admserv/cgi-src40/repl-monitor-cgi.pl.in | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
New commits:
commit f733c904293bb50ac2c5bcfc441b527fcec30e19
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 30 14:53:53 2015 -0800
Ticket #48024 - repl-monitor invoked from adminserver cgi fails
Description: A generated file by a cgi script requires the "Content-
Type: text/html" at the top. This patch adds it. Also, removing
the old default config file path, e.g., /etc/dirsrv/eplmon.conf,
which we don't include any more.
https://fedorahosted.org/389/ticket/48024
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/admserv/cgi-src40/repl-monitor-cgi.pl.in b/admserv/cgi-src40/repl-monitor-cgi.pl.in
index 5529454..3a7cc05 100755
--- a/admserv/cgi-src40/repl-monitor-cgi.pl.in
+++ b/admserv/cgi-src40/repl-monitor-cgi.pl.in
@@ -43,15 +43,7 @@ use CGI;
my $query = CGI->new;
@ARGV = (); # clear it out
-if ( $query->url_param('configfile') eq "" ) {
- my $configfile;
- if ($ENV{DS_CONFIG_DIR} and -d $ENV{DS_CONFIG_DIR}) {
- $configfile = "$ENV{DS_CONFIG_DIR}/@instancename@/replmon.conf";
- } elsif ("@instconfigdir@" and -d "@instconfigdir@") {
- $configfile = "@instconfigdir@/replmon.conf";
- }
- push @ARGV, '-f', $configfile;
-} else {
+if ( $query->url_param('configfile') ne "" ) {
push @ARGV, '-f', $query->url_param('configfile');
}
@@ -76,4 +68,5 @@ if ( $query->url_param('servport') ne "" ) {
}
# Now the real work
+print "Content-Type: text/html\n\n";
require "@bindir@/repl-monitor.pl";
1
0
dirsrvtests/tickets/create_testcase.py | 540 +++++++++++++++++++++++++++++++++
1 file changed, 540 insertions(+)
New commits:
commit f68e2d46026f928aa40851f88eeb621af5c3560c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Thu Jan 29 08:56:06 2015 -0500
Ticket 48017 - add script to generate lib389 CI test script
Description: Created a new script to generate a consistent, concise
lib389 CI test script template. Everyting is written for
the user except the contents of the "test" function.
Replication masters, hubs, and consumers can be easily
be added, and fully configured/initialized by using
simple command line arguments:
# python ./create_testcase.py --ticket 48017 --masters 4 --hubs 2 --consumers 10
This is a maximum of 10 standalone servers, or 10 masters,
10 hubs, and 10 consumers.
https://fedorahosted.org/389/ticket/48017
Reviewed by: nhosoi(Thanks!!)
diff --git a/dirsrvtests/tickets/create_testcase.py b/dirsrvtests/tickets/create_testcase.py
new file mode 100644
index 0000000..6697823
--- /dev/null
+++ b/dirsrvtests/tickets/create_testcase.py
@@ -0,0 +1,540 @@
+import sys
+import optparse
+
+'''
+ This script generates a template test script that handles the
+ non-interesting parts of a test script:
+ topology,
+ test (to be completed by the user),
+ final,
+ and run-isolated functions
+'''
+
+
+def displayUsage():
+ print ('\nUsage:\ncreate_ticket.py -t|--ticket <ticket number> [ i|--instances ' +
+ '<number of standalone instances> [ -m|--masters <number of masters> ' +
+ '-h|--hubs <number of hubs> -c|--consumers <number of consumers> ] ' +
+ '-o|--outputfile ]\n')
+ print ('If only "-t" is provided then a single standalone instance is created. ' +
+ 'The "-i" option can add mulitple standalone instances(maximum 10). ' +
+ 'However, you can not mix "-i" with the replication options(-m, -h , -c). ' +
+ 'There is a maximum of 10 masters, 10 hubs, and 10 consumers.')
+ exit(1)
+
+desc = 'Script to generate an initial lib389 test script. ' + \
+ 'This generates the topology, test, final, and run-isolated functions.'
+
+if len(sys.argv) > 0:
+ parser = optparse.OptionParser(description=desc, add_help_option=False)
+
+ # Script options
+ parser.add_option('-t', '--ticket', dest='ticket', default=None)
+ parser.add_option('-i', '--instances', dest='inst', default=None)
+ parser.add_option('-m', '--masters', dest='masters', default='0')
+ parser.add_option('-h', '--hubs', dest='hubs', default='0')
+ parser.add_option('-c', '--consumers', dest='consumers', default='0')
+ parser.add_option('-o', '--outputfile', dest='filename', default=None)
+
+ # Validate the options
+ try:
+ (args, opts) = parser.parse_args()
+ except:
+ displayUsage()
+
+ if args.ticket is None:
+ print 'Missing required ticket number'
+ displayUsage()
+
+ if int(args.masters) == 0:
+ if int(args.hubs) > 0 or int(args.consumers) > 0:
+ print 'You must use "-m|--masters" if you want to have hubs and/or consumers'
+ displayUsage()
+
+ if not args.masters.isdigit() or int(args.masters) > 10 or int(args.masters) < 0:
+ print 'Invalid value for "--masters", it must be a number and it can not be greater than 10'
+ displayUsage()
+
+ if not args.hubs.isdigit() or int(args.hubs) > 10 or int(args.hubs) < 0:
+ print 'Invalid value for "--hubs", it must be a number and it can not be greater than 10'
+ displayUsage()
+
+ if not args.consumers.isdigit() or int(args.consumers) > 10 or int(args.consumers) < 0:
+ print 'Invalid value for "--consumers", it must be a number and it can not be greater than 10'
+ displayUsage()
+
+ if args.inst:
+ if not args.inst.isdigit() or int(args.inst) > 10 or int(args.inst) < 1:
+ print ('Invalid value for "--instances", it must be a number greater than 0 ' +
+ 'and not greater than 10')
+ displayUsage()
+ if int(args.inst) > 0:
+ if int(args.masters) > 0 or int(args.hubs) > 0 or int(args.consumers) > 0:
+ print 'You can not mix "--instances" with replication.'
+ displayUsage()
+
+ # Extract usable values
+ masters = int(args.masters)
+ hubs = int(args.hubs)
+ consumers = int(args.consumers)
+ ticket = args.ticket
+ if not args.inst:
+ instances = 1
+ else:
+ instances = int(args.inst)
+ filename = args.filename
+
+ #
+ # Create/open the new test script file
+ #
+ if not filename:
+ filename = 'ticket' + ticket + '_test.py'
+ try:
+ TEST = open(filename, "w")
+ except IOError:
+ print "Can\'t open file:", filename
+ exit(1)
+
+ #
+ # Write the imports
+ #
+ TEST.write('import os\nimport sys\nimport time\nimport ldap\nimport ldap.sasl\n' +
+ 'import logging\nimport socket\nimport pytest\n')
+ TEST.write('from lib389 import DirSrv, Entry, tools, tasks\nfrom lib389.tools import DirSrvTools\n' +
+ 'from lib389._constants import *\nfrom lib389.properties import *\nfrom lib389.tasks import *\n\n')
+
+ #
+ # Set the logger and installation prefix
+ #
+ TEST.write('logging.getLogger(__name__).setLevel(logging.DEBUG)\n')
+ TEST.write('log = logging.getLogger(__name__)\n\n')
+ TEST.write('installation1_prefix = None\n\n\n')
+
+ #
+ # Write the replication or standalone classes
+ #
+ repl_deployment = False
+ if masters + hubs + consumers > 0:
+ #
+ # Write the replication class
+ #
+ repl_deployment = True
+
+ TEST.write('class TopologyReplication(object):\n')
+ TEST.write(' def __init__(self')
+ for idx in range(masters):
+ TEST.write(', master' + str(idx + 1))
+ for idx in range(hubs):
+ TEST.write(', hub' + str(idx + 1))
+ for idx in range(consumers):
+ TEST.write(', consumer' + str(idx + 1))
+ TEST.write('):\n')
+
+ for idx in range(masters):
+ TEST.write(' master' + str(idx + 1) + '.open()\n')
+ TEST.write(' self.master' + str(idx + 1) + ' = master' + str(idx + 1) + '\n')
+ for idx in range(hubs):
+ TEST.write(' hub' + str(idx + 1) + '.open()\n')
+ TEST.write(' self.hub' + str(idx + 1) + ' = hub' + str(idx + 1) + '\n')
+ for idx in range(consumers):
+ TEST.write(' consumer' + str(idx + 1) + '.open()\n')
+ TEST.write(' self.consumer' + str(idx + 1) + ' = consumer' + str(idx + 1) + '\n')
+ TEST.write('\n\n')
+ else:
+ #
+ # Write the standalone class
+ #
+ TEST.write('class TopologyStandalone(object):\n')
+ TEST.write(' def __init__(self')
+ for idx in range(instances):
+ idx += 1
+ if idx == 1:
+ idx = ''
+ else:
+ idx = str(idx)
+ TEST.write(', standalone' + idx)
+ TEST.write('):\n')
+
+ for idx in range(instances):
+ idx += 1
+ if idx == 1:
+ idx = ''
+ else:
+ idx = str(idx)
+ TEST.write(' standalone' + idx + '.open()\n')
+ TEST.write(' self.standalone' + idx + ' = standalone' + idx + '\n')
+ TEST.write('\n\n')
+
+ #
+ # Write the 'topology function'
+ #
+ TEST.write('@pytest.fixture(scope="module")\n')
+ TEST.write('def topology(request): \n')
+ TEST.write(' global installation1_prefix\n')
+ TEST.write(' if installation1_prefix:\n')
+ TEST.write(' args_instance[SER_DEPLOYED_DIR] = installation1_prefix\n\n')
+
+ if repl_deployment:
+ #
+ # Create the replication instances
+ #
+ for idx in range(masters):
+ idx = str(idx + 1)
+ TEST.write(' # Creating master ' + idx + '...\n')
+ TEST.write(' master' + idx + ' = DirSrv(verbose=False)\n')
+ TEST.write(' args_instance[SER_HOST] = HOST_MASTER_' + idx + '\n')
+ TEST.write(' args_instance[SER_PORT] = PORT_MASTER_' + idx + '\n')
+ TEST.write(' args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_' + idx + '\n')
+ TEST.write(' args_master = args_instance.copy()\n')
+ TEST.write(' master' + idx + '.allocate(args_master)\n')
+ TEST.write(' instance_master' + idx + ' = master' + idx + '.exists()\n')
+ TEST.write(' if instance_master' + idx + ':\n')
+ TEST.write(' master' + idx + '.delete()\n')
+ TEST.write(' master' + idx + '.create()\n')
+ TEST.write(' master' + idx + '.open()\n')
+ TEST.write(' master' + idx + '.replica.enableReplication(suffix=SUFFIX, ' +
+ 'role=REPLICAROLE_MASTER, ' +
+ 'replicaId=REPLICAID_MASTER_' + idx + ')\n\n')
+
+ for idx in range(hubs):
+ idx = str(idx + 1)
+ TEST.write(' # Creating hub ' + idx + '...\n')
+ TEST.write(' hub' + idx + ' = DirSrv(verbose=False)\n')
+ TEST.write(' args_instance[SER_HOST] = HOST_HUB_' + idx + '\n')
+ TEST.write(' args_instance[SER_PORT] = PORT_HUB_' + idx + '\n')
+ TEST.write(' args_instance[SER_SERVERID_PROP] = SERVERID_HUB_' + idx + '\n')
+ TEST.write(' args_hub = args_instance.copy()\n')
+ TEST.write(' hub' + idx + '.allocate(args_hub)\n')
+ TEST.write(' instance_hub' + idx + ' = hub' + idx + '.exists()\n')
+ TEST.write(' if instance_hub' + idx + ':\n')
+ TEST.write(' hub' + idx + '.delete()\n')
+ TEST.write(' hub' + idx + '.create()\n')
+ TEST.write(' hub' + idx + '.open()\n')
+ TEST.write(' hub' + idx + '.replica.enableReplication(suffix=SUFFIX, ' +
+ 'role=REPLICAROLE_HUB, ' +
+ 'replicaId=REPLICAID_HUB_' + idx + ')\n\n')
+
+ for idx in range(consumers):
+ idx = str(idx + 1)
+ TEST.write(' # Creating consumer ' + idx + '...\n')
+ TEST.write(' consumer' + idx + ' = DirSrv(verbose=False)\n')
+ TEST.write(' args_instance[SER_HOST] = HOST_CONSUMER_' + idx + '\n')
+ TEST.write(' args_instance[SER_PORT] = PORT_CONSUMER_' + idx + '\n')
+ TEST.write(' args_instance[SER_SERVERID_PROP] = SERVERID_CONSUMER_' + idx + '\n')
+ TEST.write(' args_consumer = args_instance.copy()\n')
+ TEST.write(' consumer' + idx + '.allocate(args_consumer)\n')
+ TEST.write(' instance_consumer' + idx + ' = consumer' + idx + '.exists()\n')
+ TEST.write(' if instance_consumer' + idx + ':\n')
+ TEST.write(' consumer' + idx + '.delete()\n')
+ TEST.write(' consumer' + idx + '.create()\n')
+ TEST.write(' consumer' + idx + '.open()\n')
+ TEST.write(' consumer' + idx + '.replica.enableReplication(suffix=SUFFIX, ' +
+ 'role=REPLICAROLE_CONSUMER, ' +
+ 'replicaId=CONSUMER_REPLICAID)\n\n')
+
+ #
+ # Create the master agreements
+ #
+ TEST.write(' #\n')
+ TEST.write(' # Create all the agreements\n')
+ TEST.write(' #\n')
+ agmt_count = 0
+ for idx in range(masters):
+ master_idx = idx + 1
+ for idx in range(masters):
+ #
+ # Create agreements with the other masters (master -> master)
+ #
+ idx += 1
+ if master_idx == idx:
+ # skip ourselves
+ continue
+ TEST.write(' # Creating agreement from master ' + str(master_idx) + ' to master ' + str(idx) + '\n')
+ TEST.write(" properties = {RA_NAME: r'meTo_$host:$port',\n")
+ TEST.write(" RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],\n")
+ TEST.write(" RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],\n")
+ TEST.write(" RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],\n")
+ TEST.write(" RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}\n")
+ TEST.write(' m' + str(idx) + '_agmt = master' + str(master_idx) +
+ '.agreement.create(suffix=SUFFIX, host=master' +
+ str(idx) + '.host, port=master' + str(idx) + '.port, properties=properties)\n')
+ TEST.write(' if not m' + str(idx) + '_agmt:\n')
+ TEST.write(' log.fatal("Fail to create a master -> master replica agreement")\n')
+ TEST.write(' sys.exit(1)\n')
+ TEST.write(' log.debug("%s created" % m' + str(idx) + '_agmt)\n\n')
+ agmt_count += 1
+
+ for idx in range(hubs):
+ idx += 1
+ #
+ # Create agreements from each master to each hub (master -> hub)
+ #
+ TEST.write(' # Creating agreement from master ' + str(master_idx) + ' to hub ' + str(idx) + '\n')
+ TEST.write(" properties = {RA_NAME: r'meTo_$host:$port',\n")
+ TEST.write(" RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],\n")
+ TEST.write(" RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],\n")
+ TEST.write(" RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],\n")
+ TEST.write(" RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}\n")
+ TEST.write(' h' + str(idx) + '_agmt = master' + str(master_idx) +
+ '.agreement.create(suffix=SUFFIX, host=hub' +
+ str(idx) + '.host, port=hub' + str(idx) + '.port, properties=properties)\n')
+ TEST.write(' if not h' + str(idx) + '_agmt:\n')
+ TEST.write(' log.fatal("Fail to create a master -> hub replica agreement")\n')
+ TEST.write(' sys.exit(1)\n')
+ TEST.write(' log.debug("%s created" % h' + str(idx) + '_agmt)\n\n')
+ agmt_count += 1
+
+ #
+ # Create the hub agreements
+ #
+ for idx in range(hubs):
+ hub_idx = idx + 1
+ #
+ # Add agreements from each hub to each consumer (hub -> consumer)
+ #
+ for idx in range(consumers):
+ idx += 1
+ #
+ # Create agreements from each hub to each consumer
+ #
+ TEST.write(' # Creating agreement from hub ' + str(hub_idx) + ' to consumer ' + str(idx) + '\n')
+ TEST.write(" properties = {RA_NAME: r'meTo_$host:$port',\n")
+ TEST.write(" RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],\n")
+ TEST.write(" RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],\n")
+ TEST.write(" RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],\n")
+ TEST.write(" RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}\n")
+ TEST.write(' c' + str(idx) + '_agmt = hub' +
+ str(hub_idx) + '.agreement.create(suffix=SUFFIX, host=consumer' +
+ str(idx) + '.host, port=consumer' + str(idx) + '.port, properties=properties)\n')
+ TEST.write(' if not c' + str(idx) + '_agmt:\n')
+ TEST.write(' log.fatal("Fail to create a hub -> consumer replica agreement")\n')
+ TEST.write(' sys.exit(1)\n')
+ TEST.write(' log.debug("%s created" % c' + str(idx) + '_agmt)\n\n')
+ agmt_count += 1
+
+ if hubs == 0:
+ #
+ # No Hubs, see if there are any consumers to create agreements to...
+ #
+ for idx in range(masters):
+ master_idx = idx + 1
+ #
+ # Create agreements with the consumers (master -> consumer)
+ #
+ for idx in range(consumers):
+ idx += 1
+ #
+ # Create agreements from each master to each consumer
+ #
+ TEST.write(' # Creating agreement fro master ' + str(master_idx) +
+ ' to consumer ' + str(idx) + '\n')
+ TEST.write(" properties = {RA_NAME: r'meTo_$host:$port',\n")
+ TEST.write(" RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],\n")
+ TEST.write(" RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],\n")
+ TEST.write(" RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],\n")
+ TEST.write(" RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}\n")
+ TEST.write(' c' + str(idx) + '_agmt = master' + str(master_idx) +
+ '.agreement.create(suffix=SUFFIX, host=consumer' +
+ str(idx) + '.host, port=consumer' + str(idx) +
+ '.port, properties=properties)\n')
+ TEST.write(' if not c' + str(idx) + '_agmt:\n')
+ TEST.write(' log.fatal("Fail to create a hub -> consumer replica agreement")\n')
+ TEST.write(' sys.exit(1)\n')
+ TEST.write(' log.debug("%s created" % c' + str(idx) + '_agmt)\n\n')
+ agmt_count += 1
+
+ #
+ # Write the replication initializations
+ #
+ TEST.write(' #\n')
+ TEST.write(' # Initialize all the agreements\n')
+ TEST.write(' #\n')
+
+ # Masters
+ for idx in range(masters):
+ idx += 1
+ if idx == 1:
+ continue
+ TEST.write(' master1.agreement.init(SUFFIX, HOST_MASTER_' +
+ str(idx) + ', PORT_MASTER_' + str(idx) + ')\n')
+ TEST.write(' master1.waitForReplInit(m' + str(idx) + '_agmt)\n')
+
+ # Hubs
+ consumers_inited = False
+ for idx in range(hubs):
+ idx += 1
+ TEST.write(' master1.agreement.init(SUFFIX, HOST_HUB_' +
+ str(idx) + ', PORT_HUB_' + str(idx) + ')\n')
+ TEST.write(' master1.waitForReplInit(h' + str(idx) + '_agmt)\n')
+ for idx in range(consumers):
+ if consumers_inited:
+ continue
+ idx += 1
+ TEST.write(' hub1.agreement.init(SUFFIX, HOST_CONSUMER_' +
+ str(idx) + ', PORT_CONSUMER_' + str(idx) + ')\n')
+ TEST.write(' hub1.waitForReplInit(c' + str(idx) + '_agmt)\n')
+ consumers_inited = True
+
+ # Consumers (master -> consumer)
+ if hubs == 0:
+ for idx in range(consumers):
+ idx += 1
+ TEST.write(' master1.agreement.init(SUFFIX, HOST_CONSUMER_' +
+ str(idx) + ', PORT_CONSUMER_' + str(idx) + ')\n')
+ TEST.write(' master1.waitForReplInit(c' + str(idx) + '_agmt)\n')
+
+ TEST.write('\n')
+
+ #
+ # Write replicaton check
+ #
+ if agmt_count > 0:
+ TEST.write(' #\n')
+ TEST.write(' # Check replication is working...\n')
+ TEST.write(' #\n')
+ TEST.write(" REPL_TEST_DN = 'cn=test repl,' + SUFFIX\n")
+ TEST.write(' master1.add_s(Entry((REPL_TEST_DN, {\n')
+ TEST.write(" 'objectclass': 'top person'.split(),\n")
+ TEST.write(" 'sn': 'test_repl',\n")
+ TEST.write(" 'cn': 'test_repl'})))\n")
+ TEST.write(' loop = 0\n')
+ TEST.write(' ent = None\n')
+ # Find the lowest replica type in the deployment(consumer -> master)
+ if consumers > 0:
+ replica = 'consumer1'
+ elif hubs > 0:
+ replica = 'hub1'
+ else:
+ replica = 'master2'
+ TEST.write(' while loop <= 10:\n')
+ TEST.write(' try:\n')
+ TEST.write(' ent = ' + replica + '.getEntry(REPL_TEST_DN, ldap.SCOPE_BASE, "(objectclass=*)")\n')
+ TEST.write(' break\n')
+ TEST.write(' except ldap.NO_SUCH_OBJECT:\n')
+ TEST.write(' time.sleep(1)\n')
+ TEST.write(' loop += 1\n')
+ TEST.write(' if ent is None:\n')
+ TEST.write(' assert False\n')
+ TEST.write('\n')
+
+ #
+ # Write the finals steps for replication
+ #
+ TEST.write(' # Clear out the tmp dir\n')
+ TEST.write(' master1.clearTmpDir(__file__)\n\n')
+ TEST.write(' return TopologyReplication(master1')
+ for idx in range(masters):
+ idx += 1
+ if idx == 1:
+ continue
+ TEST.write(', master' + str(idx))
+ for idx in range(hubs):
+ TEST.write(', hub' + str(idx + 1))
+ for idx in range(consumers):
+ TEST.write(', consumer' + str(idx + 1))
+ TEST.write(')\n')
+ else:
+ #
+ # Standalone servers
+ #
+
+ # Args for the standalone instance
+ for idx in range(instances):
+ idx += 1
+ if idx == 1:
+ idx = ''
+ else:
+ idx = str(idx)
+ TEST.write(' # Creating standalone instance ' + idx + '...\n')
+ TEST.write(' standalone' + idx + ' = DirSrv(verbose=False)\n')
+ TEST.write(' args_instance[SER_HOST] = HOST_STANDALONE' + idx + '\n')
+ TEST.write(' args_instance[SER_PORT] = PORT_STANDALONE' + idx + '\n')
+ TEST.write(' args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE' + idx + '\n')
+ TEST.write(' args_standalone' + idx + ' = args_instance.copy()\n')
+ TEST.write(' standalone' + idx + '.allocate(args_standalone' + idx + ')\n')
+
+ # Get the status of the instance and restart it if it exists
+ TEST.write(' instance_standalone' + idx + ' = standalone' + idx + '.exists()\n')
+
+ # Remove the instance
+ TEST.write(' if instance_standalone' + idx + ':\n')
+ TEST.write(' standalone' + idx + '.delete()\n')
+
+ # Create and open the instance
+ TEST.write(' standalone' + idx + '.create()\n')
+ TEST.write(' standalone' + idx + '.open()\n\n')
+
+ TEST.write(' # Clear out the tmp dir\n')
+ TEST.write(' standalone.clearTmpDir(__file__)\n')
+ TEST.write('\n')
+ TEST.write(' return TopologyStandalone(standalone')
+ for idx in range(instances):
+ idx += 1
+ if idx == 1:
+ continue
+ TEST.write(', standalone' + str(idx))
+ TEST.write(')\n')
+
+ TEST.write('\n\n')
+
+ #
+ # Write the test function
+ #
+ TEST.write('def test_ticket' + ticket + '(topology):\n')
+ TEST.write(" '''\n")
+ if repl_deployment:
+ TEST.write(' Write your replication testcase here.\n\n')
+ TEST.write(' To access each DirSrv instance use: topology.master1, topology.master2,\n' +
+ ' ..., topology.hub1, ..., topology.consumer1, ...\n')
+ else:
+ TEST.write(' Write your testcase here...\n')
+
+ TEST.write(" '''\n\n")
+ TEST.write(" log.info('Test complete')\n")
+ TEST.write("\n\n")
+
+ #
+ # Write the final function here - delete each instance
+ #
+ TEST.write('def test_ticket' + ticket + '_final(topology):\n')
+ if repl_deployment:
+ for idx in range(masters):
+ idx += 1
+ TEST.write(' topology.master' + str(idx) + '.delete()\n')
+ for idx in range(hubs):
+ idx += 1
+ TEST.write(' topology.hub' + str(idx) + '.delete()\n')
+ for idx in range(consumers):
+ idx += 1
+ TEST.write(' topology.consumer' + str(idx) + '.delete()\n')
+ TEST.write('\n\n')
+ else:
+ for idx in range(instances):
+ idx += 1
+ if idx == 1:
+ idx = ''
+ else:
+ idx = str(idx)
+ TEST.write(' topology.standalone' + idx + '.delete()\n')
+ TEST.write('\n\n')
+ TEST.write(" log.info('Testcase PASSED')\n")
+
+ #
+ # Write the main function
+ #
+ TEST.write('def run_isolated():\n')
+ TEST.write(' global installation1_prefix\n')
+ TEST.write(' installation1_prefix = None\n\n')
+ TEST.write(' topo = topology(True)\n')
+ TEST.write(' test_ticket' + ticket + '(topo)\n')
+ TEST.write(' test_ticket' + ticket + '_final(topo)\n')
+ TEST.write('\n\n')
+
+ TEST.write("if __name__ == '__main__':\n")
+ TEST.write(' run_isolated()\n\n')
+
+ #
+ # Done, close things up
+ #
+ TEST.close()
+ print('Created: ' + filename)
1
0
dirsrvtests/tickets/ticket47653MMR_test.py | 8 ++++-
dirsrvtests/tickets/ticket47721_test.py | 41 ++++++++++++++++-------------
dirsrvtests/tickets/ticket47980_test.py | 2 +
3 files changed, 32 insertions(+), 19 deletions(-)
New commits:
commit 18547e400545fc6cc173ac884db5c5db26701e35
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 26 16:51:39 2015 -0500
Ticket 47999 - address several race conditions in tests
Description: Some tests can run too fast. Add some sleeps were appropriate.
https://fedorahosted.org/389/ticket/47999
Reviewed by: tbordaz(Thanks!)
diff --git a/dirsrvtests/tickets/ticket47653MMR_test.py b/dirsrvtests/tickets/ticket47653MMR_test.py
index 3c4c1ef..5791479 100644
--- a/dirsrvtests/tickets/ticket47653MMR_test.py
+++ b/dirsrvtests/tickets/ticket47653MMR_test.py
@@ -356,6 +356,7 @@ def test_ticket47653_add(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
+ time.sleep(1)
# bind as bind_entry
topology.master1.log.info("Bind as %s" % BIND_DN)
@@ -384,7 +385,11 @@ def test_ticket47653_add(topology):
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
topology.master1.log.info("Try to add Add %s should be successful" % ENTRY_DN)
- topology.master1.add_s(entry_with_member)
+ try:
+ topology.master1.add_s(entry_with_member)
+ except ldap.LDAPError, e:
+ topology.master1.log.info("Failed to add entry, error: " + e.message['desc'])
+ assert False
#
# Now check the entry as been replicated
@@ -457,6 +462,7 @@ def test_ticket47653_modify(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETATTR + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
+ time.sleep(1)
# bind as bind_entry
topology.master1.log.info("M1: Bind as %s" % BIND_DN)
diff --git a/dirsrvtests/tickets/ticket47721_test.py b/dirsrvtests/tickets/ticket47721_test.py
index 3b1aa7b..e9e0488 100644
--- a/dirsrvtests/tickets/ticket47721_test.py
+++ b/dirsrvtests/tickets/ticket47721_test.py
@@ -57,6 +57,7 @@ ENTRY_OC = "top person %s" % OC_NAME
BASE_OID = "1.2.3.4.5.6.7.8.9.10"
+SLEEP_INTERVAL = 60
def _add_custom_at_definition(name='ATticket47721'):
new_at = "( %s-oid NAME '%s' DESC 'test AT ticket 47721' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'Test 47721' 'user defined' ) )" % (name, name)
@@ -290,8 +291,8 @@ def test_ticket47721_init(topology):
'cn': BIND_NAME,
'userpassword': BIND_PW})))
- # enable acl error logging
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(8192))] # ACL + REPL
+ # enable repl error logging
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(8192))] # REPL logging
topology.master1.modify_s(DN_CONFIG, mod)
topology.master2.modify_s(DN_CONFIG, mod)
@@ -320,6 +321,7 @@ def test_ticket47721_0(topology):
def test_ticket47721_1(topology):
+ log.info('Running test 1...')
#topology.master1.log.info("Attach debugger\n\n")
#time.sleep(30)
@@ -357,19 +359,13 @@ def test_ticket47721_1(topology):
time.sleep(2)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
- if schema_csn_master1 != schema_csn_master2:
- # We need to give the server a little more time, then check it again
- log.info('Schema CSNs are not in sync yet: m1 (%s) vs m2 (%s), wait a little...'
- % (schema_csn_master1, schema_csn_master2))
- time.sleep(30)
- schema_csn_master1 = topology.master1.schema.get_schema_csn()
- schema_csn_master2 = topology.master2.schema.get_schema_csn()
-
- assert schema_csn_master1 is not None
- assert schema_csn_master1 == schema_csn_master2
+ log.debug('Master 1 schemaCSN: %s' % schema_csn_master1)
+ log.debug('Master 2 schemaCSN: %s' % schema_csn_master2)
def test_ticket47721_2(topology):
+ log.info('Running test 2...')
+
mod = [(ldap.MOD_REPLACE, 'description', 'Hello world 2')]
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
topology.master1.modify_s(dn, mod)
@@ -388,11 +384,13 @@ def test_ticket47721_2(topology):
time.sleep(2)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
+ log.debug('Master 1 schemaCSN: %s' % schema_csn_master1)
+ log.debug('Master 2 schemaCSN: %s' % schema_csn_master2)
if schema_csn_master1 != schema_csn_master2:
# We need to give the server a little more time, then check it again
log.info('Schema CSNs are not in sync yet: m1 (%s) vs m2 (%s), wait a little...'
% (schema_csn_master1, schema_csn_master2))
- time.sleep(30)
+ time.sleep(SLEEP_INTERVAL)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
@@ -405,6 +403,8 @@ def test_ticket47721_3(topology):
Check that the supplier can update its schema from consumer schema
Update M2 schema, then trigger a replication M1->M2
'''
+ log.info('Running test 3...')
+
# stop RA M2->M1, so that M1 can only learn being a supplier
ents = topology.master2.agreement.list(suffix=SUFFIX)
assert len(ents) == 1
@@ -436,11 +436,13 @@ def test_ticket47721_3(topology):
time.sleep(2)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
- if schema_csn_master1 != schema_csn_master2:
+ log.debug('Master 1 schemaCSN: %s' % schema_csn_master1)
+ log.debug('Master 2 schemaCSN: %s' % schema_csn_master2)
+ if schema_csn_master1 == schema_csn_master2:
# We need to give the server a little more time, then check it again
log.info('Schema CSNs are not in sync yet: m1 (%s) vs m2 (%s), wait a little...'
% (schema_csn_master1, schema_csn_master2))
- time.sleep(30)
+ time.sleep(SLEEP_INTERVAL)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
@@ -456,6 +458,8 @@ def test_ticket47721_4(topology):
the nsschemacsn is M2>M1. But as the RA M2->M1 is disabled, M1 keeps its schemacsn.
Update schema on M2 (nsschemaCSN update), update M2. Check they have the same schemacsn
'''
+ log.info('Running test 4...')
+
new = _add_custom_at_definition('ATtest4')
topology.master1.log.info("Update schema (M1) %s " % new)
topology.master1.schema.add_schema('attributetypes', new)
@@ -499,10 +503,12 @@ def test_ticket47721_4(topology):
time.sleep(2)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
+ log.debug('Master 1 schemaCSN: %s' % schema_csn_master1)
+ log.debug('Master 2 schemaCSN: %s' % schema_csn_master2)
if schema_csn_master1 != schema_csn_master2:
# We need to give the server a little more time, then check it again
- log.info('Schema CSNs are not in sync yet, wait a little...')
- time.sleep(30)
+ log.info('Schema CSNs are incorrectly in sync, wait a little...')
+ time.sleep(SLEEP_INTERVAL)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
@@ -543,4 +549,3 @@ def run_isolated():
if __name__ == '__main__':
run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47980_test.py b/dirsrvtests/tickets/ticket47980_test.py
index 51e37dc..da9246c 100644
--- a/dirsrvtests/tickets/ticket47980_test.py
+++ b/dirsrvtests/tickets/ticket47980_test.py
@@ -627,6 +627,8 @@ def test_ticket47980(topology):
log.error('Failed to add COS def for branch6: error ' + e.message['desc'])
assert False
+ time.sleep(2)
+
#
# Now check that each user has its expected passwordPolicy subentry
#
1
0
Changes since 389-ds-base-1.2.6.a1:
Anupam Jain (9):
Ticket 123 - Enhancement request:"whoami" extended operation
Ticket 123 - Enhancement request:"whoami" extended operation
Ticket 123 - Enhancement request:"whoami" extended operation
Ticket #47423 - 7-bit check plugin does not work for userpassword attribute
Ticket #47363 - 7-bit checking is not necessary for userPassword
Ticket #47431 - Duplicate values for the attribute nsslapd-pluginarg are not handled correctly
Ticket #47370 - DS crashes with some 7-bit check plugin configurations
Ticket #617 - Possible to add invalid ACI value
Ticket #626 - Possible to add nonexistent target to ACI
Charles Lopes (1):
Bug #361: Bad DNs in ACIs can segfault ns-slapd
Endi S. Dewata (168):
Bug 545620 - Password cannot start with minus sign
Bug 538525 - Ability to create instance as non-root user
Bug 570542 - Root password cannot contain matching curly braces
Bug 470684 - Pam_passthru plugin doesn't verify account activation
Bug 573375 - MODRDN operation not logged
Bug 520151 - Error when modifying userPassword with proxy user
Bug 455489 - Address compiler warnings about strict-aliasing rules
Bug 566320 - RFE: add exception to removal of attributes in cn=config for aci
Bug 566043 - startpid file is only cleaned by initscript runs
Bug 584109 - Slapd crashes while parsing DNA configuration
Bug 542570 - Directory Server port number is not validated in the beginning.
Bug 145181 - Plugin target/bind subtrees only take 1 value.
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 628096 - spurious error message from /sbin/service when doing a stop on no instances
Bug 573889 - Migration does not remove deprecated schema
Bug 606545 - core schema should include numSubordinates
Bug 643979 - Strange byte sequence for attribute with no values (nsslapd-referral)
Endi Sukma Dewata (16):
Bug 630092 - Coverity #12117: Resource leaks issues
Bug 630092 - Coverity #15478: Resource leaks issues
Bug 630092 - Coverity #15479: Resource leaks issues
Bug 630092 - Coverity #15481: Resource leaks issues
Bug 630092 - Coverity #15482: Resource leaks issues
Bug 630092 - Coverity #15483: Resource leaks issues
Bug 630092 - Coverity #15484: Resource leaks issues
Bug 630092 - Coverity #15485: Resource leaks issues
Bug 630092 - Coverity #15487: Resource leaks issues
Bug 630092 - Coverity #15490: Resource leaks issues
Bug 630092 - Coverity #15497: Resource leaks issues
Bug 630092 - Coverity #11991: Resource leaks issues
Bug 630092 - Coverity #12000: Resource leaks issues
Bug 630092 - Coverity #12003: Resource leaks issues
Bug 630092 - Coverity #11985: Resource leaks issues
Bug 630092 - Coverity #11992,11993: Resource leaks issues
Jeroen van Meeuwen (Kolab Systems) (1):
Suppress alert on unavailable port with forced setup
Jonathan \"Duke\" Leto (1):
fix for trac #173; update ds-logpipe.py docs about -t option
Ken Rossato (8):
Factorize into new isPosixGroup function
Change "return"s in modGroupMembership to "break"s to avoid leaking
Memory leaks: unmatched slapi_attr_get_valueset and slapi_value_new
Simplify program flow: eliminate unnecessary continue
Simplify program flow: make adduids/moduids/deluids action blocks all similar
Fix logic errors: del_mod should be latched (might not be last mod), and avoid skipping add-mods (int value 0)
Simplify program flow: change while loops to for
Ticket #481 - expand nested posix groups
Ludwig Krispenz (56):
Fix for ticket 510
Fix for ticket 465: cn=monitor showing stats for other db instances
Fix for ticket 504
Ticket 349 - nsViewFilter syntax issue in 389DS 1.2.5
Ticket 518 - dse.ldif is 0 length after server kill or machine kill
Ticket 505 - use lock-free access name2asi and oid2asi table
Fix optimization issue introduced with fix for ticket #561,
modify operations without values need to be written to the changelog
Reduce replication meta data stored in entry, cf ticket 569
Fix compiler warnings introduced by fix for #569
removing an unused variable, did also remove an assigment
Ticket 568 - make usage of transaction batch flush durable
fix hang related to ticket 568
Ticket 47358 - implement backend optimazation levels
Ticket 47396 - crash on modrdn of tombstone
Ticket 47395 47397 v2 correct behaviour of account policy if only stateattr
fix compiler warnings, caused by fix for 47395,47397
Ticket 47399 - RHDS denies MODRDN access if ACI list contains any DENY rule
Ticket 47369 version2 - provide default syntax plugin
Fix compiler warning
Ticket 346 - version 4 Slow ldapmodify operation time
fix compiler warnings
CVE-2013-2219 ACLs inoperative in some search scenarios
fix compiler warning
Ticket 47502 - updates to ruv entry are written to retro changelog
Fix regression from fix for 569, when the last value of an attribute was explicitely deleted
Ticket 47505 - Get rid of valueset_add_valuearray_ext
Ticket 47487 - enhance retro changelog
Ticket 314 - ChaiOnUpdate for root handling
Use defines for backend error handling
Ticket 601 - multi master replication allows schema violation
Ticket 47388 - RFE to implement RFC4533 -ver2
Fix for coverty issues 12028,12029,12030
Ticket 47577 - crash when removing entries from cache
Ticket 47591 - entries with empty objectclass attribute value can be hidden
Ticket 47526 - Allow memberof suffixes to be configurable
Ticket 47527 - Allow referential integrity suffixes to be configurable
Ticket 47612 - ns-slapd eats all the memory
Ticket 47621 - v2 make referential integrity configuration more flexible
Ticket 47629 - random crashes related to sync repl
Ticket 47732 - ds logs many "SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN plugin returned error" messages
Ticket 47733 - ds logs many "Operation error fetching Null DN" messages
bump version
Ticket 47806 - Failed deletion of aci: no such attribute
Ticket 47704 - invalid sizelimits in aci group evaluation
Ticket 47821 - deref plugin cannot handle complex acis
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket 47872 - Filter AND with only one clause should be optimized
Ticket 47877 - check_and_add_entry fails for changetype: add and existing entry
Ticket 47816 -v2- internal syncrepl searches are flagged as unindexed
Ticket 47866 - Errors after upgrading related to attribute "dnaremotebindmethod"
Ticket 47885 - deref plugin should not return references with noc access rights
fix for 47885 did not always return a response control
Ticket 47918 - result of dna_dn_is_shared_config is incorrectly used
Ticket 47964 - v2 - Incorrect search result after replacing an empty attribute
Ticket 47991 - upgrade script fails if /etc and /var are on different file systems
Mark Reynolds (335):
Ticket #71 - unable to delete managed entry config
Ticket #159 - Managed Entry Plugin runs against managed entries upon any update without validating
Ticket #177 - logconv.pl doesn't detect restarts
Merge branch 'ticket159'
Ticket #49 - better handling for server shutdown while long running tasks are active
Ticket #50 - server should not call a plugin after the plugin close function is calle
Updated for ticket#50
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #140 - incorrect memset parameters
Revert "Ticket #140 - incorrect memset parameters"
Revert "Ticket #55 - Limit of 1024 characters for nsMatchingRule"
Ticket #38 - nisDomain schema is incorrect
Ticket #6 - protocol error from proxied auth operation
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #39 - Account Policy Plugin does not work for simple binds when PAM Pass Through Auth plugin is enabled
Ticket 175 - logconv.pl improvements
Ticket 175 - minor fixes
Ticket #17 - Replication optimizations
Ticket #17 - new replication optimizations
Ticket #129 - Should only update modifyTimestamp/modifiersName on MODIFY ops
Ticket #111 - ability to control behavior of modifyTimestamp/modifiersName
Ticket #211 - dnaNextValue gets incremented even if the user addition fails
Ticket #74 - Add schema for DNA plugin (RFE)
Ticket #306 - void function cannot return value
Ticket #302 - use thread local storage for internalModifiersName & internalCreatorsName
Schema Reload crash fix
Ticket #291 - cannot use & in a sasl map search filter
Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash
Ticket #191 - Implement SO_KEEPALIVE in network calls
Config changes fail because of unknown attribute "internalModifiersname"
Ticket #292 - logconv.pl reporting unindexed search with different search base than shown in access logs
Ticket #308 - Automembership plugin fails if data and config area mixed in the plugin configuration
Ticket #271 - replication code cleanup
TIcket #285 - compilation fixes for '--format-security'
Ticket #271 - Slow shutdown when you have 100+ replication agreements
Ticket #24 - Add nsTLS1 to the DS schema
Ticket #319 - ldap-agent crashes on start with signal SIGSEGV
Ticket #20 - Allow automember to work on entries that have already been added
Ticket #315 - ns-slapd exits/crashes if /var fills up
Ticket #315 - small fix to libglobs
Ticket #183 - passwordMaxFailure should lockout password one sooner - and should be configurable to avoid regressions
Coverity Fixes
Ticket #325 - logconv.pl : use of getopts to parse command line options
Ticket #183 - passwordMaxFailure should lockout password one sooner
Ticket #207 - [RFE] enable attribute that tracks when a password was last set
Ticket #214 - Adding Replication agreement should complain if required nsds5ReplicaCredentials not supplied
Ticket #337 - Improve CLEANRUV task
Ticket #356 - RFE - Track bind info
Ticket #196 - RFE: Interpret IPV6 addresses for ACIs, replication, and chaining
Ticket #218 - Make RI Plugin worked with replicated updates
Ticket 367 - Invalid chaining config triggers a disk full error and shutdown
Ticket 365 - passwords in clear text in the audit log
Ticket #321 - krbExtraData is being null modified and replicated on each ssh login
Ticket #110 - RFE limiting root DN by host, IP, time of day, day of week
Ticket 368 - Make the cleanAllRUV task one step
Ticket #28 - MOD operations with chained delete/add get back error 53 on backend config
Ticket #369 - restore of replica ldif file on second master after deleting two records shows only 1 deletion
Update the slapi-plugin documentation on new slapi functions, and added a slapi function for checking on shutdowns
Ticket #388 - Improve replication agreement status messages
COVERITY FIXES
Coverity Fix
Ticket 366 - Change DS to purge ticket from krb cache in case of authentication error
Ticket 399 - slapi_ldap_bind() doesn't check bind results
Ticket 328 - make sure all internal search filters are properly escaped
Ticket 413 - "Server is unwilling to perform" when running ldapmodify on nsds5ReplicaStripAttrs
Ticket 403 - CLEANALLRUV feature
Ticket 407 - memory leak in dna plugin
Ticket 403 - cleanallruv coverity fixes
Misc Coverity Fixes
Ticket 407 - dna memory leak
Ticket 403 - CLEANALLRUV amendment
Ticket 403 - CLEANALLRUV - revision to last amendment
Ticket 403 - fix CLEANALLRUV regression from last commit
Ticket 429 - Add nsslapd-readonly to schema
CLEANALLRUV coverity fixes
Ticket 436 - nsds5ReplicaEnabled can be set with any invalid values.
Ticket 386 - Overconsumption of memory with large cachememsize and heavy use of ldapmodify
Ticket 450 - CLEANALLRUV task gets stuck on winsync replication agreement
Ticket 452 - automember rebuild task adds users to groups that do not match the configuration scope
Ticket 408 - create a normalized dn cache
Ticket 467 - CLEANALLRUV abort task should be able to ignore down replicas
Ticket 747 - Root DN Access Control - days allowed not working correctly
Ticket 475 - Root DN Access Control - improve value checking for config
Ticket 473 - change VERSION.sh to have console version be major.minor
Coverity issue 13091
Ticket 457 - dirsrv init script returns 0 even when few or all instances fail to start
Ticket 477 - CLEANALLRUV if there are only winsync agmts task will hang
Ticket 478 - passwordTrackUpdateTime stops working with subtree password policies
Ticket #446 - anonymous limits are being applied to directory manager
Ticket 488 - Doc: DS error log messages with typo
Ticket 486 - nsslapd-enablePlugin should not be multivalued
Ticket 468 - if pam_passthru is enabled, need to AC_CHECK_HEADERS([security/pam_appl.h])
Ticket 495 - internalModifiersname not updated by DNA plugin
Revert "Ticket 495 - internalModifiersname not updated by DNA plugin"
Ticket 495 - internalModifiersname not updated by DNA plugin
Ticket 147 - Internal Password Policy usage very inefficient
Ticket 517 - crash in DNA if no dnaMagicRegen is specified
Ticket 507 - use mutex for FrontendConfig lock instead of rwlock
Ticket 394 - modify-delete userpassword
Ticket 337 - improve CLEANRUV functionality
Coverity Fixes
Ticket 20 - Allow automember to work on entries that have already been added
Ticket 393 - Change in winSyncInterval does not take immediate effect
Ticket 216 - disable replication agreements
Ticket 395 - RFE: 389-ds shouldn't advertise in the rootDSE that we can handle a sasl mech if we really can't
Ticket 527 - ns-slapd segfaults if it cannot rename the logs
Ticket 509 - lock-free access to be->be_suffixlock
Merge branch 'ticket509'
Ticket 456 - improve entry cache sizing
Ticket 509 - lock-free access to be->be_suffixlock
Ticket 511 - allow turning off vattr lookup in search entry return
Ticket 541 - RootDN Access Control plugin is missing after upgrade
Ticket 541 - need to set plugin as off in ldif template
Ticket 534 - RFE: Add SASL mappings fallback
Ticket 534 - sasl mapping fallback
Ticket 532 - RUV is not getting updated for both Master and consumer
Ticket 534 - Add SASL mappings fallback
Ticket 534 - SASL Mapping Fallback
Ticket 539 - logconv.pl should handle microsecond timing
Ticket 471 - logconv.pl tool removes the access logs contents if "-M" is not correctly used
Ticket 552 - Adding rootdn-open-time without rootdn-close-time to RootDN Acess Control results in inconsistent configuration
Ticket 551 - Multivalued rootdn-days-allowed in RootDN Access Control plugin always results in access control violation
TIcket 419 - logconv.pl - improve memory management
Ticket 419 - logconv.pl - improve memory management
Ticket 558 - Replication - make timeout for protocol shutdown configurable
Ticket 417 - RFE - forcing passwordmustchange attribute by non-cn=directory manager
Ticket 562 - Crash when deleting suffix
Merge branch 'master' of ssh://git.fedorahosted.org/git/389/ds
Ticket 532 - RUV is not getting updated for both Master and consumer
Ticket 433 - multiple bugs in start-dirsrv, stop-dirsrv, restart-dirsrv scripts
Ticket 433 - multiple bugs in start-dirsrv, stop-dirsrv, restart-dirsrv scripts
Ticket 570 - DS returns error 20 when replacing values of a multi-valued attribute (only when replication is enabled)
Ticket 528 - RFE - get rid of instance specific scripts
Coverity Fixes
Ticket 528 - RFE - get rid of instance specific scripts (part 2)
Ticket 332 - Command line perl scripts should attempt most secure connection type first
Ticket 332 - Fix usage in scripts
Ticket 332 - minor quoting issue in a few scripts.
Ticket 588 - Create MAN pages for command line scripts
Ticket 332 - wrong argument count in ldif2db
Ticket 571 - server does not accept 0 length LDAP Control sequence
Ticket 583 - dirsrv fails to start on reboot due to /var/run/dirsrv permissions
Ticket 574 - problems with dbcachesize disk space calculation
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
Ticket 574 - problems with dbcachesize disk space calculation
Ticket 458 - RFE - Make it possible for privileges to be provided to an admin user
Ticket 611 - logconv.pl missing stats for StartTLS, LDAPI, and AUTOBIND
Ticket 622 - DS logging errors "libdb: BDB0171 seek: 2147483648: (262144 * 8192) + 0: No such file or directory
Ticket 525 - Introducing a user visible configuration variable for controlling replication retry time
Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC
Ticket 587 - Replication error messages in the DS error logs
Ticket 458 - Need to properly check if the password admin dn is set
Ticket 628 - crash in aci evaluation
Ticket 620 - Better logging of error messages for 389-ds-base
Ticket 534 - RFE: Add SASL mappings fallback
Ticket 550 - posix winsync will not create memberuid values if group entry become posix group in the same sync interval
Ticket 631 - Replication: "Incremental update started" status message without consumer initialized
Ticket 47311 - segfault in db2ldif(trigger by a cleanallruv task)
Ticket 47304 - reinitialization of a master with a disabled agreement hangs
Ticket 47315 - filter option in fixup-memberof requires more clarification
Ticket 77 - [RFE] Add ACI support for ldapi
Ticket 47317 - should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default
Ticket 205 - Fix compiler warning
Ticket 153 - use openldap's schema parser
Ticket 47299 - fix config file and server id processing
Ticket 580 - Wrong error code return when using EXTERNAL SASL and no client certificate
Fix coverity issues
Ticket 47317 - should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default - revision
Ticket 47355 - dse.ldif doesn't replicate update to nsslapd-sasl-mapping-fallback
Ticket 511 - Revision - allow turning off vattr lookup in search entry return
Ticket 47337 - mep_pre_op: Unable to fetch origin entry
Ticket 283 - Expose slapi_eq_* API
Ticket 47340 - Deleting a separator ',' in 7-bit check plugin arguments makes the
Ticket 47326 - idl switch does not work
Merge branch 'ticket47326'
Ticket 589 - RFE - Support RFC 4527 Read Entry Controls
Ticket 47372 - make old-idl tunable
Coverity Fixes (part 1)
Coverity Fixes (Part 2)
Coverity Fixes (Part 3)
Coverity Fixes (Part 4)
Coverity Fixes (Part 5)
Ticket 47385 - DS not shutting down when disk monitoring threshold is reached
Fri Jun 7 10:41:00 2013 -0400
Ticket 47383 - connections attribute in cn=snmp,cn=monitor is counted twice
Ticket 47376 - DESC should not be empty as per RFC 2252 (ldapv3)
Ticket 47379 - DNA plugin failed to fetch replication agreement
Coverity (Part 7) + Jenkins fix
Ticket 47389 - Non-directory manager can change the individual userPassword's storage scheme
Ticket 47329 - Improve slapi_back_transaction_begin() return code when transactions are not available
Coverity Fixes
Ticket 47381 - nsslapd-db-transaction-batch-val turns to -1
Ticket 47385 - Disk Monitoring is not triggered as expected.
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47416 - SASL encrypted packet length exceeds maximum allowed limit
Ticket 47421 - memory leaks in set_krb5_creds
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47441 - Disk Monitoring not checking filesystem with logs
Ticket 47382 - Add a warning message when a connection hits the max number of threads
Ticket 47449 - deadlock after adding and deleting entries
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47450 - Fix compiler formatting warning errors for 32/64 bit arch
Ticket 47447 - logconv.pl man page missing -m,-M,-B,-D
Ticket 47323 - resurrected entry is not correctly indexed
Ticket 47440 - Fix compilation warnings and header files
Ticket 47440 - Fix runtime errors caused by last patch.
Ticket 47411 - Replace substring search with plain search in referint plugin
Ticket 47425 - should only call windows_update_done if repl agmt type is windows
Ticket 47426 - move compute_idletimeout out of handle_pr_read_ready
Ticket47426 - Coverity issue with last commit(move compute_idletimeout out of handle_pr_read_ready)
Ticket 47473 - setup-ds.pl doesn't lookup the "root" group correctly
Ticket 47461 - logconv.pl - Use of comma-less variable list is deprecated
Ticket 47384 - Plugin path validation returntext not set correctly
Ticket 47394 - remove-ds.pl should remove /var/lock/dirsrv
Ticket 47371 - Some updates of "passwordgraceusertime" are useless when updating "userpassword"
Ticket 47306 - execute index_add_mods only for indexed attributes
Ticket 47500 - start-dirsrv/restart-dirsrv/stop-disrv do not register with systemd correctly
Ticket 411 - [RFE] mods optimizer
Ticket 47507 - automember rebuild task not working as expected
Ticket 47512 - backend txn plugin fixup tasks should be done in a txn
Coverity fix - 11952
Ticket 47401 - report unindexed internal searches
Ticket 47520 - Fix various issues with logconv.pl
Ticket 47509 - CLEANALLRUV doesnt run across all replicas
Ticket 47509 - Cleanallruv jenkins error
Ticket 47513 - tmpfiles.d references /var/lock when they should reference /run/lock
Ticket 47528 - 389-ds-base built with mozldap can crash from invalid free
Ticket 47510 - 389-ds-base does not compile against MozLDAP libraries
Ticket 47532 - 1.3.1 with mozldap crashes in new operation work_q code
Ticket 47510 - Repl Sync does not compile against MozLDAP libraries
Ticket 47510 - remove unnecessary typedef
Ticket 47513 - Refine the check for @localrundir@
Ticket 47513 - Set localrundir outside of the "with-fhs" block
Ticket 47543 - Mozldap - fix compiler warnings
Ticket 47531 - Mozldap - need to rewrite sasl_io_recv
Ticket 47510 - Additional mozldap failures with Repl Sync
Ticket 47522 - Password adminstrators should be able to voilate password policy
Ticket 47517 - memory leak in range searches and other various leaks
Ticket 47597 - Convert retro changelog plug-in to betxn
Ticket 47598 - Convert ldbm_back_seq code to be transaction aware
Ticket 47599 - Reduce lock scope in retro changelog plug-in
Revert "Ticket 47599 - Reduce lock scope in retro changelog plug-in"
Ticket 47599 - Reduce lock scope in retro changelog plug-in
bump version to 1.3.2.4
Ticket 47599 - fix memory leak
Ticket 47593 - Update plugin API for OTP plugin
Bump version to 1.3.2.7
Ticket 47592 - automember plugin task memory leaks
Ticket 47613 - Impossible to configure nsslapd-allowed-sasl-mechanisms
Ticket 47614 - Possible to specify invalid SASL mechanism in nsslapd-allowed-sasl-mechanisms
Ticket 47587 - hard coded limit of 64 masters in agreement and changelog code
Ticket 47620 - 389-ds rejects nsds5ReplicaProtocolTimeout attribute
Ticket 47622 - Automember betxnpreoperation - transaction not aborted when group entry does not exist
Ticket 47627 - changelog iteration should ignore cleaned rids when getting the minCSN
Ticket 47601 - Plugin library path validation prevents intentional loading of out-of-tree modules
Ticket 47617 - allow configuring changelog trim interval
Ticket 47613 - Issues setting allowed mechanisms
Ticket 47620 - Fix cherry-pick error for 1.3.2 and 1.3.1
Ticket 47620 - Config value validation improvement
Ticket 47620 - Fix logically dead code.
