389-commits June 2014

389-commits@lists.fedoraproject.org

5 participants
66 discussions

ldap/servers
by Mark Reynolds 18 Jun '14

18 Jun '14

ldap/servers/plugins/linkedattrs/linked_attrs.c | 174 +++++++++++++++------ ldap/servers/plugins/memberof/memberof.c | 165 ++++++++++++++++---- ldap/servers/plugins/mep/mep.c | 72 ++++++-- ldap/servers/plugins/pam_passthru/pam_ptpreop.c | 3 ldap/servers/plugins/retrocl/retrocl_po.c | 195 ++++++++++++------------ 5 files changed, 416 insertions(+), 193 deletions(-) New commits: commit f2eb45bdd4fa8a0ad56c398ea8c7f370da8870f5 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Wed Jun 18 08:38:26 2014 -0400 Ticket 47810 - investigate betxn plugins to ensure they return the correct error code Bug Description: Prior to backend transaction plugin types, postop error codes didn't really have an effect, so often times a success result was implicitly being returned. Fix Description: Alawys return the correct error code for all backend transaction plugins. https://fedorahosted.org/389/ticket/47810 Jenkins: Passed TET: Passed Reviewed by: nhosoi(Thanks!) diff --git a/ldap/servers/plugins/linkedattrs/linked_attrs.c b/ldap/servers/plugins/linkedattrs/linked_attrs.c index 73247e5..20bb9fa 100644 --- a/ldap/servers/plugins/linkedattrs/linked_attrs.c +++ b/ldap/servers/plugins/linkedattrs/linked_attrs.c @@ -55,6 +55,8 @@ static Slapi_RWLock *g_config_lock; static void *_PluginID = NULL; static char *_PluginDN = NULL; int plugin_is_betxn = 0; +/* For future use - enforce all linked attribute operations succeed */ +static int strict_results = 0; static Slapi_PluginDesc pdesc = { LINK_FEATURE_DESC, VENDOR, @@ -106,13 +108,13 @@ static int linked_attrs_config_exists_reverse(struct configEntry *entry); static int linked_attrs_oktodo(Slapi_PBlock *pb); void linked_attrs_load_array(Slapi_Value **array, Slapi_Attr *attr); int linked_attrs_compare(const void *a, const void *b); -static void linked_attrs_add_backpointers(char *linkdn, struct configEntry *config, +static int linked_attrs_add_backpointers(char *linkdn, struct configEntry *config, Slapi_Mod *smod); -static void linked_attrs_del_backpointers(Slapi_PBlock *pb, char *linkdn, +static int linked_attrs_del_backpointers(Slapi_PBlock *pb, char *linkdn, struct configEntry *config, Slapi_Mod *smod); -static void linked_attrs_replace_backpointers(Slapi_PBlock *pb, char *linkdn, +static int linked_attrs_replace_backpointers(Slapi_PBlock *pb, char *linkdn, struct configEntry *config, Slapi_Mod *smod); -static void linked_attrs_mod_backpointers(char *linkdn, char *type, char *scope, +static int linked_attrs_mod_backpointers(char *linkdn, char *type, char *scope, int modop, Slapi_ValueSet *targetvals); /* @@ -1247,17 +1249,19 @@ linked_attrs_compare(const void *a, const void *b) * Adds backpointers pointing to dn to the entries referred to * by the values in smod. */ -static void +static int linked_attrs_add_backpointers(char *linkdn, struct configEntry *config, Slapi_Mod *smod) { Slapi_ValueSet *vals = slapi_valueset_new(); + int rc = LDAP_SUCCESS; slapi_valueset_set_from_smod(vals, smod); - linked_attrs_mod_backpointers(linkdn, config->managedtype, config->scope, + rc = linked_attrs_mod_backpointers(linkdn, config->managedtype, config->scope, LDAP_MOD_ADD, vals); slapi_valueset_free(vals); + return rc; } /* @@ -1266,11 +1270,12 @@ linked_attrs_add_backpointers(char *linkdn, struct configEntry *config, * Remove backpointers pointing to linkdn in the entries referred * to by the values in smod. */ -static void +static int linked_attrs_del_backpointers(Slapi_PBlock *pb, char *linkdn, struct configEntry *config, Slapi_Mod *smod) { Slapi_ValueSet *vals = NULL; + int rc = LDAP_SUCCESS; /* If no values are listed in the smod, we need to get * a list of all of the values that were deleted by @@ -1287,10 +1292,11 @@ linked_attrs_del_backpointers(Slapi_PBlock *pb, char *linkdn, slapi_valueset_set_from_smod(vals, smod); } - linked_attrs_mod_backpointers(linkdn, config->managedtype, config->scope, + rc = linked_attrs_mod_backpointers(linkdn, config->managedtype, config->scope, LDAP_MOD_DELETE, vals); - slapi_valueset_free(vals); + + return rc; } /* @@ -1301,7 +1307,7 @@ linked_attrs_del_backpointers(Slapi_PBlock *pb, char *linkdn, * for any new values that were added as a part of the * replace operation. */ -static void +static int linked_attrs_replace_backpointers(Slapi_PBlock *pb, char *linkdn, struct configEntry *config, Slapi_Mod *smod) { @@ -1309,6 +1315,7 @@ linked_attrs_replace_backpointers(Slapi_PBlock *pb, char *linkdn, Slapi_Entry *post_e = NULL; Slapi_Attr *pre_attr = 0; Slapi_Attr *post_attr = 0; + int rc = LDAP_SUCCESS; /* Get the pre and post copy of the entry to see * what values have been added and removed. */ @@ -1404,13 +1411,13 @@ linked_attrs_replace_backpointers(Slapi_PBlock *pb, char *linkdn, /* Perform the actual updates to the target entries. */ if (delvals) { - linked_attrs_mod_backpointers(linkdn, config->managedtype, + rc = linked_attrs_mod_backpointers(linkdn, config->managedtype, config->scope, LDAP_MOD_DELETE, delvals); slapi_valueset_free(delvals); } - if (addvals) { - linked_attrs_mod_backpointers(linkdn, config->managedtype, + if (rc == LDAP_SUCCESS && addvals) { + rc = linked_attrs_mod_backpointers(linkdn, config->managedtype, config->scope, LDAP_MOD_ADD, addvals); slapi_valueset_free(addvals); } @@ -1418,6 +1425,8 @@ linked_attrs_replace_backpointers(Slapi_PBlock *pb, char *linkdn, slapi_ch_free((void **)&pre_array); slapi_ch_free((void **)&post_array); } + + return rc; } /* @@ -1425,7 +1434,7 @@ linked_attrs_replace_backpointers(Slapi_PBlock *pb, char *linkdn, * * Performs backpointer management. */ -static void +static int linked_attrs_mod_backpointers(char *linkdn, char *type, char *scope, int modop, Slapi_ValueSet *targetvals) { @@ -1435,6 +1444,7 @@ linked_attrs_mod_backpointers(char *linkdn, char *type, LDAPMod mod; LDAPMod *mods[2]; Slapi_Value *targetval = NULL; + int rc = LDAP_SUCCESS; /* Setup the modify operation. Only the target will * change, so we only need to do this once. */ @@ -1481,7 +1491,14 @@ linked_attrs_mod_backpointers(char *linkdn, char *type, slapi_modify_internal_set_pb_ext(mod_pb, targetsdn, mods, 0, 0, linked_attrs_get_plugin_id(), 0); slapi_modify_internal_pb(mod_pb); - + if (strict_results){ + /* we are enforcing strict results, so return the error */ + slapi_pblock_get(mod_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); + if(rc != LDAP_SUCCESS){ + slapi_sdn_free(&targetsdn); + break; + } + } /* Initialize the pblock so we can reuse it. */ slapi_pblock_init(mod_pb); } @@ -1491,6 +1508,8 @@ linked_attrs_mod_backpointers(char *linkdn, char *type, } slapi_pblock_destroy(mod_pb); + + return rc; } @@ -1607,6 +1626,7 @@ linked_attrs_mod_post_op(Slapi_PBlock *pb) char *dn = NULL; struct configEntry *config = NULL; void *caller_id = NULL; + int rc = SLAPI_PLUGIN_SUCCESS; slapi_log_error(SLAPI_LOG_TRACE, LINK_PLUGIN_SUBSYSTEM, "--> linked_attrs_mod_post_op\n"); @@ -1662,27 +1682,36 @@ linked_attrs_mod_post_op(Slapi_PBlock *pb) case LDAP_MOD_ADD: /* Find the entries pointed to by the new * values and add the backpointers. */ - linked_attrs_add_backpointers(dn, config, smod); + rc = linked_attrs_add_backpointers(dn, config, smod); break; case LDAP_MOD_DELETE: /* Find the entries pointed to by the deleted * values and remove the backpointers. */ - linked_attrs_del_backpointers(pb, dn, config, smod); + rc = linked_attrs_del_backpointers(pb, dn, config, smod); break; case LDAP_MOD_REPLACE: /* Find the entries pointed to by the deleted * values and remove the backpointers. If * any new values are being added, find those * entries and add the backpointers. */ - linked_attrs_replace_backpointers(pb, dn, config, smod); + rc = linked_attrs_replace_backpointers(pb, dn, config, smod); break; default: slapi_log_error(SLAPI_LOG_PLUGIN, LINK_PLUGIN_SUBSYSTEM, "linked_attrs_mod_post_op: unknown mod type\n" ); + rc = SLAPI_PLUGIN_FAILURE; break; } slapi_unlock_mutex(config->lock); + if(rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_mod_post_op - update failed (%d)\n",rc); + linked_attrs_unlock(); + slapi_mod_done(next_mod); + break; + } + } config = NULL; @@ -1695,10 +1724,14 @@ linked_attrs_mod_post_op(Slapi_PBlock *pb) slapi_mods_free(&smods); } + if (rc) { + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &rc); + rc = SLAPI_PLUGIN_FAILURE; + } slapi_log_error(SLAPI_LOG_TRACE, LINK_PLUGIN_SUBSYSTEM, - "<-- linked_attrs_mod_post_op\n"); + "<-- linked_attrs_mod_post_op (%d)\n", rc); - return SLAPI_PLUGIN_SUCCESS; + return rc; } static int @@ -1706,6 +1739,7 @@ linked_attrs_add_post_op(Slapi_PBlock *pb) { Slapi_Entry *e = NULL; char *dn = NULL; + int rc = SLAPI_PLUGIN_SUCCESS; slapi_log_error(SLAPI_LOG_TRACE, LINK_PLUGIN_SUBSYSTEM, "--> linked_attrs_add_post_op\n"); @@ -1748,15 +1782,19 @@ linked_attrs_add_post_op(Slapi_PBlock *pb) Slapi_ValueSet *vals = NULL; slapi_attr_get_valueset(attr, &vals); - slapi_lock_mutex(config->lock); - linked_attrs_mod_backpointers(dn, config->managedtype, + rc = linked_attrs_mod_backpointers(dn, config->managedtype, config->scope, LDAP_MOD_ADD, vals); slapi_unlock_mutex(config->lock); - slapi_valueset_free(vals); + if(rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_add_post_op: update failed (%d)\n",rc); + linked_attrs_unlock(); + break; + } } config = NULL; @@ -1770,10 +1808,14 @@ linked_attrs_add_post_op(Slapi_PBlock *pb) "retrieving post-op entry %s\n", dn); } + if (rc) { + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &rc); + rc = SLAPI_PLUGIN_FAILURE; + } slapi_log_error(SLAPI_LOG_TRACE, LINK_PLUGIN_SUBSYSTEM, "<-- linked_attrs_add_post_op\n"); - return SLAPI_PLUGIN_SUCCESS; + return rc; } static int @@ -1781,13 +1823,14 @@ linked_attrs_del_post_op(Slapi_PBlock *pb) { char *dn = NULL; Slapi_Entry *e = NULL; + int rc = SLAPI_PLUGIN_SUCCESS; slapi_log_error(SLAPI_LOG_TRACE, LINK_PLUGIN_SUBSYSTEM, "--> linked_attrs_del_post_op\n"); /* Just bail if we aren't ready to service requests yet. */ if (!linked_attrs_oktodo(pb)){ - return SLAPI_PLUGIN_SUCCESS; + return rc; } /* Reload config if a config entry was deleted. */ @@ -1818,7 +1861,7 @@ linked_attrs_del_post_op(Slapi_PBlock *pb) /* Bail out if the plug-in close function was just called. */ if (!slapi_plugin_running(pb)) { linked_attrs_unlock(); - return SLAPI_PLUGIN_SUCCESS; + return rc; } linked_attrs_find_config(dn, type, &config); @@ -1828,15 +1871,19 @@ linked_attrs_del_post_op(Slapi_PBlock *pb) Slapi_ValueSet *vals = NULL; slapi_attr_get_valueset(attr, &vals); - slapi_lock_mutex(config->lock); - linked_attrs_mod_backpointers(dn, config->managedtype, + rc = linked_attrs_mod_backpointers(dn, config->managedtype, config->scope, LDAP_MOD_DELETE, vals); slapi_unlock_mutex(config->lock); - slapi_valueset_free(vals); + if (rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_del_post_op - update failed (%d)\n",rc); + linked_attrs_unlock(); + break; + } } config = NULL; @@ -1855,18 +1902,23 @@ linked_attrs_del_post_op(Slapi_PBlock *pb) if (config) { Slapi_ValueSet *vals = slapi_valueset_new(); - slapi_valueset_add_value(vals, val); + slapi_valueset_add_value(vals, val); slapi_lock_mutex(config->lock); /* Delete forward link value. */ - linked_attrs_mod_backpointers(dn, config->linktype, - config->scope, LDAP_MOD_DELETE, vals); + rc = linked_attrs_mod_backpointers(dn, config->linktype, + config->scope, LDAP_MOD_DELETE, vals); slapi_unlock_mutex(config->lock); - slapi_valueset_free(vals); config = NULL; + if(rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_del_post_op: update failed (%d)\n",rc); + linked_attrs_unlock(); + goto bail; + } } hint = slapi_attr_next_value(attr, hint, &val); @@ -1878,15 +1930,21 @@ linked_attrs_del_post_op(Slapi_PBlock *pb) slapi_entry_next_attr(e, attr, &attr); } } else { - slapi_log_error(SLAPI_LOG_PLUGIN, LINK_PLUGIN_SUBSYSTEM, + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, "linked_attrs_del_post_op: Error " "retrieving pre-op entry %s\n", dn); + rc = SLAPI_PLUGIN_FAILURE; } +bail: + if (rc) { + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &rc); + rc = SLAPI_PLUGIN_FAILURE; + } slapi_log_error(SLAPI_LOG_TRACE, LINK_PLUGIN_SUBSYSTEM, "<-- linked_attrs_del_post_op\n"); - return SLAPI_PLUGIN_SUCCESS; + return rc; } static int @@ -1955,17 +2013,21 @@ linked_attrs_modrdn_post_op(Slapi_PBlock *pb) Slapi_ValueSet *vals = NULL; slapi_attr_get_valueset(attr, &vals); - slapi_lock_mutex(config->lock); /* Delete old dn value. */ - linked_attrs_mod_backpointers(old_dn, config->managedtype, + rc = linked_attrs_mod_backpointers(old_dn, config->managedtype, config->scope, LDAP_MOD_DELETE, vals); slapi_unlock_mutex(config->lock); - slapi_valueset_free(vals); config = NULL; + if(rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_modrdn_post_op: update failed(old type) (%d)\n",rc); + linked_attrs_unlock(); + break; + } } linked_attrs_find_config(new_dn, type, &config); @@ -1978,17 +2040,21 @@ linked_attrs_modrdn_post_op(Slapi_PBlock *pb) Slapi_ValueSet *vals = NULL; slapi_attr_get_valueset(attr, &vals); - slapi_lock_mutex(config->lock); /* Add new dn value. */ - linked_attrs_mod_backpointers(new_dn, config->managedtype, - config->scope, LDAP_MOD_ADD, vals); + rc = linked_attrs_mod_backpointers(new_dn, config->managedtype, + config->scope, LDAP_MOD_ADD, vals); slapi_unlock_mutex(config->lock); - slapi_valueset_free(vals); config = NULL; + if(rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_modrdn_post_op: update failed(new type) (%d)\n",rc); + linked_attrs_unlock(); + break; + } } /* See if any of the values for this attribute are managed @@ -2006,22 +2072,35 @@ linked_attrs_modrdn_post_op(Slapi_PBlock *pb) /* If the new DN is within scope, we should fixup the forward links. */ if (config && slapi_dn_issuffix(new_dn, (config->scope))) { Slapi_ValueSet *vals = slapi_valueset_new(); - slapi_valueset_add_value(vals, val); + slapi_valueset_add_value(vals, val); slapi_lock_mutex(config->lock); /* Delete old dn value. */ - linked_attrs_mod_backpointers(old_dn, config->linktype, + rc = linked_attrs_mod_backpointers(old_dn, config->linktype, config->scope, LDAP_MOD_DELETE, vals); + if(rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_modrdn_post_op: update failed(old dn) (%d)\n",rc); + slapi_unlock_mutex(config->lock); + slapi_valueset_free(vals); + linked_attrs_unlock(); + goto done; + } /* Add new dn value. */ - linked_attrs_mod_backpointers(new_dn, config->linktype, - config->scope, LDAP_MOD_ADD, vals); + rc = linked_attrs_mod_backpointers(new_dn, config->linktype, + config->scope, LDAP_MOD_ADD, vals); slapi_unlock_mutex(config->lock); - slapi_valueset_free(vals); config = NULL; + if(rc != LDAP_SUCCESS){ + slapi_log_error(SLAPI_LOG_FATAL, LINK_PLUGIN_SUBSYSTEM, + "linked_attrs_modrdn_post_op: update failed(new dn) (%d)\n",rc); + linked_attrs_unlock(); + goto done; + } } hint = slapi_attr_next_value(attr, hint, &val); @@ -2032,6 +2111,7 @@ linked_attrs_modrdn_post_op(Slapi_PBlock *pb) slapi_entry_next_attr(post_e, attr, &attr); } + done: slapi_log_error(SLAPI_LOG_TRACE, LINK_PLUGIN_SUBSYSTEM, "<-- linked_attrs_modrdn_post_op\n"); diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c index 1073b8e..11ac965 100644 --- a/ldap/servers/plugins/memberof/memberof.c +++ b/ldap/servers/plugins/memberof/memberof.c @@ -147,7 +147,7 @@ static void memberof_set_plugin_id(void * plugin_id); static int memberof_compare(MemberOfConfig *config, const void *a, const void *b); static int memberof_qsort_compare(const void *a, const void *b); static void memberof_load_array(Slapi_Value **array, Slapi_Attr *attr); -static void memberof_del_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *config, Slapi_DN *sdn); +static int memberof_del_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *config, Slapi_DN *sdn); static int memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn, char **types, plugin_search_entry_callback callback, void *callback_data); static int memberof_is_direct_member(MemberOfConfig *config, Slapi_Value *groupdn, @@ -162,7 +162,7 @@ static int memberof_test_membership(Slapi_PBlock *pb, MemberOfConfig *config, static int memberof_test_membership_callback(Slapi_Entry *e, void *callback_data); static int memberof_del_dn_type_callback(Slapi_Entry *e, void *callback_data); static int memberof_replace_dn_type_callback(Slapi_Entry *e, void *callback_data); -static void memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *config, +static int memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *config, Slapi_DN *pre_sdn, Slapi_DN *post_sdn); static int memberof_modop_one_replace_r(Slapi_PBlock *pb, MemberOfConfig *config, int mod_op, Slapi_DN *group_sdn, Slapi_DN *op_this_sdn, @@ -556,7 +556,14 @@ int memberof_postop_del(Slapi_PBlock *pb) /* remove this DN from the * membership lists of groups */ - memberof_del_dn_from_groups(pb, &configCopy, sdn); + if((ret = memberof_del_dn_from_groups(pb, &configCopy, sdn))){ + slapi_log_error(SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_del: error deleting dn (%s) from group. Error (%d)", + slapi_sdn_get_dn(sdn),ret); + memberof_unlock(); + memberof_free_config(&configCopy); + goto bail; + } /* is the entry of interest as a group? */ if(e && configCopy.group_filter && !slapi_filter_test_simple(e, configCopy.group_filter)) @@ -565,20 +572,28 @@ int memberof_postop_del(Slapi_PBlock *pb) Slapi_Attr *attr = 0; /* Loop through to find each grouping attribute separately. */ - for (i = 0; configCopy.groupattrs[i]; i++) + for (i = 0; configCopy.groupattrs[i] && ret == LDAP_SUCCESS; i++) { if (0 == slapi_entry_attr_find(e, configCopy.groupattrs[i], &attr)) { - memberof_del_attr_list(pb, &configCopy, sdn, attr); + if((ret = memberof_del_attr_list(pb, &configCopy, sdn, attr))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_del: error deleting attr list - dn (%s). Error (%d)", + slapi_sdn_get_dn(sdn),ret); + } + } } } - memberof_unlock(); - memberof_free_config(&configCopy); } +bail: + if(ret){ + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &ret); + ret = SLAPI_PLUGIN_FAILURE; + } slapi_log_error( SLAPI_LOG_TRACE, MEMBEROF_PLUGIN_SUBSYSTEM, "<-- memberof_postop_del\n" ); return ret; @@ -591,28 +606,32 @@ typedef struct _memberof_del_dn_data } memberof_del_dn_data; /* Deletes a member dn from all groups that refer to it. */ -static void +static int memberof_del_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *config, Slapi_DN *sdn) { int i = 0; char *groupattrs[2] = {0, 0}; + int rc = LDAP_SUCCESS; /* Loop through each grouping attribute to find groups that have * dn as a member. For any matches, delete the dn value from the * same grouping attribute. */ - for (i = 0; config->groupattrs && config->groupattrs[i]; i++) + for (i = 0; config->groupattrs && config->groupattrs[i] && rc == LDAP_SUCCESS; i++) { memberof_del_dn_data data = {(char *)slapi_sdn_get_dn(sdn), config->groupattrs[i]}; groupattrs[0] = config->groupattrs[i]; - memberof_call_foreach_dn(pb, sdn, groupattrs, - memberof_del_dn_type_callback, &data); + rc = memberof_call_foreach_dn(pb, sdn, groupattrs, + memberof_del_dn_type_callback, &data); } + + return rc; } -int memberof_del_dn_type_callback(Slapi_Entry *e, void *callback_data) +int +memberof_del_dn_type_callback(Slapi_Entry *e, void *callback_data) { int rc = 0; LDAPMod mod; @@ -654,7 +673,8 @@ int memberof_del_dn_type_callback(Slapi_Entry *e, void *callback_data) * is a user, you'd want "type" to be "member". If "dn" is a group, you * could want type to be either "member" or "memberOf" depending on the case. */ -int memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn, +int +memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn, char **types, plugin_search_entry_callback callback, void *callback_data) { Slapi_PBlock *search_pb = NULL; @@ -763,6 +783,11 @@ int memberof_call_foreach_dn(Slapi_PBlock *pb, Slapi_DN *sdn, slapi_search_internal_set_pb(search_pb, slapi_sdn_get_dn(base_sdn), LDAP_SCOPE_SUBTREE, filter_str, 0, 0, 0, 0, memberof_get_plugin_id(), 0); slapi_search_internal_callback_pb(search_pb, callback_data, 0, callback, 0); + slapi_pblock_get(search_pb, SLAPI_PLUGIN_INTOP_RESULT, &rc); + if(rc != LDAP_SUCCESS){ + break; + } + if(!all_backends){ break; @@ -841,8 +866,12 @@ int memberof_postop_modrdn(Slapi_PBlock *pb) { if(0 == slapi_entry_attr_find(post_e, configCopy.groupattrs[i], &attr)) { - if(memberof_moddn_attr_list(pb, &configCopy, pre_sdn, - post_sdn, attr) != 0){ + if((ret = memberof_moddn_attr_list(pb, &configCopy, pre_sdn, + post_sdn, attr) != 0)) + { + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modrdn - update failed for (%s), error (%d)\n", + slapi_sdn_get_dn(pre_sdn), ret); break; } } @@ -852,13 +881,25 @@ int memberof_postop_modrdn(Slapi_PBlock *pb) /* It's possible that this is an entry who is a member * of other group entries. We need to update any member * attributes to refer to the new name. */ - if (pre_sdn && post_sdn) { + if (ret == LDAP_SUCCESS && pre_sdn && post_sdn) { if (entry_scope && !slapi_sdn_issuffix(post_sdn, entry_scope)) { memberof_del_dn_data del_data = {0, configCopy.memberof_attr}; - memberof_del_dn_from_groups(pb, &configCopy, pre_sdn); - memberof_del_dn_type_callback(post_e, &del_data); + if((ret = memberof_del_dn_from_groups(pb, &configCopy, pre_sdn))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modrdn - delete