389-commits April 2010

389-commits@lists.fedoraproject.org

5 participants
71 discussions

Branch 'Directory_Server_8_2_Branch' - ldap/servers
by Nathan Kinder 09 Apr '10

09 Apr '10

ldap/servers/slapd/mapping_tree.c | 42 ++++++++++++++++++++++++++++++ ldap/servers/slapd/passwd_extop.c | 52 +++++++++++++++++++++++++++----------- ldap/servers/slapd/slapi-plugin.h | 13 +++++++++ 3 files changed, 92 insertions(+), 15 deletions(-) New commits: commit 92ca2bbfa7a3462b9e4317b0fdb6828f60612021 Author: Nathan Kinder <nkinder(a)redhat.com> Date: Thu Apr 8 15:55:29 2010 -0700 Bug 578863 - Password modify extop needs to send referrals on replicas The password modify extended operation was modifying the local database on a read-only replica instead of returning a referral. The server is designed to let the plugin ID used for updating password retry info make local updates instead of returning a referral. This plugin ID was being used by the password extop code, which it should not be doing. The second issue is that we need to check if a referral needs to be sent as early as possible when processing the extop request. We don't want to reject the change if an entry does not exist before checking if a referral is necessary since the server we refer to may have the target entry present. This required adding a new helper function that allows one to see if a write operation to a particular DN would require a referral to be sent. The password modify extop code leverages this new function to get the referrals and return them to the client if necessary. diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c index 479909a..e9d5c3f 100644 --- a/ldap/servers/slapd/mapping_tree.c +++ b/ldap/servers/slapd/mapping_tree.c @@ -1925,6 +1925,48 @@ static int sdn_is_nulldn(const Slapi_DN *sdn){ return 0; } +/* Checks if a write operation for a particular DN would + * require a referral to be sent. */ +int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral) +{ + mapping_tree_node *target_node = NULL; + int ret = 0; + + if(mapping_tree_freed){ + /* shutdown detected */ + goto done; + } + + if(!mapping_tree_inited) { + mapping_tree_init(); + } + + if (target_sdn) { + mtn_lock(); + + /* Get the mapping tree node that is the best match for the target dn. */ + target_node = slapi_get_mapping_tree_node_by_dn(target_sdn); + if (target_node == NULL) { + target_node = mapping_tree_root; + } + + /* See if we need to return a referral. */ + if ((target_node->mtn_state == MTN_REFERRAL) || + (target_node->mtn_state == MTN_REFERRAL_ON_UPDATE)) { + *referral = (target_node->mtn_referral_entry ? + slapi_entry_dup(target_node->mtn_referral_entry) : + NULL); + if (*referral) { + ret = 1; + } + } + + mtn_unlock(); + } + + done: + return ret; +} /* * Description: * The reason we have a mapping tree. This function selects a backend or diff --git a/ldap/servers/slapd/passwd_extop.c b/ldap/servers/slapd/passwd_extop.c index b5f30e0..14341f9 100644 --- a/ldap/servers/slapd/passwd_extop.c +++ b/ldap/servers/slapd/passwd_extop.c @@ -167,7 +167,7 @@ static int passwd_apply_mods(Slapi_PBlock *pb_orig, const char *dn, Slapi_Mods * slapi_modify_internal_set_pb (&pb, dn, slapi_mods_get_ldapmods_byref(mods), req_controls_copy, NULL, /* UniqueID */ - pw_get_componentID(), /* PluginID */ + plugin_get_default_component_id(), /* PluginID */ 0); /* Flags */ /* We copy the connection from the original pblock into the @@ -472,6 +472,8 @@ passwd_modify_extop( Slapi_PBlock *pb ) LDAPControl **req_controls = NULL; LDAPControl **resp_controls = NULL; passwdPolicy *pwpolicy = NULL; + Slapi_DN *target_sdn = NULL; + Slapi_Entry *referrals = NULL; /* Slapi_DN sdn; */ LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_modify_extop\n", 0, 0, 0 ); @@ -607,19 +609,33 @@ parse_req_done: /* LDAPDebug( LDAP_DEBUG_ARGS, "passwd: