389-commits March 2013

389-commits@lists.fedoraproject.org

5 participants
68 discussions

Branch '389-ds-base-1.2.11' - ldap/schema ldap/servers
by Mark Reynolds 22 Mar '13

22 Mar '13

ldap/schema/01core389.ldif | 13 ++++++++++++ ldap/servers/slapd/libglobs.c | 43 ++++++++++++++++++++++++++++++++++++++++ ldap/servers/slapd/proto-slap.h | 2 + ldap/servers/slapd/saslbind.c | 2 - ldap/servers/slapd/slap.h | 2 + 5 files changed, 61 insertions(+), 1 deletion(-) New commits: commit 6a2b0b1741ce6cdcceea06e630141673d47c6012 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Fri Mar 22 13:18:28 2013 -0400 Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC Bug Description: When FreeIPA is configured with AD trust support, Kerberos tickets may also contain PAC which makes them bigger than usually expected (bigger than 2048 B) Fix Description: Make the default 64k(65536), and allow it to be configurable using: nsslapd-sasl-max-buffer-size https://fedorahosted.org/389/ticket/632 Reviewed by: nkinder(Thanks!) diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif index fb707d3..ad5b555 100644 --- a/ldap/schema/01core389.ldif +++ b/ldap/schema/01core389.ldif @@ -139,6 +139,19 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2136 NAME 'nsds5ReplicaCleanRUVNotified' attributeTypes: ( 2.16.840.1.113730.3.1.2137 NAME 'nsds5ReplicaAbortCleanRUV' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2111 NAME 'tombstoneNumSubordinates' DESC 'count of immediate subordinates for tombstone entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN '389 directory server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2138 NAME 'nsslapd-readonly' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2143 NAME 'nsslapd-sasl-mapping-fallback' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2144 NAME 'rootdn-open-time' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2145 NAME 'rootdn-close-time' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2146 NAME 'rootdn-days-allowed' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2147 NAME 'rootdn-allow-host' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2148 NAME 'rootdn-deny-host' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2149 NAME 'rootdn-allow-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2150 NAME 'rootdn-deny-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2151 NAME 'nsslapd-plugin-depends-on-type' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2154 NAME 'nsds5ReplicaBackoffMin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2155 NAME 'nsds5ReplicaBackoffMax' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2156 NAME 'nsslapd-sasl-max-buffer-size' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) # # objectclasses # diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index 3226ede..2e141c7 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -83,6 +83,8 @@ #include "plhash.h" #define REMOVE_CHANGELOG_CMD "remove" +#define DEFAULT_SASL_MAXBUFSIZE "65536" +#define SLAPD_DEFAULT_SASL_MAXBUFSIZE 65536 /* On UNIX, there's only one copy of slapd_ldap_debug */ /* On NT, each module keeps its own module_ldap_debug, which */ @@ -691,6 +693,10 @@ static struct config_get_and_set { NULL, 0, (void**)&global_slapdFrontendConfig.disk_preserve_logging, CONFIG_ON_OFF, (ConfigGetFunc)config_get_disk_preserve_logging}, + {CONFIG_SASL_MAXBUFSIZE, config_set_sasl_maxbufsize, + NULL, 0, + (void**)&global_slapdFrontendConfig.sasl_max_bufsize, + CONFIG_INT, (ConfigGetFunc)config_get_sasl_maxbufsize}, #ifdef MEMPOOL_EXPERIMENTAL ,{CONFIG_MEMPOOL_SWITCH_ATTRIBUTE, config_set_mempool_switch, NULL, 0, @@ -1092,6 +1098,7 @@ FrontendConfig_init () { cfg->disk_grace_period = 60; /* 1 hour */ cfg->disk_preserve_logging = LDAP_OFF; cfg->disk_logging_critical = LDAP_OFF; + cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE; #ifdef MEMPOOL_EXPERIMENTAL cfg->mempool_switch = LDAP_ON; @@ -1310,6 +1317,29 @@ config_set_disk_grace_period( const char *attrname, char *value, char *errorbuf, return retVal; } +int +config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply ) +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS; + int default_size = atoi(DEFAULT_SASL_MAXBUFSIZE); + int size; + + size = atoi(value); + if(size < default_size){ + PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "nsslapd-sasl-max-buffer-size is too low (%d), " + "setting to default value (%d).\n",size, default_size); + size = default_size; + } + if(apply){ + CFG_LOCK_WRITE(slapdFrontendConfig); + slapdFrontendConfig->sasl_max_bufsize = size; + CFG_UNLOCK_WRITE(slapdFrontendConfig); + } + + return retVal; +} + int config_set_port( const char *attrname, char *port, char *errorbuf, int apply ) { long nPort; @@ -3730,6 +3760,19 @@ config_get_port(){ } int +config_get_sasl_maxbufsize() +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal; + + CFG_LOCK_READ(slapdFrontendConfig); + retVal = slapdFrontendConfig->sasl_max_bufsize; + CFG_UNLOCK_READ(slapdFrontendConfig); + + return retVal; +} + +int config_get_disk_monitoring(){ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); int retVal; diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index c3ac3c7..f1f5b25 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -389,6 +389,7 @@ int config_set_disk_grace_period( const char *attrname, char *value, char *error int config_set_disk_preserve_logging( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_disk_logging_critical( const char *attrname, char *value, char *errorbuf, int apply ); int config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply); +int config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply ); #if !defined(_WIN32) && !defined(AIX) int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply ); @@ -544,6 +545,7 @@ long config_get_disk_threshold(); int config_get_disk_grace_period(); int config_get_disk_preserve_logging(); int config_get_disk_logging_critical(); +int config_get_sasl_maxbufsize(); int is_abspath(const char *); char* rel2abspath( char * ); diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c index f75e977..2d6ec0a 100644 --- a/ldap/servers/slapd/saslbind.c +++ b/ldap/servers/slapd/saslbind.c @@ -659,7 +659,7 @@ void ids_sasl_server_new(Connection *conn) } /* Enable security for this connection */ - secprops.maxbufsize = 2048; /* DBDB: hack */ + secprops.maxbufsize = config_get_sasl_maxbufsize(); secprops.max_ssf = 0xffffffff; secprops.min_ssf = config_get_minssf(); /* If anonymous access is disabled, set the appropriate flag */ diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index eea025a..7e0faed 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -2003,6 +2003,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_DISK_GRACE_PERIOD "nsslapd-disk-monitoring-grace-period" #define CONFIG_DISK_PRESERVE_LOGGING "nsslapd-disk-monitoring-preserve-logging" #define CONFIG_DISK_LOGGING_CRITICAL "nsslapd-disk-monitoring-logging-critical" +#define CONFIG_SASL_MAXBUFSIZE "nsslapd-sasl-max-buffer-size" #ifdef MEMPOOL_EXPERIMENTAL #define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool" @@ -2231,6 +2232,7 @@ typedef struct _slapdFrontendConfig { char *entryusn_import_init; /* Entry USN: determine the initital value of import */ int pagedsizelimit; char *default_naming_context; /* Default naming context (normalized) */ + int sasl_max_bufsize; /* The max receive buffer size for SASL */ /* disk monitoring */ int disk_monitoring;

