: libmodnss.la
Index: Makefile.in
===================================================================
RCS file: /cvs/dirsec/mod_nss/Makefile.in,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -r1.17 -r1.18
--- Makefile.in 26 Feb 2006 00:30:56 -0000 1.17
+++ Makefile.in 2 Mar 2006 19:21:54 -0000 1.18
@@ -121,7 +121,6 @@
INCLUDES = -I@apache_inc@ @nspr_inc@ @nss_inc@ @apr_inc@
LIBS = @nspr_lib@ @nss_lib@ -lssl3 -lsmime3 -lnss3 -lsoftokn3 -lplc4 -lplds4 -lnspr4
-@SSL2_TRUE@AM_CFLAGS = -DWANT_SSL2
EXTRA_CPPFLAGS = @extra_cppflags@
LTCOMPILE = $(LIBTOOL) --mode=compile $(CC) $(DEFS) \
Index: configure
===================================================================
RCS file: /cvs/dirsec/mod_nss/configure,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- configure 26 Feb 2006 00:34:57 -0000 1.14
+++ configure 2 Mar 2006 19:21:54 -0000 1.15
@@ -462,7 +462,7 @@
# include <unistd.h>
#endif"
-ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO AMTAR install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM AWK SET_MAKE CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE build build_cpu build_vendor build_os host host_cpu host_vendor host_os EGREP LN_S ECHO AR ac_ct_AR RANLIB ac_ct_RANLIB CPP CXX CXXFLAGS ac_ct_CXX CXXDEPMODE CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL YACC LEX LEXLIB LEX_OUTPUT_ROOT SSL2_TRUE SSL2_FALSE APR_CONFIG APXS PKG_CONFIG apr_inc apache_inc apache_conf apache_prefix apache_bin nspr_inc ns!
pr_lib nss_inc nss_lib nspr_dir nss_dir extra_cppflags LIBOBJS LTLIBOBJS'
+ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO AMTAR install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM AWK SET_MAKE CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE build build_cpu build_vendor build_os host host_cpu host_vendor host_os EGREP LN_S ECHO AR ac_ct_AR RANLIB ac_ct_RANLIB CPP CXX CXXFLAGS ac_ct_CXX CXXDEPMODE CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL YACC LEX LEXLIB LEX_OUTPUT_ROOT APR_CONFIG APXS PKG_CONFIG apr_inc apache_inc apache_conf apache_prefix apache_bin nspr_inc nspr_lib nss_inc nss_li!
b nspr_dir nss_dir extra_cppflags LIBOBJS LTLIBOBJS'
ac_subst_files=''
# Initialize some variables set by options.
@@ -1032,6 +1032,7 @@
optimize for fast installation [default=yes]
--disable-libtool-lock avoid locking (might break parallel builds)
--enable-ssl2 enable SSLv2 (default=no)
+ --enable-ecc enable Elliptical Curve Cyptography (default=no)
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
@@ -3568,7 +3569,7 @@
;;
*-*-irix6*)
# Find out which ABI we are using.
- echo '#line 3571 "configure"' > conftest.$ac_ext
+ echo '#line 3572 "configure"' > conftest.$ac_ext
if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
(eval $ac_compile) 2>&5
ac_status=$?
@@ -5100,7 +5101,7 @@
# Provide some information about the compiler.
-echo "$as_me:5103:" \
+echo "$as_me:5104:" \
"checking for Fortran 77 compiler version" >&5
ac_compiler=`set X $ac_compile; echo $2`
{ (eval echo "$as_me:$LINENO: \"$ac_compiler --version </dev/null >&5\"") >&5
@@ -6134,11 +6135,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:6137: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:6138: $lt_compile\"" >&5)
(eval "$lt_compile" 2>conftest.err)
ac_status=$?
cat conftest.err >&5
- echo "$as_me:6141: \$? = $ac_status" >&5
+ echo "$as_me:6142: \$? = $ac_status" >&5
if (exit $ac_status) && test -s "$ac_outfile"; then
# The compiler can only warn and ignore the option if not recognized
# So say no if there are warnings
@@ -6367,11 +6368,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:6370: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:6371: $lt_compile\"" >&5)
(eval "$lt_compile" 2>conftest.err)
ac_status=$?
cat conftest.err >&5
- echo "$as_me:6374: \$? = $ac_status" >&5
+ echo "$as_me:6375: \$? = $ac_status" >&5
if (exit $ac_status) && test -s "$ac_outfile"; then
# The compiler can only warn and ignore the option if not recognized
# So say no if there are warnings
@@ -6427,11 +6428,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:6430: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:6431: $lt_compile\"" >&5)
(eval "$lt_compile" 2>out/conftest.err)
ac_status=$?
cat out/conftest.err >&5
- echo "$as_me:6434: \$? = $ac_status" >&5
+ echo "$as_me:6435: \$? = $ac_status" >&5
if (exit $ac_status) && test -s out/conftest2.$ac_objext
then
# The compiler can only warn and ignore the option if not recognized
@@ -7761,7 +7762,7 @@
libsuff=
case "$host_cpu" in
x86_64*|s390x*|powerpc64*)
- echo '#line 7764 "configure"' > conftest.$ac_ext
+ echo '#line 7765 "configure"' > conftest.$ac_ext
if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
(eval $ac_compile) 2>&5
ac_status=$?
@@ -8632,7 +8633,7 @@
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<EOF
-#line 8635 "configure"
+#line 8636 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -8730,7 +8731,7 @@
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<EOF
-#line 8733 "configure"
+#line 8734 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -10909,11 +10910,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:10912: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:10913: $lt_compile\"" >&5)
(eval "$lt_compile" 2>conftest.err)
ac_status=$?
cat conftest.err >&5
- echo "$as_me:10916: \$? = $ac_status" >&5
+ echo "$as_me:10917: \$? = $ac_status" >&5
if (exit $ac_status) && test -s "$ac_outfile"; then
# The compiler can only warn and ignore the option if not recognized
# So say no if there are warnings
@@ -10969,11 +10970,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:10972: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:10973: $lt_compile\"" >&5)
(eval "$lt_compile" 2>out/conftest.err)
ac_status=$?
cat out/conftest.err >&5
- echo "$as_me:10976: \$? = $ac_status" >&5
+ echo "$as_me:10977: \$? = $ac_status" >&5
if (exit $ac_status) && test -s out/conftest2.$ac_objext
then
# The compiler can only warn and ignore the option if not recognized
@@ -11480,7 +11481,7 @@
libsuff=
case "$host_cpu" in
x86_64*|s390x*|powerpc64*)
- echo '#line 11483 "configure"' > conftest.$ac_ext
+ echo '#line 11484 "configure"' > conftest.$ac_ext
if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
(eval $ac_compile) 2>&5
ac_status=$?
@@ -12351,7 +12352,7 @@
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<EOF
-#line 12354 "configure"
+#line 12355 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -12449,7 +12450,7 @@
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<EOF
-#line 12452 "configure"
+#line 12453 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -13276,11 +13277,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:13279: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:13280: $lt_compile\"" >&5)
(eval "$lt_compile" 2>conftest.err)
ac_status=$?
cat conftest.err >&5
- echo "$as_me:13283: \$? = $ac_status" >&5
+ echo "$as_me:13284: \$? = $ac_status" >&5
if (exit $ac_status) && test -s "$ac_outfile"; then
# The compiler can only warn and ignore the option if not recognized
# So say no if there are warnings
@@ -13336,11 +13337,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:13339: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:13340: $lt_compile\"" >&5)
(eval "$lt_compile" 2>out/conftest.err)
ac_status=$?
cat out/conftest.err >&5
- echo "$as_me:13343: \$? = $ac_status" >&5
+ echo "$as_me:13344: \$? = $ac_status" >&5
if (exit $ac_status) && test -s out/conftest2.$ac_objext
then
# The compiler can only warn and ignore the option if not recognized
@@ -14650,7 +14651,7 @@
libsuff=
case "$host_cpu" in
x86_64*|s390x*|powerpc64*)
- echo '#line 14653 "configure"' > conftest.$ac_ext
+ echo '#line 14654 "configure"' > conftest.$ac_ext
if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
(eval $ac_compile) 2>&5
ac_status=$?
@@ -15391,11 +15392,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:15394: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:15395: $lt_compile\"" >&5)
(eval "$lt_compile" 2>conftest.err)
ac_status=$?
cat conftest.err >&5
- echo "$as_me:15398: \$? = $ac_status" >&5
+ echo "$as_me:15399: \$? = $ac_status" >&5
if (exit $ac_status) && test -s "$ac_outfile"; then
# The compiler can only warn and ignore the option if not recognized
# So say no if there are warnings
@@ -15624,11 +15625,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:15627: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:15628: $lt_compile\"" >&5)
(eval "$lt_compile" 2>conftest.err)
ac_status=$?
cat conftest.err >&5
- echo "$as_me:15631: \$? = $ac_status" >&5
+ echo "$as_me:15632: \$? = $ac_status" >&5
if (exit $ac_status) && test -s "$ac_outfile"; then
# The compiler can only warn and ignore the option if not recognized
# So say no if there are warnings
@@ -15684,11 +15685,11 @@
-e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
-e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
-e 's:$: $lt_compiler_flag:'`
- (eval echo "\"\$as_me:15687: $lt_compile\"" >&5)
+ (eval echo "\"\$as_me:15688: $lt_compile\"" >&5)
(eval "$lt_compile" 2>out/conftest.err)
ac_status=$?
cat out/conftest.err >&5
- echo "$as_me:15691: \$? = $ac_status" >&5
+ echo "$as_me:15692: \$? = $ac_status" >&5
if (exit $ac_status) && test -s out/conftest2.$ac_objext
then
# The compiler can only warn and ignore the option if not recognized
@@ -17018,7 +17019,7 @@
libsuff=
case "$host_cpu" in
x86_64*|s390x*|powerpc64*)
- echo '#line 17021 "configure"' > conftest.$ac_ext
+ echo '#line 17022 "configure"' > conftest.$ac_ext
if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
(eval $ac_compile) 2>&5
ac_status=$?