Ticket 47627 - Fix replication logging
Ticket 47620 - Fix dereferenced NULL pointer in agmtlist_modify_callback()
Ticket 47620 - Fix missing left bracket
Ticket 47653 - Need a way to allow users to create entries assigned to themselves
Ticket 408 - Fix crash when disabling/enabling the setting
Ticket 47620 - Unable to delete protocol timeout attribute
Ticket 47641 - 7-bit check plugin not checking MODRDN operation
Ticket 47638 - Overflow in nsslapd-disk-monitoring-threshold on 32bit platform
Ticket 47615 - Failed to compile the DS 389 1.3.2.3 version against Berkeley DB 4.2 version
Ticket 525 - Replication retry time attributes cannot be added
Ticket 47637 - rsa_null_sha should not be enabled by default
Ticket 47729 - Directory Server crashes if shutdown during a replication initialization
Ticket 47700 - Fix compiler warnings
Ticket 47722 - rsearch filter error on any search filter
Ticket47722 - Fixed filter not correctly identified
Ticket 47740 - Coverity Fixes (Mark - part 1)
Ticket 47538 - RFE: repl-monitor.pl plain text output, cmdline config options
Ticket 47740 - Fix sync plugin resource leaks
Ticket 47640 - Fix coverity issues - part 3
Ticket 47740 - Fix coverity erorrs - Part 4
Ticket 47740 - Fix coverity issues - Part 5
Ticket 47740 - Fix coverity issues: null deferences - Part 6
Ticket 47740 - Crash caused by changes to certmap.c
Ticket 47743 - Memory leak with proxy auth control
Ticket 47740 - Fix coverity issues(part 7)
Ticket 47759 - Crash in replication when server is under write load
Ticket 47766 - Tombstone purging can crash the server if the backend is stopped/disabled
Ticket 47767 - Nested tombstones become orphaned after purge
Ticket 47771 - Performing deletes during tombstone purging results in operation errors
Ticket 47782 - Parent numbordinate count can be incorrectly updated if an error occurs
Ticket 47779 - Part of DNA shared configuration is deleted after server restart
Ticket 47771 - Move parentsdn initialization to avoid crash
Ticket 477779 - Need to lock server list when removing list
Ticket 47792 - code cleanup
Ticket 47792 - database plugins need a way to call betxn
Ticket 47793 - Server crashes if uniqueMember is invalid syntax and memberOf
Ticket 47772 - fix coverity issue
Ticket 47670 - Aci warnings in error log
Ticket 47713 - Logconv.pl with an empty access log gives lots of errors
Ticket 47446 - logconv.pl memory continually grows
Ticket 47813 - managed entry plugin fails to update member
Ticket 47813 - remove "goto bail" from previous commit
Ticket 47815 - Add operations rejected by betxn plugins remain in cache
Ticket 47817 - The error result text message should be obtained just prior to sending result
Ticket 47815 - add lib389 test
Ticket 47779 - Potential deadlock after startup if a dna configuration change is made
Ticket 47781 - Server deadlock if online import started while
Ticket 47858 - Internal searches using OP_FLAG_REVERSE_CANDIDATE_ORDER can crash the server
Ticket 47861 - Certain schema files are not replaced during upgrade
Ticket 47862 - Repl-monitor.pl ignores the provided connection parameters
Ticket 47862 - repl-monitor fails to convert "*" to default values
Ticket 47457 - default nsslapd-sasl-max-buffer-size should be 2MB
Ticket 47900 - Adding an entry with an invalid password as rootDN is incorrectly rejected
Ticket 47900 - Server fails to start if password admin is set
Ticket 47937 - Crash in entry_add_present_values_wsi_multi_valued
Ticket 47953 - Should not check aci syntax when deleting an aci
Ticket 47952 - PasswordAdminDN attribute is not properly returned to client
Ticket 47958 - Memory leak in password admin if the admin entry does not exist
Ticket 47950 - Bind DN tracking unable to write to internalModifiersName without special permissions
Ticket 47963 - RFE - memberOf - add option to skip nested
Ticket 47963 - skip nested groups breaks memberof fixup task
Ticket 47967 - cos_cache_build_definition_list does not stop during server shutdown
Ticket 47969 - COS memory leak when rebuilding the cache
Ticket 47970 - Account lockout attributes incorrectly updated after failed SASL Bind
Ticket 47970 - add lib389 testcase
Ticket 47969 - Fix coverity issue
Ticket 47965 - Fix coverity issues (2014/11/24)
Ticket 47722 - Using the filter file does not work
Ticket 47750 - Need to refresh cache entry after called betxn postop plugins
Ticket 47750 - During delete operation do not refresh cache entry if it is a tombstone
Ticket 47980 - Nested COS definitions can be incorrectly
Ticket 47981 - COS cache doesn't properly mark vattr cache as
Ticket 47949 - logconv.pl -- support parsing/showing/reporting different protocol versions
Ticket 47973 - During schema reload sometimes the search returns no results
Ticket 47617 - replication changelog trimming setting validation
Matthew Via (1):
Ticket #47428 - Memory leak in 389-ds-base 1.2.11.15
Nathan Kinder (210):
Bug 549554 - Trim single-valued attributes before sending to AD
Improve search for pcre header file
Bug 434735 - Allow SASL ANONYMOUS mech to work
Bug 570912 - Avoid selinux context conflict with httpd
Allow instance name to be parsed from start-slapd
Add managed entries plug-in
Bug 572355 - Label instance files and ports during upgrade.
Bug 578863 - Password modify extop needs to send referrals on replicas
Bug 584156 - Remove ldapi socket file during upgrade
Fix rsearch usage of name files for random filters
Bug 584497 - Allow DNA plugin to set same value on multiple attributes
Add replication session hooks
Correct function prototype for repl session hook
Bug 592389 - Set anonymous resource limits properly
Bug 601433 - Add man pages for start-dirsrv and related commands
Bug 604263 - Fix memory leak when password change is rejected
Bug 612242 - membership change on DS does not show on AD
Bug 613833 - Allow dirsrv_t to bind to rpc ports
Bug 594745 - Get rid of dirsrv_lib_t label
Bug 620927 - Allow multiple membership attributes in memberof plugin
Bug 612264 - ACI issue with (targetattr='userPassword')
Bug 630098 - fix coverity Defect Type: Code maintainability issues
Bug 630098 - fix coverity Defect Type: Code maintainability issues
Bug 630093 - (cov#15511) Don't use unintialized search_results in refint plugin
Bug 630093 - (cov#15518) Need to intialize fd in ldbm2ldif code
Bug 630096 - (cov#11778) check return value of ldap_parse_result
Bug 630096 - (cov#15446) check return value of ber_scanf()
Bug 630096 - (cov#15449,15450) Check return value of stat()
Bug 630096 - (cov#15448) Check return value of cache_replace()
Bug 630096 - (cov#15447) - Check return value of idl_append_extend()
Bug 630090 - (cov#11974) Remove unused ACL functions
Bug 630090 - (cov#15445) Fix illegal free in archive code
Bug 630094 - (cov#11818) Fix unreachable return in snmp subagent
Bug 630094 - (cov#15451) Get rid of unreachable free statements
Bug 630094 - (cov#15452) Remove NULL checking for op_string
Bug 630094 - (cov#15453) Eliminate NULL check for local_newentry
Bug 630094 - (cov#15454) Fix deadcode issue in mapping tree code
Bug 630094 - (cov#15455) Remove deadcode in attr_index_config()
Bug 630094 - (cov#15456) Remove NULL check for srdn in import code
Bug 630094 - (cov#15457) Remove deadcode in import code
Bug 630094 - (cov#15458) Fix deadcode issue in moddn code
Bug 630094 - (cov#15459) Remove NULL check for srdn in ldif2ldbm code
Bug 630094 - (cov#15520) Fix unreachable code issue if perfctrs code
Bug 630094 - (cov#15581) Add missing breaks in agt_mopen_stats()
Bug 690090 - (cov#11974) Remove additional unused ACL functions
Bug 630091 - (cov#15512) Fix usage of uninitialized bervals
Bug 630091 - (cov#15513) Fix usage of uninitialized bervals
Bug 630091 - (cov#15514) Initialize DBT in entryrdn_get_parent()
Bug 630091 - (cov#15515) Use of uninitialized array in index config code
Bug 630091 - (cov#15516,15517) Initialize pointers before attempting to free
Bug 630091 - (cov#15519) Initialize bervals in search_easter_egg()
Bug 630091 - (cov#15582) Free of uninitialized pointer in attr_index_config()
Bug 630097 - (cov#11933) Fix NULL dereference in schema code
Bug 630097 - (cov#11938) NULL dereference in mmldif
Bug 630097 - (cov#11946) NULL dereference in ResHashCreate()
Bug 630097 - (cov#11964) Remove dead code from libaccess
Bug 630097 - (cov#12143) NULL dereference in cos cache code
Bug 630097 - (cov#12148) NULL dereference in ruvInit()
Bug 630097 - (cov#12182,12183) NULL dereference in import code
Bug 630097 - (cov#15460) NULL deference in ACL URL code
Bug 630097 - (cov#15461) Remove unnecessary NULL check in DNA
Bug 630097 - (cov#15462) NULL dereference in mep_modrdn_post_op()
Bug 630097 - (cov#15463) Remove NULL check in referint plugin
Bug 630097 - (cov#15464) NULL dereference in repl code
Bug 630097 - (cov#15465) Null dereference in USN code
Bug 630097 - (cov#15473) NULL dereference in ResHashCreate()
Bug 630097 - (cov#15505) NULL dereference in memberOf code
Bug 630097 - (cov#15506) NULL dereference in dblayer code
Bug 630097 - (cov#15507,15508) NULL dereference in entryrdn code
Bug 630097 - (cov#15509) NULL dereference in idsktune
Bug 630097 - (cov#11938) NULL dereference in mmldif
Bug 630097 - (cov#15477) NULL dereference in ACL plug-in code
Bug 630091 - (cov#12209) Use of uninitialized pointer in libaccess
Bug 630092 - (cov#12116) Resource leak in ldclt code
Bug 630092 - (cov#12105) Resource leak in pwdscheme config code
Bug 630092 - (cov#12068) Resource leak in certmap code
Bug 630091 - (cov#11973) Array overrun in libaccess
Bug 522055 - Scope check for managed attribute fails
Bug 625335 - Self-write aci has permission to invalid attribute
Bug 631993 - Log authzid when proxy auth control is used
Cov #16300 - Unused variable in account policy plugin
Bug 544321 - remove-ds.pl should not throw error unlabelling port
Bug 555955 - Allow CoS values to be merged
Bug 643937 - Initialize replication version flags
Bug 305131 - Allow empty modify operation
Bug 619633 - Make attribute uniqueness obey requiredObjectClass
Bug 619623 - attr-unique-plugin ignores requiredObjectClass on modrdn operations
Bug 189985 - Improve attribute uniqueness error message
Bug 647932 - multiple memberOf configuration adding memberOf where there is no member
Bug 521088 - DNA should check ACLs before getting a value from the range
Bug 635009 - Add one-way AD sync capability
Bump VERSION.sh to 1.2.8.a1
Bug 648949 - Move selinux policy into base OS
Bug 648949 - Update configure
Roll back VERSION.sh for 1.2.7 release
Bug 625950 - hash nsslapd-rootpw changes in audit log
Bug 656392 - Remove calls to ber_err_print()
Bug 656515 - Allow Name and Optional UID syntax for grouping attributes
Bug 197886 - Avoid overflow of UUID generator
Bug 658312 - Allow mapped attribute types to be quoted
Bug 197886 - Initialize return value for UUID generation code
Bug 658309 - Process escaped characters in managed entry mappings
Bug 659456 - Incorrect usage of ber_printf() in winsync code
Bug 641944 - Don't normalize non-DN RDN values
Bug 658312 - Invalid free in Managed Entry plug-in
Bug 661792 - Valid managed entry config rejected
Bug 588791 - Allow anonymous rootDSE access only
Bug 606439 - Creating server instance with LDAPI takes too long
Bug 632670 - Chain-on-update logs managed-entries-plugin errors
Bug 621008 - parsing purge RUV from changelog at startup fails
Bug 663191 - Don't use $USER in DSCreate.pm
Bug 663597 - Memory leaks in normalization code
Bug 659131 - Incorrect RDN values added with multi-valued RDN
Bug 661102 - Rename of managed entries not handled correctly
Bug 193297 - Call pre-bind plug-ins for all SASL bind steps
Bug 201652 - LDAPv2 bind with expired password doesn't unbind correctly
Bug 470576 - Migration could do addition checks before commiting actions
Bug 481195 - Missing op type in log when password change required
Bug 509897 - Validate dnaScope to ensure it is a legal DN
Bug 505722 - Allow ntGroup to have mail attribute present
Bug 543633 - replication problems if supplier is killed under update load
Bug 671033 - range sharing between server breaks with SASL/GSSAPI auth
Bug 527912 - setup-ds.pl appears to hang when DNS is unreachable
Bug 252249 - Add pkg-config file for plug-in developers
Bug 670616 - Allow SSF to be set for local (ldapi) connections
Bug 668862 - init scripts return wrong error code
Bug 674430 - Improve error messages for attribute uniqueness
Bug 675853 - dirsrv crash segfault in need_new_pw()
Bug 678646 - Ignore tombstone operations in managed entry plug-in
Bug 671199 - Don't allow other to write to rundir
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 674852 - crash in ldap-agent when using OpenLDAP
Bug 681345 - setup-ds.pl should set SuiteSpotGroup automatically
Bug 680558 - Winsync plugin fails to restrain itself to the configured subtree
Bug 504803 - Allow maxlogsize to be set if logmaxdiskspace is -1
Bug 687974 - (cov#10715) Fix Coverity uninitialized variables issues
Bug 688341 - (cov#10709) Fix Coverity code maintainability issues
Bug 688341 - (cov#10708) Fix Coverity code maintainability issues
Bug 688341 - (cov#10706,10707) Fix Coverity code maintainability issues
Bug 688341 - (cov#10704,10705) Fix Coverity code maintainability issues
Bug 688341 - (cov#10703) Fix Coverity code maintainability issues
Bug 688341 - (cov#10702) Fix Coverity code maintainability issues
Bug 688341 - (cov#10709) Fix Coverity code maintainability issues
Bug 689537 - (cov#10699) Fix Coverity NULL pointer dereferences
Bug 689537 - (cov#10610) Fix Coverity NULL pointer dereferences
Bug 689537 - (cov#10608) Fix Coverity NULL pointer dereferences
Bug 689952 - (cov#10581) Incorrect bit check in replication connection code
Bug 690526 - (cov#10734) Double free in dse_add()
Bug 690649 - (cov#10731) Use of free'd pointer in indexing code
Bug 690882 - (cov#10571) Incorrect sizeof use in uuid code
Bug 690882 - (cov#10636,10637) Useless comparison in attrcrypt
Bug 690882 - (cov#10703) Incorrect sizeof use in vattr code
Bug 690882 - (cov#10572,10710) Incorrect sizeof use in uuid code
Bug 691574 - (cov#10579) Check return value of ber_scanf() in sort code
Bug 691574 - (cov#10577) Check return types when adding RDN CSNs
Bug 691574 - (cov#10573) check return value in GER code
Bug 691574 - (cov#10575) Check return value of ldap_get_option
Bug 691574 - (cov#10573) Fix syntax error
Bug 693868 - Add managed entry config during in-place upgrade
Add Auto Membership Plug-in
Bug 698428 - Make auto membership use Slapi_DN for DN comparisons
Bug 695779 - windows sync can lose old values when a new value is added
Bug 700557 - Linked attrs callbacks access free'd pointers after close
Bug 700557 - Leak at shutdown in DNA plug-in
Bug 703304 - Auto membership alternate config area should override default area
Bug 703304 - Auto membership alternate config area should override default area
Bug 703530 - Allow Managed Entry config to be relocated
Bug 697961 - memberOf needs to be triggered by internal operations
Bug 710377 - Import with chain-on-update crashes ns-slapd
Split automember regex rules into separate entries
Bug 713209 - Update sudo schema
Bug 691313 - Need TLS/SSL error messages in repl status and errors log
Bug 723937 - Slapi_Counter API broken on 32-bit F15
Bug 725743 - Make memberOf use PRMonitor for it's operation lock
Bug 729717 - Fatal error messages when syncing deletes from AD
Bug 728510 - Run dirsync after sending updates to AD
Bug 730387 - Add slapi_rwlock API and use POSIX rwlocks
Bug 611438 - Add Account Usability Control support
Bug 728592 - Allow ns-slapd to start with an invalid server cert
Bug 732541 - Ignore error 32 when adding automember config
Bug 722292 - Entries in DS are not updated properly when using WinSync API
Bug 722292 - (cov#11030) Leak of mapped_sdn in winsync rename code
Bug 735114 - renaming a managed entry does not update mepmanagedby
Bug 739172 - Allow separate fractional attrs for incremental and total protocols
Bug 743966 - Compiler warnings in account usability plugin
Bug 744946 - (cov#11046) NULL dereference in IDL code
Bug 752155 - Use restorecon after creating init script lock file
Ticket 284 - Remove unnecessary SNMP MIB files
ticket 304 - Fix kernel version checking in dsktune
ticket 211 - Use of uninitialized variables in ldbm_back_modify()
ticket 181 - Allow PAM passthru plug-in to have multiple config entries
coverity 12563 Read from pointer after free (fix 2)
Ticket 211 - Avoid preop range requests non-DNA operations
Ticket #503 - Improve AD version in winsync log message
Ticket 549 - DNA plugin no longer reports additional info when range is depleted
Ticket 556 - Don't overwrite certmap.conf during upgrade
Add make rpms build target
Allow rpm builds to be run without configure
Add git commit hash to developer rpm build names
Add hardened build option and correct changelog dates
Revert "Ticket #47431 - Duplicate values for the attribute nsslapd-pluginarg are not handled correctly"
Ticket 449 - Allow macro aci keywords to be case-insensitive
Ticket 47539 - Disabling DNA plug-in throws error 53
Ticket 47513 - tmpfiles.d references /var/lock when they should reference /run/lock
Ticket 47565 - Content Sync update file needs extensibleObject
Ticket 47569 - ACIs do not allow attribute subtypes in targetattr keyword
Ticket 47569 - Fix build warnings
Ticket 47588 - Compiler warnings building on F19
Ticket 47611 - Add script to build patched RPMs
Ticket 47753 - Add switch to disable pre-hashed password checking
Noriko Hosoi (560):
544089 - Referential Integrity Plugin does not take into account the attribute
557224 - subtree rename breaks the referential integrity plug-in
247413 - Incorrect error on multiple identical value add
559016 - Attempting to rename suffix returns inappropriate errors
555577 - Syntax validation fails for "ou=NetscapeRoot" tree
Undo - 555577 - Syntax validation fails for "ou=NetscapeRoot" tree
560827 - Admin Server templates: DistinguishName validation fails
548535 - memory leak in attrcrypt
563365 - Error handling problems in the backend functions
565664 - Incorrect parameter for CACHE_RETURN()
565987 - redhat-ds-base fails to build due to undefined struct
527848 - make sure db upgrade to 4.7 and later works correctly
539618 - Replication bulk import reports Invalid read/write
567370 - dncache: assertion failure in id2entry_delete
548115 - memory leak in schema reload
555970 - missing read lock in the combination of cos and nsview
539618 - Replication bulk import reports Invalid read/write
570667 - MMR: simultaneous total updates on the masters cause
Merge branch '547503'
Revert "Merge branch '547503'"
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
199923 - subtree search fails to find items under a db
570107 - The import of LDIFs with base-64 encoded DNs fails,
572649 - DS8.2 crashes on RHEL 4 (corresponding to bob, ber_2 test case)
573060 - DN normalizer: ESC HEX HEX is not normalized (
573896 - initializing subtree with invalid syntax crashes ns-slapd
515805 - Stop "initialize Database" crashes the server
548533 - memory leak in Repl_5_Inc_Protocol_new
Fixing a syntax error
Update to New DN Format
585905 - ACL with targattrfilters error crashes the server
574167 - An escaped space at the end of the RDN value is not
590931 - rhds81 import - hardcoded pages_limit for nsslapd-import-cache-autosize
591336 - Implementing upgrade DN format tool
593453 - Creating password policy with ns-newpolicy.pl on Replicated
593110 - backup-restore does not ALWAYS work
593899 - adding specific ACI causes very large mem allocate request
588867 - entryusn plugin fails on solaris
593899 - adding specific ACI causes very large mem allocate request
595893 - Base DN in SASL mapping is not normalized
511112 - Password history limited to 25 values
597375 - Deleting LDBM database causes backup/restore problem
574101 - MODRDN request never returns - possible deadlock
606920 - anonymous resource limit - nstimelimit -
605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl
578296 - Attribute type entrydn needs to be added when subtree
609256 - Selinux: pwdhash fails if called via Admin Server CGI
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
616618 - 389 v1.2.5 accepts 2 identical entries with different DN formats
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
616608 - SIGBUS in RDN index reads on platforms with strict alignments
619595 - Upgrading sub suffix under non-normalized suffix disappears
513166 - Simple Paged result doesn't provide the server's estimate
621928 - Unable to enable replica (rdn problem?) on 1.2.6 rc6
Bug 194531 - db2bak is too noisy
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 623118 - Simplepaged results going in infinite loop
Bug 614511 - fix coverity Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 619122 - fix coverity Defect Type: Resource leaks issues CID 11975 - 12051
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverity Defect Type: Resource leaks issues CID 12052 - 12093
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892
Bug 616500 - fix coverity Defect Type: Resource leaks issues
Bug 623507 - fix coverity Defect Type: Incorrect expression issues
Bug 623507 - fix coverity Defect Type: Incorrect expression issues
Bug 613056 - fix coverify Defect Type: Null pointer dereferences
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Removed redundant code in agmt_new_from_entry
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 628300 - DN is not normalized in dn/entry cache when an entry is added, entrydn is not present in search results
Bug 531642 - EntryUSN: RFE: a configuration option to make entryusn "global"
Bug 627738 - The cn=monitor statistics entries for the dnentry cache do not change or change very rarely
DN normalizer should check the invalid type
Bug 627738 - The cn=monitor statistics entries for the dnentry cache
Bug 629710 - escape_string does not check '\<HEX><HEX>'
agmtlist_shutdown (repl5_agmtlist.c) had an illegal access defect.
Bug 633168 - Share backend dbEnv with the replication changelog
Bug 633168 - Share backend dbEnv with the replication changelog
Bug 631862 - crash - delete entries not in cache + referint
Bug 625014 - SubTree Renames: ModRDN operation fails and the server hangs if the entry is moved to "under" the same DN.
Bug 558099 - Enhancement request: Log more information about the search result being a paged one
Bug 635987 - Incorrect sub scope search result with
Bug 606920 - anonymous resource limit- nstimelimit -
Bug 635987 - Incorrect sub scope search result with ACL containing ldap:///self
Bug 639289 - Adding a new CN entry with UpperCase UTF-8 Character
Bug 640027 - Naming attribute with a special char sequence parsing bug
Bug 640854 - changelog db: _cl5WriteOperation: failed to
Bug 637852 - sasl_io_start_packet: failed - read only 3 bytes
Bug 586966 - Sample update script has syntax errors
Bug 586973 - Sample update ldif points to non-existent directory
Bug 602456 - Allow to add any cn=config attributes;
Bug 244229 - targetattr not verified against schema when setting an aci
Bug 643532 - Incorrect DNs sometimes returned on searches
Bug 592397 - Upgrade tool dn2rdn: it does not clean up
Bug 645061 - Upgrade: 06inetorgperson.ldif and 05rfc4524.ldif
Bug 629681 - Retro Changelog trimming does not behave as expected
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 638773 - permissions too loose on pid and lock files
Bug 491733 - dbtest crashes
Bug 329751 - "nested" filtered roles searches candidates more
Bug 567282 - server can not abandon searchRequest of "simple paged results"
Bug 572018 - Upgrading from 1.2.5 to 1.2.6.a2 deletes userRoot
Bug 651571 - When attrcrypt is on, entrydn is stored in the backend db
Bug 661918 - 389-ds MMR plugin's changelogdb path logic is incorrect
Bug 182507 - clear-password mod from replica is discarded before changelogged
Bug 602456 - Allow to add any cn=config attributes;
Bug 489379 - passwordExpirationTime in entry being added
Bug 663484 - Entry usn plugin fails to properly tag entries on initialization
Bug 664563 - GER: ger for non-present entry is not correct
Bug 653007 - db2ldif export of clear text passwords lacks storage scheme
Bug 667488 - Cannot recreate numsubordinates index with db2index
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 615100 - log rotationinfo always recreated at startup,
Bug 624442 - MMR: duplicate replica ID
Bug 669205 - db2bak: backed up changelog should include RUVs
Bug 616850 - ldapmodify failed to reject the replace operation
Bug 627993 - Inconsistent storage of password expiry times
Bug 627993 - Inconsistent storage of password expiry times
dn2rdn should respect the DB version info
Bug 646381 - Faulty password for nsmultiplexorcredentials does not give any error message in logs
Bug 624547 - attrcrypt should query the given slot/token for
Bug 668619 - slapd stops responding
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
Bug 615052 - intrinsics and 64-bit atomics code fails to compile
Bug 616213 - insufficient stack size for HP-UX on PA-RISC
Bug 675265 - preventryusn gets added to entries on a failed delete
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 676053 - export task followed by import task causes cache assertion
Bug 676053 - export task followed by import task causes cache assertion
Bug 676053 - export task followed by import task causes cache assertion
Bug 450016 - RFE- Console display values in KB/MB/GB
Cancelling commit aef19508c4f618285116d2068655183658f564d9
Bug 625424 - repl-monitor.pl doesn't work in hub node
Bug 679978 - modifying attr value crashes the server, which is supposed to
Bug 681015 - RFE: allow fine grained password policy duration attributes in days, hours, minutes, as well
Bug 668909 - Can't modify replication agreement in some cases
Bug 684996 - Exported tombstone cannot be imported correctly
Bug 681015 - RFE: allow fine grained password policy duration attributes in days, hours, minutes, as well
Bug 689866 - ns-newpwpolicy.pl needs to use the new DN format
Bug 690955 - Mrclone fails due to the replica generation id mismatch
Bug 696407 - If an entry with a mixed case RDN is turned to be
Bug 697027 - 1 - minor memory leaks found by Valgrind + TET
Bug 697027 - 2 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 697027 - 4 - minor memory leaks found by Valgrind + TET
Bug 697027 - 5 - minor memory leaks found by Valgrind + TET
Bug 697027 - 6 - minor memory leaks found by Valgrind + TET
Bug 697027 - 7 - minor memory leaks found by Valgrind + TET
Bug 697027 - 8 - minor memory leaks found by Valgrind + TET
Bug 697027 - 9 - minor memory leaks found by Valgrind + TET
Bug 697027 - 10 - minor memory leaks found by Valgrind + TET
Bug 697027 - 11 - minor memory leaks found by Valgrind + TET
Bug 697027 - 12 - minor memory leaks found by Valgrind + TET
Bug 697027 - 13 - minor memory leaks found by Valgrind + TET
Bug 697027 - 14 - minor memory leaks found by Valgrind + TET
Bug 697027 - 15 - minor memory leaks found by Valgrind + TET
Bug 697027 - 16 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 700215 - ldclt core dumps
Bug 668619 - slapd stops responding
Bug 709826 - Memory leak: when extra referrals configured
Bug 706179 - DS can not restart after create a new objectClass has entryusn attribute
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
Bug 718303 - Intensive updates on masters could break the consumer's cache
Merge branch '718303'
Bug 719069 - clean up compiler warnings in 389-ds-base 1.2.9
Bug 712855 - Directory Server 8.2 logs "Netscape Portable
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 732153 - subtree and user account lockout policies implemented?
Introducing an environment variable USE_VALGRIND to clean up the entry cache and dn cache on exit.
Bug 744945 - nsslapd-counters attribute value cannot be set to "off"
Keep unhashed password psuedo-attribute in the adding entry
Reduce the number of DN normalization
Bug 745259 - Incorrect entryUSN index under high load
Bug 750622 - Fix Coverity (11104) Resource leak:
Bug 750624 - Fix Coverity (11053) Explicit null dereferenced:
Bug 750625 - Fix Coverity (11066) Unused pointer value
Bug 750625 - Fix Coverity (11065) Uninitialized pointer read
Bug 750625 - Fix Coverity (11064) Dereference before null check
Bug 750625 - Fix Coverity (11061) Resource leak
Bug 750625 - Fix Coverity (11060) Dereference null return value
Bug 750625 - Fix Coverity (11058, 11059) Dereference null return value
Bug 750625 - Fix Coverity (11057) Dereference null return value
Bug 750625 - Fix Coverity (11055) Explicit null dereferenced
Bug 750625 - Fix Coverity (11054) Dereference after null check
Bug 750625 - Fix Coverity (11117) Uninitialized pointer read
Bug 750625 - Fix Coverity (11116) Uninitialized pointer read
Bug 750625 - Fix Coverity (11114, 11115) Uninitialized value use
Bug 750625 - Fix Coverity (11113) Uninitialized pointer read
Bug 750625 - Fix Coverity (11112) Uninitialized pointer read
Bug 750625 - Fix Coverity (11109, 11110, 11111) Uninitialized pointer read
Bug 750625 - Fix Coverity (11108) Sizeof not portable
Bug 750625 - Fix Coverity (11107) Dereference before null check
Bug 750625 - Fix Coverity (11096) Explicit null dereferenced
Bug 750625 - Fix Coverity (11095) Explicit null dereferenced
Bug 750625 - Fix Coverity (11094) Dereference after null check
Bug 750625 - Fix Coverity (11091) Unchecked return value
Bug 750625 - Fix Coverity (11055-2) Explicit null dereferenced
Bug 750625 - Fix Coverity (11062) Resource leak
Bug 750625 - Fix Coverity (11066-2) Unused pointer value
Bug 750625 - Fix Coverity (12195) Dereference after null check
Bug 750625 - Fix Coverity (12196) Dereference before null check
Bug 750625 - Fix Coverity (11066-3) Unused pointer value
Bug 745259 - Incorrect entryUSN index under high load in
Trac Ticket 2 - If node entries are tombstone'd,
Trac Ticket 2 - If node entries are tombstone'd,
Trac Ticket 26 - Please support setting
Trac Ticket 75 - Unconfigure plugin opperations are being called.
Trac Ticket 168 - minssf should not apply to rootdse
Trac Ticket #18 - Data inconsitency during replication
Trac Ticket #52 - FQDN set to nsslapd-listenhost
Trac Ticket 139 - eliminate the use of char *dn in favor of Slapi_DN *dn
Trac Ticket 35 - Log not clear enough on schema errors
Trac Ticket #274 - Reindexing entryrdn fails if
Trac Ticket #275 - Invalid read reported by valgrind
Trac Ticket 51 - memory leaks in 389-ds-base-1.2.8.2-1.el5?
Trac Ticket #27 - SASL/PLAIN binds do not work
Trac Ticket #84 - 389 Directory Server Unnecessary Checkpoints
Trac Ticket #169 - allow 389 to use db5
Trac Ticket #34 - remove-ds.pl does not remove everything
Trac Ticket #26 - Please support setting defaultNamingContext in the rootdse.
Trac Ticket #298 - crash when replicating orphaned tombstone entry
Trac Ticket #290 - server hangs during shutdown if betxn pre/post op fails
Trac Ticket #290 - server hangs during shutdown if betxn pre/post op fails
Minor bug fix introcuded by commit 69c9f3bf7dd9fe2cadd5eae0ab72ce218b78820e
Trac Ticket #260 - 389 DS does not support multiple
Fixing compiler warnings
Trac Ticket #303 - make DNA range requests work with transactions
coverity 12606 Logically dead code
Trac Ticket #46 - setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 (revised) - setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 - (take 3) setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 - (additional) setup-ds-admin.pl does not
Trac Ticket #45 - Fine Grained Password policy:
Trac Ticket #46 - (additional 2) setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #335 - transaction retries need to be cache aware
Trac Ticket #338 - letters in object's cn get converted to
Trac Ticket #310 - Avoid calling escape_string() for logged DNs
Trac Ticket #19 - Convert entryUSN plugin to transaction aware type
Trac Ticket #345 - db deadlock return should not log error
Trac Ticket #359 - Database RUV could mismatch the one in changelog under the stress
Trac Ticket #359 - Database RUV could mismatch the one
Trac Ticket #338 - letters in object's cn get converted to
Trac Ticket #335 - transaction retries need to be cache aware
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
audit log does not log unhashed password: enabled, by default.
Trac Ticket 396 - Account Usability Control Not Working [Bug 835238]
Trac Ticket #402 - nhashed#user#password in entry extension
Trac Ticket #346 - Slow ldapmodify operation time for large
Trac Ticket #346 - Slow ldapmodify operation time for large
Coverity defects
Conflict definition in SLAPI_ATTR_FLAG macros
Trac Ticket #412 - memberof performance enhancement
Trac Ticket #409 - Report during startup if nsslapd-cachememsize is too small
Ticket 328 - make sure all internal search filters are properly escaped
Ticket 328 - make sure all internal search filters are properly escaped
Trac Ticket #346 - Slow ldapmodify operation time for large
Trac Ticket #437 - variable dn should not be used in ldbm_back_delete
Coverity defects
Trac Ticket #340 - Change on SLAPI_MODRDN_NEWSUPERIOR is not
Trac Ticket #466 - entry_apply_mod - ADD: Failed to set
Coverity defects
Trac Ticket #470 - 389 prevents from adding a posixaccount
Coverity defects
Trac Ticket #453 - db2index with -tattrname:type,type fails
Trac Ticket #351 - use betxn plugins by default
Bug 863576 - Dirsrv deadlock locking up IPA
Trac Ticket #455 - Insufficient rights to unhashed#user#password
Trac Ticket #451 - Allow db2ldif to be quiet
Coverity defects
Fixing compiler warnings in the posix-winsync plugin
Trac Ticket #494 - slapd entered to infinite loop during new index addition
Coverity defects
Trac Ticket #498 - Cannot abaondon simple paged result search
Trac Ticket #448 - Possible to set invalid macros in Macro ACIs
Trac Ticket #391 - Slapd crashes when deleting backends
Coverity fixes
Trac Ticket #190 - Un-resolvable server in replication
Trac Ticket #443 - Deleting attribute present in
Trac Ticket #447 - Possible to add invalid attribute
Trac Ticket #311 - IP lookup failing with multiple DNS
Trac Ticket #500 - Newly created users with
Trac Ticket #519 - Search with a complex filter including range search is slow
Trac Ticket #520 - RedHat Directory Server crashes (segfaults) when moving ldap entry
Coverity defect: Resource leak 13110
Trac Ticket #276 - Multiple threads simultaneously working on
Trac Ticket #531 - loading an entry from the database should use str2entry_fast
Trac Ticket #536 - Clean up compiler warnings for 1.3
Trac Ticket #531 - loading an entry from the database should use str2entry_f
Trac Ticket #499 - Handling URP results is not corrrect
bump version to 1.3.0.rc1
Trac Ticket #522 - betxn: upgrade is not implemented yet
Ticket 509 - lock-free access to be->be_suffixlock
Trac Ticket #497 - Escaped character cannot be used in the substring search filter
Ticket #422 - 389-ds-base - Can't call method "getText"
Ticket #547 - Incorrect assumption in ndn cache
Ticket #545 - Segfault during initial LDIF import: str2entry_dupcheck()
Ticket #542 - Cannot dynamically set nsslapd-maxbersize
Ticket #537 - Improvement of range search
Ticket #342 - better error message when cache overflows
Ticket #505 - use lock-free access name2asi and oid2asi tables (additional)
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #502 - setup-ds.pl script should wait if "semanage.trans.LOCK" presen
Ticket #563 - DSCreate.pm: Error messages cannot be used in the if expression since they could be localized.
Ticket #533 - only scan for attributes to decrypt if there are encrypted attrs configured
Ticket #543 - Sorting with attributes in ldapsearch gives incorrect result
Ticket #572 - PamConfig schema not updated during upgrade
Ticket #576 - DNA: use event queue for config update only at the start up
Ticket #579 - Error messages encountered when using POSIX winsync
Ticket #584 - Existence of an entry is not checked when its password is to be deleted
bump version to 1.3.1.pre.a1
Ticket #561 - disable writing unhashed#user#password to changelog
Coverity Fix
Ticket #490 - Slow role performance when using a lot of roles
Ticket #603 - A logic error in str2simple
Ticket #604 - Required attribute not checked during search operation
Ticket #585 - Behaviours of "db2ldif -a <filename>" and "db2ldif.pl -a <filename>" are inconsistent
Fixing a compiler warning introduced by Ticket #561 - disable writing unhashed#user#password to changelog
Ticket #634 - Deadlock in DNA plug-in
Ticket #627 - ns-slapd crashes sporadically with segmentation fault in libslapd.so
Ticket #47308 - unintended information exposure when anonymous access is set to rootdse
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
Ticket #618 - Crash at shutdown while stopping replica agreements
Ticket 458 - Need to properly check if the password admin dn is set
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #608 - Posix Winsync plugin throws "posix_winsync_end_update_cb: failed to add task entry" error message
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
bump version to 1.3.2.pre.a1
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket 528 - RFE - get rid of instance specific scripts
Ticket #47330 - changelog db extension / upgrade is obsolete
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #47313 - Indexed search with filter containing '&' and "!" with attribute subtypes gives wrong result
Ticket #47330 - changelog db extension / upgrade is obsolete
Ticket #47347 - Simple paged results should support async search
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #47320 - put conn on work_q not poll list if conn has buffered more_data
Ticket 47331 - Self entry access ACI not working properly
Ticket #529 - dn normalization must handle multiple space characters in attributes
Coverity fix -- 13164: Logically dead code
Ticket #47343 - 389-ds-base: Does not support aarch64 in f19 and rawhide
Ticket #47327 - error syncing group if group member user is not synced
Ticket #428 - posix winsync should support ADD user/group entries from DS to AD
Trac Ticket #402 - nhashed#user#password in entry extension
Ticket #569 - examine replication code to reduce amount of stored state information
Ticket 47379 - DNA plugin failed to fetch replication agreement
Ticket #47391 - deleting and adding userpassword fails to update the password
Ticket #47391 - deleting and adding userpassword fails to update the password (additional fix)
Ticket #47400 - MMR stress test with dna enabled causes a deadlock
Ticket #47384 - Plugin library path validation
Ticket #47374 - flush.pl is not included in perl5
Ticket #47420 - An upgrade script 80upgradednformat.pl fails to handle a server instance name incuding '-'
Ticket #47419 - Unhashed userpassword can accidentally get removed from mods
Ticket #47384 - Plugin library path validation
Ticket #47367 - (phase 1) ldapdelete returns non-leaf entry error while trying to remove a leaf entry
Ticket #47367 - (phase 2) ldapdelete returns non-leaf entry error while trying to remove a leaf entry
Ticket #47435 - Very large entryusn values after enabling the USN plugin and the lastusn value is negative.
Ticket #521 - modrdn + NSMMReplicationPlugin - Consumer failed to replay change
Ticket #47378 - fix recent compiler warnings
Ticket #630 - The backend name provided to bak2db is not validated
Ticket #415 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist
Ticket #47314 - Winsync should support range retrieval
Ticket #47310 - Attribute "dsOnlyMemberUid" not allowed when syncing nested posix groups from AD with posixWinsync
Ticket #48 - Active Directory has certain uids which are reserved and will cause a Directory Server replica initialization of an AD server to abort.
Ticket #609 - nsDS5BeginReplicaRefresh attribute accepts any value and it doesn't throw any error when server restarts.
Ticket #197 - BDB backend - clear free page files to reduce changelog size
Ticket #48 - Active Directory has certain uids which are reserved and will cause a Directory Server replica initialization of an AD server to abort.
Ticket #460 - support multiple subtrees and filters
coverity 11956 - Dereference after null check
Ticket #47492 - PassSync removes User must change password flag on the Windows side
Ticket #47523 - Set up replcation/agreement before initializing the sub suffix, the sub suffix is not found by ldapsearch
Ticket #47534 - RUV tombstone search with scope "one" doesn`t work
Ticket #47463 - IDL-style can become mismatched during partial restoration
Coverity fixes - 12023, 12024, and 12025
Ticket #54 - locale "nl" not supported by collation plugin
Ticket #53 - Need to update supported locales
bump version to 1.3.2.0
Ticket #53 - Need to update supported locales
bump version to 1.3.2.2
bump version to 1.3.2.3
Ticket #47581 - Winsync plugin segfault during incremental backoff
Ticket #47581 - Winsync plugin segfault during incremental backoff (phase 2)
Ticket #342 - better error message when cache overflows (phase 2)
Bump version to 1.3.2.8
Ticket #47313 - Indexed search with filter containing '&' and "!" with attribute subtypes gives wrong result
Ticket #47606 - replica init/bulk import errors should be more verbose
Bump version to 1.3.2.9
Ticket #447 - Possible to add invalid attribute to nsslapd-allowed-to-delete-attrs
Revert "Ticket 47653 - Need a way to allow users to create entries assigned to themselves"
Ticket #47660 - config_set_allowed_to_delete_attrs: Valgrind reports Invalid read
Ticket #47571 - targetattr ACIs ignore subtype
Ticket #47571 - targetattr ACIs ignore subtype
Ticket #342 - better error message when cache overflows
Ticket #443 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
Ticket #47649 - Server hangs in cos_cache when adding a user entry
Bump version to 1.3.2.11
Ticket #47693 - Environment variables are not passed when DS is started via service
Ticket #47677 - Size returned by slapi_entry_size is not accurate
Ticket #47642 - Windows Sync group issues
Ticket #47700 - Unresolved external symbol references break loading of the ACL plugin
Ticket #47709 - package issue in 389-ds-base
Ticket #47709 - package issue in 389-ds-base
Ticket #47709 - package issue in 389-ds-base
Ticket 525 - Replication retry time attributes cannot be added
Ticket 408 - create a normalized dn cache
Ticket 571 (dup 47361) - Empty control list causes LDAP protocol error is thrown
Ticket 408 - create a normalized dn cache
Bump version to 1.3.2.13
Ticket #47735 - e_uniqueid fails to set if an entry is a conflict entry
Ticket #47737 - Under heavy stress, failure of turning a tombstone into glue makes the server hung
Ticket #47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind
Revert "Ticket 47700 - Fix compiler warnings"
Bump version to 1.3.2.14
Ticket #47734 - Change made in resolving ticket #346 fails on Debian SPARC64
Ticket #47735 - e_uniqueid fails to set if an entry is a conflict entry
Ticket #47740 - Coverity issue in 1.3.3
Bump version to 1.3.2.15
Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check
Ticket #346 - Slow ldapmodify operation time for large quantities of multi-valued attribute values
Ticket #47707 - 389 DS Server crashes and dies while handles paged searches from clients
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing;
Ticket #47764 - Problem with deletion while replicated
Ticket #47780 - Some VLV search request causes memory leaks
Ticket #47804 - db2bak.pl error with changelogdb
Ticket #47720 - Normalization from old DN format to New DN format doesnt handel condition properly when there is space in a suffix after the seperator operator.
Bump version to 1.3.2.17
Ticket #47770 - #481 breaks possibility to reassemble memberuid list
Ticket #47808 - If be_txn plugin fails in ldbm_back_add, adding entry is double freed.
Ticket #47809 - find a way to remove replication plugin errors messages "changelog iteration code returned a dummy entry with csn %s, skipping ..."
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47763 - winsync plugin modify is broken
Bump version to 1.3.2.18
Ticket #47839 - 389-ds production segfault: __memcpy_sse2_unaligned...
Bump version to 1.3.2.19
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Bump version to 1.3.2.20
Ticket #346 - Fixing memory leaks
Ticket #47824 - paged results control is not working in some cases when we have a subsuffix.
Ticket #47869 - unauthenticated information disclosure (Bug 1123477)
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Bump version to 1.3.2.21
Ticket #47874 - Performance degradation with scope ONE after some load
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Revert "Ticket #47875 - dirsrv not running with old openldap"
Revert "Ticket #47875 - dirsrv not running with old openldap"
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Bump version to 1.3.2.23
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Ticket #47907 - ldclt: assertion failure with -e "add,counteach" -e "object=<ldif file>,rdn=uid:test[A=INCRNNOLOOP(0;24
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47919 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails.
Ticket #47897 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten
Ticket #47922 - dynamically added macro aci is not evaluated on the fly
Bump version to 1.3.2.24
Ticket #47948 - ldap_sasl_bind fails assertion (ld != NULL) if it is called from chainingdb_bind over SSL/startTLS
Ticket #47935 - Error: failed to open an LDAP connection to host 'example.org' port '389' as user 'cn=Directory Manager'. Error: unknown.
Ticket 47965 - Fix coverity issues (2014/12/16)
Ticket #47928 - Disable SSL v3, by default [389-ds-base-1.2.11 only]
Ticket #47945 - Add SSL/TLS version info to the access log
Ticket #47880 - provide enabled ciphers as search result
Ticket #47659 - ldbm_usn_init: Valgrind reports Invalid read / SIGSEGV
Ticket #47905 - Bad manipulation of passwordhistory
Ticket #47934 - nsslapd-db-locks modify not taking into account.
Ticket #47989 - Windows Sync accidentally cleared raw_entry
Ticket #47996 - ldclt needs to support SSL Version range
Bump version to 1.3.2.25
Rich Megginson (459):
Net::LDAP password modify extop breaks; msgid in response is 0xFF
Clean up assert for entrydn
Bug 543080 - Bitwise plugin fails to return the exact matched entries for Bitwise search filter
Bug 537466 - nsslapd-distribution-plugin should not require plugin name to begin with "lib"
bump version to 1.2.6.a2
Do not use syntax plugins directly for filters, indexing
wrap new style matching rule plugins for use in old style indexing code
change extensible filter code to use new syntax function style mr funcs
change syntax plugins to register required matching rule plugins
crash looking up compat syntax; numeric string syntax using integer; make octet string ordering work correctly
fix memory leak in attr replace when replacement fails
fix dso linking issues found by fedora 13 linking
problems linking with -z defs
389 DS segfaults on libsyntax-plugin.so - part 1
389 DS segfaults on libsyntax-plugin.so - part 2
389 DS segfaults on libsyntax-plugin.so - part 3
Bug 460162 - FedoraDS "with-FHS" installs init.d StartupScript in wrong location on non-RHEL/Fedora OS
Bug 568196 - Install DS8.2 on Solaris fails
Bug 568196 - Install DS8.2 on Solaris fails - part 2
Bug 551198 - LDAPI: incorrect logging to access log
bump version to 1.2.6.a3
fix various memory leaks
Bug 551198 - LDAPI: incorrect logging to access log - part 2
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
cleanup build warnings
Bug 571514 - upgrade to 1.2.6 should upgrade 05rfc4523.ldif (cert schema)
Bug 570905 - postalAddress syntax should allow empty lines (should allow $$)
Add support for additional schema/matching rules included with 389
Bug 572677 - Memory leak in searches including GER control
Bug 571677 - Busy replica on consumers when directly deleting a replication conflict
Bug 576074 - search filters with parentheses fail
Bug 567429 - slapd didn't close connection and get into CLOSE_WAIT state
Bug 578167 - repl. of mod/replace deletes multi-valued attrs
Bug 561575 - setup-ds-admin fails to supply nsds5ReplicaName when configuring via ConfigFile
Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements.
Bug 576644 - segfault while multimaster replication (paired node won't find deleted entries)
start of 1.2.6.a4
Bug 572018 - Upgrading from 1.2.5 to 1.2.6.a2 deletes userRoot
Fix too few args for format warning in acllas
Bug 586571 - DS Console shows escaped DNs
Bug 591685 - Server instances Fail to Start on Solaris due to Library Path and pcre
bump console version to 1.2.3
Repl Session API needs to check for NULL api before init
Bug 593392 - setup-ds-admin.pl -k creates world readable file
Bug 595874 - 99user.ldif getting overpopulated
bump version to 1.2.6.a5
bump version to 1.2.6.rc1
bump version to 1.2.6.rc2
bump version to 1.2.6.rc3
Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
Bug 603942 - null deref in _ger_parse_control() for subjectdn
bump version to 1.2.6.rc4
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 602530 - coverity: op_shared_modify: compare pre, post and original entries before freeing them
Bug 602531 - coverity: op_shared_delete: compare preop entry and GLUE_PARENT_ENTRY before freeing them
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 610177 - fix coverity Defect Type: Uninitialized variables issues
Bug 610276 - fix coverity Defect Type: API usage errors issues
Bug 611850 - fix coverity Defect Type: Error handling issues
Bug 614242 - C99/ANSI C++ related compile errors on HP-UX
Bug 547503 - replication broken again, with 389 MMR replication and TCP errors
Bug 617013 - repl-monitor.pl use cpu upto 90%
fix build failures due to libtool problems
Bug 617629 - Missing aliases in new schema files
Bug 617862 - Replication: Unable to delete tombstone errors
bump version to 1.2.7.a1
Bug 610281 - fix coverity Defect Type: Control flow issues - daemon.c:write_function()
Bug 610281 - fix coverity Defect Type: Control flow issues - last repl init status
postalAddress syntax does not accept empty values
ger should support both "dn" and "distinguishedName"
openldap - ldap_url_parse_ext is not part of the public api
fix memleak in ldbm_config_read_instance_entries
Add -x option to ldap tools when using openldap
openldap - add support for missing controls, add ldif api, fix NSS usage
port client tools to use openldap API
use the mozldap versions of the proxy auth control create function
document slapi wrappers for openldap/mozldap functions that differ
fix some compiler warnings
use strcasecmp with ptype and type->bv_val
ber_printf 'o' cannot handle NULL bv_val
fix the url_parse logic when looking for a missing suffix DN
openldap ldapsearch uses -LLL to suppress # version: N
add ldaptool_opts for the non BUNDLE case in Makefile.am
openldap ldapsearch returns empty line at end of LDIF output
have to use LDAP_OPT_X_TLS_NEVER to defeat cert hostname checking
openldap_read_function needs to set EWOULDBLOCK if the buffer is empty
do not terminate unwrapped LDIF line with another newline
slapi_ldap_url_parse must handle multiple host:port in url
convert mozldap host list to openldap uri list
move the out pointer back if continuation lines were removed
check src < *out only; only check for \nspace if src < *out - 2
use slapi_ldap_url_parse in the acl code
do not un-null-terminate normalized DN until new url is constructed
implement slapi_ldap_explode_dn and slapi_ldap_explode_rdn
use slapi_pblock_set to set the ldap result code for the be postop plugins
pass the string copy to slapi_dn_normalize_original
bug 614511 - fix coverity null reference - revert macro aci $dn logic
fix compiler warnings - unused vars/funcs, invalid casts
use slapi_mods_init_passin/get_ldapmods_passout if modifying the smods
Have to explicitly set protocol version to 3
Only check modrdn ops for backend/suffix correctness if not the default backend
Bug 634561 - Server crushes when using Windows Sync Agreement
openldap ber_init will assert if the bv->bv_val is NULL
add the account policy plugin and related server code, schema, and config
fix pblock memory leak
do not register pre/post op plugins if disabled
add support for global inactivity limit
fix typos in Makefile.am, acctpolicy schema
bump version to 1.2.7.a2
remove extra format argument; use %lu for size_t printf format
Bug 644013 - uniqueness plugin segfault bug
bump version to 1.2.7.a3
bump to 1.2.7.a4
bump version to 1.2.7.a5
put replication config entries in separate file
bump version to 1.2.7.a6
bump version to 1.2.7.1
bump version to 1.2.7.2
bump version to 1.2.7.3
bump version to 1.2.7.4
Bug 515329 - Multiple mods in one operation can result in an inconsistent replica
bump version to 1.2.8.a1
Bug 642046 - Segfault when using SASL/GSSAPI multimaster replication, possible krb5_creds doublefree
Bug 624485 - setup dsktune check step should default to "yes" if no problems found
Bug 622907 - support piped passwords to perl-based maintenance commands
Bug 624485 - setup dsktune check step should default to "yes" if no problems found
Bug 576534 - Password displayed on console when entered in command-line utilities
Bug 667935 - DS pipe log script's logregex.py plugin is not redirecting the log output to the text file
bump version to 1.2.8.a2
Bug 668385 - DS pipe log script is executed as many times as the dirsrv service is restarted
Bug 676689 - crash while adding a new user to be synced to windows
Bug 675113 - ns-slapd core dump in windows_tot_run if oneway sync is used
Bug 677440 - clean up compiler warnings in 389-ds-base 1.2.8
Bug 677774 - DS fails to start after reboot
Bug 666076 - dirsrv crash (1.2.7.5) with multiple simple paged result searches
Bug 675320 - empty modify operation with repl on or lastmod off will crash server
bump version to 1.2.9.a1 - console version to 1.2.4
Bug 677705 - ds-logpipe.py script is failing to validate "-s" and "--serverpid" options with "-t".
Bug 676655 - winsync stops working after server restart
Bug 680555 - ns-slapd segfaults if I have more than 100 DBs
Bug 514190 - setup-ds-admin.pl --debug does not log to file
Bug 518890 - setup-ds-admin.pl - improve hostname validation
Bug 644784 - Memory leak in "testbind.c" plugin
Bug 683250 - slapd crashing when traffic replayed
Bug 690584 - #10691 ldbm_back_init() - fix coverity resource leak issues
Bug 690584 - #10690 #10689 attrcrypt_get_ssl_cert_name() - fix coverity resource leak issues
Bug 690584 - #10688 - dblayer_make_env - fix coverity resource leak issues
Bug 690584 - #10669 #10668 cl5ImportLDIF - fix coverity resource leak issues
Bug 690584 - #10658 linked_attrs_pre_op - fix coverity resource leak issues
Bug 690584 - #10655 acllas__handle_group_entry - fix coverity resource leak issues
Bug 690584 - #10654 #10653 str2entry_dupcheck - fix coverity resource leak issues
Bug 690584 - #10652 #10651 #10650 #10649 #10648 #10647 send_specific_attrs send_all_attrs - fix coverity resource leak issues
Bug 690584 - #10643 hash_rootpw - fix coverity resource leak issues
Bug 690584 - #10641 reslimit_bv2int - fix coverity resource leak issues
Bug 691422 - sdt_destroy - fix coverity control flow issues
Bug 691422 - ldbm_back_upgradedb - fix coverity control flow issues
Bug 691422 - csnplFree - fix coverity control flow issues
Bug 691422 - SetUnicodeStringFromUTF_8 - fix coverity control flow issues
Bug 691422 - cl5DeleteRUV - fix coverity control flow issues
Bug 691422 - acl_read_access_allowed_on_entry - fix coverity control flow issues
Bug 691422 - search_internal_callback_pb - fix coverity control flow issues
Bug 691422 - cl5WriteRUV - fix coverity control flow issues
Bug 691422 - windows_replay_update - fix coverity control flow issues
Bug 690584 - #10691 ldbm_back_init() - fix coverity resource leak issues
Bug 690584 - #10652 #10651 #10650 #10649 #10648 #10647 send_specific_attrs send_all_attrs - fix coverity resource leak issues
Bug 668385 - DS pipe log script is executed as many times as the dirsrv service is restarted
Bug 692937 - Replica install fails after step for "enable GSSAPI for replication"
Bug 692331 - Segfault on index update during full replication push on 1.2.7.5
Bug 693451 - cannot use localized matching rules
Bug 693455 - nsMatchingRule does not work with multiple values
Bug 693503 - matching rules do not inherit from superior attribute type
Bug 693466 - Unable to change schema online
Bug 692991 - rhds82 - windows_tot_run: failed to obtain data to send to the consumer; LDAP error - -1
Bug 693473 - rhds82 rfe - windows_tot_run to log Sizelimit exceeded instead of LDAP error - -1
Bug 693962 - Full replica push loses some entries with multi-valued RDNs
Bug 694336 - Group sync hangs Windows initial Sync
Bug 700145 - userpasswd not replicating
Bug 703990 - Support upgrade from Red Hat Directory Server
bump console version to 1.2.5
Bug 703990 - Support upgrade from Red Hat Directory Server
Bug 703990 - Support upgrade from Red Hat Directory Server
Bug 707015 - Cannot disable SSLv3 and use TLS only
bump version to 1.2.9.a2
Bug 707384 - only allow FIPS approved cipher suites in FIPS mode
Bug 711906 - ns-slapd segfaults using suffix referrals
Bug 706209 - LEGAL: RHEL6.1 License issue for 389-ds-base package
Bug 703703 - setup-ds-admin.pl asks for legal agreement to a non-existant file
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
bump console version to 1.2.6
Bug 697694 - rhds82 - incr update state stop_fatal_error "requires administrator action", with extop_result: 9
Bug 716980 - winsync uses old AD entry if new one not found
add support for ldif files with changetype: add
writing Inf file shows SchemaFile = ARRAY(0xhexnum)
look for separate openldap ldif library
bump version to 1.2.9.a3
Bug 709468 - RSA Authentication Server timeouts when using simple paged results on RHDS 8.2.