dn failed for (%s), error (%d)\n", + slapi_sdn_get_dn(pre_sdn), ret); + } + if(ret == LDAP_SUCCESS && (ret = memberof_del_dn_type_callback(post_e, &del_data))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modrdn - delete dn callback failed for (%s), error (%d)\n", + slapi_entry_get_dn(post_e), ret); + } } else { - memberof_replace_dn_from_groups(pb, &configCopy, pre_sdn, post_sdn); + if((ret = memberof_replace_dn_from_groups(pb, &configCopy, pre_sdn, post_sdn))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modrdn - replace dne failed for (%s), error (%d)\n", + slapi_sdn_get_dn(pre_sdn), ret); + } } } @@ -866,6 +907,10 @@ int memberof_postop_modrdn(Slapi_PBlock *pb) memberof_free_config(&configCopy); } + if(ret){ + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &ret); + ret = SLAPI_PLUGIN_FAILURE; + } slapi_log_error( SLAPI_LOG_TRACE, MEMBEROF_PLUGIN_SUBSYSTEM, "<-- memberof_postop_modrdn\n" ); return ret; @@ -881,12 +926,13 @@ typedef struct _replace_dn_data /* Finds any groups that have pre_dn as a member and modifies them to * to use post_dn instead. */ -static void +static int memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *config, Slapi_DN *pre_sdn, Slapi_DN *post_sdn) { int i = 0; char *groupattrs[2] = {0, 0}; + int ret = LDAP_SUCCESS; /* Loop through each grouping attribute to find groups that have * pre_dn as a member. For any matches, replace pre_dn with post_dn @@ -899,9 +945,15 @@ memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *config, groupattrs[0] = config->groupattrs[i]; - memberof_call_foreach_dn(pb, pre_sdn, groupattrs, - memberof_replace_dn_type_callback, &data); + if((ret = memberof_call_foreach_dn(pb, pre_sdn, groupattrs, + memberof_replace_dn_type_callback, + &data))) + { + break; + } } + + return ret; } @@ -1068,7 +1120,14 @@ int memberof_postop_modify(Slapi_PBlock *pb) case LDAP_MOD_ADD: { /* add group DN to targets */ - memberof_add_smod_list(pb, &configCopy, sdn, smod); + if((ret = memberof_add_smod_list(pb, &configCopy, sdn, smod))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modify: failed to add dn (%s) to target. " + "Error (%d)\n", slapi_sdn_get_dn(sdn), ret ); + slapi_mod_done(next_mod); + memberof_unlock(); + goto bail; + } break; } @@ -1080,12 +1139,26 @@ int memberof_postop_modify(Slapi_PBlock *pb) * entry, which the replace code deals with. */ if (slapi_mod_get_num_values(smod) == 0) { - memberof_replace_list(pb, &configCopy, sdn); + if((ret = memberof_replace_list(pb, &configCopy, sdn))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modify: failed to replace list (%s). " + "Error (%d)\n", slapi_sdn_get_dn(sdn), ret ); + slapi_mod_done(next_mod); + memberof_unlock(); + goto bail; + } } else { /* remove group DN from target values in smod*/ - memberof_del_smod_list(pb, &configCopy, sdn, smod); + if((ret = memberof_del_smod_list(pb, &configCopy, sdn, smod))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modify: failed to remove dn (%s). " + "Error (%d)\n", slapi_sdn_get_dn(sdn), ret ); + slapi_mod_done(next_mod); + memberof_unlock(); + goto bail; + } } break; } @@ -1093,16 +1166,24 @@ int memberof_postop_modify(Slapi_PBlock *pb) case LDAP_MOD_REPLACE: { /* replace current values */ - memberof_replace_list(pb, &configCopy, sdn); + if((ret = memberof_replace_list(pb, &configCopy, sdn))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_modify: failed to replace values in dn (%s). " + "Error (%d)\n", slapi_sdn_get_dn(sdn), ret ); + slapi_mod_done(next_mod); + memberof_unlock(); + goto bail; + } break; } default: { slapi_log_error( - SLAPI_LOG_PLUGIN, + SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, "memberof_postop_modify: unknown mod type\n" ); + ret = SLAPI_PLUGIN_FAILURE; break; } } @@ -1114,6 +1195,7 @@ int memberof_postop_modify(Slapi_PBlock *pb) smod = slapi_mods_get_next_smod(smods, next_mod); } +bail: if (config_copied) { memberof_free_config(&configCopy); @@ -1124,6 +1206,11 @@ int memberof_postop_modify(Slapi_PBlock *pb) } done: + if(ret){ + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &ret); + ret = SLAPI_PLUGIN_FAILURE; + } + slapi_log_error( SLAPI_LOG_TRACE, MEMBEROF_PLUGIN_SUBSYSTEM, "<-- memberof_postop_modify\n" ); return ret; @@ -1186,7 +1273,12 @@ int memberof_postop_add(Slapi_PBlock *pb) { if(0 == slapi_entry_attr_find(e, configCopy.groupattrs[i], &attr)) { - memberof_add_attr_list(pb, &configCopy, sdn, attr); + if((ret = memberof_add_attr_list(pb, &configCopy, sdn, attr))){ + slapi_log_error( SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM, + "memberof_postop_add: failed to add dn(%s), error (%d)", + slapi_sdn_get_dn(sdn), ret); + break; + } } } @@ -1196,6 +1288,11 @@ int memberof_postop_add(Slapi_PBlock *pb) } } + if(ret){ + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &ret); + ret = SLAPI_PLUGIN_FAILURE; + } + slapi_log_error( SLAPI_LOG_TRACE, MEMBEROF_PLUGIN_SUBSYSTEM, "<-- memberof_postop_add\n" ); @@ -1542,7 +1639,7 @@ memberof_modop_one_replace_r(Slapi_PBlock *pb, MemberOfConfig *config, if(LDAP_MOD_DELETE == mod_op || LDAP_MOD_ADD == mod_op) { /* find parent groups and replace our member attr */ - memberof_fix_memberof_callback(e, config); + rc = memberof_fix_memberof_callback(e, config); } else { /* single entry - do mod */ mod_pb = slapi_pblock_new(); @@ -1664,7 +1761,9 @@ int memberof_mod_smod_list(Slapi_PBlock *pb, MemberOfConfig *config, int mod, strncpy(dn_str, bv->bv_val, (size_t)bv->bv_len); slapi_sdn_set_dn_byref(sdn, dn_str); - memberof_modop_one(pb, config, mod, group_sdn, sdn); + if((rc = memberof_modop_one(pb, config, mod, group_sdn, sdn))){ + break; + } bv = slapi_mod_get_next_value(smod); } @@ -1743,7 +1842,7 @@ int memberof_mod_attr_list_r(Slapi_PBlock *pb, MemberOfConfig *config, int mod, op_this_val = slapi_value_new_string(slapi_sdn_get_ndn(op_this_sdn)); slapi_value_set_flags(op_this_val, SLAPI_ATTR_FLAG_NORMALIZED_CIS); - while(val) + while(val && rc == 0) { char *dn_str = 0; struct berval *bv = 0; @@ -1779,13 +1878,13 @@ int memberof_mod_attr_list_r(Slapi_PBlock *pb, MemberOfConfig *config, int mod, slapi_sdn_set_normdn_byref(sdn, dn_str); /* dn_str is normalized */ if(mod == LDAP_MOD_REPLACE) { - memberof_modop_one_replace_r(pb, config, mod, group_sdn, + rc = memberof_modop_one_replace_r(pb, config, mod, group_sdn, op_this_sdn, group_sdn, sdn, stack); } else { - memberof_modop_one_r(pb, config, mod, group_sdn, + rc = memberof_modop_one_r(pb, config, mod, group_sdn, op_this_sdn, sdn, stack); } } diff --git a/ldap/servers/plugins/mep/mep.c b/ldap/servers/plugins/mep/mep.c index 76ba827..f0b9bae 100644 --- a/ldap/servers/plugins/mep/mep.c +++ b/ldap/servers/plugins/mep/mep.c @@ -108,7 +108,7 @@ static Slapi_Entry *mep_create_managed_entry(struct configEntry *config, Slapi_Entry *origin); static int mep_add_managed_entry(struct configEntry *config, Slapi_Entry *origin); -static void mep_rename_managed_entry(Slapi_Entry *origin, +static int mep_rename_managed_entry(Slapi_Entry *origin, Slapi_DN *new_dn, Slapi_DN *old_dn); static Slapi_Mods *mep_get_mapped_mods(struct configEntry *config, Slapi_Entry *origin, char **mapped_dn); @@ -1450,9 +1450,8 @@ mep_add_managed_entry(struct configEntry *config, slapi_pblock_init(mod_pb); /* - * Add the origin entry objectclass. Do not check the result - * as we could be here because of a modrdn operation - in which - * case the objectclass already exists. + * Add the origin entry objectclass. A modrdn might result in + * an err 20 (type or value exists), in which case just ignore it. */ oc_vals[0] = MEP_ORIGIN_OC; oc_vals[1] = 0; @@ -1517,7 +1516,7 @@ bail: * Renames a managed entry and updates the pointer in the * origin entry. */ -static void +static int mep_rename_managed_entry(Slapi_Entry *origin, Slapi_DN *new_dn, Slapi_DN *old_dn) { @@ -1582,6 +1581,8 @@ mep_rename_managed_entry(Slapi_Entry *origin, bail: slapi_rdn_free(&srdn); slapi_pblock_destroy(mep_pb); + + return result; } /* @@ -2311,7 +2312,7 @@ mep_mod_post_op(Slapi_PBlock *pb) char *mapped_dn = NULL; Slapi_DN *mapped_sdn = NULL; struct configEntry *config = NULL; - int result = 0; + int result = SLAPI_PLUGIN_SUCCESS; LDAPMod **mods = NULL; int i, abort_mod = 1; @@ -2333,8 +2334,9 @@ mep_mod_post_op(Slapi_PBlock *pb) * backend, so don't treat the message as fatal. */ slapi_pblock_get(pb, SLAPI_ENTRY_POST_OP, &e); if (e == NULL) { - slapi_log_error(SLAPI_LOG_PLUGIN, MEP_PLUGIN_SUBSYSTEM, + slapi_log_error(SLAPI_LOG_FATAL, MEP_PLUGIN_SUBSYSTEM, "mep_mod_post_op: Unable to fetch postop entry.\n"); + result = SLAPI_PLUGIN_FAILURE; goto bail; } @@ -2408,12 +2410,12 @@ mep_mod_post_op(Slapi_PBlock *pb) } /* Check if we need to rename the managed entry. */ - if (mapped_dn) { + if (result == SLAPI_PLUGIN_SUCCESS && mapped_dn) { mapped_sdn = slapi_sdn_new_normdn_passin(mapped_dn); managed_sdn = slapi_sdn_new_normdn_byref(managed_dn); if (slapi_sdn_compare(managed_sdn, mapped_sdn) != 0) { - mep_rename_managed_entry(e, mapped_sdn, managed_sdn); + result = mep_rename_managed_entry(e, mapped_sdn, managed_sdn); } slapi_sdn_free(&mapped_sdn); @@ -2428,12 +2430,16 @@ mep_mod_post_op(Slapi_PBlock *pb) } } - bail: +bail: + if(result){ + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &result); + result = SLAPI_PLUGIN_FAILURE; + } slapi_ch_free_string(&managed_dn); slapi_log_error(SLAPI_LOG_TRACE, MEP_PLUGIN_SUBSYSTEM, "<-- mep_mod_post_op\n"); - return SLAPI_PLUGIN_SUCCESS; + return result; } static int @@ -2514,6 +2520,7 @@ mep_del_post_op(Slapi_PBlock *pb) { Slapi_Entry *e = NULL; Slapi_DN *sdn = NULL; + int result = SLAPI_PLUGIN_SUCCESS; slapi_log_error(SLAPI_LOG_TRACE, MEP_PLUGIN_SUBSYSTEM, "--> mep_del_post_op\n"); @@ -2557,7 +2564,12 @@ mep_del_post_op(Slapi_PBlock *pb) slapi_delete_internal_set_pb(mep_pb, managed_dn, NULL, NULL, mep_get_plugin_id(), 0); slapi_delete_internal_pb(mep_pb); - + slapi_pblock_get(mep_pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if(result){ + slapi_log_error(SLAPI_LOG_FATAL, MEP_PLUGIN_SUBSYSTEM, + "mep_del_post_op: failed to delete managed entry " + "(%s) - error (%d)\n",managed_dn, result); + } slapi_ch_free_string(&managed_dn); slapi_pblock_destroy(mep_pb); } @@ -2567,10 +2579,15 @@ mep_del_post_op(Slapi_PBlock *pb) "retrieving pre-op entry %s\n", slapi_sdn_get_dn(sdn)); } + if(result){ + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &result); + result = SLAPI_PLUGIN_FAILURE; + } + slapi_log_error(SLAPI_LOG_TRACE, MEP_PLUGIN_SUBSYSTEM, "<-- mep_del_post_op\n"); - return SLAPI_PLUGIN_SUCCESS; + return result; } static int @@ -2599,10 +2616,10 @@ mep_modrdn_post_op(Slapi_PBlock *pb) new_sdn = slapi_entry_get_sdn(post_e); new_dn = slapi_sdn_get_dn(new_sdn); } else { - slapi_log_error(SLAPI_LOG_PLUGIN, MEP_PLUGIN_SUBSYSTEM, + slapi_log_error(SLAPI_LOG_FATAL, MEP_PLUGIN_SUBSYSTEM, "mep_modrdn_post_op: Error " "retrieving post-op entry\n"); - return SLAPI_PLUGIN_SUCCESS; + return SLAPI_PLUGIN_FAILURE; } if ((old_sdn = mep_get_sdn(pb))) { @@ -2660,7 +2677,13 @@ mep_modrdn_post_op(Slapi_PBlock *pb) slapi_delete_internal_set_pb (mep_pb, managed_dn, NULL, NULL, mep_get_plugin_id(), 0); slapi_delete_internal_pb(mep_pb); - + slapi_pblock_get(mep_pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if(result){ + slapi_log_error(SLAPI_LOG_FATAL, MEP_PLUGIN_SUBSYSTEM, + "mep_modrdn_post_op: failed to delete managed entry " + "(%s) - error (%d)\n",managed_dn, result); + goto bailmod; + } /* Clear out the pblock for reuse. */ slapi_pblock_init(mep_pb); @@ -2760,9 +2783,12 @@ mep_modrdn_post_op(Slapi_PBlock *pb) "entry \"%s\".