@@ -17889,7 +17890,7 @@
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<EOF
-#line 17892 "configure"
+#line 17893 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -17987,7 +17988,7 @@
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<EOF
-#line 17990 "configure"
+#line 17991 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -19761,20 +19762,31 @@
if test $ssl2 = yes; then
echo "$as_me:$LINENO: result: yes" >&5
echo "${ECHO_T}yes" >&6
+ extra_cppflags="$extra_cppflags -DWANT_SSL2"
else
echo "$as_me:$LINENO: result: no" >&5
echo "${ECHO_T}no" >&6
fi
+#AM_CONDITIONAL(SSL2, test x$ssl2 = xyes)
-
-if test x$ssl2 = xyes; then
- SSL2_TRUE=
- SSL2_FALSE='#'
+echo "$as_me:$LINENO: checking for ECC" >&5
+echo $ECHO_N "checking for ECC... $ECHO_C" >&6
+# Check whether --enable-ecc or --disable-ecc was given.
+if test "${enable_ecc+set}" = set; then
+ enableval="$enable_ecc"
+ ecc=$enableval
+else
+ ecc=no
+fi;
+if test $ecc = yes; then
+ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6
+ extra_cppflags="$extra_cppflags -DNSS_ENABLE_ECC"
else
- SSL2_TRUE='#'
- SSL2_FALSE=
+ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
fi
-
+#AM_CONDITIONAL(ECC, test x$ecc = xyes)
{ echo "$as_me:$LINENO: checking for apr-config..." >&5
echo "$as_me: checking for apr-config..." >&6;}
@@ -19954,7 +19966,7 @@
apache_conf=`$APXS -q SYSCONFDIR`
apache_prefix=`$APXS -q PREFIX`
apache_bin=`$APXS -q SBINDIR`
-extra_cppflags=`$APXS -q EXTRA_CPPFLAGS`
+extra_cppflags="$extra_cppflags `$APXS -q EXTRA_CPPFLAGS`"
if ! test -f "$apache_inc/apr.h"; then
if test -z "$apr_inc"; then
@@ -20387,13 +20399,6 @@
Usually this means the macro was only invoked conditionally." >&2;}
{ (exit 1); exit 1; }; }
fi
-if test -z "${SSL2_TRUE}" && test -z "${SSL2_FALSE}"; then
- { { echo "$as_me:$LINENO: error: conditional \"SSL2\" was never defined.
-Usually this means the macro was only invoked conditionally." >&5
-echo "$as_me: error: conditional \"SSL2\" was never defined.
-Usually this means the macro was only invoked conditionally." >&2;}
- { (exit 1); exit 1; }; }
-fi
: ${CONFIG_STATUS=./config.status}
ac_clean_files_save=$ac_clean_files
@@ -20981,8 +20986,6 @@
s,@LEX@,$LEX,;t t
s,@LEXLIB@,$LEXLIB,;t t
s,@LEX_OUTPUT_ROOT@,$LEX_OUTPUT_ROOT,;t t
-s,@SSL2_TRUE@,$SSL2_TRUE,;t t
-s,@SSL2_FALSE@,$SSL2_FALSE,;t t
s,@APR_CONFIG@,$APR_CONFIG,;t t
s,@APXS@,$APXS,;t t
s,@PKG_CONFIG@,$PKG_CONFIG,;t t
Index: configure.in
===================================================================
RCS file: /cvs/dirsec/mod_nss/configure.in,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- configure.in 26 Feb 2006 00:30:56 -0000 1.10
+++ configure.in 2 Mar 2006 19:21:54 -0000 1.11
@@ -28,10 +28,23 @@
ssl2=$enableval, ssl2=no)
if test $ssl2 = yes; then
AC_MSG_RESULT(yes)
+ extra_cppflags="$extra_cppflags -DWANT_SSL2"
else
AC_MSG_RESULT(no)
fi
-AM_CONDITIONAL(SSL2, test x$ssl2 = xyes)
+#AM_CONDITIONAL(SSL2, test x$ssl2 = xyes)
+
+AC_MSG_CHECKING(for ECC)
+AC_ARG_ENABLE(ecc,
+ [ --enable-ecc enable Elliptical Curve Cyptography (default=no)],
+ ecc=$enableval, ecc=no)
+if test $ecc = yes; then
+ AC_MSG_RESULT(yes)
+ extra_cppflags="$extra_cppflags -DNSS_ENABLE_ECC"
+else
+ AC_MSG_RESULT(no)
+fi
+#AM_CONDITIONAL(ECC, test x$ecc = xyes)
AC_CHECKING(for apr-config)
# check for --with-apr-config
@@ -97,7 +110,7 @@
apache_conf=`$APXS -q SYSCONFDIR`
apache_prefix=`$APXS -q PREFIX`
apache_bin=`$APXS -q SBINDIR`
-extra_cppflags=`$APXS -q EXTRA_CPPFLAGS`
+extra_cppflags="$extra_cppflags `$APXS -q EXTRA_CPPFLAGS`"
if ! test -f "$apache_inc/apr.h"; then
if test -z "$apr_inc"; then
Index: mod_nss.c
===================================================================
RCS file: /cvs/dirsec/mod_nss/mod_nss.c,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- mod_nss.c 4 Jan 2006 22:07:58 -0000 1.10
+++ mod_nss.c 2 Mar 2006 19:21:54 -0000 1.11
@@ -86,8 +86,13 @@
"SSL Client Authentication "
"(`none', `optional', `require'")
SSL_CMD_SRV(Nickname, TAKE1,
- "SSL Server Certificate nickname "
+ "SSL RSA Server Certificate nickname "
"(`Server-Cert'")
+#ifdef NSS_ENABLE_ECC
+ SSL_CMD_SRV(ECCNickname, TAKE1,
+ "SSL ECC Server Certificate nickname "
+ "(`Server-Cert'")
+#endif
SSL_CMD_SRV(EnforceValidCerts, FLAG,
"Require a valid, trust, non-expired server certificate (default on)"
"(`on', `off'")
Index: mod_nss.h
===================================================================
RCS file: /cvs/dirsec/mod_nss/mod_nss.h,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- mod_nss.h 4 Jan 2006 22:07:58 -0000 1.9
+++ mod_nss.h 2 Mar 2006 19:21:54 -0000 1.10
@@ -268,11 +268,20 @@
int tlsrollback;
int enforce;
const char *nickname;
+#ifdef NSS_ENABLE_ECC
+ const char *eccnickname;
+#endif
CERTCertificate *servercert;
SECKEYPrivateKey *serverkey;
SSLKEAType serverKEAType;
+#ifdef NSS_ENABLE_ECC
+ CERTCertificate *eccservercert;
+ SECKEYPrivateKey *eccserverkey;
+ SSLKEAType eccserverKEAType;
+#endif
+
PRFileDesc *model; /* used to model an SSL socket */
modnss_auth_ctx_t auth;
@@ -329,7 +338,11 @@
enum sslversion { SSL2=1, SSL3=2, TLS=4};
/* the table itself is defined in nss_engine_init.c */
+#ifdef NSS_ENABLE_ECC
+#define ciphernum 48
+#else
#define ciphernum 23
+#endif
/*
* function prototypes
@@ -353,6 +366,9 @@
const char *nss_cmd_NSSVerifyClient(cmd_parms *cmd, void *dcfg, const char *arg);
const char *nss_cmd_NSSProtocol(cmd_parms *cmd, void *dcfg, const char *arg);
const char *nss_cmd_NSSNickname(cmd_parms *cmd, void *dcfg, const char *arg);
+#ifdef NSS_ENABLE_ECC
+const char *nss_cmd_NSSECCNickname(cmd_parms *cmd, void *dcfg, const char *arg);
+#endif
const char *nss_cmd_NSSEnforceValidCerts(cmd_parms *, void *, int);
const char *nss_cmd_NSSSessionCacheTimeout(cmd_parms *cmd, void *dcfg, const char *arg);
const char *nss_cmd_NSSSession3CacheTimeout(cmd_parms *cmd, void *dcfg, const char *arg);
Index: nss.conf.in
===================================================================
RCS file: /cvs/dirsec/mod_nss/nss.conf.in,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- nss.conf.in 3 Oct 2005 14:59:26 -0000 1.7
+++ nss.conf.in 2 Mar 2006 19:21:54 -0000 1.8
@@ -86,14 +86,27 @@
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_nss documentation for a complete list.
-NSSCipherSuite +rsa_3des_sha,-rsa_des_56_sha,+rsa_des_sha,-rsa_null_md5,-rsa_null_sha,-rsa_rc2_40_md5,+rsa_rc4_128_md5,-rsa_rc4_128_sha,-rsa_rc4_40_md5,-rsa_rc4_56_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-fips_des_sha,+fips_3des_sha,-rsa_aes_128_sha,-rsa_aes_256_sha
+
+# SSL 3 ciphers. SSL 2 is disabled by default.
+NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha
+
+# SSL 3 ciphers + ECC ciphers. SSL 2 is disabled by default.