Bug 720059 - RDN with % can cause crashes or missing entries
bump version to 1.2.9.0
Bug 725542 - Instance upgrade fails when upgrading 389-ds-base package
Bug 725953 - Winsync: DS entries fail to sync to AD, if the User's CN entry contains a comma
Bug 723937 - replication failing on RUV errors
bump version to 1.2.9.1
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.2
Bug 727511 - ldclt SSL search requests are failing with "illegal error numbe
bump version to 1.2.9.3
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.4
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.5
Bug 729378 - delete user subtree container in AD + modify password in DS == DS crash
Bug 723937 - replication failing on RUV errors
Bug 729369 - upgrade DB to upgrade from entrydn to entryrdn format is not working.
make sure the DBVERSION file ends in a newline
bump version to 1.2.10.a1
Bug 633803 - passwordisglobalpolicy attribute brakes TLS chaining
Bug 733103 - large targetattr list with syntax errors cause server to crash or hang
Bug 703990 - cross-platform - Support upgrade from Red Hat Directory Server
Bug 735121 - simple paged search + ip/dns based ACI hangs server
Bug 695736 - Providing native systemd file for upcoming F15 Feature Systemd
Bug 590826 - Reloading database from ldif causes changelog to emit "data no longer matches" errors
Bug 736712 - Modifying ruv entry deadlocks server
Add support for pre/post db transaction plugins
Make all backend operations transaction aware
Bug 741744 - MOD operations with chained delete/add get back error 53 on backend config
Bug 742324 - allow nsslapd-idlistscanlimit to be set dynamically and per-user
Bug 741744 - part2 - MOD operations with chained delete/add get back error 53 on backend config
Bug 740942 - allow resource limits to be set for paged searches independently of limits for other searches/operations
bump version to 1.2.10.a2
bump version to 1.2.10.a3
fix transaction support in ldbm_delete
bump version to 1.2.10.a4
set the ENTRY_POST_OP for modrdn betxnpostoperation plugins
pass the plugin config entry to the plugin init function
make memberof transaction aware and able to be a betxnpostoperation plugin
Bug 741744 - part3 - MOD operations with chained delete/add get back error 53
bump version to 1.2.10.a5
Change referential integrity to be a betxnpostoperation plugin
Use new PLUGIN_CONFIG_ENTRY feature to allow switching between txn and regular
Bug 748575 - rhds81 modrn operation and 100% cpu use in replication
Bug 748575 - part 2 - rhds81 modrdn operation and 100% cpu use in replication
Bug 751495 - 'setup-ds.pl -u' fails with undefined routine 'updateSystemD'
bump version to 1.2.10.a6
Bug 751645 - crash when simple paged fails to send entry to client
csn_as_string - use slapi_uN_to_hex instead of sprintf
uniqueid formatting - use slapi_u8_to_hex instead of sprintf
fix member variable name error in slapi_uniqueIDFormat
reduce calls to csn_as_string and slapi_log_error
csn_init_as_string should not use sscanf
use slapi_hexchar2int and slapi_str_to_u8 everywhere
Bug 755754 - Unable to start dirsrv service using systemd
Bug 755725 - 389 programs linked against openldap crash during shutdown
Ticket 1 - pre-normalize filter and pre-compile substring regex - and other optimizations
Ticket #162 - Infinite loop / spin inside strcmpi_fast, acl_read_access_allowed_on_attr, server DoS
bak2db gets stuck in infinite loop
Ticket #256 - debug build assertion in ACL_EvalDestroy()
bump version to 1.2.10.a7
Ticket #167 - Mixing transaction and non-transaction plugins can cause deadlock
fix mep sdn compiler warnings
add a hack to disable sasl hostname canonicalization - helps with testing when you don't want to set up correct host name resolution and/or cannot set the default system hostname
Ticket #12 - 389 DS DNA Plugin / Replication failing on GSSAPI
Ticket #257 - repl-monitor doesn't work if leftmost hostnames are the same
fix recent compiler warnings
Ticket #15 - Get rid of rwlock.h/rwlock.c and just use slapi_rwlock instead
fix compiler warnings
Remove redundant code - make a global into a static
Ticket #262 - pid file not removed with systemd
fix mozldap build issues
Ticket #264 - upgrade needs better check for "server is running"
Ticket #263 - add systemd include directive
bump version to 1.2.10.rc1
change version to 1.2.10.a8
Ticket #272 - add tombstonenumsubordinates to schema
bump version to 1.2.10.rc1
Ticket #161 - Review and address latest Coverity issues
Ticket #22 - RFE: Support sendmail LDAP routing schema
Ticket #29 - Samba3-schema is missing sambaTrustedDomainPassword
Ticket #273 - ruv tombstone searches don't work after reindex entryrdn
Ticket #273 - ruv tombstone searches don't work after reindex entryrdn
fix a couple of minor coverity issues
Ticket #87 - Manpages fixes
Ticket #13 - slapd process exits when put the database on read only mode while updates are coming to the server
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #277 - cannot set repl referrals or state
Ticket #278 - Schema replication update failed: Invalid syntax
Ticket #277 - cannot set repl referrals or state
Ticket #279 - filter normalization does not use matching rules
Ticket #280 - extensible binary filters do not work
Ticket #281 - TLS not working with latest openldap
coverity 12488 Resource leak In attr_index_config(): Leak of memory or pointers to system resources
bump version to 1.2.10.rc2
fix compiler warning in acct policy plugin
bump version to 1.2.11.a1
Ticket #294 - 389 DS Segfaults during replica install in FreeIPA
coverity uninit var and resource leak
Revert "Ticket #111 - ability to control behavior of modifyTimestamp/modifiersName"
Revert "Ticket #167 - Mixing transaction and non-transaction plugins can cause deadlock"
Revert "Change referential integrity to be a betxnpostoperation plugin"
Revert "make memberof transaction aware and able to be a betxnpostoperation plugin"
Revert "pass the plugin config entry to the plugin init function"
coverity 12559 Uninitialized pointer read In ldbm_back_modify(): Reads an uninitialized pointer or its target
Ticket #281 - TLS not working with latest openldap
Trac Ticket #298 - crash when replicating orphaned tombstone entry
Ticket #301 - implement transaction support using thread local storage
init txn thread private data for all database modes
handle null smods
memleak in mep_parse_config_entry
memleak in normalize_mods2bvals
destroy the entry cache and dn cache in the dse post op delete callback
Ticket #289 - allow betxn plugin config changes
coverity 12563 Read from pointer after free
Ticket 317 - RHDS fractional replication with excluded password policy attributes leads to wrong error messages.
Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash
Ticket #320 - allow most plugins to be betxn plugins
Ticket #324 - Sync with group attribute containing () fails
Ticket #324 - redux: Sync with group attribute containing () fails
Ticket #316 and Ticket #70 - add post add/mod and AD add callback hooks
Ticket #261 - Add Solaris i386
Ticket #331 - transaction errors with db 4.3 and db 4.2
schema def must have DESC '' - close paren must be preceded by space
Ticket #336 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
Ticket #336 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
Ticket #347 - IPA dirsvr seg-fault during system longevity test
Ticket #348 - crash in ldap_initialize with multiple threads
Ticket #351 - use betxn plugins by default
Ticket #353 - coverity 12625-12629 - leaks, dead code, unchecked return
Ticket #348 - crash in ldap_initialize with multiple threads
Ticket #351 - use betxn plugins by default
bump version to 1.3.0.a1
Ticket #358 - managed entry doesn't delete linked entry
Trac Ticket #359 - Database RUV could mismatch the one in changelog under the stress
console .2 is still compatible with 389 .3 for now
Ticket #321 - krbExtraData is being null modified and replicated on each ssh login
Ticket #360 - ldapmodify returns Operations error
Ticket #382 - DS Shuts down intermittently
Ticket #383 - usn + mmr = deletions are not replicated
Ticket #389 - ADD operations not in audit log
Ticket #360 - ldapmodify returns Operations error - fix delete caching
fix coverity issues with uninit vals, no return checking
Ticket #360 - ldapmodify returns Operations error - fix delete caching
improve txn test index handling
Ticket #387 - managed entry sometimes doesn't delete the managed entry
Ticket #387 - managed entry sometimes doesn't delete the managed entry
Ticket 378 - unhashed#user#password visible after changing password
Ticket #405 - referint modrdn not working if case is different
Ticket #406 - Impossible to rename entry (modrdn) with Attribute Uniqueness plugin enabled
Ticket #410 - Referential integrity plug-in does not work when update interval is not zero
Ticket #425 - support multiple winsync plugins
Ticket #430 - server to server ssl client auth broken with latest openldap
Ticket #426 - support posix schema for user and group sync
coverity - mbo dead code - winsync leaks, deadcode, null check, test code
Ticket #355 - winsync should not delete entry that appears to be out of scope
Ticket #440 - periodic dirsync timed event causes server to loop repeatedly
fix mem leaks with parent dn log message, setting winsync windows domain
coverity - posix winsync mem leaks, null check, deadcode, null ref, use after free
fix coverity resource leak in windows_plugin_add
Ticket #426 - support posix schema for user and group sync
Ticket #374 - consumer can go into total update mode for no reason
Ticket #461 - fix build problem with mozldap c sdk
Ticket #462 - add test for include file mntent.h
Ticket #463 - different parameters of getmntent in Solaris
add eclipse generated files to the ignore list
fix compiler warnings in ticket 374 code
Ticket #491 - multimaster_extop_cleanruv returns wrong error codes
minor fixes for bdb 4.2/4.3 and mozldap
Ticket #322 - Create DOAP description for the 389 Directory Server project
Ticket #508 - part 1 - lock-free access to FrontendConfig structure
Ticket #508 - part 2 - lock-free access to FrontendConfig structure
Ticket #612 - improve dbgen rdn generation, output
Ticket #613 - ldclt: add timestamp, interval, nozeropad, other improvements
Ticket #47299 - allow cmdline scripts to work with non-root user
Ticket #47302 - get rid of sbindir start/stop/restart slapd scripts
Ticket #47303 - start/stop/restart dirsrv scripts should report and error if no instances
Ticket #47302 - get rid of sbindir start/stop/restart slapd scripts
Ticket #565 - turbo mode and replication - allow disable of turbo mode
Ticket #633 - allow nsslapd-nagle to be disabled, and also tcp cork
Ticket #613 - ldclt: add timestamp, interval, nozeropad, other improvements
Ticket #47312 - replace PR_GetFileInfo with PR_GetFileInfo64
Ticket #574 - problems with dbcachesize disk space calculation
Ticket #47312 - replace PR_GetFileInfo with PR_GetFileInfo64
Ticket #514 - investigate connection locking
Ticket #513 - recycle operation pblocks
Ticket #47319 - make connection buffer size adjustable
Ticket #47320 - put conn on work_q not poll list if conn has buffered more_data
Ticket #47299 - allow cmdline scripts to work with non-root user
Ticket #47336 - logconv.pl -m not working for all stats
Ticket #47341 - logconv.pl -m time calculation is wrong
Ticket #47348 - add etimes to per second/minute stats
Ticket #47349 - DS instance crashes under a high load
Ticket #47362 - ipa upgrade selinuxusermap data not replicating
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
Ticket #47378 - fix recent compiler warnings
Ticket #47387 - improve logconv.pl performance with large access logs
Ticket #47377 - make listen backlog size configurable
Ticket #47375 - flush_ber error sending back start_tls response will deadlock
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47387 - improve logconv.pl performance with large access logs
Ticket #47410 - changelog db deadlocks with DNA and replication
Ticket #47392 - ldbm errors when adding/modifying/deleting entries
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket #47424 - Replication problem with add-delete requests on single-valued attributes
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket #47448 - Segfault in 389-ds-base-1.3.1.4-1.fc19 when setting up FreeIPA replication
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
Ticket #47456 - delete present values should append values to deleted values
fix coverity 11895 - null deref - caused by fix to ticket 47392
fix coverity 11915 - dead code - introduced with fix for ticket 346
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
Bug 999634 - ns-slapd crash due to bogus DN
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
Ticket #47516 replication stops with excessive clock skew
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47501 logconv.pl uses /var/tmp for BDB temp files
Ticket 47533 logconv: some stats do not work across server restarts
Ticket #47551 logconv: -V does not produce unindexed search report
Ticket #47550 logconv: failed logins: Use of uninitialized value in numeric comparison at logconv.pl line 949
ticket #47550 wip
Ticket #47559 hung server - related to sasl and initialize
Ticket #47515 Fedora 20: setup-ds-admin.pl
Ticket #47585 Replication Failures related to skipped entries due to cleaned rids
Revert "Ticket #47559 hung server - related to sasl and initialize"
Ticket #47596 attrcrypt fails to find unlocked key
Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches
bump version to 1.3.2.5
Ticket 47599 - Reduce lock scope in retro changelog plug-in
bump version to 1.3.2.6
Ticket #47596 attrcrypt fails to find unlocked key
Ticket #47623 fix memleak caused by 47347
Ticket #47623 fix memleak caused by 47347
Ticket #47631 objectclass may, must lists skip rest of objectclass once first is found in sup
Ticket #47645 reset stack, op fields to NULL - clean up stacks at shutdown - free unused plugin config entries
Ticket #47634 support AttributeTypeDescription USAGE userApplications distributedOperation dSAOperation
Ticket #47647 remove bogus definition in 60rfc3712.ldif
Ticket #47516 replication stops with excessive clock skew
Ticket #47374 - flush.pl is not included in perl5
Ticket #471 logconv.pl tool removes the access logs contents if "-M" is not correctly used
Ticket #47692 single valued attribute replicated ADD does not work
Ticket #47773 - mem leak in do_bind when there is an error
Ticket #47774 mem leak in do_search - rawbase not freed upon certain errors
Ticket #47772 empty modify returns LDAP_INVALID_DN_SYNTAX
Ticket #47772 empty modify returns LDAP_INVALID_DN_SYNTAX
Ticket #47831 - server restart wipes out index config if there is a default index
Ticket #47692 single valued attribute replicated ADD does not work
Ticket 47446 - logconv.pl memory continually grows
Thierry bordaz (tbordaz) (37):
Ticket #487 - Possible to add invalid attribute values to PAM PTA plugin configuration
Ticket 600 - Server should return unavailableCriticalExtension when processing a badly formed critical control
Ticket 616 - High contention on computed attribute lock
Ticket 618 - Crash at shutdown while stopping replica agreements
Ticket 512 - improve performance of vattr code
Ticket 205 - snmp counters index strings for multiple network interfaces with ip addr and tcp port pairs
Ticket 47325 - Crash at shutdown on a replica aggrement
Ticket 47331 - Self entry access ACI not working properly
Ticket 47361 - Empty control list causes LDAP protocol error is thrown
Ticket 47354 - Indexed search are logged with 'notes=U' in the access logs
Ticket 47350 - Allow search to look up 'in memory RUV'
Compilation warnings (ticket 47350)
Ticket 47350 - (Cont.) Allow search to look up 'in memory RUV'
Ticket 564 - Is ldbm_txn_ruv_modify_context still required
Ticket 47393 - Attribute are not encrypted on a consumer after a full initialization
Ticket 208 - [RFE] Roles with explicit scoping in RHDS
Ticket 47433 - With SeLinux, setup-ds.pl and setup-ds-admin.pl fail to detect already ranged labelled ports
Ticket 512 - improve performance of vattr code
Ticket 47489 - Under specific values of nsDS5ReplicaName, replication may get broken or updates missing
Ticket 47490 - Schema replication between DS versions may overwrite newer base schema
Ticket 47560: fixup memberof task does not work: task entry not added
Ticket 47653 - Need a way to allow users to create entries assigned to themselves.
Ticket 47699: Propagate plugin precedence to all registered function types
Ticket 47787 - A replicated MOD fails (Unwilling to perform) if it targets a tombstone
Ticket 47541 - Replication of the schema may overwrite
Ticket 47541 - Fix Jenkins errors
Ticket 47676 : Replication of the schema fails 'master branch' -> 1.2.11 or 1.3.1
Ticket 47676 : (cont.) Replication of the schema fails 'master branch' -> 1.2.11 or 1.3.1
Ticket 47721 - Schema Replication Issue
Ticket 47721 - Schema Replication Issue (follow up + cleanup)
Ticket 47721 - Schema Replication Issue (follow up)
Ticket 47797 - DB deadlock when two threads (on separated backend) try to record changes in retroCL
Ticket 47797 - fix the indentation
Ticket 47871 - 389-ds-base-1.3.2.21-1.fc20 crashed over the weekend
Ticket 47889 - DS crashed during ipa-server-install on test_ava_filter
Ticket 47920: Encoding of SearchResultEntry is missing tag
Ticket 47942: DS hangs during online total update
nturpin (1):
Ticket #3: acl cache overflown problem
root (4):
Bug 480787 - Autoconf parameter --with and --without
Ticket #326 - MemberOf plugin should work on all backends
Ticket #337 - RFE - Improve CLEANRUV functionality
Ticket #216 - RFE - Disable replication agreements
---
.gitignore | 5
389-doap.rdf | 47
Makefile.am | 413
Makefile.in | 6792 +-
README | 11
VERSION.sh | 18
aclocal.m4 | 7265 --
compile | 240
config.guess | 529
config.h.in | 37
config.sub | 379
configure |39988 +++++-------
configure.ac | 226
depcomp | 343
dirsrv.pc.in | 7
dirsrvtests/tickets/ticket47490_test.py | 674
dirsrvtests/tickets/ticket47553_single_aci_test.py | 1187
dirsrvtests/tickets/ticket47619_test.py | 298
dirsrvtests/tickets/ticket47653MMR_test.py | 552
dirsrvtests/tickets/ticket47653_test.py | 432
dirsrvtests/tickets/ticket47676_test.py | 485
dirsrvtests/tickets/ticket47721_test.py | 492
dirsrvtests/tickets/ticket47787_test.py | 630
dirsrvtests/tickets/ticket47815_test.py | 227
dirsrvtests/tickets/ticket47871_test.py | 306
dirsrvtests/tickets/ticket47900_test.py | 398
dirsrvtests/tickets/ticket47920_test.py | 251
dirsrvtests/tickets/ticket47937_test.py | 237
dirsrvtests/tickets/ticket47950_test.py | 273
dirsrvtests/tickets/ticket47970_test.py | 206
dirsrvtests/tickets/ticket47973_test.py | 235
dirsrvtests/tickets/ticket47980_test.py | 710
dirsrvtests/tickets/ticket47981_test.py | 345
include/base/dbtbase.h | 2
include/base/file.h | 5
include/base/lexer.h | 126
include/base/rwlock.h | 91
include/i18n.h | 121
include/ldaputil/ldaputil.h | 10
include/libaccess/acl.h | 4
include/libaccess/aclerror.h | 13
include/libaccess/acleval.h | 3
include/libaccess/aclproto.h | 21
include/libaccess/aclstruct.h | 2
include/libaccess/dbtlibaccess.h | 3
include/libaccess/las.h | 2
include/libaccess/nsautherr.h | 2
include/libaccess/nserror.h | 2
include/libaccess/symbols.h | 4
include/public/nsacl/aclapi.h | 18
include/public/nsacl/acldef.h | 2
include/public/nsacl/nserrdef.h | 2
install-sh | 538
ldap/admin/src/base-initconfig.in | 44
ldap/admin/src/initconfig.in | 37
ldap/admin/src/logconv.pl | 3345 -
ldap/admin/src/scripts/10cleanupldapi.pl | 23
ldap/admin/src/scripts/10fixrundir.pl | 11
ldap/admin/src/scripts/20betxn.pl | 74
ldap/admin/src/scripts/50acctusabilityplugin.ldif | 21
ldap/admin/src/scripts/50automemberplugin.ldif | 15
ldap/admin/src/scripts/50contentsync.ldif | 23
ldap/admin/src/scripts/50fixNsState.pl | 240
ldap/admin/src/scripts/50managedentriesplugin.ldif | 16
ldap/admin/src/scripts/50refintprecedence.ldif | 4
ldap/admin/src/scripts/50rootdnaccesscontrolplugin.ldif | 15
ldap/admin/src/scripts/50smd5pwdstorageplugin.ldif | 5
ldap/admin/src/scripts/50targetuniqueid.ldif | 7
ldap/admin/src/scripts/60upgradeconfigfiles.pl | 69
ldap/admin/src/scripts/60upgradeschemafiles.pl | 2
ldap/admin/src/scripts/70upgradefromldif.pl | 108
ldap/admin/src/scripts/80upgradednformat.pl.in | 307
ldap/admin/src/scripts/81changelog.pl | 34
ldap/admin/src/scripts/82targetuniqueidindex.pl | 52
ldap/admin/src/scripts/90subtreerename.pl | 21
ldap/admin/src/scripts/91subtreereindex.pl | 148
ldap/admin/src/scripts/DSCreate.pm.in | 470
ldap/admin/src/scripts/DSDialogs.pm | 12
ldap/admin/src/scripts/DSMigration.pm.in | 49
ldap/admin/src/scripts/DSSharedLib.in | 227
ldap/admin/src/scripts/DSUpdate.pm.in | 50
ldap/admin/src/scripts/DSUtil.pm.in | 884
ldap/admin/src/scripts/DialogManager.pm | 241
ldap/admin/src/scripts/DialogManager.pm.in | 241
ldap/admin/src/scripts/Inf.pm | 67
ldap/admin/src/scripts/Migration.pm.in | 20
ldap/admin/src/scripts/Setup.pm.in | 20
ldap/admin/src/scripts/SetupDialogs.pm.in | 31
ldap/admin/src/scripts/SetupLog.pm | 8
ldap/admin/src/scripts/bak2db.in | 76
ldap/admin/src/scripts/bak2db.pl.in | 146
ldap/admin/src/scripts/cleanallruv.pl.in | 154
ldap/admin/src/scripts/db2bak.in | 76
ldap/admin/src/scripts/db2bak.pl.in | 139
ldap/admin/src/scripts/db2index.in | 83
ldap/admin/src/scripts/db2index.pl.in | 213
ldap/admin/src/scripts/db2ldif.in | 160
ldap/admin/src/scripts/db2ldif.pl.in | 293
ldap/admin/src/scripts/dbverify.in | 68
ldap/admin/src/scripts/dn2rdn.in | 58
ldap/admin/src/scripts/dnaplugindepends.ldif | 3
ldap/admin/src/scripts/ds-logpipe.py | 223
ldap/admin/src/scripts/exampleupdate.ldif | 2
ldap/admin/src/scripts/exampleupdate.sh | 10
ldap/admin/src/scripts/fixup-linkedattrs.pl.in | 140
ldap/admin/src/scripts/fixup-memberof.pl.in | 149
ldap/admin/src/scripts/ldif2db.in | 109
ldap/admin/src/scripts/ldif2db.pl.in | 243
ldap/admin/src/scripts/ldif2ldap.in | 173
ldap/admin/src/scripts/logregex.py | 16
ldap/admin/src/scripts/migrate-ds.pl.in | 13
ldap/admin/src/scripts/monitor.in | 170
ldap/admin/src/scripts/ns-accountstatus.pl.in | 708
ldap/admin/src/scripts/ns-activate.pl.in | 710
ldap/admin/src/scripts/ns-inactivate.pl.in | 712
ldap/admin/src/scripts/ns-newpwpolicy.pl.in | 217
ldap/admin/src/scripts/remove-ds.pl.in | 38
ldap/admin/src/scripts/repl-monitor.pl.in | 642
ldap/admin/src/scripts/restart-dirsrv.in | 28
ldap/admin/src/scripts/restoreconfig.in | 52
ldap/admin/src/scripts/saveconfig.in | 53
ldap/admin/src/scripts/schema-reload.pl.in | 139
ldap/admin/src/scripts/setup-ds.pl.in | 17
ldap/admin/src/scripts/setup-ds.res.in | 41
ldap/admin/src/scripts/start-dirsrv.in | 63
ldap/admin/src/scripts/stop-dirsrv.in | 65
ldap/admin/src/scripts/suffix2instance.in | 58
ldap/admin/src/scripts/syntax-validate.pl.in | 151
ldap/admin/src/scripts/template-bak2db.in | 44
ldap/admin/src/scripts/template-bak2db.pl.in | 102
ldap/admin/src/scripts/template-cleanallruv.pl.in | 54
ldap/admin/src/scripts/template-db2bak.in | 23
ldap/admin/src/scripts/template-db2bak.pl.in | 93
ldap/admin/src/scripts/template-db2index.in | 26
ldap/admin/src/scripts/template-db2index.pl.in | 192
ldap/admin/src/scripts/template-db2ldif.in | 79
ldap/admin/src/scripts/template-db2ldif.pl.in | 238
ldap/admin/src/scripts/template-dbverify.in | 41
ldap/admin/src/scripts/template-dn2rdn.in | 23
ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in | 120
ldap/admin/src/scripts/template-fixup-memberof.pl.in | 131
ldap/admin/src/scripts/template-ldif2db.in | 23
ldap/admin/src/scripts/template-ldif2db.pl.in | 194
ldap/admin/src/scripts/template-ldif2ldap.in | 15
ldap/admin/src/scripts/template-monitor.in | 14
ldap/admin/src/scripts/template-ns-accountstatus.pl.in | 810
ldap/admin/src/scripts/template-ns-activate.pl.in | 810
ldap/admin/src/scripts/template-ns-inactivate.pl.in | 810
ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in | 253
ldap/admin/src/scripts/template-restart-slapd.in | 12
ldap/admin/src/scripts/template-restoreconfig.in | 16
ldap/admin/src/scripts/template-saveconfig.in | 17
ldap/admin/src/scripts/template-schema-reload.pl.in | 120
ldap/admin/src/scripts/template-start-slapd.in | 12
ldap/admin/src/scripts/template-stop-slapd.in | 11
ldap/admin/src/scripts/template-suffix2instance.in | 15
ldap/admin/src/scripts/template-syntax-validate.pl.in | 131
ldap/admin/src/scripts/template-upgradedb.in | 17
ldap/admin/src/scripts/template-upgradednformat.in | 5
ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in | 149
ldap/admin/src/scripts/template-verify-db.pl.in | 223
ldap/admin/src/scripts/template-vlvindex.in | 16
ldap/admin/src/scripts/upgradedb.in | 59
ldap/admin/src/scripts/upgradednformat.in | 71
ldap/admin/src/scripts/usn-tombstone-cleanup.pl.in | 155
ldap/admin/src/scripts/verify-db.pl.in | 267
ldap/admin/src/scripts/vlvindex.in | 64
ldap/admin/src/slapd.inf.in | 2
ldap/admin/src/template-initconfig.in | 18
ldap/docs/LICENSE.txt | 132
ldap/docs/README.txt | 11
ldap/include/ldaplog.h | 32
ldap/ldif/50posix-winsync-plugin.ldif | 21
ldap/ldif/50replication-plugins.ldif | 27
ldap/ldif/template-baseacis.ldif.in | 2
ldap/ldif/template-bitwise.ldif.in | 6
ldap/ldif/template-dnaplugin.ldif.in | 2
ldap/ldif/template-dse.ldif.in | 171
ldap/ldif/template-pampta.ldif.in | 2
ldap/ldif/template-suffix-db.ldif.in | 1
ldap/libraries/libavl/avl.c | 7
ldap/schema/00core.ldif | 72
ldap/schema/01core389.ldif | 88
ldap/schema/02common.ldif | 25
ldap/schema/05rfc4523.ldif | 14
ldap/schema/05rfc4524.ldif | 30
ldap/schema/06inetorgperson.ldif | 5
ldap/schema/10automember-plugin.ldif | 123
ldap/schema/10dna-plugin.ldif | 240
ldap/schema/10mep-plugin.ldif | 104
ldap/schema/30ns-common.ldif | 4
ldap/schema/50ns-directory.ldif | 4
ldap/schema/50ns-mail.ldif | 10
ldap/schema/60acctpolicy.ldif | 47
ldap/schema/60nis.ldif | 2
ldap/schema/60pam-plugin.ldif | 3
ldap/schema/60posix-winsync-plugin.ldif | 44
ldap/schema/60qmail.ldif | 24
ldap/schema/60radius.ldif | 132
ldap/schema/60rfc3712.ldif | 9
ldap/schema/60sabayon.ldif | 10
ldap/schema/60samba3.ldif | 36
ldap/schema/60sendmail.ldif | 54
ldap/schema/60sudo.ldif | 58
ldap/schema/slapd-collations.conf | 234
ldap/servers/plugins/acct_usability/acct_usability.c | 464
ldap/servers/plugins/acct_usability/acct_usability.h | 63
ldap/servers/plugins/acctpolicy/acct_config.c | 154
ldap/servers/plugins/acctpolicy/acct_init.c | 191
ldap/servers/plugins/acctpolicy/acct_plugin.c | 321
ldap/servers/plugins/acctpolicy/acct_util.c | 274
ldap/servers/plugins/acctpolicy/acctpolicy.h | 82
ldap/servers/plugins/acctpolicy/sampleconfig.ldif | 40
ldap/servers/plugins/acctpolicy/samplepolicy.ldif | 27
ldap/servers/plugins/acl/acl.c | 664
ldap/servers/plugins/acl/acl.h | 66
ldap/servers/plugins/acl/acl_ext.c | 227
ldap/servers/plugins/acl/aclanom.c | 26
ldap/servers/plugins/acl/acleffectiverights.c | 154
ldap/servers/plugins/acl/aclgroup.c | 21
ldap/servers/plugins/acl/aclinit.c | 4
ldap/servers/plugins/acl/acllas.c | 590
ldap/servers/plugins/acl/acllist.c | 137
ldap/servers/plugins/acl/aclparse.c | 841
ldap/servers/plugins/acl/aclplugin.c | 45
ldap/servers/plugins/acl/aclproxy.c | 232
ldap/servers/plugins/acl/aclutil.c | 136
ldap/servers/plugins/automember/automember.c | 2800
ldap/servers/plugins/automember/automember.h | 134
ldap/servers/plugins/bitwise/bitwise.c | 23
ldap/servers/plugins/chainingdb/cb.h | 8
ldap/servers/plugins/chainingdb/cb_add.c | 245
ldap/servers/plugins/chainingdb/cb_bind.c | 224
ldap/servers/plugins/chainingdb/cb_close.c | 67
ldap/servers/plugins/chainingdb/cb_compare.c | 101
ldap/servers/plugins/chainingdb/cb_config.c | 221
ldap/servers/plugins/chainingdb/cb_conn_stateless.c | 103
ldap/servers/plugins/chainingdb/cb_controls.c | 52
ldap/servers/plugins/chainingdb/cb_delete.c | 258
ldap/servers/plugins/chainingdb/cb_init.c | 6
ldap/servers/plugins/chainingdb/cb_instance.c | 586
ldap/servers/plugins/chainingdb/cb_modify.c | 301
ldap/servers/plugins/chainingdb/cb_modrdn.c | 305
ldap/servers/plugins/chainingdb/cb_monitor.c | 6
ldap/servers/plugins/chainingdb/cb_schema.c | 4
ldap/servers/plugins/chainingdb/cb_search.c | 548
ldap/servers/plugins/chainingdb/cb_utils.c | 30
ldap/servers/plugins/collation/collate.c | 49
ldap/servers/plugins/collation/orfilter.c | 19
ldap/servers/plugins/cos/cos.c | 82
ldap/servers/plugins/cos/cos_cache.c | 929
ldap/servers/plugins/cos/cos_cache.h | 1
ldap/servers/plugins/deref/deref.c | 155
ldap/servers/plugins/dna/dna.c | 2505
ldap/servers/plugins/http/http_impl.c | 85
ldap/servers/plugins/linkedattrs/fixup_task.c | 198
ldap/servers/plugins/linkedattrs/linked_attrs.c | 286
ldap/servers/plugins/linkedattrs/linked_attrs.h | 9
ldap/servers/plugins/memberof/memberof.c | 1215
ldap/servers/plugins/memberof/memberof.h | 18
ldap/servers/plugins/memberof/memberof_config.c | 335
ldap/servers/plugins/mep/mep.c | 2866
ldap/servers/plugins/mep/mep.h | 130
ldap/servers/plugins/pam_passthru/pam_passthru.h | 49
ldap/servers/plugins/pam_passthru/pam_ptconfig.c | 726
ldap/servers/plugins/pam_passthru/pam_ptimpl.c | 81
ldap/servers/plugins/pam_passthru/pam_ptpreop.c | 683
ldap/servers/plugins/passthru/passthru.h | 4
ldap/servers/plugins/passthru/ptbind.c | 6
ldap/servers/plugins/passthru/ptconfig.c | 43
ldap/servers/plugins/passthru/ptconn.c | 8
ldap/servers/plugins/passthru/ptpreop.c | 17
ldap/servers/plugins/posix-winsync/README | 50
ldap/servers/plugins/posix-winsync/posix-group-func.c | 1020
ldap/servers/plugins/posix-winsync/posix-group-func.h | 24
ldap/servers/plugins/posix-winsync/posix-group-task.c | 494
ldap/servers/plugins/posix-winsync/posix-winsync-config.c | 303
ldap/servers/plugins/posix-winsync/posix-winsync.c | 1988
ldap/servers/plugins/posix-winsync/posix-wsp-ident.h | 53
ldap/servers/plugins/pwdstorage/smd5_pwd.c | 9
ldap/servers/plugins/referint/referint.c | 1630
ldap/servers/plugins/replication/cl4_api.c | 2
ldap/servers/plugins/replication/cl5.h | 5
ldap/servers/plugins/replication/cl5_api.c | 2960
ldap/servers/plugins/replication/cl5_api.h | 181
ldap/servers/plugins/replication/cl5_clcache.c | 177
ldap/servers/plugins/replication/cl5_clcache.h | 2
ldap/servers/plugins/replication/cl5_config.c | 373
ldap/servers/plugins/replication/cl5_init.c | 4
ldap/servers/plugins/replication/cl5_test.c | 4
ldap/servers/plugins/replication/cl_crypt.c | 203
ldap/servers/plugins/replication/cl_crypt.h | 53
ldap/servers/plugins/replication/csnpl.c | 74
ldap/servers/plugins/replication/legacy_consumer.c | 43
ldap/servers/plugins/replication/llist.c | 8
ldap/servers/plugins/replication/repl-session-plugin.h | 115
ldap/servers/plugins/replication/repl.h | 16
ldap/servers/plugins/replication/repl5.h | 196
ldap/servers/plugins/replication/repl5_agmt.c | 808
ldap/servers/plugins/replication/repl5_agmtlist.c | 241
ldap/servers/plugins/replication/repl5_connection.c | 584
ldap/servers/plugins/replication/repl5_inc_protocol.c | 1541
ldap/servers/plugins/replication/repl5_init.c | 462
ldap/servers/plugins/replication/repl5_mtnode_ext.c | 19
ldap/servers/plugins/replication/repl5_plugins.c | 398
ldap/servers/plugins/replication/repl5_prot_private.h | 10
ldap/servers/plugins/replication/repl5_protocol.c | 189
ldap/servers/plugins/replication/repl5_protocol_util.c | 574
ldap/servers/plugins/replication/repl5_replica.c | 1586
ldap/servers/plugins/replication/repl5_replica_config.c | 2947
ldap/servers/plugins/replication/repl5_replica_dnhash.c | 26
ldap/servers/plugins/replication/repl5_replica_hash.c | 30
ldap/servers/plugins/replication/repl5_ruv.c | 775
ldap/servers/plugins/replication/repl5_ruv.h | 32
ldap/servers/plugins/replication/repl5_schedule.c | 4
ldap/servers/plugins/replication/repl5_tot_protocol.c | 116
ldap/servers/plugins/replication/repl5_total.c | 30
ldap/servers/plugins/replication/repl5_updatedn_list.c | 2
ldap/servers/plugins/replication/repl_bind.c | 7
ldap/servers/plugins/replication/repl_compare.c | 18
ldap/servers/plugins/replication/repl_connext.c | 160
ldap/servers/plugins/replication/repl_controls.c | 2
ldap/servers/plugins/replication/repl_extop.c | 948
ldap/servers/plugins/replication/repl_globals.c | 19
ldap/servers/plugins/replication/repl_init.c | 1
ldap/servers/plugins/replication/repl_objset.c | 9
ldap/servers/plugins/replication/repl_session_plugin.c | 188
ldap/servers/plugins/replication/repl_shared.h | 20
ldap/servers/plugins/replication/replutil.c | 167
ldap/servers/plugins/replication/test_repl_session_plugin.c | 335
ldap/servers/plugins/replication/urp.c | 418
ldap/servers/plugins/replication/urp.h | 8
ldap/servers/plugins/replication/urp_glue.c | 51
ldap/servers/plugins/replication/urp_tombstone.c | 114
ldap/servers/plugins/replication/windows_connection.c | 394
ldap/servers/plugins/replication/windows_inc_protocol.c | 238
ldap/servers/plugins/replication/windows_private.c | 2890
ldap/servers/plugins/replication/windows_protocol_util.c | 2577
ldap/servers/plugins/replication/windows_tot_protocol.c | 221
ldap/servers/plugins/replication/windowsrepl.h | 83
ldap/servers/plugins/replication/winsync-plugin.h | 499
ldap/servers/plugins/retrocl/retrocl.c | 73
ldap/servers/plugins/retrocl/retrocl.h | 6
ldap/servers/plugins/retrocl/retrocl_cn.c | 42
ldap/servers/plugins/retrocl/retrocl_create.c | 13
ldap/servers/plugins/retrocl/retrocl_po.c | 76
ldap/servers/plugins/retrocl/retrocl_trim.c | 183
ldap/servers/plugins/rever/des.c | 72
ldap/servers/plugins/rever/rever.c | 8
ldap/servers/plugins/roles/roles_cache.c | 193
ldap/servers/plugins/roles/roles_cache.h | 2
ldap/servers/plugins/roles/roles_plugin.c | 54
ldap/servers/plugins/rootdn_access/rootdn_access.c | 703
ldap/servers/plugins/rootdn_access/rootdn_access.h | 55
ldap/servers/plugins/schema_reload/schema_reload.c | 56
ldap/servers/plugins/shared/plugin-utils.h | 112
ldap/servers/plugins/shared/utils.c | 508
ldap/servers/plugins/statechange/statechange.c | 77
ldap/servers/plugins/sync/sync.h | 197
ldap/servers/plugins/sync/sync_init.c | 174
ldap/servers/plugins/sync/sync_persist.c | 694
ldap/servers/plugins/sync/sync_refresh.c | 744
ldap/servers/plugins/sync/sync_util.c | 702
ldap/servers/plugins/syntaxes/bin.c | 142
ldap/servers/plugins/syntaxes/bitstring.c | 68
ldap/servers/plugins/syntaxes/ces.c | 172
ldap/servers/plugins/syntaxes/cis.c | 321
ldap/servers/plugins/syntaxes/deliverymethod.c | 32
ldap/servers/plugins/syntaxes/dn.c | 72
ldap/servers/plugins/syntaxes/facsimile.c | 32
ldap/servers/plugins/syntaxes/guide.c | 32
ldap/servers/plugins/syntaxes/int.c | 96
ldap/servers/plugins/syntaxes/nameoptuid.c | 73
ldap/servers/plugins/syntaxes/numericstring.c | 148
ldap/servers/plugins/syntaxes/sicis.c | 32
ldap/servers/plugins/syntaxes/string.c | 455
ldap/servers/plugins/syntaxes/syntax.h | 61
ldap/servers/plugins/syntaxes/syntax_common.c | 118
ldap/servers/plugins/syntaxes/tel.c | 94
ldap/servers/plugins/syntaxes/teletex.c | 32
ldap/servers/plugins/syntaxes/telex.c | 31
ldap/servers/plugins/syntaxes/validate.c | 17
ldap/servers/plugins/syntaxes/validate_task.c | 6
ldap/servers/plugins/syntaxes/value.c | 134
ldap/servers/plugins/uiduniq/7bit.c | 162
ldap/servers/plugins/uiduniq/plugin-utils.h | 96
ldap/servers/plugins/uiduniq/uid.c | 370
ldap/servers/plugins/uiduniq/utils.c | 249
ldap/servers/plugins/usn/usn.c | 415
ldap/servers/plugins/usn/usn.h | 3
ldap/servers/plugins/usn/usn_cleanup.c | 44
ldap/servers/plugins/views/views.c | 71
ldap/servers/plugins/whoami/whoami.c | 145
ldap/servers/slapd/abandon.c | 13
ldap/servers/slapd/add.c | 433
ldap/servers/slapd/agtmmap.c | 117
ldap/servers/slapd/agtmmap.h | 2
ldap/servers/slapd/apibroker.c | 58
ldap/servers/slapd/attr.c | 412
ldap/servers/slapd/attrlist.c | 50
ldap/servers/slapd/attrsyntax.c | 1030
ldap/servers/slapd/auditlog.c | 87
ldap/servers/slapd/auth.c | 192
ldap/servers/slapd/ava.c | 2
ldap/servers/slapd/back-ldbm/ancestorid.c | 132
ldap/servers/slapd/back-ldbm/archive.c | 141
ldap/servers/slapd/back-ldbm/back-ldbm.h | 155
ldap/servers/slapd/back-ldbm/backentry.c | 7
ldap/servers/slapd/back-ldbm/cache.c | 513
ldap/servers/slapd/back-ldbm/dbhelp.c | 77
ldap/servers/slapd/back-ldbm/dblayer.c | 3167
ldap/servers/slapd/back-ldbm/dblayer.h | 20
ldap/servers/slapd/back-ldbm/dbsize.c | 7
ldap/servers/slapd/back-ldbm/dbtest.c | 349
ldap/servers/slapd/back-ldbm/dbverify.c | 6
ldap/servers/slapd/back-ldbm/dbversion.c | 82
ldap/servers/slapd/back-ldbm/dn2entry.c | 63
ldap/servers/slapd/back-ldbm/filterindex.c | 343
ldap/servers/slapd/back-ldbm/findentry.c | 147
ldap/servers/slapd/back-ldbm/id2entry.c | 199
ldap/servers/slapd/back-ldbm/idl.c | 172
ldap/servers/slapd/back-ldbm/idl_common.c | 42
ldap/servers/slapd/back-ldbm/idl_new.c | 554
ldap/servers/slapd/back-ldbm/idl_shim.c | 17
ldap/servers/slapd/back-ldbm/import-merge.c | 40
ldap/servers/slapd/back-ldbm/import-threads.c | 1826
ldap/servers/slapd/back-ldbm/import.c | 465
ldap/servers/slapd/back-ldbm/import.h | 49
ldap/servers/slapd/back-ldbm/index.c | 788
ldap/servers/slapd/back-ldbm/init.c | 89
ldap/servers/slapd/back-ldbm/instance.c | 178
ldap/servers/slapd/back-ldbm/ldbm_add.c | 1547
ldap/servers/slapd/back-ldbm/ldbm_attr.c | 892
ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c | 1027
ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c | 4
ldap/servers/slapd/back-ldbm/ldbm_bind.c | 42
ldap/servers/slapd/back-ldbm/ldbm_compare.c | 27
ldap/servers/slapd/back-ldbm/ldbm_config.c | 505
ldap/servers/slapd/back-ldbm/ldbm_config.h | 19
ldap/servers/slapd/back-ldbm/ldbm_delete.c | 1326
ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c | 1853
ldap/servers/slapd/back-ldbm/ldbm_index_config.c | 699
ldap/servers/slapd/back-ldbm/ldbm_instance_config.c | 275
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 827
ldap/servers/slapd/back-ldbm/ldbm_modrdn.c | 1787
ldap/servers/slapd/back-ldbm/ldbm_search.c | 874
ldap/servers/slapd/back-ldbm/ldbm_usn.c | 83
ldap/servers/slapd/back-ldbm/ldif2ldbm.c | 920
ldap/servers/slapd/back-ldbm/matchrule.c | 50
ldap/servers/slapd/back-ldbm/misc.c | 322
ldap/servers/slapd/back-ldbm/monitor.c | 76
ldap/servers/slapd/back-ldbm/nextid.c | 17
ldap/servers/slapd/back-ldbm/parents.c | 148
ldap/servers/slapd/back-ldbm/perfctrs.c | 26
ldap/servers/slapd/back-ldbm/proto-back-ldbm.h | 111
ldap/servers/slapd/back-ldbm/seq.c | 69
ldap/servers/slapd/back-ldbm/sort.c | 196
ldap/servers/slapd/back-ldbm/start.c | 109
ldap/servers/slapd/back-ldbm/upgrade.c | 72
ldap/servers/slapd/back-ldbm/vlv.c | 398
ldap/servers/slapd/back-ldbm/vlv_srch.c | 17
ldap/servers/slapd/back-ldbm/vlv_srch.h | 3
ldap/servers/slapd/back-ldif/back-ldif.h | 2
ldap/servers/slapd/back-ldif/modify.c | 2
ldap/servers/slapd/back-ldif/modrdn.c | 12
ldap/servers/slapd/backend.c | 223
ldap/servers/slapd/backend_manager.c | 59
ldap/servers/slapd/bind.c | 457
ldap/servers/slapd/bulk_import.c | 39
ldap/servers/slapd/charray.c | 41
ldap/servers/slapd/compare.c | 43
ldap/servers/slapd/computed.c | 184
ldap/servers/slapd/config.c | 65
ldap/servers/slapd/configdse.c | 108
ldap/servers/slapd/connection.c | 1195
ldap/servers/slapd/conntable.c | 54
ldap/servers/slapd/control.c | 64
ldap/servers/slapd/csn.c | 89
ldap/servers/slapd/csngen.c | 75
ldap/servers/slapd/csnset.c | 4
ldap/servers/slapd/daemon.c | 956
ldap/servers/slapd/delete.c | 132
ldap/servers/slapd/dn.c | 2243
ldap/servers/slapd/dse.c | 905
ldap/servers/slapd/dynalib.c | 36
ldap/servers/slapd/entry.c | 2124
ldap/servers/slapd/entrywsi.c | 797
ldap/servers/slapd/errormap.c | 18
ldap/servers/slapd/eventq.c | 4
ldap/servers/slapd/extendop.c | 39
ldap/servers/slapd/factory.c | 1
ldap/servers/slapd/fe.h | 33
ldap/servers/slapd/fedse.c | 191
ldap/servers/slapd/filter.c | 231
ldap/servers/slapd/filter.h | 1
ldap/servers/slapd/filtercmp.c | 26
ldap/servers/slapd/filterentry.c | 50
ldap/servers/slapd/generation.c | 1
ldap/servers/slapd/getfilelist.c | 4
ldap/servers/slapd/globals.c | 7
ldap/servers/slapd/index_subsystem.c | 28
ldap/servers/slapd/intrinsics.h | 7
ldap/servers/slapd/ldaputil.c | 1323
ldap/servers/slapd/lenstr.c | 6
ldap/servers/slapd/libglobs.c | 3290
ldap/servers/slapd/libslapd.def | 10
ldap/servers/slapd/log.c | 381
ldap/servers/slapd/log.h | 20
ldap/servers/slapd/main.c | 414
ldap/servers/slapd/mapping_tree.c | 635
ldap/servers/slapd/match.c | 96
ldap/servers/slapd/modify.c | 845
ldap/servers/slapd/modrdn.c | 377
ldap/servers/slapd/modutil.c | 77
ldap/servers/slapd/monitor.c | 8
ldap/servers/slapd/mozldap.h | 45
ldap/servers/slapd/ntperfdll/nsldapctr.cpp | 32
ldap/servers/slapd/ntperfdll/nsldapctrdef.h | 2
ldap/servers/slapd/ntperfdll/nsldapctrs.h | 10
ldap/servers/slapd/openldapber.h | 25
ldap/servers/slapd/operation.c | 175
ldap/servers/slapd/opshared.c | 532
ldap/servers/slapd/pagedresults.c | 787
ldap/servers/slapd/passwd_extop.c | 208
ldap/servers/slapd/pblock.c | 710
ldap/servers/slapd/plugin.c | 538
ldap/servers/slapd/plugin_acl.c | 52
ldap/servers/slapd/plugin_internal_op.c | 204
ldap/servers/slapd/plugin_mr.c | 474
ldap/servers/slapd/plugin_syntax.c | 482
ldap/servers/slapd/protect_db.c | 24
ldap/servers/slapd/protect_db.h | 7
ldap/servers/slapd/proto-slap.h | 250
ldap/servers/slapd/proxyauth.c | 253
ldap/servers/slapd/psearch.c | 119
ldap/servers/slapd/pw.c | 1219
ldap/servers/slapd/pw.h | 30
ldap/servers/slapd/pw_mgmt.c | 177
ldap/servers/slapd/pw_retry.c | 124
ldap/servers/slapd/rdn.c | 283
ldap/servers/slapd/referral.c | 29
ldap/servers/slapd/regex.c | 35
ldap/servers/slapd/resourcelimit.c | 84
ldap/servers/slapd/result.c | 979
ldap/servers/slapd/rootdse.c | 12
ldap/servers/slapd/rwlock.c | 257
ldap/servers/slapd/rwlock.h | 65
ldap/servers/slapd/sasl_io.c | 352
ldap/servers/slapd/sasl_map.c | 277
ldap/servers/slapd/saslbind.c | 284
ldap/servers/slapd/schema.c | 4692 +
ldap/servers/slapd/schemaparse.c | 17
ldap/servers/slapd/search.c | 227
ldap/servers/slapd/security_wrappers.c | 36
ldap/servers/slapd/slap.h | 661
ldap/servers/slapd/slapi-plugin-compat4.h | 6
ldap/servers/slapd/slapi-plugin.h | 2105
ldap/servers/slapd/slapi-private.h | 225
ldap/servers/slapd/slapi2nspr.c | 79
ldap/servers/slapd/slapi_counter.c | 24
ldap/servers/slapd/snmp_collator.c | 31
ldap/servers/slapd/sort.c | 11
ldap/servers/slapd/ssl.c | 574
ldap/servers/slapd/start_tls_extop.c | 230
ldap/servers/slapd/str2filter.c | 7
ldap/servers/slapd/task.c | 192
ldap/servers/slapd/test-plugins/testbind.c | 1
ldap/servers/slapd/test-plugins/testdbinterop.c | 6
ldap/servers/slapd/test-plugins/testpostop.c | 3
ldap/servers/slapd/thread_data.c | 174
ldap/servers/slapd/time.c | 91
ldap/servers/slapd/tools/dbscan.c | 91
ldap/servers/slapd/tools/ldclt/data.c | 83
ldap/servers/slapd/tools/ldclt/ldapfct.c | 1229
ldap/servers/slapd/tools/ldclt/ldclt.c | 104
ldap/servers/slapd/tools/ldclt/ldclt.h | 18
ldap/servers/slapd/tools/ldclt/ldcltU.c | 24
ldap/servers/slapd/tools/ldclt/parser.c | 19
ldap/servers/slapd/tools/ldclt/scalab01.c | 190
ldap/servers/slapd/tools/ldclt/threadMain.c | 24
ldap/servers/slapd/tools/ldclt/utils.c | 16
ldap/servers/slapd/tools/ldclt/utils.h | 1
ldap/servers/slapd/tools/ldif.c | 4
ldap/servers/slapd/tools/migratecred.c | 2
ldap/servers/slapd/tools/mmldif.c | 31
ldap/servers/slapd/tools/pwenc.c | 18
ldap/servers/slapd/tools/rsearch/addthread.c | 51
ldap/servers/slapd/tools/rsearch/infadd.c | 7
ldap/servers/slapd/tools/rsearch/nametable.c | 13
ldap/servers/slapd/tools/rsearch/rsearch.c | 11
ldap/servers/slapd/tools/rsearch/scripts/dbgen.pl.in | 161
ldap/servers/slapd/tools/rsearch/sdattable.c | 64
ldap/servers/slapd/tools/rsearch/searchthread.c | 130
ldap/servers/slapd/unbind.c | 6
ldap/servers/slapd/uniqueid.c | 99
ldap/servers/slapd/utf8compare.c | 30
ldap/servers/slapd/util.c | 800
ldap/servers/slapd/uuid.c | 24
ldap/servers/slapd/value.c | 62
ldap/servers/slapd/valueset.c | 1223
ldap/servers/slapd/vattr.c | 169
ldap/servers/snmp/NETWORK-SERVICES-MIB.txt | 650
ldap/servers/snmp/RFC-1215.txt | 38
ldap/servers/snmp/RFC1155-SMI.txt | 119
ldap/servers/snmp/SNMPv2-CONF.txt | 322
ldap/servers/snmp/SNMPv2-SMI.txt | 344
ldap/servers/snmp/SNMPv2-TC.txt | 772
ldap/servers/snmp/ldap-agent.c | 38
ldap/servers/snmp/ldap-agent.h | 5
ldap/servers/snmp/main.c | 54
ldap/servers/snmp/netscape-ldap.mib | 759
ldap/servers/snmp/ntagt/nsldapagt_nt.c | 2
ldap/servers/snmp/ntagt/nsldapagt_nt.h | 2
ldap/servers/snmp/redhat-directory.mib | 41
ldap/systools/idsktune.c | 100
lib/base/crit.cpp | 6
lib/base/ereport.cpp | 2
lib/base/file.cpp | 28
lib/base/lexer.cpp | 1015
lib/base/plist.cpp | 3
lib/base/pool.cpp | 14
lib/base/rwlock.cpp | 168
lib/base/util.cpp | 25
lib/ldaputil/cert.c | 16
lib/ldaputil/certmap.c | 572
lib/ldaputil/dbconf.c | 14
lib/ldaputil/utest/Makefile | 149
lib/ldaputil/utest/auth.cpp | 611
lib/ldaputil/utest/authtest | 138
lib/ldaputil/utest/certmap.conf | 68
lib/ldaputil/utest/dblist.conf | 47
lib/ldaputil/utest/example.c | 153
lib/ldaputil/utest/plugin.c | 152
lib/ldaputil/utest/plugin.h | 57
lib/ldaputil/utest/stubs.c | 144
lib/ldaputil/utest/stubs.cpp | 139
lib/ldaputil/utest/test.ref | 480
lib/ldaputil/vtable.c | 2
lib/libaccess/acl.tab.cpp | 27
lib/libaccess/aclcache.cpp | 105
lib/libaccess/aclerror.cpp | 4
lib/libaccess/acleval.cpp | 4
lib/libaccess/aclflush.cpp | 1
lib/libaccess/aclpriv.h | 1
lib/libaccess/aclspace.cpp | 4
lib/libaccess/acltext.y | 6
lib/libaccess/acltools.cpp | 2002
lib/libaccess/aclutil.cpp | 13
lib/libaccess/authdb.cpp | 112
lib/libaccess/lasdns.cpp | 299
lib/libaccess/lasgroup.cpp | 10
lib/libaccess/lasip.cpp | 413
lib/libaccess/lasip.h | 3
lib/libaccess/nsautherr.cpp | 12
lib/libaccess/nseframe.cpp | 3
lib/libaccess/oneeval.cpp | 286
lib/libaccess/permhash.h | 11
lib/libaccess/register.cpp | 59
lib/libaccess/symbols.cpp | 4
lib/libaccess/usrcache.cpp | 14
lib/libaccess/utest/.purify | 19
lib/libaccess/utest/Makefile | 147
lib/libaccess/utest/acl.dat | 44
lib/libaccess/utest/aclfile0 | 87
lib/libaccess/utest/aclfile1 | 43
lib/libaccess/utest/aclfile10 | 45
lib/libaccess/utest/aclfile11 | 43
lib/libaccess/utest/aclfile12 | 43
lib/libaccess/utest/aclfile13 | 43
lib/libaccess/utest/aclfile14 | 43
lib/libaccess/utest/aclfile15 | 43
lib/libaccess/utest/aclfile16 | 43
lib/libaccess/utest/aclfile17 | 43
lib/libaccess/utest/aclfile18 | 51
lib/libaccess/utest/aclfile19 | 46
lib/libaccess/utest/aclfile2 | 43
lib/libaccess/utest/aclfile3 | 43
lib/libaccess/utest/aclfile4 | 43
lib/libaccess/utest/aclfile5 | 43
lib/libaccess/utest/aclfile6 | 55
lib/libaccess/utest/aclfile7 | 43
lib/libaccess/utest/aclfile8 | 43
lib/libaccess/utest/aclfile9 | 43
lib/libaccess/utest/aclgrp0 | 42
lib/libaccess/utest/aclgrp1 | 42
lib/libaccess/utest/aclgrp2 | 42
lib/libaccess/utest/aclgrp3 | 42
lib/libaccess/utest/aclgrp4 | 42
lib/libaccess/utest/acltest.cpp | 794
lib/libaccess/utest/onetest.cpp | 77
lib/libaccess/utest/shexp.cpp | 331
lib/libaccess/utest/shexp.h | 168
lib/libaccess/utest/test.ref | 217
lib/libaccess/utest/testmain.cpp | 89
lib/libaccess/utest/twotest.cpp | 87
lib/libaccess/utest/ustubs.cpp | 331
lib/libadmin/error.c | 9
lib/libadmin/template.c | 2
lib/libadmin/util.c | 48
lib/libsi18n/coreres.c | 141
lib/libsi18n/coreres.h | 52
lib/libsi18n/getlang.c | 330
lib/libsi18n/getstrmem.c | 160
lib/libsi18n/getstrmem.h | 1
lib/libsi18n/getstrprop.c | 89
lib/libsi18n/makstrdb.c | 21
lib/libsi18n/propset.c | 442
lib/libsi18n/propset.h | 80
lib/libsi18n/reshash.c | 21
ltmain.sh |14878 ++--
m4/db.m4 | 27
m4/fhs.m4 | 4
m4/icu.m4 | 25
m4/kerberos.m4 | 4
m4/mozldap.m4 | 38
m4/netsnmp.m4 | 15
m4/nspr.m4 | 17
m4/nss.m4 | 17
m4/openldap.m4 | 30
m4/pcre.m4 | 28
m4/sasl.m4 | 25
m4/selinux.m4 | 13
m4/svrcore.m4 | 41
man/man1/cl-dump.1 | 18
man/man1/dbgen.pl.1 | 4
man/man1/ds-logpipe.py.1 | 2
man/man1/infadd.1 | 8
man/man1/logconv.pl.1 | 44
man/man1/migratecred.1 | 6
man/man1/mmldif.1 | 4
man/man1/pwdhash.1 | 4
man/man1/repl-monitor.1 | 41
man/man8/bak2db.8 | 58
man/man8/bak2db.pl.8 | 82
man/man8/cleanallruv.pl.8 | 85
man/man8/db2bak.8 | 59
man/man8/db2bak.pl.8 | 78
man/man8/db2index.8 | 63
man/man8/db2index.pl.8 | 85
man/man8/db2ldif.8 | 102
man/man8/db2ldif.pl.8 | 124
man/man8/dbverify.8 | 60
man/man8/dn2rdn.8 | 58
man/man8/fixup-linkedattrs.pl.8 | 76
man/man8/fixup-memberof.pl.8 | 80
man/man8/ldif2db.8 | 85
man/man8/ldif2db.pl.8 | 102
man/man8/ldif2ldap.8 | 62
man/man8/monitor.8 | 67
man/man8/ns-accountstatus.pl.8 | 74
man/man8/ns-activate.pl.8 | 73
man/man8/ns-inactivate.pl.8 | 72
man/man8/ns-newpwpolicy.pl.8 | 79
man/man8/ns-slapd.8 | 10
man/man8/remove-ds.pl.8 | 6
man/man8/restart-dirsrv.8 | 50
man/man8/restoreconfig.8 | 48
man/man8/saveconfig.8 | 48
man/man8/schema-reload.pl.8 | 74
man/man8/setup-ds.pl.8 | 4
man/man8/start-dirsrv.8 | 50
man/man8/stop-dirsrv.8 | 50
man/man8/suffix2instance.8 | 51
man/man8/syntax-validate.pl.8 | 77
man/man8/upgradedb.8 | 56
man/man8/upgradednformat.8 | 55
man/man8/usn-tombstone-cleanup.pl.8 | 80
man/man8/verify-db.pl.8 | 49
man/man8/vlvindex.8 | 58
missing | 234
rpm.mk | 67
rpm/389-ds-base-devel.README | 4
rpm/389-ds-base-git.sh | 16
rpm/389-ds-base.spec.in | 1584
rpm/add_patches.sh | 55
rpm/rpmverrel.sh | 15
selinux/dirsrv.fc.in | 2
selinux/dirsrv.if | 41
selinux/dirsrv.te | 11
wrappers/cl-dump.in | 11
wrappers/dbscan.in | 10
wrappers/infadd.in | 12
wrappers/initscript.in | 245
wrappers/ldap-agent-initscript.in | 20
wrappers/ldap-agent.in | 12
wrappers/ldclt.in | 12
wrappers/ldif.in | 12
wrappers/migratecred.in | 14
wrappers/mmldif.in | 14
wrappers/pwdhash.in | 14
wrappers/repl-monitor.in | 11
wrappers/rsearch.in | 12
wrappers/systemd-snmp.service.in | 16
wrappers/systemd.group.in | 6
wrappers/systemd.template.service.in | 28
wrappers/systemd.template.sysconfig | 3
796 files changed, 156266 insertions(+), 92285 deletions(-)
---
1
0
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit a204469eaaf8d56e268b9a3cc14054d14f29d5f7
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 28 13:44:09 2015 -0800
Bump version to 1.3.2.25
diff --git a/VERSION.sh b/VERSION.sh
index b89d017..3c4ce62 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=3
-VERSION_MAINT=2.24
+VERSION_MAINT=2.25
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
1
0
Changes since 389-ds-base-1.2.6.a1:
Anupam Jain (9):
Ticket 123 - Enhancement request:"whoami" extended operation
Ticket 123 - Enhancement request:"whoami" extended operation
Ticket 123 - Enhancement request:"whoami" extended operation
Ticket #47423 - 7-bit check plugin does not work for userpassword attribute
Ticket #47363 - 7-bit checking is not necessary for userPassword
Ticket #47431 - Duplicate values for the attribute nsslapd-pluginarg are not handled correctly
Ticket #47370 - DS crashes with some 7-bit check plugin configurations
Ticket #617 - Possible to add invalid ACI value
Ticket #626 - Possible to add nonexistent target to ACI
Carsten Grzemba (2):
Ticket #555 - add fixup-memberuid.pl script
Ticket #555 - add fixup-memberuid.pl script
Charles Lopes (1):
Bug #361: Bad DNs in ACIs can segfault ns-slapd
Endi S. Dewata (168):
Bug 545620 - Password cannot start with minus sign
Bug 538525 - Ability to create instance as non-root user
Bug 570542 - Root password cannot contain matching curly braces
Bug 470684 - Pam_passthru plugin doesn't verify account activation
Bug 573375 - MODRDN operation not logged
Bug 520151 - Error when modifying userPassword with proxy user
Bug 455489 - Address compiler warnings about strict-aliasing rules
Bug 566320 - RFE: add exception to removal of attributes in cn=config for aci
Bug 566043 - startpid file is only cleaned by initscript runs
Bug 584109 - Slapd crashes while parsing DNA configuration
Bug 542570 - Directory Server port number is not validated in the beginning.