1 0

ldap/servers
by thierry bordaz 22 Mar '13

22 Mar '13

ldap/servers/slapd/computed.c | 149 +++++++++++++++++++----- ldap/servers/slapd/main.c | 3 ldap/servers/slapd/proto-slap.h | 1 ldap/servers/slapd/tools/rsearch/nametable.c | 4 ldap/servers/slapd/tools/rsearch/searchthread.c | 2 5 files changed, 126 insertions(+), 33 deletions(-) New commits: commit 4b7791f3ab9370ccf30b09077656e247682bf384 Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com> Date: Thu Mar 14 18:35:21 2013 +0100 Ticket 616 - High contention on computed attribute lock Bug Description: On search request, some requested attributes are computed: - subschemasubentry - nscpentrywsi - numsubordinates - hassubordinates This is done with a linked list of registered callback. When sending the results, each requested attribute is evaluated against all the callbacks. When going through the callbacks list the thread hold the lock on the list. Currently all the server callbacks are registered at startup time with only one thread registering them (main). A custom plugin may register custom callback using slapi_compute_add_evaluator The important point is that callback are only added to the list. Also on standard deployment without custom plugin adding new computed attribute, this list is built at startup. The problem on computed attribute is that it can create contention between search threads trying to evaluate/compute the requested attributes The same description applies to computed filters. For example with 'views' or filters containing "subordinates", the filter is recomputed. This using a linked list of callbacks registered during startup. A custom plugin may register custom callback using slapi_compute_add_search_rewriter. In short: On standard deployment computed filters and computed attributes lists are unchanged after startup. Computed filters/attribute are only added to the lists. Fix Description: The fix consist to not protect the access to computed filter/attribute unless a computed filter/attribute is added after startup. The fix also contains a improvement of rsearch to support filters larger than 256 char The fix also contains reworks according to review feedback. Basically using a temporary variable to hold the actual value of require_* The benefit is limited to 2% in terms of search throughput (8*4core machine) https://fedorahosted.org/389/ticket/616 Reviewed by: Rich Megginson (thanks Rich !) Platforms tested: 1*4cores fedora and 8*4cores RHEL6.4 Flag Day: no Doc impact: no diff --git a/ldap/servers/slapd/computed.c b/ldap/servers/slapd/computed.c index 353d375..8259dea 100644 --- a/ldap/servers/slapd/computed.c +++ b/ldap/servers/slapd/computed.c @@ -44,6 +44,7 @@ /* Handles computed attributes for entries as they're returned to the client */ #include "slap.h" +#include "proto-slap.h" /* Structure used to pass the context needed for completing a computed attribute operation */ @@ -61,8 +62,11 @@ struct _compute_evaluator { }; typedef struct _compute_evaluator compute_evaluator; +static PRBool startup_completed = PR_FALSE; + static compute_evaluator *compute_evaluators = NULL; static Slapi_RWLock *compute_evaluators_lock = NULL; +static PRBool require_compute_evaluator_lock = PR_FALSE; static int compute_stock_evaluator(computed_attr_context *c,char* type,Slapi_Entry *e,slapi_compute_output_t outputfn); @@ -75,6 +79,7 @@ typedef struct _compute_rewriter compute_rewriter; static compute_rewriter *compute_rewriters = NULL; static Slapi_RWLock *compute_rewriters_lock = NULL; +static PRBool require_compute_rewriters_lock = PR_FALSE; /* Function called by evaluators to have the value output */ static int @@ -83,17 +88,36 @@ compute_output_callback(computed_attr_context *c,Slapi_Attr *a , Slapi_Entry *e) return encode_attr (c->pb, c->ber, e, a, c->attrsonly, c->requested_type); } +static +int compute_call_evaluators_nolock(computed_attr_context *c,slapi_compute_output_t outfn,char *type,Slapi_Entry *e) +{ + int rc = -1; + compute_evaluator *current = NULL; + + for (current = compute_evaluators; (current != NULL) && (-1 == rc); current = current->next) { + rc = (*(current->function))(c,type,e,outfn); + } + return rc; +} + static int compute_call_evaluators(computed_attr_context *c,slapi_compute_output_t outfn,char *type,Slapi_Entry *e) { int rc = -1; - compute_evaluator *current = NULL; + int need_lock = require_compute_evaluator_lock; + /* Walk along the list (locked) calling the evaluator functions util one says yes, an error happens, or we finish */ - slapi_rwlock_rdlock(compute_evaluators_lock); - for (current = compute_evaluators; (current != NULL) && (-1 == rc); current = current->next) { - rc = (*(current->function))(c,type,e,outfn); - } - slapi_rwlock_unlock(compute_evaluators_lock); + + if (need_lock) { + slapi_rwlock_rdlock(compute_evaluators_lock); + } + + rc = compute_call_evaluators_nolock(c, outfn, type, e); + + if (need_lock) { + slapi_rwlock_unlock(compute_evaluators_lock); + } + return rc; } @@ -132,25 +156,54 @@ compute_stock_evaluator(computed_attr_context *c,char* type,Slapi_Entry *e,slapi return rc; /* I see no ships */ } +static void +compute_add_evaluator_nolock(slapi_compute_callback_t function, compute_evaluator *new_eval) +{ + new_eval->next = compute_evaluators; + new_eval->function = function; + compute_evaluators = new_eval; +} int slapi_compute_add_evaluator(slapi_compute_callback_t function) { int rc = 0; compute_evaluator *new_eval = NULL; PR_ASSERT(NULL != function); PR_ASSERT(NULL != compute_evaluators_lock); - slapi_rwlock_wrlock(compute_evaluators_lock); + if (startup_completed) { + /* We are now in multi-threaded and we still add + * a attribute evaluator. + * switch to use locking mechanimsm + */ + require_compute_evaluator_lock = PR_TRUE; + } + new_eval = (compute_evaluator *)slapi_ch_calloc(1,sizeof (compute_evaluator)); if (NULL == new_eval) { rc = ENOMEM; } else { - new_eval->next = compute_evaluators; - new_eval->function = function; - compute_evaluators = new_eval; + int need_lock = require_compute_evaluator_lock; + + if (need_lock) { + slapi_rwlock_wrlock(compute_evaluators_lock); + } + + compute_add_evaluator_nolock(function, new_eval); + + if (need_lock) { + slapi_rwlock_unlock(compute_evaluators_lock); + } } - slapi_rwlock_unlock(compute_evaluators_lock); + return rc; } +/* Called when */ +void +compute_plugins_started() +{ + startup_completed = PR_TRUE; +} + /* Call this on server startup, before the first LDAP operation is serviced */ int compute_init() { @@ -200,6 +253,14 @@ int compute_terminate() return 0; } +static void +compute_add_search_rewrite_nolock(slapi_search_rewrite_callback_t function, compute_rewriter *new_rewriter) +{ + new_rewriter->next = compute_rewriters; + new_rewriter->function = function; + compute_rewriters = new_rewriter; +} + /* Functions dealing with re-writing of search filters */ int slapi_compute_add_search_rewriter(slapi_search_rewrite_callback_t function) @@ -208,36 +269,66 @@ int slapi_compute_add_search_rewriter(slapi_search_rewrite_callback_t function) compute_rewriter *new_rewriter = NULL; PR_ASSERT(NULL != function); PR_ASSERT(NULL != compute_rewriters_lock); + if (startup_completed) { + /* We are now in multi-threaded and we still add + * a filter rewriter. + * switch to use locking mechanimsm + */ + require_compute_rewriters_lock = PR_TRUE; + } new_rewriter = (compute_rewriter *)slapi_ch_calloc(1,sizeof (compute_rewriter)); if (NULL == new_rewriter) { rc = ENOMEM; } else { - slapi_rwlock_wrlock(compute_rewriters_lock); - new_rewriter->next = compute_rewriters; - new_rewriter->function = function; - compute_rewriters = new_rewriter; - slapi_rwlock_unlock(compute_rewriters_lock); + int need_lock = require_compute_rewriters_lock; + + if (need_lock) { + slapi_rwlock_wrlock(compute_rewriters_lock); + } + + compute_add_search_rewrite_nolock(function, new_rewriter); + + if (need_lock) { + slapi_rwlock_unlock(compute_rewriters_lock); + } } return rc; } -int compute_rewrite_search_filter(Slapi_PBlock *pb) +static +int compute_rewrite_search_filter_nolock(Slapi_PBlock *pb) +{ + int rc = -1; + compute_rewriter *current = NULL; + + for (current = compute_rewriters; (current != NULL) && (-1 == rc); current = current->next) { + rc = (*(current->function))(pb); + /* Meaning of the return code : + -1 : keep looking + 0 : rewrote OK + 1 : refuse to do this search + 2 : operations error + */ + } + return(rc); +} + +int compute_rewrite_search_filter(Slapi_PBlock *pb) { /* Iterate through the listed rewriters until one says it matched */ int rc = -1; - compute_rewriter *current = NULL; + int need_lock = require_compute_rewriters_lock; + /* Walk along the list (locked) calling the evaluator functions util one says yes, an error happens, or we finish */ - slapi_rwlock_rdlock(compute_rewriters_lock); - for (current = compute_rewriters; (current != NULL) && (-1 == rc); current = current->next) { - rc = (*(current->function))(pb); - /* Meaning of the return code : - -1 : keep looking - 0 : rewrote OK - 1 : refuse to do this search - 2 : operations error - */ - } - slapi_rwlock_unlock(compute_rewriters_lock); + if (need_lock) { + slapi_rwlock_rdlock(compute_rewriters_lock); + } + + rc = compute_rewrite_search_filter_nolock(pb); + + if (need_lock) { + slapi_rwlock_unlock(compute_rewriters_lock); + } return rc; } diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c index f438fce..e97e5ef 100644 --- a/ldap/servers/slapd/main.c +++ b/ldap/servers/slapd/main.c @@ -1178,7 +1178,8 @@ main( int argc, char **argv) pw_exp_init (); plugin_print_lists(); - plugin_startall(argc, argv, 1 /* Start Backends */, 1 /* Start Globals */); + plugin_startall(argc, argv, 1 /* Start Backends */, 1 /* Start Globals */); + compute_plugins_started(); if (housekeeping_start((time_t)0, NULL) == NULL) { return_value = 1; goto cleanup; diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 0da266b..53d3569 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -251,6 +251,7 @@ void do_compare( Slapi_PBlock *pb ); int compute_attribute(char *type, Slapi_PBlock *pb,BerElement *ber,Slapi_Entry *e,int attrsonly,char *requested_type); int compute_init(); int compute_terminate(); +void compute_plugins_started(); /* diff --git a/ldap/servers/slapd/tools/rsearch/nametable.c b/ldap/servers/slapd/tools/rsearch/nametable.c index 0a4b6fc..e5d04cd 100644 --- a/ldap/servers/slapd/tools/rsearch/nametable.c +++ b/ldap/servers/slapd/tools/rsearch/nametable.c @@ -152,8 +152,8 @@ int nt_load(NameTable *nt, const char *filename) if (!fd) return 0; while (PR_Available(fd) > 0) { - char temp[256], *s; - if (PR_GetLine(fd, temp, 256)) break; + char temp[4096], *s; + if (PR_GetLine(fd, temp, sizeof(temp))) break; s = strdup(temp); if (!s) break; if (!nt_push(nt, s)) break; diff --git a/ldap/servers/slapd/tools/rsearch/searchthread.c b/ldap/servers/slapd/tools/rsearch/searchthread.c index 8a74d58..6c43dfb 100644 --- a/ldap/servers/slapd/tools/rsearch/searchthread.c +++ b/ldap/servers/slapd/tools/rsearch/searchthread.c @@ -285,7 +285,7 @@ static int st_bind(SearchThread *st) return 0; } } else if (uid) { - char filterBuffer[100]; + char filterBuffer[4096]; char *pFilter; char *filterTemplate = (uidFilter) ? uidFilter : "(uid=%s)"; struct timeval timeout;

1 0

Branch '389-ds-base-1.3.0' - ldap/schema ldap/servers
by Mark Reynolds 22 Mar '13

22 Mar '13

ldap/schema/01core389.ldif | 13 +++++++++++ ldap/servers/slapd/libglobs.c | 46 +++++++++++++++++++++++++++++++++++++++- ldap/servers/slapd/proto-slap.h | 2 + ldap/servers/slapd/saslbind.c | 2 - ldap/servers/slapd/slap.h | 2 + 5 files changed, 63 insertions(+), 2 deletions(-) New commits: commit 00463a1b23d970837e73a38a82fd34424ab13782 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Fri Mar 22 13:18:28 2013 -0400 Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC Bug Description: When FreeIPA is configured with AD trust support, Kerberos tickets may also contain PAC which makes them bigger than usually expected (bigger than 2048 B) Fix Description: Make the default 64k(65536), and allow it to be configurable using: nsslapd-sasl-max-buffer-size https://fedorahosted.org/389/ticket/632 Reviewed by: nkinder(Thanks!) diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif index fb707d3..ad5b555 100644 --- a/ldap/schema/01core389.ldif +++ b/ldap/schema/01core389.ldif @@ -139,6 +139,19 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2136 NAME 'nsds5ReplicaCleanRUVNotified' attributeTypes: ( 2.16.840.1.113730.3.1.2137 NAME 'nsds5ReplicaAbortCleanRUV' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2111 NAME 'tombstoneNumSubordinates' DESC 'count of immediate subordinates for tombstone entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN '389 directory server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2138 NAME 'nsslapd-readonly' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2143 NAME 'nsslapd-sasl-mapping-fallback' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2144 NAME 'rootdn-open-time' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2145 NAME 'rootdn-close-time' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2146 NAME 'rootdn-days-allowed' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2147 NAME 'rootdn-allow-host' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2148 NAME 'rootdn-deny-host' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2149 NAME 'rootdn-allow-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2150 NAME 'rootdn-deny-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2151 NAME 'nsslapd-plugin-depends-on-type' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2154 NAME 'nsds5ReplicaBackoffMin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2155 NAME 'nsds5ReplicaBackoffMax' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2156 NAME 'nsslapd-sasl-max-buffer-size' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) # # objectclasses # diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index ab366fc..a5c1067 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -175,6 +175,8 @@ static int config_set_schemareplace ( const char *attrname, char *value, #define DEFAULT_PW_RESETFAILURECOUNT "600" #define DEFAULT_PW_LOCKDURATION "3600" #define DEFAULT_NDN_SIZE "20971520" +#define DEFAULT_SASL_MAXBUFSIZE "65536" +#define SLAPD_DEFAULT_SASL_MAXBUFSIZE 65536 #ifdef MEMPOOL_EXPERIMENTAL #define DEFAULT_MEMPOOL_MAXFREELIST "1024" #endif @@ -1010,6 +1012,11 @@ static struct config_get_and_set { NULL, 0, (void**)&global_slapdFrontendConfig.allowed_sasl_mechs, CONFIG_STRING, (ConfigGetFunc)config_get_allowed_sasl_mechs, DEFAULT_ALLOWED_TO_DELETE_ATTRS}, + {CONFIG_SASL_MAXBUFSIZE, config_set_sasl_maxbufsize, + NULL, 0, + (void**)&global_slapdFrontendConfig.sasl_max_bufsize, + CONFIG_INT, (ConfigGetFunc)config_get_sasl_maxbufsize, + DEFAULT_SASL_MAXBUFSIZE}, #ifdef MEMPOOL_EXPERIMENTAL ,{CONFIG_MEMPOOL_SWITCH_ATTRIBUTE, config_set_mempool_switch, NULL, 0, @@ -1436,6 +1443,7 @@ FrontendConfig_init () { init_disk_logging_critical = cfg->disk_logging_critical = LDAP_OFF; init_ndn_cache_enabled = cfg->ndn_cache_enabled = LDAP_OFF; cfg->ndn_cache_max_size = NDN_DEFAULT_SIZE; + cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE; #ifdef MEMPOOL_EXPERIMENTAL init_mempool_switch = cfg->mempool_switch = LDAP_ON; @@ -1669,8 +1677,8 @@ int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int apply ) { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); - long size; int retVal = LDAP_SUCCESS; + long size; size = atol(value); if(size < 0){ @@ -1690,6 +1698,29 @@ config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, return retVal; } +int +config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply ) +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS; + int default_size = atoi(DEFAULT_SASL_MAXBUFSIZE); + int size; + + size = atoi(value); + if(size < default_size){ + PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "nsslapd-sasl-max-buffer-size is too low (%d), " + "setting to default value (%d).\n",size, default_size); + size = default_size; + } + if(apply){ + CFG_LOCK_WRITE(slapdFrontendConfig); + slapdFrontendConfig->sasl_max_bufsize = size; + CFG_UNLOCK_WRITE(slapdFrontendConfig); + } + + return retVal; +} + int config_set_port( const char *attrname, char *port, char *errorbuf, int apply ) { long nPort; @@ -4128,6 +4159,19 @@ config_get_port(){ } int +config_get_sasl_maxbufsize() +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal; + + CFG_LOCK_READ(slapdFrontendConfig); + retVal = slapdFrontendConfig->sasl_max_bufsize; + CFG_UNLOCK_READ(slapdFrontendConfig); + + return retVal; +} + +int config_get_disk_monitoring(){ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); int retVal; diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 6d7a1ad..e947248 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -392,6 +392,7 @@ int config_set_disk_logging_critical( const char *attrname, char *value, char *e int config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply); int config_set_ndn_cache_enabled(const char *attrname, char *value, char *errorbuf, int apply); int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int apply); +int config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply ); #if !defined(_WIN32) && !defined(AIX) int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply ); @@ -553,6 +554,7 @@ int config_get_ndn_cache_enabled(); char *config_get_allowed_sasl_mechs(); int config_set_allowed_sasl_mechs(const char *attrname, char *value, char *errorbuf, int apply); int config_get_schemamod(); +int config_get_sasl_maxbufsize(); PLHashNumber hashNocaseString(const void *key); PRIntn hashNocaseCompare(const void *v1, const void *v2); diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c index f9ddbfc..51c0a4e 100644 --- a/ldap/servers/slapd/saslbind.c +++ b/ldap/servers/slapd/saslbind.c @@ -661,7 +661,7 @@ void ids_sasl_server_new(Connection *conn) } /* Enable security for this connection */ - secprops.maxbufsize = 2048; /* DBDB: hack */ + secprops.maxbufsize = config_get_sasl_maxbufsize(); secprops.max_ssf = 0xffffffff; secprops.min_ssf = config_get_minssf(); /* If anonymous access is disabled, set the appropriate flag */ diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 4e70aff..7e27a78 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -2052,6 +2052,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_NDN_CACHE "nsslapd-ndn-cache-enabled" #define CONFIG_NDN_CACHE_SIZE "nsslapd-ndn-cache-max-size" #define CONFIG_ALLOWED_SASL_MECHS "nsslapd-allowed-sasl-mechanisms" +#define CONFIG_SASL_MAXBUFSIZE "nsslapd-sasl-max-buffer-size" #ifdef MEMPOOL_EXPERIMENTAL #define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool" @@ -2263,6 +2264,7 @@ typedef struct _slapdFrontendConfig { int pagedsizelimit; char *default_naming_context; /* Default naming context (normalized) */ char *allowed_sasl_mechs; /* comma/space separated list of allowed sasl mechs */ + int sasl_max_bufsize; /* The max receive buffer size for SASL */ /* disk monitoring */ int disk_monitoring;