\n ", managed_dn, slapi_entry_get_dn(new_managed_entry), slapi_sdn_get_dn(old_sdn)); - mep_rename_managed_entry(post_e, + if((result = mep_rename_managed_entry(post_e, slapi_entry_get_sdn(new_managed_entry), - managed_sdn); + managed_sdn))) + { + goto bailmod; + } } /* Update all of the mapped attributes @@ -2824,18 +2850,22 @@ bailmod: if (config) { if(mep_add_managed_entry(config, post_e)){ char errtxt[SLAPI_DSE_RETURNTEXT_SIZE]; - int rc = LDAP_UNWILLING_TO_PERFORM; + result = LDAP_UNWILLING_TO_PERFORM; PR_snprintf(errtxt, SLAPI_DSE_RETURNTEXT_SIZE, "Managed Entry Plugin rejected modrdn operation (see errors log).\n"); slapi_pblock_set(pb, SLAPI_PB_RESULT_TEXT, &errtxt); - slapi_pblock_set(pb, SLAPI_RESULT_CODE, &rc); - result = SLAPI_PLUGIN_FAILURE; + } } mep_config_unlock(); } + + if(result){ + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &result); + result = SLAPI_PLUGIN_FAILURE; + } slapi_log_error(SLAPI_LOG_TRACE, MEP_PLUGIN_SUBSYSTEM, "<-- mep_modrdn_post_op\n"); diff --git a/ldap/servers/plugins/pam_passthru/pam_ptpreop.c b/ldap/servers/plugins/pam_passthru/pam_ptpreop.c index a25b9fa..476d834 100644 --- a/ldap/servers/plugins/pam_passthru/pam_ptpreop.c +++ b/ldap/servers/plugins/pam_passthru/pam_ptpreop.c @@ -673,6 +673,7 @@ pam_passthru_postop(Slapi_PBlock *pb) /* Make sure the operation succeeded and bail if it didn't. */ slapi_pblock_get(pb, SLAPI_PLUGIN_OPRETURN, &oprc); if (oprc != 0) { + ret = oprc; goto bail; } @@ -681,6 +682,7 @@ pam_passthru_postop(Slapi_PBlock *pb) if (!sdn) { slapi_log_error(SLAPI_LOG_FATAL, PAM_PASSTHRU_PLUGIN_SUBSYSTEM, "pam_passthru_postop: unale to fetch target SDN.\n"); + ret = SLAPI_PLUGIN_FAILURE; goto bail; } @@ -695,6 +697,7 @@ pam_passthru_postop(Slapi_PBlock *pb) slapi_log_error(SLAPI_LOG_FATAL, PAM_PASSTHRU_PLUGIN_SUBSYSTEM, "pam_passthru_postop: unable to fetch post-op " "entry for rename operation.\n"); + ret = SLAPI_PLUGIN_FAILURE; goto bail; } } diff --git a/ldap/servers/plugins/retrocl/retrocl_po.c b/ldap/servers/plugins/retrocl/retrocl_po.c index 0e32d06..04687da 100644 --- a/ldap/servers/plugins/retrocl/retrocl_po.c +++ b/ldap/servers/plugins/retrocl/retrocl_po.c @@ -150,11 +150,11 @@ static lenstr *make_changes_string(LDAPMod **ldm, const char **includeattrs) * log_m - pointer to the actual change operation on a modify * flag - only used by modrdn operations - value of deleteoldrdn * curtime - the current time - * Returns: nothing + * Returns: error code * Description: Given a change, construct an entry which is to be added to the * changelog database. */ -static void +static int write_replog_db( Slapi_PBlock *pb, int optype, @@ -168,20 +168,21 @@ write_replog_db( const char *newsuperior ) { - char *edn; - struct berval *vals[ 2 ]; - struct berval val; - Slapi_Entry *e; - char chnobuf[ 20 ]; - int err; - Slapi_PBlock *newPb = NULL; + Slapi_PBlock *newPb = NULL; changeNumber changenum; - int i; - int extensibleObject = 0; + struct berval *vals[ 2 ]; + struct berval val; + Slapi_Entry *e; + char chnobuf[ 20 ]; + char *edn; + int extensibleObject = 0; + int err = 0; + int ret = LDAP_SUCCESS; + int i; if (!dn) { slapi_log_error( SLAPI_LOG_PLUGIN, RETROCL_PLUGIN_NAME, "write_replog_db: NULL dn\n"); - return; + return ret; } PR_Lock(retrocl_internal_lock); @@ -321,78 +322,79 @@ write_replog_db( * Finish constructing the entry. How to do it depends on the type * of modification being logged. */ - err = 0; switch ( optype ) { case OP_ADD: - if ( entry2reple( e, log_e, OP_ADD ) != 0 ) { - err = 1; - } - break; + if ( entry2reple( e, log_e, OP_ADD ) != 0 ) { + err = SLAPI_PLUGIN_FAILURE; + } + break; case OP_MODIFY: - if ( mods2reple( e, log_m ) != 0 ) { - err = 1; - } - break; + if ( mods2reple( e, log_m ) != 0 ) { + err = SLAPI_PLUGIN_FAILURE; + } + break; case OP_MODRDN: - if ( modrdn2reple( e, newrdn, flag, modrdn_mods, newsuperior ) != 0 ) { - err = 1; - } - break; + if ( modrdn2reple( e, newrdn, flag, modrdn_mods, newsuperior ) != 0 ) { + err = SLAPI_PLUGIN_FAILURE; + } + break; case OP_DELETE: - if (log_e) { - /* we have to log the full entry */ - if ( entry2reple( e, log_e, OP_DELETE ) != 0 ) { - err = 1; - } - } else { - /* Set the changetype attribute */ - val.bv_val = "delete"; - val.bv_len = 6; - slapi_entry_add_values( e, attr_changetype, vals ); - } - break; + if (log_e) { + /* we have to log the full entry */ + if ( entry2reple( e, log_e, OP_DELETE ) != 0 ) { + err = SLAPI_PLUGIN_FAILURE; + } + } else { + /* Set the changetype attribute */ + val.bv_val = "delete"; + val.bv_len = 6; + slapi_entry_add_values( e, attr_changetype, vals ); + } + break; + default: - slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME, "replog: Unknown LDAP operation type " - "%d.\n", optype ); - err = 1; + slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME, + "replog: Unknown LDAP operation type %d.\n", optype ); + err = SLAPI_PLUGIN_FAILURE; } /* Call the repl backend to add this entry */ if ( 0 == err ) { - int rc; - - newPb = slapi_pblock_new (); - slapi_add_entry_internal_set_pb( newPb, e, NULL /* controls */, - g_plg_identity[PLUGIN_RETROCL], - /* dont leave entry in cache if main oparation is aborted */ - SLAPI_OP_FLAG_NEVER_CACHE); - slapi_add_internal_pb (newPb); - slapi_pblock_get( newPb, SLAPI_PLUGIN_INTOP_RESULT, &rc ); - slapi_pblock_destroy(newPb); - if ( 0 != rc ) { - slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME, - "replog: an error occured while adding change " - "number %lu, dn = %s: %s. \n", - changenum, edn, ldap_err2string( rc )); - retrocl_release_changenumber(); - } else { - /* Tell the change numbering system this one's committed to disk */ - retrocl_commit_changenumber(); - } + newPb = slapi_pblock_new (); + slapi_add_entry_internal_set_pb( newPb, e, NULL /* controls */, + g_plg_identity[PLUGIN_RETROCL], + /* dont leave entry in cache if main oparation is aborted */ + SLAPI_OP_FLAG_NEVER_CACHE); + slapi_add_internal_pb (newPb); + slapi_pblock_get( newPb, SLAPI_PLUGIN_INTOP_RESULT, &ret ); + slapi_pblock_destroy(newPb); + if ( 0 != ret ) { + slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME, + "replog: an error occured while adding change " + "number %lu, dn = %s: %s. \n", + changenum, edn, ldap_err2string( ret )); + retrocl_release_changenumber(); + + } else { + /* Tell the change numbering system this one's committed to disk */ + retrocl_commit_changenumber(); + } } else { - slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME, - "An error occurred while constructing " - "change record number %ld.\n", changenum ); - retrocl_release_changenumber(); + slapi_log_error( SLAPI_LOG_FATAL, RETROCL_PLUGIN_NAME, + "An error occurred while constructing " + "change record number %ld.\n", changenum ); + retrocl_release_changenumber(); + ret = err; } PR_Unlock(retrocl_internal_lock); if ( NULL != edn ) { - slapi_ch_free((void **) &edn); + slapi_ch_free((void **) &edn); } + return ret; } @@ -585,7 +587,7 @@ int retrocl_postob (Slapi_PBlock *pb, int optype) Slapi_DN *newsuperior = NULL; Slapi_Backend *be = NULL; time_t curtime; - int rc; + int rc = SLAPI_PLUGIN_SUCCESS; /* * Check to see if the change was made to the replication backend db. @@ -608,10 +610,10 @@ int retrocl_postob (Slapi_PBlock *pb, int optype) if (rc != LDAP_SUCCESS) { LDAPDebug1Arg(LDAP_DEBUG_TRACE,"not applying change if op failed %d\n",rc); - /* this could also mean that the changenumber is no longer correct - * set a flag to check at next assignment - */ - retrocl_set_check_changenumber(); + /* this could also mean that the changenumber is no longer correct + * set a flag to check at next assignment + */ + retrocl_set_check_changenumber(); return SLAPI_PLUGIN_SUCCESS; } @@ -642,35 +644,44 @@ int retrocl_postob (Slapi_PBlock *pb, int optype) switch ( optype ) { case OP_MODIFY: - (void)slapi_pblock_get( pb, SLAPI_MODIFY_MODS, &log_m ); - break; + (void)slapi_pblock_get( pb, SLAPI_MODIFY_MODS, &log_m ); + break; case OP_ADD: - /* - * For adds, we want the unnormalized dn, so we can preserve - * spacing, case, when replicating it. - */ - (void)slapi_pblock_get( pb, SLAPI_ADD_ENTRY, &te ); - if ( NULL != te ) { - dn = slapi_entry_get_dn( te ); - } - break; + /* + * For adds, we want the unnormalized dn, so we can preserve + * spacing, case, when replicating it. + */ + (void)slapi_pblock_get( pb, SLAPI_ADD_ENTRY, &te ); + if ( NULL != te ) { + dn = slapi_entry_get_dn( te ); + } + break; case OP_DELETE: - if (retrocl_log_deleted) - (void)slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &te); + if (retrocl_log_deleted) + (void)slapi_pblock_get(pb, SLAPI_ENTRY_PRE_OP, &te); break; case OP_MODRDN: - /* newrdn is used just for logging; no need to be normalized */ - (void)slapi_pblock_get( pb, SLAPI_MODRDN_NEWRDN, &newrdn ); - (void)slapi_pblock_get( pb, SLAPI_MODRDN_DELOLDRDN, &flag ); - (void)slapi_pblock_get( pb, SLAPI_MODIFY_MODS, &modrdn_mods ); - (void)slapi_pblock_get( pb, SLAPI_MODRDN_NEWSUPERIOR_SDN, &newsuperior ); - break; + /* newrdn is used just for logging; no need to be normalized */ + (void)slapi_pblock_get( pb, SLAPI_MODRDN_NEWRDN, &newrdn ); + (void)slapi_pblock_get( pb, SLAPI_MODRDN_DELOLDRDN, &flag ); + (void)slapi_pblock_get( pb, SLAPI_MODIFY_MODS, &modrdn_mods ); + (void)slapi_pblock_get( pb, SLAPI_MODRDN_NEWSUPERIOR_SDN, &newsuperior ); + break; } /* check if we should log change to retro changelog, and * if so, do it here */ - write_replog_db( pb, optype, dn, log_m, flag, curtime, te, - newrdn, modrdn_mods, slapi_sdn_get_dn(newsuperior) ); + if((rc = write_replog_db( pb, optype, dn, log_m, flag, curtime, te, + newrdn, modrdn_mods, slapi_sdn_get_dn(newsuperior) ))) + { + slapi_log_error(SLAPI_LOG_FATAL, "retrocl-plugin", + "retrocl_postob: operation failure [%d]\n", rc); + if(rc < 0){ + rc = LDAP_OPERATIONS_ERROR; + } + slapi_pblock_set(pb, SLAPI_RESULT_CODE, &rc); + rc = SLAPI_PLUGIN_FAILURE; + } - return 0; + return rc; }