dn (%s), oldPasswd (%s) ,newPasswd (%s)\n", dn, oldPasswd, newPasswd); */ - - /* Get Bind DN */ - slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN ); + /* Get Bind DN */ + slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN ); + + /* Find and set the target DN. */ + if (dn && *dn != '\0') { + target_sdn = slapi_sdn_new_dn_byref(dn); + slapi_pblock_set(pb, SLAPI_TARGET_DN, dn); + } else if (bindDN && *bindDN != '\0') { + target_sdn = slapi_sdn_new_dn_byref(bindDN); + slapi_pblock_set(pb, SLAPI_TARGET_DN, bindDN); + } - /* If the connection is bound anonymously, we must refuse to process this operation. */ - if (bindDN == NULL || *bindDN == '\0') { + /* Check if we need to send any referrals. */ + if (slapi_dn_write_needs_referral(target_sdn, &referrals)) { + rc = LDAP_REFERRAL; + goto free_and_return; + } + + /* If the connection is bound anonymously, we must refuse to process this operation. */ + if (bindDN == NULL || *bindDN == '\0') { /* Refuse the operation because they're bound anonymously */ errMesg = "Anonymous Binds are not allowed.\n"; rc = LDAP_INSUFFICIENT_ACCESS; goto free_and_return; - } + } - if (oldPasswd == NULL || *oldPasswd == '\0') { + if (oldPasswd == NULL || *oldPasswd == '\0') { /* If user is authenticated, they already gave their password during * the bind operation (or used sasl or client cert auth or OS creds) */ slapi_pblock_get(pb, SLAPI_CONN_AUTHMETHOD, &authmethod); @@ -628,7 +644,7 @@ parse_req_done: rc = LDAP_INSUFFICIENT_ACCESS; goto free_and_return; } - } + } /* Fetch the password policy. We need this in case we need to * generate a password as well as for some policy checks. */ @@ -694,7 +710,7 @@ parse_req_done: "Missing userIdentity in request, using the bind DN instead.\n", 0, 0, 0 ); } - + slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, dn ); /* Now we have the DN, look for the entry */ @@ -807,6 +823,16 @@ parse_req_done: /* Free anything that we allocated above */ free_and_return: + slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", + errMesg ? errMesg : "success" ); + + if ((rc == LDAP_REFERRAL) && (referrals)) { + send_referrals_from_entry(pb, referrals); + } else { + send_ldap_result( pb, rc, NULL, errMesg, 0, NULL ); + } + + slapi_sdn_free(&target_sdn); slapi_ch_free_string(&bindDN); /* slapi_pblock_get SLAPI_CONN_DN does strdup */ slapi_ch_free_string(&oldPasswd); slapi_ch_free_string(&newPasswd); @@ -821,6 +847,7 @@ free_and_return: slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, NULL ); slapi_ch_free_string(&authmethod); delete_passwdPolicy(&pwpolicy); + slapi_entry_free(referrals); if ( targetEntry != NULL ){ slapi_entry_free (targetEntry); @@ -831,11 +858,6 @@ free_and_return: ber = NULL; } - slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", - errMesg ? errMesg : "success" ); - send_ldap_result( pb, rc, NULL, errMesg, 0, NULL ); - - /* We can free the generated password bval now */ ber_bvfree(gen_passwd); diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 2640ed1..883e966 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -2918,6 +2918,19 @@ int slapi_dn_isroot( const char *dn ); int slapi_dn_isbesuffix( Slapi_PBlock *pb, const char *dn ); /** + * Checks if writes to a particular DN need to send a referral. + * + * \param target_sdn The target DN that you want to check. + * \param referral The address of a pointer to receive a referral + * if one is needed. + * \return \c 1 if a referral needs to be sent. + * \return \c 0 if no referral is needed. + * \warning The referral entry must be freed when it is no longer + * being used. + */ +int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral); + +/** * Converts the second RDN type value to the berval value. * * Returns the new RDN value as a berval value in \c bv. This function