1 0

ldap/schema ldap/servers
by Mark Reynolds 22 Mar '13

22 Mar '13

ldap/schema/01core389.ldif | 1 ldap/servers/slapd/libglobs.c | 46 +++++++++++++++++++++++++++++++++++++++- ldap/servers/slapd/proto-slap.h | 2 + ldap/servers/slapd/saslbind.c | 2 - ldap/servers/slapd/slap.h | 2 + 5 files changed, 51 insertions(+), 2 deletions(-) New commits: commit ac6d8e583c51e5935d697e254e3869c63cbd483f Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Fri Mar 22 13:05:32 2013 -0400 Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC Bug Description: When FreeIPA is configured with AD trust support, Kerberos tickets may also contain PAC which makes them bigger than usually expected (bigger than 2048 B) Fix Description: Make the default 64k(65536), and allow it to be configurable using: nsslapd-sasl-max-buffer-size https://fedorahosted.org/389/ticket/632 Reviewed by: nkinder(Thanks!) diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif index ed25bd8..8ef702d 100644 --- a/ldap/schema/01core389.ldif +++ b/ldap/schema/01core389.ldif @@ -152,6 +152,7 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2151 NAME 'nsslapd-plugin-depends-on-typ attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2154 NAME 'nsds5ReplicaBackoffMin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2155 NAME 'nsds5ReplicaBackoffMax' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2156 NAME 'nsslapd-sasl-max-buffer-size' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) # # objectclasses # diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index 13f5d8b..b7bc999 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -176,6 +176,8 @@ static int config_set_schemareplace ( const char *attrname, char *value, #define DEFAULT_PW_RESETFAILURECOUNT "600" #define DEFAULT_PW_LOCKDURATION "3600" #define DEFAULT_NDN_SIZE "20971520" +#define DEFAULT_SASL_MAXBUFSIZE "65536" +#define SLAPD_DEFAULT_SASL_MAXBUFSIZE 65536 #ifdef MEMPOOL_EXPERIMENTAL #define DEFAULT_MEMPOOL_MAXFREELIST "1024" #endif @@ -1033,6 +1035,11 @@ static struct config_get_and_set { CONFIG_SPECIAL_UNHASHED_PW_SWITCH, (ConfigGetFunc)config_get_unhashed_pw_switch, DEFAULT_UNHASHED_PW_SWITCH}, + {CONFIG_SASL_MAXBUFSIZE, config_set_sasl_maxbufsize, + NULL, 0, + (void**)&global_slapdFrontendConfig.sasl_max_bufsize, + CONFIG_INT, (ConfigGetFunc)config_get_sasl_maxbufsize, + DEFAULT_SASL_MAXBUFSIZE}, {CONFIG_SEARCH_RETURN_ORIGINAL_TYPE, config_set_return_orig_type_switch, NULL, 0, (void**)&global_slapdFrontendConfig.return_orig_type, @@ -1468,6 +1475,7 @@ FrontendConfig_init () { cfg->ignore_vattrs = slapi_counter_new(); cfg->sasl_mapping_fallback = slapi_counter_new(); init_sasl_mapping_fallback = LDAP_OFF; + cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE; cfg->unhashed_pw_switch = SLAPD_UNHASHED_PW_ON; init_return_orig_type = cfg->return_orig_type = LDAP_OFF; @@ -1731,8 +1739,8 @@ int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int apply ) { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); - long size; int retVal = LDAP_SUCCESS; + long size; size = atol(value); if(size < 0){ @@ -1753,6 +1761,29 @@ config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, } int +config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply ) +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS; + int default_size = atoi(DEFAULT_SASL_MAXBUFSIZE); + int size; + + size = atoi(value); + if(size < default_size){ + PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "nsslapd-sasl-max-buffer-size is too low (%d), " + "setting to default value (%d).\n",size, default_size); + size = default_size; + } + if(apply){ + CFG_LOCK_WRITE(slapdFrontendConfig); + slapdFrontendConfig->sasl_max_bufsize = size; + CFG_UNLOCK_WRITE(slapdFrontendConfig); + } + + return retVal; +} + +int config_set_return_orig_type_switch(const char *attrname, char *value, char *errorbuf, int apply) { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); @@ -4228,6 +4259,19 @@ config_get_port(){ } int +config_get_sasl_maxbufsize() +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal; + + CFG_LOCK_READ(slapdFrontendConfig); + retVal = slapdFrontendConfig->sasl_max_bufsize; + CFG_UNLOCK_READ(slapdFrontendConfig); + + return retVal; +} + +int config_get_ignore_vattrs() { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 0bb923f..0da266b 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -397,6 +397,7 @@ int config_set_ndn_cache_enabled(const char *attrname, char *value, char *errorb int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int apply); int config_set_unhashed_pw_switch(const char *attrname, char *value, char *errorbuf, int apply); int config_set_return_orig_type_switch(const char *attrname, char *value, char *errorbuf, int apply); +int config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply ); #if !defined(_WIN32) && !defined(AIX) int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply ); @@ -564,6 +565,7 @@ int config_get_ignore_vattrs(); int config_set_sasl_mapping_fallback(const char *attrname, char *value, char *errorbuf, int apply); int config_get_sasl_mapping_fallback(); int config_get_unhashed_pw_switch(); +int config_get_sasl_maxbufsize(); PLHashNumber hashNocaseString(const void *key); PRIntn hashNocaseCompare(const void *v1, const void *v2); diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c index 78031dc..9119c8a 100644 --- a/ldap/servers/slapd/saslbind.c +++ b/ldap/servers/slapd/saslbind.c @@ -674,7 +674,7 @@ void ids_sasl_server_new(Connection *conn) } /* Enable security for this connection */ - secprops.maxbufsize = 2048; /* DBDB: hack */ + secprops.maxbufsize = config_get_sasl_maxbufsize(); secprops.max_ssf = 0xffffffff; secprops.min_ssf = config_get_minssf(); /* If anonymous access is disabled, set the appropriate flag */ diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index f1cd80e..a19e192 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -2073,6 +2073,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_ALLOWED_SASL_MECHS "nsslapd-allowed-sasl-mechanisms" #define CONFIG_IGNORE_VATTRS "nsslapd-ignore-virtual-attrs" #define CONFIG_SASL_MAPPING_FALLBACK "nsslapd-sasl-mapping-fallback" +#define CONFIG_SASL_MAXBUFSIZE "nsslapd-sasl-max-buffer-size" #define CONFIG_SEARCH_RETURN_ORIGINAL_TYPE "nsslapd-search-return-original-type-switch" #ifdef MEMPOOL_EXPERIMENTAL @@ -2297,6 +2298,7 @@ typedef struct _slapdFrontendConfig { int pagedsizelimit; char *default_naming_context; /* Default naming context (normalized) */ char *allowed_sasl_mechs; /* comma/space separated list of allowed sasl mechs */ + int sasl_max_bufsize; /* The max receive buffer size for SASL */ /* disk monitoring */ slapi_onoff_t disk_monitoring;