1 0

Branch '389-ds-base-1.3.1' - ldap/servers
by Mark Reynolds 18 Jun '14

18 Jun '14

ldap/servers/slapd/back-ldbm/ldbm_add.c | 5 +++++ 1 file changed, 5 insertions(+) New commits: commit 98b0853fe4f566cd213415ef6dbc6f9641dda050 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Jun 17 17:23:07 2014 -0400 Ticket 47815 - Add operations rejected by betxn plugins remain in cache Bug Description: When an add operation is rejected by a betxn post plugin the "adding" entry is removed the cache(previously added tentatively), it gets re-added back to the entry cache when we call betxn post plugins just before the abort. Fix Description: Remove the entry from the cache when the 2nd run of the betxn postop plugins fails(just before we abort the transaction). https://fedorahosted.org/389/ticket/47815 valgrind: passed jenkins: passed Reviewed by: nhosoi(Thanks!) (cherry picked from commit fe81bda5f2f2cef647cedadf9ba442f8b7851973) diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c index 2b79be3..fb487cc 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_add.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c @@ -1220,6 +1220,11 @@ diskfull_return: opreturn = -1; slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &opreturn); } + if (addingentry_in_cache && addingentry && inst) { + CACHE_REMOVE(&inst->inst_cache, addingentry); + /* tell frontend not to free this entry */ + slapi_pblock_set(pb, SLAPI_ADD_ENTRY, NULL); + } } /* Release SERIAL LOCK */

1 0

Branch '389-ds-base-1.3.2' - ldap/servers
by Mark Reynolds 18 Jun '14

18 Jun '14

ldap/servers/slapd/back-ldbm/ldbm_add.c | 5 +++++ 1 file changed, 5 insertions(+) New commits: commit 887a72ef6f2cacdf256e340cb79732df0b220adb Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Jun 17 17:23:07 2014 -0400 Ticket 47815 - Add operations rejected by betxn plugins remain in cache Bug Description: When an add operation is rejected by a betxn post plugin the "adding" entry is removed the cache(previously added tentatively), it gets re-added back to the entry cache when we call betxn post plugins just before the abort. Fix Description: Remove the entry from the cache when the 2nd run of the betxn postop plugins fails(just before we abort the transaction). https://fedorahosted.org/389/ticket/47815 valgrind: passed jenkins: passed Reviewed by: nhosoi(Thanks!) (cherry picked from commit fe81bda5f2f2cef647cedadf9ba442f8b7851973) diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c index c99db8d..0dcb158 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_add.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c @@ -1220,6 +1220,11 @@ diskfull_return: opreturn = -1; slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &opreturn); } + if (addingentry_in_cache && addingentry && inst) { + CACHE_REMOVE(&inst->inst_cache, addingentry); + /* tell frontend not to free this entry */ + slapi_pblock_set(pb, SLAPI_ADD_ENTRY, NULL); + } } /* Release SERIAL LOCK */

1 0

ldap/servers
by Mark Reynolds 18 Jun '14

18 Jun '14

ldap/servers/slapd/back-ldbm/ldbm_add.c | 5 +++++ 1 file changed, 5 insertions(+) New commits: commit fe81bda5f2f2cef647cedadf9ba442f8b7851973 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Jun 17 17:23:07 2014 -0400 Ticket 47815 - Add operations rejected by betxn plugins remain in cache Bug Description: When an add operation is rejected by a betxn post plugin the "adding" entry is removed the cache(previously added tentatively), it gets re-added back to the entry cache when we call betxn post plugins just before the abort. Fix Description: Remove the entry from the cache when the 2nd run of the betxn postop plugins fails(just before we abort the transaction). https://fedorahosted.org/389/ticket/47815 valgrind: passed jenkins: passed Reviewed by: nhosoi(Thanks!) diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c index 5be1cd8..181c173 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_add.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c @@ -1222,6 +1222,11 @@ diskfull_return: opreturn = -1; slapi_pblock_set(pb, SLAPI_PLUGIN_OPRETURN, &opreturn); } + if (addingentry_in_cache && addingentry && inst) { + CACHE_REMOVE(&inst->inst_cache, addingentry); + /* tell frontend not to free this entry */ + slapi_pblock_set(pb, SLAPI_ADD_ENTRY, NULL); + } } /* Release SERIAL LOCK */

1 0

ldap/servers
by Mark Reynolds 13 Jun '14

13 Jun '14

ldap/servers/slapd/back-ldbm/seq.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) New commits: commit 958b4edfd966e3871d2f10f721e314f9362ce4e3 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Fri Jun 13 13:48:50 2014 -0400 Ticket 47602 - txn commit being performed too early Bug Description: The transaction is committed too early, and this leads to a deadlock when accessing the retro changelog. Fix Description: Move the commit after we are done using the txn(id2entry, etc). https://fedorahosted.org/389/ticket/47602 Reviewed by: nhosoi(Thanks!) diff --git a/ldap/servers/slapd/back-ldbm/seq.c b/ldap/servers/slapd/back-ldbm/seq.c index 29b3f6a..1874239 100644 --- a/ldap/servers/slapd/back-ldbm/seq.c +++ b/ldap/servers/slapd/back-ldbm/seq.c @@ -236,9 +236,6 @@ retry: dbc->c_close(dbc); if ((0 == return_value) || (DB_NOTFOUND == return_value)) { - if (txn.back_txn_txn) { - dblayer_read_txn_commit(be, &txn); - } /* Now check that the key we eventually settled on was an equality key ! */ if (key.data && *((char*)key.data) == EQ_PREFIX) { /* Retrieve the idlist for this key */ @@ -255,6 +252,7 @@ retry: if ((key.data != little_buffer) && (key.data != &keystring)) { slapi_ch_free(&(key.data)); } + dblayer_read_txn_abort(be, &txn); goto retry; } else { continue; @@ -321,6 +319,14 @@ retry: } idl_free( &idl ); } + /* if success finally commit the transaction, otherwise abort if DB_NOTFOUND */ + if(txn.back_txn_txn){ + if (return_value == 0) { + dblayer_read_txn_commit(be, &txn); + } else if (DB_NOTFOUND == return_value){ + dblayer_read_txn_abort(be, &txn); + } + } dblayer_release_index_file( be, ai, db );

1 0

Branch '389-ds-base-1.2.11' - 2 commits - ldap/servers
by Noriko Hosoi 12 Jun '14