+#
+# Comment out the NSSCipherSuite line above and use the one below if you have
+# ECC enabled NSS and mod_nss and want to use Elliptical Curve Cryptography
+#NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha,-ecdh_ecdsa_null_sha,+ecdh_ecdsa_rc4_128_sha,+ecdh_ecdsa_3des_sha,+ecdh_ecdsa_aes_128_sha,+ecdh_ecdsa_aes_256_sha,-ecdhe_ecdsa_null_sha,+ecdhe_ecdsa_rc4_128_sha,+ecdhe_ecdsa_3des_sha,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,-ecdh_rsa_null_sha,+ecdh_rsa_128_sha,+ecdh_rsa_3des_sha,+ecdh_rsa_aes_128_sha,+ecdh_rsa_aes_256_sha,-echde_rsa_null,+ecdhe_rsa_rc4_128_sha,+ecdhe_rsa_3des_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha
NSSProtocol SSLv3,TLSv1
# SSL Certificate Nickname:
-# The nickname of the server certificate you are going to use.
+# The nickname of the RSA server certificate you are going to use.
NSSNickname Server-Cert
+# SSL Certificate Nickname:
+# The nickname of the ECC server certificate you are going to use, if you
+# have an ECC-enabled version of NSS and mod_nss
+#NSSECCNickname Server-Cert-ecc
+
# Server Certificate Database:
# The NSS security database directory that holds the certificates and
# keys. The database consists of 3 files: cert8.db, key3.db and secmod.db.
Index: nss_engine_config.c
===================================================================
RCS file: /cvs/dirsec/mod_nss/nss_engine_config.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- nss_engine_config.c 3 Oct 2005 14:59:26 -0000 1.9
+++ nss_engine_config.c 2 Mar 2006 19:21:54 -0000 1.10
@@ -80,6 +80,9 @@
mctx->enforce = PR_TRUE;
mctx->nickname = NULL;
+#ifdef NSS_ENABLE_ECC
+ mctx->eccnickname = NULL;
+#endif
mctx->servercert = NULL;
mctx->serverkey = NULL;
@@ -162,6 +165,9 @@
cfgMerge(auth.verify_mode, SSL_CVERIFY_UNSET);
cfgMerge(nickname, NULL);
+#ifdef NSS_ENABLE_ECC
+ cfgMerge(eccnickname, NULL);
+#endif
cfgMerge(enforce, PR_TRUE);
}
@@ -416,6 +422,19 @@
return NULL;
}
+#ifdef NSS_ENABLE_ECC
+const char *nss_cmd_NSSECCNickname(cmd_parms *cmd,
+ void *dcfg,
+ const char *arg)
+{
+ SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+
+ sc->server->eccnickname = arg;
+
+ return NULL;
+}
+#endif
+
const char *nss_cmd_NSSProxyEngine(cmd_parms *cmd, void *dcfg, int flag)
{
SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
Index: nss_engine_init.c
===================================================================
RCS file: /cvs/dirsec/mod_nss/nss_engine_init.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- nss_engine_init.c 28 Oct 2005 18:20:01 -0000 1.16
+++ nss_engine_init.c 2 Mar 2006 19:21:54 -0000 1.17
@@ -60,6 +60,34 @@
/* AES ciphers.*/
{"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA, 0, SSL3 | TLS},
{"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA, 0, SSL3 | TLS},
+#ifdef NSS_ENABLE_ECC
+ /* ECC ciphers.*/
+ {"ecdh_ecdsa_null_sha", TLS_ECDH_ECDSA_WITH_NULL_SHA, 0, TLS},
+ {"ecdh_ecdsa_rc4_128_sha", TLS_ECDH_ECDSA_WITH_RC4_128_SHA, 0, TLS},
+ {"ecdh_ecdsa_3des_sha", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, 0, TLS},
+ {"ecdh_ecdsa_aes_128_sha", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, 0, TLS},
+ {"ecdh_ecdsa_aes_256_sha", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, 0, TLS},
+ {"ecdhe_ecdsa_null_sha", TLS_ECDHE_ECDSA_WITH_NULL_SHA, 0, TLS},
+ {"ecdhe_ecdsa_rc4_128_sha", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, 0, TLS},
+ {"ecdhe_ecdsa_3des_sha", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, 0, TLS},
+ {"ecdhe_ecdsa_aes_128_sha", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 0, TLS},
+ {"ecdhe_ecdsa_aes_256_sha", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 0, TLS},
+ {"ecdh_rsa_null_sha", TLS_ECDH_RSA_WITH_NULL_SHA, 0, TLS},
+ {"ecdh_rsa_128_sha", TLS_ECDH_RSA_WITH_RC4_128_SHA, 0, TLS},
+ {"ecdh_rsa_3des_sha", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, 0, TLS},
+ {"ecdh_rsa_aes_128_sha", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, 0, TLS},
+ {"ecdh_rsa_aes_256_sha", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, 0, TLS},
+ {"echde_rsa_null", TLS_ECDHE_RSA_WITH_NULL_SHA, 0, TLS},
+ {"ecdhe_rsa_rc4_128_sha", TLS_ECDHE_RSA_WITH_RC4_128_SHA, 0, TLS},
+ {"ecdhe_rsa_3des_sha", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 0, TLS},
+ {"ecdhe_rsa_aes_128_sha", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 0, TLS},
+ {"ecdhe_rsa_aes_256_sha", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 0, TLS},
+ {"ecdh_anon_null_sha", TLS_ECDH_anon_WITH_NULL_SHA, 0, TLS},
+ {"ecdh_anon_rc4_128sha", TLS_ECDH_anon_WITH_RC4_128_SHA, 0, TLS},
+ {"ecdh_anon_3des_sha", TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, 0, TLS},
+ {"ecdh_anon_aes_128_sha", TLS_ECDH_anon_WITH_AES_128_CBC_SHA, 0, TLS},
+ {"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA, 0, TLS},
+#endif
};
static char *version_components[] = {
@@ -722,7 +750,11 @@
apr_pool_t *ptemp,
modnss_ctx_t *mctx)
{
- if (mctx->servercert != NULL || mctx->serverkey != NULL) {
+#ifdef NSS_ENABLE_ECC
+ if (mctx->servercert != NULL || mctx->eccservercert != NULL) {
+#else
+ if (mctx->servercert != NULL) {
+#endif
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
"Illegal attempt to re-initialise SSL for server "
"(theoretically shouldn't happen!)");
@@ -749,58 +781,50 @@
nss_init_ctx_cipher_suite(s, p, ptemp, mctx);
}
-static void nss_init_server_certs(server_rec *s,
- apr_pool_t *p,
- apr_pool_t *ptemp,
- modnss_ctx_t *mctx)
+static void nss_init_certificate(server_rec *s, const char *nickname,
+ CERTCertificate **servercert,
+ SECKEYPrivateKey **serverkey,
+ SSLKEAType *KEAtype,
+ PRFileDesc *model,
+ int enforce)
{
SECCertTimeValidity certtimestatus;
SECStatus secstatus;
PK11SlotInfo* slot = NULL;
-
- /*
- * Get own certificate and private key.
- */
- if (mctx->nickname == NULL && mctx->as_server) {
- ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
- "No certificate nickname provided.");
- nss_die();
+ if (nickname == NULL) {
+ return;
}
- if (mctx->nickname != NULL) {
- ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "Using nickname %s.", mctx->nickname);
- mctx->servercert = FindServerCertFromNickname(mctx->nickname);
- }
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+ "Using nickname %s.", nickname);
+
+ *servercert = FindServerCertFromNickname(nickname);
/* Verify the certificate chain. */
- if (mctx->servercert != NULL && mctx->as_server) {
+ if (*servercert != NULL) {
SECCertificateUsage usage = certificateUsageSSLServer;
- if (CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), mctx->servercert, PR_TRUE, usage, NULL, NULL) != SECSuccess) {
+ if (CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), *servercert, PR_TRUE, usage, NULL, NULL) != SECSuccess) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
- "Certificate not verified: '%s'", mctx->nickname);
+ "Certificate not verified: '%s'", nickname);
nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
- if (mctx->enforce) {
+ if (enforce) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
- "Unable to verify certificate '%s'. Add \"NSSEnforceValidCerts off\" to nss.conf so the server can start until the problem can be resolved.", mctx->nickname);
+ "Unable to verify certificate '%s'. Add \"NSSEnforceValidCerts off\" to nss.conf so the server can start until the problem can be resolved.", nickname);
nss_die();
}
}
- }
-
- if (NULL == mctx->servercert && mctx->as_server)
- {
+ } else {
ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "Certificate not found: '%s'", mctx->nickname);
+ "Certificate not found: '%s'", nickname);
nss_die();
}
- if (mctx->nickname && strchr(mctx->nickname, ':'))
+ if (strchr(nickname, ':'))
{
- char* token = strdup(mctx->nickname);
+ char* token = strdup(nickname);
char* colon = strchr(token, ':');
if (colon) {
*colon = 0;
@@ -822,21 +846,19 @@
else {
slot = PK11_GetInternalKeySlot();
}
-
- if (mctx->servercert) {
- mctx->serverkey = PK11_FindPrivateKeyFromCert(slot, mctx->servercert, NULL);
- }
+
+ *serverkey = PK11_FindPrivateKeyFromCert(slot, *servercert, NULL);
+
PK11_FreeSlot(slot);
- if (mctx->as_server && mctx->serverkey == NULL) {
+ if (*serverkey == NULL) {
ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "Key not found for: '%s'", mctx->nickname);
+ "Key not found for: '%s'", nickname);
nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
nss_die();
}
- if (mctx->as_server) {
- mctx->serverKEAType = NSS_FindCertKEAType(mctx->servercert);
+ *KEAtype = NSS_FindCertKEAType(*servercert);
/*
* Check for certs that are expired or not yet valid and WARN about it
@@ -846,7 +868,7 @@
* for every virtual server - too expensive?