1 0

ldap/servers
by thierry bordaz 22 Mar '13

22 Mar '13

ldap/servers/plugins/acl/acleffectiverights.c | 29 +++++-- ldap/servers/plugins/chainingdb/cb_utils.c | 15 +++ ldap/servers/plugins/deref/deref.c | 11 ++ ldap/servers/slapd/back-ldbm/ldbm_search.c | 101 ++++++++++++++++++-------- ldap/servers/slapd/opshared.c | 12 ++- ldap/servers/slapd/proxyauth.c | 13 ++- 6 files changed, 135 insertions(+), 46 deletions(-) New commits: commit e84c63f7c183577868194b66b3e7c0cd4f54af09 Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com> Date: Tue Mar 12 10:41:14 2013 +0100 Ticket 600 - Server should return unavailableCriticalExtension when processing a badly formed critical control Bug Description: When the server receives a critical control and fails to process it, it should return the result LDAP_UNAVAILABLE_CRITICAL_EXTENSION (RFC 4511 4.1.11). The server may fails to process it because of various reasons (unable to decode the control, unwilling to perform, invalid values...) Fix Description: The fix consists, when an error condition is detected while processing a control, to check the 'critical' flag to determine which result to return https://fedorahosted.org/389/ticket/600 Reviewed by: Mark Reynolds (thanks mark for all these reviews) Platforms tested: Fedora 17 Flag Day: no Doc impact: no QE impact: some acceptance tests will need changes (at least filter fltr_97 and fltr_99 diff --git a/ldap/servers/plugins/acl/acleffectiverights.c b/ldap/servers/plugins/acl/acleffectiverights.c index 89ce79b..e4537af 100644 --- a/ldap/servers/plugins/acl/acleffectiverights.c +++ b/ldap/servers/plugins/acl/acleffectiverights.c @@ -40,6 +40,8 @@ #endif +#include <ldap.h> + #include "acl.h" /* safer than doing strcat unprotected */ @@ -218,7 +220,10 @@ _ger_parse_control ( { aclutil_str_append ( errbuf, "get-effective-rights: missing subject" ); slapi_log_error (SLAPI_LOG_FATAL, plugin_name, "%s\n", *errbuf ); - return LDAP_INVALID_SYNTAX; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_INVALID_SYNTAX; } if ( strncasecmp ( "dn:", subjectber->bv_val, 3 ) == 0 ) @@ -239,7 +244,10 @@ _ger_parse_control ( { aclutil_str_append ( errbuf, "get-effective-rights: ber_init failed for the subject" ); slapi_log_error (SLAPI_LOG_FATAL, plugin_name, "%s\n", *errbuf ); - return LDAP_OPERATIONS_ERROR; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_OPERATIONS_ERROR; } /* "a" means to allocate storage as needed for octet string */ if ( ber_scanf (ber, "a", &orig) == LBER_ERROR ) @@ -247,7 +255,10 @@ _ger_parse_control ( aclutil_str_append ( errbuf, "get-effective-rights: invalid ber tag in the subject" ); slapi_log_error (SLAPI_LOG_FATAL, plugin_name, "%s\n", *errbuf ); ber_free ( ber, 1 ); - return LDAP_INVALID_SYNTAX; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_INVALID_SYNTAX; } ber_free ( ber, 1 ); } @@ -263,7 +274,10 @@ _ger_parse_control ( aclutil_str_append ( errbuf, "get-effective-rights: subject is not dnAuthzId" ); slapi_log_error (SLAPI_LOG_FATAL, plugin_name, "%s\n", *errbuf ); slapi_ch_free_string(&orig); - return LDAP_INVALID_SYNTAX; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_INVALID_SYNTAX; } /* memmove is safe for overlapping copy */ @@ -273,7 +287,10 @@ _ger_parse_control ( aclutil_str_append (errbuf, orig); slapi_log_error (SLAPI_LOG_FATAL, plugin_name, "%s\n", *errbuf); slapi_ch_free_string(&orig); - return LDAP_INVALID_SYNTAX; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_INVALID_SYNTAX; } slapi_ch_free_string(&orig); *subjectndn = normed; @@ -1023,7 +1040,7 @@ acl_get_effective_rights ( char *gerstr = NULL; size_t gerstrsize = 0; size_t gerstrcap = 0; - int iscritical = 1; + int iscritical = 0; /* critical may be missing or false http://tools.ietf.org/html/draft-ietf-ldapext-acl-model-08 */ int rc = LDAP_SUCCESS; *errbuf = '\0'; diff --git a/ldap/servers/plugins/chainingdb/cb_utils.c b/ldap/servers/plugins/chainingdb/cb_utils.c index f28f5d3..f35943b 100644 --- a/ldap/servers/plugins/chainingdb/cb_utils.c +++ b/ldap/servers/plugins/chainingdb/cb_utils.c @@ -160,21 +160,30 @@ int cb_forward_operation(Slapi_PBlock * pb ) { if ((ber = ber_init(ctl_value)) == NULL) { slapi_log_error(SLAPI_LOG_PLUGIN, CB_PLUGIN_SUBSYSTEM, "cb_forward_operation: ber_init: Memory allocation failed"); - return LDAP_NO_MEMORY; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_NO_MEMORY; } rc = ber_scanf(ber,"i",&hops); if (LBER_ERROR == rc) { slapi_log_error(SLAPI_LOG_PLUGIN, CB_PLUGIN_SUBSYSTEM, "Loop detection control badly encoded."); ber_free(ber,1); - return LDAP_LOOP_DETECT; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_LOOP_DETECT; } if (hops <= 0) { slapi_log_error(SLAPI_LOG_PLUGIN, CB_PLUGIN_SUBSYSTEM, "Max hop count exceeded. Loop detected.\n"); ber_free(ber,1); - return LDAP_LOOP_DETECT; + if (iscritical) + return LDAP_UNAVAILABLE_CRITICAL_EXTENSION; /* RFC 4511 4.1.11 */ + else + return LDAP_LOOP_DETECT; } ber_free(ber,1); } diff --git a/ldap/servers/plugins/deref/deref.c b/ldap/servers/plugins/deref/deref.c index aec48ed..2601170 100644 --- a/ldap/servers/plugins/deref/deref.c +++ b/ldap/servers/plugins/deref/deref.c @@ -395,6 +395,9 @@ deref_parse_ctrl_value(DerefSpecList *speclist, const struct berval *ctrlbv, int len = -1; /* reset */ if ((LBER_ERROR == ber_scanf(ber, "{a{v}}", &derefattr, &attrs)) || !derefattr || !attrs || !attrs[0]){ + if (critical) + *ldapcode = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; + else *ldapcode = LDAP_PROTOCOL_ERROR; if (!derefattr) { *ldaperrtext = "Missing dereference attribute name"; @@ -442,6 +445,7 @@ deref_pre_search(Slapi_PBlock *pb) const char *incompatible = NULL; DerefSpecList *speclist = NULL; int ii; + int iscritical = 0; slapi_log_error(SLAPI_LOG_TRACE, DEREF_PLUGIN_SUBSYSTEM, "--> deref_pre_search\n"); @@ -463,18 +467,22 @@ deref_pre_search(Slapi_PBlock *pb) "No control value specified for dereference control\n"); ldapcode = LDAP_PROTOCOL_ERROR; ldaperrtext = "The dereference control must have a value"; + iscritical = ctrl->ldctl_iscritical; } else if (!ctrl->ldctl_value.bv_val) { slapi_log_error(SLAPI_LOG_FATAL, DEREF_PLUGIN_SUBSYSTEM, "No control value specified for dereference control\n"); ldapcode = LDAP_PROTOCOL_ERROR; ldaperrtext = "The dereference control must have a value"; + iscritical = ctrl->ldctl_iscritical; } else if (!ctrl->ldctl_value.bv_val[0] || !ctrl->ldctl_value.bv_len) { slapi_log_error(SLAPI_LOG_FATAL, DEREF_PLUGIN_SUBSYSTEM, "Empty control value specified for dereference control\n"); ldapcode = LDAP_PROTOCOL_ERROR; ldaperrtext = "The dereference control must have a non-empty value"; + iscritical = ctrl->ldctl_iscritical; } else { derefctrl = ctrl; + iscritical = ctrl->ldctl_iscritical; } } else if (deref_incompatible_ctrl(ctrl->ldctl_oid)) { incompatible = ctrl->ldctl_oid; @@ -509,6 +517,9 @@ deref_pre_search(Slapi_PBlock *pb) } if (ldapcode != LDAP_SUCCESS) { + if (iscritical) { + ldapcode = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; + } slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &ldapcode); slapi_send_ldap_result(pb, ldapcode, NULL, (char *)ldaperrtext, 0, NULL); delete_DerefSpecList(&speclist); diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c index 5f085f9..70a2ee3 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_search.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c @@ -43,6 +43,8 @@ /* search.c - ldbm backend search function */ /* view with ts=4 */ +#include <ldap.h> + #include "back-ldbm.h" #include "vlv_srch.h" @@ -391,18 +393,36 @@ ldbm_back_search( Slapi_PBlock *pb ) if ( NULL != controls ) { /* Are we being asked to sort the results ? */ - sort = slapi_control_present( controls, LDAP_CONTROL_SORTREQUEST, &sort_spec, &is_sorting_critical_orig ); + sort = slapi_control_present(controls, LDAP_CONTROL_SORTREQUEST, &sort_spec, &is_sorting_critical_orig); if(sort) { rc = parse_sort_spec(sort_spec, &sort_control); if (rc) { /* Badly formed SORT control */ - return ldbm_back_search_cleanup(pb, li, sort_control, - LDAP_PROTOCOL_ERROR, "Sort Control", + if (is_sorting_critical_orig) { + /* RFC 4511 4.1.11 the server must not process the operation + * and return LDAP_UNAVAILABLE_CRITICAL_EXTENSION + */ + return ldbm_back_search_cleanup(pb, li, sort_control, + LDAP_UNAVAILABLE_CRITICAL_EXTENSION, "Sort Control", SLAPI_FAIL_GENERAL, NULL, NULL); + } else { + PRUint64 conn_id; + int op_id; + + /* Just ignore the control */ + sort = 0; + slapi_pblock_get(pb, SLAPI_CONN_ID, &conn_id); + slapi_pblock_get(pb, SLAPI_OPERATION_ID, &op_id); + + LDAPDebug(LDAP_DEBUG_ANY, + "Warning: Sort control ignored for conn=%d op=%d\n", + conn_id, op_id, 0); + } + } else { + /* set this operation includes the server side sorting */ + operation->o_flags |= OP_FLAG_SERVER_SIDE_SORTING; } - /* set this operation includes the server side sorting */ - operation->o_flags |= OP_FLAG_SERVER_SIDE_SORTING; } is_sorting_critical = is_sorting_critical_orig; @@ -414,36 +434,55 @@ ldbm_back_search( Slapi_PBlock *pb ) rc = vlv_parse_request_control( be, vlv_spec, &vlv_request_control ); if (rc != LDAP_SUCCESS) { /* Badly formed VLV control */ - return ldbm_back_search_cleanup(pb, li, sort_control, - rc, "VLV Control", SLAPI_FAIL_GENERAL, + if (is_vlv_critical) { + /* RFC 4511 4.1.11 the server must not process the operation + * and return LDAP_UNAVAILABLE_CRITICAL_EXTENSION + */ + return ldbm_back_search_cleanup(pb, li, sort_control, + LDAP_UNAVAILABLE_CRITICAL_EXTENSION, "VLV Control", SLAPI_FAIL_GENERAL, &vlv_request_control, NULL); - } - { - /* Access Control Check to see if the client is allowed to use the VLV Control. */ - Slapi_Entry *feature; - char dn[128]; - char *dummyAttr = "dummy#attr"; - char *dummyAttrs[2] = { NULL, NULL }; - - dummyAttrs[0] = dummyAttr; - - /* This dn is normalized. */ - PR_snprintf(dn,sizeof(dn),"dn: oid=%s,cn=features,cn=config",LDAP_CONTROL_VLVREQUEST); - feature= slapi_str2entry(dn,0); - rc = plugin_call_acl_plugin (pb, feature, dummyAttrs, NULL, SLAPI_ACL_READ, ACLPLUGIN_ACCESS_DEFAULT, NULL); - slapi_entry_free(feature); - if (rc != LDAP_SUCCESS) { - /* Client isn't allowed to do this. */ - return ldbm_back_search_cleanup(pb, li, sort_control, - rc, "VLV Control", SLAPI_FAIL_GENERAL, + } else { + PRUint64 conn_id; + int op_id; + + /* Just ignore the control */ + virtual_list_view = 0; + slapi_pblock_get(pb, SLAPI_CONN_ID, &conn_id); + slapi_pblock_get(pb, SLAPI_OPERATION_ID, &op_id); + + LDAPDebug(LDAP_DEBUG_ANY, + "Warning: VLV control ignored for conn=%d op=%d\n", + conn_id, op_id, 0); + } + + } else { + { + /* Access Control Check to see if the client is allowed to use the VLV Control. */ + Slapi_Entry *feature; + char dn[128]; + char *dummyAttr = "dummy#attr"; + char *dummyAttrs[2] = {NULL, NULL}; + + dummyAttrs[0] = dummyAttr; + + /* This dn is normalized. */ + PR_snprintf(dn, sizeof (dn), "dn: oid=%s,cn=features,cn=config", LDAP_CONTROL_VLVREQUEST); + feature = slapi_str2entry(dn, 0); + rc = plugin_call_acl_plugin(pb, feature, dummyAttrs, NULL, SLAPI_ACL_READ, ACLPLUGIN_ACCESS_DEFAULT, NULL); + slapi_entry_free(feature); + if (rc != LDAP_SUCCESS) { + /* Client isn't allowed to do this. */ + return ldbm_back_search_cleanup(pb, li, sort_control, + rc, "VLV Control", SLAPI_FAIL_GENERAL, &vlv_request_control, NULL); + } } + /* + * Sorting must always be critical for VLV; Force it be so. + */ + is_sorting_critical = 1; + virtual_list_view = 1; } - /* - * Sorting must always be critical for VLV; Force it be so. - */ - is_sorting_critical= 1; - virtual_list_view= 1; } else { diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c index 747b634..42b0935 100644 --- a/ldap/servers/slapd/opshared.c +++ b/ldap/servers/slapd/opshared.c @@ -431,7 +431,10 @@ op_shared_search (Slapi_PBlock *pb, int send_result) if ((ctl_value->bv_len == 0) || (ctl_value->bv_val == NULL)) { rc = -1; - send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL); + if (iscritical) + send_ldap_result(pb, LDAP_UNAVAILABLE_CRITICAL_EXTENSION, NULL, NULL, 0, NULL); + else + send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL); goto free_and_return_nolock; } else @@ -440,7 +443,10 @@ op_shared_search (Slapi_PBlock *pb, int send_result) if (be_name == NULL) { rc = -1; - send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL); + if (iscritical) + send_ldap_result(pb, LDAP_UNAVAILABLE_CRITICAL_EXTENSION, NULL, NULL, 0, NULL); + else + send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL); goto free_and_return_nolock; } } @@ -496,7 +502,7 @@ op_shared_search (Slapi_PBlock *pb, int send_result) } else { /* parse paged-results-control failed */ if (iscritical) { /* return an error since it's critical */ - send_ldap_result(pb, rc, NULL, + send_ldap_result(pb, LDAP_UNAVAILABLE_CRITICAL_EXTENSION, NULL, "Simple Paged Results Search failed", 0, NULL); goto free_and_return; diff --git a/ldap/servers/slapd/proxyauth.c b/ldap/servers/slapd/proxyauth.c index 562ac93..817adce 100644 --- a/ldap/servers/slapd/proxyauth.c +++ b/ldap/servers/slapd/proxyauth.c @@ -40,6 +40,8 @@ # include <config.h> #endif +#include <ldap.h> + #include "slap.h" #define BEGIN do { @@ -219,14 +221,19 @@ proxyauth_get_dn( Slapi_PBlock *pb, char **proxydnp, char **errtextp ) rv = parse_LDAPProxyAuth(spec_ber, version, errtextp, &spec); if (LDAP_SUCCESS != rv) { if ( critical ) { - lderr = rv; - } + lderr = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; + } else { + lderr = rv; + } break; } dn = slapi_ch_strdup(spec->auth_dn); if (slapi_dn_isroot(dn) ) { - lderr = LDAP_UNWILLING_TO_PERFORM; + if (critical) + lderr = LDAP_UNAVAILABLE_CRITICAL_EXTENSION; + else + lderr = LDAP_UNWILLING_TO_PERFORM; *errtextp = "Proxy dn should not be rootdn"; break;