12 Jun '14

ldap/servers/plugins/acl/acl.c | 28 ++++++++++++++++++++++++++-- ldap/servers/plugins/acl/acl.h | 3 ++- ldap/servers/plugins/acl/aclparse.c | 19 +++++++++++++++++++ 3 files changed, 47 insertions(+), 3 deletions(-) New commits: commit d8f6af4242a8f546a2d60a10b48fd8e24a9e72d9 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Apr 30 10:22:59 2013 -0700 Ticket 47331 - Self entry access ACI not working properly Description: Additional change to commit 79346deb255ca8d7889d7590534d308d4e3a78da which added a macro ACLPB_CACHE_RESULT_PER_ENTRY_SKIP, but ACLPB_STATE_ALL was not updated to cover the bit. This patch updates ACLPB_STATE_ALL to support the new bit. (cherry picked from commit 86fea4b326b28912cd0d8de0d0cb3a2f8dea423e) (cherry picked from commit 6d43552d862234334f94a5768132d71847bfcd20) diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h index dbe5c11..8a9bec2 100644 --- a/ldap/servers/plugins/acl/acl.h +++ b/ldap/servers/plugins/acl/acl.h @@ -475,7 +475,7 @@ struct acl_pblock { ACLPB_ACCESS_ALLOWED_ON_ENTRY | ACLPB_ATTR_STAR_MATCHED | \ ACLPB_FOUND_ATTR_RULE | ACLPB_EVALUATING_FIRST_ATTR | \ ACLPB_FOUND_A_ENTRY_TEST_RULE ) -#define ACLPB_STATE_ALL 0x3fffff +#define ACLPB_STATE_ALL 0xffffff int aclpb_res_type; commit 46b06bb3f12be8df973579971c5cdf4312456974 Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com> Date: Mon Apr 22 14:15:33 2013 +0200 Ticket 47331 - Self entry access ACI not working properly Bug Description: There are two issues in that bug. The first one is that for a given entry, the rights related to an attribute are evaluated and cached. Reusing this evaluation for a different entry is erronous. The second one is that for each deny/allow aci, the results of the evaluation of the aci is cached. These results are reset for aci type that are entry related. The parsing of the rule self entry access miss the setting of ACI_USERDN_SELFRULE. This flag allows to reset (in result cache) a result obtained on a previous entry. The consequence is that a previous result was erronously reused. Fix Description: The fix for the first issue, is to prevent acl__match_handlesFromCache to reuse already evaluated attributes. A new flag make acl__match_handlesFromCache to return if the evaluation is entry related. The second fix is to set ACI_USERDN_SELFRULE, when we have a rule like 'userdn = ldap:///self' https://fedorahosted.org/389/ticket/47331 Reviewed by: Noriko Hosoi, Ludwig Krispenz Platforms tested: fedora 17 Flag Day: no Doc impact: no (cherry picked from commit 79346deb255ca8d7889d7590534d308d4e3a78da) (cherry picked from commit 1580bcd71cbb60f0e97a36bf83faca6e079cd861) diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c index 09f28ee..d27c0e1 100644 --- a/ldap/servers/plugins/acl/acl.c +++ b/ldap/servers/plugins/acl/acl.c @@ -2799,6 +2799,11 @@ acl__TestRights(Acl_PBlock *aclpb,int access, char **right, char ** map_generic, if (access & ( SLAPI_ACL_SEARCH | SLAPI_ACL_READ)) { + /* We can not reused results obtained on a other entry */ + if (aci->aci_type & ACI_CACHE_RESULT_PER_ENTRY) { + aclpb->aclpb_state |= ACLPB_CACHE_RESULT_PER_ENTRY_SKIP; + } + /* * aclpb->aclpb_cache_result[0..aclpb->aclpb_last_cache_result] is * a cache of info about whether applicable acis @@ -3010,6 +3015,10 @@ acl__TestRights(Acl_PBlock *aclpb,int access, char **right, char ** map_generic, if (access & ( SLAPI_ACL_SEARCH | SLAPI_ACL_READ)) { + /* We can not reused results obtained on a other entry */ + if (aci->aci_type & ACI_CACHE_RESULT_PER_ENTRY) { + aclpb->aclpb_state |= ACLPB_CACHE_RESULT_PER_ENTRY_SKIP; + } /* * aclpb->aclpb_cache_result[0..aclpb->aclpb_last_cache_result] is * a cache of info about whether applicable acis @@ -3794,8 +3803,23 @@ acl__match_handlesFromCache ( Acl_PBlock *aclpb, char *attr, int access) } else { context_type = ACLPB_EVALCONTEXT_PREV; c_evalContext = &aclpb->aclpb_prev_entryEval_context; - } - + } + + /* we can not reused access evaluation done on a previous entry + * so just skip that cache + */ + if (aclpb->aclpb_state & ACLPB_CACHE_RESULT_PER_ENTRY_SKIP) { + aclpb->aclpb_state &= ~ACLPB_MATCHES_ALL_ACLS; + aclpb->aclpb_state |= ACLPB_UPD_ACLCB_CACHE; + /* Did not match */ + if (context_type == ACLPB_EVALCONTEXT_ACLCB) { + aclpb->aclpb_state &= ~ACLPB_HAS_ACLCB_EVALCONTEXT; + } else { + aclpb->aclpb_state |= ACLPB_COPY_EVALCONTEXT; + c_evalContext->acle_numof_tmatched_handles = 0; + } + return -1; + } if ( aclpb->aclpb_res_type & (ACLPB_NEW_ENTRY | ACLPB_EFFECTIVE_RIGHTS) ) { aclpb->aclpb_state |= ACLPB_MATCHES_ALL_ACLS; diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h index c61ee70..dbe5c11 100644 --- a/ldap/servers/plugins/acl/acl.h +++ b/ldap/servers/plugins/acl/acl.h @@ -468,6 +468,7 @@ struct acl_pblock { #define ACLPB_UPD_ACLCB_CACHE 0x100000 #define ACLPB_ATTR_RULE_EVALUATED 0x200000 #define ACLPB_DONOT_EVALUATE_PROXY 0x400000 +#define ACLPB_CACHE_RESULT_PER_ENTRY_SKIP 0x800000 #define ACLPB_RESET_MASK ( ACLPB_ACCESS_ALLOWED_ON_A_ATTR | ACLPB_ACCESS_DENIED_ON_ALL_ATTRS | \ diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c index 8b11471..26d57c4 100644 --- a/ldap/servers/plugins/acl/aclparse.c +++ b/ldap/servers/plugins/acl/aclparse.c @@ -784,6 +784,8 @@ normalize_nextACERule: goto error; } } else if ( 0 == strncmp ( s, DS_LAS_USERDN, 6 )) { + char *prefix; + p = PL_strnchr (s, '=', end - s); if (NULL == p) { goto error; @@ -808,6 +810,23 @@ normalize_nextACERule: goto error; } + /* skip the ldap prefix */ + prefix = PL_strncasestr(p, LDAP_URL_prefix, end - p); + if (prefix) { + prefix += strlen(LDAP_URL_prefix); + } else { + prefix = PL_strncasestr(p, LDAPS_URL_prefix, end - p); + if (prefix) { + prefix += strlen(LDAPS_URL_prefix); + } + } + if (prefix == NULL) { + /* userdn value does not starts with LDAP(S)_URL_prefix */ + goto error; + } + p = prefix; + + /* we have a rule like userdn = "ldap:///blah". s points to blah now. ** let's find if we have a SELF rule like userdn = "ldap:///self". ** Since the resource changes on entry basis, we can't cache the

1 0

Branch '389-ds-base-1.3.1' - 2 commits - ldap/servers
by Noriko Hosoi 12 Jun '14

12 Jun '14

ldap/servers/plugins/acl/acl.c | 28 ++++++++++++++++++++++++++-- ldap/servers/plugins/acl/acl.h | 3 ++- ldap/servers/plugins/acl/aclparse.c | 19 +++++++++++++++++++ 3 files changed, 47 insertions(+), 3 deletions(-) New commits: commit 6d43552d862234334f94a5768132d71847bfcd20 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Apr 30 10:22:59 2013 -0700 Ticket 47331 - Self entry access ACI not working properly Description: Additional change to commit 79346deb255ca8d7889d7590534d308d4e3a78da which added a macro ACLPB_CACHE_RESULT_PER_ENTRY_SKIP, but ACLPB_STATE_ALL was not updated to cover the bit. This patch updates ACLPB_STATE_ALL to support the new bit. (cherry picked from commit 86fea4b326b28912cd0d8de0d0cb3a2f8dea423e) diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h index abb0230..1d3698a 100644 --- a/ldap/servers/plugins/acl/acl.h +++ b/ldap/servers/plugins/acl/acl.h @@ -476,7 +476,7 @@ struct acl_pblock { ACLPB_ACCESS_ALLOWED_ON_ENTRY | ACLPB_ATTR_STAR_MATCHED | \ ACLPB_FOUND_ATTR_RULE | ACLPB_EVALUATING_FIRST_ATTR | \ ACLPB_FOUND_A_ENTRY_TEST_RULE ) -#define ACLPB_STATE_ALL 0x3fffff +#define ACLPB_STATE_ALL 0xffffff int aclpb_res_type; commit 1580bcd71cbb60f0e97a36bf83faca6e079cd861 Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com> Date: Mon Apr 22 14:15:33 2013 +0200 Ticket 47331 - Self entry access ACI not working properly Bug Description: There are two issues in that bug. The first one is that for a given entry, the rights related to an attribute are evaluated and cached. Reusing this evaluation for a different entry is erronous. The second one is that for each deny/allow aci, the results of the evaluation of the aci is cached. These results are reset for aci type that are entry related. The parsing of the rule self entry access miss the setting of ACI_USERDN_SELFRULE. This flag allows to reset (in result cache) a result obtained on a previous entry. The consequence is that a previous result was erronously reused. Fix Description: The fix for the first issue, is to prevent acl__match_handlesFromCache to reuse already evaluated attributes. A new flag make acl__match_handlesFromCache to return if the evaluation is entry related. The second fix is to set ACI_USERDN_SELFRULE, when we have a rule like 'userdn = ldap:///self' https://fedorahosted.org/389/ticket/47331 Reviewed by: Noriko Hosoi, Ludwig Krispenz Platforms tested: fedora 17 Flag Day: no Doc impact: no (cherry picked from commit 79346deb255ca8d7889d7590534d308d4e3a78da) diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c index 600eb12..2337e0d 100644 --- a/ldap/servers/plugins/acl/acl.c +++ b/ldap/servers/plugins/acl/acl.c @@ -2807,6 +2807,11 @@ acl__TestRights(Acl_PBlock *aclpb,int access, const char **right, const char ** if (access & ( SLAPI_ACL_SEARCH | SLAPI_ACL_READ)) { + /* We can not reused results obtained on a other entry */ + if (aci->aci_type & ACI_CACHE_RESULT_PER_ENTRY) { + aclpb->aclpb_state |= ACLPB_CACHE_RESULT_PER_ENTRY_SKIP; + } + /* * aclpb->aclpb_cache_result[0..aclpb->aclpb_last_cache_result] is * a cache of info about whether applicable acis @@ -3030,6 +3035,10 @@ acl__TestRights(Acl_PBlock *aclpb,int access, const char **right, const char ** if (access & ( SLAPI_ACL_SEARCH | SLAPI_ACL_READ)) { + /* We can not reused results obtained on a other entry */ + if (aci->aci_type & ACI_CACHE_RESULT_PER_ENTRY) { + aclpb->aclpb_state |= ACLPB_CACHE_RESULT_PER_ENTRY_SKIP; + } /* * aclpb->aclpb_cache_result[0..aclpb->aclpb_last_cache_result] is * a cache of info about whether applicable acis @@ -3830,8 +3839,23 @@ acl__match_handlesFromCache ( Acl_PBlock *aclpb, char *attr, int access) } else { context_type = ACLPB_EVALCONTEXT_PREV; c_evalContext = &aclpb->aclpb_prev_entryEval_context; - } - + } + + /* we can not reused access evaluation done on a previous entry + * so just skip that cache + */ + if (aclpb->aclpb_state & ACLPB_CACHE_RESULT_PER_ENTRY_SKIP) { + aclpb->aclpb_state &= ~ACLPB_MATCHES_ALL_ACLS; + aclpb->aclpb_state |= ACLPB_UPD_ACLCB_CACHE; + /* Did not match */ + if (context_type == ACLPB_EVALCONTEXT_ACLCB) { + aclpb->aclpb_state &= ~ACLPB_HAS_ACLCB_EVALCONTEXT; + } else { + aclpb->aclpb_state |= ACLPB_COPY_EVALCONTEXT; + c_evalContext->acle_numof_tmatched_handles = 0; + } + return -1; + } if ( aclpb->aclpb_res_type & (ACLPB_NEW_ENTRY | ACLPB_EFFECTIVE_RIGHTS) ) { aclpb->aclpb_state |= ACLPB_MATCHES_ALL_ACLS; diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h index bf58f5c..abb0230 100644 --- a/ldap/servers/plugins/acl/acl.h +++ b/ldap/servers/plugins/acl/acl.h @@ -469,6 +469,7 @@ struct acl_pblock { #define ACLPB_UPD_ACLCB_CACHE 0x100000 #define ACLPB_ATTR_RULE_EVALUATED 0x200000 #define ACLPB_DONOT_EVALUATE_PROXY 0x400000 +#define ACLPB_CACHE_RESULT_PER_ENTRY_SKIP 0x800000 #define ACLPB_RESET_MASK ( ACLPB_ACCESS_ALLOWED_ON_A_ATTR | ACLPB_ACCESS_DENIED_ON_ALL_ATTRS | \ diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c index 29203da..c9db473 100644 --- a/ldap/servers/plugins/acl/aclparse.c +++ b/ldap/servers/plugins/acl/aclparse.c @@ -826,6 +826,8 @@ normalize_nextACERule: goto error; } } else if ( 0 == strncmp ( s, DS_LAS_USERDN, 6 )) { + char *prefix; + p = PL_strnchr (s, '=', end - s); if (NULL == p) { goto error; @@ -850,6 +852,23 @@ normalize_nextACERule: goto error; } + /* skip the ldap prefix */ + prefix = PL_strncasestr(p, LDAP_URL_prefix, end - p); + if (prefix) { + prefix += strlen(LDAP_URL_prefix); + } else { + prefix = PL_strncasestr(p, LDAPS_URL_prefix, end - p); + if (prefix) { + prefix += strlen(LDAPS_URL_prefix); + } + } + if (prefix == NULL) { + /* userdn value does not starts with LDAP(S)_URL_prefix */ + goto error; + } + p = prefix; + + /* we have a rule like userdn = "ldap:///blah". s points to blah now. ** let's find if we have a SELF rule like userdn = "ldap:///self". ** Since the resource changes on entry basis, we can't cache the