*/
- certtimestatus = CERT_CheckCertValidTimes(mctx->servercert, PR_Now(), PR_FALSE);
+ certtimestatus = CERT_CheckCertValidTimes(*servercert, PR_Now(), PR_FALSE);
switch (certtimestatus)
{
case secCertTimeValid:
@@ -854,35 +876,69 @@
break;
case secCertTimeExpired:
ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "Server certificate is expired: '%s'", mctx->nickname);
+ "Server certificate is expired: '%s'", nickname);
break;
case secCertTimeNotValidYet:
ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "Certificate is not valid yet '%s'", mctx->nickname);
+ "Certificate is not valid yet '%s'", nickname);
default:
ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "Unhandled Certificate time type %d for: '%s'", certtimestatus, mctx->nickname);
+ "Unhandled Certificate time type %d for: '%s'", certtimestatus, nickname);
break;
}
- }
- secstatus = (SECStatus)SSL_SetPKCS11PinArg(mctx->model, NULL);
+ secstatus = SSL_ConfigSecureServer(model, *servercert, *serverkey, *KEAtype);
if (secstatus != SECSuccess) {
ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "Error setting PKCS11 pin argument: '%s'", mctx->nickname);
+ "SSL error configuring server: '%s'", nickname);
+ nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
nss_die();
}
-
+}
+
+
+static void nss_init_server_certs(server_rec *s,
+ apr_pool_t *p,
+ apr_pool_t *ptemp,
+ modnss_ctx_t *mctx)
+{
+ SECCertTimeValidity certtimestatus;
+ SECStatus secstatus;
+
+ PK11SlotInfo* slot = NULL;
+
+ /*
+ * Get own certificate and private key.
+ */
if (mctx->as_server) {
- secstatus = SSL_ConfigSecureServer(mctx->model, mctx->servercert, mctx->serverkey, mctx->serverKEAType);
- if (secstatus != SECSuccess) {
- ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
- "SSL error configuring server: '%s'", mctx->nickname);
- nss_log_nss_error(APLOG_MARK, APLOG_ERR, s);
+#ifdef NSS_ENABLE_ECC
+ if (mctx->nickname == NULL && mctx->eccnickname == NULL)
+#else
+ if (mctx->nickname == NULL)
+#endif
+ {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+ "No certificate nickname provided.");
nss_die();
}
+
+ nss_init_certificate(s, mctx->nickname, &mctx->servercert,
+ &mctx->serverkey, &mctx->serverKEAType,
+ mctx->model, mctx->enforce);
+#ifdef NSS_ENABLE_ECC
+ nss_init_certificate(s, mctx->eccnickname, &mctx->eccservercert,
+ &mctx->eccserverkey, &mctx->eccserverKEAType,
+ mctx->model, mctx->enforce);
+#endif
}
+ secstatus = (SECStatus)SSL_SetPKCS11PinArg(mctx->model, NULL);
+ if (secstatus != SECSuccess) {
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+ "Error setting PKCS11 pin argument: '%s'", mctx->nickname);
+ nss_die();
+ }
+
secstatus = (SECStatus)SSL_HandshakeCallback(mctx->model, (SSLHandshakeCallback)NSSHandshakeCallback, NULL);
if (secstatus != SECSuccess)
{
@@ -958,8 +1014,16 @@
sc = mySrvConfig(s);
if (sc->enabled) {
- CERT_DestroyCertificate(sc->server->servercert);
- SECKEY_DestroyPrivateKey(sc->server->serverkey);
+ if (sc->server->nickname) {
+ CERT_DestroyCertificate(sc->server->servercert);
+ SECKEY_DestroyPrivateKey(sc->server->serverkey);
+ }
+#ifdef NSS_ENABLE_ECC
+ if (sc->server->eccnickname) {
+ CERT_DestroyCertificate(sc->server->eccservercert);
+ SECKEY_DestroyPrivateKey(sc->server->eccserverkey);
+ }
+#endif
/* Closing this implicitly cleans up the copy of the certificates
* and keys associated with any SSL socket */
Index: nss_engine_io.c
===================================================================
RCS file: /cvs/dirsec/mod_nss/nss_engine_io.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- nss_engine_io.c 29 Sep 2005 19:36:10 -0000 1.4
+++ nss_engine_io.c 2 Mar 2006 19:21:54 -0000 1.5
@@ -652,7 +652,7 @@
conn_rec *c = filter_ctx->c;
SSLConnRec *sslconn = myConnConfig(c);
- ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, NULL,
+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, c->base_server,
"SSL connection destroyed without being closed");
PR_Close(sslconn->ssl);
@@ -859,7 +859,7 @@
filter_ctx->nobuffer = 1;
status = nss_filter_io_shutdown(filter_ctx, f->c, 0);
if (status != APR_SUCCESS) {
- ap_log_error(APLOG_MARK, APLOG_INFO, status, NULL,
+ ap_log_error(APLOG_MARK, APLOG_INFO, status, f->c->base_server,
"SSL filter error shutting down I/O");
}
if ((status = ap_pass_brigade(f->next, bb)) != APR_SUCCESS) {
Index: nss_engine_kernel.c
===================================================================
RCS file: /cvs/dirsec/mod_nss/nss_engine_kernel.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- nss_engine_kernel.c 31 May 2005 14:32:42 -0000 1.3
+++ nss_engine_kernel.c 2 Mar 2006 19:21:54 -0000 1.4
@@ -446,6 +446,9 @@
"Performing full renegotiation: "
"complete handshake protocol");
+ /* Do NOT call SSL_ResetHandshake as this will tear down the
+ * existing connection.
+ */
if (SSL_HandshakeCallback(ssl, HandshakeDone, (void *)&handshake_done) || SSL_ReHandshake(ssl, PR_TRUE)) {
int errCode = PR_GetError();
if (errCode == SEC_ERROR_INVALID_ARGS) {
@@ -461,7 +464,7 @@
return HTTP_FORBIDDEN;
}
- ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,
+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,
"Awaiting re-negotiation handshake");
while (!handshake_done) {
@@ -500,7 +503,9 @@
"Re-negotiation handshake failed: "
"Not accepted by client!?");
+#if 0
r->connection->aborted = 1;
+#endif
return HTTP_FORBIDDEN;
}
}
@@ -724,6 +729,7 @@
"SSL_VERSION_LIBRARY",
"SSL_PROTOCOL",
"SSL_CIPHER",
+ "SSL_CIPHER_NAME",
"SSL_CIPHER_EXPORT",
"SSL_CIPHER_USEKEYSIZE",
"SSL_CIPHER_ALGKEYSIZE",
Index: nss_engine_vars.c
===================================================================
RCS file: /cvs/dirsec/mod_nss/nss_engine_vars.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- nss_engine_vars.c 4 Jan 2006 22:07:58 -0000 1.4
+++ nss_engine_vars.c 2 Mar 2006 19:21:54 -0000 1.5
@@ -363,10 +363,10 @@
if (SSL_GetCipherSuiteInfo(channel.cipherSuite,
&suite, sizeof suite) == SECSuccess)
{
- result = apr_psprintf(p, "%s", suite.keaTypeName);
+ result = apr_psprintf(p, "%s_%s", suite.keaTypeName, suite.authAlgorithmName);
}
} else
- result = apr_pstrdup(p, "UNKNOWN");
+ result = apr_pstrdup(p, "UNKNOWN_UNKNOWN");
resdup = FALSE;
}
@@ -582,6 +582,25 @@
result = apr_psprintf(p, "%d", keySize);
resdup = FALSE;
}
+ else if (strcEQ(var, "_NAME")) {
+ SSLChannelInfo channel;
+ SSLCipherSuiteInfo suite;
+ SSLConnRec *sslconn = myConnConfig(c);
+
+ if (SSL_GetChannelInfo(sslconn->ssl, &channel, sizeof channel) ==
+ SECSuccess && channel.length == sizeof channel &&
+ channel.cipherSuite)
+ {
+ if (SSL_GetCipherSuiteInfo(channel.cipherSuite,
+ &suite, sizeof suite) == SECSuccess)
+ {
+ result = apr_psprintf(p, "%s", suite.cipherSuiteName);
+ }
+ } else
+ result = apr_pstrdup(p, "UNKNOWN");
+
+ resdup = FALSE;
+ }
if (result != NULL && resdup)
result = apr_pstrdup(p, result);
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] ldapserver/ldap/servers/slapd/back-ldbm dn2entry.c, 1.4, 1.4.2.1 import-threads.c, 1.8.2.1, 1.8.2.2 sort.c, 1.5, 1.5.2.1
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11336/ldap/servers/slapd/back-ldbm
Modified Files:
Tag: Directory71RtmBranch
dn2entry.c import-threads.c sort.c
Log Message:
[159328] Tracking bug for Directory Server 7.1 Service Packs; Comment #50
ported internal diffs to the external CVS
Index: dn2entry.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/dn2entry.c,v
retrieving revision 1.4
retrieving revision 1.4.2.1
diff -u -r1.4 -r1.4.2.1
--- dn2entry.c 19 Apr 2005 22:07:38 -0000 1.4
+++ dn2entry.c 2 Mar 2006 01:12:31 -0000 1.4.2.1
@@ -109,58 +109,12 @@
}
/*
- * dn2entry_or_ancestor - look up dn in the cache/indexes and return the
- * corresponding entry. If the entry is not found, this function returns NULL
- * and sets ancestordn to the DN of highest entry in the tree matched.
- *
- * ancestordn should be initialized before calling this function.