Bug 145181 - Plugin target/bind subtrees only take 1 value.
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 619122 - fix coverify Defect Type: Resource leaks issues CID 11975 - 12053
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverify Defect Type: Resource leaks issues CID 12094 - 12136
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 628096 - spurious error message from /sbin/service when doing a stop on no instances
Bug 573889 - Migration does not remove deprecated schema
Bug 606545 - core schema should include numSubordinates
Bug 643979 - Strange byte sequence for attribute with no values (nsslapd-referral)
Endi Sukma Dewata (16):
Bug 630092 - Coverity #12117: Resource leaks issues
Bug 630092 - Coverity #15478: Resource leaks issues
Bug 630092 - Coverity #15479: Resource leaks issues
Bug 630092 - Coverity #15481: Resource leaks issues
Bug 630092 - Coverity #15482: Resource leaks issues
Bug 630092 - Coverity #15483: Resource leaks issues
Bug 630092 - Coverity #15484: Resource leaks issues
Bug 630092 - Coverity #15485: Resource leaks issues
Bug 630092 - Coverity #15487: Resource leaks issues
Bug 630092 - Coverity #15490: Resource leaks issues
Bug 630092 - Coverity #15497: Resource leaks issues
Bug 630092 - Coverity #11991: Resource leaks issues
Bug 630092 - Coverity #12000: Resource leaks issues
Bug 630092 - Coverity #12003: Resource leaks issues
Bug 630092 - Coverity #11985: Resource leaks issues
Bug 630092 - Coverity #11992,11993: Resource leaks issues
Jeroen van Meeuwen (Kolab Systems) (1):
Suppress alert on unavailable port with forced setup
Jonathan \"Duke\" Leto (1):
fix for trac #173; update ds-logpipe.py docs about -t option
Ken Rossato (8):
Factorize into new isPosixGroup function
Change "return"s in modGroupMembership to "break"s to avoid leaking
Memory leaks: unmatched slapi_attr_get_valueset and slapi_value_new
Simplify program flow: eliminate unnecessary continue
Simplify program flow: make adduids/moduids/deluids action blocks all similar
Fix logic errors: del_mod should be latched (might not be last mod), and avoid skipping add-mods (int value 0)
Simplify program flow: change while loops to for
Ticket #481 - expand nested posix groups
Ludwig Krispenz (70):
Fix for ticket 510
Fix for ticket 465: cn=monitor showing stats for other db instances
Fix for ticket 504
Ticket 349 - nsViewFilter syntax issue in 389DS 1.2.5
Ticket 518 - dse.ldif is 0 length after server kill or machine kill
Ticket 505 - use lock-free access name2asi and oid2asi table
Fix optimization issue introduced with fix for ticket #561,
modify operations without values need to be written to the changelog
Reduce replication meta data stored in entry, cf ticket 569
Fix compiler warnings introduced by fix for #569
removing an unused variable, did also remove an assigment
Ticket 568 - make usage of transaction batch flush durable
fix hang related to ticket 568
Ticket 47358 - implement backend optimazation levels
Ticket 47396 - crash on modrdn of tombstone
Ticket 47395 47397 v2 correct behaviour of account policy if only stateattr
fix compiler warnings, caused by fix for 47395,47397
Ticket 47399 - RHDS denies MODRDN access if ACI list contains any DENY rule
Ticket 47369 version2 - provide default syntax plugin
Fix compiler warning
Ticket 346 - version 4 Slow ldapmodify operation time
fix compiler warnings
CVE-2013-2219 ACLs inoperative in some search scenarios
fix compiler warning
Ticket 47502 - updates to ruv entry are written to retro changelog
Fix regression from fix for 569, when the last value of an attribute was explicitely deleted
Ticket 47505 - Get rid of valueset_add_valuearray_ext
Ticket 47487 - enhance retro changelog
Ticket 314 - ChaiOnUpdate for root handling
Use defines for backend error handling
Ticket 601 - multi master replication allows schema violation
Ticket 47388 - RFE to implement RFC4533 -ver2
Fix for coverty issues 12028,12029,12030
Ticket 47577 - crash when removing entries from cache
Ticket 47521 - Complex filter in a search request doen't work as expected.
Ticket 47591 - entries with empty objectclass attribute value can be hidden
Ticket 47527 - Allow referential integrity suffixes to be configurable
Ticket 47526 - Allow memberof suffixes to be configurable
Ticket 47612 - ns-slapd eats all the memory
simplify fix for 47612
Ticket 47621 - v2 make referential integrity configuration more flexible
Ticket 47629 - random crashes related to sync repl
Ticket 47704 - invalid sizelimits in aci group evaluation
Ticket 47732 - ds logs many "SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN plugin returned error" messages
Ticket 47733 - ds logs many "Operation error fetching Null DN" messages
Ticket 47667 - Allow nsDS5ReplicaBindDN to be a group DN
Ticket 47712 - betxn: retro changelog broken after cancelled transaction
fix assertion failure introduced with fix for ticket 47667
Ticket 47761 - Return all attributes in rootdse without explicit request
fix jenkins warning
Ticket 47806 - Failed deletion of aci: no such attribute
Ticket 47805 - syncrepl doesn't send notification when attribute in search filter changes
Ticket 47803 - syncrepl crash if attribute list is non-empty
fix coverity issue 12621
fix compiler error with alst coverity commit
Ticket 47821 - deref plugin cannot handle complex acis
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket 47846 - server crashes deleting a replication agreement
Ticket 47872 - Filter AND with only one clause should be optimized
Ticket 47877 - check_and_add_entry fails for changetype: add and existing entry
Ticket 47816 -v2- internal syncrepl searches are flagged as unindexed
Ticket 47866 - Errors after upgrading related to attribute "dnaremotebindmethod"
Ticket 47885 - deref plugin should not return references with noc access rights
fix for 47885 did not always return a response control
Ticket 47918 - result of dna_dn_is_shared_config is incorrectly used
ticket 47916 plugin logging parameter only triggers result logging
Additional fix for ticket 47526 v3
fix jenkins warning
Ticket 47964 - v2 - Incorrect search result after replacing an empty attribute
Ticket 47991 - upgrade script fails if /etc and /var are on different file systems
Mark Reynolds (396):
Ticket #71 - unable to delete managed entry config
Ticket #159 - Managed Entry Plugin runs against managed entries upon any update without validating
Ticket #177 - logconv.pl doesn't detect restarts
Merge branch 'ticket159'
Ticket #49 - better handling for server shutdown while long running tasks are active
Ticket #50 - server should not call a plugin after the plugin close function is calle
Updated for ticket#50
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #140 - incorrect memset parameters
Revert "Ticket #140 - incorrect memset parameters"
Revert "Ticket #55 - Limit of 1024 characters for nsMatchingRule"
Ticket #38 - nisDomain schema is incorrect
Ticket #6 - protocol error from proxied auth operation
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #39 - Account Policy Plugin does not work for simple binds when PAM Pass Through Auth plugin is enabled
Ticket 175 - logconv.pl improvements
Ticket 175 - minor fixes
Ticket #17 - Replication optimizations
Ticket #17 - new replication optimizations
Ticket #129 - Should only update modifyTimestamp/modifiersName on MODIFY ops
Ticket #111 - ability to control behavior of modifyTimestamp/modifiersName
Ticket #211 - dnaNextValue gets incremented even if the user addition fails
Ticket #74 - Add schema for DNA plugin (RFE)
Ticket #306 - void function cannot return value
Ticket #302 - use thread local storage for internalModifiersName & internalCreatorsName
Schema Reload crash fix
Ticket #291 - cannot use & in a sasl map search filter
Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash
Ticket #191 - Implement SO_KEEPALIVE in network calls
Config changes fail because of unknown attribute "internalModifiersname"
Ticket #292 - logconv.pl reporting unindexed search with different search base than shown in access logs
Ticket #308 - Automembership plugin fails if data and config area mixed in the plugin configuration
Ticket #271 - replication code cleanup
TIcket #285 - compilation fixes for '--format-security'
Ticket #271 - Slow shutdown when you have 100+ replication agreements
Ticket #24 - Add nsTLS1 to the DS schema
Ticket #319 - ldap-agent crashes on start with signal SIGSEGV
Ticket #20 - Allow automember to work on entries that have already been added
Ticket #315 - ns-slapd exits/crashes if /var fills up
Ticket #315 - small fix to libglobs
Ticket #183 - passwordMaxFailure should lockout password one sooner - and should be configurable to avoid regressions
Coverity Fixes
Ticket #325 - logconv.pl : use of getopts to parse command line options
Ticket #183 - passwordMaxFailure should lockout password one sooner
Ticket #207 - [RFE] enable attribute that tracks when a password was last set
Ticket #214 - Adding Replication agreement should complain if required nsds5ReplicaCredentials not supplied
Ticket #337 - Improve CLEANRUV task
Ticket #356 - RFE - Track bind info
Ticket #196 - RFE: Interpret IPV6 addresses for ACIs, replication, and chaining
Ticket #218 - Make RI Plugin worked with replicated updates
Ticket 367 - Invalid chaining config triggers a disk full error and shutdown
Ticket 365 - passwords in clear text in the audit log
Ticket #321 - krbExtraData is being null modified and replicated on each ssh login
Ticket #110 - RFE limiting root DN by host, IP, time of day, day of week
Ticket 368 - Make the cleanAllRUV task one step
Ticket #28 - MOD operations with chained delete/add get back error 53 on backend config
Ticket #369 - restore of replica ldif file on second master after deleting two records shows only 1 deletion
Update the slapi-plugin documentation on new slapi functions, and added a slapi function for checking on shutdowns
Ticket #388 - Improve replication agreement status messages
COVERITY FIXES
Coverity Fix
Ticket 366 - Change DS to purge ticket from krb cache in case of authentication error
Ticket 399 - slapi_ldap_bind() doesn't check bind results
Ticket 328 - make sure all internal search filters are properly escaped
Ticket 413 - "Server is unwilling to perform" when running ldapmodify on nsds5ReplicaStripAttrs
Ticket 403 - CLEANALLRUV feature
Ticket 407 - memory leak in dna plugin
Ticket 403 - cleanallruv coverity fixes
Misc Coverity Fixes
Ticket 407 - dna memory leak
Ticket 403 - CLEANALLRUV amendment
Ticket 403 - CLEANALLRUV - revision to last amendment
Ticket 403 - fix CLEANALLRUV regression from last commit
Ticket 429 - Add nsslapd-readonly to schema
CLEANALLRUV coverity fixes
Ticket 436 - nsds5ReplicaEnabled can be set with any invalid values.
Ticket 386 - Overconsumption of memory with large cachememsize and heavy use of ldapmodify
Ticket 450 - CLEANALLRUV task gets stuck on winsync replication agreement
Ticket 452 - automember rebuild task adds users to groups that do not match the configuration scope
Ticket 408 - create a normalized dn cache
Ticket 467 - CLEANALLRUV abort task should be able to ignore down replicas
Ticket 747 - Root DN Access Control - days allowed not working correctly
Ticket 475 - Root DN Access Control - improve value checking for config
Ticket 473 - change VERSION.sh to have console version be major.minor
Coverity issue 13091
Ticket 457 - dirsrv init script returns 0 even when few or all instances fail to start
Ticket 477 - CLEANALLRUV if there are only winsync agmts task will hang
Ticket 478 - passwordTrackUpdateTime stops working with subtree password policies
Ticket #446 - anonymous limits are being applied to directory manager
Ticket 488 - Doc: DS error log messages with typo
Ticket 486 - nsslapd-enablePlugin should not be multivalued
Ticket 468 - if pam_passthru is enabled, need to AC_CHECK_HEADERS([security/pam_appl.h])
Ticket 495 - internalModifiersname not updated by DNA plugin
Revert "Ticket 495 - internalModifiersname not updated by DNA plugin"
Ticket 495 - internalModifiersname not updated by DNA plugin
Ticket 147 - Internal Password Policy usage very inefficient
Ticket 517 - crash in DNA if no dnaMagicRegen is specified
Ticket 507 - use mutex for FrontendConfig lock instead of rwlock
Ticket 394 - modify-delete userpassword
Ticket 337 - improve CLEANRUV functionality
Coverity Fixes
Ticket 20 - Allow automember to work on entries that have already been added
Ticket 393 - Change in winSyncInterval does not take immediate effect
Ticket 216 - disable replication agreements
Ticket 395 - RFE: 389-ds shouldn't advertise in the rootDSE that we can handle a sasl mech if we really can't
Ticket 527 - ns-slapd segfaults if it cannot rename the logs
Ticket 509 - lock-free access to be->be_suffixlock
Merge branch 'ticket509'
Ticket 456 - improve entry cache sizing
Ticket 509 - lock-free access to be->be_suffixlock
Ticket 511 - allow turning off vattr lookup in search entry return
Ticket 541 - RootDN Access Control plugin is missing after upgrade
Ticket 541 - need to set plugin as off in ldif template
Ticket 534 - RFE: Add SASL mappings fallback
Ticket 534 - sasl mapping fallback
Ticket 532 - RUV is not getting updated for both Master and consumer
Ticket 534 - Add SASL mappings fallback
Ticket 534 - SASL Mapping Fallback
Ticket 539 - logconv.pl should handle microsecond timing
Ticket 471 - logconv.pl tool removes the access logs contents if "-M" is not correctly used
Ticket 552 - Adding rootdn-open-time without rootdn-close-time to RootDN Acess Control results in inconsistent configuration
Ticket 551 - Multivalued rootdn-days-allowed in RootDN Access Control plugin always results in access control violation
TIcket 419 - logconv.pl - improve memory management
Ticket 419 - logconv.pl - improve memory management
Ticket 558 - Replication - make timeout for protocol shutdown configurable
Ticket 417 - RFE - forcing passwordmustchange attribute by non-cn=directory manager
Ticket 562 - Crash when deleting suffix
Merge branch 'master' of ssh://git.fedorahosted.org/git/389/ds
Ticket 532 - RUV is not getting updated for both Master and consumer
Ticket 433 - multiple bugs in start-dirsrv, stop-dirsrv, restart-dirsrv scripts
Ticket 433 - multiple bugs in start-dirsrv, stop-dirsrv, restart-dirsrv scripts
Ticket 570 - DS returns error 20 when replacing values of a multi-valued attribute (only when replication is enabled)
Ticket 528 - RFE - get rid of instance specific scripts
Coverity Fixes
Ticket 528 - RFE - get rid of instance specific scripts (part 2)
Ticket 332 - Command line perl scripts should attempt most secure connection type first
Ticket 332 - Fix usage in scripts
Ticket 332 - minor quoting issue in a few scripts.
Ticket 588 - Create MAN pages for command line scripts
Ticket 332 - wrong argument count in ldif2db
Ticket 571 - server does not accept 0 length LDAP Control sequence
Ticket 583 - dirsrv fails to start on reboot due to /var/run/dirsrv permissions
Ticket 574 - problems with dbcachesize disk space calculation
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
Ticket 574 - problems with dbcachesize disk space calculation
Ticket 458 - RFE - Make it possible for privileges to be provided to an admin user
Ticket 611 - logconv.pl missing stats for StartTLS, LDAPI, and AUTOBIND
Ticket 622 - DS logging errors "libdb: BDB0171 seek: 2147483648: (262144 * 8192) + 0: No such file or directory
Ticket 525 - Introducing a user visible configuration variable for controlling replication retry time
Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC
Ticket 587 - Replication error messages in the DS error logs
Ticket 458 - Need to properly check if the password admin dn is set
Ticket 628 - crash in aci evaluation
Ticket 620 - Better logging of error messages for 389-ds-base
Ticket 534 - RFE: Add SASL mappings fallback
Ticket 550 - posix winsync will not create memberuid values if group entry become posix group in the same sync interval
Ticket 631 - Replication: "Incremental update started" status message without consumer initialized
Ticket 47311 - segfault in db2ldif(trigger by a cleanallruv task)
Ticket 47304 - reinitialization of a master with a disabled agreement hangs
Ticket 47315 - filter option in fixup-memberof requires more clarification
Ticket 77 - [RFE] Add ACI support for ldapi
Ticket 47317 - should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default
Ticket 205 - Fix compiler warning
Ticket 153 - use openldap's schema parser
Ticket 47299 - fix config file and server id processing
Ticket 580 - Wrong error code return when using EXTERNAL SASL and no client certificate
Fix coverity issues
Ticket 47317 - should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default - revision
Ticket 47355 - dse.ldif doesn't replicate update to nsslapd-sasl-mapping-fallback
Ticket 511 - Revision - allow turning off vattr lookup in search entry return
Ticket 47337 - mep_pre_op: Unable to fetch origin entry
Ticket 283 - Expose slapi_eq_* API
Ticket 47340 - Deleting a separator ',' in 7-bit check plugin arguments makes the
Ticket 47326 - idl switch does not work
Merge branch 'ticket47326'
Ticket 589 - RFE - Support RFC 4527 Read Entry Controls
Ticket 47372 - make old-idl tunable
Coverity Fixes (part 1)
Coverity Fixes (Part 2)
Coverity Fixes (Part 3)
Coverity Fixes (Part 4)
Coverity Fixes (Part 5)
Ticket 47385 - DS not shutting down when disk monitoring threshold is reached
Fri Jun 7 10:41:00 2013 -0400
Ticket 47383 - connections attribute in cn=snmp,cn=monitor is counted twice
Ticket 47376 - DESC should not be empty as per RFC 2252 (ldapv3)
Ticket 47379 - DNA plugin failed to fetch replication agreement
Coverity (Part 7) + Jenkins fix
Ticket 47389 - Non-directory manager can change the individual userPassword's storage scheme
Ticket 47329 - Improve slapi_back_transaction_begin() return code when transactions are not available
Coverity Fixes
Ticket 47381 - nsslapd-db-transaction-batch-val turns to -1
Ticket 47385 - Disk Monitoring is not triggered as expected.
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47416 - SASL encrypted packet length exceeds maximum allowed limit
Ticket 47421 - memory leaks in set_krb5_creds
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47441 - Disk Monitoring not checking filesystem with logs
Ticket 47382 - Add a warning message when a connection hits the max number of threads
Ticket 47449 - deadlock after adding and deleting entries
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket 47450 - Fix compiler formatting warning errors for 32/64 bit arch
Ticket 47447 - logconv.pl man page missing -m,-M,-B,-D
Ticket 47323 - resurrected entry is not correctly indexed
Ticket 47440 - Fix compilation warnings and header files
Ticket 47440 - Fix runtime errors caused by last patch.
Ticket 47411 - Replace substring search with plain search in referint plugin
Ticket 47425 - should only call windows_update_done if repl agmt type is windows
Ticket 47426 - move compute_idletimeout out of handle_pr_read_ready
Ticket47426 - Coverity issue with last commit(move compute_idletimeout out of handle_pr_read_ready)
Ticket 47473 - setup-ds.pl doesn't lookup the "root" group correctly
Ticket 47461 - logconv.pl - Use of comma-less variable list is deprecated
Ticket 47384 - Plugin path validation returntext not set correctly
Ticket 47394 - remove-ds.pl should remove /var/lock/dirsrv
Ticket 47371 - Some updates of "passwordgraceusertime" are useless when updating "userpassword"
Ticket 47306 - execute index_add_mods only for indexed attributes
Ticket 47500 - start-dirsrv/restart-dirsrv/stop-disrv do not register with systemd correctly
Ticket 411 - [RFE] mods optimizer
Ticket 47507 - automember rebuild task not working as expected
Ticket 47512 - backend txn plugin fixup tasks should be done in a txn
Coverity fix - 11952
Ticket 47401 - report unindexed internal searches
Ticket 47520 - Fix various issues with logconv.pl
Ticket 47509 - CLEANALLRUV doesnt run across all replicas
Ticket 47509 - Cleanallruv jenkins error
Ticket 47513 - tmpfiles.d references /var/lock when they should reference /run/lock
Ticket 47528 - 389-ds-base built with mozldap can crash from invalid free
Ticket 47510 - 389-ds-base does not compile against MozLDAP libraries
Ticket 47532 - 1.3.1 with mozldap crashes in new operation work_q code
Ticket 47510 - Repl Sync does not compile against MozLDAP libraries
Ticket 47510 - remove unnecessary typedef
Ticket 47513 - Refine the check for @localrundir@
Ticket 47513 - Set localrundir outside of the "with-fhs" block
Ticket 47543 - Mozldap - fix compiler warnings
Ticket 47531 - Mozldap - need to rewrite sasl_io_recv
Ticket 47510 - Additional mozldap failures with Repl Sync
Ticket 47522 - Password adminstrators should be able to voilate password policy
Ticket 47491 - Update systemd service file to use PartOf directive
Ticket 47517 - memory leak in range searches and other various leaks
Ticket 47535 - Logconv.pl - RFE - add on option for a minimum etime for unindexed search stats
Ticket 47535 - update man page
Ticket 47499 - if nsslapd-cachememsize set to the number larger than
Ticket 47436 - 389-ds-base - shebang with /usr/bin/env
Coverity Issue 12033
Ticket 47538 - RFE: repl-monitor.pl plain text output, cmdline config options
Ticket 47519 - memory leaks in access control
Ticket 47368 - IPA server dirsrv RUV entry data excluded from replication
Ticket 47368 - Fix Jenkins errors
Ticket 47368 - Fix coverity issues
Ticket 47582 - agmt_count in Replica could become (PRUint64)-1
Ticket 47541 - Replication of the schema may overwrite consumer 'attributetypes' even
Ticket 47541 - Fix Jenkins errors
Ticket 47597 - Convert retro changelog plug-in to betxn
Ticket 47598 - Convert ldbm_back_seq code to be transaction aware
Ticket 47529 - Automember plug-in should treat MODRDN operations as ADD operations
Ticket 47599 - Reduce lock scope in retro changelog plug-in
Revert "Ticket 47599 - Reduce lock scope in retro changelog plug-in"
Ticket 47599 - Reduce lock scope in retro changelog plug-in
Ticket 47525 - Allow memberOf to use an alternate config area
Ticket 47525 - Fix memory leak
Ticket 47599 - fix memory leak
Ticket 47593 - Update plugin API for OTP plugin
Ticket 47457 - default nsslapd-sasl-max-buffer-size should be 2MB
Ticket 47592 - automember plugin task memory leaks
Ticket 47525 - Need to add locking around config area access
Ticket 47613 - Impossible to configure nsslapd-allowed-sasl-mechanisms
Ticket 47614 - Possible to specify invalid SASL mechanism in nsslapd-allowed-sasl-mechanisms
Ticket 47603 - Allow RI plugin to use alternate config area
Ticket 47587 - hard coded limit of 64 masters in agreement and changelog code
Ticket 47368 - fix memory leaks
Ticket 47620 - 389-ds rejects nsds5ReplicaProtocolTimeout attribute
Ticket 47622 - Automember betxnpreoperation - transaction not aborted when group entry does not exist
Ticket 47627 - changelog iteration should ignore cleaned rids when getting the minCSN
Ticket 47601 - Plugin library path validation prevents intentional loading of out-of-tree modules
Ticket 47617 - allow configuring changelog trim interval
Ticket 47613 - Issues setting allowed mechanisms
Ticket 47603 - should not modify pre op entry during config validation
Ticket 47620 - Config value validation improvement
Ticket 47620 - Fix logically dead code.
Ticket 47627 - Fix replication logging
Ticket 47620 - Fix dereferenced NULL pointer in agmtlist_modify_callback()
Ticket 47620 - Fix missing left bracket
Ticket 47653 - Need a way to allow users to create entries assigned to themselves
Ticket 47654 - Cleanup old memory leaks reported from valgrind
Ticket 47654 - fix double free
Ticket 408 - Fix crash when disabling/enabling the setting
Ticket 47620 - Unable to delete protocol timeout attribute
Ticket 47641 - 7-bit check plugin not checking MODRDN operation
Ticket 47638 - Overflow in nsslapd-disk-monitoring-threshold on 32bit platform
Ticket 47618 - Enable normalized DN cache by default
Ticket 47437 - Some attributes in cn=config should not be multivalued
Ticket 47615 - Failed to compile the DS 389 1.3.2.3 version against Berkeley DB 4.2 version
Ticket 47552 - logconv: unindexed report should list bind dn
Ticket 525 - Replication retry time attributes cannot be added
Ticket 47453 - configure SASL/GSSAPI/Kerberos without server restart
Ticket 47727 - Updating nsds5ReplicaHost attribute in a replication agreement fails with error 53
Ticket 47637 - rsa_null_sha should not be enabled by default
Ticket 47729 - Directory Server crashes if shutdown during a replication initialization
Ticket 47700 - Fix compiler warnings
Ticket 47722 - rsearch filter error on any search filter
Ticket47722 - Fixed filter not correctly identified
Ticket 47740 - Coverity Fixes (Mark - part 1)
Ticket 47740 - Fix sync plugin resource leaks
Ticket 47640 - Fix coverity issues - part 3
Ticket 47740 - Fix coverity erorrs - Part 4
Ticket 47740 - Fix coverity issues - Part 5
Ticket 47740 - Fix coverity issues: null deferences - Part 6
Ticket 47740 - Crash caused by changes to certmap.c
Revert "Ticket 47700 - Fix compiler warnings"
Ticket 47743 - Memory leak with proxy auth control
Ticket 47451 - add/enable/disable/remove plugins without server restart
Ticket 47740 - Fix coverity issues(part 7)
Ticket 47756 - Improve import logging and abort processing
Ticket 47759 - Crash in replication when server is under write load
Ticket 47655 - Improve replication total update logging
Ticket 47766 - Tombstone purging can crash the server if the backend is stopped/disabled
Ticket 47767 - Nested tombstones become orphaned after purge
Ticket 47771 - Performing deletes during tombstone purging results in operation errors
Ticket 47782 - Parent numbordinate count can be incorrectly updated if an error occurs
Ticket 47779 - Part of DNA shared configuration is deleted after server restart
Ticket 47771 - Move parentsdn initialization to avoid crash
Ticket 477779 - Need to lock server list when removing list
Ticket 47792 - code cleanup
Ticket 47792 - database plugins need a way to call betxn
Ticket 47793 - Server crashes if uniqueMember is invalid syntax and memberOf
Ticket 47756 - fix coverity issues
Ticket 47772 - fix coverity issue
Ticket 47451 - Remove old code from linked attr plugin
Ticket 47670 - Aci warnings in error log
Ticket 47636 - errorlog-level 16384 is listed as 0 in cn=config
Ticket 47713 - Logconv.pl with an empty access log gives lots of errors
Ticket 47446 - logconv.pl memory continually grows
Ticket 47791 - Negative value of nsSaslMapPriority is not
Ticket 47644 - Managed Entry Plugin - transaction not aborted upon failure to create managed entry
Ticket 47466 - Fix coverity issue
Ticket 47813 - managed entry plugin fails to update member
Ticket 47602 - txn commit being performed too early
Ticket 47815 - Add operations rejected by betxn plugins remain in cache
Ticket 47810 - investigate betxn plugins to ensure they
Ticket 47817 - The error result text message should be obtained just prior to sending result
Ticket 47827 - online import crashes server if using verbose error logging
Ticket 47815 - add lib389 test
Ticket 47827 - Fix coverity issue 12695
Ticket 47779 - Potential deadlock after startup if a dna configuration change is made
Ticket 47781 - Server deadlock if online import started while
Ticket 47781 - Add CI test
Ticket 47781 - CI test - use predefined property name variables
Ticket 47654 - Fix regression (deadlock/crash)
Ticket 47858 - Internal searches using OP_FLAG_REVERSE_CANDIDATE_ORDER can crash the server
Ticket 47819 - Improve tombstone purging performance
Ticket 47855 - clear tmp directory at the start of each test
Ticket 47855 - Fix previous commit
Ticket 47853 - client hangs in add if memberof fails
Ticket 437853 - Missing newline at end of the error log messages in memberof
Ticket 47710 - Missing warning for invalid replica backoff configuration
Ticket 47790 - Integer config attributes accept invalid
Ticket 47812 - logconv.pl missing -U option from usage
Ticket 47861 - Certain schema files are not replaced during upgrade
Ticket 47819 - Fix memory leak
Ticket 47862 - repl-monitor fails to convert "*" to default values
Ticket 47900 - Adding an entry with an invalid password as rootDN is incorrectly rejected
Ticket 47900 - Server fails to start if password admin is set
Ticket 47892 - Fix remaining compiler warnings
Ticket 47937 - Crash in entry_add_present_values_wsi_multi_valued
Ticket 47953 - Should not check aci syntax when deleting an aci
Ticket 47451 - Need to unregister tasks created by plugins
Ticket 47952 - PasswordAdminDN attribute is not properly returned to client
Ticket 47958 - Memory leak in password admin if the admin entry does not exist
Ticket 47950 - Bind DN tracking unable to write to internalModifiersName without special permissions
Ticket 47810 - RI plugin does not return result code if update fails
Ticket 47963 - RFE - memberOf - add option to skip nested
Ticket 47963 - skip nested groups breaks memberof fixup task
Ticket 47451 - Running a plugin task can crash the server
Ticket 47967 - cos_cache_build_definition_list does not stop during server shutdown
Ticket 47969 - COS memory leak when rebuilding the cache
Ticket 47970 - Account lockout attributes incorrectly updated after failed SASL Bind
Ticket 47970 - add lib389 testcase
Ticket 47525 - Crash if setting invalid plugin config area for MemberOf Plugin
Ticket 47949 - logconv.pl -- support parsing/showing/reporting different protocol versions
Ticket 47969 - Fix coverity issue
Ticket 47965 - Fix coverity issues (2014/11/24)
Ticket 47636 - Error log levels not displayed correctly
Ticket 47722 - Using the filter file does not work
Ticket 47750 - Need to refresh cache entry after called betxn postop plugins
Ticket 47451 - Dynamic Plugin - various fixes
Ticket 47451 - Fix jenkins errors
Ticket 47451 - Add Dynamic Plugin CI Suite
Ticket 47750 - During delete operation do not refresh cache entry if it is a tombstone
Ticket 47451 - Dynamic plugins - fixed thread synchronization
Ticket 47980 - Nested COS definitions can be incorrectly
Ticket 47981 - COS cache doesn't properly mark vattr cache as
Ticket 47973 - During schema reload sometimes the search returns no results
Ticket 47617 - replication changelog trimming setting validation
Ticket 47807 - SLAPI_REQUESTOR_ISROOT not set for extended operation plugins
Ticket 47462 - Stop using DES in the reversible password
Ticket 47738 - use PL_strcasestr instead of strcasestr
Matthew Via (1):
Ticket #47428 - Memory leak in 389-ds-base 1.2.11.15
Nathan Kinder (212):
Bug 549554 - Trim single-valued attributes before sending to AD
Improve search for pcre header file
Bug 434735 - Allow SASL ANONYMOUS mech to work
Bug 570912 - Avoid selinux context conflict with httpd
Allow instance name to be parsed from start-slapd
Add managed entries plug-in
Bug 572355 - Label instance files and ports during upgrade.
Bug 578863 - Password modify extop needs to send referrals on replicas
Bug 584156 - Remove ldapi socket file during upgrade
Fix rsearch usage of name files for random filters
Bug 584497 - Allow DNA plugin to set same value on multiple attributes
Add replication session hooks
Correct function prototype for repl session hook
Bug 592389 - Set anonymous resource limits properly
Bug 601433 - Add man pages for start-dirsrv and related commands
Bug 604263 - Fix memory leak when password change is rejected
Bug 612242 - membership change on DS does not show on AD
Bug 613833 - Allow dirsrv_t to bind to rpc ports
Bug 594745 - Get rid of dirsrv_lib_t label
Bug 620927 - Allow multiple membership attributes in memberof plugin
Bug 612264 - ACI issue with (targetattr='userPassword')
Bug 630098 - fix coverity Defect Type: Code maintainability issues
Bug 630098 - fix coverity Defect Type: Code maintainability issues
Bug 630093 - (cov#15511) Don't use unintialized search_results in refint plugin
Bug 630093 - (cov#15518) Need to intialize fd in ldbm2ldif code
Bug 630096 - (cov#11778) check return value of ldap_parse_result
Bug 630096 - (cov#15446) check return value of ber_scanf()
Bug 630096 - (cov#15449,15450) Check return value of stat()
Bug 630096 - (cov#15448) Check return value of cache_replace()
Bug 630096 - (cov#15447) - Check return value of idl_append_extend()
Bug 630090 - (cov#11974) Remove unused ACL functions
Bug 630090 - (cov#15445) Fix illegal free in archive code
Bug 630094 - (cov#11818) Fix unreachable return in snmp subagent
Bug 630094 - (cov#15451) Get rid of unreachable free statements
Bug 630094 - (cov#15452) Remove NULL checking for op_string
Bug 630094 - (cov#15453) Eliminate NULL check for local_newentry
Bug 630094 - (cov#15454) Fix deadcode issue in mapping tree code
Bug 630094 - (cov#15455) Remove deadcode in attr_index_config()
Bug 630094 - (cov#15456) Remove NULL check for srdn in import code
Bug 630094 - (cov#15457) Remove deadcode in import code
Bug 630094 - (cov#15458) Fix deadcode issue in moddn code
Bug 630094 - (cov#15459) Remove NULL check for srdn in ldif2ldbm code
Bug 630094 - (cov#15520) Fix unreachable code issue if perfctrs code
Bug 630094 - (cov#15581) Add missing breaks in agt_mopen_stats()
Bug 690090 - (cov#11974) Remove additional unused ACL functions
Bug 630091 - (cov#15512) Fix usage of uninitialized bervals
Bug 630091 - (cov#15513) Fix usage of uninitialized bervals
Bug 630091 - (cov#15514) Initialize DBT in entryrdn_get_parent()
Bug 630091 - (cov#15515) Use of uninitialized array in index config code
Bug 630091 - (cov#15516,15517) Initialize pointers before attempting to free
Bug 630091 - (cov#15519) Initialize bervals in search_easter_egg()
Bug 630091 - (cov#15582) Free of uninitialized pointer in attr_index_config()
Bug 630097 - (cov#11933) Fix NULL dereference in schema code
Bug 630097 - (cov#11938) NULL dereference in mmldif
Bug 630097 - (cov#11946) NULL dereference in ResHashCreate()
Bug 630097 - (cov#11964) Remove dead code from libaccess
Bug 630097 - (cov#12143) NULL dereference in cos cache code
Bug 630097 - (cov#12148) NULL dereference in ruvInit()
Bug 630097 - (cov#12182,12183) NULL dereference in import code
Bug 630097 - (cov#15460) NULL deference in ACL URL code
Bug 630097 - (cov#15461) Remove unnecessary NULL check in DNA
Bug 630097 - (cov#15462) NULL dereference in mep_modrdn_post_op()
Bug 630097 - (cov#15463) Remove NULL check in referint plugin
Bug 630097 - (cov#15464) NULL dereference in repl code
Bug 630097 - (cov#15465) Null dereference in USN code
Bug 630097 - (cov#15473) NULL dereference in ResHashCreate()
Bug 630097 - (cov#15505) NULL dereference in memberOf code
Bug 630097 - (cov#15506) NULL dereference in dblayer code
Bug 630097 - (cov#15507,15508) NULL dereference in entryrdn code
Bug 630097 - (cov#15509) NULL dereference in idsktune
Bug 630097 - (cov#11938) NULL dereference in mmldif
Bug 630097 - (cov#15477) NULL dereference in ACL plug-in code
Bug 630091 - (cov#12209) Use of uninitialized pointer in libaccess
Bug 630092 - (cov#12116) Resource leak in ldclt code
Bug 630092 - (cov#12105) Resource leak in pwdscheme config code
Bug 630092 - (cov#12068) Resource leak in certmap code
Bug 630091 - (cov#11973) Array overrun in libaccess
Bug 522055 - Scope check for managed attribute fails
Bug 625335 - Self-write aci has permission to invalid attribute
Bug 631993 - Log authzid when proxy auth control is used
Cov #16300 - Unused variable in account policy plugin
Bug 544321 - remove-ds.pl should not throw error unlabelling port
Bug 555955 - Allow CoS values to be merged
Bug 643937 - Initialize replication version flags
Bug 305131 - Allow empty modify operation
Bug 619633 - Make attribute uniqueness obey requiredObjectClass
Bug 619623 - attr-unique-plugin ignores requiredObjectClass on modrdn operations
Bug 189985 - Improve attribute uniqueness error message
Bug 647932 - multiple memberOf configuration adding memberOf where there is no member
Bug 521088 - DNA should check ACLs before getting a value from the range
Bug 635009 - Add one-way AD sync capability
Bump VERSION.sh to 1.2.8.a1
Bug 648949 - Move selinux policy into base OS
Bug 648949 - Update configure
Roll back VERSION.sh for 1.2.7 release
Bug 625950 - hash nsslapd-rootpw changes in audit log
Bug 656392 - Remove calls to ber_err_print()
Bug 656515 - Allow Name and Optional UID syntax for grouping attributes
Bug 197886 - Avoid overflow of UUID generator
Bug 658312 - Allow mapped attribute types to be quoted
Bug 197886 - Initialize return value for UUID generation code
Bug 658309 - Process escaped characters in managed entry mappings
Bug 659456 - Incorrect usage of ber_printf() in winsync code
Bug 641944 - Don't normalize non-DN RDN values
Bug 658312 - Invalid free in Managed Entry plug-in
Bug 661792 - Valid managed entry config rejected
Bug 588791 - Allow anonymous rootDSE access only
Bug 606439 - Creating server instance with LDAPI takes too long
Bug 632670 - Chain-on-update logs managed-entries-plugin errors
Bug 621008 - parsing purge RUV from changelog at startup fails
Bug 663191 - Don't use $USER in DSCreate.pm
Bug 663597 - Memory leaks in normalization code
Bug 659131 - Incorrect RDN values added with multi-valued RDN
Bug 661102 - Rename of managed entries not handled correctly
Bug 193297 - Call pre-bind plug-ins for all SASL bind steps
Bug 201652 - LDAPv2 bind with expired password doesn't unbind correctly
Bug 470576 - Migration could do addition checks before commiting actions
Bug 481195 - Missing op type in log when password change required
Bug 509897 - Validate dnaScope to ensure it is a legal DN
Bug 505722 - Allow ntGroup to have mail attribute present
Bug 543633 - replication problems if supplier is killed under update load
Bug 671033 - range sharing between server breaks with SASL/GSSAPI auth
Bug 527912 - setup-ds.pl appears to hang when DNS is unreachable
Bug 252249 - Add pkg-config file for plug-in developers
Bug 670616 - Allow SSF to be set for local (ldapi) connections
Bug 668862 - init scripts return wrong error code
Bug 674430 - Improve error messages for attribute uniqueness
Bug 675853 - dirsrv crash segfault in need_new_pw()
Bug 678646 - Ignore tombstone operations in managed entry plug-in
Bug 671199 - Don't allow other to write to rundir
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 674852 - crash in ldap-agent when using OpenLDAP
Bug 681345 - setup-ds.pl should set SuiteSpotGroup automatically
Bug 680558 - Winsync plugin fails to restrain itself to the configured subtree
Bug 504803 - Allow maxlogsize to be set if logmaxdiskspace is -1
Bug 687974 - (cov#10715) Fix Coverity uninitialized variables issues
Bug 688341 - (cov#10709) Fix Coverity code maintainability issues
Bug 688341 - (cov#10708) Fix Coverity code maintainability issues
Bug 688341 - (cov#10706,10707) Fix Coverity code maintainability issues
Bug 688341 - (cov#10704,10705) Fix Coverity code maintainability issues
Bug 688341 - (cov#10703) Fix Coverity code maintainability issues
Bug 688341 - (cov#10702) Fix Coverity code maintainability issues
Bug 688341 - (cov#10709) Fix Coverity code maintainability issues
Bug 689537 - (cov#10699) Fix Coverity NULL pointer dereferences
Bug 689537 - (cov#10610) Fix Coverity NULL pointer dereferences
Bug 689537 - (cov#10608) Fix Coverity NULL pointer dereferences
Bug 689952 - (cov#10581) Incorrect bit check in replication connection code
Bug 690526 - (cov#10734) Double free in dse_add()
Bug 690649 - (cov#10731) Use of free'd pointer in indexing code
Bug 690882 - (cov#10571) Incorrect sizeof use in uuid code
Bug 690882 - (cov#10636,10637) Useless comparison in attrcrypt
Bug 690882 - (cov#10703) Incorrect sizeof use in vattr code
Bug 690882 - (cov#10572,10710) Incorrect sizeof use in uuid code
Bug 691574 - (cov#10579) Check return value of ber_scanf() in sort code
Bug 691574 - (cov#10577) Check return types when adding RDN CSNs
Bug 691574 - (cov#10573) check return value in GER code
Bug 691574 - (cov#10575) Check return value of ldap_get_option
Bug 691574 - (cov#10573) Fix syntax error
Bug 693868 - Add managed entry config during in-place upgrade
Add Auto Membership Plug-in
Bug 698428 - Make auto membership use Slapi_DN for DN comparisons
Bug 695779 - windows sync can lose old values when a new value is added
Bug 700557 - Linked attrs callbacks access free'd pointers after close
Bug 700557 - Leak at shutdown in DNA plug-in
Bug 703304 - Auto membership alternate config area should override default area
Bug 703304 - Auto membership alternate config area should override default area
Bug 703530 - Allow Managed Entry config to be relocated
Bug 697961 - memberOf needs to be triggered by internal operations
Bug 710377 - Import with chain-on-update crashes ns-slapd
Split automember regex rules into separate entries
Bug 713209 - Update sudo schema
Bug 691313 - Need TLS/SSL error messages in repl status and errors log
Bug 723937 - Slapi_Counter API broken on 32-bit F15
Bug 725743 - Make memberOf use PRMonitor for it's operation lock
Bug 729717 - Fatal error messages when syncing deletes from AD
Bug 728510 - Run dirsync after sending updates to AD
Bug 730387 - Add slapi_rwlock API and use POSIX rwlocks
Bug 611438 - Add Account Usability Control support
Bug 728592 - Allow ns-slapd to start with an invalid server cert
Bug 732541 - Ignore error 32 when adding automember config
Bug 722292 - Entries in DS are not updated properly when using WinSync API
Bug 722292 - (cov#11030) Leak of mapped_sdn in winsync rename code
Bug 735114 - renaming a managed entry does not update mepmanagedby
Bug 739172 - Allow separate fractional attrs for incremental and total protocols
Bug 743966 - Compiler warnings in account usability plugin
Bug 744946 - (cov#11046) NULL dereference in IDL code
Bug 752155 - Use restorecon after creating init script lock file
Ticket 284 - Remove unnecessary SNMP MIB files
ticket 304 - Fix kernel version checking in dsktune
ticket 211 - Use of uninitialized variables in ldbm_back_modify()
ticket 181 - Allow PAM passthru plug-in to have multiple config entries
coverity 12563 Read from pointer after free (fix 2)
Ticket 211 - Avoid preop range requests non-DNA operations
Ticket #503 - Improve AD version in winsync log message
Ticket 549 - DNA plugin no longer reports additional info when range is depleted
Ticket 556 - Don't overwrite certmap.conf during upgrade
Add make rpms build target
Allow rpm builds to be run without configure
Add git commit hash to developer rpm build names
Add hardened build option and correct changelog dates
Revert "Ticket #47431 - Duplicate values for the attribute nsslapd-pluginarg are not handled correctly"
Ticket 449 - Allow macro aci keywords to be case-insensitive
Ticket 47539 - Disabling DNA plug-in throws error 53
Ticket 47513 - tmpfiles.d references /var/lock when they should reference /run/lock
Ticket 47565 - Content Sync update file needs extensibleObject
Ticket 47569 - ACIs do not allow attribute subtypes in targetattr keyword
Ticket 47569 - Fix build warnings
Ticket 47588 - Compiler warnings building on F19
Ticket 47611 - Add script to build patched RPMs
Ticket 47525 - Don't modify preop entry in memberOf config
Ticket 47752 - Don't add unhashed password mod if we don't have an unhashed value
Ticket 47753 - Add switch to disable pre-hashed password checking
Noriko Hosoi (628):
544089 - Referential Integrity Plugin does not take into account the attribute
557224 - subtree rename breaks the referential integrity plug-in
247413 - Incorrect error on multiple identical value add
559016 - Attempting to rename suffix returns inappropriate errors
555577 - Syntax validation fails for "ou=NetscapeRoot" tree
Undo - 555577 - Syntax validation fails for "ou=NetscapeRoot" tree
560827 - Admin Server templates: DistinguishName validation fails
548535 - memory leak in attrcrypt
563365 - Error handling problems in the backend functions
565664 - Incorrect parameter for CACHE_RETURN()
565987 - redhat-ds-base fails to build due to undefined struct
527848 - make sure db upgrade to 4.7 and later works correctly
539618 - Replication bulk import reports Invalid read/write
567370 - dncache: assertion failure in id2entry_delete
548115 - memory leak in schema reload
555970 - missing read lock in the combination of cos and nsview
539618 - Replication bulk import reports Invalid read/write
570667 - MMR: simultaneous total updates on the masters cause
Merge branch '547503'
Revert "Merge branch '547503'"
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
199923 - subtree search fails to find items under a db
570107 - The import of LDIFs with base-64 encoded DNs fails,
572649 - DS8.2 crashes on RHEL 4 (corresponding to bob, ber_2 test case)
573060 - DN normalizer: ESC HEX HEX is not normalized (
573896 - initializing subtree with invalid syntax crashes ns-slapd
515805 - Stop "initialize Database" crashes the server
548533 - memory leak in Repl_5_Inc_Protocol_new
Fixing a syntax error
Update to New DN Format
585905 - ACL with targattrfilters error crashes the server
574167 - An escaped space at the end of the RDN value is not
590931 - rhds81 import - hardcoded pages_limit for nsslapd-import-cache-autosize
591336 - Implementing upgrade DN format tool
593453 - Creating password policy with ns-newpolicy.pl on Replicated
593110 - backup-restore does not ALWAYS work
593899 - adding specific ACI causes very large mem allocate request
588867 - entryusn plugin fails on solaris
593899 - adding specific ACI causes very large mem allocate request
595893 - Base DN in SASL mapping is not normalized
511112 - Password history limited to 25 values
597375 - Deleting LDBM database causes backup/restore problem
574101 - MODRDN request never returns - possible deadlock
606920 - anonymous resource limit - nstimelimit -
605827 - In-place upgrade: upgrade dn format should not run in setup-ds-admin.pl
578296 - Attribute type entrydn needs to be added when subtree
609256 - Selinux: pwdhash fails if called via Admin Server CGI
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
609255 - fix coverity Defect Type: Memory - illegal accesses issues
616618 - 389 v1.2.5 accepts 2 identical entries with different DN formats
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
610281 - fix coverity Defect Type: Control flow issues
616608 - SIGBUS in RDN index reads on platforms with strict alignments
619595 - Upgrading sub suffix under non-normalized suffix disappears
513166 - Simple Paged result doesn't provide the server's estimate
621928 - Unable to enable replica (rdn problem?) on 1.2.6 rc6
Bug 194531 - db2bak is too noisy
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622628 - fix coverity Defect Type: Integer handling issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 622903 - fix coverity Defect Type: Code maintainability issues
Bug 623118 - Simplepaged results going in infinite loop
Bug 614511 - fix coverity Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 619122 - fix coverity Defect Type: Resource leaks issues CID 11975 - 12051
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 617630 - fix coverity Defect Type: Resource leaks issues CID 12052 - 12093
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 616500 - fix coverity Defect Type: Resource leaks issues CID 12094 - 12136
Bug 614511 - fix coverify Defect Type: Null pointer dereferences issues 11846 - 11891
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892 - 11939
Bug 613056 - fix coverify Defect Type: Null pointer dereferences issues 11892
Bug 616500 - fix coverity Defect Type: Resource leaks issues
Bug 623507 - fix coverity Defect Type: Incorrect expression issues
Bug 623507 - fix coverity Defect Type: Incorrect expression issues
Bug 613056 - fix coverify Defect Type: Null pointer dereferences
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 610119 - fix coverify Defect Type: Null pointer dereferences issues 12167 - 12199
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Bug 611790 - fix coverify Defect Type: Null pointer dereferences issues 11940 - 12166
Removed redundant code in agmt_new_from_entry
Bug 617630 - fix coverify Defect Type: Resource leaks issues CID 12052 - 12093
Bug 628300 - DN is not normalized in dn/entry cache when an entry is added, entrydn is not present in search results
Bug 531642 - EntryUSN: RFE: a configuration option to make entryusn "global"
Bug 627738 - The cn=monitor statistics entries for the dnentry cache do not change or change very rarely
DN normalizer should check the invalid type
Bug 627738 - The cn=monitor statistics entries for the dnentry cache
Bug 629710 - escape_string does not check '\<HEX><HEX>'
agmtlist_shutdown (repl5_agmtlist.c) had an illegal access defect.
Bug 633168 - Share backend dbEnv with the replication changelog
Bug 633168 - Share backend dbEnv with the replication changelog
Bug 631862 - crash - delete entries not in cache + referint
Bug 625014 - SubTree Renames: ModRDN operation fails and the server hangs if the entry is moved to "under" the same DN.
Bug 558099 - Enhancement request: Log more information about the search result being a paged one
Bug 635987 - Incorrect sub scope search result with
Bug 606920 - anonymous resource limit- nstimelimit -
Bug 635987 - Incorrect sub scope search result with ACL containing ldap:///self
Bug 639289 - Adding a new CN entry with UpperCase UTF-8 Character
Bug 640027 - Naming attribute with a special char sequence parsing bug
Bug 640854 - changelog db: _cl5WriteOperation: failed to
Bug 637852 - sasl_io_start_packet: failed - read only 3 bytes
Bug 586966 - Sample update script has syntax errors
Bug 586973 - Sample update ldif points to non-existent directory
Bug 602456 - Allow to add any cn=config attributes;
Bug 244229 - targetattr not verified against schema when setting an aci
Bug 643532 - Incorrect DNs sometimes returned on searches
Bug 592397 - Upgrade tool dn2rdn: it does not clean up
Bug 645061 - Upgrade: 06inetorgperson.ldif and 05rfc4524.ldif
Bug 629681 - Retro Changelog trimming does not behave as expected
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 644608 - RHDS 8.1->8.2 upgrade fails to properly migrate ACIs
Bug 638773 - permissions too loose on pid and lock files
Bug 491733 - dbtest crashes
Bug 329751 - "nested" filtered roles searches candidates more
Bug 567282 - server can not abandon searchRequest of "simple paged results"
Bug 572018 - Upgrading from 1.2.5 to 1.2.6.a2 deletes userRoot
Bug 651571 - When attrcrypt is on, entrydn is stored in the backend db
Bug 661918 - 389-ds MMR plugin's changelogdb path logic is incorrect
Bug 182507 - clear-password mod from replica is discarded before changelogged
Bug 602456 - Allow to add any cn=config attributes;
Bug 489379 - passwordExpirationTime in entry being added
Bug 663484 - Entry usn plugin fails to properly tag entries on initialization
Bug 664563 - GER: ger for non-present entry is not correct
Bug 653007 - db2ldif export of clear text passwords lacks storage scheme
Bug 667488 - Cannot recreate numsubordinates index with db2index
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 615100 - log rotationinfo always recreated at startup,
Bug 624442 - MMR: duplicate replica ID
Bug 669205 - db2bak: backed up changelog should include RUVs
Bug 616850 - ldapmodify failed to reject the replace operation
Bug 627993 - Inconsistent storage of password expiry times
Bug 627993 - Inconsistent storage of password expiry times
dn2rdn should respect the DB version info
Bug 646381 - Faulty password for nsmultiplexorcredentials does not give any error message in logs
Bug 624547 - attrcrypt should query the given slot/token for
Bug 668619 - slapd stops responding
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
Bug 615052 - intrinsics and 64-bit atomics code fails to compile
Bug 616213 - insufficient stack size for HP-UX on PA-RISC
Bug 675265 - preventryusn gets added to entries on a failed delete
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 676053 - export task followed by import task causes cache assertion
Bug 676053 - export task followed by import task causes cache assertion
Bug 676053 - export task followed by import task causes cache assertion
Bug 450016 - RFE- Console display values in KB/MB/GB
Cancelling commit aef19508c4f618285116d2068655183658f564d9
Bug 625424 - repl-monitor.pl doesn't work in hub node
Bug 679978 - modifying attr value crashes the server, which is supposed to
Bug 681015 - RFE: allow fine grained password policy duration attributes in days, hours, minutes, as well
Bug 668909 - Can't modify replication agreement in some cases
Bug 684996 - Exported tombstone cannot be imported correctly
Bug 681015 - RFE: allow fine grained password policy duration attributes in days, hours, minutes, as well
Bug 689866 - ns-newpwpolicy.pl needs to use the new DN format
Bug 690955 - Mrclone fails due to the replica generation id mismatch
Bug 696407 - If an entry with a mixed case RDN is turned to be
Bug 697027 - 1 - minor memory leaks found by Valgrind + TET
Bug 697027 - 2 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 697027 - 4 - minor memory leaks found by Valgrind + TET
Bug 697027 - 5 - minor memory leaks found by Valgrind + TET
Bug 697027 - 6 - minor memory leaks found by Valgrind + TET
Bug 697027 - 7 - minor memory leaks found by Valgrind + TET
Bug 697027 - 8 - minor memory leaks found by Valgrind + TET
Bug 697027 - 9 - minor memory leaks found by Valgrind + TET
Bug 697027 - 10 - minor memory leaks found by Valgrind + TET
Bug 697027 - 11 - minor memory leaks found by Valgrind + TET
Bug 697027 - 12 - minor memory leaks found by Valgrind + TET
Bug 697027 - 13 - minor memory leaks found by Valgrind + TET
Bug 697027 - 14 - minor memory leaks found by Valgrind + TET
Bug 697027 - 15 - minor memory leaks found by Valgrind + TET
Bug 697027 - 16 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 697027 - 3 - minor memory leaks found by Valgrind + TET
Bug 700215 - ldclt core dumps
Bug 668619 - slapd stops responding
Bug 709826 - Memory leak: when extra referrals configured
Bug 706179 - DS can not restart after create a new objectClass has entryusn attribute
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
Bug 718303 - Intensive updates on masters could break the consumer's cache
Merge branch '718303'
Bug 719069 - clean up compiler warnings in 389-ds-base 1.2.9
Bug 712855 - Directory Server 8.2 logs "Netscape Portable
Bug 663752 - Cert renewal for attrcrypt and encchangelog
Bug 732153 - subtree and user account lockout policies implemented?