1 0

ldap/servers
by Nathan Kinder 09 Apr '10

09 Apr '10

ldap/servers/slapd/mapping_tree.c | 42 ++++++++++++++++++++++++++++++ ldap/servers/slapd/passwd_extop.c | 52 +++++++++++++++++++++++++++----------- ldap/servers/slapd/slapi-plugin.h | 13 +++++++++ 3 files changed, 92 insertions(+), 15 deletions(-) New commits: commit c53b8b31c8655d8b387c4b213caee885778c3872 Author: Nathan Kinder <nkinder(a)redhat.com> Date: Thu Apr 8 15:55:29 2010 -0700 Bug 578863 - Password modify extop needs to send referrals on replicas The password modify extended operation was modifying the local database on a read-only replica instead of returning a referral. The server is designed to let the plugin ID used for updating password retry info make local updates instead of returning a referral. This plugin ID was being used by the password extop code, which it should not be doing. The second issue is that we need to check if a referral needs to be sent as early as possible when processing the extop request. We don't want to reject the change if an entry does not exist before checking if a referral is necessary since the server we refer to may have the target entry present. This required adding a new helper function that allows one to see if a write operation to a particular DN would require a referral to be sent. The password modify extop code leverages this new function to get the referrals and return them to the client if necessary. diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c index 8b4c541..645618c 100644 --- a/ldap/servers/slapd/mapping_tree.c +++ b/ldap/servers/slapd/mapping_tree.c @@ -1925,6 +1925,48 @@ static int sdn_is_nulldn(const Slapi_DN *sdn){ return 0; } +/* Checks if a write operation for a particular DN would + * require a referral to be sent. */ +int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral) +{ + mapping_tree_node *target_node = NULL; + int ret = 0; + + if(mapping_tree_freed){ + /* shutdown detected */ + goto done; + } + + if(!mapping_tree_inited) { + mapping_tree_init(); + } + + if (target_sdn) { + mtn_lock(); + + /* Get the mapping tree node that is the best match for the target dn. */ + target_node = slapi_get_mapping_tree_node_by_dn(target_sdn); + if (target_node == NULL) { + target_node = mapping_tree_root; + } + + /* See if we need to return a referral. */ + if ((target_node->mtn_state == MTN_REFERRAL) || + (target_node->mtn_state == MTN_REFERRAL_ON_UPDATE)) { + *referral = (target_node->mtn_referral_entry ? + slapi_entry_dup(target_node->mtn_referral_entry) : + NULL); + if (*referral) { + ret = 1; + } + } + + mtn_unlock(); + } + + done: + return ret; +} /* * Description: * The reason we have a mapping tree. This function selects a backend or diff --git a/ldap/servers/slapd/passwd_extop.c b/ldap/servers/slapd/passwd_extop.c index b5f30e0..14341f9 100644 --- a/ldap/servers/slapd/passwd_extop.c +++ b/ldap/servers/slapd/passwd_extop.c @@ -167,7 +167,7 @@ static int passwd_apply_mods(Slapi_PBlock *pb_orig, const char *dn, Slapi_Mods * slapi_modify_internal_set_pb (&pb, dn, slapi_mods_get_ldapmods_byref(mods), req_controls_copy, NULL, /* UniqueID */ - pw_get_componentID(), /* PluginID */ + plugin_get_default_component_id(), /* PluginID */ 0); /* Flags */ /* We copy the connection from the original pblock into the @@ -472,6 +472,8 @@ passwd_modify_extop( Slapi_PBlock *pb ) LDAPControl **req_controls = NULL; LDAPControl **resp_controls = NULL; passwdPolicy *pwpolicy = NULL; + Slapi_DN *target_sdn = NULL; + Slapi_Entry *referrals = NULL; /* Slapi_DN sdn; */ LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_modify_extop\n", 0, 0, 0 ); @@ -607,19 +609,33 @@ parse_req_done: /* LDAPDebug( LDAP_DEBUG_ARGS, "passwd: dn (%s), oldPasswd (%s) ,newPasswd (%s)\n", dn, oldPasswd, newPasswd); */ - - /* Get Bind DN */ - slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN ); + /* Get Bind DN */ + slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN ); + + /* Find and set the target DN. */ + if (dn && *dn != '\0') { + target_sdn = slapi_sdn_new_dn_byref(dn); + slapi_pblock_set(pb, SLAPI_TARGET_DN, dn); + } else if (bindDN && *bindDN != '\0') { + target_sdn = slapi_sdn_new_dn_byref(bindDN); + slapi_pblock_set(pb, SLAPI_TARGET_DN, bindDN); + } - /* If the connection is bound anonymously, we must refuse to process this operation. */ - if (bindDN == NULL || *bindDN == '\0') { + /* Check if we need to send any referrals. */ + if (slapi_dn_write_needs_referral(target_sdn, &referrals)) { + rc = LDAP_REFERRAL; + goto free_and_return; + } + + /* If the connection is bound anonymously, we must refuse to process this operation. */ + if (bindDN == NULL || *bindDN == '\0') { /* Refuse the operation because they're bound anonymously */ errMesg = "Anonymous Binds are not allowed.\n"; rc = LDAP_INSUFFICIENT_ACCESS; goto free_and_return; - } + } - if (oldPasswd == NULL || *oldPasswd == '\0') { + if (oldPasswd == NULL || *oldPasswd == '\0') { /* If user is authenticated, they already gave their password during * the bind operation (or used sasl or client cert auth or OS creds) */ slapi_pblock_get(pb, SLAPI_CONN_AUTHMETHOD, &authmethod); @@ -628,7 +644,7 @@ parse_req_done: rc = LDAP_INSUFFICIENT_ACCESS; goto free_and_return; } - } + } /* Fetch the password policy. We need this in case we need to * generate a password as well as for some policy checks. */ @@ -694,7 +710,7 @@ parse_req_done: "Missing userIdentity in request, using the bind DN instead.\n", 0, 0, 0 ); } - + slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, dn ); /* Now we have the DN, look for the entry */ @@ -807,6 +823,16 @@ parse_req_done: /* Free anything that we allocated above */ free_and_return: + slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", + errMesg ? errMesg : "success" ); + + if ((rc == LDAP_REFERRAL) && (referrals)) { + send_referrals_from_entry(pb, referrals); + } else { + send_ldap_result( pb, rc, NULL, errMesg, 0, NULL ); + } + + slapi_sdn_free(&target_sdn); slapi_ch_free_string(&bindDN); /* slapi_pblock_get SLAPI_CONN_DN does strdup */ slapi_ch_free_string(&oldPasswd); slapi_ch_free_string(&newPasswd); @@ -821,6 +847,7 @@ free_and_return: slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, NULL ); slapi_ch_free_string(&authmethod); delete_passwdPolicy(&pwpolicy); + slapi_entry_free(referrals); if ( targetEntry != NULL ){ slapi_entry_free (targetEntry); @@ -831,11 +858,6 @@ free_and_return: ber = NULL; } - slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop", - errMesg ? errMesg : "success" ); - send_ldap_result( pb, rc, NULL, errMesg, 0, NULL ); - - /* We can free the generated password bval now */ ber_bvfree(gen_passwd); diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index 9229ea7..f7683b5 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -3140,6 +3140,19 @@ int slapi_dn_isroot( const char *dn ); int slapi_dn_isbesuffix( Slapi_PBlock *pb, const char *dn ); /** + * Checks if writes to a particular DN need to send a referral. + * + * \param target_sdn The target DN that you want to check. + * \param referral The address of a pointer to receive a referral + * if one is needed. + * \return \c 1 if a referral needs to be sent. + * \return \c 0 if no referral is needed. + * \warning The referral entry must be freed when it is no longer + * being used. + */ +int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral); + +/** * Converts the second RDN type value to the berval value. * * Returns the new RDN value as a berval value in \c bv. This function

1 0

esc/mac/coolkey_package_data/Resources Welcome, 1.1, 1.2
by Jack Magne 07 Apr '10