- *
- * When the caller is finished with the entry returned, it should return it
- * to the cache:
- * e = dn2entry_or_ancestor( ... );
- * if ( NULL != e ) {
- * cache_return( &inst->inst_cache, &e );
- * }
- */
-struct backentry *
-dn2entry_or_ancestor(
- Slapi_Backend *be,
- const Slapi_DN *sdn,
- Slapi_DN *ancestordn,
- back_txn *txn,
- int *err
-)
-{
- struct backentry *e;
-
- LDAPDebug( LDAP_DEBUG_TRACE, "=> dn2entry_or_ancestor \"%s\"\n", slapi_sdn_get_dn(sdn), 0, 0 );
-
- /*
- * Fetch the entry asked for.
- */
-
- e= dn2entry(be,sdn,txn,err);
-
- if(e==NULL)
- {
- /*
- * could not find the entry named. crawl back up the dn and
- * stop at the first ancestor that does exist, or when we get
- * to the suffix.
- */
- e= dn2ancestor(be,sdn,ancestordn,txn,err);
- }
-
- LDAPDebug( LDAP_DEBUG_TRACE, "<= dn2entry_or_ancestor %p\n", e, 0, 0 );
- return( e );
-}
-
-/*
* Use the DN to fetch the parent of the entry.
* If the parent entry doesn't exist, keep working
* up the DN until we hit "" or an backend suffix.
*
- * ancestordn should be initialized before calling this function.
+ * ancestordn should be initialized before calling this function, and
+ * should be empty
*
* Returns NULL for no entry found.
*
@@ -184,18 +138,64 @@
LDAPDebug( LDAP_DEBUG_TRACE, "=> dn2ancestor \"%s\"\n", slapi_sdn_get_dn(sdn), 0, 0 );
- /* stop when we get to "", or a backend suffix point */
- slapi_sdn_done(ancestordn); /* free any previous contents */
- slapi_sdn_get_backend_parent(sdn,ancestordn,be);
- if ( !slapi_sdn_isempty(ancestordn) )
- {
- Slapi_DN *newsdn = slapi_sdn_dup(ancestordn);
- e = dn2entry_or_ancestor( be, newsdn, ancestordn, txn, err );
- slapi_sdn_free(&newsdn);
- }
-
- LDAPDebug( LDAP_DEBUG_TRACE, "<= dn2ancestor %p\n", e, 0, 0 );
- return( e );
+ /* first, check to see if the given sdn is empty or a root suffix of the
+ given backend - if so, it has no parent */
+ if (!slapi_sdn_isempty(sdn) && !slapi_be_issuffix( be, sdn )) {
+ Slapi_DN ancestorndn;
+ const char *ptr;
+
+ /* assign ancestordn to the parent of the given dn - ancestordn will contain
+ the "raw" unnormalized DN from the caller, so we can give back the DN
+ in the same format as we received it */
+ ptr = slapi_dn_find_parent(slapi_sdn_get_dn(sdn));
+ /* assign the ancestordn dn pointer to the parent of dn from sdn - sdn "owns"
+ the memory, but ancestordn points to it */
+ slapi_sdn_set_dn_byref(ancestordn, ptr); /* free any previous contents */
+ /* now, do the same for the normalized version */
+ /* ancestorndn holds the normalized version for iteration purposes and
+ because dn2entry needs the normalized dn */
+ ptr = slapi_dn_find_parent(slapi_sdn_get_ndn(sdn));
+ slapi_sdn_init_ndn_byref(&ancestorndn, ptr);
+
+ /*
+ At this point you may be wondering why I need both ancestorndn and
+ ancestordn. Because, with the slapi_sdn interface, you cannot set both
+ the dn and ndn byref at the same time. Whenever you call set_dn or set_ndn,
+ it calls slapi_sdn_done which wipes out the previous contents. I suppose I
+ could have added another API to allow you to pass them both in. Also, using
+ slapi_sdn_get_ndn(ancestordn) every time would result in making a copy then
+ normalizing the copy every time - not efficient.
+ So, why not just use a char* for the ancestorndn? Because dn2entry requires
+ a Slapi_DN with the normalized dn.
+ */
+
+ /* stop when we get to "", or a backend suffix point */
+ while (!e && !slapi_sdn_isempty(&ancestorndn) && !slapi_be_issuffix( be, &ancestorndn )) {
+ /* find the entry - it uses the ndn, so no further conversion is necessary */
+ e= dn2entry(be,&ancestorndn,txn,err);
+ if (!e) {
+ /* not found, so set ancestordn to its parent and try again */
+ ptr = slapi_dn_find_parent(slapi_sdn_get_ndn(&ancestorndn));
+ /* keep in mind that ptr points to the raw ndn pointer inside
+ ancestorndn which is still the ndn string "owned" by sdn, the
+ original dn we started with - we are careful not to touch
+ or change it */
+ slapi_sdn_set_ndn_byref(&ancestorndn, ptr); /* wipe out the previous contents */
+ /* now do the same for the unnormalized one */
+ ptr = slapi_dn_find_parent(slapi_sdn_get_dn(ancestordn));
+ slapi_sdn_set_dn_byref(ancestordn, ptr); /* wipe out the previous contents */
+ }
+ }
+
+ slapi_sdn_done(&ancestorndn);
+ }
+
+ /* post conditions:
+ e is the entry of the ancestor of sdn OR e is the suffix entry
+ OR e is NULL
+ ancestordn contains the unnormalized DN of e or is empty */
+ LDAPDebug( LDAP_DEBUG_TRACE, "<= dn2ancestor %p\n", e, 0, 0 );
+ return( e );
}
/*
Index: import-threads.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/import-threads.c,v
retrieving revision 1.8.2.1
retrieving revision 1.8.2.2
diff -u -r1.8.2.1 -r1.8.2.2
--- import-threads.c 20 Feb 2006 18:14:50 -0000 1.8.2.1
+++ import-threads.c 2 Mar 2006 01:12:31 -0000 1.8.2.2
@@ -986,7 +986,7 @@
int ret = 0;
struct attrinfo *parentid_ai;
Slapi_PBlock *pb = slapi_pblock_new();
- int shift = 0;
+ int shift = 0;
PR_ASSERT(info != NULL);
PR_ASSERT(inst != NULL);
@@ -1030,8 +1030,8 @@
/* Read that entry from the cache */
fi = import_fifo_fetch(job, id, 0, shift);
if (! fi) {
- import_log_notice(job, "WARNING: entry id %d is missing");
- shift++;
+ import_log_notice(job, "WARNING: entry id %d is missing", id);
+ shift++;
continue;
}
@@ -1052,7 +1052,7 @@
*/
if (job->flags & FLAG_ABORT) {
goto error;
- }
+ }
if (parent_status == IMPORT_ADD_OP_ATTRS_NO_PARENT) {
/* If this entry is a suffix entry, this is not a problem */
Index: sort.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/back-ldbm/sort.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- sort.c 19 Apr 2005 22:07:38 -0000 1.5
+++ sort.c 2 Mar 2006 01:12:31 -0000 1.5.2.1
@@ -384,6 +384,7 @@
return_value = ber_scanf(ber,"a",&rtype);
if (LBER_ERROR == return_value) {
+ slapi_ch_free_string(&rtype);
rc = LDAP_PROTOCOL_ERROR;
goto err;
}
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] ldapserver/ldap/servers/slapd add.c, 1.5, 1.5.2.1 attr.c, 1.5.2.1, 1.5.2.2 ava.c, 1.4, 1.4.2.1 bind.c, 1.6, 1.6.2.1 compare.c, 1.4, 1.4.2.1 delete.c, 1.4, 1.4.2.1 dn.c, 1.6.2.1, 1.6.2.2 filter.c, 1.5, 1.5.2.1 modify.c, 1.7, 1.7.2.1 modrdn.c, 1.4, 1.4.2.1 passwd_extop.c, 1.6, 1.6.2.1 slapi-plugin.h, 1.8, 1.8.2.1
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11336/ldap/servers/slapd
Modified Files:
Tag: Directory71RtmBranch
add.c attr.c ava.c bind.c compare.c delete.c dn.c filter.c
modify.c modrdn.c passwd_extop.c slapi-plugin.h
Log Message:
[159328] Tracking bug for Directory Server 7.1 Service Packs; Comment #50
ported internal diffs to the external CVS
Index: add.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/add.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- add.c 19 Apr 2005 22:07:36 -0000 1.5
+++ add.c 2 Mar 2006 01:12:23 -0000 1.5.2.1
@@ -102,8 +102,9 @@
*/
/* get the name */
{
- char *dn;
+ char *dn = NULL;
if ( ber_scanf( ber, "{a", &dn ) == LBER_ERROR ) {
+ slapi_ch_free_string(&dn);
LDAPDebug( LDAP_DEBUG_ANY,