Introducing an environment variable USE_VALGRIND to clean up the entry cache and dn cache on exit.
Bug 744945 - nsslapd-counters attribute value cannot be set to "off"
Keep unhashed password psuedo-attribute in the adding entry
Reduce the number of DN normalization
Bug 745259 - Incorrect entryUSN index under high load
Bug 750622 - Fix Coverity (11104) Resource leak:
Bug 750624 - Fix Coverity (11053) Explicit null dereferenced:
Bug 750625 - Fix Coverity (11066) Unused pointer value
Bug 750625 - Fix Coverity (11065) Uninitialized pointer read
Bug 750625 - Fix Coverity (11064) Dereference before null check
Bug 750625 - Fix Coverity (11061) Resource leak
Bug 750625 - Fix Coverity (11060) Dereference null return value
Bug 750625 - Fix Coverity (11058, 11059) Dereference null return value
Bug 750625 - Fix Coverity (11057) Dereference null return value
Bug 750625 - Fix Coverity (11055) Explicit null dereferenced
Bug 750625 - Fix Coverity (11054) Dereference after null check
Bug 750625 - Fix Coverity (11117) Uninitialized pointer read
Bug 750625 - Fix Coverity (11116) Uninitialized pointer read
Bug 750625 - Fix Coverity (11114, 11115) Uninitialized value use
Bug 750625 - Fix Coverity (11113) Uninitialized pointer read
Bug 750625 - Fix Coverity (11112) Uninitialized pointer read
Bug 750625 - Fix Coverity (11109, 11110, 11111) Uninitialized pointer read
Bug 750625 - Fix Coverity (11108) Sizeof not portable
Bug 750625 - Fix Coverity (11107) Dereference before null check
Bug 750625 - Fix Coverity (11096) Explicit null dereferenced
Bug 750625 - Fix Coverity (11095) Explicit null dereferenced
Bug 750625 - Fix Coverity (11094) Dereference after null check
Bug 750625 - Fix Coverity (11091) Unchecked return value
Bug 750625 - Fix Coverity (11055-2) Explicit null dereferenced
Bug 750625 - Fix Coverity (11062) Resource leak
Bug 750625 - Fix Coverity (11066-2) Unused pointer value
Bug 750625 - Fix Coverity (12195) Dereference after null check
Bug 750625 - Fix Coverity (12196) Dereference before null check
Bug 750625 - Fix Coverity (11066-3) Unused pointer value
Bug 745259 - Incorrect entryUSN index under high load in
Trac Ticket 2 - If node entries are tombstone'd,
Trac Ticket 2 - If node entries are tombstone'd,
Trac Ticket 26 - Please support setting
Trac Ticket 75 - Unconfigure plugin opperations are being called.
Trac Ticket 168 - minssf should not apply to rootdse
Trac Ticket #18 - Data inconsitency during replication
Trac Ticket #52 - FQDN set to nsslapd-listenhost
Trac Ticket 139 - eliminate the use of char *dn in favor of Slapi_DN *dn
Trac Ticket 35 - Log not clear enough on schema errors
Trac Ticket #274 - Reindexing entryrdn fails if
Trac Ticket #275 - Invalid read reported by valgrind
Trac Ticket 51 - memory leaks in 389-ds-base-1.2.8.2-1.el5?
Trac Ticket #27 - SASL/PLAIN binds do not work
Trac Ticket #84 - 389 Directory Server Unnecessary Checkpoints
Trac Ticket #169 - allow 389 to use db5
Trac Ticket #34 - remove-ds.pl does not remove everything
Trac Ticket #26 - Please support setting defaultNamingContext in the rootdse.
Trac Ticket #298 - crash when replicating orphaned tombstone entry
Trac Ticket #290 - server hangs during shutdown if betxn pre/post op fails
Trac Ticket #290 - server hangs during shutdown if betxn pre/post op fails
Minor bug fix introcuded by commit 69c9f3bf7dd9fe2cadd5eae0ab72ce218b78820e
Trac Ticket #260 - 389 DS does not support multiple
Fixing compiler warnings
Trac Ticket #303 - make DNA range requests work with transactions
coverity 12606 Logically dead code
Trac Ticket #46 - setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 (revised) - setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 - (take 3) setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #46 - (additional) setup-ds-admin.pl does not
Trac Ticket #45 - Fine Grained Password policy:
Trac Ticket #46 - (additional 2) setup-ds-admin.pl does not like ipv6 only hostnames
Trac Ticket #335 - transaction retries need to be cache aware
Trac Ticket #338 - letters in object's cn get converted to
Trac Ticket #310 - Avoid calling escape_string() for logged DNs
Trac Ticket #19 - Convert entryUSN plugin to transaction aware type
Trac Ticket #345 - db deadlock return should not log error
Trac Ticket #359 - Database RUV could mismatch the one in changelog under the stress
Trac Ticket #359 - Database RUV could mismatch the one
Trac Ticket #338 - letters in object's cn get converted to
Trac Ticket #335 - transaction retries need to be cache aware
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
Bug 829213 - unhashed#user#password visible after changing password https://bugzilla.redhat.com/show_bug.cgi?id=829213
audit log does not log unhashed password: enabled, by default.
Trac Ticket 396 - Account Usability Control Not Working [Bug 835238]
Trac Ticket #402 - nhashed#user#password in entry extension
Trac Ticket #346 - Slow ldapmodify operation time for large
Trac Ticket #346 - Slow ldapmodify operation time for large
Coverity defects
Conflict definition in SLAPI_ATTR_FLAG macros
Trac Ticket #412 - memberof performance enhancement
Trac Ticket #409 - Report during startup if nsslapd-cachememsize is too small
Ticket 328 - make sure all internal search filters are properly escaped
Ticket 328 - make sure all internal search filters are properly escaped
Trac Ticket #346 - Slow ldapmodify operation time for large
Trac Ticket #437 - variable dn should not be used in ldbm_back_delete
Coverity defects
Trac Ticket #340 - Change on SLAPI_MODRDN_NEWSUPERIOR is not
Trac Ticket #466 - entry_apply_mod - ADD: Failed to set
Coverity defects
Trac Ticket #470 - 389 prevents from adding a posixaccount
Coverity defects
Trac Ticket #453 - db2index with -tattrname:type,type fails
Trac Ticket #351 - use betxn plugins by default
Bug 863576 - Dirsrv deadlock locking up IPA
Trac Ticket #455 - Insufficient rights to unhashed#user#password
Trac Ticket #451 - Allow db2ldif to be quiet
Coverity defects
Fixing compiler warnings in the posix-winsync plugin
Trac Ticket #494 - slapd entered to infinite loop during new index addition
Coverity defects
Trac Ticket #498 - Cannot abaondon simple paged result search
Trac Ticket #448 - Possible to set invalid macros in Macro ACIs
Trac Ticket #391 - Slapd crashes when deleting backends
Coverity fixes
Trac Ticket #190 - Un-resolvable server in replication
Trac Ticket #443 - Deleting attribute present in
Trac Ticket #447 - Possible to add invalid attribute
Trac Ticket #311 - IP lookup failing with multiple DNS
Trac Ticket #500 - Newly created users with
Trac Ticket #519 - Search with a complex filter including range search is slow
Trac Ticket #520 - RedHat Directory Server crashes (segfaults) when moving ldap entry
Coverity defect: Resource leak 13110
Trac Ticket #276 - Multiple threads simultaneously working on
Trac Ticket #531 - loading an entry from the database should use str2entry_fast
Trac Ticket #536 - Clean up compiler warnings for 1.3
Trac Ticket #531 - loading an entry from the database should use str2entry_f
Trac Ticket #499 - Handling URP results is not corrrect
bump version to 1.3.0.rc1
Trac Ticket #522 - betxn: upgrade is not implemented yet
Ticket 509 - lock-free access to be->be_suffixlock
Trac Ticket #497 - Escaped character cannot be used in the substring search filter
Ticket #422 - 389-ds-base - Can't call method "getText"
Ticket #547 - Incorrect assumption in ndn cache
Ticket #545 - Segfault during initial LDIF import: str2entry_dupcheck()
Ticket #542 - Cannot dynamically set nsslapd-maxbersize
Ticket #537 - Improvement of range search
Ticket #342 - better error message when cache overflows
Ticket #505 - use lock-free access name2asi and oid2asi tables (additional)
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #502 - setup-ds.pl script should wait if "semanage.trans.LOCK" presen
Ticket #563 - DSCreate.pm: Error messages cannot be used in the if expression since they could be localized.
Ticket #533 - only scan for attributes to decrypt if there are encrypted attrs configured
Ticket #543 - Sorting with attributes in ldapsearch gives incorrect result
Ticket #572 - PamConfig schema not updated during upgrade
Ticket #576 - DNA: use event queue for config update only at the start up
Ticket #579 - Error messages encountered when using POSIX winsync
Ticket #584 - Existence of an entry is not checked when its password is to be deleted
bump version to 1.3.1.pre.a1
Ticket #561 - disable writing unhashed#user#password to changelog
Coverity Fix
Ticket #490 - Slow role performance when using a lot of roles
Ticket #603 - A logic error in str2simple
Ticket #604 - Required attribute not checked during search operation
Ticket #585 - Behaviours of "db2ldif -a <filename>" and "db2ldif.pl -a <filename>" are inconsistent
Fixing a compiler warning introduced by Ticket #561 - disable writing unhashed#user#password to changelog
Ticket #634 - Deadlock in DNA plug-in
Ticket #627 - ns-slapd crashes sporadically with segmentation fault in libslapd.so
Ticket #47308 - unintended information exposure when anonymous access is set to rootdse
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
Ticket #618 - Crash at shutdown while stopping replica agreements
Ticket 458 - Need to properly check if the password admin dn is set
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #608 - Posix Winsync plugin throws "posix_winsync_end_update_cb: failed to add task entry" error message
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket 623 - cleanAllRUV task fails to cleanup config upon completion
bump version to 1.3.2.pre.a1
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket 528 - RFE - get rid of instance specific scripts
Ticket #47330 - changelog db extension / upgrade is obsolete
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #47313 - Indexed search with filter containing '&' and "!" with attribute subtypes gives wrong result
Ticket #47330 - changelog db extension / upgrade is obsolete
Ticket #47347 - Simple paged results should support async search
Ticket #529 - dn normalization must handle multiple space characters in attributes
Ticket #47320 - put conn on work_q not poll list if conn has buffered more_data
Ticket 47331 - Self entry access ACI not working properly
Ticket #529 - dn normalization must handle multiple space characters in attributes
Coverity fix -- 13164: Logically dead code
Ticket #47343 - 389-ds-base: Does not support aarch64 in f19 and rawhide
Ticket #47327 - error syncing group if group member user is not synced
Ticket #428 - posix winsync should support ADD user/group entries from DS to AD
Trac Ticket #402 - nhashed#user#password in entry extension
Ticket #569 - examine replication code to reduce amount of stored state information
Ticket 47379 - DNA plugin failed to fetch replication agreement
Ticket #47391 - deleting and adding userpassword fails to update the password
Ticket #47391 - deleting and adding userpassword fails to update the password (additional fix)
Ticket #47400 - MMR stress test with dna enabled causes a deadlock
Ticket #47384 - Plugin library path validation
Ticket #47374 - flush.pl is not included in perl5
Ticket #47420 - An upgrade script 80upgradednformat.pl fails to handle a server instance name incuding '-'
Ticket #47419 - Unhashed userpassword can accidentally get removed from mods
Ticket #47384 - Plugin library path validation
Ticket #47367 - (phase 1) ldapdelete returns non-leaf entry error while trying to remove a leaf entry
Ticket #47367 - (phase 2) ldapdelete returns non-leaf entry error while trying to remove a leaf entry
Ticket #47435 - Very large entryusn values after enabling the USN plugin and the lastusn value is negative.
Ticket #521 - modrdn + NSMMReplicationPlugin - Consumer failed to replay change
Ticket #47378 - fix recent compiler warnings
Ticket #630 - The backend name provided to bak2db is not validated
Ticket #415 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist
Ticket #47314 - Winsync should support range retrieval
Ticket #47310 - Attribute "dsOnlyMemberUid" not allowed when syncing nested posix groups from AD with posixWinsync
Ticket #48 - Active Directory has certain uids which are reserved and will cause a Directory Server replica initialization of an AD server to abort.
Ticket #609 - nsDS5BeginReplicaRefresh attribute accepts any value and it doesn't throw any error when server restarts.
Ticket #197 - BDB backend - clear free page files to reduce changelog size
Ticket #48 - Active Directory has certain uids which are reserved and will cause a Directory Server replica initialization of an AD server to abort.
Ticket #460 - support multiple subtrees and filters
coverity 11956 - Dereference after null check
Ticket #47492 - PassSync removes User must change password flag on the Windows side
Ticket #47523 - Set up replcation/agreement before initializing the sub suffix, the sub suffix is not found by ldapsearch
Ticket #47534 - RUV tombstone search with scope "one" doesn`t work
Ticket #47463 - IDL-style can become mismatched during partial restoration
Coverity fixes - 12023, 12024, and 12025
Ticket #54 - locale "nl" not supported by collation plugin
Ticket #53 - Need to update supported locales
Ticket #53 - Need to update supported locales
Ticket #53 - Need to update supported locales
Ticket #47530 - dbscan on entryrdn should show all matching values
Ticket #47422 - With 1.3.04 and subtree-renaming OFF, when a user is deleted after restarting the server, the same entry can't be added
Ticket #47530 - dbscan on entryrdn should show all matching values
Ticket #538 - hardcoded sasl2 plugin path in ldaputil.c, saslbind.c
Ticket #47555 - db2bak.pl issue when specifying non-default directory
Ticket #47581 - Winsync plugin segfault during incremental backoff
Ticket #47581 - Winsync plugin segfault during incremental backoff (phase 2)
Ticket #605 - support TLS 1.1
Ticket #605 - support TLS 1.1 - adding backward compatibility
Ticket #342 - better error message when cache overflows (phase 2)
Ticket #605 - support TLS 1.1 - lower the log level for the supported NSS version range
Ticket #605 - support TLS 1.1 - Fixing "Coverity 12415 - Logically dead code"
Ticket #47313 - Indexed search with filter containing '&' and "!" with attribute subtypes gives wrong result
Ticket #47606 - replica init/bulk import errors should be more verbose
Ticket #447 - Possible to add invalid attribute to nsslapd-allowed-to-delete-attrs
Ticket #47571 - targetattr ACIs ignore subtype
Revert "Ticket 47653 - Need a way to allow users to create entries assigned to themselves"
Ticket #47660 - config_set_allowed_to_delete_attrs: Valgrind reports Invalid read
Ticket #47571 - targetattr ACIs ignore subtype
Ticket #342 - better error message when cache overflows
Ticket #443 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error
Ticket #47649 - Server hangs in cos_cache when adding a user entry
Ticket #47659 - ldbm_usn_init: Valgrind reports Invalid read / SIGSEGV
Ticket #47570 - slapi_ldap_init unusable during independent plugin development
Ticket #47693 - Environment variables are not passed when DS is started via service
Ticket #47677 - Size returned by slapi_entry_size is not accurate
Ticket #47608 - change slapi_entry_attr_get_bool to handle "on"/"off" values, support default value
Ticket #47602 - Make ldbm_back_seq independently support transactions
Ticket #47642 - Windows Sync group issues
Ticket #47701 - Make retro changelog trim interval programmable
Ticket #47701 - Make retro changelog trim interval programmable
Ticket #47700 - Unresolved external symbol references break loading of the ACL plugin
Ticket #47709 - package issue in 389-ds-base
Ticket #47709 - package issue in 389-ds-base
Ticket #47709 - package issue in 389-ds-base
Ticket #47701 - Make retro changelog trim interval programmable
Ticket 525 - Replication retry time attributes cannot be added
Ticket 408 - create a normalized dn cache
Ticket 571 (dup 47361) - Empty control list causes LDAP protocol error is thrown
Ticket 408 - create a normalized dn cache
Ticket #47725 - compiler error on daemon.c
Ticket #47735 - e_uniqueid fails to set if an entry is a conflict entry
Ticket #47737 - Under heavy stress, failure of turning a tombstone into glue makes the server hung
Ticket #47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind
Ticket #47734 - Change made in resolving ticket #346 fails on Debian SPARC64
Ticket #47740 - Coverity issue in 1.3.3
Ticket #47735 - e_uniqueid fails to set if an entry is a conflict entry
Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check
Ticket #346 - Slow ldapmodify operation time for large quantities of multi-valued attribute values
Ticket #47707 - 389 DS Server crashes and dies while handles paged searches from clients
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing;
Ticket #47764 - Problem with deletion while replicated
Ticket #47780 - Some VLV search request causes memory leaks
Ticket #47804 - db2bak.pl error with changelogdb
Ticket #47720 - Normalization from old DN format to New DN format doesnt handel condition properly when there is space in a suffix after the seperator operator.
Ticket #47770 - #481 breaks possibility to reassemble memberuid list
Ticket #47808 - If be_txn plugin fails in ldbm_back_add, adding entry is double freed.
Ticket 47313 - CI test: add test case for ticket 47313
Ticket 47808 - CI test: add test case for ticket 47808
Ticket #47809 - find a way to remove replication plugin errors messages "changelog iteration code returned a dummy entry with csn %s, skipping ..."
Ticket #555 - add fixup-memberuid.pl script
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47763 - winsync plugin modify is broken
Ticket #47835 - Coverity: 12687..12692
Ticket #47835 - Coverity: 12687..12692
Ticket #47835 - Coverity: 12687..12692
Ticket #47835 - Coverity: 12687..12692
Ticket #47835 - Coverity: 12687..12692
Ticket #47835 - Coverity: 12687..12692
Ticket #47835 - Coverity: 12687..12692
Ticket #47839 - 389-ds production segfault: __memcpy_sse2_unaligned...
Revert "Ticket #47835 - Coverity: 12687..12692"
Revert "Ticket #47835 - Coverity: 12687..12692"
Revert "Ticket #47835 - Coverity: 12687..12692"
Revert "Ticket #47835 - Coverity: 12687..12692"
Revert "Ticket #47835 - Coverity: 12687..12692"
Revert "Ticket #47835 - Coverity: 12687..12692"
Revert "Ticket #47835 - Coverity: 12687..12692"
Ticket #47852 - Updating winsync one-way sync does not affect the behaviour dynamically
Ticket #47832 - attrcrypt_generate_key calls slapd_pk11_TokenKeyGenWithFlags with improper macro
Ticket #47843 - Fix various typos in manpages & code
Ticket #47844 - Fix hyphens used as minus signed and other manpage mistakes
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Revert "Revert "Ticket #47835 - Coverity: 12687..12692""
Ticket #47859 - Coverity: 12692 & 12717
Ticket #47859 - Coverity: 12692 & 12717
Ticket #47711 - improve dbgen rdn generation, output and man page.
Ticket #47746 - ldap/servers/slapd/back-ldbm/dblayer.c: possible minor problem with sscanf
Ticket #47824 - paged results control is not working in some cases when we have a subsuffix.
Ticket 47824 - CI test: add test case for ticket 47824
Ticket #47664 - Page control does not work if effective rights control is specified
Ticket 47664 - CI test: add test case for ticket 47664
Ticket #47714 - [RFE] Update lastLoginTime also in Account Policy plugin if account lockout is based on passwordExpirationTime.
Ticket 47714 - CI test: add test case for ticket 47713
Ticket 47714 - CI test: add test case for ticket 47714
Ticket #346 - Fixing memory leaks
Ticket #47579 - add dbmon.sh
Ticket #47579 - add dbmon.sh
Ticket #47869 - unauthenticated information disclosure (Bug 1123477)
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Ticket 47824 - CI test: add test case for ticket 47824
Ticket 47664 - CI test: add test case for ticket 47664
Ticket #47838 - harden the list of ciphers available by default
Ticket 47838 - CI test: add test case for ticket 47838
Ticket #47838 - harden the list of ciphers available by default
Ticket 47869 - CI test: add test case for ticket 47869
Ticket #47838 - harden the list of ciphers available by default
Ticket #47574 - start dirsrv after ntpd
Ticket #47874 - Performance degradation with scope ONE after some load
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
Revert "Ticket #47875 - dirsrv not running with old openldap"
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Ticket #47876 - coverity defects in slapd/tools/mmldif.c
Ticket #47879 - coverity defects in plugins/replication/windows_protocol_util.c
bump version to 1.3.3.0
Ticket #47875 - dirsrv not running with old openldap
Ticket #47875 - dirsrv not running with old openldap
bump version to 1.3.3.1
Ticket #47748 - Simultaneous adding a user and binding as the user could fail in the password policy check
Ticket #47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Ticket #47890 - minor memory leaks in utilities
Ticket #47838 - harden the list of ciphers available by default
Ticket 47838,47895 - CI test: add test cases for ticket 47838 and 47895
Ticket #47895 - If no effective ciphers are available, disable security setting.
bump version to 1.3.3.2
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing
Ticket #47907 - ldclt: assertion failure with -e "add,counteach" -e "object=<ldif file>,rdn=uid:test[A=INCRNNOLOOP(0;24
Ticket #47908 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server
Ticket #47838 - harden the list of ciphers available by default (phase 2)
Ticket 47838 - CI test: adjusted test cases based on the phase 2 fixes for ticket 47838
Ticket #47880 - provide enabled ciphers as search result
Ticket 47880 - CI test: added test cases for ticket 47880
bump version to 1.3.3.4
Ticket #47892 - coverity defects found in 1.3.3.x
Ticket #47919 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails.
Ticket #47912 - Proper handling of "No original_tombstone for changenumber" errors
Ticket #47897 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten
Ticket #47922 - dynamically added macro aci is not evaluated on the fly
bump version to 1.3.3.5
Ticket #47553 - Enhance ACIs to have more control over MODRDN operations
Ticket #47928 - Disable SSL v3, by default.
Ticket 47928 - CI test: added test cases for ticket 47928
Ticket #47928 - Disable SSL v3, by default.
Ticket #47939 - Malformed cookie for LDAP Sync makes DS crash
Ticket #47945 - Add SSL/TLS version info to the access log
Ticket #47948 - ldap_sasl_bind fails assertion (ld != NULL) if it is called from chainingdb_bind over SSL/startTLS
Ticket #47928 - Disable SSL v3, by default.
Ticket #47960 - cookie_change_info returns random negative number if there was no change in a tree
Ticket #47960 - cookie_change_info returns random negative number if there was no change in a tree
Ticket #47935 - Error: failed to open an LDAP connection to host 'example.org' port '389' as user 'cn=Directory Manager'. Error: unknown.
Ticket 47965 - Fix coverity issues (2014/12/16)
Ticket #47947 - start dirsrv after chrony on RHEL7 and Fedora
Ticket #47905 - Bad manipulation of passwordhistory
Ticket #47934 - nsslapd-db-locks modify not taking into account.
Ticket #47989 - Windows Sync accidentally cleared raw_entry
Ticket #47996 - ldclt needs to support SSL Version range
Ticket 47988: Schema learning mechanism, in replication, unable to extend an existing definition
Coverity 12970 - Explicit null dereference
bump version to 1.3.3.7
Petr Viktorin (1):
Ticket 47899: Fix slapi_td_plugin_lock_init prototype
Rich Megginson (465):
Net::LDAP password modify extop breaks; msgid in response is 0xFF
Clean up assert for entrydn
Bug 543080 - Bitwise plugin fails to return the exact matched entries for Bitwise search filter
Bug 537466 - nsslapd-distribution-plugin should not require plugin name to begin with "lib"
bump version to 1.2.6.a2
Do not use syntax plugins directly for filters, indexing
wrap new style matching rule plugins for use in old style indexing code
change extensible filter code to use new syntax function style mr funcs
change syntax plugins to register required matching rule plugins
crash looking up compat syntax; numeric string syntax using integer; make octet string ordering work correctly
fix memory leak in attr replace when replacement fails
fix dso linking issues found by fedora 13 linking
problems linking with -z defs
389 DS segfaults on libsyntax-plugin.so - part 1
389 DS segfaults on libsyntax-plugin.so - part 2
389 DS segfaults on libsyntax-plugin.so - part 3
Bug 460162 - FedoraDS "with-FHS" installs init.d StartupScript in wrong location on non-RHEL/Fedora OS
Bug 568196 - Install DS8.2 on Solaris fails
Bug 568196 - Install DS8.2 on Solaris fails - part 2
Bug 551198 - LDAPI: incorrect logging to access log
bump version to 1.2.6.a3
fix various memory leaks
Bug 551198 - LDAPI: incorrect logging to access log - part 2
Bug 554573 - ACIs use bind DN from bind req rather than cert mapped DN from sasl/external
cleanup build warnings
Bug 571514 - upgrade to 1.2.6 should upgrade 05rfc4523.ldif (cert schema)
Bug 570905 - postalAddress syntax should allow empty lines (should allow $$)
Add support for additional schema/matching rules included with 389
Bug 572677 - Memory leak in searches including GER control
Bug 571677 - Busy replica on consumers when directly deleting a replication conflict
Bug 576074 - search filters with parentheses fail
Bug 567429 - slapd didn't close connection and get into CLOSE_WAIT state
Bug 578167 - repl. of mod/replace deletes multi-valued attrs
Bug 561575 - setup-ds-admin fails to supply nsds5ReplicaName when configuring via ConfigFile
Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements.
Bug 576644 - segfault while multimaster replication (paired node won't find deleted entries)
start of 1.2.6.a4
Bug 572018 - Upgrading from 1.2.5 to 1.2.6.a2 deletes userRoot
Fix too few args for format warning in acllas
Bug 586571 - DS Console shows escaped DNs
Bug 591685 - Server instances Fail to Start on Solaris due to Library Path and pcre
bump console version to 1.2.3
Repl Session API needs to check for NULL api before init
Bug 593392 - setup-ds-admin.pl -k creates world readable file
Bug 595874 - 99user.ldif getting overpopulated
bump version to 1.2.6.a5
bump version to 1.2.6.rc1
bump version to 1.2.6.rc2
bump version to 1.2.6.rc3
Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
Bug 604453 - SASL Stress and Server crash: Program quits with the assertion failure in PR_Poll
Bug 603942 - null deref in _ger_parse_control() for subjectdn
bump version to 1.2.6.rc4
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 602530 - coverity: op_shared_modify: compare pre, post and original entries before freeing them
Bug 602531 - coverity: op_shared_delete: compare preop entry and GLUE_PARENT_ENTRY before freeing them
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
Bug 610177 - fix coverity Defect Type: Uninitialized variables issues
Bug 610276 - fix coverity Defect Type: API usage errors issues
Bug 611850 - fix coverity Defect Type: Error handling issues
Bug 614242 - C99/ANSI C++ related compile errors on HP-UX
Bug 547503 - replication broken again, with 389 MMR replication and TCP errors
Bug 617013 - repl-monitor.pl use cpu upto 90%
fix build failures due to libtool problems
Bug 617629 - Missing aliases in new schema files
Bug 617862 - Replication: Unable to delete tombstone errors
bump version to 1.2.7.a1
Bug 610281 - fix coverity Defect Type: Control flow issues - daemon.c:write_function()
Bug 610281 - fix coverity Defect Type: Control flow issues - last repl init status
postalAddress syntax does not accept empty values
ger should support both "dn" and "distinguishedName"
openldap - ldap_url_parse_ext is not part of the public api
fix memleak in ldbm_config_read_instance_entries
Add -x option to ldap tools when using openldap
openldap - add support for missing controls, add ldif api, fix NSS usage
port client tools to use openldap API
use the mozldap versions of the proxy auth control create function
document slapi wrappers for openldap/mozldap functions that differ
fix some compiler warnings
use strcasecmp with ptype and type->bv_val
ber_printf 'o' cannot handle NULL bv_val
fix the url_parse logic when looking for a missing suffix DN
openldap ldapsearch uses -LLL to suppress # version: N
add ldaptool_opts for the non BUNDLE case in Makefile.am
openldap ldapsearch returns empty line at end of LDIF output
have to use LDAP_OPT_X_TLS_NEVER to defeat cert hostname checking
openldap_read_function needs to set EWOULDBLOCK if the buffer is empty
do not terminate unwrapped LDIF line with another newline
slapi_ldap_url_parse must handle multiple host:port in url
convert mozldap host list to openldap uri list
move the out pointer back if continuation lines were removed
check src < *out only; only check for \nspace if src < *out - 2
use slapi_ldap_url_parse in the acl code
do not un-null-terminate normalized DN until new url is constructed
implement slapi_ldap_explode_dn and slapi_ldap_explode_rdn
use slapi_pblock_set to set the ldap result code for the be postop plugins
pass the string copy to slapi_dn_normalize_original
bug 614511 - fix coverity null reference - revert macro aci $dn logic
fix compiler warnings - unused vars/funcs, invalid casts
use slapi_mods_init_passin/get_ldapmods_passout if modifying the smods
Have to explicitly set protocol version to 3
Only check modrdn ops for backend/suffix correctness if not the default backend
Bug 634561 - Server crushes when using Windows Sync Agreement
openldap ber_init will assert if the bv->bv_val is NULL
add the account policy plugin and related server code, schema, and config
fix pblock memory leak
do not register pre/post op plugins if disabled
add support for global inactivity limit
fix typos in Makefile.am, acctpolicy schema
bump version to 1.2.7.a2
remove extra format argument; use %lu for size_t printf format
Bug 644013 - uniqueness plugin segfault bug
bump version to 1.2.7.a3
bump to 1.2.7.a4
bump version to 1.2.7.a5
put replication config entries in separate file
bump version to 1.2.7.a6
bump version to 1.2.7.1
bump version to 1.2.7.2
bump version to 1.2.7.3
bump version to 1.2.7.4
Bug 515329 - Multiple mods in one operation can result in an inconsistent replica
bump version to 1.2.8.a1
Bug 642046 - Segfault when using SASL/GSSAPI multimaster replication, possible krb5_creds doublefree
Bug 624485 - setup dsktune check step should default to "yes" if no problems found
Bug 622907 - support piped passwords to perl-based maintenance commands
Bug 624485 - setup dsktune check step should default to "yes" if no problems found
Bug 576534 - Password displayed on console when entered in command-line utilities
Bug 667935 - DS pipe log script's logregex.py plugin is not redirecting the log output to the text file
bump version to 1.2.8.a2
Bug 668385 - DS pipe log script is executed as many times as the dirsrv service is restarted
Bug 676689 - crash while adding a new user to be synced to windows
Bug 675113 - ns-slapd core dump in windows_tot_run if oneway sync is used
Bug 677440 - clean up compiler warnings in 389-ds-base 1.2.8
Bug 677774 - DS fails to start after reboot
Bug 666076 - dirsrv crash (1.2.7.5) with multiple simple paged result searches
Bug 675320 - empty modify operation with repl on or lastmod off will crash server
bump version to 1.2.9.a1 - console version to 1.2.4
Bug 677705 - ds-logpipe.py script is failing to validate "-s" and "--serverpid" options with "-t".
Bug 676655 - winsync stops working after server restart
Bug 680555 - ns-slapd segfaults if I have more than 100 DBs
Bug 514190 - setup-ds-admin.pl --debug does not log to file
Bug 518890 - setup-ds-admin.pl - improve hostname validation
Bug 644784 - Memory leak in "testbind.c" plugin
Bug 683250 - slapd crashing when traffic replayed
Bug 690584 - #10691 ldbm_back_init() - fix coverity resource leak issues
Bug 690584 - #10690 #10689 attrcrypt_get_ssl_cert_name() - fix coverity resource leak issues
Bug 690584 - #10688 - dblayer_make_env - fix coverity resource leak issues
Bug 690584 - #10669 #10668 cl5ImportLDIF - fix coverity resource leak issues
Bug 690584 - #10658 linked_attrs_pre_op - fix coverity resource leak issues
Bug 690584 - #10655 acllas__handle_group_entry - fix coverity resource leak issues
Bug 690584 - #10654 #10653 str2entry_dupcheck - fix coverity resource leak issues
Bug 690584 - #10652 #10651 #10650 #10649 #10648 #10647 send_specific_attrs send_all_attrs - fix coverity resource leak issues
Bug 690584 - #10643 hash_rootpw - fix coverity resource leak issues
Bug 690584 - #10641 reslimit_bv2int - fix coverity resource leak issues
Bug 691422 - sdt_destroy - fix coverity control flow issues
Bug 691422 - ldbm_back_upgradedb - fix coverity control flow issues
Bug 691422 - csnplFree - fix coverity control flow issues
Bug 691422 - SetUnicodeStringFromUTF_8 - fix coverity control flow issues
Bug 691422 - cl5DeleteRUV - fix coverity control flow issues
Bug 691422 - acl_read_access_allowed_on_entry - fix coverity control flow issues
Bug 691422 - search_internal_callback_pb - fix coverity control flow issues
Bug 691422 - cl5WriteRUV - fix coverity control flow issues
Bug 691422 - windows_replay_update - fix coverity control flow issues
Bug 690584 - #10691 ldbm_back_init() - fix coverity resource leak issues
Bug 690584 - #10652 #10651 #10650 #10649 #10648 #10647 send_specific_attrs send_all_attrs - fix coverity resource leak issues
Bug 668385 - DS pipe log script is executed as many times as the dirsrv service is restarted
Bug 692937 - Replica install fails after step for "enable GSSAPI for replication"
Bug 692331 - Segfault on index update during full replication push on 1.2.7.5
Bug 693451 - cannot use localized matching rules
Bug 693455 - nsMatchingRule does not work with multiple values
Bug 693503 - matching rules do not inherit from superior attribute type
Bug 693466 - Unable to change schema online
Bug 692991 - rhds82 - windows_tot_run: failed to obtain data to send to the consumer; LDAP error - -1
Bug 693473 - rhds82 rfe - windows_tot_run to log Sizelimit exceeded instead of LDAP error - -1
Bug 693962 - Full replica push loses some entries with multi-valued RDNs
Bug 694336 - Group sync hangs Windows initial Sync
Bug 700145 - userpasswd not replicating
Bug 703990 - Support upgrade from Red Hat Directory Server
bump console version to 1.2.5
Bug 703990 - Support upgrade from Red Hat Directory Server
Bug 703990 - Support upgrade from Red Hat Directory Server
Bug 707015 - Cannot disable SSLv3 and use TLS only
bump version to 1.2.9.a2
Bug 707384 - only allow FIPS approved cipher suites in FIPS mode
Bug 711906 - ns-slapd segfaults using suffix referrals
Bug 706209 - LEGAL: RHEL6.1 License issue for 389-ds-base package
Bug 703703 - setup-ds-admin.pl asks for legal agreement to a non-existant file
Bug 711679 - unresponsive LDAP service when deleting vlv on replica
bump console version to 1.2.6
Bug 697694 - rhds82 - incr update state stop_fatal_error "requires administrator action", with extop_result: 9
Bug 716980 - winsync uses old AD entry if new one not found
add support for ldif files with changetype: add
writing Inf file shows SchemaFile = ARRAY(0xhexnum)
look for separate openldap ldif library
bump version to 1.2.9.a3
Bug 709468 - RSA Authentication Server timeouts when using simple paged results on RHDS 8.2.
Bug 720059 - RDN with % can cause crashes or missing entries
bump version to 1.2.9.0
Bug 725542 - Instance upgrade fails when upgrading 389-ds-base package
Bug 725953 - Winsync: DS entries fail to sync to AD, if the User's CN entry contains a comma
Bug 723937 - replication failing on RUV errors
bump version to 1.2.9.1
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.2
Bug 727511 - ldclt SSL search requests are failing with "illegal error numbe
bump version to 1.2.9.3
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.4
Bug 727511 - ldclt SSL search requests are failing with "illegal error number -1" error
bump version to 1.2.9.5
Bug 729378 - delete user subtree container in AD + modify password in DS == DS crash
Bug 723937 - replication failing on RUV errors
Bug 729369 - upgrade DB to upgrade from entrydn to entryrdn format is not working.
make sure the DBVERSION file ends in a newline
bump version to 1.2.10.a1
Bug 633803 - passwordisglobalpolicy attribute brakes TLS chaining
Bug 733103 - large targetattr list with syntax errors cause server to crash or hang
Bug 703990 - cross-platform - Support upgrade from Red Hat Directory Server
Bug 735121 - simple paged search + ip/dns based ACI hangs server
Bug 695736 - Providing native systemd file for upcoming F15 Feature Systemd
Bug 590826 - Reloading database from ldif causes changelog to emit "data no longer matches" errors
Bug 736712 - Modifying ruv entry deadlocks server
Add support for pre/post db transaction plugins
Make all backend operations transaction aware
Bug 741744 - MOD operations with chained delete/add get back error 53 on backend config
Bug 742324 - allow nsslapd-idlistscanlimit to be set dynamically and per-user
Bug 741744 - part2 - MOD operations with chained delete/add get back error 53 on backend config
Bug 740942 - allow resource limits to be set for paged searches independently of limits for other searches/operations
bump version to 1.2.10.a2
bump version to 1.2.10.a3
fix transaction support in ldbm_delete
bump version to 1.2.10.a4
set the ENTRY_POST_OP for modrdn betxnpostoperation plugins
pass the plugin config entry to the plugin init function
make memberof transaction aware and able to be a betxnpostoperation plugin
Bug 741744 - part3 - MOD operations with chained delete/add get back error 53
bump version to 1.2.10.a5
Change referential integrity to be a betxnpostoperation plugin
Use new PLUGIN_CONFIG_ENTRY feature to allow switching between txn and regular
Bug 748575 - rhds81 modrn operation and 100% cpu use in replication
Bug 748575 - part 2 - rhds81 modrdn operation and 100% cpu use in replication
Bug 751495 - 'setup-ds.pl -u' fails with undefined routine 'updateSystemD'
bump version to 1.2.10.a6
Bug 751645 - crash when simple paged fails to send entry to client
csn_as_string - use slapi_uN_to_hex instead of sprintf
uniqueid formatting - use slapi_u8_to_hex instead of sprintf
fix member variable name error in slapi_uniqueIDFormat
reduce calls to csn_as_string and slapi_log_error
csn_init_as_string should not use sscanf
use slapi_hexchar2int and slapi_str_to_u8 everywhere
Bug 755754 - Unable to start dirsrv service using systemd
Bug 755725 - 389 programs linked against openldap crash during shutdown
Ticket 1 - pre-normalize filter and pre-compile substring regex - and other optimizations
Ticket #162 - Infinite loop / spin inside strcmpi_fast, acl_read_access_allowed_on_attr, server DoS
bak2db gets stuck in infinite loop
Ticket #256 - debug build assertion in ACL_EvalDestroy()
bump version to 1.2.10.a7
Ticket #167 - Mixing transaction and non-transaction plugins can cause deadlock
fix mep sdn compiler warnings
add a hack to disable sasl hostname canonicalization - helps with testing when you don't want to set up correct host name resolution and/or cannot set the default system hostname
Ticket #12 - 389 DS DNA Plugin / Replication failing on GSSAPI
Ticket #257 - repl-monitor doesn't work if leftmost hostnames are the same
fix recent compiler warnings
Ticket #15 - Get rid of rwlock.h/rwlock.c and just use slapi_rwlock instead
fix compiler warnings
Remove redundant code - make a global into a static
Ticket #262 - pid file not removed with systemd
fix mozldap build issues
Ticket #264 - upgrade needs better check for "server is running"
Ticket #263 - add systemd include directive
bump version to 1.2.10.rc1
change version to 1.2.10.a8
Ticket #272 - add tombstonenumsubordinates to schema
bump version to 1.2.10.rc1
Ticket #161 - Review and address latest Coverity issues
Ticket #22 - RFE: Support sendmail LDAP routing schema
Ticket #29 - Samba3-schema is missing sambaTrustedDomainPassword
Ticket #273 - ruv tombstone searches don't work after reindex entryrdn
Ticket #273 - ruv tombstone searches don't work after reindex entryrdn
fix a couple of minor coverity issues
Ticket #87 - Manpages fixes
Ticket #13 - slapd process exits when put the database on read only mode while updates are coming to the server
Ticket #55 - Limit of 1024 characters for nsMatchingRule
Ticket #277 - cannot set repl referrals or state
Ticket #278 - Schema replication update failed: Invalid syntax
Ticket #277 - cannot set repl referrals or state
Ticket #279 - filter normalization does not use matching rules
Ticket #280 - extensible binary filters do not work
Ticket #281 - TLS not working with latest openldap
coverity 12488 Resource leak In attr_index_config(): Leak of memory or pointers to system resources
bump version to 1.2.10.rc2
fix compiler warning in acct policy plugin
bump version to 1.2.11.a1
Ticket #294 - 389 DS Segfaults during replica install in FreeIPA
coverity uninit var and resource leak
Revert "Ticket #111 - ability to control behavior of modifyTimestamp/modifiersName"
Revert "Ticket #167 - Mixing transaction and non-transaction plugins can cause deadlock"
Revert "Change referential integrity to be a betxnpostoperation plugin"
Revert "make memberof transaction aware and able to be a betxnpostoperation plugin"
Revert "pass the plugin config entry to the plugin init function"
coverity 12559 Uninitialized pointer read In ldbm_back_modify(): Reads an uninitialized pointer or its target
Ticket #281 - TLS not working with latest openldap
Trac Ticket #298 - crash when replicating orphaned tombstone entry
Ticket #301 - implement transaction support using thread local storage
init txn thread private data for all database modes
handle null smods
memleak in mep_parse_config_entry
memleak in normalize_mods2bvals
destroy the entry cache and dn cache in the dse post op delete callback
Ticket #289 - allow betxn plugin config changes
coverity 12563 Read from pointer after free
Ticket 317 - RHDS fractional replication with excluded password policy attributes leads to wrong error messages.
Ticket #305 - Certain CMP operations hang or cause ns-slapd to crash
Ticket #320 - allow most plugins to be betxn plugins
Ticket #324 - Sync with group attribute containing () fails
Ticket #324 - redux: Sync with group attribute containing () fails
Ticket #316 and Ticket #70 - add post add/mod and AD add callback hooks
Ticket #261 - Add Solaris i386
Ticket #331 - transaction errors with db 4.3 and db 4.2
schema def must have DESC '' - close paren must be preceded by space
Ticket #336 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
Ticket #336 - [abrt] 389-ds-base-1.2.10.4-2.fc16: index_range_read_ext: Process /usr/sbin/ns-slapd was killed by signal 11 (SIGSEGV)
Ticket #347 - IPA dirsvr seg-fault during system longevity test
Ticket #348 - crash in ldap_initialize with multiple threads
Ticket #351 - use betxn plugins by default
Ticket #353 - coverity 12625-12629 - leaks, dead code, unchecked return
Ticket #348 - crash in ldap_initialize with multiple threads
Ticket #351 - use betxn plugins by default
bump version to 1.3.0.a1
Ticket #358 - managed entry doesn't delete linked entry
Trac Ticket #359 - Database RUV could mismatch the one in changelog under the stress
console .2 is still compatible with 389 .3 for now
Ticket #321 - krbExtraData is being null modified and replicated on each ssh login
Ticket #360 - ldapmodify returns Operations error
Ticket #382 - DS Shuts down intermittently
Ticket #383 - usn + mmr = deletions are not replicated
Ticket #389 - ADD operations not in audit log
Ticket #360 - ldapmodify returns Operations error - fix delete caching
fix coverity issues with uninit vals, no return checking
Ticket #360 - ldapmodify returns Operations error - fix delete caching
improve txn test index handling
Ticket #387 - managed entry sometimes doesn't delete the managed entry
Ticket #387 - managed entry sometimes doesn't delete the managed entry
Ticket 378 - unhashed#user#password visible after changing password
Ticket #405 - referint modrdn not working if case is different
Ticket #406 - Impossible to rename entry (modrdn) with Attribute Uniqueness plugin enabled
Ticket #410 - Referential integrity plug-in does not work when update interval is not zero
Ticket #425 - support multiple winsync plugins
Ticket #430 - server to server ssl client auth broken with latest openldap
Ticket #426 - support posix schema for user and group sync
coverity - mbo dead code - winsync leaks, deadcode, null check, test code
Ticket #355 - winsync should not delete entry that appears to be out of scope
Ticket #440 - periodic dirsync timed event causes server to loop repeatedly
fix mem leaks with parent dn log message, setting winsync windows domain
coverity - posix winsync mem leaks, null check, deadcode, null ref, use after free
fix coverity resource leak in windows_plugin_add
Ticket #426 - support posix schema for user and group sync
Ticket #374 - consumer can go into total update mode for no reason
Ticket #461 - fix build problem with mozldap c sdk
Ticket #462 - add test for include file mntent.h
Ticket #463 - different parameters of getmntent in Solaris
add eclipse generated files to the ignore list
fix compiler warnings in ticket 374 code
Ticket #491 - multimaster_extop_cleanruv returns wrong error codes
minor fixes for bdb 4.2/4.3 and mozldap
Ticket #322 - Create DOAP description for the 389 Directory Server project
Ticket #508 - part 1 - lock-free access to FrontendConfig structure
Ticket #508 - part 2 - lock-free access to FrontendConfig structure
Ticket #612 - improve dbgen rdn generation, output
Ticket #613 - ldclt: add timestamp, interval, nozeropad, other improvements
Ticket #47299 - allow cmdline scripts to work with non-root user
Ticket #47302 - get rid of sbindir start/stop/restart slapd scripts
Ticket #47303 - start/stop/restart dirsrv scripts should report and error if no instances
Ticket #47302 - get rid of sbindir start/stop/restart slapd scripts
Ticket #565 - turbo mode and replication - allow disable of turbo mode
Ticket #633 - allow nsslapd-nagle to be disabled, and also tcp cork
Ticket #613 - ldclt: add timestamp, interval, nozeropad, other improvements
Ticket #47312 - replace PR_GetFileInfo with PR_GetFileInfo64
Ticket #574 - problems with dbcachesize disk space calculation
Ticket #47312 - replace PR_GetFileInfo with PR_GetFileInfo64
Ticket #514 - investigate connection locking
Ticket #513 - recycle operation pblocks
Ticket #47319 - make connection buffer size adjustable
Ticket #47320 - put conn on work_q not poll list if conn has buffered more_data
Ticket #47299 - allow cmdline scripts to work with non-root user
Ticket #47336 - logconv.pl -m not working for all stats
Ticket #47341 - logconv.pl -m time calculation is wrong
Ticket #47348 - add etimes to per second/minute stats
Ticket #47349 - DS instance crashes under a high load
Ticket #47362 - ipa upgrade selinuxusermap data not replicating
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
Ticket #47359 - new ldap connections can block ldaps and ldapi connections
Ticket #47378 - fix recent compiler warnings
Ticket #47387 - improve logconv.pl performance with large access logs
Ticket #47377 - make listen backlog size configurable
Ticket #47375 - flush_ber error sending back start_tls response will deadlock
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47409 - allow setting db deadlock rejection policy
Ticket #47387 - improve logconv.pl performance with large access logs
Ticket #47410 - changelog db deadlocks with DNA and replication
Ticket #47392 - ldbm errors when adding/modifying/deleting entries
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket #47424 - Replication problem with add-delete requests on single-valued attributes
Ticket 47427 - Overflow in nsslapd-disk-monitoring-threshold
Ticket #47448 - Segfault in 389-ds-base-1.3.1.4-1.fc19 when setting up FreeIPA replication
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
Ticket #47456 - delete present values should append values to deleted values
fix coverity 11895 - null deref - caused by fix to ticket 47392
fix coverity 11915 - dead code - introduced with fix for ticket 346
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
Bug 999634 - ns-slapd crash due to bogus DN
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
Ticket #47516 replication stops with excessive clock skew
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47504 idlistscanlimit per index/type/value
Ticket #47501 logconv.pl uses /var/tmp for BDB temp files
Ticket 47533 logconv: some stats do not work across server restarts
Ticket #47515 Fedora 20: setup-ds-admin.pl
Ticket #47551 logconv: -V does not produce unindexed search report
bump autoconf to 2.69, automake to 1.13.4, libtool to 2.4.2
ticket #47550 wip
Ticket #47550 logconv: failed logins: Use of uninitialized value in numeric comparison at logconv.pl line 949
Ticket #47559 hung server - related to sasl and initialize
Ticket #47585 Replication Failures related to skipped entries due to cleaned rids
Revert "Ticket #47559 hung server - related to sasl and initialize"
Ticket #47596 attrcrypt fails to find unlocked key
Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches
bump version to 1.3.3.a1
Ticket #381 Recognize compressed log files
Ticket 47599 - Reduce lock scope in retro changelog plug-in
bump version to 1.3.3.a2
Ticket #47596 attrcrypt fails to find unlocked key
Ticket #47623 fix memleak caused by 47347
Ticket #47623 fix memleak caused by 47347
Ticket #47631 objectclass may, must lists skip rest of objectclass once first is found in sup
Ticket #47645 reset stack, op fields to NULL - clean up stacks at shutdown - free unused plugin config entries
Ticket #47634 support AttributeTypeDescription USAGE userApplications distributedOperation dSAOperation
Ticket #47647 remove bogus definition in 60rfc3712.ldif
Ticket #47657 add schema test suite and tests for Ticket #47634
Ticket #47675 logconv errors when search has invalid bind dn
Ticket #47516 replication stops with excessive clock skew
Ticket #47374 - flush.pl is not included in perl5
Ticket #471 logconv.pl tool removes the access logs contents if "-M" is not correctly used
Ticket #47692 single valued attribute replicated ADD does not work
Ticket #47773 - mem leak in do_bind when there is an error
Ticket #47774 mem leak in do_search - rawbase not freed upon certain errors
Ticket #47772 empty modify returns LDAP_INVALID_DN_SYNTAX
Ticket #47772 empty modify returns LDAP_INVALID_DN_SYNTAX
Ticket #47831 - server restart wipes out index config if there is a default index
Ticket #47692 single valued attribute replicated ADD does not work
Ticket 47446 - logconv.pl memory continually grows
Ticket #47892 coverity defects found in 1.3.3.1
bump version to 1.3.3.3
Thierry bordaz (tbordaz) (53):
Ticket #487 - Possible to add invalid attribute values to PAM PTA plugin configuration
Ticket 600 - Server should return unavailableCriticalExtension when processing a badly formed critical control
Ticket 616 - High contention on computed attribute lock
Ticket 618 - Crash at shutdown while stopping replica agreements
Ticket 512 - improve performance of vattr code
Ticket 205 - snmp counters index strings for multiple network interfaces with ip addr and tcp port pairs
Ticket 47325 - Crash at shutdown on a replica aggrement
Ticket 47331 - Self entry access ACI not working properly
Ticket 47361 - Empty control list causes LDAP protocol error is thrown
Ticket 47354 - Indexed search are logged with 'notes=U' in the access logs
Ticket 47350 - Allow search to look up 'in memory RUV'
Compilation warnings (ticket 47350)
Ticket 47350 - (Cont.) Allow search to look up 'in memory RUV'
Ticket 564 - Is ldbm_txn_ruv_modify_context still required
Ticket 47393 - Attribute are not encrypted on a consumer after a full initialization
Ticket 208 - [RFE] Roles with explicit scoping in RHDS
Ticket 47433 - With SeLinux, setup-ds.pl and setup-ds-admin.pl fail to detect already ranged labelled ports
Ticket 512 - improve performance of vattr code
Ticket 47489 - Under specific values of nsDS5ReplicaName, replication may get broken or updates missing
Ticket 47490 - Schema replication between DS versions may overwrite newer base schema
Ticket 47398 - memberOf on a user is converted to lowercase
Ticket 47560: fixup memberof task does not work: task entry not added
Ticket 47586 - CI tests: test case for 47490
Ticket 47586 - CI tests: follow up
Ticket 47586 - Need to rebind after a stop (fix to run direct python script)
Ticket 47575 - CI test: add test case for ticket47560
Ticket 47628: port testcases to new DirSrv interface
Ticket 47651 - Finaliser to remove instances backups
Ticket 47668 - test: port ticket47490_test to Replica/Agreement interface (47600)
Ticket 47653 - Need a way to allow users to create entries assigned to themselves.