07 Apr '10

Author: jmagne Update of /cvs/dirsec/esc/mac/coolkey_package_data/Resources In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv31286 Added Files: Welcome Log Message: Replace missing Welcome text file for the installer. Index: Welcome =================================================================== RCS file: Welcome diff -N Welcome --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ Welcome 7 Apr 2010 18:45:06 -0000 1.2 @@ -0,0 +1,13 @@ +Please remove all smart cards from the computer before proceeding. + +After successfully installing this package, this computer can be used to manage and use smart cards for common cryptographic operations such as secure mail and secure web site access.. + + +The following Smart Card related components will be installed: + +1. The Smart Card Manager application (ESC), used to manage smart cards. + +2. The CoolKey PKCS#11 driver, used to recognize CoolKey smart cards. + +3. The CoolKey Smart CArd "Tokend" driver, used by Apple Mail and Safari to recognize CoolKey smart cards. +

1 0

esc/mac/coolkey_package_data/Resources Welcome, NONE, 1.1.2.1
by Jack Magne 07 Apr '10

07 Apr '10

Author: jmagne Update of /cvs/dirsec/esc/mac/coolkey_package_data/Resources In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv31170 Added Files: Tag: PKI_8_0_RTM_BRANCH Welcome Log Message: Replace missing Welcome text file for the installer. --- NEW FILE Welcome --- Please remove all smart cards from the computer before proceeding. After successfully installing this package, this computer can be used to manage and use smart cards for common cryptographic operations such as secure mail and secure web site access.. The following Smart Card related components will be installed: 1. The Smart Card Manager application (ESC), used to manage smart cards. 2. The CoolKey PKCS#11 driver, used to recognize CoolKey smart cards. 3. The CoolKey Smart CArd "Tokend" driver, used by Apple Mail and Safari to recognize CoolKey smart cards.

1 0

ldap/servers
by Richard Allen Megginson 07 Apr '10

07 Apr '10

ldap/servers/plugins/syntaxes/string.c | 6 +++--- ldap/servers/slapd/filterentry.c | 6 +++++- ldap/servers/slapd/proto-slap.h | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) New commits: commit b433e4c852a2ef78558dffc1ccbaf464c1186934 Author: Rich Megginson <rmeggins(a)redhat.com> Date: Wed Apr 7 10:16:22 2010 -0600 Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements. https://bugzilla.redhat.com/show_bug.cgi?id=572162 Resolves: bug 572162 Bug Description: the string "|*" within a search filter on a non-indexed attribute returns all elements. Reviewed by: nhosoi (Thanks!) Branch: HEAD Fix Description: PCRE interprets the '|' character as the start of alternative branch. In the search filter, the other side of the '|' is empty, which means match everything. The solution is to escape this and other PCRE special chars before matching. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no diff --git a/ldap/servers/plugins/syntaxes/string.c b/ldap/servers/plugins/syntaxes/string.c index dd44a80..9b33833 100644 --- a/ldap/servers/plugins/syntaxes/string.c +++ b/ldap/servers/plugins/syntaxes/string.c @@ -262,7 +262,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final, if ( initial != NULL ) { value_normalize( initial, syntax, 1 /* trim leading blanks */ ); *p++ = '^'; - filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_PARENS ); + filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_RECHARS ); p = strchr( p, '\0' ); } if ( any != NULL ) { @@ -271,7 +271,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final, /* ".*" + value */ *p++ = '.'; *p++ = '*'; - filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_PARENS ); + filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_RECHARS ); p = strchr( p, '\0' ); } } @@ -280,7 +280,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final, /* ".*" + value */ *p++ = '.'; *p++ = '*'; - filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_PARENS ); + filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_RECHARS ); strcat( p, "$" ); } diff --git a/ldap/servers/slapd/filterentry.c b/ldap/servers/slapd/filterentry.c index f163b47..fad7362 100644 --- a/ldap/servers/slapd/filterentry.c +++ b/ldap/servers/slapd/filterentry.c @@ -663,7 +663,11 @@ filter_strcpy_special_ext( char *d, char *s, int flags ) break; case '(': case ')': - if (flags & FILTER_STRCPY_ESCAPE_PARENS) { + case '}': + case '{': + case '|': + case '?': + if (flags & FILTER_STRCPY_ESCAPE_RECHARS) { *d++ = '\\'; } break; diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index e67cfae..68d5d48 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -595,7 +595,7 @@ void set_hash_filters(int i); * filterentry.c */ void filter_strcpy_special( char *d, char *s ); -#define FILTER_STRCPY_ESCAPE_PARENS 0x01 +#define FILTER_STRCPY_ESCAPE_RECHARS 0x01 void filter_strcpy_special_ext( char *d, char *s, int flags );