1 0

Branch '389-ds-base-1.2.11' - 2 commits - ldap/servers
by Noriko Hosoi 12 Jun '14

12 Jun '14

ldap/servers/slapd/connection.c | 21 +++++++++++++++++++++ ldap/servers/slapd/daemon.c | 25 +++++++++++++++---------- ldap/servers/slapd/pblock.c | 12 ++++++++++++ ldap/servers/slapd/slap.h | 4 +++- 4 files changed, 51 insertions(+), 11 deletions(-) New commits: commit a184bbb92e59105ca196d793b87541c656081e12 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Thu Aug 1 15:05:16 2013 -0400 Ticket47426 - Coverity issue with last commit(move compute_idletimeout out of handle_pr_read_ready) I had added a NULL check trying to avoid a coverity error, but pb->pb_conn can not be NULL when it gets to this code. Removed NULL check. https://fedorahosted.org/389/ticket/47426 Reviewed by: ? (cherry picked from commit a4daf1a0a65f796878b40b8ebc572082a1101f3b) (cherry picked from commit 89b78da25aa79101d6b43529a7486c64feb5eda6) diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index 7aea493..c2ec4a7 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -2210,7 +2210,7 @@ connection_threadmain() in connection_activity when the conn is added to the work queue, setup_pr_read_pds won't add the connection prfd to the poll list */ - if(pb->pb_conn && pb->pb_conn->c_opscompleted == 0){ + if(pb->pb_conn->c_opscompleted == 0){ /* * We have a new connection, set the anonymous reslimit idletimeout * if applicable. commit ed408d89c0bf6d5ebbe7c4ab44f47bdafd6f0765 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Wed Jul 31 19:19:34 2013 -0400 Ticket 47426 - move compute_idletimeout out of handle_pr_read_ready Description: Instead of calculating the idletimeout everytime new data is received, set the anonymous reslimit idletimeout and handle in the connection struct when the connection first comes in. Then update idletimeout after each bind. I removed compute_idletimeout() because bind_credentials_set_nolock() basically does the same thing, so it was just extended to update the idletimeout. https://fedorahosted.org/389/ticket/47426 Reviewed by: richm(Thanks!) (cherry picked from commit ed83a783887b0f9c54781bac64c7b26f0402640a) (cherry picked from commit d4f9c40d6d7f36b31e81c2326036a65229fe470f) diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index 914a2d3..7aea493 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -2210,6 +2210,27 @@ connection_threadmain() in connection_activity when the conn is added to the work queue, setup_pr_read_pds won't add the connection prfd to the poll list */ + if(pb->pb_conn && pb->pb_conn->c_opscompleted == 0){ + /* + * We have a new connection, set the anonymous reslimit idletimeout + * if applicable. + */ + char *anon_dn = config_get_anon_limits_dn(); + int idletimeout; + /* If an anonymous limits dn is set, use it to set the limits. */ + if (anon_dn && (strlen(anon_dn) > 0)) { + Slapi_DN *anon_sdn = slapi_sdn_new_normdn_byref( anon_dn ); + reslimit_update_from_dn( pb->pb_conn, anon_sdn ); + slapi_sdn_free( &anon_sdn ); + if (slapi_reslimit_get_integer_limit(pb->pb_conn, pb->pb_conn->c_idletimeout_handle, + &idletimeout) + == SLAPI_RESLIMIT_STATUS_SUCCESS) + { + pb->pb_conn->c_idletimeout = idletimeout; + } + } + slapi_ch_free_string( &anon_dn ); + } if (connection_call_io_layer_callbacks(pb->pb_conn)) { LDAPDebug0Args( LDAP_DEBUG_ANY, "Error: could not add/remove IO layers from connection\n" ); } diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index 3db8350..9d24829 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -1779,7 +1779,6 @@ daemon_register_reslimits( void ) &idletimeout_reslimit_handle )); } - /* * Compute the idle timeout for the connection. * @@ -1871,9 +1870,8 @@ handle_read_ready(Connection_Table *ct, fd_set *readfds) /* idle timeout */ } - else if (( idletimeout = compute_idletimeout( - slapdFrontendConfig, c )) > 0 && - (curtime - c->c_idlesince) >= idletimeout && + else if (( c->c_idletimeout > 0 && + (curtime - c->c_idlesince) >= c->c_idletimeout && NULL == c->c_ops ) { disconnect_server_nomutex( c, c->c_connid, -1, @@ -1895,6 +1893,7 @@ handle_pr_read_ready(Connection_Table *ct, PRIntn num_poll) time_t curtime = current_time(); slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); int idletimeout; + int maxthreads = config_get_maxthreadsperconn(); #if defined( XP_WIN32 ) int i; #endif @@ -1957,10 +1956,9 @@ handle_pr_read_ready(Connection_Table *ct, PRIntn num_poll) /* This is where the work happens ! */ connection_activity( c ); } - else if (( idletimeout = compute_idletimeout( slapdFrontendConfig, - c )) > 0 && + else if (( c->c_ideltimeout > 0 && c->c_prfd == ct->fd[i].fd && - (curtime - c->c_idlesince) >= idletimeout && + (curtime - c->c_idlesince) >= c->c_ideltimeout && NULL == c->c_ops ) { /* idle timeout */ @@ -2031,9 +2029,8 @@ handle_pr_read_ready(Connection_Table *ct, PRIntn num_poll) SLAPD_DISCONNECT_POLL, EPIPE ); } } - else if (( idletimeout = compute_idletimeout( - slapdFrontendConfig, c )) > 0 && - (curtime - c->c_idlesince) >= idletimeout && + else if (c->c_idletimeout > 0 && + (curtime - c->c_idlesince) >= c->c_idletimeout && NULL == c->c_ops ) { /* idle timeout */ @@ -2602,6 +2599,7 @@ handle_new_connection(Connection_Table *ct, int tcps, PRFileDesc *pr_acceptfd, i /* struct sockaddr_in from;*/ PRNetAddr from; PRFileDesc *pr_clonefd = NULL; + slapdFrontendConfig_t *fecfg = getFrontendConfig(); memset(&from, 0, sizeof(from)); /* reset to nulls so we can see what was set */ if ( (ns = accept_and_configure( tcps, pr_acceptfd, &from, @@ -2618,6 +2616,13 @@ handle_new_connection(Connection_Table *ct, int tcps, PRFileDesc *pr_acceptfd, i } PR_Lock( conn->c_mutex ); + /* + * Set the default idletimeout and the handle. We'll update c_idletimeout + * after each bind so we can correctly set the resource limit. + */ + conn->c_idletimeout = fecfg->idletimeout; + conn->c_idletimeout_handle = idletimeout_reslimit_handle; + #if defined( XP_WIN32 ) if( !secure ) ber_sockbuf_set_option(conn->c_sb,LBER_SOCKBUF_OPT_DESC,&ns); diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c index 20df245..849c20e 100644 --- a/ldap/servers/slapd/pblock.c +++ b/ldap/servers/slapd/pblock.c @@ -3647,6 +3647,9 @@ void bind_credentials_set_nolock( Connection *conn, char *authtype, char *normdn, char *extauthtype, char *externaldn, CERTCertificate *clientcert, Slapi_Entry * bind_target_entry ) { + slapdFrontendConfig_t *fecfg = getFrontendConfig(); + int idletimeout = 0; + /* clear credentials */ bind_credentials_clear( conn, PR_FALSE /* conn is already locked */, ( extauthtype != NULL ) /* clear external creds. if requested */ ); @@ -3690,8 +3693,17 @@ bind_credentials_set_nolock( Connection *conn, char *authtype, char *normdn, slapi_ch_free_string( &anon_dn ); } + if (slapi_reslimit_get_integer_limit(conn, conn->c_idletimeout_handle, + &idletimeout) + != SLAPI_RESLIMIT_STATUS_SUCCESS) + { + conn->c_idletimeout = fecfg->idletimeout; + } else { + conn->c_idletimeout = idletimeout; + } } else { /* For root dn clear about the resource limits */ reslimit_update_from_entry( conn, NULL ); + conn->c_idletimeout = 0; } } diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 42b6a1e..33cfeb4 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1406,7 +1406,7 @@ typedef struct conn { char *c_authtype; /* auth method used to bind c_dn */ char *c_external_dn; /* client DN of this SSL session */ char *c_external_authtype; /* used for c_external_dn */ - PRNetAddr *cin_addr; /* address of client on this conn */ + PRNetAddr *cin_addr; /* address of client on this conn */ PRNetAddr *cin_destaddr; /* address client connected to */ struct berval **c_domain; /* DNS names of client */ Operation *c_ops; /* list of pending operations */ @@ -1421,6 +1421,8 @@ typedef struct conn { PRLock *c_mutex; /* protect each conn structure */ PRLock *c_pdumutex; /* only write one pdu at a time */ time_t c_idlesince; /* last time of activity on conn */ + int c_idletimeout; /* local copy of idletimeout */ + int c_idletimeout_handle; /* the resource limits handle */ Conn_private *c_private; /* data which is not shared outside*/ /* connection.c */ int c_flags; /* Misc flags used only for SSL */