Ticket 47676 : Replication of the schema fails 'master branch' -> 1.2.11 or 1.3.1
Ticket 47676 : (cont.) Replication of the schema fails 'master branch' -> 1.2.11 or 1.3.1
Ticket 47573: schema push can be erronously prevented
Update test cases due to new modules: Schema, tasks, plugins and index
Ticket 47619: cannot reindex retrochangelog
Ticket 47699: Propagate plugin precedence to all registered function types
Ticket 47553: Enhance ACIs to have more control over MODRDN operations
Ticket 47721 - Schema Replication Issue
Ticket 47721 - Schema Replication Issue (follow up + cleanup)
Ticket 47721 - Schema Replication Issue (follow up)
Ticket 47787 - A replicated MOD fails (Unwilling to perform) if it targets a tombstone
Ticket 47808 - If be_txn plugin fails in ldbm_back_add, adding entry is double freed
Ticket 47815 - Add operations rejected by betxn plugins remain in cache
Ticket 47829: memberof scope: allow to exclude subtrees
Ticket 47823 - attribute uniqueness enforced on all subtrees
Ticket 47797 - DB deadlock when two threads (on separated backend) try to record changes in retroCL
Ticket 47797 - fix the indentation
Ticket 47871 - 389-ds-base-1.3.2.21-1.fc20 crashed over the weekend
Ticket 47889 - DS crashed during ipa-server-install on test_ava_filter
Ticket 47920: Encoding of SearchResultEntry is missing tag
Ticket 47553: Enhance ACIs to have more control over MODRDN operations
Ticket 47942: DS hangs during online total update
Ticket 47988: Schema learning mechanism, in replication, unable to extend an existing definition
nturpin (1):
Ticket #3: acl cache overflown problem
root (4):
Bug 480787 - Autoconf parameter --with and --without
Ticket #326 - MemberOf plugin should work on all backends
Ticket #337 - RFE - Improve CLEANRUV functionality
Ticket #216 - RFE - Disable replication agreements
---
.gitignore | 5
389-doap.rdf | 47
Makefile.am | 429
Makefile.in | 8366 +-
README | 11
VERSION.sh | 18
aclocal.m4 | 7490 --
autogen.sh | 108
compile | 245
config.guess | 763
config.h.in | 40
config.sub | 443
configure |40020 +++++-------
configure.ac | 273
depcomp | 637
dirsrv.pc.in | 7
dirsrvtests/data/README | 11
dirsrvtests/suites/dynamic-plugins/constants.py | 33
dirsrvtests/suites/dynamic-plugins/finalizer.py | 57
dirsrvtests/suites/dynamic-plugins/plugin_tests.py | 2299
dirsrvtests/suites/dynamic-plugins/stress_tests.py | 141
dirsrvtests/suites/dynamic-plugins/test_dynamic_plugins.py | 534
dirsrvtests/suites/schema/constants.py | 33
dirsrvtests/suites/schema/finalizer.py | 51
dirsrvtests/suites/schema/test_schema.py | 260
dirsrvtests/tickets/constants.py | 69
dirsrvtests/tickets/finalizer.py | 57
dirsrvtests/tickets/ticket47313_test.py | 226
dirsrvtests/tickets/ticket47462_test.py | 452
dirsrvtests/tickets/ticket47490_test.py | 677
dirsrvtests/tickets/ticket47553_ger.py | 553
dirsrvtests/tickets/ticket47553_single_aci_test.py | 1190
dirsrvtests/tickets/ticket47560_test.py | 307
dirsrvtests/tickets/ticket47573_test.py | 418
dirsrvtests/tickets/ticket47619_test.py | 301
dirsrvtests/tickets/ticket47653MMR_test.py | 555
dirsrvtests/tickets/ticket47653_test.py | 435
dirsrvtests/tickets/ticket47664_test.py | 273
dirsrvtests/tickets/ticket47676_test.py | 488
dirsrvtests/tickets/ticket47714_test.py | 312
dirsrvtests/tickets/ticket47721_test.py | 495
dirsrvtests/tickets/ticket47781_test.py | 238
dirsrvtests/tickets/ticket47787_test.py | 633
dirsrvtests/tickets/ticket47808_test.py | 215
dirsrvtests/tickets/ticket47815_test.py | 230
dirsrvtests/tickets/ticket47819_test.py | 348
dirsrvtests/tickets/ticket47823_test.py | 1049
dirsrvtests/tickets/ticket47824_test.py | 313
dirsrvtests/tickets/ticket47829_test.py | 712
dirsrvtests/tickets/ticket47838_test.py | 872
dirsrvtests/tickets/ticket47869MMR_test.py | 416
dirsrvtests/tickets/ticket47871_test.py | 306
dirsrvtests/tickets/ticket47900_test.py | 398
dirsrvtests/tickets/ticket47920_test.py | 251
dirsrvtests/tickets/ticket47937_test.py | 237
dirsrvtests/tickets/ticket47950_test.py | 273
dirsrvtests/tickets/ticket47970_test.py | 206
dirsrvtests/tickets/ticket47973_test.py | 235
dirsrvtests/tickets/ticket47980_test.py | 710
dirsrvtests/tickets/ticket47981_test.py | 345
dirsrvtests/tmp/README | 10
include/base/dbtbase.h | 2
include/base/file.h | 5
include/base/lexer.h | 126
include/base/pool.h | 5
include/base/rwlock.h | 91
include/i18n.h | 121
include/ldaputil/ldaputil.h | 10
include/libaccess/acl.h | 4
include/libaccess/aclerror.h | 13
include/libaccess/acleval.h | 3
include/libaccess/aclproto.h | 25
include/libaccess/aclstruct.h | 2
include/libaccess/dbtlibaccess.h | 3
include/libaccess/las.h | 6
include/libaccess/nsautherr.h | 2
include/libaccess/nserror.h | 2
include/libaccess/symbols.h | 4
include/public/nsacl/aclapi.h | 18
include/public/nsacl/acldef.h | 2
include/public/nsacl/nserrdef.h | 2
install-sh | 538
ldap/admin/src/base-initconfig.in | 44
ldap/admin/src/initconfig.in | 37
ldap/admin/src/logconv.pl | 3502 -
ldap/admin/src/scripts/10cleanupldapi.pl | 23
ldap/admin/src/scripts/10fixrundir.pl | 11
ldap/admin/src/scripts/20betxn.pl | 74
ldap/admin/src/scripts/50AES-pbe-plugin.ldif | 16
ldap/admin/src/scripts/50acctusabilityplugin.ldif | 21
ldap/admin/src/scripts/50automemberplugin.ldif | 15
ldap/admin/src/scripts/50contentsync.ldif | 23
ldap/admin/src/scripts/50fixNsState.pl | 240
ldap/admin/src/scripts/50managedentriesplugin.ldif | 16
ldap/admin/src/scripts/50nstombstonecsn.ldif | 7
ldap/admin/src/scripts/50refintprecedence.ldif | 4
ldap/admin/src/scripts/50rootdnaccesscontrolplugin.ldif | 15
ldap/admin/src/scripts/50smd5pwdstorageplugin.ldif | 5
ldap/admin/src/scripts/50targetuniqueid.ldif | 7
ldap/admin/src/scripts/50updateconfig.ldif | 10
ldap/admin/src/scripts/52updateAESplugin.pl | 84
ldap/admin/src/scripts/60upgradeconfigfiles.pl | 69
ldap/admin/src/scripts/60upgradeschemafiles.pl | 2
ldap/admin/src/scripts/70upgradefromldif.pl | 108
ldap/admin/src/scripts/80upgradednformat.pl.in | 307
ldap/admin/src/scripts/81changelog.pl | 34
ldap/admin/src/scripts/82targetuniqueidindex.pl | 52
ldap/admin/src/scripts/90subtreerename.pl | 21
ldap/admin/src/scripts/91subtreereindex.pl | 148
ldap/admin/src/scripts/DSCreate.pm.in | 470
ldap/admin/src/scripts/DSDialogs.pm | 12
ldap/admin/src/scripts/DSMigration.pm.in | 49
ldap/admin/src/scripts/DSSharedLib.in | 227
ldap/admin/src/scripts/DSUpdate.pm.in | 52
ldap/admin/src/scripts/DSUtil.pm.in | 884
ldap/admin/src/scripts/DialogManager.pm | 241
ldap/admin/src/scripts/DialogManager.pm.in | 241
ldap/admin/src/scripts/Inf.pm | 67
ldap/admin/src/scripts/Migration.pm.in | 20
ldap/admin/src/scripts/Setup.pm.in | 20
ldap/admin/src/scripts/SetupDialogs.pm.in | 31
ldap/admin/src/scripts/SetupLog.pm | 8
ldap/admin/src/scripts/bak2db.in | 76
ldap/admin/src/scripts/bak2db.pl.in | 149
ldap/admin/src/scripts/cleanallruv.pl.in | 154
ldap/admin/src/scripts/db2bak.in | 76
ldap/admin/src/scripts/db2bak.pl.in | 178
ldap/admin/src/scripts/db2index.in | 83
ldap/admin/src/scripts/db2index.pl.in | 213
ldap/admin/src/scripts/db2ldif.in | 160
ldap/admin/src/scripts/db2ldif.pl.in | 293
ldap/admin/src/scripts/dbmon.sh | 221
ldap/admin/src/scripts/dbverify.in | 68
ldap/admin/src/scripts/dn2rdn.in | 58
ldap/admin/src/scripts/dnaplugindepends.ldif | 3
ldap/admin/src/scripts/ds-logpipe.py | 223
ldap/admin/src/scripts/exampleupdate.ldif | 2
ldap/admin/src/scripts/exampleupdate.sh | 10
ldap/admin/src/scripts/fixup-linkedattrs.pl.in | 140
ldap/admin/src/scripts/fixup-memberof.pl.in | 149
ldap/admin/src/scripts/ldif2db.in | 109
ldap/admin/src/scripts/ldif2db.pl.in | 243
ldap/admin/src/scripts/ldif2ldap.in | 173
ldap/admin/src/scripts/logregex.py | 16
ldap/admin/src/scripts/migrate-ds.pl.in | 13
ldap/admin/src/scripts/monitor.in | 170
ldap/admin/src/scripts/ns-accountstatus.pl.in | 708
ldap/admin/src/scripts/ns-activate.pl.in | 710
ldap/admin/src/scripts/ns-inactivate.pl.in | 712
ldap/admin/src/scripts/ns-newpwpolicy.pl.in | 217
ldap/admin/src/scripts/remove-ds.pl.in | 38
ldap/admin/src/scripts/repl-monitor.pl.in | 782
ldap/admin/src/scripts/restart-dirsrv.in | 28
ldap/admin/src/scripts/restoreconfig.in | 52
ldap/admin/src/scripts/saveconfig.in | 53
ldap/admin/src/scripts/schema-reload.pl.in | 139
ldap/admin/src/scripts/setup-ds.pl.in | 17
ldap/admin/src/scripts/setup-ds.res.in | 41
ldap/admin/src/scripts/start-dirsrv.in | 63
ldap/admin/src/scripts/stop-dirsrv.in | 65
ldap/admin/src/scripts/suffix2instance.in | 58
ldap/admin/src/scripts/syntax-validate.pl.in | 151
ldap/admin/src/scripts/template-bak2db.in | 44
ldap/admin/src/scripts/template-bak2db.pl.in | 102
ldap/admin/src/scripts/template-cleanallruv.pl.in | 54
ldap/admin/src/scripts/template-db2bak.in | 23
ldap/admin/src/scripts/template-db2bak.pl.in | 93
ldap/admin/src/scripts/template-db2index.in | 26
ldap/admin/src/scripts/template-db2index.pl.in | 192
ldap/admin/src/scripts/template-db2ldif.in | 79
ldap/admin/src/scripts/template-db2ldif.pl.in | 238
ldap/admin/src/scripts/template-dbverify.in | 41
ldap/admin/src/scripts/template-dn2rdn.in | 23
ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in | 120
ldap/admin/src/scripts/template-fixup-memberof.pl.in | 131
ldap/admin/src/scripts/template-fixup-memberuid.pl.in | 180
ldap/admin/src/scripts/template-ldif2db.in | 23
ldap/admin/src/scripts/template-ldif2db.pl.in | 194
ldap/admin/src/scripts/template-ldif2ldap.in | 15
ldap/admin/src/scripts/template-monitor.in | 14
ldap/admin/src/scripts/template-ns-accountstatus.pl.in | 810
ldap/admin/src/scripts/template-ns-activate.pl.in | 810
ldap/admin/src/scripts/template-ns-inactivate.pl.in | 810
ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in | 253
ldap/admin/src/scripts/template-restart-slapd.in | 12
ldap/admin/src/scripts/template-restoreconfig.in | 16
ldap/admin/src/scripts/template-saveconfig.in | 17
ldap/admin/src/scripts/template-schema-reload.pl.in | 120
ldap/admin/src/scripts/template-start-slapd.in | 12
ldap/admin/src/scripts/template-stop-slapd.in | 11
ldap/admin/src/scripts/template-suffix2instance.in | 15
ldap/admin/src/scripts/template-syntax-validate.pl.in | 131
ldap/admin/src/scripts/template-upgradedb.in | 17
ldap/admin/src/scripts/template-upgradednformat.in | 5
ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in | 149
ldap/admin/src/scripts/template-verify-db.pl.in | 223
ldap/admin/src/scripts/template-vlvindex.in | 16
ldap/admin/src/scripts/upgradedb.in | 59
ldap/admin/src/scripts/upgradednformat.in | 71
ldap/admin/src/scripts/usn-tombstone-cleanup.pl.in | 155
ldap/admin/src/scripts/verify-db.pl.in | 267
ldap/admin/src/scripts/vlvindex.in | 64
ldap/admin/src/slapd.inf.in | 2
ldap/admin/src/template-initconfig.in | 18
ldap/docs/LICENSE.txt | 132
ldap/docs/README.txt | 11
ldap/include/ldaplog.h | 32
ldap/ldif/50posix-winsync-plugin.ldif | 21
ldap/ldif/50replication-plugins.ldif | 27
ldap/ldif/template-baseacis.ldif.in | 2
ldap/ldif/template-bitwise.ldif.in | 6
ldap/ldif/template-dnaplugin.ldif.in | 2
ldap/ldif/template-dse.ldif.in | 214
ldap/ldif/template-pampta.ldif.in | 2
ldap/ldif/template-suffix-db.ldif.in | 1
ldap/libraries/libavl/avl.c | 7
ldap/schema/00core.ldif | 72
ldap/schema/01core389.ldif | 233
ldap/schema/02common.ldif | 25
ldap/schema/05rfc4523.ldif | 14
ldap/schema/05rfc4524.ldif | 30
ldap/schema/06inetorgperson.ldif | 5
ldap/schema/10automember-plugin.ldif | 123
ldap/schema/10dna-plugin.ldif | 240
ldap/schema/10mep-plugin.ldif | 104
ldap/schema/30ns-common.ldif | 4
ldap/schema/50ns-directory.ldif | 4
ldap/schema/50ns-mail.ldif | 10
ldap/schema/60acctpolicy.ldif | 47
ldap/schema/60nis.ldif | 2
ldap/schema/60pam-plugin.ldif | 3
ldap/schema/60posix-winsync-plugin.ldif | 44
ldap/schema/60qmail.ldif | 24
ldap/schema/60radius.ldif | 132
ldap/schema/60rfc3712.ldif | 9
ldap/schema/60sabayon.ldif | 10
ldap/schema/60samba3.ldif | 36
ldap/schema/60sendmail.ldif | 54
ldap/schema/60sudo.ldif | 58
ldap/schema/slapd-collations.conf | 234
ldap/servers/plugins/acct_usability/acct_usability.c | 457
ldap/servers/plugins/acct_usability/acct_usability.h | 63
ldap/servers/plugins/acctpolicy/acct_config.c | 175
ldap/servers/plugins/acctpolicy/acct_init.c | 299
ldap/servers/plugins/acctpolicy/acct_plugin.c | 497
ldap/servers/plugins/acctpolicy/acct_util.c | 277
ldap/servers/plugins/acctpolicy/acctpolicy.h | 100
ldap/servers/plugins/acctpolicy/sampleconfig.ldif | 40
ldap/servers/plugins/acctpolicy/samplepolicy.ldif | 27
ldap/servers/plugins/acl/acl.c | 916
ldap/servers/plugins/acl/acl.h | 121
ldap/servers/plugins/acl/acl_ext.c | 290
ldap/servers/plugins/acl/aclanom.c | 75
ldap/servers/plugins/acl/acleffectiverights.c | 218
ldap/servers/plugins/acl/aclgroup.c | 32
ldap/servers/plugins/acl/aclinit.c | 6
ldap/servers/plugins/acl/acllas.c | 590
ldap/servers/plugins/acl/acllist.c | 204
ldap/servers/plugins/acl/aclparse.c | 958
ldap/servers/plugins/acl/aclplugin.c | 58
ldap/servers/plugins/acl/aclproxy.c | 232
ldap/servers/plugins/acl/aclutil.c | 141
ldap/servers/plugins/automember/automember.c | 2721
ldap/servers/plugins/automember/automember.h | 134
ldap/servers/plugins/bitwise/bitwise.c | 23
ldap/servers/plugins/chainingdb/cb.h | 15
ldap/servers/plugins/chainingdb/cb_add.c | 245
ldap/servers/plugins/chainingdb/cb_bind.c | 224
ldap/servers/plugins/chainingdb/cb_close.c | 78
ldap/servers/plugins/chainingdb/cb_compare.c | 101
ldap/servers/plugins/chainingdb/cb_config.c | 221
ldap/servers/plugins/chainingdb/cb_conn_stateless.c | 103
ldap/servers/plugins/chainingdb/cb_controls.c | 52
ldap/servers/plugins/chainingdb/cb_delete.c | 258
ldap/servers/plugins/chainingdb/cb_init.c | 6
ldap/servers/plugins/chainingdb/cb_instance.c | 646
ldap/servers/plugins/chainingdb/cb_modify.c | 301
ldap/servers/plugins/chainingdb/cb_modrdn.c | 305
ldap/servers/plugins/chainingdb/cb_monitor.c | 6
ldap/servers/plugins/chainingdb/cb_schema.c | 4
ldap/servers/plugins/chainingdb/cb_search.c | 548
ldap/servers/plugins/chainingdb/cb_utils.c | 30
ldap/servers/plugins/collation/collate.c | 49
ldap/servers/plugins/collation/orfilter.c | 19
ldap/servers/plugins/cos/cos.c | 85
ldap/servers/plugins/cos/cos_cache.c | 943
ldap/servers/plugins/cos/cos_cache.h | 1
ldap/servers/plugins/deref/deref.c | 164
ldap/servers/plugins/distrib/Makefile | 2
ldap/servers/plugins/dna/dna.c | 2489
ldap/servers/plugins/http/http_impl.c | 85
ldap/servers/plugins/linkedattrs/fixup_task.c | 204
ldap/servers/plugins/linkedattrs/linked_attrs.c | 442
ldap/servers/plugins/linkedattrs/linked_attrs.h | 5
ldap/servers/plugins/memberof/memberof.c | 1589
ldap/servers/plugins/memberof/memberof.h | 33
ldap/servers/plugins/memberof/memberof_config.c | 662
ldap/servers/plugins/mep/mep.c | 2883
ldap/servers/plugins/mep/mep.h | 130
ldap/servers/plugins/pam_passthru/pam_passthru.h | 50
ldap/servers/plugins/pam_passthru/pam_ptconfig.c | 735
ldap/servers/plugins/pam_passthru/pam_ptimpl.c | 90
ldap/servers/plugins/pam_passthru/pam_ptpreop.c | 659
ldap/servers/plugins/passthru/passthru.h | 9
ldap/servers/plugins/passthru/ptbind.c | 6
ldap/servers/plugins/passthru/ptconfig.c | 484
ldap/servers/plugins/passthru/ptconn.c | 8
ldap/servers/plugins/passthru/ptpreop.c | 32
ldap/servers/plugins/posix-winsync/README | 50
ldap/servers/plugins/posix-winsync/posix-group-func.c | 1027
ldap/servers/plugins/posix-winsync/posix-group-func.h | 25
ldap/servers/plugins/posix-winsync/posix-group-task.c | 494
ldap/servers/plugins/posix-winsync/posix-winsync-config.c | 327
ldap/servers/plugins/posix-winsync/posix-winsync.c | 2113
ldap/servers/plugins/posix-winsync/posix-wsp-ident.h | 58
ldap/servers/plugins/pwdstorage/smd5_pwd.c | 9
ldap/servers/plugins/referint/referint.c | 2165
ldap/servers/plugins/replication/cl4_api.c | 2
ldap/servers/plugins/replication/cl5.h | 5
ldap/servers/plugins/replication/cl5_api.c | 2960
ldap/servers/plugins/replication/cl5_api.h | 181
ldap/servers/plugins/replication/cl5_clcache.c | 177
ldap/servers/plugins/replication/cl5_clcache.h | 2
ldap/servers/plugins/replication/cl5_config.c | 373
ldap/servers/plugins/replication/cl5_init.c | 4
ldap/servers/plugins/replication/cl5_test.c | 4
ldap/servers/plugins/replication/cl_crypt.c | 203
ldap/servers/plugins/replication/cl_crypt.h | 53
ldap/servers/plugins/replication/csnpl.c | 74
ldap/servers/plugins/replication/legacy_consumer.c | 43
ldap/servers/plugins/replication/llist.c | 8
ldap/servers/plugins/replication/repl-session-plugin.h | 115
ldap/servers/plugins/replication/repl.h | 16
ldap/servers/plugins/replication/repl5.h | 222
ldap/servers/plugins/replication/repl5_agmt.c | 1340
ldap/servers/plugins/replication/repl5_agmtlist.c | 267
ldap/servers/plugins/replication/repl5_connection.c | 601
ldap/servers/plugins/replication/repl5_inc_protocol.c | 1541
ldap/servers/plugins/replication/repl5_init.c | 462
ldap/servers/plugins/replication/repl5_mtnode_ext.c | 19
ldap/servers/plugins/replication/repl5_plugins.c | 405
ldap/servers/plugins/replication/repl5_prot_private.h | 10
ldap/servers/plugins/replication/repl5_protocol.c | 189
ldap/servers/plugins/replication/repl5_protocol_util.c | 574
ldap/servers/plugins/replication/repl5_replica.c | 1830
ldap/servers/plugins/replication/repl5_replica_config.c | 3020
ldap/servers/plugins/replication/repl5_replica_dnhash.c | 26
ldap/servers/plugins/replication/repl5_replica_hash.c | 30
ldap/servers/plugins/replication/repl5_ruv.c | 776
ldap/servers/plugins/replication/repl5_ruv.h | 32
ldap/servers/plugins/replication/repl5_tot_protocol.c | 147
ldap/servers/plugins/replication/repl5_total.c | 30
ldap/servers/plugins/replication/repl5_updatedn_list.c | 126
ldap/servers/plugins/replication/repl_bind.c | 7
ldap/servers/plugins/replication/repl_compare.c | 18
ldap/servers/plugins/replication/repl_connext.c | 160
ldap/servers/plugins/replication/repl_controls.c | 2
ldap/servers/plugins/replication/repl_extop.c | 948
ldap/servers/plugins/replication/repl_globals.c | 25
ldap/servers/plugins/replication/repl_init.c | 1
ldap/servers/plugins/replication/repl_objset.c | 9
ldap/servers/plugins/replication/repl_session_plugin.c | 188
ldap/servers/plugins/replication/repl_shared.h | 20
ldap/servers/plugins/replication/replutil.c | 167
ldap/servers/plugins/replication/test_repl_session_plugin.c | 335
ldap/servers/plugins/replication/urp.c | 420
ldap/servers/plugins/replication/urp.h | 8
ldap/servers/plugins/replication/urp_glue.c | 51
ldap/servers/plugins/replication/urp_tombstone.c | 116
ldap/servers/plugins/replication/windows_connection.c | 394
ldap/servers/plugins/replication/windows_inc_protocol.c | 239
ldap/servers/plugins/replication/windows_private.c | 2890
ldap/servers/plugins/replication/windows_protocol_util.c | 2591
ldap/servers/plugins/replication/windows_tot_protocol.c | 221
ldap/servers/plugins/replication/windowsrepl.h | 83
ldap/servers/plugins/replication/winsync-plugin.h | 499
ldap/servers/plugins/retrocl/retrocl.c | 109
ldap/servers/plugins/retrocl/retrocl.h | 9
ldap/servers/plugins/retrocl/retrocl_cn.c | 59
ldap/servers/plugins/retrocl/retrocl_create.c | 13
ldap/servers/plugins/retrocl/retrocl_po.c | 237
ldap/servers/plugins/retrocl/retrocl_trim.c | 237
ldap/servers/plugins/rever/des.c | 521
ldap/servers/plugins/rever/pbe.c | 621
ldap/servers/plugins/rever/rever.c | 122
ldap/servers/plugins/rever/rever.h | 11
ldap/servers/plugins/roles/roles_cache.c | 205
ldap/servers/plugins/roles/roles_cache.h | 2
ldap/servers/plugins/roles/roles_plugin.c | 74
ldap/servers/plugins/rootdn_access/rootdn_access.c | 712
ldap/servers/plugins/rootdn_access/rootdn_access.h | 55
ldap/servers/plugins/schema_reload/schema_reload.c | 91
ldap/servers/plugins/shared/plugin-utils.h | 112
ldap/servers/plugins/shared/utils.c | 508
ldap/servers/plugins/statechange/statechange.c | 125
ldap/servers/plugins/sync/sync.h | 204
ldap/servers/plugins/sync/sync_init.c | 177
ldap/servers/plugins/sync/sync_persist.c | 719
ldap/servers/plugins/sync/sync_refresh.c | 771
ldap/servers/plugins/sync/sync_util.c | 743
ldap/servers/plugins/syntaxes/bin.c | 142
ldap/servers/plugins/syntaxes/bitstring.c | 68
ldap/servers/plugins/syntaxes/ces.c | 172
ldap/servers/plugins/syntaxes/cis.c | 321
ldap/servers/plugins/syntaxes/deliverymethod.c | 32
ldap/servers/plugins/syntaxes/dn.c | 72
ldap/servers/plugins/syntaxes/facsimile.c | 38
ldap/servers/plugins/syntaxes/guide.c | 32
ldap/servers/plugins/syntaxes/int.c | 96
ldap/servers/plugins/syntaxes/nameoptuid.c | 73
ldap/servers/plugins/syntaxes/numericstring.c | 148
ldap/servers/plugins/syntaxes/sicis.c | 32
ldap/servers/plugins/syntaxes/string.c | 455
ldap/servers/plugins/syntaxes/syntax.h | 61
ldap/servers/plugins/syntaxes/syntax_common.c | 118
ldap/servers/plugins/syntaxes/tel.c | 94
ldap/servers/plugins/syntaxes/teletex.c | 32
ldap/servers/plugins/syntaxes/telex.c | 31
ldap/servers/plugins/syntaxes/validate.c | 17
ldap/servers/plugins/syntaxes/validate_task.c | 6
ldap/servers/plugins/syntaxes/value.c | 134
ldap/servers/plugins/uiduniq/7bit.c | 162
ldap/servers/plugins/uiduniq/plugin-utils.h | 96
ldap/servers/plugins/uiduniq/uid.c | 824
ldap/servers/plugins/uiduniq/utils.c | 249
ldap/servers/plugins/usn/usn.c | 425
ldap/servers/plugins/usn/usn.h | 3
ldap/servers/plugins/usn/usn_cleanup.c | 49
ldap/servers/plugins/views/views.c | 180
ldap/servers/plugins/whoami/whoami.c | 148
ldap/servers/slapd/abandon.c | 13
ldap/servers/slapd/add.c | 433
ldap/servers/slapd/agtmmap.c | 117
ldap/servers/slapd/agtmmap.h | 2
ldap/servers/slapd/apibroker.c | 60
ldap/servers/slapd/attr.c | 412
ldap/servers/slapd/attrlist.c | 50
ldap/servers/slapd/attrsyntax.c | 1030
ldap/servers/slapd/auditlog.c | 87
ldap/servers/slapd/auth.c | 160
ldap/servers/slapd/ava.c | 2
ldap/servers/slapd/back-ldbm/ancestorid.c | 228
ldap/servers/slapd/back-ldbm/archive.c | 141
ldap/servers/slapd/back-ldbm/back-ldbm.h | 155
ldap/servers/slapd/back-ldbm/backentry.c | 7
ldap/servers/slapd/back-ldbm/cache.c | 513
ldap/servers/slapd/back-ldbm/dbhelp.c | 77
ldap/servers/slapd/back-ldbm/dblayer.c | 3186
ldap/servers/slapd/back-ldbm/dblayer.h | 20
ldap/servers/slapd/back-ldbm/dbsize.c | 7
ldap/servers/slapd/back-ldbm/dbtest.c | 349
ldap/servers/slapd/back-ldbm/dbverify.c | 6
ldap/servers/slapd/back-ldbm/dbversion.c | 82
ldap/servers/slapd/back-ldbm/dn2entry.c | 63
ldap/servers/slapd/back-ldbm/filterindex.c | 343
ldap/servers/slapd/back-ldbm/findentry.c | 147
ldap/servers/slapd/back-ldbm/id2entry.c | 199
ldap/servers/slapd/back-ldbm/idl.c | 172
ldap/servers/slapd/back-ldbm/idl_common.c | 42
ldap/servers/slapd/back-ldbm/idl_new.c | 554
ldap/servers/slapd/back-ldbm/idl_shim.c | 17
ldap/servers/slapd/back-ldbm/import-merge.c | 40
ldap/servers/slapd/back-ldbm/import-threads.c | 1875
ldap/servers/slapd/back-ldbm/import.c | 482
ldap/servers/slapd/back-ldbm/import.h | 57
ldap/servers/slapd/back-ldbm/index.c | 801
ldap/servers/slapd/back-ldbm/init.c | 89
ldap/servers/slapd/back-ldbm/instance.c | 178
ldap/servers/slapd/back-ldbm/ldbm_add.c | 1605
ldap/servers/slapd/back-ldbm/ldbm_attr.c | 892
ldap/servers/slapd/back-ldbm/ldbm_attrcrypt.c | 1027
ldap/servers/slapd/back-ldbm/ldbm_attrcrypt_config.c | 4
ldap/servers/slapd/back-ldbm/ldbm_bind.c | 42
ldap/servers/slapd/back-ldbm/ldbm_compare.c | 27
ldap/servers/slapd/back-ldbm/ldbm_config.c | 561
ldap/servers/slapd/back-ldbm/ldbm_config.h | 19
ldap/servers/slapd/back-ldbm/ldbm_delete.c | 1396
ldap/servers/slapd/back-ldbm/ldbm_entryrdn.c | 1848
ldap/servers/slapd/back-ldbm/ldbm_index_config.c | 699
ldap/servers/slapd/back-ldbm/ldbm_instance_config.c | 291
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 832
ldap/servers/slapd/back-ldbm/ldbm_modrdn.c | 1817
ldap/servers/slapd/back-ldbm/ldbm_search.c | 874
ldap/servers/slapd/back-ldbm/ldbm_usn.c | 83
ldap/servers/slapd/back-ldbm/ldif2ldbm.c | 1006
ldap/servers/slapd/back-ldbm/matchrule.c | 50
ldap/servers/slapd/back-ldbm/misc.c | 322
ldap/servers/slapd/back-ldbm/monitor.c | 76
ldap/servers/slapd/back-ldbm/nextid.c | 17
ldap/servers/slapd/back-ldbm/parents.c | 148
ldap/servers/slapd/back-ldbm/perfctrs.c | 26
ldap/servers/slapd/back-ldbm/proto-back-ldbm.h | 115
ldap/servers/slapd/back-ldbm/seq.c | 115
ldap/servers/slapd/back-ldbm/sort.c | 196
ldap/servers/slapd/back-ldbm/start.c | 109
ldap/servers/slapd/back-ldbm/upgrade.c | 72
ldap/servers/slapd/back-ldbm/vlv.c | 408
ldap/servers/slapd/back-ldbm/vlv_srch.c | 17
ldap/servers/slapd/back-ldbm/vlv_srch.h | 3
ldap/servers/slapd/back-ldif/back-ldif.h | 2
ldap/servers/slapd/back-ldif/modify.c | 2
ldap/servers/slapd/back-ldif/modrdn.c | 12
ldap/servers/slapd/backend.c | 223
ldap/servers/slapd/backend_manager.c | 59
ldap/servers/slapd/bind.c | 457
ldap/servers/slapd/bulk_import.c | 39
ldap/servers/slapd/charray.c | 41
ldap/servers/slapd/compare.c | 43
ldap/servers/slapd/computed.c | 184
ldap/servers/slapd/config.c | 91
ldap/servers/slapd/configdse.c | 110
ldap/servers/slapd/connection.c | 1195
ldap/servers/slapd/conntable.c | 54
ldap/servers/slapd/control.c | 64
ldap/servers/slapd/csn.c | 89
ldap/servers/slapd/csngen.c | 75
ldap/servers/slapd/csnset.c | 4
ldap/servers/slapd/daemon.c | 1203
ldap/servers/slapd/delete.c | 132
ldap/servers/slapd/dn.c | 2243
ldap/servers/slapd/dse.c | 1182
ldap/servers/slapd/dynalib.c | 36
ldap/servers/slapd/entry.c | 2174
ldap/servers/slapd/entrywsi.c | 812
ldap/servers/slapd/errormap.c | 18
ldap/servers/slapd/eventq.c | 4
ldap/servers/slapd/extendop.c | 41
ldap/servers/slapd/factory.c | 211
ldap/servers/slapd/fe.h | 33
ldap/servers/slapd/fedse.c | 251
ldap/servers/slapd/filter.c | 231
ldap/servers/slapd/filter.h | 1
ldap/servers/slapd/filtercmp.c | 26
ldap/servers/slapd/filterentry.c | 50
ldap/servers/slapd/generation.c | 1
ldap/servers/slapd/getfilelist.c | 4
ldap/servers/slapd/globals.c | 7
ldap/servers/slapd/index_subsystem.c | 33
ldap/servers/slapd/init.c | 2
ldap/servers/slapd/intrinsics.h | 7
ldap/servers/slapd/ldaputil.c | 1371
ldap/servers/slapd/lenstr.c | 6
ldap/servers/slapd/libglobs.c | 3353 -
ldap/servers/slapd/libslapd.def | 10
ldap/servers/slapd/log.c | 381
ldap/servers/slapd/log.h | 20
ldap/servers/slapd/main.c | 462
ldap/servers/slapd/mapping_tree.c | 646
ldap/servers/slapd/match.c | 96
ldap/servers/slapd/modify.c | 845
ldap/servers/slapd/modrdn.c | 377
ldap/servers/slapd/modutil.c | 77
ldap/servers/slapd/monitor.c | 8
ldap/servers/slapd/mozldap.h | 45
ldap/servers/slapd/ntperfdll/nsldapctr.cpp | 32
ldap/servers/slapd/ntperfdll/nsldapctrdef.h | 2
ldap/servers/slapd/ntperfdll/nsldapctrs.h | 10
ldap/servers/slapd/openldapber.h | 25
ldap/servers/slapd/operation.c | 217
ldap/servers/slapd/opshared.c | 565
ldap/servers/slapd/pagedresults.c | 787
ldap/servers/slapd/passwd_extop.c | 210
ldap/servers/slapd/pblock.c | 722
ldap/servers/slapd/plugin.c | 1925
ldap/servers/slapd/plugin_acl.c | 52
ldap/servers/slapd/plugin_internal_op.c | 204
ldap/servers/slapd/plugin_mr.c | 474
ldap/servers/slapd/plugin_syntax.c | 482
ldap/servers/slapd/protect_db.c | 24
ldap/servers/slapd/protect_db.h | 7
ldap/servers/slapd/proto-slap.h | 267
ldap/servers/slapd/proxyauth.c | 253
ldap/servers/slapd/psearch.c | 119
ldap/servers/slapd/pw.c | 1299
ldap/servers/slapd/pw.h | 32
ldap/servers/slapd/pw_mgmt.c | 177
ldap/servers/slapd/pw_retry.c | 124
ldap/servers/slapd/rdn.c | 293
ldap/servers/slapd/referral.c | 29
ldap/servers/slapd/regex.c | 35
ldap/servers/slapd/resourcelimit.c | 84
ldap/servers/slapd/result.c | 996
ldap/servers/slapd/rootdse.c | 12
ldap/servers/slapd/rwlock.c | 257
ldap/servers/slapd/rwlock.h | 65
ldap/servers/slapd/sasl_io.c | 352
ldap/servers/slapd/sasl_map.c | 278
ldap/servers/slapd/saslbind.c | 291
ldap/servers/slapd/schema.c | 6243 +
ldap/servers/slapd/schemaparse.c | 17
ldap/servers/slapd/search.c | 227
ldap/servers/slapd/security_wrappers.c | 42
ldap/servers/slapd/slap.h | 682
ldap/servers/slapd/slapi-plugin-compat4.h | 6
ldap/servers/slapd/slapi-plugin.h | 2275
ldap/servers/slapd/slapi-private.h | 237
ldap/servers/slapd/slapi2nspr.c | 79
ldap/servers/slapd/slapi_counter.c | 26
ldap/servers/slapd/snmp_collator.c | 114
ldap/servers/slapd/sort.c | 11
ldap/servers/slapd/ssl.c | 1534
ldap/servers/slapd/start_tls_extop.c | 230
ldap/servers/slapd/str2filter.c | 7
ldap/servers/slapd/task.c | 779
ldap/servers/slapd/test-plugins/Makefile.server | 2
ldap/servers/slapd/test-plugins/testbind.c | 1
ldap/servers/slapd/test-plugins/testdbinterop.c | 6
ldap/servers/slapd/test-plugins/testpostop.c | 3
ldap/servers/slapd/thread_data.c | 243
ldap/servers/slapd/time.c | 91
ldap/servers/slapd/tools/dbscan.c | 143
ldap/servers/slapd/tools/ldclt/data.c | 85
ldap/servers/slapd/tools/ldclt/ldapfct.c | 1231
ldap/servers/slapd/tools/ldclt/ldclt.c | 112
ldap/servers/slapd/tools/ldclt/ldclt.h | 22
ldap/servers/slapd/tools/ldclt/ldclt.man | 2
ldap/servers/slapd/tools/ldclt/ldclt.use | 2
ldap/servers/slapd/tools/ldclt/ldcltU.c | 28
ldap/servers/slapd/tools/ldclt/opCheck.c | 2
ldap/servers/slapd/tools/ldclt/parser.c | 19
ldap/servers/slapd/tools/ldclt/scalab01.c | 190
ldap/servers/slapd/tools/ldclt/threadMain.c | 24
ldap/servers/slapd/tools/ldclt/utils.c | 16
ldap/servers/slapd/tools/ldclt/utils.h | 1
ldap/servers/slapd/tools/ldclt/workarounds.c | 2
ldap/servers/slapd/tools/ldif.c | 9
ldap/servers/slapd/tools/migratecred.c | 15
ldap/servers/slapd/tools/mmldif.c | 47
ldap/servers/slapd/tools/pwenc.c | 25
ldap/servers/slapd/tools/rsearch/addthread.c | 51
ldap/servers/slapd/tools/rsearch/infadd.c | 7
ldap/servers/slapd/tools/rsearch/nametable.c | 13
ldap/servers/slapd/tools/rsearch/rsearch.c | 11
ldap/servers/slapd/tools/rsearch/scripts/dbgen.pl.in | 161
ldap/servers/slapd/tools/rsearch/sdattable.c | 64
ldap/servers/slapd/tools/rsearch/searchthread.c | 130
ldap/servers/slapd/unbind.c | 6
ldap/servers/slapd/uniqueid.c | 99
ldap/servers/slapd/utf8compare.c | 30
ldap/servers/slapd/util.c | 800
ldap/servers/slapd/uuid.c | 24
ldap/servers/slapd/value.c | 62
ldap/servers/slapd/valueset.c | 1223
ldap/servers/slapd/vattr.c | 169
ldap/servers/snmp/NETWORK-SERVICES-MIB.txt | 650
ldap/servers/snmp/RFC-1215.txt | 38
ldap/servers/snmp/RFC1155-SMI.txt | 119
ldap/servers/snmp/SNMPv2-CONF.txt | 322
ldap/servers/snmp/SNMPv2-SMI.txt | 344
ldap/servers/snmp/SNMPv2-TC.txt | 772
ldap/servers/snmp/ldap-agent.c | 38
ldap/servers/snmp/ldap-agent.h | 5
ldap/servers/snmp/main.c | 54
ldap/servers/snmp/netscape-ldap.mib | 759
ldap/servers/snmp/ntagt/nsldapagt_nt.c | 2
ldap/servers/snmp/ntagt/nsldapagt_nt.h | 2
ldap/servers/snmp/redhat-directory.mib | 41
ldap/systools/idsktune.c | 100
lib/base/crit.cpp | 6
lib/base/ereport.cpp | 2
lib/base/file.cpp | 28
lib/base/lexer.cpp | 1015
lib/base/plist.cpp | 3
lib/base/pool.cpp | 56
lib/base/rwlock.cpp | 168
lib/base/system.cpp | 8
lib/base/util.cpp | 25
lib/ldaputil/cert.c | 16
lib/ldaputil/certmap.c | 572
lib/ldaputil/dbconf.c | 14
lib/ldaputil/utest/Makefile | 149
lib/ldaputil/utest/auth.cpp | 611
lib/ldaputil/utest/authtest | 138
lib/ldaputil/utest/certmap.conf | 68
lib/ldaputil/utest/dblist.conf | 47
lib/ldaputil/utest/example.c | 153
lib/ldaputil/utest/plugin.c | 152
lib/ldaputil/utest/plugin.h | 57
lib/ldaputil/utest/stubs.c | 144
lib/ldaputil/utest/stubs.cpp | 139
lib/ldaputil/utest/test.ref | 480
lib/ldaputil/vtable.c | 2
lib/libaccess/acl.tab.cpp | 27
lib/libaccess/acl.yy.cpp | 5
lib/libaccess/aclcache.cpp | 131
lib/libaccess/aclerror.cpp | 4
lib/libaccess/acleval.cpp | 4
lib/libaccess/aclflush.cpp | 1
lib/libaccess/aclpriv.h | 1
lib/libaccess/aclscan.h | 1
lib/libaccess/aclspace.cpp | 4
lib/libaccess/acltext.y | 6
lib/libaccess/acltools.cpp | 2015
lib/libaccess/aclutil.cpp | 13
lib/libaccess/authdb.cpp | 112
lib/libaccess/lasdns.cpp | 299
lib/libaccess/lasgroup.cpp | 10
lib/libaccess/lasip.cpp | 413
lib/libaccess/lasip.h | 3
lib/libaccess/nsautherr.cpp | 12
lib/libaccess/nseframe.cpp | 3
lib/libaccess/oneeval.cpp | 286
lib/libaccess/permhash.h | 16
lib/libaccess/register.cpp | 106
lib/libaccess/symbols.cpp | 4
lib/libaccess/usrcache.cpp | 14
lib/libaccess/utest/.purify | 19
lib/libaccess/utest/Makefile | 147
lib/libaccess/utest/acl.dat | 44
lib/libaccess/utest/aclfile0 | 87
lib/libaccess/utest/aclfile1 | 43
lib/libaccess/utest/aclfile10 | 45
lib/libaccess/utest/aclfile11 | 43
lib/libaccess/utest/aclfile12 | 43
lib/libaccess/utest/aclfile13 | 43
lib/libaccess/utest/aclfile14 | 43
lib/libaccess/utest/aclfile15 | 43
lib/libaccess/utest/aclfile16 | 43
lib/libaccess/utest/aclfile17 | 43
lib/libaccess/utest/aclfile18 | 51
lib/libaccess/utest/aclfile19 | 46
lib/libaccess/utest/aclfile2 | 43
lib/libaccess/utest/aclfile3 | 43
lib/libaccess/utest/aclfile4 | 43
lib/libaccess/utest/aclfile5 | 43
lib/libaccess/utest/aclfile6 | 55
lib/libaccess/utest/aclfile7 | 43
lib/libaccess/utest/aclfile8 | 43
lib/libaccess/utest/aclfile9 | 43
lib/libaccess/utest/aclgrp0 | 42
lib/libaccess/utest/aclgrp1 | 42
lib/libaccess/utest/aclgrp2 | 42
lib/libaccess/utest/aclgrp3 | 42
lib/libaccess/utest/aclgrp4 | 42
lib/libaccess/utest/acltest.cpp | 794
lib/libaccess/utest/onetest.cpp | 77
lib/libaccess/utest/shexp.cpp | 331
lib/libaccess/utest/shexp.h | 168
lib/libaccess/utest/test.ref | 217
lib/libaccess/utest/testmain.cpp | 89
lib/libaccess/utest/twotest.cpp | 87
lib/libaccess/utest/ustubs.cpp | 331
lib/libadmin/error.c | 9
lib/libadmin/template.c | 2
lib/libadmin/util.c | 48
lib/libsi18n/coreres.c | 141
lib/libsi18n/coreres.h | 52
lib/libsi18n/getlang.c | 330
lib/libsi18n/getstrmem.c | 160
lib/libsi18n/getstrmem.h | 1
lib/libsi18n/getstrprop.c | 89
lib/libsi18n/makstrdb.c | 21
lib/libsi18n/propset.c | 442
lib/libsi18n/propset.h | 80
lib/libsi18n/reshash.c | 21
ltmain.sh |14878 ++--
m4/db.m4 | 27
m4/fhs.m4 | 4
m4/icu.m4 | 25
m4/kerberos.m4 | 4
m4/mozldap.m4 | 38
m4/netsnmp.m4 | 15
m4/nspr.m4 | 17
m4/nss.m4 | 17
m4/openldap.m4 | 30
m4/pcre.m4 | 28
m4/sasl.m4 | 25
m4/selinux.m4 | 13
m4/svrcore.m4 | 41
man/man1/cl-dump.1 | 20
man/man1/dbgen.pl.1 | 12
man/man1/dbscan.1 | 2
man/man1/ds-logpipe.py.1 | 14
man/man1/dsktune.1 | 2
man/man1/infadd.1 | 10
man/man1/ldap-agent.1 | 2
man/man1/ldclt.1 | 2
man/man1/ldif.1 | 2
man/man1/logconv.pl.1 | 47
man/man1/migratecred.1 | 8
man/man1/mmldif.1 | 6
man/man1/pwdhash.1 | 6
man/man1/repl-monitor.1 | 43
man/man1/rsearch.1 | 2
man/man8/bak2db.8 | 58
man/man8/bak2db.pl.8 | 82
man/man8/cleanallruv.pl.8 | 85
man/man8/db2bak.8 | 59
man/man8/db2bak.pl.8 | 78
man/man8/db2index.8 | 63
man/man8/db2index.pl.8 | 85
man/man8/db2ldif.8 | 102
man/man8/db2ldif.pl.8 | 124
man/man8/dbmon.sh.8 | 56
man/man8/dbverify.8 | 60
man/man8/dn2rdn.8 | 58
man/man8/fixup-linkedattrs.pl.8 | 76
man/man8/fixup-memberof.pl.8 | 80
man/man8/ldif2db.8 | 85
man/man8/ldif2db.pl.8 | 102
man/man8/ldif2ldap.8 | 62
man/man8/migrate-ds.pl.8 | 2
man/man8/monitor.8 | 67
man/man8/ns-accountstatus.pl.8 | 74
man/man8/ns-activate.pl.8 | 73
man/man8/ns-inactivate.pl.8 | 72
man/man8/ns-newpwpolicy.pl.8 | 79
man/man8/ns-slapd.8 | 12
man/man8/remove-ds.pl.8 | 8
man/man8/restart-dirsrv.8 | 50
man/man8/restoreconfig.8 | 48
man/man8/saveconfig.8 | 48
man/man8/schema-reload.pl.8 | 74
man/man8/setup-ds.pl.8 | 6
man/man8/start-dirsrv.8 | 50
man/man8/stop-dirsrv.8 | 50
man/man8/suffix2instance.8 | 51
man/man8/syntax-validate.pl.8 | 77
man/man8/upgradedb.8 | 56
man/man8/upgradednformat.8 | 55
man/man8/usn-tombstone-cleanup.pl.8 | 80
man/man8/verify-db.pl.8 | 49
man/man8/vlvindex.8 | 58
missing | 453
rpm.mk | 67
rpm/389-ds-base-devel.README | 4
rpm/389-ds-base-git.sh | 16
rpm/389-ds-base.spec.in | 1584
rpm/add_patches.sh | 55
rpm/rpmverrel.sh | 15
selinux/dirsrv.fc.in | 2
selinux/dirsrv.if | 41
selinux/dirsrv.te | 11
wrappers/cl-dump.in | 11
wrappers/dbscan.in | 10
wrappers/infadd.in | 12
wrappers/initscript.in | 247
wrappers/ldap-agent-initscript.in | 20
wrappers/ldap-agent.in | 12
wrappers/ldclt.in | 12
wrappers/ldif.in | 12
wrappers/migratecred.in | 14
wrappers/mmldif.in | 14
wrappers/pwdhash.in | 14
wrappers/repl-monitor.in | 11
wrappers/rsearch.in | 12
wrappers/systemd-snmp.service.in | 16
wrappers/systemd.group.in | 6
wrappers/systemd.template.service.in | 28
wrappers/systemd.template.sysconfig | 3
850 files changed, 179820 insertions(+), 96420 deletions(-)
---
1
0
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit d65945e7179fa39b44b2ae66b7e080adb3226083
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 28 12:20:11 2015 -0800
bump version to 1.3.3.7
diff --git a/VERSION.sh b/VERSION.sh
index 4746887..29a68a0 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=3
-VERSION_MAINT=3.5
+VERSION_MAINT=3.7
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
1
0
ldap/servers/slapd/daemon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 833b03dbb54c55716e43c48c34e083bdbde05718
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 28 11:45:13 2015 -0800
Coverity 12970 - Explicit null dereference
Description:
Introdced by commit a57494fcaffccb6fdd060a93ba605d432e38bc09.
https://fedorahosted.org/389/ticket/47462
(cherry picked from commit 64e237cb2768b52ef74c62fdb891540dcc6c10f1)
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 3cb8451..1230abc 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1026,7 +1026,7 @@ convert_pbe_des_to_aes()
/*
* Loop over all the backends looking for the password attribute
*/
- for(be_idx = 0; backends[be_idx]; be_idx++){
+ for(be_idx = 0; backends && backends[be_idx]; be_idx++){
pb = slapi_pblock_new();
slapi_search_internal_set_pb(pb, backends[be_idx],
LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
1
0
ldap/servers/slapd/daemon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 64e237cb2768b52ef74c62fdb891540dcc6c10f1
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 28 11:45:13 2015 -0800
Coverity 12970 - Explicit null dereference
Description:
Introdced by commit a57494fcaffccb6fdd060a93ba605d432e38bc09.
https://fedorahosted.org/389/ticket/47462
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 3cb8451..1230abc 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1026,7 +1026,7 @@ convert_pbe_des_to_aes()
/*
* Loop over all the backends looking for the password attribute
*/
- for(be_idx = 0; backends[be_idx]; be_idx++){
+ for(be_idx = 0; backends && backends[be_idx]; be_idx++){
pb = slapi_pblock_new();
slapi_search_internal_set_pb(pb, backends[be_idx],
LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
1
0
dirsrvtests/data/ticket47988/schema_ipa3.3.tar.gz |binary
dirsrvtests/data/ticket47988/schema_ipa4.1.tar.gz |binary
dirsrvtests/tickets/ticket47988_test.py | 576 ++++++++++++++++++++++
3 files changed, 576 insertions(+)
New commits:
commit 868ac8b0093c52132e618d694faf9bf1f6f8aeea
Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com>
Date: Mon Jan 26 11:15:56 2015 +0100
Ticket 47988: test case
diff --git a/dirsrvtests/data/ticket47988/schema_ipa3.3.tar.gz b/dirsrvtests/data/ticket47988/schema_ipa3.3.tar.gz
new file mode 100644
index 0000000..2b309a0
Binary files /dev/null and b/dirsrvtests/data/ticket47988/schema_ipa3.3.tar.gz differ
diff --git a/dirsrvtests/data/ticket47988/schema_ipa4.1.tar.gz b/dirsrvtests/data/ticket47988/schema_ipa4.1.tar.gz
new file mode 100644
index 0000000..84de0e9
Binary files /dev/null and b/dirsrvtests/data/ticket47988/schema_ipa4.1.tar.gz differ
diff --git a/dirsrvtests/tickets/ticket47988_test.py b/dirsrvtests/tickets/ticket47988_test.py
new file mode 100644
index 0000000..2e5e6fd
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47988_test.py
@@ -0,0 +1,576 @@
+'''
+Created on Nov 7, 2013
+
+@author: tbordaz
+'''
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import time
+import logging
+import pytest
+import re
+import tarfile
+import stat
+import shutil
+from random import randint
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389._constants import *
+from constants import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
+installation1_prefix = None
+installation2_prefix = None
+
+TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
+OC_NAME = 'OCticket47988'
+MUST = "(postalAddress $ postalCode)"
+MAY = "(member $ street)"
+
+OTHER_NAME = 'other_entry'
+MAX_OTHERS = 10
+
+BIND_NAME = 'bind_entry'
+BIND_DN = 'cn=%s, %s' % (BIND_NAME, SUFFIX)
+BIND_PW = 'password'
+
+ENTRY_NAME = 'test_entry'
+ENTRY_DN = 'cn=%s, %s' % (ENTRY_NAME, SUFFIX)
+ENTRY_OC = "top person %s" % OC_NAME
+
+def _oc_definition(oid_ext, name, must=None, may=None):
+ oid = "1.2.3.4.5.6.7.8.9.10.%d" % oid_ext
+ desc = 'To test ticket 47490'
+ sup = 'person'
+ if not must:
+ must = MUST
+ if not may:
+ may = MAY
+
+ new_oc = "( %s NAME '%s' DESC '%s' SUP %s AUXILIARY MUST %s MAY %s )" % (oid, name, desc, sup, must, may)
+ return new_oc
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ At the beginning, It may exists a master2 instance and/or a master2 instance.
+ It may also exists a backup for the master1 and/or the master2.