1 0

Branch 'Directory_Server_8_2_Branch' - ldap/servers
by Richard Allen Megginson 07 Apr '10

07 Apr '10

ldap/servers/plugins/syntaxes/string.c | 6 +++--- ldap/servers/slapd/filterentry.c | 6 +++++- ldap/servers/slapd/proto-slap.h | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) New commits: commit 7b29561a0614032f12bd7151841f5150da9d4cb0 Author: Rich Megginson <rmeggins(a)redhat.com> Date: Wed Apr 7 10:16:22 2010 -0600 Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements. https://bugzilla.redhat.com/show_bug.cgi?id=572162 Resolves: bug 572162 Bug Description: the string "|*" within a search filter on a non-indexed attribute returns all elements. Reviewed by: nhosoi (Thanks!) Branch: Directory_Server_8_2_Branch Fix Description: PCRE interprets the '|' character as the start of alternative branch. In the search filter, the other side of the '|' is empty, which means match everything. The solution is to escape this and other PCRE special chars before matching. Platforms tested: RHEL5 x86_64 Flag Day: no Doc impact: no (cherry picked from commit b433e4c852a2ef78558dffc1ccbaf464c1186934) diff --git a/ldap/servers/plugins/syntaxes/string.c b/ldap/servers/plugins/syntaxes/string.c index dd44a80..9b33833 100644 --- a/ldap/servers/plugins/syntaxes/string.c +++ b/ldap/servers/plugins/syntaxes/string.c @@ -262,7 +262,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final, if ( initial != NULL ) { value_normalize( initial, syntax, 1 /* trim leading blanks */ ); *p++ = '^'; - filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_PARENS ); + filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_RECHARS ); p = strchr( p, '\0' ); } if ( any != NULL ) { @@ -271,7 +271,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final, /* ".*" + value */ *p++ = '.'; *p++ = '*'; - filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_PARENS ); + filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_RECHARS ); p = strchr( p, '\0' ); } } @@ -280,7 +280,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final, /* ".*" + value */ *p++ = '.'; *p++ = '*'; - filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_PARENS ); + filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_RECHARS ); strcat( p, "$" ); } diff --git a/ldap/servers/slapd/filterentry.c b/ldap/servers/slapd/filterentry.c index f163b47..fad7362 100644 --- a/ldap/servers/slapd/filterentry.c +++ b/ldap/servers/slapd/filterentry.c @@ -663,7 +663,11 @@ filter_strcpy_special_ext( char *d, char *s, int flags ) break; case '(': case ')': - if (flags & FILTER_STRCPY_ESCAPE_PARENS) { + case '}': + case '{': + case '|': + case '?': + if (flags & FILTER_STRCPY_ESCAPE_RECHARS) { *d++ = '\\'; } break; diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index d428ff9..a21380e 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -574,7 +574,7 @@ void set_hash_filters(int i); * filterentry.c */ void filter_strcpy_special( char *d, char *s ); -#define FILTER_STRCPY_ESCAPE_PARENS 0x01 +#define FILTER_STRCPY_ESCAPE_RECHARS 0x01 void filter_strcpy_special_ext( char *d, char *s, int flags );