1 0

Branch '389-ds-base-1.3.1' - 2 commits - ldap/servers
by Noriko Hosoi 12 Jun '14

12 Jun '14

ldap/servers/slapd/connection.c | 21 +++++++++++++++++++++ ldap/servers/slapd/daemon.c | 25 +++++++++++++++---------- ldap/servers/slapd/pblock.c | 12 ++++++++++++ ldap/servers/slapd/slap.h | 4 +++- 4 files changed, 51 insertions(+), 11 deletions(-) New commits: commit 89b78da25aa79101d6b43529a7486c64feb5eda6 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Thu Aug 1 15:05:16 2013 -0400 Ticket47426 - Coverity issue with last commit(move compute_idletimeout out of handle_pr_read_ready) I had added a NULL check trying to avoid a coverity error, but pb->pb_conn can not be NULL when it gets to this code. Removed NULL check. https://fedorahosted.org/389/ticket/47426 Reviewed by: ? (cherry picked from commit a4daf1a0a65f796878b40b8ebc572082a1101f3b) diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index 31b2a2c..9dc9d65 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -2239,7 +2239,7 @@ connection_threadmain() in connection_activity when the conn is added to the work queue, setup_pr_read_pds won't add the connection prfd to the poll list */ - if(pb->pb_conn && pb->pb_conn->c_opscompleted == 0){ + if(pb->pb_conn->c_opscompleted == 0){ /* * We have a new connection, set the anonymous reslimit idletimeout * if applicable. commit d4f9c40d6d7f36b31e81c2326036a65229fe470f Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Wed Jul 31 19:19:34 2013 -0400 Ticket 47426 - move compute_idletimeout out of handle_pr_read_ready Description: Instead of calculating the idletimeout everytime new data is received, set the anonymous reslimit idletimeout and handle in the connection struct when the connection first comes in. Then update idletimeout after each bind. I removed compute_idletimeout() because bind_credentials_set_nolock() basically does the same thing, so it was just extended to update the idletimeout. https://fedorahosted.org/389/ticket/47426 Reviewed by: richm(Thanks!) (cherry picked from commit ed83a783887b0f9c54781bac64c7b26f0402640a) diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c index 02c86c5..31b2a2c 100644 --- a/ldap/servers/slapd/connection.c +++ b/ldap/servers/slapd/connection.c @@ -2239,6 +2239,27 @@ connection_threadmain() in connection_activity when the conn is added to the work queue, setup_pr_read_pds won't add the connection prfd to the poll list */ + if(pb->pb_conn && pb->pb_conn->c_opscompleted == 0){ + /* + * We have a new connection, set the anonymous reslimit idletimeout + * if applicable. + */ + char *anon_dn = config_get_anon_limits_dn(); + int idletimeout; + /* If an anonymous limits dn is set, use it to set the limits. */ + if (anon_dn && (strlen(anon_dn) > 0)) { + Slapi_DN *anon_sdn = slapi_sdn_new_normdn_byref( anon_dn ); + reslimit_update_from_dn( pb->pb_conn, anon_sdn ); + slapi_sdn_free( &anon_sdn ); + if (slapi_reslimit_get_integer_limit(pb->pb_conn, pb->pb_conn->c_idletimeout_handle, + &idletimeout) + == SLAPI_RESLIMIT_STATUS_SUCCESS) + { + pb->pb_conn->c_idletimeout = idletimeout; + } + } + slapi_ch_free_string( &anon_dn ); + } if (connection_call_io_layer_callbacks(pb->pb_conn)) { LDAPDebug0Args( LDAP_DEBUG_ANY, "Error: could not add/remove IO layers from connection\n" ); } diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index dddbd5f..0ac3211 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -1782,7 +1782,6 @@ daemon_register_reslimits( void ) &idletimeout_reslimit_handle )); } - /* * Compute the idle timeout for the connection. * @@ -1877,9 +1876,8 @@ handle_read_ready(Connection_Table *ct, fd_set *readfds) /* idle timeout */ } - else if (( idletimeout = compute_idletimeout( - slapdFrontendConfig, c )) > 0 && - (curtime - c->c_idlesince) >= idletimeout && + else if (( c->c_idletimeout > 0 && + (curtime - c->c_idlesince) >= c->c_idletimeout && NULL == c->c_ops ) { disconnect_server_nomutex( c, c->c_connid, -1, @@ -1901,6 +1899,7 @@ handle_pr_read_ready(Connection_Table *ct, PRIntn num_poll) time_t curtime = current_time(); slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); int idletimeout; + int maxthreads = config_get_maxthreadsperconn(); #if defined( XP_WIN32 ) int i; #endif @@ -1963,10 +1962,9 @@ handle_pr_read_ready(Connection_Table *ct, PRIntn num_poll) /* This is where the work happens ! */ connection_activity( c ); } - else if (( idletimeout = compute_idletimeout( slapdFrontendConfig, - c )) > 0 && + else if (( c->c_ideltimeout > 0 && c->c_prfd == ct->fd[i].fd && - (curtime - c->c_idlesince) >= idletimeout && + (curtime - c->c_idlesince) >= c->c_ideltimeout && NULL == c->c_ops ) { /* idle timeout */ @@ -2037,9 +2035,8 @@ handle_pr_read_ready(Connection_Table *ct, PRIntn num_poll) SLAPD_DISCONNECT_POLL, EPIPE ); } } - else if (( idletimeout = compute_idletimeout( - slapdFrontendConfig, c )) > 0 && - (curtime - c->c_idlesince) >= idletimeout && + else if (c->c_idletimeout > 0 && + (curtime - c->c_idlesince) >= c->c_idletimeout && NULL == c->c_ops ) { /* idle timeout */ @@ -2609,6 +2606,7 @@ handle_new_connection(Connection_Table *ct, int tcps, PRFileDesc *pr_acceptfd, i PRNetAddr from; PRFileDesc *pr_clonefd = NULL; ber_len_t maxbersize; + slapdFrontendConfig_t *fecfg = getFrontendConfig(); memset(&from, 0, sizeof(from)); /* reset to nulls so we can see what was set */ if ( (ns = accept_and_configure( tcps, pr_acceptfd, &from, @@ -2625,6 +2623,13 @@ handle_new_connection(Connection_Table *ct, int tcps, PRFileDesc *pr_acceptfd, i } PR_Lock( conn->c_mutex ); + /* + * Set the default idletimeout and the handle. We'll update c_idletimeout + * after each bind so we can correctly set the resource limit. + */ + conn->c_idletimeout = fecfg->idletimeout; + conn->c_idletimeout_handle = idletimeout_reslimit_handle; + #if defined( XP_WIN32 ) if( !secure ) ber_sockbuf_set_option(conn->c_sb,LBER_SOCKBUF_OPT_DESC,&ns); diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c index 8d8c66f..9e6ade7 100644 --- a/ldap/servers/slapd/pblock.c +++ b/ldap/servers/slapd/pblock.c @@ -3650,6 +3650,9 @@ void bind_credentials_set_nolock( Connection *conn, char *authtype, char *normdn, char *extauthtype, char *externaldn, CERTCertificate *clientcert, Slapi_Entry * bind_target_entry ) { + slapdFrontendConfig_t *fecfg = getFrontendConfig(); + int idletimeout = 0; + /* clear credentials */ bind_credentials_clear( conn, PR_FALSE /* conn is already locked */, ( extauthtype != NULL ) /* clear external creds. if requested */ ); @@ -3693,8 +3696,17 @@ bind_credentials_set_nolock( Connection *conn, char *authtype, char *normdn, slapi_ch_free_string( &anon_dn ); } + if (slapi_reslimit_get_integer_limit(conn, conn->c_idletimeout_handle, + &idletimeout) + != SLAPI_RESLIMIT_STATUS_SUCCESS) + { + conn->c_idletimeout = fecfg->idletimeout; + } else { + conn->c_idletimeout = idletimeout; + } } else { /* For root dn clear about the resource limits */ reslimit_update_from_entry( conn, NULL ); + conn->c_idletimeout = 0; } } diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index e9b11f1..87f0039 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1435,7 +1435,7 @@ typedef struct conn { char *c_authtype; /* auth method used to bind c_dn */ char *c_external_dn; /* client DN of this SSL session */ char *c_external_authtype; /* used for c_external_dn */ - PRNetAddr *cin_addr; /* address of client on this conn */ + PRNetAddr *cin_addr; /* address of client on this conn */ PRNetAddr *cin_destaddr; /* address client connected to */ struct berval **c_domain; /* DNS names of client */ Operation *c_ops; /* list of pending operations */ @@ -1450,6 +1450,8 @@ typedef struct conn { PRLock *c_mutex; /* protect each conn structure */ PRLock *c_pdumutex; /* only write one pdu at a time */ time_t c_idlesince; /* last time of activity on conn */ + int c_idletimeout; /* local copy of idletimeout */ + int c_idletimeout_handle; /* the resource limits handle */ Conn_private *c_private; /* data which is not shared outside*/ /* connection.c */ int c_flags; /* Misc flags used only for SSL */

1 0

Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi 12 Jun '14

12 Jun '14

ldap/servers/plugins/uiduniq/7bit.c | 37 ++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) New commits: commit 7e7a85f6fb74547f7d2af191db3b4608b39995ab Author: Anupam Jain <anjain(a)localhost.localdomain> Date: Wed Jul 10 17:18:03 2013 -0700 Ticket #47423 - 7-bit check plugin does not work for userpassword attribute Bug description: 7-bit check plugin fails to validate userpassword attribute Fix description: This patch corrects the validation code for userpassword attribute. It fetches the unhashed userpassword from the extension instead of the entry attribute value https://fedorahosted.org/389/ticket/47423 Reviewed by nhosoi. (cherry picked from commit d804aaf7ee15841ac1aeaf831879fe56da23931d) (cherry picked from commit f5ee5b8babfb7b61db7da3db7ab7c443eda58323) diff --git a/ldap/servers/plugins/uiduniq/7bit.c b/ldap/servers/plugins/uiduniq/7bit.c index f690b4e..c98d660 100644 --- a/ldap/servers/plugins/uiduniq/7bit.c +++ b/ldap/servers/plugins/uiduniq/7bit.c @@ -218,7 +218,8 @@ preop_add(Slapi_PBlock *pb) { int result; char *violated = NULL; - + char *pwd = NULL; + char *origpwd = NULL; #ifdef DEBUG slapi_log_error(SLAPI_LOG_PLUGIN, plugin_name, "ADD begin\n"); #endif @@ -236,12 +237,14 @@ preop_add(Slapi_PBlock *pb) const char *dn; Slapi_DN *sdn = NULL; Slapi_Entry *e; - Slapi_Attr *attr; char **firstSubtree; char **subtreeDN; int subtreeCnt; int is_replicated_operation; - + struct berval *vals[2]; + struct berval val; + vals[0] = &val; + vals[1] = NULL; /* * Get the arguments */ @@ -288,19 +291,26 @@ preop_add(Slapi_PBlock *pb) for (attrName = argv; strcmp(*attrName, ",") != 0; attrName++ ) { /* - * if the attribute is userpassword, check unhashed#user#password + * if the attribute is userpassword, check unhashed user password * instead. "userpassword" is encoded; it will always pass the 7bit * check. */ - char *attr_name; + char *attr_name = NULL; + Slapi_Attr *attr = NULL; if ( strcasecmp(*attrName, "userpassword") == 0 ) { - attr_name = "unhashed#user#password"; + origpwd = pwd = slapi_get_first_clear_text_pw(e); + if (pwd == NULL) + { + continue; + } + val.bv_val = pwd; + val.bv_len = strlen(val.bv_val); } else { attr_name = *attrName; + err = slapi_entry_attr_find(e, attr_name, &attr); + if (err) continue; /* break;*/ /* no 7-bit attribute */ } - err = slapi_entry_attr_find(e, attr_name, &attr); - if (err) continue; /* break;*/ /* no 7-bit attribute */ /* * For each DN in the managed list, do 7-bit checking if @@ -323,7 +333,14 @@ preop_add(Slapi_PBlock *pb) /* * Check if the value is 7-bit clean */ - result = bit_check(attr, NULL, &violated); + if(pwd) + { + result = bit_check(attr, vals, &violated); + if(!result) + pwd = NULL; + } + else + result = bit_check(attr, NULL, &violated); if (result) break; } } @@ -335,7 +352,7 @@ preop_add(Slapi_PBlock *pb) if (result) { issue_error(pb, result, "ADD", violated); } - + slapi_ch_free_string(&origpwd); return (result==LDAP_SUCCESS)?0:-1; }

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits June 2014