+
+ Principle:
+ If master1 instance exists:
+ restart it
+ If master2 instance exists:
+ restart it
+ If backup of master1 AND backup of master2 exists:
+ create or rebind to master1
+ create or rebind to master2
+
+ restore master1 from backup
+ restore master2 from backup
+ else:
+ Cleanup everything
+ remove instances
+ remove backups
+ Create instances
+ Initialize replication
+ Create backups
+ '''
+ global installation1_prefix
+ global installation2_prefix
+
+ #os.environ['USE_VALGRIND'] = '1'
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+
+ # Get the status of the backups
+ backup_master1 = master1.checkBackupFS()
+ backup_master2 = master2.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.stop(timeout=10)
+ master1.start(timeout=10)
+
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.stop(timeout=10)
+ master2.start(timeout=10)
+
+ if backup_master1 and backup_master2:
+ # The backups exist, assuming they are correct
+ # we just re-init the instances with them
+ if not instance_master1:
+ master1.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master1.open()
+
+ if not instance_master2:
+ master2.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master2.open()
+
+ # restore master1 from backup
+ master1.stop(timeout=10)
+ master1.restoreFS(backup_master1)
+ master1.start(timeout=10)
+
+ # restore master2 from backup
+ master2.stop(timeout=10)
+ master2.restoreFS(backup_master2)
+ master2.start(timeout=10)
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve master-consumer
+ # so we need to create everything
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove all the backups. So even if we have a specific backup file
+ # (e.g backup_master) we clear all backups that an instance my have created
+ if backup_master1:
+ master1.clearBackupFS()
+ if backup_master2:
+ master2.clearBackupFS()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+
+ if not repl_agreement:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % repl_agreement)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(repl_agreement)
+
+ # Check replication is working fine
+ master1.add_s(Entry((TEST_REPL_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': 'test_repl',
+ 'cn': 'test_repl'})))
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+
+ # Time to create the backups
+ master1.stop(timeout=10)
+ master1.backupfile = master1.backupFS()
+ master1.start(timeout=10)
+
+ master2.stop(timeout=10)
+ master2.backupfile = master2.backupFS()
+ master2.start(timeout=10)
+
+ #
+ # Here we have two instances master and consumer
+ # with replication working. Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyMaster1Master2(master1, master2)
+
+def _header(topology, label):
+ topology.master1.log.info("\n\n###############################################")
+ topology.master1.log.info("#######")
+ topology.master1.log.info("####### %s" % label)
+ topology.master1.log.info("#######")
+ topology.master1.log.info("###################################################")
+
+def _install_schema(server, tarFile):
+ server.stop(timeout=10)
+
+ here = os.getcwd()
+
+ tmpSchema = '/tmp/schema_47988'
+ if not os.path.isdir(tmpSchema):
+ os.mkdir(tmpSchema)
+
+ for the_file in os.listdir(tmpSchema):
+ file_path = os.path.join(tmpSchema, the_file)
+ if os.path.isfile(file_path):
+ os.unlink(file_path)
+
+ os.chdir(tmpSchema)
+ tar = tarfile.open(tarFile, 'r:gz')
+ for member in tar.getmembers():
+ tar.extract(member.name)
+
+ tar.close()
+
+ st = os.stat(server.schemadir)
+ os.chmod(server.schemadir, st.st_mode | stat.S_IWUSR | stat.S_IXUSR | stat.S_IRUSR )
+ for the_file in os.listdir(tmpSchema):
+ schemaFile = os.path.join(server.schemadir, the_file)
+ if os.path.isfile(schemaFile):
+ if the_file.startswith('99user.ldif'):
+ # only replace 99user.ldif, the other standard definition are kept
+ os.chmod(schemaFile, stat.S_IWUSR | stat.S_IRUSR)
+ server.log.info("replace %s" % schemaFile)
+ shutil.copy(the_file, schemaFile)
+
+ else:
+ server.log.info("add %s" % schemaFile)
+ shutil.copy(the_file, schemaFile)
+ os.chmod(schemaFile, stat.S_IRUSR | stat.S_IRGRP)
+ os.chmod(server.schemadir, st.st_mode | stat.S_IRUSR | stat.S_IRGRP)
+
+
+def test_ticket47988_init(topology):
+ """
+ It adds
+ - Objectclass with MAY 'member'
+ - an entry ('bind_entry') with which we bind to test the 'SELFDN' operation
+ It deletes the anonymous aci
+
+ """
+
+ _header(topology, 'test_ticket47988_init')
+
+ # enable acl error logging
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(8192))] # REPL
+ topology.master1.modify_s(DN_CONFIG, mod)
+ topology.master2.modify_s(DN_CONFIG, mod)
+
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-accesslog-level', str(260))] # Internal op
+ topology.master1.modify_s(DN_CONFIG, mod)
+ topology.master2.modify_s(DN_CONFIG, mod)
+
+ # add dummy entries
+ for cpt in range(MAX_OTHERS):
+ name = "%s%d" % (OTHER_NAME, cpt)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, SUFFIX), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+
+ # check that entry 0 is replicated before
+ loop = 0
+ entryDN = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(entryDN, ldap.SCOPE_BASE, "(objectclass=*)", ['telephonenumber'])
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ assert (loop <= 10)
+
+ topology.master1.stop(timeout=10)
+ topology.master2.stop(timeout=10)
+
+ #install the specific schema M1: ipa3.3, M2: ipa4.1
+ schema_file = os.path.join(topology.master1.getDir(__file__, DATA_DIR), "ticket47988/schema_ipa3.3.tar.gz")
+ _install_schema(topology.master1, schema_file)
+ schema_file = os.path.join(topology.master1.getDir(__file__, DATA_DIR), "ticket47988/schema_ipa4.1.tar.gz")
+ _install_schema(topology.master2, schema_file)
+
+ topology.master1.start(timeout=10)
+ topology.master2.start(timeout=10)
+
+def _do_update_schema(server, range=3999):
+ '''
+ Update the schema of the M2 (IPA4.1). to generate a nsSchemaCSN
+ '''
+ postfix = str(randint(range, range+1000))
+ OID = '2.16.840.1.113730.3.8.12.%s' % postfix
+ NAME = 'thierry%s' % postfix
+ value = '( %s NAME \'%s\' DESC \'Override for Group Attributes\' STRUCTURAL MUST ( cn ) MAY sn X-ORIGIN ( \'IPA v4.1.2\' \'user defined\' ) )' % (OID, NAME)
+ mod = [(ldap.MOD_ADD, 'objectclasses', value)]
+ server.modify_s('cn=schema', mod)
+
+def _do_update_entry(supplier=None, consumer=None, attempts=10):
+ '''
+ This is doing an update on M2 (IPA4.1) and checks the update has been
+ propagated to M1 (IPA3.3)
+ '''
+ assert(supplier)
+ assert(consumer)
+ entryDN = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
+ value = str(randint(100,200))
+ mod = [(ldap.MOD_REPLACE, 'telephonenumber', value)]
+ supplier.modify_s(entryDN, mod)
+
+ loop = 0
+ while loop <= attempts:
+ ent = consumer.getEntry(entryDN, ldap.SCOPE_BASE, "(objectclass=*)", ['telephonenumber'])
+ read_val = ent.telephonenumber or "0"
+ if read_val == value:
+ break
+ # the expected value is not yet replicated. try again
+ time.sleep(5)
+ loop += 1
+ supplier.log.debug("test_do_update: receive %s (expected %s)" % (read_val, value))
+ assert (loop <= attempts)
+
+def _pause_M2_to_M1(topology):
+ topology.master1.log.info("\n\n######################### Pause RA M2->M1 ######################\n")
+ ents = topology.master2.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+ topology.master2.agreement.pause(ents[0].dn)
+
+
+def _resume_M1_to_M2(topology):
+ topology.master1.log.info("\n\n######################### resume RA M1->M2 ######################\n")
+ ents = topology.master1.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+ topology.master1.agreement.resume(ents[0].dn)
+
+def _pause_M1_to_M2(topology):
+ topology.master1.log.info("\n\n######################### Pause RA M1->M2 ######################\n")
+ ents = topology.master1.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+ topology.master1.agreement.pause(ents[0].dn)
+
+
+def _resume_M2_to_M1(topology):
+ topology.master1.log.info("\n\n######################### resume RA M2->M1 ######################\n")
+ ents = topology.master2.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+ topology.master2.agreement.resume(ents[0].dn)
+
+def test_ticket47988_1(topology):
+ '''
+ Check that replication is working and pause replication M2->M1
+ '''
+ _header(topology, 'test_ticket47988_1')
+
+ topology.master1.log.debug("\n\nCheck that replication is working and pause replication M2->M1\n")
+ _do_update_entry(supplier=topology.master2, consumer=topology.master1, attempts=5)
+ _pause_M2_to_M1(topology)
+
+def test_ticket47988_2(topology):
+ '''
+ Update M1 schema and trigger update M1->M2
+ So M1 should learn new/extended definitions that are in M2 schema
+ '''
+ _header(topology, 'test_ticket47988_2')
+
+ topology.master1.log.debug("\n\nUpdate M1 schema and an entry on M1\n")
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\nBefore updating the schema on M1\n")
+ topology.master1.log.debug("Master1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("Master2 nsschemaCSN: %s" % master2_schema_csn)
+
+ # Here M1 should no, should check M2 schema and learn
+ _do_update_schema(topology.master1)
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\nAfter updating the schema on M1\n")
+ topology.master1.log.debug("Master1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("Master2 nsschemaCSN: %s" % master2_schema_csn)
+ assert (master1_schema_csn)
+
+ # to avoid linger effect where a replication session is reused without checking the schema
+ _pause_M1_to_M2(topology)
+ _resume_M1_to_M2(topology)
+
+ #topo.master1.log.debug("\n\nSleep.... attach the debugger dse_modify")
+ #time.sleep(60)
+ _do_update_entry(supplier=topology.master1, consumer=topology.master2, attempts=15)
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\nAfter a full replication session\n")
+ topology.master1.log.debug("Master1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("Master2 nsschemaCSN: %s" % master2_schema_csn)
+ assert (master1_schema_csn)
+ assert (master2_schema_csn)
+
+def test_ticket47988_3(topology):
+ '''
+ Resume replication M2->M1 and check replication is still working
+ '''
+ _header(topology, 'test_ticket47988_3')
+
+ _resume_M2_to_M1(topology)
+ _do_update_entry(supplier=topology.master1, consumer=topology.master2, attempts=5)
+ _do_update_entry(supplier=topology.master2, consumer=topology.master1, attempts=5)
+
+def test_ticket47988_4(topology):
+ '''
+ Check schemaCSN is identical on both server
+ And save the nsschemaCSN to later check they do not change unexpectedly
+ '''
+ _header(topology, 'test_ticket47988_4')
+
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\n\nMaster1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("\n\nMaster2 nsschemaCSN: %s" % master2_schema_csn)
+ assert (master1_schema_csn)
+ assert (master2_schema_csn)
+ assert (master1_schema_csn == master2_schema_csn)
+
+ topology.master1.saved_schema_csn = master1_schema_csn
+ topology.master2.saved_schema_csn = master2_schema_csn
+
+def test_ticket47988_5(topology):
+ '''
+ Check schemaCSN do not change unexpectedly
+ '''
+ _header(topology, 'test_ticket47988_5')
+
+ _do_update_entry(supplier=topology.master1, consumer=topology.master2, attempts=5)
+ _do_update_entry(supplier=topology.master2, consumer=topology.master1, attempts=5)
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\n\nMaster1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("\n\nMaster2 nsschemaCSN: %s" % master2_schema_csn)
+ assert (master1_schema_csn)
+ assert (master2_schema_csn)
+ assert (master1_schema_csn == master2_schema_csn)
+
+ assert (topology.master1.saved_schema_csn == master1_schema_csn)
+ assert (topology.master2.saved_schema_csn == master2_schema_csn)
+
+def test_ticket47988_6(topology):
+ '''
+ Update M1 schema and trigger update M2->M1
+ So M2 should learn new/extended definitions that are in M1 schema
+ '''
+
+ _header(topology, 'test_ticket47988_6')
+
+ topology.master1.log.debug("\n\nUpdate M1 schema and an entry on M1\n")
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\nBefore updating the schema on M1\n")
+ topology.master1.log.debug("Master1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("Master2 nsschemaCSN: %s" % master2_schema_csn)
+
+ # Here M1 should no, should check M2 schema and learn
+ _do_update_schema(topology.master1, range=5999)
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\nAfter updating the schema on M1\n")
+ topology.master1.log.debug("Master1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("Master2 nsschemaCSN: %s" % master2_schema_csn)
+ assert (master1_schema_csn)
+
+ # to avoid linger effect where a replication session is reused without checking the schema
+ _pause_M1_to_M2(topology)
+ _resume_M1_to_M2(topology)
+
+ #topo.master1.log.debug("\n\nSleep.... attach the debugger dse_modify")
+ #time.sleep(60)
+ _do_update_entry(supplier=topology.master2, consumer=topology.master1, attempts=15)
+ master1_schema_csn = topology.master1.schema.get_schema_csn()
+ master2_schema_csn = topology.master2.schema.get_schema_csn()
+ topology.master1.log.debug("\nAfter a full replication session\n")
+ topology.master1.log.debug("Master1 nsschemaCSN: %s" % master1_schema_csn)
+ topology.master1.log.debug("Master2 nsschemaCSN: %s" % master2_schema_csn)
+ assert (master1_schema_csn)
+ assert (master2_schema_csn)
+
+def test_ticket47988_final(topology):
+ topology.master1.delete()
+ topology.master2.delete()
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation1_prefix
+ global installation2_prefix
+ installation1_prefix = None
+ installation2_prefix = None
+
+ topo = topology(True)
+ test_ticket47988_init(topo)
+ test_ticket47988_1(topo)
+ test_ticket47988_2(topo)
+ test_ticket47988_3(topo)
+ test_ticket47988_4(topo)
+ test_ticket47988_5(topo)
+ test_ticket47988_6(topo)
+ test_ticket47988_final(topo)
+
+if __name__ == '__main__':
+ run_isolated()
+
1
0
ldap/servers/slapd/schema.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit 1e2bf2b1ee6cd4c08a171edfedb10ee6bb1c3420
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Sun Jan 25 22:05:12 2015 -0800
Ticket 47988: Schema learning mechanism, in replication, unable to extend an existing definition
Description: Covscan FORWARD_NULL fix introduced by commit
commit 51e05df9c37c66206041f026c9a67ec17bc9ea4a
1. ldap/servers/slapd/schema.c:2490: var_deref_op: Dereferencing null pointer "mod->mod_vals.modv_bvals".
2. ldap/servers/slapd/schema.c:2603: var_deref_op: Dereferencing null pointer "mod->mod_vals.modv_bvals".
Added NULL check on mod->mod_bvalues to the for loop stop condition.
(cherry picked from commit cfa8e4daef9253df0bd8a348f302299bda16b37c)
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index e98150e..af52081 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2487,7 +2487,7 @@ schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
}
}
- for (i = 0; mod->mod_bvalues[i]; i++) {
+ for (i = 0; mod->mod_bvalues && mod->mod_bvalues[i]; i++) {
if ( LDAP_SUCCESS != ( rc = parse_oc_str (
(const char *)mod->mod_bvalues[i]->bv_val, &delete_oc,
errorbuf, errorbufsize, 0, 0, schema_ds4x_compat, NULL))) {
@@ -2600,7 +2600,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
}
- for (i = 0; mod->mod_bvalues[i]; i++) {
+ for (i = 0; mod->mod_bvalues && mod->mod_bvalues[i]; i++) {
attr_ldif =(char *) mod->mod_bvalues[i]->bv_val;
/* normalize the attr ldif */
1
0
ldap/servers/slapd/schema.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit cfa8e4daef9253df0bd8a348f302299bda16b37c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Sun Jan 25 22:05:12 2015 -0800
Ticket 47988: Schema learning mechanism, in replication, unable to extend an existing definition
Description: Covscan FORWARD_NULL fix introduced by commit
commit 51e05df9c37c66206041f026c9a67ec17bc9ea4a
1. ldap/servers/slapd/schema.c:2490: var_deref_op: Dereferencing null pointer "mod->mod_vals.modv_bvals".
2. ldap/servers/slapd/schema.c:2603: var_deref_op: Dereferencing null pointer "mod->mod_vals.modv_bvals".
Added NULL check on mod->mod_bvalues to the for loop stop condition.
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index e98150e..af52081 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2487,7 +2487,7 @@ schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
}
}
- for (i = 0; mod->mod_bvalues[i]; i++) {
+ for (i = 0; mod->mod_bvalues && mod->mod_bvalues[i]; i++) {
if ( LDAP_SUCCESS != ( rc = parse_oc_str (
(const char *)mod->mod_bvalues[i]->bv_val, &delete_oc,
errorbuf, errorbufsize, 0, 0, schema_ds4x_compat, NULL))) {
@@ -2600,7 +2600,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
}
- for (i = 0; mod->mod_bvalues[i]; i++) {
+ for (i = 0; mod->mod_bvalues && mod->mod_bvalues[i]; i++) {
attr_ldif =(char *) mod->mod_bvalues[i]->bv_val;
/* normalize the attr ldif */
1
0
ldap/servers/plugins/replication/repl5_connection.c | 17
ldap/servers/slapd/schema.c | 365 ++++++++++++++++----
2 files changed, 309 insertions(+), 73 deletions(-)
New commits:
commit 107316806d291e584028e278c9ce1e0e99ff5617
Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com>
Date: Thu Jan 22 14:29:52 2015 +0100
Ticket 47988: Schema learning mechanism, in replication, unable to extend an existing definition
Bug Description:
At the beginning of a replication session, a supplier checks the status of remote schema vs
its own schema. If the remote schema contains new/extended definitions, the supplier learns
those definitions.
It learns through internal MOD_ADD operation on cn=schema.
For extending definition, this fails because the definition already exists.
Fix Description:
It needs to MOD_DEL and MOD_ADD those extended definitions while it needs to do MOD_ADD for new definitions.
It uses the field 'old_value' in 'struct schema_mods_indexes' to determine if it needs to del some definitions.
Some definitions can not be deleted
- if an objectclass is standard or is a superior of others oc
- if an attribute is a standard definition or is used in objectclass
This was problematic for updating the schema, so the fix is relaxing those controls for
internal operations
https://fedorahosted.org/389/ticket/47988
Reviewed by: ?
Platforms tested: F17
Flag Day: no
Doc impact: no
(cherry picked from commit 51e05df9c37c66206041f026c9a67ec17bc9ea4a)
diff --git a/ldap/servers/plugins/replication/repl5_connection.c b/ldap/servers/plugins/replication/repl5_connection.c
index 2971025..eddcae8 100644
--- a/ldap/servers/plugins/replication/repl5_connection.c
+++ b/ldap/servers/plugins/replication/repl5_connection.c
@@ -1779,6 +1779,7 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
CSN *localcsn = NULL;
Slapi_PBlock *spb = NULL;
char localcsnstr[CSN_STRSIZE + 1] = {0};
+ char remotecnsstr[CSN_STRSIZE+1] = {0};
if (!remotecsn)
{
@@ -1807,6 +1808,16 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
}
else
{
+ if (*remotecsn) {
+ csn_as_string (*remotecsn, PR_FALSE, remotecnsstr);
+ csn_as_string (localcsn, PR_FALSE, localcsnstr);
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "[S] Checking consumer schema localcsn:%s / remotecsn:%s\n", localcsnstr, remotecnsstr);
+ } else {
+ csn_as_string (localcsn, PR_FALSE, localcsnstr);
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "[S] Checking consumer schema localcsn:%s / remotecsn:NULL\n", localcsnstr);
+ }
if (!update_consumer_schema(conn)) {
/* At least one schema definition (attributetypes/objectclasses) of the consumer
* is a superset of the supplier.
@@ -1815,7 +1826,11 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
* So it could be possible that a second attempt (right now) of update_consumer_schema
* would be successful
*/
+ slapi_log_error(SLAPI_LOG_REPL, "schema",
+ "[S] schema definitions may have been learned\n");
if (!update_consumer_schema(conn)) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema",
+ "[S] learned definitions are not suffisant to try to push the schema \n");
return_value = CONN_OPERATION_FAILED;
}
}
@@ -1831,6 +1846,8 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
memcpy(remotecsnstr, remote_schema_csn_bervals[0]->bv_val,
remote_schema_csn_bervals[0]->bv_len);
remotecsnstr[remote_schema_csn_bervals[0]->bv_len] = '\0';
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "[S] Reread remotecsn:%s\n", remotecsnstr);
*remotecsn = csn_new_by_string(remotecsnstr);
if (*remotecsn && (csn_compare(localcsn, *remotecsn) <= 0)) {
return_value = CONN_SCHEMA_NO_UPDATE_NEEDED;
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 52f29c2..e98150e 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -139,6 +139,7 @@ typedef struct repl_schema_policy {
struct schema_mods_indexes {
int index;
char *new_value;
+ char *old_value;
struct schema_mods_indexes *next;
};
@@ -155,9 +156,9 @@ static int oc_check_required(Slapi_PBlock *, Slapi_Entry *,struct objclass *);
static int oc_check_allowed_sv(Slapi_PBlock *, Slapi_Entry *e, const char *type, struct objclass **oclist );
static int schema_delete_objectclasses ( Slapi_Entry *entryBefore,
LDAPMod *mod, char *errorbuf, size_t errorbufsize,
- int schema_ds4x_compat );
+ int schema_ds4x_compat, int is_internal_operation);
static int schema_delete_attributes ( Slapi_Entry *entryBefore,
- LDAPMod *mod, char *errorbuf, size_t errorbufsize);
+ LDAPMod *mod, char *errorbuf, size_t errorbufsize, int is_internal_operation);
static int schema_add_attribute ( Slapi_PBlock *pb, LDAPMod *mod,
char *errorbuf, size_t errorbufsize, int schema_ds4x_compat );
static int schema_add_objectclass ( Slapi_PBlock *pb, LDAPMod *mod,
@@ -2074,7 +2075,9 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
int schema_modify_enabled = config_get_schemamod();
int reapply_mods = 0;
int is_replicated_operation = 0;
-
+ int is_internal_operation = 0;
+ Slapi_Operation *operation = NULL;
+
if (!schema_modify_enabled) {
*returncode = LDAP_UNWILLING_TO_PERFORM;
schema_create_errormsg( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
@@ -2085,6 +2088,8 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
slapi_pblock_get( pb, SLAPI_MODIFY_MODS, &mods );
slapi_pblock_get( pb, SLAPI_IS_REPLICATED_OPERATION, &is_replicated_operation);
+ slapi_pblock_get( pb, SLAPI_OPERATION, &operation);
+ is_internal_operation = slapi_operation_is_flag_set(operation, SLAPI_OP_FLAG_INTERNAL);
/* In case we receive a schema from a supplier, check if we can accept it
* (it is a superset of our own schema).
@@ -2153,11 +2158,11 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
if (SLAPI_IS_MOD_DELETE(mods[i]->mod_op)) {
if (strcasecmp (mods[i]->mod_type, "objectclasses") == 0) {
*returncode = schema_delete_objectclasses (entryBefore, mods[i],
- returntext, SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat );
+ returntext, SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat, is_internal_operation);
}
else if (strcasecmp (mods[i]->mod_type, "attributetypes") == 0) {
*returncode = schema_delete_attributes (entryBefore, mods[i],
- returntext, SLAPI_DSE_RETURNTEXT_SIZE );
+ returntext, SLAPI_DSE_RETURNTEXT_SIZE, is_internal_operation);
}
else {
*returncode= LDAP_NO_SUCH_ATTRIBUTE;
@@ -2196,6 +2201,7 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
schema_create_errormsg( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
schema_errprefix_generic, mods[i]->mod_type,
"Replace is not allowed on the subschema subentry" );
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "modify_schema_dse: Replace is not allowed on the subschema subentry\n");
rc = SLAPI_DSE_CALLBACK_ERROR;
} else {
if (strcasecmp (mods[i]->mod_type, "attributetypes") == 0) {
@@ -2264,7 +2270,7 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
* Add a new objectclass
*/
*returncode = schema_add_objectclass ( pb, mods[i], returntext,
- SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat );
+ SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat);
}
else {
if ( schema_ds4x_compat ) {
@@ -2465,16 +2471,20 @@ oc_add_nolock(struct objclass *newoc)
*/
static int
schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
- char *errorbuf, size_t errorbufsize, int schema_ds4x_compat )
+ char *errorbuf, size_t errorbufsize, int schema_ds4x_compat, int is_internal_operation)
{
int i;
int rc = LDAP_SUCCESS; /* optimistic */
struct objclass *poc, *poc2, *delete_oc = NULL;
if ( NULL == mod->mod_bvalues ) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
- NULL, "Cannot remove all schema object classes" );
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Remove all objectclass in Internal op\n");
+ } else {
+ schema_create_errormsg(errorbuf, errorbufsize, schema_errprefix_oc,
+ NULL, "Cannot remove all schema object classes");
return LDAP_UNWILLING_TO_PERFORM;
+ }
}
for (i = 0; mod->mod_bvalues[i]; i++) {
@@ -2492,11 +2502,19 @@ schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
for (poc2 = g_get_global_oc_nolock(); poc2 != NULL; poc2 = poc2->oc_next) {
if (poc2->oc_superior &&
(strcasecmp (poc2->oc_superior, delete_oc->oc_name) == 0)) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Should not delete object class (%s) which has child object classes"
+ ". But accept it because it is internal operation\n",
+ delete_oc->oc_name);
+ } else {
+ schema_create_errormsg(errorbuf, errorbufsize, schema_errprefix_oc,
delete_oc->oc_name, "Cannot delete an object class"
- " which has child object classes" );
- rc = LDAP_UNWILLING_TO_PERFORM;
- goto unlock_and_return;
+ " which has child object classes");
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Cannot delete an object class (%s) which has child object classes\n",
+ delete_oc->oc_name);
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ goto unlock_and_return;
+ }
}
}
@@ -2505,10 +2523,19 @@ schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
}
else {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
- delete_oc->oc_name, "Cannot delete a standard object class" );
- rc = LDAP_UNWILLING_TO_PERFORM;
- goto unlock_and_return;
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Should not delete a standard object class (%s)"
+ ". But accept it because it is internal operation\n",
+ delete_oc->oc_name);
+ oc_delete_nolock (poc->oc_name);
+ } else {
+ schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
+ delete_oc->oc_name, "Cannot delete a standard object class" );
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Cannot delete a standard object class (%s)\n",
+ delete_oc->oc_name);
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ goto unlock_and_return;
+ }
}
}
else {
@@ -2552,7 +2579,7 @@ schema_return(int rc,struct sizedbuffer * psb1,struct sizedbuffer *psb2,struct s
*/
static int
schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
- char *errorbuf, size_t errorbufsize)
+ char *errorbuf, size_t errorbufsize, int is_internal_operation)
{
char *attr_ldif, *oc_list_type = "";
asyntaxinfo *a;
@@ -2563,10 +2590,14 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
struct sizedbuffer *psbAttrSyntax= sizedbuffer_construct(BUFSIZ);
if (NULL == mod->mod_bvalues) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Remove all attributetypes in Internal op\n");
+ } else {
+ schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
NULL, "Cannot remove all schema attribute types" );
- return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
+ return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
psbAttrSyntax,NULL);
+ }
}
for (i = 0; mod->mod_bvalues[i]; i++) {
@@ -2592,12 +2623,20 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
if ((a = attr_syntax_get_by_name ( psbAttrName->buffer, 0 )) != NULL ) {
/* only modify attrs which were user defined */
if (a->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
- psbAttrName->buffer,
- "Cannot delete a standard attribute type" );
- attr_syntax_return( a );
- return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
- psbAttrSyntax,NULL);
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Should not delete a standard attribute type (%s)"
+ ". But accept it because it is internal operation\n",
+ psbAttrName->buffer);
+ } else {
+ schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
+ psbAttrName->buffer,
+ "Cannot delete a standard attribute type");
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Cannot delete a standard attribute type (%s)\n",
+ psbAttrName->buffer);
+ attr_syntax_return(a);
+ return schema_return(LDAP_UNWILLING_TO_PERFORM, psbAttrOid, psbAttrName,
+ psbAttrSyntax, NULL);
+ }
}
/* Do not allow deletion if referenced by an object class. */
@@ -2627,17 +2666,32 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
if (attr_in_use_by_an_oc) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
- psbAttrName->buffer, "Is included in the %s list for object class %s. Cannot delete.",
- oc_list_type, oc->oc_name );
- break;
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Should not delete an attribute (%s) used in oc (%s)"
+ ". But accept it because it is internal operation\n",
+ oc_list_type, oc->oc_name);
+ } else {
+ schema_create_errormsg(errorbuf, errorbufsize, schema_errprefix_at,
+ psbAttrName->buffer, "Is included in the %s list for object class %s. Cannot delete.",
+ oc_list_type, oc->oc_name);
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Could delete an attribute (%s) used in oc (%s)"
+ ". But accept it because it is internal operation\n",
+ oc_list_type, oc->oc_name);
+ break;
+ }
}
}
oc_unlock();
if (attr_in_use_by_an_oc) {
- attr_syntax_return( a );
- return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
- psbAttrSyntax,NULL);
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Should not delete an attribute used in oc"
+ ". But accept it because it is internal operation\n");
+
+ } else {
+ attr_syntax_return(a);
+ return schema_return(LDAP_UNWILLING_TO_PERFORM, psbAttrOid, psbAttrName,
+ psbAttrSyntax, NULL);
+ }
}
/* Delete it. */
@@ -2744,7 +2798,10 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
}
}
- /* check to see if the superior oc exists */
+ /* check to see if the superior oc exists
+ * This is not enforced for internal op (when learning new schema
+ * definitions from a replication session)
+ */
if (!rc && pnew_oc->oc_superior &&
((psup_oc = oc_find_nolock (pnew_oc->oc_superior, NULL, PR_FALSE)) == NULL)) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
@@ -2798,7 +2855,10 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
sizedbuffer_destroy(psbOcOid);
}
- /* check to see if the oc's attributes are valid */
+ /* check to see if the oc's attributes are valid
+ * This is not checked if this is an internal operation (learning schema
+ * definitions from a replication session)
+ */
if (!rc && !(flags & DSE_SCHEMA_NO_CHECK) &&
schema_check_oc_attrs ( pnew_oc, errorbuf, errorbufsize,
0 /* don't strip options */ ) == 0 ) {
@@ -6276,11 +6336,101 @@ schema_oc_superset_check(struct objclass *oc_list1, struct objclass *oc_list2, c
return rc;
}
+
+static char *
+schema_oc_to_string(struct objclass *oc)
+{
+ char *oc_str;
+ int i;
+ int size = 0;
+
+ /* Compute the size of the string that can contain
+ * the oc definition and allocates it
+ */
+ if (oc->oc_oid) size += strlen(oc->oc_oid);
+ if (oc->oc_name) size += strlen(oc->oc_name);
+ if (oc->oc_desc) size += strlen(oc->oc_desc);
+ if (oc->oc_orig_required) {
+ for (i =0; oc->oc_orig_required[i] != NULL; i++) {
+ size += strlen(oc->oc_orig_required[i]);
+ size += 3;
+ }
+ }
+ if (oc->oc_orig_allowed) {
+ for (i =0; oc->oc_orig_allowed[i] != NULL; i++) {
+ size += strlen(oc->oc_orig_allowed[i]);
+ size += 3;
+ }
+ }
+ size += strlen(schema_oc_kind_strings_with_spaces[oc->oc_kind]);
+
+ size += 128; /* for all keywords: NAME, DESC, SUP... */
+ if ((oc_str = (char *) slapi_ch_calloc(1, size)) == NULL) {
+ return NULL;
+ }
+
+ /* OID + name */
+ sprintf(oc_str, "( %s NAME '%s'", (oc->oc_oid) ? oc->oc_oid : "", oc->oc_name);
+
+ /* description */
+ strcat(oc_str, " DESC '");
+ if (oc->oc_desc) {
+ strcat(oc_str, oc->oc_desc);
+ }
+ strcat(oc_str, "'");
+
+ /* SUP */
+ if (oc->oc_superior) {
+ strcat(oc_str, " SUP '");
+ strcat(oc_str, oc->oc_superior);
+ strcat(oc_str, "'");
+ }
+
+ /* oc_kind */
+ strcat(oc_str, schema_oc_kind_strings_with_spaces[oc->oc_kind]);
+
+ /* MUST */
+ if (oc->oc_orig_required) {
+ strcat(oc_str, " MUST ( ");
+ for ( i = 0; oc->oc_orig_required[i] != NULL; ++i ) {
+ if (i > 0) {
+ strcat(oc_str, " $ ");
+ }
+ strcat(oc_str, oc->oc_orig_required[i]);
+ }
+ strcat(oc_str, " ) ");
+ }
+
+ /* MAY */
+ if (oc->oc_orig_allowed) {
+ strcat(oc_str, " MAY ( ");
+ for ( i = 0; oc->oc_orig_allowed[i] != NULL; ++i ) {
+ if (i > 0) {
+ strcat(oc_str, " $ ");
+ }
+ strcat(oc_str, oc->oc_orig_allowed[i]);
+ }
+ strcat(oc_str, " ) ");
+ }
+
+ /* flags */
+ if (oc->oc_flags & OC_FLAG_USER_OC) {
+ strcat(oc_str, " X-ORIGIN 'blahblahblah'");
+ }
+
+ strcat(oc_str, " )");
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_oc_to_string: replace (old[%d]=%s)\n",
+ size, oc_str);
+
+ return(oc_str);
+
+}
/* call must hold oc_lock at least in read */
static struct schema_mods_indexes *
schema_list_oc2learn(struct objclass *oc_remote_list, struct objclass *oc_local_list, int replica_role) {
struct objclass *oc_remote, *oc_local;
struct schema_mods_indexes *head = NULL, *mods_index;
+ struct schema_mods_indexes *tail = NULL;
int index = 0;
int repl_schema_policy;
const char *message;
@@ -6320,11 +6470,22 @@ schema_list_oc2learn(struct objclass *oc_remote_list, struct objclass *oc_local_
continue;
}
- /* insert it in the list */
+ /* insert it at the end of the list
+ * to keep the order of the original schema
+ * For example superior oc should be declared first
+ */
mods_index->index = index;
- mods_index->next = head;
+ mods_index->next = NULL;
mods_index->new_value = NULL;
- head = mods_index;
+ if (oc_local) {
+ mods_index->old_value = schema_oc_to_string(oc_local);
+ }
+ if (head == NULL) {
+ head = mods_index;
+ } else {
+ tail->next = mods_index;
+ }
+ tail = mods_index;
}
}
slapi_rwlock_unlock( schema_policy_lock );
@@ -7184,17 +7345,27 @@ modify_schema_internal_mod(Slapi_DN *sdn, Slapi_Mods *smods)
/* do modify */
slapi_modify_internal_pb (newpb);
slapi_pblock_get (newpb, SLAPI_PLUGIN_INTOP_RESULT, &op_result);
- if (op_result == LDAP_SUCCESS) {
- /* Update the schema csn if the operation succeeded */
- schema_csn = csn_new();
- if (NULL != schema_csn) {
- csn_set_replicaid(schema_csn, 0);
- csn_set_time(schema_csn, current_time());
- g_set_global_schema_csn(schema_csn);
- }
- }
+ if (op_result == LDAP_SUCCESS) {
+ char *type;
- slapi_pblock_destroy(newpb);
+ if (smods && smods->mods) {
+ type = smods->mods[0]->mod_type;
+ } else {
+ type = "unknown";
+ }
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "modify_schema_internal_mod: successfully learn %s definitions\n", type);
+ /* Update the schema csn if the operation succeeded */
+ schema_csn = csn_new();
+ if (NULL != schema_csn) {
+ csn_set_replicaid(schema_csn, 0);
+ csn_set_time(schema_csn, current_time());
+ g_set_global_schema_csn(schema_csn);
+ }
+ } else {
+ slapi_log_error(SLAPI_LOG_FATAL, "schema", "modify_schema_internal_mod: fail to learn schema definitions (%d) \n", op_result);
+ }
+
+ slapi_pblock_destroy(newpb);
}
/* Prepare slapi_mods for the internal mod
@@ -7202,32 +7373,80 @@ modify_schema_internal_mod(Slapi_DN *sdn, Slapi_Mods *smods)
*/
static void
modify_schema_prepare_mods(Slapi_Mods *smods, char *type, struct schema_mods_indexes *values)
-{
- struct schema_mods_indexes *object;
- struct berval *bv;
- struct berval **bvps;
- int nb_values, i;
-
- for (object = values, nb_values = 0; object != NULL; object = object->next, nb_values++);
- bvps = (struct berval **) slapi_ch_calloc(1, (nb_values + 1) * sizeof(struct berval *));
-
-
+{
+ struct schema_mods_indexes *object;
+ struct berval *bv;
+ struct berval **bvps_del = NULL;
+ struct berval **bvps_add = NULL;
+ int nb_values_del, nb_values_add, i;
+ int nb_mods;
+
+ /* Checks the values to delete */
+ for (object = values, nb_values_del = 0; object != NULL; object = object->next) {
+ if (object->old_value) {
+ nb_values_del++;
+ }
+ }
+ if (nb_values_del) {
+ bvps_del = (struct berval **) slapi_ch_calloc(1, (nb_values_del + 1) * sizeof (struct berval *));
+
+ for (i = 0, object = values; object != NULL; object = object->next) {
+ if (object->old_value) {
+ bv = (struct berval *) slapi_ch_malloc(sizeof (struct berval));
+ bv->bv_len = strlen(object->old_value);
+ bv->bv_val = (void*) object->old_value;
+ bvps_del[i] = bv;
+ i++;
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "MOD[%d] del (%s): %s\n", i, type, object->old_value);
+ }
+ }
+ bvps_del[nb_values_del] = NULL;
+ }
+
+ /* Checks the values to add */
+ for (object = values, nb_values_add = 0; object != NULL; object = object->next, nb_values_add++);
+
+ if (nb_values_add) {
+ bvps_add = (struct berval **) slapi_ch_calloc(1, (nb_values_add + 1) * sizeof (struct berval *));
+
+
for (i = 0, object = values; object != NULL; i++, object = object->next) {
- bv = (struct berval *) slapi_ch_malloc(sizeof(struct berval));
- bv->bv_len = strlen(object->new_value);
- bv->bv_val = (void*) object->new_value;
- bvps[i] = bv;
- slapi_log_error(SLAPI_LOG_REPL, "schema", "MOD[%d] add (%s): %s\n", i, type, object->new_value);
- }
- bvps[nb_values] = NULL;
- slapi_mods_init (smods, 2);
- slapi_mods_add_modbvps( smods, LDAP_MOD_ADD, type, bvps );
- for (i = 0; bvps[i] != NULL; i++) {
- /* bv_val should not be free. It belongs to the incoming MOD */
- slapi_ch_free((void **) &bvps[i]);
- }
- slapi_ch_free((void **) &bvps);
-
+ bv = (struct berval *) slapi_ch_malloc(sizeof (struct berval));
+ bv->bv_len = strlen(object->new_value);
+ bv->bv_val = (void*) object->new_value;
+ bvps_add[i] = bv;
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "MOD[%d] add (%s): %s\n", i, type, object->new_value);
+ }
+ bvps_add[nb_values_add] = NULL;
+ }
+
+ /* Prepare the mods */
+ nb_mods = 1;
+ if (bvps_del) nb_mods++;
+ if (bvps_add) nb_mods++;
+ slapi_mods_init(smods, nb_mods);
+ if (bvps_del) slapi_mods_add_modbvps(smods, LDAP_MOD_DELETE, type, bvps_del);
+ if (bvps_add) slapi_mods_add_modbvps(smods, LDAP_MOD_ADD, type, bvps_add);
+
+
+ /* clean up */
+ if (bvps_del) {
+
+ for (i = 0; bvps_del[i] != NULL; i++) {
+ /* bv_val should not be free. It belongs to the incoming MOD */
+ slapi_ch_free((void **) &bvps_del[i]);
+ }
+ slapi_ch_free((void **) &bvps_del);
+ }
+
+ if (bvps_add) {
+
+ for (i = 0; bvps_add[i] != NULL; i++) {
+ /* bv_val should not be free. It belongs to the incoming MOD */
+ slapi_ch_free((void **) &bvps_add[i]);
+ }
+ slapi_ch_free((void **) &bvps_add);
+ }
}
/* called by modify_schema_dse/supplier_learn_new_definitions to learn new
1
0
ldap/servers/plugins/replication/repl5_connection.c | 17
ldap/servers/slapd/schema.c | 365 ++++++++++++++++----
2 files changed, 309 insertions(+), 73 deletions(-)
New commits:
commit 51e05df9c37c66206041f026c9a67ec17bc9ea4a
Author: Thierry bordaz (tbordaz) <tbordaz(a)redhat.com>
Date: Thu Jan 22 14:29:52 2015 +0100
Ticket 47988: Schema learning mechanism, in replication, unable to extend an existing definition
Bug Description:
At the beginning of a replication session, a supplier checks the status of remote schema vs
its own schema. If the remote schema contains new/extended definitions, the supplier learns
those definitions.
It learns through internal MOD_ADD operation on cn=schema.
For extending definition, this fails because the definition already exists.
Fix Description:
It needs to MOD_DEL and MOD_ADD those extended definitions while it needs to do MOD_ADD for new definitions.
It uses the field 'old_value' in 'struct schema_mods_indexes' to determine if it needs to del some definitions.
Some definitions can not be deleted
- if an objectclass is standard or is a superior of others oc
- if an attribute is a standard definition or is used in objectclass
This was problematic for updating the schema, so the fix is relaxing those controls for
internal operations
https://fedorahosted.org/389/ticket/47988
Reviewed by: ?
Platforms tested: F17
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/plugins/replication/repl5_connection.c b/ldap/servers/plugins/replication/repl5_connection.c
index 969aa07..398ff98 100644
--- a/ldap/servers/plugins/replication/repl5_connection.c
+++ b/ldap/servers/plugins/replication/repl5_connection.c
@@ -1810,6 +1810,7 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
CSN *localcsn = NULL;
Slapi_PBlock *spb = NULL;
char localcsnstr[CSN_STRSIZE + 1] = {0};
+ char remotecnsstr[CSN_STRSIZE+1] = {0};
if (!remotecsn)
{
@@ -1838,6 +1839,16 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
}
else
{
+ if (*remotecsn) {
+ csn_as_string (*remotecsn, PR_FALSE, remotecnsstr);
+ csn_as_string (localcsn, PR_FALSE, localcsnstr);
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "[S] Checking consumer schema localcsn:%s / remotecsn:%s\n", localcsnstr, remotecnsstr);
+ } else {
+ csn_as_string (localcsn, PR_FALSE, localcsnstr);
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "[S] Checking consumer schema localcsn:%s / remotecsn:NULL\n", localcsnstr);
+ }
if (!update_consumer_schema(conn)) {
/* At least one schema definition (attributetypes/objectclasses) of the consumer
* is a superset of the supplier.
@@ -1846,7 +1857,11 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
* So it could be possible that a second attempt (right now) of update_consumer_schema
* would be successful
*/
+ slapi_log_error(SLAPI_LOG_REPL, "schema",
+ "[S] schema definitions may have been learned\n");
if (!update_consumer_schema(conn)) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema",
+ "[S] learned definitions are not suffisant to try to push the schema \n");
return_value = CONN_OPERATION_FAILED;
}
}
@@ -1862,6 +1877,8 @@ conn_push_schema(Repl_Connection *conn, CSN **remotecsn)
memcpy(remotecsnstr, remote_schema_csn_bervals[0]->bv_val,
remote_schema_csn_bervals[0]->bv_len);
remotecsnstr[remote_schema_csn_bervals[0]->bv_len] = '\0';
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "[S] Reread remotecsn:%s\n", remotecsnstr);
*remotecsn = csn_new_by_string(remotecsnstr);
if (*remotecsn && (csn_compare(localcsn, *remotecsn) <= 0)) {
return_value = CONN_SCHEMA_NO_UPDATE_NEEDED;
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 52f29c2..e98150e 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -139,6 +139,7 @@ typedef struct repl_schema_policy {
struct schema_mods_indexes {
int index;
char *new_value;
+ char *old_value;
struct schema_mods_indexes *next;
};
@@ -155,9 +156,9 @@ static int oc_check_required(Slapi_PBlock *, Slapi_Entry *,struct objclass *);
static int oc_check_allowed_sv(Slapi_PBlock *, Slapi_Entry *e, const char *type, struct objclass **oclist );
static int schema_delete_objectclasses ( Slapi_Entry *entryBefore,
LDAPMod *mod, char *errorbuf, size_t errorbufsize,
- int schema_ds4x_compat );
+ int schema_ds4x_compat, int is_internal_operation);
static int schema_delete_attributes ( Slapi_Entry *entryBefore,
- LDAPMod *mod, char *errorbuf, size_t errorbufsize);
+ LDAPMod *mod, char *errorbuf, size_t errorbufsize, int is_internal_operation);
static int schema_add_attribute ( Slapi_PBlock *pb, LDAPMod *mod,
char *errorbuf, size_t errorbufsize, int schema_ds4x_compat );
static int schema_add_objectclass ( Slapi_PBlock *pb, LDAPMod *mod,
@@ -2074,7 +2075,9 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
int schema_modify_enabled = config_get_schemamod();
int reapply_mods = 0;
int is_replicated_operation = 0;
-
+ int is_internal_operation = 0;
+ Slapi_Operation *operation = NULL;
+
if (!schema_modify_enabled) {
*returncode = LDAP_UNWILLING_TO_PERFORM;
schema_create_errormsg( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
@@ -2085,6 +2088,8 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
slapi_pblock_get( pb, SLAPI_MODIFY_MODS, &mods );
slapi_pblock_get( pb, SLAPI_IS_REPLICATED_OPERATION, &is_replicated_operation);
+ slapi_pblock_get( pb, SLAPI_OPERATION, &operation);
+ is_internal_operation = slapi_operation_is_flag_set(operation, SLAPI_OP_FLAG_INTERNAL);
/* In case we receive a schema from a supplier, check if we can accept it
* (it is a superset of our own schema).
@@ -2153,11 +2158,11 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
if (SLAPI_IS_MOD_DELETE(mods[i]->mod_op)) {
if (strcasecmp (mods[i]->mod_type, "objectclasses") == 0) {
*returncode = schema_delete_objectclasses (entryBefore, mods[i],
- returntext, SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat );
+ returntext, SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat, is_internal_operation);
}
else if (strcasecmp (mods[i]->mod_type, "attributetypes") == 0) {
*returncode = schema_delete_attributes (entryBefore, mods[i],
- returntext, SLAPI_DSE_RETURNTEXT_SIZE );
+ returntext, SLAPI_DSE_RETURNTEXT_SIZE, is_internal_operation);
}
else {
*returncode= LDAP_NO_SUCH_ATTRIBUTE;
@@ -2196,6 +2201,7 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
schema_create_errormsg( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
schema_errprefix_generic, mods[i]->mod_type,
"Replace is not allowed on the subschema subentry" );
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "modify_schema_dse: Replace is not allowed on the subschema subentry\n");
rc = SLAPI_DSE_CALLBACK_ERROR;
} else {
if (strcasecmp (mods[i]->mod_type, "attributetypes") == 0) {
@@ -2264,7 +2270,7 @@ modify_schema_dse (Slapi_PBlock *pb, Slapi_Entry *entryBefore, Slapi_Entry *entr
* Add a new objectclass
*/
*returncode = schema_add_objectclass ( pb, mods[i], returntext,
- SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat );
+ SLAPI_DSE_RETURNTEXT_SIZE, schema_ds4x_compat);
}
else {
if ( schema_ds4x_compat ) {
@@ -2465,16 +2471,20 @@ oc_add_nolock(struct objclass *newoc)
*/
static int
schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
- char *errorbuf, size_t errorbufsize, int schema_ds4x_compat )
+ char *errorbuf, size_t errorbufsize, int schema_ds4x_compat, int is_internal_operation)
{
int i;
int rc = LDAP_SUCCESS; /* optimistic */
struct objclass *poc, *poc2, *delete_oc = NULL;
if ( NULL == mod->mod_bvalues ) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
- NULL, "Cannot remove all schema object classes" );
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Remove all objectclass in Internal op\n");
+ } else {
+ schema_create_errormsg(errorbuf, errorbufsize, schema_errprefix_oc,
+ NULL, "Cannot remove all schema object classes");
return LDAP_UNWILLING_TO_PERFORM;
+ }
}
for (i = 0; mod->mod_bvalues[i]; i++) {
@@ -2492,11 +2502,19 @@ schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
for (poc2 = g_get_global_oc_nolock(); poc2 != NULL; poc2 = poc2->oc_next) {
if (poc2->oc_superior &&
(strcasecmp (poc2->oc_superior, delete_oc->oc_name) == 0)) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Should not delete object class (%s) which has child object classes"
+ ". But accept it because it is internal operation\n",
+ delete_oc->oc_name);
+ } else {
+ schema_create_errormsg(errorbuf, errorbufsize, schema_errprefix_oc,
delete_oc->oc_name, "Cannot delete an object class"
- " which has child object classes" );
- rc = LDAP_UNWILLING_TO_PERFORM;
- goto unlock_and_return;
+ " which has child object classes");
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Cannot delete an object class (%s) which has child object classes\n",
+ delete_oc->oc_name);
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ goto unlock_and_return;
+ }
}
}
@@ -2505,10 +2523,19 @@ schema_delete_objectclasses( Slapi_Entry *entryBefore, LDAPMod *mod,
}
else {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
- delete_oc->oc_name, "Cannot delete a standard object class" );
- rc = LDAP_UNWILLING_TO_PERFORM;
- goto unlock_and_return;
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Should not delete a standard object class (%s)"
+ ". But accept it because it is internal operation\n",
+ delete_oc->oc_name);
+ oc_delete_nolock (poc->oc_name);
+ } else {
+ schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
+ delete_oc->oc_name, "Cannot delete a standard object class" );
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_objectclasses: Cannot delete a standard object class (%s)\n",
+ delete_oc->oc_name);
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ goto unlock_and_return;
+ }
}
}
else {
@@ -2552,7 +2579,7 @@ schema_return(int rc,struct sizedbuffer * psb1,struct sizedbuffer *psb2,struct s
*/
static int
schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
- char *errorbuf, size_t errorbufsize)
+ char *errorbuf, size_t errorbufsize, int is_internal_operation)
{
char *attr_ldif, *oc_list_type = "";
asyntaxinfo *a;
@@ -2563,10 +2590,14 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
struct sizedbuffer *psbAttrSyntax= sizedbuffer_construct(BUFSIZ);
if (NULL == mod->mod_bvalues) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Remove all attributetypes in Internal op\n");
+ } else {
+ schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
NULL, "Cannot remove all schema attribute types" );
- return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
+ return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
psbAttrSyntax,NULL);
+ }
}
for (i = 0; mod->mod_bvalues[i]; i++) {
@@ -2592,12 +2623,20 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
if ((a = attr_syntax_get_by_name ( psbAttrName->buffer, 0 )) != NULL ) {
/* only modify attrs which were user defined */
if (a->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
- psbAttrName->buffer,
- "Cannot delete a standard attribute type" );
- attr_syntax_return( a );
- return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
- psbAttrSyntax,NULL);
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Should not delete a standard attribute type (%s)"
+ ". But accept it because it is internal operation\n",
+ psbAttrName->buffer);
+ } else {
+ schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
+ psbAttrName->buffer,
+ "Cannot delete a standard attribute type");
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Cannot delete a standard attribute type (%s)\n",
+ psbAttrName->buffer);
+ attr_syntax_return(a);
+ return schema_return(LDAP_UNWILLING_TO_PERFORM, psbAttrOid, psbAttrName,
+ psbAttrSyntax, NULL);
+ }
}
/* Do not allow deletion if referenced by an object class. */
@@ -2627,17 +2666,32 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
if (attr_in_use_by_an_oc) {
- schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
- psbAttrName->buffer, "Is included in the %s list for object class %s. Cannot delete.",
- oc_list_type, oc->oc_name );
- break;
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Should not delete an attribute (%s) used in oc (%s)"
+ ". But accept it because it is internal operation\n",
+ oc_list_type, oc->oc_name);
+ } else {
+ schema_create_errormsg(errorbuf, errorbufsize, schema_errprefix_at,
+ psbAttrName->buffer, "Is included in the %s list for object class %s. Cannot delete.",
+ oc_list_type, oc->oc_name);
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Could delete an attribute (%s) used in oc (%s)"
+ ". But accept it because it is internal operation\n",
+ oc_list_type, oc->oc_name);
+ break;
+ }
}
}
oc_unlock();
if (attr_in_use_by_an_oc) {
- attr_syntax_return( a );
- return schema_return(LDAP_UNWILLING_TO_PERFORM,psbAttrOid,psbAttrName,
- psbAttrSyntax,NULL);
+ if (is_internal_operation) {
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_delete_attributes: Should not delete an attribute used in oc"
+ ". But accept it because it is internal operation\n");
+
+ } else {
+ attr_syntax_return(a);
+ return schema_return(LDAP_UNWILLING_TO_PERFORM, psbAttrOid, psbAttrName,
+ psbAttrSyntax, NULL);
+ }
}
/* Delete it. */
@@ -2744,7 +2798,10 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
}
}
- /* check to see if the superior oc exists */
+ /* check to see if the superior oc exists
+ * This is not enforced for internal op (when learning new schema
+ * definitions from a replication session)
+ */
if (!rc && pnew_oc->oc_superior &&
((psup_oc = oc_find_nolock (pnew_oc->oc_superior, NULL, PR_FALSE)) == NULL)) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
@@ -2798,7 +2855,10 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
sizedbuffer_destroy(psbOcOid);
}
- /* check to see if the oc's attributes are valid */
+ /* check to see if the oc's attributes are valid
+ * This is not checked if this is an internal operation (learning schema
+ * definitions from a replication session)
+ */
if (!rc && !(flags & DSE_SCHEMA_NO_CHECK) &&
schema_check_oc_attrs ( pnew_oc, errorbuf, errorbufsize,
0 /* don't strip options */ ) == 0 ) {
@@ -6276,11 +6336,101 @@ schema_oc_superset_check(struct objclass *oc_list1, struct objclass *oc_list2, c
return rc;
}
+
+static char *
+schema_oc_to_string(struct objclass *oc)
+{
+ char *oc_str;
+ int i;
+ int size = 0;
+
+ /* Compute the size of the string that can contain
+ * the oc definition and allocates it
+ */
+ if (oc->oc_oid) size += strlen(oc->oc_oid);
+ if (oc->oc_name) size += strlen(oc->oc_name);
+ if (oc->oc_desc) size += strlen(oc->oc_desc);
+ if (oc->oc_orig_required) {
+ for (i =0; oc->oc_orig_required[i] != NULL; i++) {
+ size += strlen(oc->oc_orig_required[i]);
+ size += 3;
+ }
+ }
+ if (oc->oc_orig_allowed) {
+ for (i =0; oc->oc_orig_allowed[i] != NULL; i++) {
+ size += strlen(oc->oc_orig_allowed[i]);
+ size += 3;
+ }
+ }
+ size += strlen(schema_oc_kind_strings_with_spaces[oc->oc_kind]);
+
+ size += 128; /* for all keywords: NAME, DESC, SUP... */
+ if ((oc_str = (char *) slapi_ch_calloc(1, size)) == NULL) {
+ return NULL;
+ }
+
+ /* OID + name */
+ sprintf(oc_str, "( %s NAME '%s'", (oc->oc_oid) ? oc->oc_oid : "", oc->oc_name);
+
+ /* description */
+ strcat(oc_str, " DESC '");
+ if (oc->oc_desc) {
+ strcat(oc_str, oc->oc_desc);
+ }
+ strcat(oc_str, "'");
+
+ /* SUP */
+ if (oc->oc_superior) {
+ strcat(oc_str, " SUP '");
+ strcat(oc_str, oc->oc_superior);
+ strcat(oc_str, "'");
+ }
+
+ /* oc_kind */
+ strcat(oc_str, schema_oc_kind_strings_with_spaces[oc->oc_kind]);
+
+ /* MUST */
+ if (oc->oc_orig_required) {
+ strcat(oc_str, " MUST ( ");
+ for ( i = 0; oc->oc_orig_required[i] != NULL; ++i ) {
+ if (i > 0) {
+ strcat(oc_str, " $ ");
+ }
+ strcat(oc_str, oc->oc_orig_required[i]);
+ }
+ strcat(oc_str, " ) ");
+ }
+
+ /* MAY */
+ if (oc->oc_orig_allowed) {
+ strcat(oc_str, " MAY ( ");
+ for ( i = 0; oc->oc_orig_allowed[i] != NULL; ++i ) {
+ if (i > 0) {
+ strcat(oc_str, " $ ");
+ }
+ strcat(oc_str, oc->oc_orig_allowed[i]);
+ }
+ strcat(oc_str, " ) ");
+ }
+
+ /* flags */
+ if (oc->oc_flags & OC_FLAG_USER_OC) {
+ strcat(oc_str, " X-ORIGIN 'blahblahblah'");
+ }
+
+ strcat(oc_str, " )");
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "schema_oc_to_string: replace (old[%d]=%s)\n",
+ size, oc_str);
+
+ return(oc_str);
+
+}
/* call must hold oc_lock at least in read */
static struct schema_mods_indexes *
schema_list_oc2learn(struct objclass *oc_remote_list, struct objclass *oc_local_list, int replica_role) {
struct objclass *oc_remote, *oc_local;
struct schema_mods_indexes *head = NULL, *mods_index;
+ struct schema_mods_indexes *tail = NULL;
int index = 0;
int repl_schema_policy;
const char *message;
@@ -6320,11 +6470,22 @@ schema_list_oc2learn(struct objclass *oc_remote_list, struct objclass *oc_local_
continue;
}
- /* insert it in the list */
+ /* insert it at the end of the list
+ * to keep the order of the original schema
+ * For example superior oc should be declared first
+ */
mods_index->index = index;
- mods_index->next = head;
+ mods_index->next = NULL;
mods_index->new_value = NULL;
- head = mods_index;
+ if (oc_local) {
+ mods_index->old_value = schema_oc_to_string(oc_local);
+ }
+ if (head == NULL) {
+ head = mods_index;
+ } else {
+ tail->next = mods_index;
+ }
+ tail = mods_index;
}
}
slapi_rwlock_unlock( schema_policy_lock );
@@ -7184,17 +7345,27 @@ modify_schema_internal_mod(Slapi_DN *sdn, Slapi_Mods *smods)
/* do modify */
slapi_modify_internal_pb (newpb);
slapi_pblock_get (newpb, SLAPI_PLUGIN_INTOP_RESULT, &op_result);
- if (op_result == LDAP_SUCCESS) {
- /* Update the schema csn if the operation succeeded */
- schema_csn = csn_new();
- if (NULL != schema_csn) {
- csn_set_replicaid(schema_csn, 0);
- csn_set_time(schema_csn, current_time());
- g_set_global_schema_csn(schema_csn);
- }
- }
+ if (op_result == LDAP_SUCCESS) {
+ char *type;
- slapi_pblock_destroy(newpb);
+ if (smods && smods->mods) {
+ type = smods->mods[0]->mod_type;
+ } else {
+ type = "unknown";
+ }
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "modify_schema_internal_mod: successfully learn %s definitions\n", type);
+ /* Update the schema csn if the operation succeeded */
+ schema_csn = csn_new();
+ if (NULL != schema_csn) {
+ csn_set_replicaid(schema_csn, 0);
+ csn_set_time(schema_csn, current_time());
+ g_set_global_schema_csn(schema_csn);
+ }
+ } else {
+ slapi_log_error(SLAPI_LOG_FATAL, "schema", "modify_schema_internal_mod: fail to learn schema definitions (%d) \n", op_result);
+ }
+
+ slapi_pblock_destroy(newpb);
}
/* Prepare slapi_mods for the internal mod
@@ -7202,32 +7373,80 @@ modify_schema_internal_mod(Slapi_DN *sdn, Slapi_Mods *smods)
*/
static void
modify_schema_prepare_mods(Slapi_Mods *smods, char *type, struct schema_mods_indexes *values)
-{
- struct schema_mods_indexes *object;
- struct berval *bv;
- struct berval **bvps;
- int nb_values, i;
-
- for (object = values, nb_values = 0; object != NULL; object = object->next, nb_values++);
- bvps = (struct berval **) slapi_ch_calloc(1, (nb_values + 1) * sizeof(struct berval *));
-
-
+{
+ struct schema_mods_indexes *object;
+ struct berval *bv;
+ struct berval **bvps_del = NULL;
+ struct berval **bvps_add = NULL;
+ int nb_values_del, nb_values_add, i;
+ int nb_mods;
+
+ /* Checks the values to delete */
+ for (object = values, nb_values_del = 0; object != NULL; object = object->next) {
+ if (object->old_value) {
+ nb_values_del++;
+ }
+ }
+ if (nb_values_del) {
+ bvps_del = (struct berval **) slapi_ch_calloc(1, (nb_values_del + 1) * sizeof (struct berval *));
+
+ for (i = 0, object = values; object != NULL; object = object->next) {
+ if (object->old_value) {
+ bv = (struct berval *) slapi_ch_malloc(sizeof (struct berval));
+ bv->bv_len = strlen(object->old_value);
+ bv->bv_val = (void*) object->old_value;
+ bvps_del[i] = bv;
+ i++;
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "MOD[%d] del (%s): %s\n", i, type, object->old_value);
+ }
+ }
+ bvps_del[nb_values_del] = NULL;
+ }
+
+ /* Checks the values to add */
+ for (object = values, nb_values_add = 0; object != NULL; object = object->next, nb_values_add++);
+
+ if (nb_values_add) {
+ bvps_add = (struct berval **) slapi_ch_calloc(1, (nb_values_add + 1) * sizeof (struct berval *));
+
+
for (i = 0, object = values; object != NULL; i++, object = object->next) {
- bv = (struct berval *) slapi_ch_malloc(sizeof(struct berval));
- bv->bv_len = strlen(object->new_value);
- bv->bv_val = (void*) object->new_value;
- bvps[i] = bv;
- slapi_log_error(SLAPI_LOG_REPL, "schema", "MOD[%d] add (%s): %s\n", i, type, object->new_value);
- }
- bvps[nb_values] = NULL;
- slapi_mods_init (smods, 2);
- slapi_mods_add_modbvps( smods, LDAP_MOD_ADD, type, bvps );
- for (i = 0; bvps[i] != NULL; i++) {
- /* bv_val should not be free. It belongs to the incoming MOD */
- slapi_ch_free((void **) &bvps[i]);
- }
- slapi_ch_free((void **) &bvps);
-
+ bv = (struct berval *) slapi_ch_malloc(sizeof (struct berval));
+ bv->bv_len = strlen(object->new_value);
+ bv->bv_val = (void*) object->new_value;
+ bvps_add[i] = bv;
+ slapi_log_error(SLAPI_LOG_REPL, "schema", "MOD[%d] add (%s): %s\n", i, type, object->new_value);
+ }
+ bvps_add[nb_values_add] = NULL;
+ }
+
+ /* Prepare the mods */
+ nb_mods = 1;
+ if (bvps_del) nb_mods++;
+ if (bvps_add) nb_mods++;
+ slapi_mods_init(smods, nb_mods);
+ if (bvps_del) slapi_mods_add_modbvps(smods, LDAP_MOD_DELETE, type, bvps_del);
+ if (bvps_add) slapi_mods_add_modbvps(smods, LDAP_MOD_ADD, type, bvps_add);
+
+
+ /* clean up */
+ if (bvps_del) {
+
+ for (i = 0; bvps_del[i] != NULL; i++) {
+ /* bv_val should not be free. It belongs to the incoming MOD */
+ slapi_ch_free((void **) &bvps_del[i]);
+ }
+ slapi_ch_free((void **) &bvps_del);
+ }
+
+ if (bvps_add) {
+
+ for (i = 0; bvps_add[i] != NULL; i++) {
+ /* bv_val should not be free. It belongs to the incoming MOD */
+ slapi_ch_free((void **) &bvps_add[i]);
+ }
+ slapi_ch_free((void **) &bvps_add);
+ }
}
/* called by modify_schema_dse/supplier_learn_new_definitions to learn new
1
0
dirsrvtests/suites/dynamic-plugins/test_dynamic_plugins.py | 4
dirsrvtests/suites/schema/test_schema.py | 53 -
dirsrvtests/tickets/ticket47313_test.py | 81 +-
dirsrvtests/tickets/ticket47462_test.py | 17
dirsrvtests/tickets/ticket47490_test.py | 275 ++++----
dirsrvtests/tickets/ticket47553_ger.py | 219 +++---
dirsrvtests/tickets/ticket47553_single_aci_test.py | 440 ++++++-------
dirsrvtests/tickets/ticket47560_test.py | 115 +--
dirsrvtests/tickets/ticket47573_test.py | 140 ++--
dirsrvtests/tickets/ticket47619_test.py | 93 +-
dirsrvtests/tickets/ticket47653MMR_test.py | 169 ++--
dirsrvtests/tickets/ticket47653_test.py | 150 ++--
dirsrvtests/tickets/ticket47664_test.py | 59 -
dirsrvtests/tickets/ticket47676_test.py | 151 ++--
dirsrvtests/tickets/ticket47714_test.py | 25
dirsrvtests/tickets/ticket47721_test.py | 195 +++--
dirsrvtests/tickets/ticket47781_test.py | 20
dirsrvtests/tickets/ticket47787_test.py | 244 +++----
dirsrvtests/tickets/ticket47808_test.py | 72 +-
dirsrvtests/tickets/ticket47815_test.py | 3
dirsrvtests/tickets/ticket47819_test.py | 3
dirsrvtests/tickets/ticket47823_test.py | 405 ++++++-----
dirsrvtests/tickets/ticket47824_test.py | 57 -
dirsrvtests/tickets/ticket47829_test.py | 436 ++++++------
dirsrvtests/tickets/ticket47838_test.py | 43 -
dirsrvtests/tickets/ticket47869MMR_test.py | 125 ++-
dirsrvtests/tickets/ticket47871_test.py | 98 +-
dirsrvtests/tickets/ticket47900_test.py | 33
dirsrvtests/tickets/ticket47920_test.py | 73 +-
dirsrvtests/tickets/ticket47937_test.py | 6
dirsrvtests/tickets/ticket47950_test.py | 6
dirsrvtests/tickets/ticket47953_test.py | 6
dirsrvtests/tickets/ticket47970_test.py | 6
dirsrvtests/tickets/ticket47973_test.py | 6
dirsrvtests/tickets/ticket47980_test.py | 6
dirsrvtests/tickets/ticket47981_test.py | 6
36 files changed, 2021 insertions(+), 1819 deletions(-)
New commits:
commit d1f75af041b6bb8e3c0a4db3ed5c69fc5d6b46c8
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Jan 23 16:50:21 2015 -0500
Ticket 47999 - lib389 individual tests not running correctly
when run as a whole
Description: Each test should delete the instances it creates. That way each new test
truly starts fresh. Otherwise if running all the tests, like in jenkins,
or running py.test, there are no conflicts and unexpected instances in
the mix.