"ber_scanf failed (op=Add; params=DN)\n", 0, 0, 0 );
op_shared_log_error_access (pb, "ADD", "???", "decoding error");
@@ -121,11 +122,13 @@
tag != LBER_DEFAULT && tag != LBER_END_OF_SEQORSET;
tag = ber_next_element( ber, &len, last ) ) {
char *type = NULL, *normtype = NULL;
- struct berval **vals;
+ struct berval **vals = NULL;
if ( ber_scanf( ber, "{a{V}}", &type, &vals ) == LBER_ERROR ) {
op_shared_log_error_access (pb, "ADD", slapi_sdn_get_dn (slapi_entry_get_sdn_const(e)), "decoding error");
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL,
"decoding error", 0, NULL );
+ slapi_ch_free_string(&type);
+ ber_bvecfree( vals );
goto free_and_return;
}
@@ -134,7 +137,7 @@
op_shared_log_error_access (pb, "ADD", slapi_sdn_get_dn (slapi_entry_get_sdn_const(e)), "null value");
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL, NULL,
0, NULL );
- free( type );
+ slapi_ch_free_string(&type);
goto free_and_return;
}
@@ -144,7 +147,7 @@
PR_snprintf (ebuf, BUFSIZ, "invalid type '%s'", type);
op_shared_log_error_access (pb, "ADD", slapi_sdn_get_dn (slapi_entry_get_sdn_const(e)), ebuf);
send_ldap_result( pb, rc, NULL, ebuf, 0, NULL );
- free( type );
+ slapi_ch_free_string(&type);
slapi_ch_free( (void**)&normtype );
ber_bvecfree( vals );
goto free_and_return;
Index: attr.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/attr.c,v
retrieving revision 1.5.2.1
retrieving revision 1.5.2.2
diff -u -r1.5.2.1 -r1.5.2.2
--- attr.c 25 Aug 2005 18:25:08 -0000 1.5.2.1
+++ attr.c 2 Mar 2006 01:12:25 -0000 1.5.2.2
@@ -112,7 +112,7 @@
switch ( opt ) {
case SLAPI_TYPE_CMP_EXACT: /* compare base name + options as given */
- rc = strcmp( a1, a2 );
+ rc = strcasecmp( a1, a2 );
break;
case SLAPI_TYPE_CMP_BASE: /* ignore options on both names - compare base names only */
Index: ava.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/ava.c,v
retrieving revision 1.4
retrieving revision 1.4.2.1
diff -u -r1.4 -r1.4.2.1
--- ava.c 19 Apr 2005 22:07:36 -0000 1.4
+++ ava.c 2 Mar 2006 01:12:25 -0000 1.4.2.1
@@ -53,10 +53,12 @@
struct ava *ava
)
{
- char *type;
+ char *type = NULL;
if ( ber_scanf( ber, "{ao}", &type, &ava->ava_value )
== LBER_ERROR ) {
+ slapi_ch_free_string(&type);
+ ava_done(ava);
LDAPDebug( LDAP_DEBUG_ANY, " get_ava ber_scanf\n", 0, 0, 0 );
return( LDAP_PROTOCOL_ERROR );
}
Index: bind.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/bind.c,v
retrieving revision 1.6
retrieving revision 1.6.2.1
diff -u -r1.6 -r1.6.2.1
--- bind.c 19 Apr 2005 22:07:36 -0000 1.6
+++ bind.c 2 Mar 2006 01:12:25 -0000 1.6.2.1
@@ -111,7 +111,7 @@
long ber_version = -1;
int auth_response_requested = 0;
int pw_response_requested = 0;
- char *dn, *saslmech = NULL;
+ char *dn = NULL, *saslmech = NULL;
struct berval cred = {0};
Slapi_Backend *be = NULL;
unsigned long rc;
@@ -154,6 +154,7 @@
log_bind_access (pb, "???", method, version, saslmech, "decoding error");
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL,
"decoding error", 0, NULL );
+ slapi_ch_free_string(&dn);
return;
}
Index: compare.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/compare.c,v
retrieving revision 1.4
retrieving revision 1.4.2.1
diff -u -r1.4 -r1.4.2.1
--- compare.c 19 Apr 2005 22:07:36 -0000 1.4
+++ compare.c 2 Mar 2006 01:12:25 -0000 1.4.2.1
@@ -60,13 +60,13 @@
do_compare( Slapi_PBlock *pb )
{
BerElement *ber = pb->pb_op->o_ber;
- char *dn;
- struct ava ava;
+ char *dn = NULL;
+ struct ava ava = {0};
Slapi_Backend *be = NULL;
int err;
char ebuf[ BUFSIZ ];
Slapi_DN sdn;
- Slapi_Entry *referral;
+ Slapi_Entry *referral = NULL;
char errorbuf[BUFSIZ];
LDAPDebug( LDAP_DEBUG_TRACE, "do_compare\n", 0, 0, 0 );
@@ -74,6 +74,9 @@
/* count the compare request */
PR_AtomicIncrement(g_get_global_snmp_vars()->ops_tbl.dsCompareOps);
+ /* have to init this here so we can "done" it below if we short circuit */
+ slapi_sdn_init(&sdn);
+
/*
* Parse the compare request. It looks like this:
*
@@ -86,7 +89,6 @@
* }
*/
-
if ( ber_scanf( ber, "{a{ao}}", &dn, &ava.ava_type,
&ava.ava_value ) == LBER_ERROR ) {
LDAPDebug( LDAP_DEBUG_ANY,
@@ -94,7 +96,7 @@
0, 0, 0 );
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0,
NULL );
- return;
+ goto free_and_return;
}
/*
* in LDAPv3 there can be optional control extensions on
@@ -106,6 +108,7 @@
goto free_and_return;
}
slapi_sdn_init_dn_passin(&sdn,dn);
+ dn = NULL; /* do not free - sdn owns it now */
/* target spec is used to decide which plugins are applicable for the operation */
operation_set_target_spec (pb->pb_op, &sdn);
@@ -181,5 +184,6 @@
if (be)
slapi_be_Unlock(be);
slapi_sdn_done(&sdn);
+ slapi_ch_free_string(&dn);
ava_done( &ava );
}
Index: delete.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/delete.c,v
retrieving revision 1.4
retrieving revision 1.4.2.1
diff -u -r1.4 -r1.4.2.1
--- delete.c 19 Apr 2005 22:07:36 -0000 1.4
+++ delete.c 2 Mar 2006 01:12:25 -0000 1.4.2.1
@@ -66,7 +66,7 @@
{
Slapi_Operation *operation;
BerElement *ber;
- char *dn;
+ char *dn = NULL;
int err;
LDAPDebug( LDAP_DEBUG_TRACE, "do_delete\n", 0, 0, 0 );
@@ -89,7 +89,7 @@
op_shared_log_error_access (pb, "DEL", "???", "decoding error");
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0,
NULL );
- return;
+ goto free_and_return;
}
/*
Index: dn.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/dn.c,v
retrieving revision 1.6.2.1
retrieving revision 1.6.2.2
diff -u -r1.6.2.1 -r1.6.2.2
--- dn.c 20 Feb 2006 18:14:43 -0000 1.6.2.1
+++ dn.c 2 Mar 2006 01:12:25 -0000 1.6.2.2
@@ -593,8 +593,26 @@
return r;
}
-char*
-slapi_dn_parent( const char *dn )
+/*
+ * This function is used for speed. Instead of returning a newly allocated
+ * dn string that contains the parent, this function just returns a pointer
+ * to the address _within_ the given string where the parent dn of the
+ * given dn starts e.g. if you call this with "dc=example,dc=com", the
+ * function will return "dc=com" - that is, the char* returned will be the
+ * address of the 'd' after the ',' in "dc=example,dc=com". This function
+ * also checks for bogus things like consecutive ocurrances of unquoted
+ * separators e.g. DNs like cn=foo,,,,,,,,,,,cn=bar,,,,,,,
+ * This function is useful for "interating" over a DN returning the ancestors
+ * of the given dn e.g.
+ *
+ * const char *dn = somedn;
+ * while (dn = slapi_dn_find_parent(dn)) {
+ * see if parent exists
+ * etc.
+ * }
+ */
+const char*
+slapi_dn_find_parent( const char *dn )
{
const char *s;
int inquote;
@@ -621,14 +639,34 @@
} else {
if ( *s == '"' )
inquote = 1;
- else if ( DNSEPARATOR( *s ) )
- return( slapi_ch_strdup( s + 1 ) );
+ else {
+ if ( DNSEPARATOR( *s ) ) {
+ while ( *s && DNSEPARATOR( *s ) ) {
+ ++s;
+ }
+ if (*s) {
+ return( s );
+ }
+ }
+ }
}
}
return( NULL );
}
+char*
+slapi_dn_parent( const char *dn )
+{
+ const char *s = slapi_dn_find_parent(dn);
+
+ if ( s == NULL || *s == '\0' ) {
+ return( NULL );
+ }
+
+ return( slapi_ch_strdup( s ) );
+}
+
/*
* slapi_dn_issuffix - tells whether suffix is a suffix of dn. both dn
* and suffix must be normalized.