1 0

src/com
by Richard Allen Megginson 07 Apr '10

07 Apr '10

src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) New commits: commit 50cd061a5adc99b886d78ee2bbb2f0dd1cdf47f8 Author: Endi S. Dewata <edewata(a)redhat.com> Date: Wed Mar 31 00:32:02 2010 -0500 Bug 563513 - New replication -> No changelong configured-msg Resolves: bug 563513 Bug Description: New replication -> No changelong configured-msg Fix Description: The ReplicaResourceObject.actionMenuSelected() has been modified to display the proper message if the changelog is not configured. Platforms tested: F12 Reviewed by: rmeggins (and pushed by) diff --git a/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java b/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java index 9d24241..aa0ce37 100644 --- a/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java +++ b/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java @@ -198,8 +198,7 @@ public class ReplicaResourceObject extends DSResourceObject } if (!logChangesExists) { ReplicationTool.displayError( - _model.getFrame(), "no changelong configured", - // "replication-err-noReplicaOrChangelog", + _model.getFrame(), "replication-err-noReplicaOrChangelog", "title", "msg", null); return; }

1 0

Branch 'Directory_Server_8_2_Branch' - ldap/admin
by Richard Allen Megginson 07 Apr '10

07 Apr '10

ldap/admin/src/scripts/start-dirsrv.in | 1 + 1 file changed, 1 insertion(+) New commits: commit a640bf6f589c915085be1de27e1261650ccb2528 Author: Endi S. Dewata <edewata(a)redhat.com> Date: Tue Mar 30 08:48:44 2010 -0500 Bug 566043 - startpid file is only cleaned by initscript runs https://bugzilla.redhat.com/show_bug.cgi?id=566043 Resolves: bug 566043 Branch: Directory_Server_8_2_Branch Bug description: startpid file is only cleaned by initscript runs Fix description: The start-dirsrv script has been modified to remove the startpid file if the server starts successfully. Reviewed by: rmeggins (and pushed by) (cherry picked from commit 0c9d4590489066d2f8dc945c9749c429972e78a9) diff --git a/ldap/admin/src/scripts/start-dirsrv.in b/ldap/admin/src/scripts/start-dirsrv.in index 46c48d7..d3788be 100755 --- a/ldap/admin/src/scripts/start-dirsrv.in +++ b/ldap/admin/src/scripts/start-dirsrv.in @@ -83,6 +83,7 @@ start_instance() { fi else PID=`cat $PIDFILE` + rm -f $STARTPIDFILE return 0; fi done

1 0

ldap/admin
by Richard Allen Megginson 07 Apr '10

07 Apr '10

ldap/admin/src/scripts/start-dirsrv.in | 1 + 1 file changed, 1 insertion(+) New commits: commit 0c9d4590489066d2f8dc945c9749c429972e78a9 Author: Endi S. Dewata <edewata(a)redhat.com> Date: Tue Mar 30 08:48:44 2010 -0500 Bug 566043 - startpid file is only cleaned by initscript runs https://bugzilla.redhat.com/show_bug.cgi?id=566043 Resolves: bug 566043 Bug description: startpid file is only cleaned by initscript runs Fix description: The start-dirsrv script has been modified to remove the startpid file if the server starts successfully. Reviewed by: rmeggins (and pushed by) diff --git a/ldap/admin/src/scripts/start-dirsrv.in b/ldap/admin/src/scripts/start-dirsrv.in index 4e95785..d7144d1 100755 --- a/ldap/admin/src/scripts/start-dirsrv.in +++ b/ldap/admin/src/scripts/start-dirsrv.in @@ -83,6 +83,7 @@ start_instance() { fi else PID=`cat $PIDFILE` + rm -f $STARTPIDFILE return 0; fi done

1 0

esc/mac/coolkey_package_data/Resources InstallationCheck, 1.1, 1.2 InstallationCheck.strings, 1.1, 1.2
by Jack Magne 06 Apr '10