1 0

Branch '389-ds-base-1.2.11' - ldap/servers
by Mark Reynolds 21 Mar '13

21 Mar '13

ldap/servers/plugins/replication/repl5_replica_config.c | 106 +++++++++++----- 1 file changed, 75 insertions(+), 31 deletions(-) New commits: commit 3d9bd35d4ef0aefaaeda5925dff37f1937df24c4 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Mar 19 15:17:51 2013 -0400 Ticket 623 - cleanAllRUV task fails to cleanup config upon completion Bug Description: Since multiple tasks can be run at once. When a task completes we need to remove a attribute from the replication configuration. We were manually building the attribute value, and under certain circumstances this would not work correctly. This would leave the attribute in the replication config, and after a restart the task would fire off again. Fix Description: Do not manually build the attribute value, but instead search cn=config and grab the exact value we need to delete. https://fedorahosted.org/389/ticket/623 Reviewed by: nhosoi(Thanks!) (cherry picked from commit fa7972a5f01be7cedcd65c4c19af9602d2f7848f) diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c index e234c15..8710c04 100644 --- a/ldap/servers/plugins/replication/repl5_replica_config.c +++ b/ldap/servers/plugins/replication/repl5_replica_config.c @@ -2351,57 +2351,100 @@ delete_aborted_rid(Replica *r, ReplicaId rid, char *repl_root, int skip){ static void delete_cleaned_rid_config(cleanruv_data *clean_data) { - Slapi_PBlock *pb; + Slapi_PBlock *pb = slapi_pblock_new(); + Slapi_Entry **entries = NULL; LDAPMod *mods[2]; LDAPMod mod; struct berval *vals[2]; struct berval val; char data[CSN_STRSIZE + 15]; char *csnstr = NULL; + char *iter = NULL; char *dn; - int rc; + int found = 0, i; + int rc, ret, rid; /* - * Prepare the mods for the config entry + * If there is no maxcsn, set the proper csnstr */ csn_as_string(clean_data->maxcsn, PR_FALSE, csnstr); - val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", (int)clean_data->rid, csnstr, clean_data->force); + if(csnstr == NULL || csn_get_replicaid(clean_data->maxcsn) == 0){ + csnstr = slapi_ch_strdup("00000000000000000000"); + } + /* + * Search the config for the exact attribute value to delete + */ dn = replica_get_dn(clean_data->replica); - pb = slapi_pblock_new(); + slapi_search_internal_set_pb(pb, dn, LDAP_SCOPE_SUBTREE, "nsds5ReplicaCleanRUV=*", NULL, 0, NULL, NULL, + (void *)plugin_get_default_component_id(), 0); + slapi_search_internal_pb(pb); + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &ret); + if (ret != LDAP_SUCCESS){ + /* + * Search failed, manually build the attr value + */ + val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", + (int)clean_data->rid, csnstr, clean_data->force); + slapi_pblock_destroy(pb); + } else { + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries); + if (entries == NULL || entries[0] == NULL){ + /* + * Entry not found, manually build the attr value + */ + val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", + (int)clean_data->rid, csnstr, clean_data->force); + } else { + char **attr_val = slapi_entry_attr_get_charray(entries[0], "nsds5ReplicaCleanRUV"); + + for (i = 0; attr_val && attr_val[i] && !found; i++){ + /* make a copy to retain the full value after toking */ + char *aval = slapi_ch_strdup(attr_val[i]); + + rid = atoi(ldap_utf8strtok_r(attr_val[i], ":", &iter)); + if(rid == clean_data->rid){ + /* found it */ + found = 1; + val.bv_len = PR_snprintf(data, sizeof(data), "%s", aval); + } + slapi_ch_free_string(&aval); + } + if(!found){ + /* + * No match, manually build the attr value + */ + val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", + (int)clean_data->rid, csnstr, clean_data->force); + } + slapi_ch_array_free(attr_val); + } + slapi_free_search_results_internal(pb); + slapi_pblock_destroy(pb); + } + + /* + * Now delete the attribute + */ mod.mod_op = LDAP_MOD_DELETE|LDAP_MOD_BVALUES; - mod.mod_type = (char *)type_replicaAbortCleanRUV; mod.mod_type = (char *)type_replicaCleanRUV; mod.mod_bvalues = vals; vals [0] = &val; vals [1] = NULL; val.bv_val = data; - mods[0] = &mod; mods[1] = NULL; + pb = slapi_pblock_new(); slapi_modify_internal_set_pb(pb, dn, mods, NULL, NULL, repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0); slapi_modify_internal_pb (pb); slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); - if (rc != LDAP_SUCCESS){ - /* - * When aborting a task, we don't know if the "force" option was used. - * So we assume it is set to "no", but if this op fails, we'll try "yes" - */ - slapi_pblock_destroy (pb); - pb = slapi_pblock_new(); - memset(data,'0',sizeof(data)); - val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:yes", (int)clean_data->rid, csnstr); - slapi_modify_internal_set_pb(pb, dn, mods, NULL, NULL, repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0); - slapi_modify_internal_pb (pb); - slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); - if (rc != LDAP_SUCCESS && rc != LDAP_NO_SUCH_OBJECT){ - slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: failed to remove replica config " - "(%d), rid (%d)\n", rc, clean_data->rid); - } - } - slapi_pblock_destroy (pb); - slapi_ch_free_string(&dn); - slapi_ch_free_string(&csnstr); - } + if (rc != LDAP_SUCCESS && rc != LDAP_NO_SUCH_OBJECT){ + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: failed to remove replica config " + "(%d), rid (%d)\n", rc, clean_data->rid); + } + slapi_pblock_destroy(pb); + slapi_ch_free_string(&dn); + slapi_ch_free_string(&csnstr); +} /* * Remove the rid from our list, and the config @@ -2762,8 +2805,8 @@ replica_cleanallruv_send_extop(Repl_Agmt *ra, cleanruv_data *clean_data, int che /* extop was accepted */ rc = 0; } else { - cleanruv_log(clean_data->task, CLEANALLRUV_ID,"Replica %s does not support the CLEANALLRUV task. Sending replica CLEANRUV task...", - slapi_sdn_get_dn(agmt_get_dn_byref(ra))); + cleanruv_log(clean_data->task, CLEANALLRUV_ID,"Replica %s does not support the CLEANALLRUV task. " + "Sending replica CLEANRUV task...", slapi_sdn_get_dn(agmt_get_dn_byref(ra))); /* * Ok, this replica doesn't know about CLEANALLRUV, so just manually * add the CLEANRUV task to the replica. @@ -2841,7 +2884,8 @@ replica_cleanallruv_find_maxcsn(Replica *replica, ReplicaId rid, char *basedn) /* we could not find any maxcsn's - already cleaned? */ return NULL; } - slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: replica_cleanallruv_find_maxcsn: Not all replicas online, retrying in %d seconds\n",interval); + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: replica_cleanallruv_find_maxcsn: " + "Not all replicas online, retrying in %d seconds\n", interval); PR_Lock( notify_lock ); PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) ); PR_Unlock( notify_lock );

1 0

Branch '389-ds-base-1.3.0' - ldap/servers
by Mark Reynolds 21 Mar '13

21 Mar '13

ldap/servers/plugins/replication/repl5_replica_config.c | 106 +++++++++++----- 1 file changed, 75 insertions(+), 31 deletions(-) New commits: commit a3781554b761d2687fb2438530a032f2a209e3e6 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Mar 19 15:17:51 2013 -0400 Ticket 623 - cleanAllRUV task fails to cleanup config upon completion Bug Description: Since multiple tasks can be run at once. When a task completes we need to remove a attribute from the replication configuration. We were manually building the attribute value, and under certain circumstances this would not work correctly. This would leave the attribute in the replication config, and after a restart the task would fire off again. Fix Description: Do not manually build the attribute value, but instead search cn=config and grab the exact value we need to delete. https://fedorahosted.org/389/ticket/623 Reviewed by: nhosoi(Thanks!) (cherry picked from commit fa7972a5f01be7cedcd65c4c19af9602d2f7848f) diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c index aef9c13..f683ed0 100644 --- a/ldap/servers/plugins/replication/repl5_replica_config.c +++ b/ldap/servers/plugins/replication/repl5_replica_config.c @@ -2351,57 +2351,100 @@ delete_aborted_rid(Replica *r, ReplicaId rid, char *repl_root, int skip){ static void delete_cleaned_rid_config(cleanruv_data *clean_data) { - Slapi_PBlock *pb; + Slapi_PBlock *pb = slapi_pblock_new(); + Slapi_Entry **entries = NULL; LDAPMod *mods[2]; LDAPMod mod; struct berval *vals[2]; struct berval val; char data[CSN_STRSIZE + 15]; char *csnstr = NULL; + char *iter = NULL; char *dn; - int rc; + int found = 0, i; + int rc, ret, rid; /* - * Prepare the mods for the config entry + * If there is no maxcsn, set the proper csnstr */ csn_as_string(clean_data->maxcsn, PR_FALSE, csnstr); - val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", (int)clean_data->rid, csnstr, clean_data->force); + if(csnstr == NULL || csn_get_replicaid(clean_data->maxcsn) == 0){ + csnstr = slapi_ch_strdup("00000000000000000000"); + } + /* + * Search the config for the exact attribute value to delete + */ dn = replica_get_dn(clean_data->replica); - pb = slapi_pblock_new(); + slapi_search_internal_set_pb(pb, dn, LDAP_SCOPE_SUBTREE, "nsds5ReplicaCleanRUV=*", NULL, 0, NULL, NULL, + (void *)plugin_get_default_component_id(), 0); + slapi_search_internal_pb(pb); + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &ret); + if (ret != LDAP_SUCCESS){ + /* + * Search failed, manually build the attr value + */ + val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", + (int)clean_data->rid, csnstr, clean_data->force); + slapi_pblock_destroy(pb); + } else { + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries); + if (entries == NULL || entries[0] == NULL){ + /* + * Entry not found, manually build the attr value + */ + val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", + (int)clean_data->rid, csnstr, clean_data->force); + } else { + char **attr_val = slapi_entry_attr_get_charray(entries[0], "nsds5ReplicaCleanRUV"); + + for (i = 0; attr_val && attr_val[i] && !found; i++){ + /* make a copy to retain the full value after toking */ + char *aval = slapi_ch_strdup(attr_val[i]); + + rid = atoi(ldap_utf8strtok_r(attr_val[i], ":", &iter)); + if(rid == clean_data->rid){ + /* found it */ + found = 1; + val.bv_len = PR_snprintf(data, sizeof(data), "%s", aval); + } + slapi_ch_free_string(&aval); + } + if(!found){ + /* + * No match, manually build the attr value + */ + val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:%s", + (int)clean_data->rid, csnstr, clean_data->force); + } + slapi_ch_array_free(attr_val); + } + slapi_free_search_results_internal(pb); + slapi_pblock_destroy(pb); + } + + /* + * Now delete the attribute + */ mod.mod_op = LDAP_MOD_DELETE|LDAP_MOD_BVALUES; - mod.mod_type = (char *)type_replicaAbortCleanRUV; mod.mod_type = (char *)type_replicaCleanRUV; mod.mod_bvalues = vals; vals [0] = &val; vals [1] = NULL; val.bv_val = data; - mods[0] = &mod; mods[1] = NULL; + pb = slapi_pblock_new(); slapi_modify_internal_set_pb(pb, dn, mods, NULL, NULL, repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0); slapi_modify_internal_pb (pb); slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); - if (rc != LDAP_SUCCESS){ - /* - * When aborting a task, we don't know if the "force" option was used. - * So we assume it is set to "no", but if this op fails, we'll try "yes" - */ - slapi_pblock_destroy (pb); - pb = slapi_pblock_new(); - memset(data,'0',sizeof(data)); - val.bv_len = PR_snprintf(data, sizeof(data), "%d:%s:yes", (int)clean_data->rid, csnstr); - slapi_modify_internal_set_pb(pb, dn, mods, NULL, NULL, repl_get_plugin_identity (PLUGIN_MULTIMASTER_REPLICATION), 0); - slapi_modify_internal_pb (pb); - slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); - if (rc != LDAP_SUCCESS && rc != LDAP_NO_SUCH_OBJECT){ - slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: failed to remove replica config " - "(%d), rid (%d)\n", rc, clean_data->rid); - } - } - slapi_pblock_destroy (pb); - slapi_ch_free_string(&dn); - slapi_ch_free_string(&csnstr); - } + if (rc != LDAP_SUCCESS && rc != LDAP_NO_SUCH_OBJECT){ + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: failed to remove replica config " + "(%d), rid (%d)\n", rc, clean_data->rid); + } + slapi_pblock_destroy(pb); + slapi_ch_free_string(&dn); + slapi_ch_free_string(&csnstr); +} /* * Remove the rid from our list, and the config @@ -2762,8 +2805,8 @@ replica_cleanallruv_send_extop(Repl_Agmt *ra, cleanruv_data *clean_data, int che /* extop was accepted */ rc = 0; } else { - cleanruv_log(clean_data->task, CLEANALLRUV_ID,"Replica %s does not support the CLEANALLRUV task. Sending replica CLEANRUV task...", - slapi_sdn_get_dn(agmt_get_dn_byref(ra))); + cleanruv_log(clean_data->task, CLEANALLRUV_ID,"Replica %s does not support the CLEANALLRUV task. " + "Sending replica CLEANRUV task...", slapi_sdn_get_dn(agmt_get_dn_byref(ra))); /* * Ok, this replica doesn't know about CLEANALLRUV, so just manually * add the CLEANRUV task to the replica. @@ -2841,7 +2884,8 @@ replica_cleanallruv_find_maxcsn(Replica *replica, ReplicaId rid, char *basedn) /* we could not find any maxcsn's - already cleaned? */ return NULL; } - slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: replica_cleanallruv_find_maxcsn: Not all replicas online, retrying in %d seconds\n",interval); + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "CleanAllRUV Task: replica_cleanallruv_find_maxcsn: " + "Not all replicas online, retrying in %d seconds\n", interval); PR_Lock( notify_lock ); PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) ); PR_Unlock( notify_lock );