Index: filter.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/filter.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- filter.c 19 Apr 2005 22:07:36 -0000 1.5
+++ filter.c 2 Mar 2006 01:12:25 -0000 1.5.2.1
@@ -175,7 +175,7 @@
unsigned long len;
int err;
struct slapi_filter *f;
- char *ftmp, *type;
+ char *ftmp, *type = NULL;
LDAPDebug( LDAP_DEBUG_FILTER, "=> get_filter_internal\n", 0, 0, 0 );
@@ -293,6 +293,7 @@
case LDAP_FILTER_PRESENT:
LDAPDebug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
if ( ber_scanf( ber, "a", &type ) == LBER_ERROR ) {
+ slapi_ch_free_string(&type);
err = LDAP_PROTOCOL_ERROR;
} else {
err = LDAP_SUCCESS;
@@ -440,12 +441,13 @@
)
{
unsigned long tag, len, rc;
- char *val, *last, *type;
+ char *val, *last, *type = NULL;
char ebuf[BUFSIZ];
LDAPDebug( LDAP_DEBUG_FILTER, "=> get_substring_filter\n", 0, 0, 0 );
if ( ber_scanf( ber, "{a", &type ) == LBER_ERROR ) {
+ slapi_ch_free_string(&type);
return( LDAP_PROTOCOL_ERROR );
}
f->f_sub_type = slapi_attr_syntax_normalize( type );
@@ -460,8 +462,10 @@
tag != LBER_ERROR && tag != LBER_END_OF_SEQORSET;
tag = ber_next_element( ber, &len, last ) )
{
+ val = NULL;
rc = ber_scanf( ber, "a", &val );
if ( rc == LBER_ERROR ) {
+ slapi_ch_free_string(&val);
return( LDAP_PROTOCOL_ERROR );
}
if ( val == NULL || *val == '\0' ) {
@@ -573,8 +577,9 @@
}
}
{
- char* type;
+ char* type = NULL;
if (ber_scanf( ber, "a", &type ) == LBER_ERROR) {
+ slapi_ch_free_string (&type);
rc = LDAP_PROTOCOL_ERROR;
} else {
mrf->mrf_type = slapi_attr_syntax_normalize(type);
Index: modify.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/modify.c,v
retrieving revision 1.7
retrieving revision 1.7.2.1
diff -u -r1.7 -r1.7.2.1
--- modify.c 19 Apr 2005 22:07:36 -0000 1.7
+++ modify.c 2 Mar 2006 01:12:25 -0000 1.7.2.1
@@ -114,7 +114,7 @@
{
Slapi_Operation *operation;
BerElement *ber;
- char *last, *type;
+ char *last, *type = NULL;
unsigned long tag, len;
LDAPMod *mod;
LDAPMod **mods;
@@ -124,7 +124,7 @@
int ignored_some_mods = 0;
int has_password_mod = 0; /* number of password mods */
char *old_pw = NULL; /* remember the old password */
- char *dn;
+ char *dn = NULL;
LDAPDebug( LDAP_DEBUG_TRACE, "do_modify\n", 0, 0, 0 );
@@ -161,6 +161,7 @@
op_shared_log_error_access (pb, "MOD", "???", "decoding error");
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0,
NULL );
+ slapi_ch_free_string(&dn);
return;
}
}
@@ -186,7 +187,9 @@
op_shared_log_error_access (pb, "MOD", dn, "decoding error");
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL,
"decoding error", 0, NULL );
+ ber_bvecfree(mod->mod_bvalues);
slapi_ch_free((void **)&mod);
+ slapi_ch_free_string(&type);
goto free_and_return;
}
mod->mod_op = long_mod_op;
Index: modrdn.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/modrdn.c,v
retrieving revision 1.4
retrieving revision 1.4.2.1
diff -u -r1.4 -r1.4.2.1
--- modrdn.c 19 Apr 2005 22:07:36 -0000 1.4
+++ modrdn.c 2 Mar 2006 01:12:25 -0000 1.4.2.1
@@ -66,10 +66,10 @@
{
Slapi_Operation *operation;
BerElement *ber;
- char *dn, *newsuperior = NULL;
+ char *dn = NULL, *newsuperior = NULL;
char *newrdn = NULL;
- int err, deloldrdn;
- unsigned long len;
+ int err = 0, deloldrdn = 0;
+ unsigned long len = 0;
LDAPDebug( LDAP_DEBUG_TRACE, "do_modrdn\n", 0, 0, 0 );
@@ -99,7 +99,7 @@
send_ldap_result( pb, LDAP_PROTOCOL_ERROR, NULL,
"unable to decode DN, newRDN, or deleteOldRDN parameters",
0, NULL );
- return;
+ goto free_and_return;
}
if ( ber_peek_tag( ber, &len ) == LDAP_TAG_NEWSUPERIOR ) {
Index: passwd_extop.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/passwd_extop.c,v
retrieving revision 1.6
retrieving revision 1.6.2.1
diff -u -r1.6 -r1.6.2.1
--- passwd_extop.c 19 Apr 2005 22:07:36 -0000 1.6
+++ passwd_extop.c 2 Mar 2006 01:12:25 -0000 1.6.2.1
@@ -201,6 +201,7 @@
{
char *oid = NULL;
char *bindDN = NULL;
+ char *authmethod = NULL;
char *dn = NULL;
char *oldPasswd = NULL;
char *newPasswd = NULL;
@@ -297,6 +298,7 @@
{
if ( ber_scanf( ber, "a", &dn) == LBER_ERROR )
{
+ slapi_ch_free_string(&dn);
LDAPDebug( LDAP_DEBUG_ANY,
"ber_scanf failed :{\n", 0, 0, 0 );
errMesg = "ber_scanf failed at userID parse.\n";
@@ -313,6 +315,7 @@
{
if ( ber_scanf( ber, "a", &oldPasswd ) == LBER_ERROR )
{
+ slapi_ch_free_string(&oldPasswd);
LDAPDebug( LDAP_DEBUG_ANY,
"ber_scanf failed :{\n", 0, 0, 0 );
errMesg = "ber_scanf failed at oldPasswd parse.\n";
@@ -331,6 +334,7 @@
{
if ( ber_scanf( ber, "a", &newPasswd ) == LBER_ERROR )
{
+ slapi_ch_free_string(&newPasswd);
LDAPDebug( LDAP_DEBUG_ANY,
"ber_scanf failed :{\n", 0, 0, 0 );
errMesg = "ber_scanf failed at newPasswd parse.\n";
@@ -379,7 +383,7 @@
/* Did they give us a DN ? */
if (dn == NULL || *dn == '\0') {
/* Get the DN from the bind identity on this connection */
- dn = bindDN;
+ dn = slapi_ch_strdup(bindDN);
LDAPDebug( LDAP_DEBUG_ANY,
"Missing userIdentity in request, using the bind DN instead.\n",
0, 0, 0 );
@@ -455,7 +459,17 @@
/* Free anything that we allocated above */
free_and_return:
-
+
+ slapi_ch_free_string(&oldPasswd);
+ slapi_ch_free_string(&newPasswd);
+ /* Either this is the same pointer that we allocated and set above,
+ or whoever used it should have freed it and allocated a new
+ value that we need to free here */
+ slapi_pblock_get( pb, SLAPI_ORIGINAL_TARGET, &dn );
+ slapi_ch_free_string(&dn);
+ slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, NULL );
+ slapi_ch_free_string(&authmethod);
+
if ( targetEntry != NULL ){
slapi_entry_free (targetEntry);
}
@@ -467,7 +481,7 @@
slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop",
- errMesg );
+ errMesg ? errMesg : "success" );
send_ldap_result( pb, rc, NULL, errMesg, 0, NULL );
Index: slapi-plugin.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slapi-plugin.h,v
retrieving revision 1.8
retrieving revision 1.8.2.1
diff -u -r1.8 -r1.8.2.1
--- slapi-plugin.h 19 Apr 2005 22:07:37 -0000 1.8
+++ slapi-plugin.h 2 Mar 2006 01:12:25 -0000 1.8.2.1
@@ -362,6 +362,7 @@
char *slapi_dn_ignore_case( char *dn );
char *slapi_dn_normalize_case( char *dn );
char *slapi_dn_beparent( Slapi_PBlock *pb, const char *dn );
+const char *slapi_dn_find_parent( const char *dn );
char *slapi_dn_parent( const char *dn );
int slapi_dn_issuffix( const char *dn, const char *suffix );
int slapi_dn_isparent( const char *parentdn, const char *childdn );
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/views views.c, 1.5.2.1, 1.5.2.2
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/views
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11336/ldap/servers/plugins/views
Modified Files:
Tag: Directory71RtmBranch
views.c
Log Message:
[159328] Tracking bug for Directory Server 7.1 Service Packs; Comment #50
ported internal diffs to the external CVS
Index: views.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/views/views.c,v
retrieving revision 1.5.2.1
retrieving revision 1.5.2.2
diff -u -r1.5.2.1 -r1.5.2.2
--- views.c 25 Aug 2005 22:38:40 -0000 1.5.2.1
+++ views.c 2 Mar 2006 01:12:04 -0000 1.5.2.2
@@ -735,6 +735,7 @@
Slapi_Filter *pCurrentFilter = 0;
Slapi_Filter *pBuiltFilter = 0;
Slapi_Filter *pViewEntryExcludeFilter = 0;
+ char *excludeFilter;
if(pView->includeAncestorFiltersFilter)
{
@@ -769,7 +770,11 @@
}
/* filter for removing view entries from search */
- pViewEntryExcludeFilter = slapi_str2filter( "(!(objectclass=" VIEW_OBJECTCLASS "))" );
+ /* richm - slapi_str2filter _writes_ to it's argument, so we have to pass in
+ some writeable memory, or core dump, do not pass go */
+ excludeFilter = slapi_ch_strdup("(!(objectclass=" VIEW_OBJECTCLASS "))");
+ pViewEntryExcludeFilter = slapi_str2filter( excludeFilter );
+ slapi_ch_free_string(&excludeFilter);
if(pBuiltFilter)
pView->includeAncestorFiltersFilter = slapi_filter_join_ex( LDAP_FILTER_AND, pBuiltFilter, pViewEntryExcludeFilter, 0 );
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/replication repl5_total.c, 1.5, 1.5.2.1 repl_controls.c, 1.5, 1.5.2.1 repl_extop.c, 1.7, 1.7.2.1 windows_protocol_util.c, 1.20.2.3, 1.20.2.4
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/replication
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11336/ldap/servers/plugins/replication
Modified Files:
Tag: Directory71RtmBranch
repl5_total.c repl_controls.c repl_extop.c
windows_protocol_util.c
Log Message:
[159328] Tracking bug for Directory Server 7.1 Service Packs; Comment #50
ported internal diffs to the external CVS
Index: repl5_total.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl5_total.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- repl5_total.c 19 Apr 2005 22:07:32 -0000 1.5
+++ repl5_total.c 2 Mar 2006 01:11:55 -0000 1.5.2.1
@@ -585,7 +585,7 @@
char *lasti;
unsigned long len;
unsigned long tag;
- char *str;
+ char *str = NULL;
int rc;
Slapi_Value *value;
@@ -685,6 +685,9 @@
if (value)
slapi_value_free (&value);
+ slapi_ch_free_string(&attrtype);
+ slapi_ch_free_string(&str);
+
return -1;
}
Index: repl_controls.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl_controls.c,v
retrieving revision 1.5
retrieving revision 1.5.2.1
diff -u -r1.5 -r1.5.2.1
--- repl_controls.c 19 Apr 2005 22:07:32 -0000 1.5
+++ repl_controls.c 2 Mar 2006 01:11:55 -0000 1.5.2.1
@@ -349,15 +349,15 @@
emtag != LBER_ERROR && emtag != LBER_END_OF_SEQORSET;
emtag = ber_next_element( ember, &emlen, emlast ))
{
- struct berval **embvals;
- if ( ber_scanf( ember, "{i{a[V]}}", &op, &type, &embvals ) == LBER_ERROR )
+ struct berval **embvals = NULL;
+ type = NULL;
+ if ( ber_scanf( ember, "{i{a[V]}}", &op, &type, &embvals ) != LBER_ERROR )
{
- continue;
+ slapi_mods_add_modbvps( smods, op, type, embvals);
/* GGOODREPL I suspect this will cause two sets of lastmods attr values
to end up in the entry. We need to remove the old ones.