06 Apr '10

Author: jmagne Update of /cvs/dirsec/esc/mac/coolkey_package_data/Resources In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv18487 Added Files: InstallationCheck InstallationCheck.strings Log Message: Improve installer for mac, bug#369031. Index: InstallationCheck =================================================================== RCS file: InstallationCheck diff -N InstallationCheck --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ InstallationCheck 6 Apr 2010 23:25:57 -0000 1.2 @@ -0,0 +1,155 @@ +#!/bin/bash + +# BEGIN COPYRIGHT BLOCK + # This Program is free software; you can redistribute it and/or modify it under + # the terms of the GNU General Public License as published by the Free Software + # Foundation; version 2 of the License. + # + # This Program is distributed in the hope that it will be useful, but WITHOUT + # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + # FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License along with + # this Program; if not, write to the Free Software Foundation, Inc., 59 Temple + # Place, Suite 330, Boston, MA 02111-1307 USA. + # + # Copyright (C) 2005 Red Hat, Inc. + # All rights reserved. + # END COPYRIGHT BLOCK **/ + +ESC_APP="ESC.app" +COOLKEY_TOKEND="COOLKEY.tokend" +PCSC_LITE="/usr/sbin/pcscd" +LIB_COOLKEY="libcoolkeypk11.dylib" +MIN_OS_VERSION="10.5.0" + +function IsRunning { + +if ps -A | grep -v grep | grep $1 > /dev/null +then + return 1 +fi + +return 0 +} + +function IsInUse { + +lsof | grep $1 + +if [ $? -eq 0 ]; +then + return 1 +fi + +return 0 +} + +#Assure proper OS Version + +function IsLegalOSVersion { + +# Input parameter is string of mininum legal version +version=`sw_vers -productVersion` + +min_version=$1 + +OLD_IFS="$IFS" +IFS="." + +version_array=( $version ) +min_version_array=( $min_version ) + +IFS="$OLD_IFS" + +#echo ${min_version_array[0]} +#echo ${min_version_array[1]} +#echo ${min_version_array[2]} + +#echo ${version_array[0]} +#echo ${version_array[1]} +#echo ${version_array[2]} + +let "major=version_array[0] + 0" +let "min_major=min_version_array[0] + 0" + +let "minor=version_array[1] + 0" +let "min_minor=min_version_array[1] + 0" + +let "release=version_array[2] + 0" +let "min_release=min_version_array[2] + 0" + +if [ $major -ge $min_major ]; +then + echo "major ok" +else + echo "major no ok" $major + return 0 +fi + +if [ $minor -ge $min_minor ]; +then + echo "minor ok" +else + echo "minor no ok" $minor + return 0 +fi + +if [ $release -ge $min_release ]; +then + echo "release ok" +else + echo "release no ok" $release + return 0 +fi + +return 1 +} + +#check for Leopard or above + +IsLegalOSVersion $MIN_OS_VERSION + +if [ $? -eq 0 ]; +then + exit 112 +fi + +# check esc + +IsRunning $ESC_APP + +if [ $? -eq 1 ]; +then + exit 113 +fi + +# check COOLKEY.tokend + +IsRunning $COOLKEY_TOKEND + +if [ $? -eq 1 ]; +then + exit 114 +fi + +#check pcscd + +IsRunning $PCSC_LITE + +if [ $? -eq 1 ]; +then + exit 115 +fi + +# check to see of libcooleypk11.dylib is in use + +IsInUse $LIB_COOLKEY + +if [ $? -eq 1 ]; +then + echo "COOLKEY PKCS#11 module in use." + exit 116 +fi + +exit 0 Index: InstallationCheck.strings =================================================================== RCS file: InstallationCheck.strings diff -N InstallationCheck.strings --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ InstallationCheck.strings 6 Apr 2010 23:25:57 -0000 1.2 @@ -0,0 +1,6 @@ +"16" = "Mac OS X, version 10.5 or later is required for this software."; +"17" = "Please close any running instances of the ESC SmartCardManager and try again."; +"18" = "Please make sure all COOLKEY smart cards are removed from the computer and try again."; +"19" = "Please make sure all smart cards are removed from the computer and try again."; +"20" = "Please close all Mozilla browsers and mail clients that may be using the COOLKEY PKCS#11 module and try again."; +

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits April 2010