1 0

ldap/schema ldap/servers
by Mark Reynolds 21 Mar '13

21 Mar '13

ldap/schema/01core389.ldif | 6 ldap/servers/plugins/replication/repl5.h | 6 ldap/servers/plugins/replication/repl5_inc_protocol.c | 62 ++- ldap/servers/plugins/replication/repl5_prot_private.h | 4 ldap/servers/plugins/replication/repl5_replica.c | 295 ++++++++-------- ldap/servers/plugins/replication/repl_globals.c | 2 ldap/servers/plugins/replication/windows_inc_protocol.c | 20 - 7 files changed, 239 insertions(+), 156 deletions(-) New commits: commit 41d95f84b1a69cd1f887beb86ac8620d8e3032b8 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Thu Mar 21 15:34:00 2013 -0400 Ticket 525 - Introducing a user visible configuration variable for controlling replication retry time RFE Description: The current replication backoff timer is hardcoded to have a minimum of 3 seconds, and a max of 300 seconds. Added two new config attributes to the replication config: nsds5ReplicaBackoffMin nsds5ReplicaBackoffMax https://fedorahosted.org/389/ticket/525 Reviewed by: nhosoi(Thanks!) diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif index befd3fa..ed25bd8 100644 --- a/ldap/schema/01core389.ldif +++ b/ldap/schema/01core389.ldif @@ -149,7 +149,9 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2148 NAME 'rootdn-deny-host' DESC 'Netsc attributeTypes: ( 2.16.840.1.113730.3.1.2149 NAME 'rootdn-allow-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2150 NAME 'rootdn-deny-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2151 NAME 'nsslapd-plugin-depends-on-type' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) -attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2154 NAME 'nsds5ReplicaBackoffMin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2155 NAME 'nsds5ReplicaBackoffMax' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) # # objectclasses # @@ -159,7 +161,7 @@ objectClasses: ( 2.16.840.1.113730.3.2.44 NAME 'nsIndex' DESC 'Netscape defined objectClasses: ( 2.16.840.1.113730.3.2.109 NAME 'nsBackendInstance' DESC 'Netscape defined objectclass' SUP top MUST ( CN ) X-ORIGIN 'Netscape Directory Server' ) objectClasses: ( 2.16.840.1.113730.3.2.110 NAME 'nsMappingTree' DESC 'Netscape defined objectclass' SUP top MUST ( CN ) X-ORIGIN 'Netscape Directory Server' ) objectClasses: ( 2.16.840.1.113730.3.2.104 NAME 'nsContainer' DESC 'Netscape defined objectclass' SUP top MUST ( CN ) X-ORIGIN 'Netscape Directory Server' ) -objectClasses: ( 2.16.840.1.113730.3.2.108 NAME 'nsDS5Replica' DESC 'Netscape defined objectclass' SUP top MUST ( nsDS5ReplicaRoot $ nsDS5ReplicaId ) MAY (cn $ nsds5ReplicaCleanRUV $ nsds5ReplicaAbortCleanRUV $ nsDS5ReplicaType $ nsDS5ReplicaBindDN $ nsState $ nsDS5ReplicaName $ nsDS5Flags $ nsDS5Task $ nsDS5ReplicaReferral $ nsDS5ReplicaAutoReferral $ nsds5ReplicaPurgeDelay $ nsds5ReplicaTombstonePurgeInterval $ nsds5ReplicaChangeCount $ nsds5ReplicaLegacyConsumer $ nsds5ReplicaProtocolTimeout ) X-ORIGIN 'Netscape Directory Server' ) +objectClasses: ( 2.16.840.1.113730.3.2.108 NAME 'nsDS5Replica' DESC 'Netscape defined objectclass' SUP top MUST ( nsDS5ReplicaRoot $ nsDS5ReplicaId ) MAY (cn $ nsds5ReplicaCleanRUV $ nsds5ReplicaAbortCleanRUV $ nsDS5ReplicaType $ nsDS5ReplicaBindDN $ nsState $ nsDS5ReplicaName $ nsDS5Flags $ nsDS5Task $ nsDS5ReplicaReferral $ nsDS5ReplicaAutoReferral $ nsds5ReplicaPurgeDelay $ nsds5ReplicaTombstonePurgeInterval $ nsds5ReplicaChangeCount $ nsds5ReplicaLegacyConsumer $ nsds5ReplicaProtocolTimeout $ nsds5ReplicaBackoffMin $ nsds5ReplicaBackoffMax ) X-ORIGIN 'Netscape Directory Server' ) objectClasses: ( 2.16.840.1.113730.3.2.113 NAME 'nsTombstone' DESC 'Netscape defined objectclass' SUP top MAY ( nsParentUniqueId $ nscpEntryDN ) X-ORIGIN 'Netscape Directory Server' ) objectClasses: ( 2.16.840.1.113730.3.2.103 NAME 'nsDS5ReplicationAgreement' DESC 'Netscape defined objectclass' SUP top MUST ( cn ) MAY ( nsds5ReplicaCleanRUVNotified $ nsDS5ReplicaHost $ nsDS5ReplicaPort $ nsDS5ReplicaTransportInfo $ nsDS5ReplicaBindDN $ nsDS5ReplicaCredentials $ nsDS5ReplicaBindMethod $ nsDS5ReplicaRoot $ nsDS5ReplicatedAttributeList $ nsDS5ReplicatedAttributeListTotal $ nsDS5ReplicaUpdateSchedule $ nsds5BeginReplicaRefresh $ description $ nsds50ruv $ nsruvReplicaLastModified $ nsds5ReplicaTimeout $ nsds5replicaChangesSentSinceStartup $ nsds5replicaLastUpdateEnd $ nsds5replicaLastUpdateStart $ nsds5replicaLastUpdateStatus $ nsds5replicaUpdateInProgress $ nsds5replicaLastInitEnd $ nsds5ReplicaEnabled $ nsds5replicaLastInitStart $ nsds5replicaLastInitStatus $ nsds5debugreplicatimeout $ nsds5replicaBusyWaitTime $ nsds5ReplicaStripAttrs $ nsds5replicaSessionPauseTime $ nsds5ReplicaProtocolTimeout ) X-ORIGIN 'Netscape Directory Server' ) objectClasses: ( 2.16.840.1.113730.3.2.39 NAME 'nsslapdConfig' DESC 'Netscape defined objectclass' SUP top MAY ( cn ) X-ORIGIN 'Netscape Directory Server' ) diff --git a/ldap/servers/plugins/replication/repl5.h b/ldap/servers/plugins/replication/repl5.h index 3031c69..92e7ac4 100644 --- a/ldap/servers/plugins/replication/repl5.h +++ b/ldap/servers/plugins/replication/repl5.h @@ -169,6 +169,8 @@ extern const char *type_nsds5ReplicaEnabled; extern const char *type_nsds5ReplicaStripAttrs; extern const char *type_nsds5ReplicaCleanRUVnotified; extern const char *type_replicaProtocolTimeout; +extern const char *type_replicaBackoffMin; +extern const char *type_replicaBackoffMax; /* Attribute names for windows replication agreements */ extern const char *type_nsds7WindowsReplicaArea; @@ -594,6 +596,10 @@ void replica_check_for_tasks(Replica*r, Slapi_Entry *e); void replica_update_state (time_t when, void *arg); void replica_reset_csn_pl(Replica *r); int replica_get_protocol_timeout(Replica *r); +int replica_get_backoff_min(Replica *r); +int replica_get_backoff_max(Replica *r); +void replica_set_backoff_min(Replica *r, int min); +void replica_set_backoff_max(Replica *r, int max); /* The functions below handles the state flag */ /* Current internal state flags */ diff --git a/ldap/servers/plugins/replication/repl5_inc_protocol.c b/ldap/servers/plugins/replication/repl5_inc_protocol.c index 97f273e..c3d027b 100644 --- a/ldap/servers/plugins/replication/repl5_inc_protocol.c +++ b/ldap/servers/plugins/replication/repl5_inc_protocol.c @@ -179,7 +179,6 @@ static const char* event2name (int event); static const char* op2string (int op); static int repl5_inc_update_from_op_result(Private_Repl_Protocol *prp, ConnResult replay_crc, int connection_error, char *csn_str, char *uniqueid, ReplicaId replica_id, int* finished, PRUint32 *num_changes_sent); - /* Push a newly sent operation onto the tail of the list */ static void repl5_int_push_operation(result_data *rd, repl5_inc_operation *it) { @@ -261,7 +260,8 @@ repl5_inc_log_operation_failure(int operation_code, int ldap_error, char* ldap_e #endif /* Thread that collects results from async operations sent to the consumer */ -static void repl5_inc_result_threadmain(void *param) +static void +repl5_inc_result_threadmain(void *param) { result_data *rd = (result_data*) param; ConnResult conres = 0; @@ -529,12 +529,12 @@ repl5_inc_delete(Private_Repl_Protocol **prpp) /* helper function */ void -set_pause_and_busy_time(long *pausetime, long *busywaittime) +set_pause_and_busy_time(Private_Repl_Protocol *prp, long *pausetime, long *busywaittime) { /* If neither are set, set busy time to its default */ if (!*pausetime && !*busywaittime) { - *busywaittime = PROTOCOL_BUSY_BACKOFF_MINIMUM; + *busywaittime = repl5_get_backoff_min(prp); } /* pause time must be at least 1 more than the busy backoff time */ if (*pausetime && !*busywaittime) @@ -683,7 +683,7 @@ repl5_inc_run(Private_Repl_Protocol *prp) busywaittime = agmt_get_busywaittime(prp->agmt); if (pausetime || busywaittime){ /* helper function to make sure they are set correctly */ - set_pause_and_busy_time(&pausetime, &busywaittime); + set_pause_and_busy_time(prp, &pausetime, &busywaittime); } break; @@ -842,12 +842,12 @@ repl5_inc_run(Private_Repl_Protocol *prp) if (use_busy_backoff_timer){ /* we received a busy signal from the consumer, wait for a while */ if (!busywaittime){ - busywaittime = PROTOCOL_BUSY_BACKOFF_MINIMUM; + busywaittime = repl5_get_backoff_min(prp); } prp_priv->backoff = backoff_new(BACKOFF_FIXED, busywaittime, busywaittime); } else { - prp_priv->backoff = backoff_new(BACKOFF_EXPONENTIAL, PROTOCOL_BACKOFF_MINIMUM, - PROTOCOL_BACKOFF_MAXIMUM); + prp_priv->backoff = backoff_new(BACKOFF_EXPONENTIAL, repl5_get_backoff_min(prp), + repl5_get_backoff_max(prp)); } next_state = STATE_BACKOFF; backoff_reset(prp_priv->backoff, repl5_inc_backoff_expired, (void *)prp); @@ -2227,3 +2227,49 @@ op2string(int op) return "unknown"; } + +void +repl5_set_backoff_min(Private_Repl_Protocol *prp, int min) +{ + Replica *replica; + + replica = (Replica *)object_get_data(prp->replica_object); + if(replica){ + replica_set_backoff_min(replica, min); + } +} + +void +repl5_set_backoff_max(Private_Repl_Protocol *prp, int max) +{ + Replica *replica; + + replica = object_get_data(prp->replica_object); + if(replica){ + replica_set_backoff_max(replica, max); + } +} + +int +repl5_get_backoff_min(Private_Repl_Protocol *prp) +{ + Replica *replica; + + replica = object_get_data(prp->replica_object); + if(replica){ + return (int)replica_get_backoff_min(replica); + } + return PROTOCOL_BACKOFF_MINIMUM; +} + +int +repl5_get_backoff_max(Private_Repl_Protocol *prp) +{ + Replica *replica; + + replica = object_get_data(prp->replica_object); + if(replica){ + return (int)replica_get_backoff_max(replica); + } + return PROTOCOL_BACKOFF_MAXIMUM; +} diff --git a/ldap/servers/plugins/replication/repl5_prot_private.h b/ldap/servers/plugins/replication/repl5_prot_private.h index d4006f7..37072ee 100644 --- a/ldap/servers/plugins/replication/repl5_prot_private.h +++ b/ldap/servers/plugins/replication/repl5_prot_private.h @@ -108,5 +108,9 @@ char* protocol_response2string (int response); int repl5_strip_fractional_mods(Repl_Agmt *agmt, LDAPMod **); void windows_release_replica(Private_Repl_Protocol *prp); int windows_acquire_replica(Private_Repl_Protocol *prp, RUV **ruv, int check_ruv); +void repl5_set_backoff_min(Private_Repl_Protocol *prp, int min); +void repl5_set_backoff_max(Private_Repl_Protocol *prp, int max); +int repl5_get_backoff_min(Private_Repl_Protocol *prp); +int repl5_get_backoff_max(Private_Repl_Protocol *prp); #endif /* _REPL5_PROT_PRIVATE_H_ */ diff --git a/ldap/servers/plugins/replication/repl5_replica.c b/ldap/servers/plugins/replication/repl5_replica.c index 6d8b660..68dc8f7 100644 --- a/ldap/servers/plugins/replication/repl5_replica.c +++ b/ldap/servers/plugins/replication/repl5_replica.c @@ -82,12 +82,14 @@ struct replica { PRUint32 repl_purge_delay; /* When purgeable, CSNs are held on to for this many extra seconds */ PRBool tombstone_reap_stop; /* TRUE when the tombstone reaper should stop */ PRBool tombstone_reap_active; /* TRUE when the tombstone reaper is running */ - long tombstone_reap_interval; /* Time in seconds between tombstone reaping */ + long tombstone_reap_interval; /* Time in seconds between tombstone reaping */ Slapi_ValueSet *repl_referral; /* A list of administrator provided referral URLs */ PRBool state_update_inprogress; /* replica state is being updated */ - PRLock *agmt_lock; /* protects agreement creation, start and stop */ - char *locking_purl; /* supplier who has exclusive access */ - PRUint64 protocol_timeout; /* protocol shutdown timeout */ + PRLock *agmt_lock; /* protects agreement creation, start and stop */ + char *locking_purl; /* supplier who has exclusive access */ + PRUint64 protocol_timeout; /* protocol shutdown timeout */ + PRUint64 backoff_min; /* backoff retry minimum */ + PRUint64 backoff_max; /* backoff retry maximum */ }; @@ -1631,64 +1633,86 @@ _replica_check_validity (const Replica *r) static int _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext) { - int rc; - Slapi_Attr *attr; - char *val; - CSNGen *gen; + Slapi_Attr *a = NULL; + Slapi_Attr *attr; + CSNGen *gen; char buf [SLAPI_DSE_RETURNTEXT_SIZE]; char *errormsg = errortext? errortext : buf; - Slapi_Attr *a = NULL; + char *val; + int backoff_min; + int backoff_max; + int rc; - PR_ASSERT (r && e); + PR_ASSERT (r && e); /* get replica root */ - val = slapi_entry_attr_get_charptr (e, attr_replicaRoot); - if (val == NULL) - { + val = slapi_entry_attr_get_charptr (e, attr_replicaRoot); + if (val == NULL){ PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, "failed to retrieve %s attribute from (%s)\n", attr_replicaRoot, (char*)slapi_entry_get_dn ((Slapi_Entry*)e)); slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "_replica_init_from_config: %s\n", errormsg); - return -1; } r->repl_root = slapi_sdn_new_dn_passin (val); - /* get replica type */ + /* get replica type */ val = slapi_entry_attr_get_charptr (e, attr_replicaType); - if (val) - { + if (val){ r->repl_type = atoi(val); slapi_ch_free ((void**)&val); - } - else - { + } else { r->repl_type = REPLICA_TYPE_READONLY; } /* get legacy consumer flag */ val = slapi_entry_attr_get_charptr (e, type_replicaLegacyConsumer); - if (val) - { + if (val){ if (strcasecmp (val, "on") == 0 || strcasecmp (val, "yes") == 0 || strcasecmp (val, "true") == 0 || strcasecmp (val, "1") == 0) { r->legacy_consumer = PR_TRUE; - } - else - { + } else { r->legacy_consumer = PR_FALSE; } - slapi_ch_free ((void**)&val); - } - else - { + } else { r->legacy_consumer = PR_FALSE; } + /* grab and validate the backoff retry settings */ + backoff_min = slapi_entry_attr_get_int(e, type_replicaBackoffMin); + if(backoff_min <= 0){ + if (backoff_min != 0){ + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Invalid value for %s: %d Using default value (%d)\n", + type_replicaBackoffMin, backoff_min, PROTOCOL_BACKOFF_MINIMUM ); + } + backoff_min = PROTOCOL_BACKOFF_MINIMUM; + } + + backoff_max = slapi_entry_attr_get_int(e, type_replicaBackoffMax); + if(backoff_max <= 0){ + if(backoff_max != 0) { + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Invalid value for %s: %d Using default value (%d)\n", + type_replicaBackoffMax, backoff_max, PROTOCOL_BACKOFF_MAXIMUM ); + } + backoff_max = PROTOCOL_BACKOFF_MAXIMUM; + } + if(backoff_min > backoff_max){ + /* Ok these values are invalid, reset back the defaults */ + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Backoff minimum (%d) can not be greater than " + "the backoff maximum (%d). Using default values: min (%d) max (%d)\n", backoff_min, backoff_max, + PROTOCOL_BACKOFF_MINIMUM, PROTOCOL_BACKOFF_MAXIMUM); + r->backoff_min = PROTOCOL_BACKOFF_MINIMUM; + r->backoff_max = PROTOCOL_BACKOFF_MAXIMUM; + } else { + r->backoff_min = backoff_min; + r->backoff_max = backoff_max; + } + + /* get the protocol timeout */ r->protocol_timeout = slapi_entry_attr_get_int(e, type_replicaProtocolTimeout); if(r->protocol_timeout == 0){ r->protocol_timeout = DEFAULT_PROTOCOL_TIMEOUT; @@ -1697,131 +1721,108 @@ _replica_init_from_config (Replica *r, Slapi_Entry *e, char *errortext) /* get replica flags */ r->repl_flags = slapi_entry_attr_get_ulong(e, attr_flags); - /* get replicaid */ - /* the replica id is ignored for read only replicas and is set to the - special value READ_ONLY_REPLICA_ID */ - if (r->repl_type == REPLICA_TYPE_READONLY) - { - r->repl_rid = READ_ONLY_REPLICA_ID; - slapi_entry_attr_set_uint(e, attr_replicaId, (unsigned int)READ_ONLY_REPLICA_ID); - } - /* a replica id is required for updatable and primary replicas */ - else if (r->repl_type == REPLICA_TYPE_UPDATABLE || - r->repl_type == REPLICA_TYPE_PRIMARY) - { - if ((val = slapi_entry_attr_get_charptr (e, attr_replicaId))) - { - int temprid = atoi (val); - slapi_ch_free ((void**)&val); - if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID) - { - PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, - "attribute %s must have a value greater than 0 " - "and less than %d: entry %s", - attr_replicaId, READ_ONLY_REPLICA_ID, - (char*)slapi_entry_get_dn ((Slapi_Entry*)e)); - slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, - "_replica_init_from_config: %s\n", - errormsg); - return -1; - } - else - { - r->repl_rid = (ReplicaId)temprid; - } - } - else - { - PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, - "failed to retrieve required %s attribute from %s", - attr_replicaId, - (char*)slapi_entry_get_dn ((Slapi_Entry*)e)); - slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, - "_replica_init_from_config: %s\n", - errormsg); - return -1; - } - } + /* + * Get replicaid + * The replica id is ignored for read only replicas and is set to the + * special value READ_ONLY_REPLICA_ID + */ + if (r->repl_type == REPLICA_TYPE_READONLY){ + r->repl_rid = READ_ONLY_REPLICA_ID; + slapi_entry_attr_set_uint(e, attr_replicaId, (unsigned int)READ_ONLY_REPLICA_ID); + } + /* a replica id is required for updatable and primary replicas */ + else if (r->repl_type == REPLICA_TYPE_UPDATABLE || + r->repl_type == REPLICA_TYPE_PRIMARY) + { + if ((val = slapi_entry_attr_get_charptr (e, attr_replicaId))){ + int temprid = atoi (val); + slapi_ch_free ((void**)&val); + if (temprid <= 0 || temprid >= READ_ONLY_REPLICA_ID){ + PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, + "attribute %s must have a value greater than 0 " + "and less than %d: entry %s", + attr_replicaId, READ_ONLY_REPLICA_ID, + (char*)slapi_entry_get_dn ((Slapi_Entry*)e)); + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, + "_replica_init_from_config: %s\n", errormsg); + return -1; + } else { + r->repl_rid = (ReplicaId)temprid; + } + } else { + PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, + "failed to retrieve required %s attribute from %s", + attr_replicaId,(char*)slapi_entry_get_dn ((Slapi_Entry*)e)); + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, + "_replica_init_from_config: %s\n", errormsg); + return -1; + } + } - attr = NULL; - rc = slapi_entry_attr_find(e, attr_state, &attr); - gen = csngen_new (r->repl_rid, attr); - if (gen == NULL) - { + attr = NULL; + rc = slapi_entry_attr_find(e, attr_state, &attr); + gen = csngen_new (r->repl_rid, attr); + if (gen == NULL){ PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, - "failed to create csn generator for replica (%s)", - (char*)slapi_entry_get_dn ((Slapi_Entry*)e)); + "failed to create csn generator for replica (%s)", + (char*)slapi_entry_get_dn ((Slapi_Entry*)e)); slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, - "_replica_init_from_config: %s\n", - errormsg); - return -1; - } - r->repl_csngen = object_new((void*)gen, (FNFree)csngen_free); + "_replica_init_from_config: %s\n", errormsg); + return -1; + } + r->repl_csngen = object_new((void*)gen, (FNFree)csngen_free); - /* Hook generator so we can maintain min/max CSN info */ - r->csn_pl_reg_id = csngen_register_callbacks(gen, assign_csn_callback, r, abort_csn_callback, r); + /* Hook generator so we can maintain min/max CSN info */ + r->csn_pl_reg_id = csngen_register_callbacks(gen, assign_csn_callback, r, abort_csn_callback, r); - /* get replication bind dn */ - r->updatedn_list = replica_updatedn_list_new(e); + /* get replication bind dn */ + r->updatedn_list = replica_updatedn_list_new(e); /* get replica name */ val = slapi_entry_attr_get_charptr (e, attr_replicaName); if (val) { - r->repl_name = val; - } - else - { + r->repl_name = val; + } else { rc = slapi_uniqueIDGenerateString (&r->repl_name); - if (rc != UID_SUCCESS) - { + if (rc != UID_SUCCESS){ PR_snprintf (errormsg, SLAPI_DSE_RETURNTEXT_SIZE, - "failed to assign replica name for replica (%s); " - "uuid generator error - %d ", - (char*)slapi_entry_get_dn ((Slapi_Entry*)e), - rc); + "failed to assign replica name for replica (%s); uuid generator error - %d ", + (char*)slapi_entry_get_dn ((Slapi_Entry*)e), rc); slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "_replica_init_from_config: %s\n", - errormsg); + errormsg); return -1; - } - else + } else r->new_name = PR_TRUE; } - /* get the list of referrals */ - slapi_entry_attr_find( e, attr_replicaReferral, &attr ); - if(attr!=NULL) - { - slapi_attr_get_valueset(attr, &r->repl_referral); - } + /* get the list of referrals */ + slapi_entry_attr_find( e, attr_replicaReferral, &attr ); + if(attr!=NULL){ + slapi_attr_get_valueset(attr, &r->repl_referral); + } - /* - * Set the purge offset (default 7 days). This is the extra - * time we allow purgeable CSNs to stick around, in case a - * replica regresses. Could also be useful when LCUP happens, - * since we don't know about LCUP replicas, and they can just - * turn up whenever they want to. - */ - if (slapi_entry_attr_find(e, type_replicaPurgeDelay, &a) == -1) - { - /* No purge delay provided, so use default */ - r->repl_purge_delay = 60 * 60 * 24 * 7; /* One week, in seconds */ - } - else - { - r->repl_purge_delay = slapi_entry_attr_get_uint(e, type_replicaPurgeDelay); - } + /* + * Set the purge offset (default 7 days). This is the extra + * time we allow purgeable CSNs to stick around, in case a + * replica regresses. Could also be useful when LCUP happens, + * since we don't know about LCUP replicas, and they can just + * turn up whenever they want to. + */ + if (slapi_entry_attr_find(e, type_replicaPurgeDelay, &a) == -1){ + /* No purge delay provided, so use default */ + r->repl_purge_delay = 60 * 60 * 24 * 7; /* One week, in seconds */ + } else { + r->repl_purge_delay = slapi_entry_attr_get_uint(e, type_replicaPurgeDelay); + } - if (slapi_entry_attr_find(e, type_replicaTombstonePurgeInterval, &a) == -1) - { - /* No reap interval provided, so use default */ - r->tombstone_reap_interval = 3600 * 24; /* One day */ - } - else - { - r->tombstone_reap_interval = slapi_entry_attr_get_int(e, type_replicaTombstonePurgeInterval); - } + if (slapi_entry_attr_find(e, type_replicaTombstonePurgeInterval, &a) == -1){ + /* No reap interval provided, so use default */ + r->tombstone_reap_interval = 3600 * 24; /* One day */ + } else { + r->tombstone_reap_interval = slapi_entry_attr_get_int(e, type_replicaTombstonePurgeInterval); + } - r->tombstone_reap_stop = r->tombstone_reap_active = PR_FALSE; + r->tombstone_reap_stop = r->tombstone_reap_active = PR_FALSE; return (_replica_check_validity (r)); } @@ -3828,3 +3829,27 @@ replica_get_attr ( Slapi_PBlock *pb, const char* type, void *value ) return rc; } + +int +replica_get_backoff_min(Replica *r) +{ + return (int)r->backoff_min; +} + +int +replica_get_backoff_max(Replica *r) +{ + return (int)r->backoff_max; +} + +void +replica_set_backoff_min(Replica *r, int min) +{ + r->backoff_min = min; +} + +void +replica_set_backoff_max(Replica *r, int max) +{ + r->backoff_max = max; +} diff --git a/ldap/servers/plugins/replication/repl_globals.c b/ldap/servers/plugins/replication/repl_globals.c index a8473ab..7dfeb9b 100644 --- a/ldap/servers/plugins/replication/repl_globals.c +++ b/ldap/servers/plugins/replication/repl_globals.c @@ -113,6 +113,8 @@ const char *type_ruvElementUpdatetime = "nsruvReplicaLastModified"; const char *type_replicaCleanRUV = "nsds5ReplicaCleanRUV"; const char *type_replicaAbortCleanRUV = "nsds5ReplicaAbortCleanRUV"; const char *type_replicaProtocolTimeout = "nsds5ReplicaProtocolTimeout"; +const char *type_replicaBackoffMin = "nsds5ReplicaBackoffMin"; +const char *type_replicaBackoffMax = "nsds5ReplicaBackoffMax"; /* Attribute names for replication agreement attributes */ const char *type_nsds5ReplicaHost = "nsds5ReplicaHost"; diff --git a/ldap/servers/plugins/replication/windows_inc_protocol.c b/ldap/servers/plugins/replication/windows_inc_protocol.c index 20a1c7a..38d9011 100644 --- a/ldap/servers/plugins/replication/windows_inc_protocol.c +++ b/ldap/servers/plugins/replication/windows_inc_protocol.c @@ -182,13 +182,13 @@ windows_inc_delete(Private_Repl_Protocol **prpp) /* helper function */ void -w_set_pause_and_busy_time(long *pausetime, long *busywaittime) +w_set_pause_and_busy_time(Private_Repl_Protocol *prp, long *pausetime, long *busywaittime) { LDAPDebug0Args( LDAP_DEBUG_TRACE, "=> w_set_pause_and_busy_time\n" ); /* If neither are set, set busy time to its default */ if (!*pausetime && !*busywaittime) { - *busywaittime = PROTOCOL_BUSY_BACKOFF_MINIMUM; + *busywaittime = repl5_get_backoff_min(prp); } /* pause time must be at least 1 more than the busy backoff time */ if (*pausetime && !*busywaittime) @@ -354,7 +354,7 @@ windows_inc_run(Private_Repl_Protocol *prp) if (pausetime || busywaittime) { /* helper function to make sure they are set correctly */ - w_set_pause_and_busy_time(&pausetime, &busywaittime); + w_set_pause_and_busy_time(prp, &pausetime, &busywaittime); } /* Check if the interval changed */ @@ -609,17 +609,15 @@ windows_inc_run(Private_Repl_Protocol *prp) if (use_busy_backoff_timer) { /* we received a busy signal from the consumer, wait for a while */ - if (!busywaittime) - { - busywaittime = PROTOCOL_BUSY_BACKOFF_MINIMUM; - } - prp_priv->backoff = backoff_new(BACKOFF_FIXED, busywaittime, - busywaittime); + if (!busywaittime){ + busywaittime = repl5_get_backoff_min(prp); + } + prp_priv->backoff = backoff_new(BACKOFF_FIXED, busywaittime, busywaittime); } else { - prp_priv->backoff = backoff_new(BACKOFF_EXPONENTIAL, PROTOCOL_BACKOFF_MINIMUM, - PROTOCOL_BACKOFF_MAXIMUM); + prp_priv->backoff = backoff_new(BACKOFF_EXPONENTIAL, repl5_get_backoff_min(prp), + repl5_get_backoff_max(prp) ); } next_state = STATE_BACKOFF; backoff_reset(prp_priv->backoff, windows_inc_backoff_expired, (void *)prp);