*/
}
- slapi_mods_add_modbvps( smods, op, type, embvals);
free( type );
ber_bvecfree( embvals );
}
Index: repl_extop.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl_extop.c,v
retrieving revision 1.7
retrieving revision 1.7.2.1
diff -u -r1.7 -r1.7.2.1
--- repl_extop.c 19 Apr 2005 22:07:32 -0000 1.7
+++ repl_extop.c 2 Mar 2006 01:11:55 -0000 1.7.2.1
@@ -384,7 +384,8 @@
/* slapi_ch_free accepts NULL pointer */
slapi_ch_free ((void**)protocol_oid);
slapi_ch_free ((void**)repl_root);
- slapi_ch_free ((void **)extra_referrals);
+ slapi_ch_array_free (*extra_referrals);
+ *extra_referrals = NULL;
slapi_ch_free ((void**)csnstr);
if (*supplier_ruv)
Index: windows_protocol_util.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/windows_protocol_util.c,v
retrieving revision 1.20.2.3
retrieving revision 1.20.2.4
diff -u -r1.20.2.3 -r1.20.2.4
--- windows_protocol_util.c 20 Feb 2006 19:50:29 -0000 1.20.2.3
+++ windows_protocol_util.c 2 Mar 2006 01:11:55 -0000 1.20.2.4
@@ -1570,11 +1570,12 @@
{
int retval = 0;
- char *string_deleted = "(isdeleted=*)";
+ char *string_deleted = slapi_ch_strdup("(isdeleted=*)");
/* DBDB: we should allocate these filters once and keep them around for better performance */
Slapi_Filter *filter_deleted = slapi_str2filter( string_deleted );
+ slapi_ch_free_string(&string_deleted);
/* DBDB: this should be one filter, the code originally tested separately and hasn't been fixed yet */
if ( (slapi_filter_test_simple( e, filter_deleted ) == 0) )
{
@@ -2251,9 +2252,10 @@
/* Next test for the correct kind of entry */
if (local_entry) {
/* DBDB: we should allocate these filters once and keep them around for better performance */
- char *string_filter = "(&(|(objectclass=ntuser)(objectclass=ntgroup))(ntUserDomainId=*))";
+ char *string_filter = slapi_ch_strdup("(&(|(objectclass=ntuser)(objectclass=ntgroup))(ntUserDomainId=*))");
Slapi_Filter *filter = slapi_str2filter( string_filter );
+ slapi_ch_free_string(&string_filter);
if (slapi_filter_test_simple( (Slapi_Entry*)local_entry, filter ) == 0)
{
retval = 1;
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] adminutil component_versions.mk, 1.3, 1.4 components.mk, 1.3, 1.4 internal_comp_deps.mk, 1.3, 1.4
by Doctor Conrad
Author: nhosoi
Update of /cvs/dirsec/adminutil
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6515
Modified Files:
component_versions.mk components.mk internal_comp_deps.mk
Log Message:
upgraded LDAP C SDK: v5.16 -> v5.17
Index: component_versions.mk
===================================================================
RCS file: /cvs/dirsec/adminutil/component_versions.mk,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- component_versions.mk 22 Feb 2006 21:45:17 -0000 1.3
+++ component_versions.mk 1 Mar 2006 23:44:01 -0000 1.4
@@ -44,7 +44,7 @@
# LDAP SDK
ifndef LDAP_RELDATE
- LDAP_RELDATE = v5.16
+ LDAP_RELDATE = v5.17
endif
ifndef LDAPCOMP_DIR
LDAPCOMP_DIR=ldapsdk50
Index: components.mk
===================================================================
RCS file: /cvs/dirsec/adminutil/components.mk,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- components.mk 22 Feb 2006 21:45:17 -0000 1.3
+++ components.mk 1 Mar 2006 23:44:01 -0000 1.4
@@ -124,7 +124,7 @@
else
LDAPSDK_LIBPATH = $(LDAP_ROOT)/lib
LDAPSDK_INCDIR = $(LDAP_ROOT)/include
- LDAPSDK_BINPATH = $(LDAP_ROOT)/tools
+ LDAPSDK_BINPATH = $(LDAP_ROOT)/bin
endif
LDAPSDK_INCLUDE = -I$(LDAPSDK_INCDIR)
Index: internal_comp_deps.mk
===================================================================
RCS file: /cvs/dirsec/adminutil/internal_comp_deps.mk,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- internal_comp_deps.mk 22 Feb 2006 21:45:17 -0000 1.3
+++ internal_comp_deps.mk 1 Mar 2006 23:44:01 -0000 1.4
@@ -117,7 +117,7 @@
mkdir -p $(LDAP_LIBPATH)
$(FTP_PULL) -method $(LDAPSDK_PULL_METHOD) \
-objdir $(LDAP_ROOT) -componentdir $(LDAP_RELEASE) \
- -files include,$(LDAPSDK_PULL_LIBS),tools
+ -files include,$(LDAPSDK_PULL_LIBS),bin
endif
-@if [ ! -f $@ ] ; \
then echo "Error: could not get component LDAPSDK file $@" ; \
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] dsbuild/ds/mod_admserv checksums, 1.3, 1.4
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/dsbuild/ds/mod_admserv
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv27398/ds/mod_admserv
Modified Files:
checksums
Log Message:
updated checksums
Index: checksums
===================================================================
RCS file: /cvs/dirsec/dsbuild/ds/mod_admserv/checksums,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- checksums 24 Feb 2006 17:23:49 -0000 1.3
+++ checksums 1 Mar 2006 18:54:19 -0000 1.4
@@ -1 +1 @@
-55b569f178f1dbbe1ca5a5eec6f05470 download/mod_admserv-1.0.2.tar.gz
+0390005e25b172868c574c76af59fafa download/mod_admserv-1.0.2.tar.gz
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] dsbuild/ds/ldapserver checksums,1.5,1.6
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/dsbuild/ds/ldapserver
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv27398/ds/ldapserver
Modified Files:
checksums
Log Message:
updated checksums
Index: checksums
===================================================================
RCS file: /cvs/dirsec/dsbuild/ds/ldapserver/checksums,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- checksums 25 Feb 2006 03:27:39 -0000 1.5
+++ checksums 1 Mar 2006 18:54:14 -0000 1.6
@@ -1 +1 @@
-3ccdf3f3613bd8cb547a9b088fe3d3d9 download/fedora-ds-1.0.2.tar.gz
+d8bd5b68087229b4bb2e3867cb92ba85 download/fedora-ds-1.0.2.tar.gz
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] dsbuild/ds/adminserver checksums, 1.5, 1.6
by Doctor Conrad
Author: rmeggins
Update of /cvs/dirsec/dsbuild/ds/adminserver
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv27398/ds/adminserver
Modified Files:
checksums
Log Message:
updated checksums
Index: checksums
===================================================================
RCS file: /cvs/dirsec/dsbuild/ds/adminserver/checksums,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- checksums 28 Feb 2006 23:26:30 -0000 1.5
+++ checksums 1 Mar 2006 18:54:08 -0000 1.6
@@ -1 +1 @@
-3dddb676c33a2580ff459d158a321e40 download/fedora-adminserver-1.0.2.tar.gz
+ab7b4809b135e28f114c8367264e9394 download/fedora-adminserver-1.0.2.tar.gz
18 years, 1 month
- 1
- 0
[Fedora-directory-commits] mod_admserv mod_admserv.c,1.20,1.21
by Doctor Conrad
Author: nkinder
Update of /cvs/dirsec/mod_admserv
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv27172
Modified Files:
mod_admserv.c
Log Message:
Updated the module hook registration order to deal with the proper Apache 2.2 module name (mod_auth_basic)
Index: mod_admserv.c
===================================================================
RCS file: /cvs/dirsec/mod_admserv/mod_admserv.c,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- mod_admserv.c 24 Feb 2006 16:19:23 -0000 1.20
+++ mod_admserv.c 1 Mar 2006 18:43:51 -0000 1.21
@@ -2680,7 +2680,13 @@
static void register_hooks(apr_pool_t *p)
{
/* Do basic auth after our own auth */
+#ifdef AP_SERVER_MAJORVERSION_NUMBER
+ /* Apache 2.2+ */
+ static const char * const aszPost[] = { "mod_auth_basic.c", NULL };
+#else
+ /* Apache 2.0 and earlier uses a different module name than 2.2+ */
static const char * const aszPost[] = { "mod_auth.c", NULL };
+#endif
/* Make sure mod_nss has been configured before us */
static const char * const aszPre[] = { "mod_nss.c", NULL };
18 years, 1 month
- 1
- 0