1 0

ldap/servers
by Mark Reynolds 21 Mar '13

21 Mar '13

ldap/servers/slapd/back-ldbm/dblayer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit 0c374792582ced6ccd37f7db968b1acbb08dac00 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Thu Mar 21 16:20:43 2013 -0400 Ticket 622 - DS logging errors "libdb: BDB0171 seek: 2147483648: (262144 * 8192) + 0: No such file or directory Bug Description: This error message gets logged in the error log if size of the id2entry grows beyond 2 GB. The int storage class is the cause of the problem. Fix description: Use the proper storage class (off64_t) https://fedorahosted.org/389/ticket/622 Reviewed by: richm(Thanks!) diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c index 6d2d1e1..c921526 100644 --- a/ldap/servers/slapd/back-ldbm/dblayer.c +++ b/ldap/servers/slapd/back-ldbm/dblayer.c @@ -510,7 +510,7 @@ int dblayer_open_huge_file(const char *path, int oflag, int mode) /* Helper function for large seeks, db4.3 */ static int dblayer_seek43_large(int fd, off64_t offset, int whence) { - int ret = 0; + off64_t ret = 0; ret = lseek64(fd, offset, whence);

1 0

ldap/admin
by Mark Reynolds 21 Mar '13

21 Mar '13

ldap/admin/src/logconv.pl | 50 ++++++++++++++++++++++++++++++++++------------ 1 file changed, 37 insertions(+), 13 deletions(-) New commits: commit 59ae73c25c316c81c1c18ea702c8e793c922e1d8 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Thu Mar 21 16:12:41 2013 -0400 Ticket 611 - logconv.pl missing stats for StartTLS, LDAPI, and AUTOBIND RFE Description: Previously there were no stats for StartTLS, LDAPI, and AUTOTBIND connections/binds. https://fedorahosted.org/389/ticket/611 Reviewed by: richm(Thanks!) diff --git a/ldap/admin/src/logconv.pl b/ldap/admin/src/logconv.pl index 7ea7f09..7e0bfd8 100755 --- a/ldap/admin/src/logconv.pl +++ b/ldap/admin/src/logconv.pl @@ -70,6 +70,7 @@ $endFlag = 0; $endTime = 0; $reportStats = ""; $dataLocation = "/tmp"; +$startTLSoid = "1.3.6.1.4.1.1466.20037"; $s_stats = new_stats_block( ); $m_stats = new_stats_block( ); @@ -208,6 +209,9 @@ $maxsimConnection = 0; $firstFile = 1; $elapsedDays = 0; $logCount = 0; +$startTLSCount = 0; +$ldapiCount = 0; +$autobindCount = 0; $limit = 25000; # number of lines processed to trigger output # hash files @@ -588,7 +592,9 @@ if($reportBinds eq "yes"){ print "Restarts: $serverRestartCount\n"; print "Total Connections: $connectionCount\n"; -print "SSL Connections: $sslCount\n"; +print " - StartTLS Connections: $startTLSCount\n"; +print " - LDAPS Connections: $sslCount\n"; +print " - LDAPI Conections: $ldapiCount\n"; print "Peak Concurrent Connections: $maxsimConnection\n"; print "Total Operations: $allOps\n"; print "Total Results: $allResults\n"; @@ -760,21 +766,22 @@ print "Max BER Size Exceeded: $maxBerSizeCount\n"; print "\n"; print "Binds: $bindCount\n"; print "Unbinds: $unbindCount\n"; -print "\n LDAP v2 Binds: $v2BindCount\n"; -print " LDAP v3 Binds: $v3BindCount\n"; -print " SSL Client Binds: $sslClientBindCount\n"; -print " Failed SSL Client Binds: $sslClientFailedCount\n"; -print " SASL Binds: $saslBindCount\n"; +print " - LDAP v2 Binds: $v2BindCount\n"; +print " - LDAP v3 Binds: $v3BindCount\n"; +print " - AUTOBINDs: $autobindCount\n"; +print " - SSL Client Binds: $sslClientBindCount\n"; +print " - Failed SSL Client Binds: $sslClientFailedCount\n"; +print " - SASL Binds: $saslBindCount\n"; if ($saslBindCount > 0){ foreach $saslb ( sort {$saslmech{$b} <=> $saslmech{$a} } (keys %saslmech) ){ - printf " %-4s %-12s\n",$saslmech{$saslb}, $saslb; + printf " %-4s %-12s\n",$saslmech{$saslb}, $saslb; } } -print "\n Directory Manager Binds: $rootDNBindCount\n"; -print " Anonymous Binds: $anonymousBindCount\n"; +print " - Directory Manager Binds: $rootDNBindCount\n"; +print " - Anonymous Binds: $anonymousBindCount\n"; $otherBindCount = $bindCount -($rootDNBindCount + $anonymousBindCount); -print " Other Binds: $otherBindCount\n\n"; +print " - Other Binds: $otherBindCount\n\n"; ########################################################################## # Verbose Logging Section # @@ -1674,6 +1681,24 @@ sub parseLineNormal if (m/ version=3/){$v3BindCount++} if (m/ conn=1 fd=/){$serverRestartCount++} if (m/ SSL connection from/){$sslCount++;} + if (m/ connection from local to /){$ldapiCount++;} + if($_ =~ /AUTOBIND dn=\"(.*)\"/){ + $autobindCount++; + $bindCount++; + if($reportStat){ inc_stats('bind',$s_stats,$m_stats); } + if ($1 ne ""){ + $tmpp = $1; + $tmpp =~ tr/A-Z/a-z/; + writeFile($BINDLIST, $tmpp); + if($1 eq $rootDN){ + $rootDNBindCount++; + } + } else { + $anonymousBindCount++; + writeFile($BINDLIST, "Anonymous Binds"); + inc_stats('anonbind',$s_stats,$m_stats); + } + } if (m/ connection from/){ $exc = "no"; if ($_ =~ /connection from *([0-9A-Fa-f\.\:]+)/i ){ @@ -1718,6 +1743,7 @@ sub parseLineNormal if($reportStat){ inc_stats('bind',$s_stats,$m_stats); } $bindCount++; if ($1 ne ""){ + if($1 eq $rootDN){$rootDNBindCount++;} $tmpp = $1; $tmpp =~ tr/A-Z/a-z/; writeFile($BINDLIST, $tmpp); @@ -1728,9 +1754,6 @@ sub parseLineNormal # only need this for the failed bind report writeFile($BINDINFO, "$bindVal ,, $bindConn ,, $bindOp"); } - if($1 eq $rootDN){ - $rootDNBindCount++; - } } else { $anonymousBindCount++; writeFile($BINDLIST, "Anonymous Binds"); @@ -2026,6 +2049,7 @@ sub parseLineNormal if (m/ EXT oid=/){ $extopCount++; if ($_ =~ /oid=\" *([0-9\.]+)/i ){ writeFile($OID,$1); } + if ($1 && $1 eq $startTLSoid){$startTLSCount++;} if ($verb eq "yes"){ if ($_ =~ /conn= *([0-9]+)/i){ writeFile($EXT_CONN, $1); } if ($_ =~ /op= *([0-9]+)/i){ writeFile($EXT_OP, $1); }

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits March 2013