Made sure all the tests call the "final" function, and that the "final"
function deletes any instances it creates.
Also fixed the formatting of all the scripts to be compliant with python
coding standards. Removed lines that accidentally ended with ";", and
fixed deprecated processes.
https://fedorahosted.org/389/ticket/47999
Reviewed by: nhosoi(Thanks!)
diff --git a/dirsrvtests/suites/dynamic-plugins/test_dynamic_plugins.py b/dirsrvtests/suites/dynamic-plugins/test_dynamic_plugins.py
index 288505b..2460ecc 100644
--- a/dirsrvtests/suites/dynamic-plugins/test_dynamic_plugins.py
+++ b/dirsrvtests/suites/dynamic-plugins/test_dynamic_plugins.py
@@ -513,7 +513,7 @@ def test_dynamic_plugins(topology):
def test_dynamic_plugins_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -529,6 +529,8 @@ def run_isolated():
topo = topology(True)
test_dynamic_plugins(topo)
+ test_dynamic_plugins_final(topo)
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/suites/schema/test_schema.py b/dirsrvtests/suites/schema/test_schema.py
index cbf8579..4629cc6 100644
--- a/dirsrvtests/suites/schema/test_schema.py
+++ b/dirsrvtests/suites/schema/test_schema.py
@@ -26,18 +26,20 @@ log = logging.getLogger(__name__)
installation_prefix = None
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
self.standalone = standalone
+
@pytest.fixture(scope="module")
def topology(request):
'''
This fixture is used to create a DirSrv instance for the 'module'.
At the beginning, there may already be an instance.
There may also be a backup for the instance.
-
+
Principle:
If instance exists:
restart it
@@ -55,30 +57,30 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
- schemainst = DirSrv(verbose=False)
-
+ schemainst = DirSrv(verbose=False)
+
# Args for the master instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
schemainst.allocate(args_instance)
-
+
# Get the status of the backups
- backup = schemainst.checkBackupFS()
-
+ backup = schemainst.checkBackupFS()
+
# Get the status of the instance and restart it if it exists
if schemainst.exists():
schemainst.stop(timeout=10)
schemainst.start(timeout=10)
-
+
if backup:
- # The backup exists, assuming it is correct
+ # The backup exists, assuming it is correct
# we just re-init the instance with it
if not schemainst.exists():
schemainst.create()
# Used to retrieve configuration information (dbdir, confdir...)
schemainst.open()
-
+
# restore from backup
schemainst.stop(timeout=10)
schemainst.restoreFS(backup)
@@ -89,30 +91,31 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup) we clear all backups that an instance may have created
if backup:
schemainst.clearBackupFS()
-
+
# Remove all the instances
if schemainst.exists():
schemainst.delete()
-
+
# Create the instances
schemainst.create()
- schemainst.open()
-
+ schemainst.open()
+
# Time to create the backup
schemainst.stop(timeout=10)
schemainst.backupfile = schemainst.backupFS()
- schemainst.start(timeout=10)
- #
+ schemainst.start(timeout=10)
+ #
return TopologyStandalone(schemainst)
attrclass = ldap.schema.models.AttributeType
occlass = ldap.schema.models.ObjectClass
+
def ochasattr(subschema, oc, mustormay, attr, key):
"""See if the oc and any of its parents and ancestors have the
given attr"""
@@ -134,6 +137,7 @@ def ochasattr(subschema, oc, mustormay, attr, key):
break
return rc
+
def ochasattrs(subschema, oc, mustormay, attrs):
key = mustormay + "dict"
ret = []
@@ -142,6 +146,7 @@ def ochasattrs(subschema, oc, mustormay, attrs):
ret.append(attr)
return ret
+
def mycmp(v1, v2):
v1ary, v2ary = [v1], [v2]
if isinstance(v1, list) or isinstance(v1, tuple):
@@ -156,6 +161,7 @@ def mycmp(v1, v2):
return False
return True
+
def ocgetdiffs(ldschema, oc1, oc2):
fields = ['obsolete', 'names', 'desc', 'must', 'may', 'kind', 'sup']
ret = ''
@@ -172,6 +178,7 @@ def ocgetdiffs(ldschema, oc1, oc2):
ret = ret + '\t%s differs: [%s] vs. [%s]\n' % (field, oc1.__dict__[field], oc2.__dict__[field])
return ret
+
def atgetparfield(subschema, at, field):
v = None
for nameoroid in at.sup:
@@ -184,6 +191,7 @@ def atgetparfield(subschema, at, field):
syntax_len_supported = False
+
def atgetdiffs(ldschema, at1, at2):
fields = ['names', 'desc', 'obsolete', 'sup', 'equality', 'ordering', 'substr', 'syntax',
'single_value', 'collective', 'no_user_mod', 'usage']
@@ -197,6 +205,7 @@ def atgetdiffs(ldschema, at1, at2):
ret = ret + '\t%s differs: [%s] vs. [%s]\n' % (field, at1.__dict__[field], at2.__dict__[field])
return ret
+
def test_schema_comparewithfiles(topology):
'''Compare the schema from ldap cn=schema with the schema files'''
retval = True
@@ -235,24 +244,26 @@ def test_schema_comparewithfiles(topology):
retval = False
assert retval
+
def test_schema_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = os.environ.get('PREFIX')
-
+ installation_prefix = os.environ.get('PREFIX')
+
topo = topology(True)
test_schema_comparewithfiles(topo)
-
+
test_schema_final(topo)
if __name__ == '__main__':
diff --git a/dirsrvtests/tickets/ticket47313_test.py b/dirsrvtests/tickets/ticket47313_test.py
index a946f08..1907faa 100644
--- a/dirsrvtests/tickets/ticket47313_test.py
+++ b/dirsrvtests/tickets/ticket47313_test.py
@@ -18,7 +18,7 @@ log = logging.getLogger(__name__)
installation_prefix = None
ENTRY_NAME = 'test_entry'
-
+
class TopologyStandalone(object):
def __init__(self, standalone):
@@ -32,7 +32,7 @@ def topology(request):
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -51,60 +51,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=False)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
-
+
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -112,8 +112,8 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
-
- #
+
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
@@ -125,19 +125,19 @@ def test_ticket47313_run(topology):
"""
It adds 2 test entries
Search with filters including subtype and !
- It deletes the added entries
+ It deletes the added entries
"""
-
+
# bind as directory manager
topology.standalone.log.info("Bind as %s" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
# enable filter error logging
mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '32')]
topology.standalone.modify_s(DN_CONFIG, mod)
-
+
topology.standalone.log.info("\n\n######################### ADD ######################\n")
-
+
# Prepare the entry with cn;fr & cn;en
entry_name_fr = '%s fr' % (ENTRY_NAME)
entry_name_en = '%s en' % (ENTRY_NAME)
@@ -149,7 +149,7 @@ def test_ticket47313_run(topology):
entry_both.setValues('cn', entry_name_both)
entry_both.setValues('cn;fr', entry_name_fr)
entry_both.setValues('cn;en', entry_name_en)
-
+
# Prepare the entry with one member
entry_name_en_only = '%s en only' % (ENTRY_NAME)
entry_dn_en_only = 'cn=%s, %s' % (entry_name_en_only, SUFFIX)
@@ -158,15 +158,15 @@ def test_ticket47313_run(topology):
entry_en_only.setValues('sn', entry_name_en_only)
entry_en_only.setValues('cn', entry_name_en_only)
entry_en_only.setValues('cn;en', entry_name_en)
-
+
topology.standalone.log.info("Try to add Add %s: %r" % (entry_dn_both, entry_both))
topology.standalone.add_s(entry_both)
topology.standalone.log.info("Try to add Add %s: %r" % (entry_dn_en_only, entry_en_only))
topology.standalone.add_s(entry_en_only)
-
+
topology.standalone.log.info("\n\n######################### SEARCH ######################\n")
-
+
# filter: (&(cn=test_entry en only)(!(cn=test_entry fr)))
myfilter = '(&(sn=%s)(!(cn=%s)))' % (entry_name_en_only, entry_name_fr)
topology.standalone.log.info("Try to search with filter %s" % myfilter)
@@ -174,7 +174,7 @@ def test_ticket47313_run(topology):
assert len(ents) == 1
assert ents[0].sn == entry_name_en_only
topology.standalone.log.info("Found %s" % ents[0].dn)
-
+
# filter: (&(cn=test_entry en only)(!(cn;fr=test_entry fr)))
myfilter = '(&(sn=%s)(!(cn;fr=%s)))' % (entry_name_en_only, entry_name_fr)
topology.standalone.log.info("Try to search with filter %s" % myfilter)
@@ -182,42 +182,41 @@ def test_ticket47313_run(topology):
assert len(ents) == 1
assert ents[0].sn == entry_name_en_only
topology.standalone.log.info("Found %s" % ents[0].dn)
-
+
# filter: (&(cn=test_entry en only)(!(cn;en=test_entry en)))
myfilter = '(&(sn=%s)(!(cn;en=%s)))' % (entry_name_en_only, entry_name_en)
topology.standalone.log.info("Try to search with filter %s" % myfilter)
ents = topology.standalone.search_s(SUFFIX, ldap.SCOPE_SUBTREE, myfilter)
assert len(ents) == 0
topology.standalone.log.info("Found none")
-
+
topology.standalone.log.info("\n\n######################### DELETE ######################\n")
-
+
topology.standalone.log.info("Try to delete %s " % entry_dn_both)
topology.standalone.delete_s(entry_dn_both)
-
+
topology.standalone.log.info("Try to delete %s " % entry_dn_en_only)
topology.standalone.delete_s(entry_dn_en_only)
+
def test_ticket47313_final(topology):
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '0')]
- topology.standalone.modify_s(DN_CONFIG, mod)
-
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
+
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47313_run(topo)
-
+
test_ticket47313_final(topo)
diff --git a/dirsrvtests/tickets/ticket47462_test.py b/dirsrvtests/tickets/ticket47462_test.py
index a909b37..67b43d7 100644
--- a/dirsrvtests/tickets/ticket47462_test.py
+++ b/dirsrvtests/tickets/ticket47462_test.py
@@ -244,9 +244,14 @@ def test_ticket47462(topology):
#
try:
topology.master1.modify_s(DES_PLUGIN,
- [(ldap.MOD_REPLACE, 'nsslapd-pluginPath', 'libdes-plugin'),
- (ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')])
+ [(ldap.MOD_REPLACE, 'nsslapd-pluginEnabled', 'on')])
+ except ldap.LDAPError, e:
+ log.fatal('Failed to enable DES plugin, error: ' + e.message['desc'])
+ assert False
+ try:
+ topology.master1.modify_s(DES_PLUGIN,
+ [(ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')])
except ldap.LDAPError, e:
log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
assert False
@@ -258,7 +263,7 @@ def test_ticket47462(topology):
except ldap.NO_SUCH_ATTRIBUTE:
pass
except ldap.LDAPError, e:
- log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ log.fatal('Failed to reset MMR plugin, error: ' + e.message['desc'])
assert False
#
@@ -428,8 +433,8 @@ def test_ticket47462(topology):
def test_ticket47462_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
def run_isolated():
@@ -447,6 +452,8 @@ def run_isolated():
topo = topology(True)
test_ticket47462(topo)
+ test_ticket47462_final(topo)
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47490_test.py b/dirsrvtests/tickets/ticket47490_test.py
index a1946de..29d8d04 100644
--- a/dirsrvtests/tickets/ticket47490_test.py
+++ b/dirsrvtests/tickets/ticket47490_test.py
@@ -36,27 +36,29 @@ class TopologyMasterConsumer(object):
def __init__(self, master, consumer):
master.open()
self.master = master
-
+
consumer.open()
self.consumer = consumer
+
def _header(topology, label):
topology.master.log.info("\n\n###############################################")
topology.master.log.info("#######")
topology.master.log.info("####### %s" % label)
topology.master.log.info("#######")
topology.master.log.info("###################################################")
-
+
+
def pattern_errorlog(file, log_pattern):
try:
pattern_errorlog.last_pos += 1
except AttributeError:
pattern_errorlog.last_pos = 0
-
+
found = None
log.debug("_pattern_errorlog: start at offset %d" % pattern_errorlog.last_pos)
file.seek(pattern_errorlog.last_pos)
-
+
# Use a while true iteration because 'for line in file: hit a
# python bug that break file.tell()
while True:
@@ -65,11 +67,12 @@ def pattern_errorlog(file, log_pattern):
found = log_pattern.search(line)
if ((line == '') or (found)):
break
-
+
log.debug("_pattern_errorlog: end at offset %d" % file.tell())
pattern_errorlog.last_pos = file.tell()
return found
+
def _oc_definition(oid_ext, name, must=None, may=None):
oid = "1.2.3.4.5.6.7.8.9.10.%d" % oid_ext
desc = 'To test ticket 47490'
@@ -78,37 +81,40 @@ def _oc_definition(oid_ext, name, must=None, may=None):
must = MUST_OLD
if not may:
may = MAY_OLD
-
+
new_oc = "( %s NAME '%s' DESC '%s' SUP %s AUXILIARY MUST %s MAY %s )" % (oid, name, desc, sup, must, may)
return new_oc
+
def add_OC(instance, oid_ext, name):
new_oc = _oc_definition(oid_ext, name)
instance.schema.add_schema('objectClasses', new_oc)
+
def mod_OC(instance, oid_ext, name, old_must=None, old_may=None, new_must=None, new_may=None):
old_oc = _oc_definition(oid_ext, name, old_must, old_may)
new_oc = _oc_definition(oid_ext, name, new_must, new_may)
instance.schema.del_schema('objectClasses', old_oc)
instance.schema.add_schema('objectClasses', new_oc)
+
def support_schema_learning(topology):
"""
- with https://fedorahosted.org/389/ticket/47721, the supplier and consumer can learn
+ with https://fedorahosted.org/389/ticket/47721, the supplier and consumer can learn
schema definitions when a replication occurs.
Before that ticket: replication of the schema fails requiring administrative operation
In the test the schemaCSN (master consumer) differs
-
+
After that ticket: replication of the schema succeeds (after an initial phase of learning)
In the test the schema CSN (master consumer) are in sync
-
+
This function returns True if 47721 is fixed in the current release
False else
"""
ent = topology.consumer.getEntry(DN_CONFIG, ldap.SCOPE_BASE, "(cn=config)", ['nsslapd-versionstring'])
if ent.hasAttr('nsslapd-versionstring'):
val = ent.getValue('nsslapd-versionstring')
- version = val.split('/')[1].split('.') # something like ['1', '3', '1', '23', 'final_fix']
+ version = val.split('/')[1].split('.') # something like ['1', '3', '1', '23', 'final_fix']
major = int(version[0])
minor = int(version[1])
if major > 1:
@@ -121,7 +127,8 @@ def support_schema_learning(topology):
if int(version[2]) >= 3:
return True
return False
-
+
+
def trigger_update(topology):
"""
It triggers an update on the supplier. This will start a replication
@@ -133,7 +140,7 @@ def trigger_update(topology):
trigger_update.value = 1
replace = [(ldap.MOD_REPLACE, 'telephonenumber', str(trigger_update.value))]
topology.master.modify_s(ENTRY_DN, replace)
-
+
# wait 10 seconds that the update is replicated
loop = 0
while loop <= 10:
@@ -149,7 +156,8 @@ def trigger_update(topology):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+
+
def trigger_schema_push(topology):
'''
Trigger update to create a replication session.
@@ -165,8 +173,7 @@ def trigger_schema_push(topology):
topology.master.agreement.pause(ra.dn)
topology.master.agreement.resume(ra.dn)
trigger_update(topology)
-
-
+
@pytest.fixture(scope="module")
def topology(request):
@@ -175,7 +182,7 @@ def topology(request):
The replicated topology is MASTER -> Consumer.
At the beginning, It may exists a master instance and/or a consumer instance.
It may also exists a backup for the master and/or the consumer.
-
+
Principle:
If master instance exists:
restart it
@@ -199,17 +206,17 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
master = DirSrv(verbose=False)
consumer = DirSrv(verbose=False)
-
+
# Args for the master instance
args_instance[SER_HOST] = HOST_MASTER
args_instance[SER_PORT] = PORT_MASTER
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER
args_master = args_instance.copy()
master.allocate(args_master)
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_CONSUMER
args_instance[SER_PORT] = PORT_CONSUMER
@@ -217,40 +224,39 @@ def topology(request):
args_consumer = args_instance.copy()
consumer.allocate(args_consumer)
-
# Get the status of the backups
backup_master = master.checkBackupFS()
backup_consumer = consumer.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_master = master.exists()
+ instance_master = master.exists()
if instance_master:
master.stop(timeout=10)
master.start(timeout=10)
-
+
instance_consumer = consumer.exists()
if instance_consumer:
consumer.stop(timeout=10)
consumer.start(timeout=10)
-
+
if backup_master and backup_consumer:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master:
master.create()
# Used to retrieve configuration information (dbdir, confdir...)
master.open()
-
+
if not instance_consumer:
consumer.create()
# Used to retrieve configuration information (dbdir, confdir...)
consumer.open()
-
+
# restore master from backup
master.stop(timeout=10)
master.restoreFS(backup_master)
master.start(timeout=10)
-
+
# restore consumer from backup
consumer.stop(timeout=10)
consumer.restoreFS(backup_consumer)
@@ -261,55 +267,56 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master:
master.clearBackupFS()
if backup_consumer:
consumer.clearBackupFS()
-
+
# Remove all the instances
if instance_master:
master.delete()
if instance_consumer:
consumer.delete()
-
+
# Create the instances
master.create()
master.open()
consumer.create()
consumer.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER)
consumer.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_CONSUMER)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master.agreement.create(suffix=SUFFIX, host=consumer.host, port=consumer.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
master.agreement.init(SUFFIX, HOST_CONSUMER, PORT_CONSUMER)
master.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
+ ent = None
loop = 0
while loop <= 10:
try:
@@ -318,12 +325,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master.stop(timeout=10)
master.backupfile = master.backupFS()
master.start(timeout=10)
-
+
consumer.stop(timeout=10)
consumer.backupfile = consumer.backupFS()
consumer.start(timeout=10)
@@ -331,7 +340,7 @@ def topology(request):
# clear the tmp directory
master.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -340,24 +349,25 @@ def topology(request):
def test_ticket47490_init(topology):
- """
+ """
Initialize the test environment
"""
log.debug("test_ticket47490_init topology %r (master %r, consumer %r" % (topology, topology.master, topology.consumer))
- # the test case will check if a warning message is logged in the
+ # the test case will check if a warning message is logged in the
# error log of the supplier
topology.master.errorlog_file = open(topology.master.errlog, "r")
-
+
# This entry will be used to trigger attempt of schema push
topology.master.add_s(Entry((ENTRY_DN, {
'objectclass': "top person".split(),
'sn': 'test_entry',
'cn': 'test_entry'})))
-
+
+
def test_ticket47490_one(topology):
"""
Summary: Extra OC Schema is pushed - no error
-
+
If supplier schema is a superset (one extra OC) of consumer schema, then
schema is pushed and there is no message in the error log
State at startup:
@@ -366,58 +376,60 @@ def test_ticket47490_one(topology):
Final state
- supplier +masterNewOCA
- consumer +masterNewOCA
-
+
"""
_header(topology, "Extra OC Schema is pushed - no error")
-
+
log.debug("test_ticket47490_one topology %r (master %r, consumer %r" % (topology, topology.master, topology.consumer))
- # update the schema of the supplier so that it is a superset of
+ # update the schema of the supplier so that it is a superset of
# consumer. Schema should be pushed
add_OC(topology.master, 2, 'masterNewOCA')
-
+
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was updated on the consumer
log.debug("test_ticket47490_one master_schema_csn=%s", master_schema_csn)
log.debug("ctest_ticket47490_one onsumer_schema_csn=%s", consumer_schema_csn)
assert master_schema_csn == consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
-
+ if res is not None:
+ assert False
+
+
def test_ticket47490_two(topology):
"""
Summary: Extra OC Schema is pushed - (ticket 47721 allows to learn missing def)
-
+
If consumer schema is a superset (one extra OC) of supplier schema, then
schema is pushed and there is a message in the error log
- State at startup
+ State at startup
- supplier +masterNewOCA
- consumer +masterNewOCA
Final state
- supplier +masterNewOCA +masterNewOCB
- consumer +masterNewOCA +consumerNewOCA
-
+
"""
-
+
_header(topology, "Extra OC Schema is pushed - (ticket 47721 allows to learn missing def)")
-
+
# add this OC on consumer. Supplier will no push the schema
add_OC(topology.consumer, 1, 'consumerNewOCA')
-
+
# add a new OC on the supplier so that its nsSchemaCSN is larger than the consumer (wait 2s)
time.sleep(2)
add_OC(topology.master, 3, 'masterNewOCB')
-
+
# now push the scheam
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was NOT updated on the consumer
# with 47721, supplier learns the missing definition
log.debug("test_ticket47490_two master_schema_csn=%s", master_schema_csn)
@@ -432,13 +444,14 @@ def test_ticket47490_two(topology):
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
+
def test_ticket47490_three(topology):
"""
Summary: Extra OC Schema is pushed - no error
-
+
If supplier schema is again a superset (one extra OC), then
schema is pushed and there is no message in the error log
- State at startup
+ State at startup
- supplier +masterNewOCA +masterNewOCB
- consumer +masterNewOCA +consumerNewOCA
Final state
@@ -447,16 +460,16 @@ def test_ticket47490_three(topology):
"""
_header(topology, "Extra OC Schema is pushed - no error")
-
+
# Do an upate to trigger the schema push attempt
# add this OC on consumer. Supplier will no push the schema
add_OC(topology.master, 1, 'consumerNewOCA')
-
+
# now push the scheam
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was NOT updated on the consumer
log.debug("test_ticket47490_three master_schema_csn=%s", master_schema_csn)
log.debug("test_ticket47490_three consumer_schema_csn=%s", consumer_schema_csn)
@@ -465,15 +478,17 @@ def test_ticket47490_three(topology):
# Check the error log of the supplier does not contain an error
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
-
+ if res is not None:
+ assert False
+
+
def test_ticket47490_four(topology):
"""
Summary: Same OC - extra MUST: Schema is pushed - no error
-
+
If supplier schema is again a superset (OC with more MUST), then
schema is pushed and there is no message in the error log
- State at startup
+ State at startup
- supplier +masterNewOCA +masterNewOCB +consumerNewOCA
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA
Final state
@@ -481,34 +496,35 @@ def test_ticket47490_four(topology):
+must=telexnumber
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA
+must=telexnumber
-
+
"""
_header(topology, "Same OC - extra MUST: Schema is pushed - no error")
-
+
mod_OC(topology.master, 2, 'masterNewOCA', old_must=MUST_OLD, new_must=MUST_NEW, old_may=MAY_OLD, new_may=MAY_OLD)
-
-
+
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was updated on the consumer
log.debug("test_ticket47490_four master_schema_csn=%s", master_schema_csn)
log.debug("ctest_ticket47490_four onsumer_schema_csn=%s", consumer_schema_csn)
assert master_schema_csn == consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
-
+ if res is not None:
+ assert False
+
+
def test_ticket47490_five(topology):
"""
Summary: Same OC - extra MUST: Schema is pushed - (fix for 47721)
-
+
If consumer schema is a superset (OC with more MUST), then
schema is pushed (fix for 47721) and there is a message in the error log
- State at startup
+ State at startup
- supplier +masterNewOCA +masterNewOCB +consumerNewOCA
+must=telexnumber
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA
@@ -518,24 +534,24 @@ def test_ticket47490_five(topology):
+must=telexnumber
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA
+must=telexnumber +must=telexnumber
-
+
Note: replication log is enabled to get more details
"""
_header(topology, "Same OC - extra MUST: Schema is pushed - (fix for 47721)")
-
+
# get more detail why it fails
topology.master.enableReplLogging()
-
+
# add telenumber to 'consumerNewOCA' on the consumer
mod_OC(topology.consumer, 1, 'consumerNewOCA', old_must=MUST_OLD, new_must=MUST_NEW, old_may=MAY_OLD, new_may=MAY_OLD)
# add a new OC on the supplier so that its nsSchemaCSN is larger than the consumer (wait 2s)
time.sleep(2)
add_OC(topology.master, 4, 'masterNewOCC')
-
+
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was NOT updated on the consumer
# with 47721, supplier learns the missing definition
log.debug("test_ticket47490_five master_schema_csn=%s", master_schema_csn)
@@ -544,59 +560,59 @@ def test_ticket47490_five(topology):
assert master_schema_csn == consumer_schema_csn
else:
assert master_schema_csn != consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
# This message may happen during the learning phase
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
-
+
def test_ticket47490_six(topology):
"""
Summary: Same OC - extra MUST: Schema is pushed - no error
-
+
If supplier schema is again a superset (OC with more MUST), then
schema is pushed and there is no message in the error log
- State at startup
+ State at startup
- supplier +masterNewOCA +masterNewOCB +consumerNewOCA +masterNewOCC
+must=telexnumber
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA
+must=telexnumber +must=telexnumber
Final state
-
+
- supplier +masterNewOCA +masterNewOCB +consumerNewOCA +masterNewOCC
+must=telexnumber +must=telexnumber
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA +masterNewOCC
+must=telexnumber +must=telexnumber
-
+
Note: replication log is enabled to get more details
"""
_header(topology, "Same OC - extra MUST: Schema is pushed - no error")
-
# add telenumber to 'consumerNewOCA' on the consumer
mod_OC(topology.master, 1, 'consumerNewOCA', old_must=MUST_OLD, new_must=MUST_NEW, old_may=MAY_OLD, new_may=MAY_OLD)
-
+
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was NOT updated on the consumer
log.debug("test_ticket47490_six master_schema_csn=%s", master_schema_csn)
log.debug("ctest_ticket47490_six onsumer_schema_csn=%s", consumer_schema_csn)
assert master_schema_csn == consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
# This message may happen during the learning phase
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
+ if res is not None:
+ assert False
def test_ticket47490_seven(topology):
"""
Summary: Same OC - extra MAY: Schema is pushed - no error
-
+
If supplier schema is again a superset (OC with more MAY), then
schema is pushed and there is no message in the error log
State at startup
@@ -610,32 +626,32 @@ def test_ticket47490_seven(topology):
+may=postOfficeBox
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA +masterNewOCC
+must=telexnumber +must=telexnumber
- +may=postOfficeBox
+ +may=postOfficeBox
"""
_header(topology, "Same OC - extra MAY: Schema is pushed - no error")
mod_OC(topology.master, 2, 'masterNewOCA', old_must=MUST_NEW, new_must=MUST_NEW, old_may=MAY_OLD, new_may=MAY_NEW)
-
-
+
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was updated on the consumer
log.debug("test_ticket47490_seven master_schema_csn=%s", master_schema_csn)
log.debug("ctest_ticket47490_seven consumer_schema_csn=%s", consumer_schema_csn)
assert master_schema_csn == consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
-
+ if res is not None:
+ assert False
+
def test_ticket47490_eight(topology):
"""
Summary: Same OC - extra MAY: Schema is pushed (fix for 47721)
-
+
If consumer schema is a superset (OC with more MAY), then
schema is pushed (fix for 47721) and there is message in the error log
State at startup
@@ -651,20 +667,20 @@ def test_ticket47490_eight(topology):
+may=postOfficeBox +may=postOfficeBox
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA +masterNewOCC
+must=telexnumber +must=telexnumber
- +may=postOfficeBox +may=postOfficeBox
+ +may=postOfficeBox +may=postOfficeBox
"""
_header(topology, "Same OC - extra MAY: Schema is pushed (fix for 47721)")
-
+
mod_OC(topology.consumer, 1, 'consumerNewOCA', old_must=MUST_NEW, new_must=MUST_NEW, old_may=MAY_OLD, new_may=MAY_NEW)
# modify OC on the supplier so that its nsSchemaCSN is larger than the consumer (wait 2s)
time.sleep(2)
mod_OC(topology.master, 4, 'masterNewOCC', old_must=MUST_OLD, new_must=MUST_OLD, old_may=MAY_OLD, new_may=MAY_NEW)
-
+
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was not updated on the consumer
# with 47721, supplier learns the missing definition
log.debug("test_ticket47490_eight master_schema_csn=%s", master_schema_csn)
@@ -673,17 +689,17 @@ def test_ticket47490_eight(topology):
assert master_schema_csn == consumer_schema_csn
else:
assert master_schema_csn != consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
# This message may happen during the learning phase
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
-
-
+
+
def test_ticket47490_nine(topology):
"""
Summary: Same OC - extra MAY: Schema is pushed - no error
-
+
If consumer schema is a superset (OC with more MAY), then
schema is not pushed and there is message in the error log
State at startup
@@ -692,10 +708,10 @@ def test_ticket47490_nine(topology):
+may=postOfficeBox +may=postOfficeBox
- consumer +masterNewOCA +masterNewOCB +consumerNewOCA +masterNewOCC
+must=telexnumber +must=telexnumber
- +may=postOfficeBox +may=postOfficeBox
+ +may=postOfficeBox +may=postOfficeBox
Final state
-
+
- supplier +masterNewOCA +masterNewOCB +consumerNewOCA +masterNewOCC
+must=telexnumber +must=telexnumber
+may=postOfficeBox +may=postOfficeBox +may=postOfficeBox
@@ -704,38 +720,41 @@ def test_ticket47490_nine(topology):
+may=postOfficeBox +may=postOfficeBox +may=postOfficeBox
"""
_header(topology, "Same OC - extra MAY: Schema is pushed - no error")
-
+
mod_OC(topology.master, 1, 'consumerNewOCA', old_must=MUST_NEW, new_must=MUST_NEW, old_may=MAY_OLD, new_may=MAY_NEW)
-
+
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was updated on the consumer
log.debug("test_ticket47490_nine master_schema_csn=%s", master_schema_csn)
log.debug("ctest_ticket47490_nine onsumer_schema_csn=%s", consumer_schema_csn)
assert master_schema_csn == consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
-
+ if res is not None:
+ assert False
+
+
def test_ticket47490_final(topology):
- topology.master.stop(timeout=10)
- topology.consumer.stop(timeout=10)
+ topology.master.delete()
+ topology.consumer.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47490_init(topo)
test_ticket47490_one(topo)
@@ -747,7 +766,7 @@ def run_isolated():
test_ticket47490_seven(topo)
test_ticket47490_eight(topo)
test_ticket47490_nine(topo)
-
+
test_ticket47490_final(topo)
diff --git a/dirsrvtests/tickets/ticket47553_ger.py b/dirsrvtests/tickets/ticket47553_ger.py
index d688c70..72df885 100644
--- a/dirsrvtests/tickets/ticket47553_ger.py
+++ b/dirsrvtests/tickets/ticket47553_ger.py
@@ -19,7 +19,7 @@ from lib389._constants import *
from lib389.properties import *
from constants import *
from lib389._constants import REPLICAROLE_MASTER
-from ldap.controls.simple import GetEffectiveRightsControl
+from ldap.controls.simple import GetEffectiveRightsControl
logging.getLogger(__name__).setLevel(logging.DEBUG)
log = logging.getLogger(__name__)
@@ -54,11 +54,12 @@ MAX_ACCOUNTS = 20
CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
+
class TopologyMaster1Master2(object):
def __init__(self, master1, master2):
master1.open()
self.master1 = master1
-
+
master2.open()
self.master2 = master2
@@ -70,7 +71,7 @@ def topology(request):
The replicated topology is MASTER1 <-> Master2.
At the beginning, It may exists a master2 instance and/or a master2 instance.
It may also exists a backup for the master1 and/or the master2.
-
+
Principle:
If master1 instance exists:
restart it
@@ -94,22 +95,22 @@ def topology(request):
global installation2_prefix
# allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
+
# Args for the master1 instance
args_instance[SER_HOST] = HOST_MASTER_1
args_instance[SER_PORT] = PORT_MASTER_1
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
args_master = args_instance.copy()
master1.allocate(args_master)
-
+
# allocate master1 on a given deployement
master2 = DirSrv(verbose=False)
if installation2_prefix:
args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_MASTER_2
args_instance[SER_PORT] = PORT_MASTER_2
@@ -117,40 +118,39 @@ def topology(request):
args_master = args_instance.copy()
master2.allocate(args_master)
-
# Get the status of the backups
backup_master1 = master1.checkBackupFS()
backup_master2 = master2.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_master1 = master1.exists()
+ instance_master1 = master1.exists()
if instance_master1:
master1.stop(timeout=10)
master1.start(timeout=10)
-
+
instance_master2 = master2.exists()
if instance_master2:
master2.stop(timeout=10)
master2.start(timeout=10)
-
+
if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master1:
master1.create()
# Used to retrieve configuration information (dbdir, confdir...)
master1.open()
-
+
if not instance_master2:
master2.create()
# Used to retrieve configuration information (dbdir, confdir...)
master2.open()
-
+
# restore master1 from backup
master1.stop(timeout=10)
master1.restoreFS(backup_master1)
master1.start(timeout=10)
-
+
# restore master2 from backup
master2.stop(timeout=10)
master2.restoreFS(backup_master2)
@@ -161,48 +161,48 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master1:
master1.clearBackupFS()
if backup_master2:
master2.clearBackupFS()
-
+
# Remove all the instances
if instance_master1:
master1.delete()
if instance_master2:
master2.delete()
-
+
# Create the instances
master1.create()
master1.open()
master2.create()
master2.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
@@ -212,13 +212,14 @@ def topology(request):
master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
master1.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master1.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -226,20 +227,22 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master1.stop(timeout=10)
master1.backupfile = master1.backupFS()
master1.start(timeout=10)
-
+
master2.stop(timeout=10)
master2.backupfile = master2.backupFS()
master2.start(timeout=10)
# clear the tmp directory
master1.clearTmpDir(__file__)
-
- #
+
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -247,29 +250,31 @@ def topology(request):
return TopologyMaster1Master2(master1, master2)
-
def _bind_manager(topology):
topology.master1.log.info("Bind as %s " % DN_DM)
topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
+
+
def _bind_normal(topology):
# bind as bind_entry
topology.master1.log.info("Bind as %s" % BIND_DN)
topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
+
+
def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
'''
It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
'''
- assert mod_type != None
-
+ if mod_type is None:
+ assert False
+
ACI_TARGET_FROM = ""
ACI_TARGET_TO = ""
if target_from:
ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
if target_to:
ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
+
ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
@@ -277,11 +282,12 @@ def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target
#topology.master1.modify_s(SUFFIX, mod)
topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type != None
+def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
+ if mod_type is None:
+ assert False
+
ACI_TARGET_FROM = ""
ACI_TARGET_TO = ""
if target_from:
@@ -295,9 +301,11 @@ def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGIN
mod = [(mod_type, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
+
def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- assert mod_type != None
-
+ if mod_type is None:
+ assert False
+
ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
@@ -313,11 +321,11 @@ def test_ticket47553_init(topology):
- a production DIT
- add accounts in staging DIT
- enable ACL logging (commented for performance reason)
-
+
"""
-
+
topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
+
# entry used to bind with
topology.master1.log.info("Add %s" % BIND_DN)
topology.master1.add_s(Entry((BIND_DN, {
@@ -325,37 +333,33 @@ def test_ticket47553_init(topology):
'sn': BIND_CN,
'cn': BIND_CN,
'userpassword': BIND_PW})))
-
+
# DIT for staging
topology.master1.log.info("Add %s" % STAGING_DN)
topology.master1.add_s(Entry((STAGING_DN, {
'objectclass': "top organizationalRole".split(),
'cn': STAGING_CN,
'description': "staging DIT"})))
-
+
# DIT for production
topology.master1.log.info("Add %s" % PRODUCTION_DN)
topology.master1.add_s(Entry((PRODUCTION_DN, {
'objectclass': "top organizationalRole".split(),
'cn': PRODUCTION_CN,
'description': "production DIT"})))
-
+
# DIT for production/except
topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
'objectclass': "top organizationalRole".split(),
'cn': EXCEPT_CN,
'description': "production except DIT"})))
-
+
# enable acl error logging
#mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
#topology.master1.modify_s(DN_CONFIG, mod)
#topology.master2.modify_s(DN_CONFIG, mod)
-
-
-
-
# add dummy entries in the staging DIT
for cpt in range(MAX_ACCOUNTS):
name = "%s%d" % (NEW_ACCOUNT, cpt)
@@ -369,11 +373,11 @@ def test_ticket47553_mode_default_add_deny(topology):
'''
This test case checks that the ADD operation fails (no ADD aci on production)
'''
-
+
topology.master1.log.info("\n\n######################### mode moddn_aci : ADD (should fail) ######################\n")
-
+
_bind_normal(topology)
-
+
#
# First try to add an entry in production => INSUFFICIENT_ACCESS
#
@@ -389,42 +393,44 @@ def test_ticket47553_mode_default_add_deny(topology):
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
def test_ticket47553_mode_default_ger_no_moddn(topology):
topology.master1.log.info("\n\n######################### mode moddn_aci : GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
+ topology.master1.log.info("dn: %s" % dn)
value = attrs['entryLevelRights'][0]
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ topology.master1.log.info("############### entryLevelRights: %r" % value)
assert 'n' not in value
-
+
+
def test_ticket47553_mode_default_ger_with_moddn(topology):
'''
This test case adds the moddn aci and check ger contains 'n'
'''
-
+
topology.master1.log.info("\n\n######################### mode moddn_aci: GER with moddn ######################\n")
# successfull MOD with the ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
value = ''
for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
+ topology.master1.log.info("dn: %s" % dn)
value = attrs['entryLevelRights'][0]
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ topology.master1.log.info("############### entryLevelRights: %r" % value)
assert 'n' in value
# successfull MOD with the both ACI
@@ -432,53 +438,57 @@ def test_ticket47553_mode_default_ger_with_moddn(topology):
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
+
def test_ticket47553_mode_switch_default_to_legacy(topology):
'''
This test switch the server from default mode to legacy
'''
- topology.master1.log.info("\n\n######################### Disable the moddn aci mod ######################\n" )
+ topology.master1.log.info("\n\n######################### Disable the moddn aci mod ######################\n")
_bind_manager(topology)
mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
topology.master1.modify_s(DN_CONFIG, mod)
-
+
+
def test_ticket47553_mode_legacy_ger_no_moddn1(topology):
topology.master1.log.info("\n\n######################### mode legacy 1: GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
+ topology.master1.log.info("dn: %s" % dn)
value = attrs['entryLevelRights'][0]
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ topology.master1.log.info("############### entryLevelRights: %r" % value)
assert 'n' not in value
+
def test_ticket47553_mode_legacy_ger_no_moddn2(topology):
topology.master1.log.info("\n\n######################### mode legacy 2: GER no moddn ######################\n")
# successfull MOD with the ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
+ topology.master1.log.info("dn: %s" % dn)
value = attrs['entryLevelRights'][0]
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ topology.master1.log.info("############### entryLevelRights: %r" % value)
assert 'n' not in value
-
- # successfull MOD with the both ACI
+
+ # successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
+
def test_ticket47553_mode_legacy_ger_with_moddn(topology):
topology.master1.log.info("\n\n######################### mode legacy : GER with moddn ######################\n")
@@ -493,34 +503,35 @@ def test_ticket47553_mode_legacy_ger_with_moddn(topology):
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
_bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
+ topology.master1.log.info("dn: %s" % dn)
value = attrs['entryLevelRights'][0]
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
+ topology.master1.log.info("############### entryLevelRights: %r" % value)
assert 'n' in value
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
_bind_normal(topology)
-
-
+
+
def test_ticket47553_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
@@ -529,7 +540,7 @@ def run_isolated():
global installation2_prefix
installation1_prefix = None
installation2_prefix = None
-
+
topo = topology(True)
topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
test_ticket47553_init(topo)
@@ -542,10 +553,8 @@ def run_isolated():
test_ticket47553_mode_legacy_ger_no_moddn1(topo)
test_ticket47553_mode_legacy_ger_no_moddn2(topo)
test_ticket47553_mode_legacy_ger_with_moddn(topo)
-
- test_ticket47553_final(topo)
-
+ test_ticket47553_final(topo)
if __name__ == '__main__':
diff --git a/dirsrvtests/tickets/ticket47553_single_aci_test.py b/dirsrvtests/tickets/ticket47553_single_aci_test.py
index 4be2470..34e3eec 100644
--- a/dirsrvtests/tickets/ticket47553_single_aci_test.py
+++ b/dirsrvtests/tickets/ticket47553_single_aci_test.py
@@ -53,11 +53,12 @@ MAX_ACCOUNTS = 20
CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
+
class TopologyMaster1Master2(object):
def __init__(self, master1, master2):
master1.open()
self.master1 = master1
-
+
master2.open()
self.master2 = master2
@@ -69,7 +70,7 @@ def topology(request):
The replicated topology is MASTER1 <-> Master2.
At the beginning, It may exists a master2 instance and/or a master2 instance.
It may also exists a backup for the master1 and/or the master2.
-
+
Principle:
If master1 instance exists:
restart it
@@ -93,22 +94,22 @@ def topology(request):
global installation2_prefix
# allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
+
# Args for the master1 instance
args_instance[SER_HOST] = HOST_MASTER_1
args_instance[SER_PORT] = PORT_MASTER_1
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
args_master = args_instance.copy()
master1.allocate(args_master)
-
+
# allocate master1 on a given deployement
master2 = DirSrv(verbose=False)
if installation2_prefix:
args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_MASTER_2
args_instance[SER_PORT] = PORT_MASTER_2
@@ -116,40 +117,39 @@ def topology(request):
args_master = args_instance.copy()
master2.allocate(args_master)
-
# Get the status of the backups
backup_master1 = master1.checkBackupFS()
backup_master2 = master2.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
instance_master1 = master1.exists()
if instance_master1:
master1.stop(timeout=10)
master1.start(timeout=10)
-
+
instance_master2 = master2.exists()
if instance_master2:
master2.stop(timeout=10)
master2.start(timeout=10)
-
+
if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master1:
master1.create()
# Used to retrieve configuration information (dbdir, confdir...)
master1.open()
-
+
if not instance_master2:
master2.create()
# Used to retrieve configuration information (dbdir, confdir...)
master2.open()
-
+
# restore master1 from backup
master1.stop(timeout=10)
master1.restoreFS(backup_master1)
master1.start(timeout=10)
-
+
# restore master2 from backup
master2.stop(timeout=10)
master2.restoreFS(backup_master2)
@@ -160,48 +160,48 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master1:
master1.clearBackupFS()
if backup_master2:
master2.clearBackupFS()
-
+
# Remove all the instances
if instance_master1:
master1.delete()
if instance_master2:
master2.delete()
-
+
# Create the instances
master1.create()
master1.open()
master2.create()
master2.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
@@ -211,13 +211,14 @@ def topology(request):
master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
master1.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master1.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -225,20 +226,22 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master1.stop(timeout=10)
master1.backupfile = master1.backupFS()
master1.start(timeout=10)
-
+
master2.stop(timeout=10)
master2.backupfile = master2.backupFS()
master2.start(timeout=10)
# clear the tmp directory
master1.clearTmpDir(__file__)
-
- #
+
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -246,29 +249,30 @@ def topology(request):
return TopologyMaster1Master2(master1, master2)
-
def _bind_manager(topology):
topology.master1.log.info("Bind as %s " % DN_DM)
topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
+
+
def _bind_normal(topology):
# bind as bind_entry
topology.master1.log.info("Bind as %s" % BIND_DN)
topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
+
+
def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
'''
It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
'''
- assert mod_type != None
-
+ assert mod_type is not None
+
ACI_TARGET_FROM = ""
ACI_TARGET_TO = ""
if target_from:
ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
if target_to:
ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
+
ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
@@ -276,11 +280,11 @@ def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target
#topology.master1.modify_s(SUFFIX, mod)
topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type != None
+def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
+ assert mod_type is not None
+
ACI_TARGET_FROM = ""
ACI_TARGET_TO = ""
if target_from:
@@ -294,9 +298,10 @@ def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGIN
mod = [(mod_type, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
+
def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- assert mod_type != None
-
+ assert mod_type is not None
+
ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
@@ -312,11 +317,11 @@ def test_ticket47553_init(topology):
- a production DIT
- add accounts in staging DIT
- enable ACL logging (commented for performance reason)
-
+
"""
-
+
topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
+
# entry used to bind with
topology.master1.log.info("Add %s" % BIND_DN)
topology.master1.add_s(Entry((BIND_DN, {
@@ -324,37 +329,33 @@ def test_ticket47553_init(topology):
'sn': BIND_CN,
'cn': BIND_CN,
'userpassword': BIND_PW})))
-
+
# DIT for staging
topology.master1.log.info("Add %s" % STAGING_DN)
topology.master1.add_s(Entry((STAGING_DN, {
'objectclass': "top organizationalRole".split(),
'cn': STAGING_CN,
'description': "staging DIT"})))
-
+
# DIT for production
topology.master1.log.info("Add %s" % PRODUCTION_DN)
topology.master1.add_s(Entry((PRODUCTION_DN, {
'objectclass': "top organizationalRole".split(),
'cn': PRODUCTION_CN,
'description': "production DIT"})))
-
+
# DIT for production/except
topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
'objectclass': "top organizationalRole".split(),
'cn': EXCEPT_CN,
'description': "production except DIT"})))
-
+
# enable acl error logging
#mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
#topology.master1.modify_s(DN_CONFIG, mod)
#topology.master2.modify_s(DN_CONFIG, mod)
-
-
-
-
# add dummy entries in the staging DIT
for cpt in range(MAX_ACCOUNTS):
name = "%s%d" % (NEW_ACCOUNT, cpt)
@@ -368,11 +369,11 @@ def test_ticket47553_add(topology):
'''
This test case checks that the ADD operation fails (no ADD aci on production)
'''
-
+
topology.master1.log.info("\n\n######################### ADD (should fail) ######################\n")
-
+
_bind_normal(topology)
-
+
#
# First try to add an entry in production => INSUFFICIENT_ACCESS
#
@@ -388,13 +389,14 @@ def test_ticket47553_add(topology):
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
def test_ticket47553_delete(topology):
'''
This test case checks that the DEL operation fails (no 'delete' aci on production)
'''
-
+
topology.master1.log.info("\n\n######################### DELETE (should fail) ######################\n")
-
+
_bind_normal(topology)
#
# Second try to delete an entry in staging => INSUFFICIENT_ACCESS
@@ -407,23 +409,23 @@ def test_ticket47553_delete(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
+
def test_ticket47553_moddn_staging_prod_0(topology):
'''
This test case MOVE entry NEW_ACCOUNT0 from staging to prod
target_to/target_from: equality filter
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (0) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s0" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -435,38 +437,38 @@ def test_ticket47553_moddn_staging_prod_0(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
-
+
+
def test_ticket47553_moddn_staging_prod_1(topology):
'''
This test case MOVE entry NEW_ACCOUNT1 from staging to prod
target_to/target_from: substring/equality filter
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (1) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s1" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -478,38 +480,39 @@ def test_ticket47553_moddn_staging_prod_1(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to substring/ from equality filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
_bind_normal(topology)
-
-
+
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
_bind_normal(topology)
+
def test_ticket47553_moddn_staging_prod_2(topology):
'''
This test case fails to MOVE entry NEW_ACCOUNT2 from staging to prod
because of bad pattern
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (2) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s2" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -521,14 +524,14 @@ def test_ticket47553_moddn_staging_prod_2(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to substring (BAD)/ from equality filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
_bind_normal(topology)
-
+
try:
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
@@ -537,27 +540,28 @@ def test_ticket47553_moddn_staging_prod_2(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
_bind_normal(topology)
-
+
+
def test_ticket47553_moddn_staging_prod_3(topology):
'''
This test case MOVE entry NEW_ACCOUNT3 from staging to prod
target_to/target_from: equality/substring filter
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (3) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s3" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -569,38 +573,38 @@ def test_ticket47553_moddn_staging_prod_3(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to:equality filter / from substring filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
+
def test_ticket47553_moddn_staging_prod_4(topology):
'''
This test case fails to MOVE entry NEW_ACCOUNT4 from staging to prod
because of bad pattern
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (4) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s4" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -612,14 +616,13 @@ def test_ticket47553_moddn_staging_prod_4(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to: equality filter/ from: substring (BAD) ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
try:
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
@@ -628,27 +631,28 @@ def test_ticket47553_moddn_staging_prod_4(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
+
def test_ticket47553_moddn_staging_prod_5(topology):
'''
This test case MOVE entry NEW_ACCOUNT5 from staging to prod
target_to/target_from: substring/substring filter
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (5) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s5" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -660,38 +664,37 @@ def test_ticket47553_moddn_staging_prod_5(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: substring filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
_bind_normal(topology)
-
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
_bind_normal(topology)
-
+
+
def test_ticket47553_moddn_staging_prod_6(topology):
'''
This test case MOVE entry NEW_ACCOUNT6 from staging to prod
target_to/target_from: substring/<enmpty> filter
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (6) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s6" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -703,38 +706,37 @@ def test_ticket47553_moddn_staging_prod_6(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: empty ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=PRODUCTION_PATTERN)
_bind_normal(topology)
-
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=PRODUCTION_PATTERN)
_bind_normal(topology)
-
+
+
def test_ticket47553_moddn_staging_prod_7(topology):
'''
This test case MOVE entry NEW_ACCOUNT7 from staging to prod
target_to/target_from: <empty>/substring filter
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (7) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s7" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -746,39 +748,37 @@ def test_ticket47553_moddn_staging_prod_7(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to: empty/ from: substring filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=None)
_bind_normal(topology)
-
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=None)
_bind_normal(topology)
-
-
+
+
def test_ticket47553_moddn_staging_prod_8(topology):
'''
This test case MOVE entry NEW_ACCOUNT8 from staging to prod
target_to/target_from: <empty>/<empty> filter
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (8) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s8" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -790,23 +790,22 @@ def test_ticket47553_moddn_staging_prod_8(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to: empty/ from: empty ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=None)
_bind_normal(topology)
-
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=None)
_bind_normal(topology)
-
+
+
def test_ticket47553_moddn_staging_prod_9(topology):
'''
This test case disable the 'moddn' right so a MODDN requires a 'add' right
@@ -814,22 +813,22 @@ def test_ticket47553_moddn_staging_prod_9(topology):
It fails to MOVE entry NEW_ACCOUNT9 from staging to prod.
Add a 'add' right to prod.
Then it succeeds to MOVE NEW_ACCOUNT9 from staging to prod.
-
+
Then enable the 'moddn' right so a MODDN requires a 'moddn' right
It fails to MOVE entry NEW_ACCOUNT10 from staging to prod.
Add a 'moddn' right to prod.
Then it succeeds to MOVE NEW_ACCOUNT10 from staging to prod.
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (9) ######################\n")
-
- _bind_normal(topology)
+
+ _bind_normal(topology)
old_rdn = "cn=%s9" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -841,21 +840,21 @@ def test_ticket47553_moddn_staging_prod_9(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
############################################
# Now do tests with no support of moddn aci
############################################
- topology.master1.log.info("Disable the moddn right" )
+ topology.master1.log.info("Disable the moddn right")
_bind_manager(topology)
mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
topology.master1.modify_s(DN_CONFIG, mod)
-
+
# Add the moddn aci that will not be evaluated because of the config flag
topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
# It will fail because it will test the ADD right
try:
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
@@ -866,51 +865,50 @@ def test_ticket47553_moddn_staging_prod_9(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# remove the moddn aci
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
- #
+
+ #
# add the 'add' right to the production DN
# Then do a successfull moddn
#
ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
+
_bind_manager(topology)
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.master1.modify_s(PRODUCTION_DN, mod)
_bind_normal(topology)
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
_bind_manager(topology)
mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
topology.master1.modify_s(PRODUCTION_DN, mod)
_bind_normal(topology)
-
-
+
############################################
# Now do tests with support of moddn aci
############################################
- topology.master1.log.info("Enable the moddn right" )
+ topology.master1.log.info("Enable the moddn right")
_bind_manager(topology)
mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'on')]
topology.master1.modify_s(DN_CONFIG, mod)
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (10) ######################\n")
-
- _bind_normal(topology)
+
+ _bind_normal(topology)
old_rdn = "cn=%s10" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -922,20 +920,20 @@ def test_ticket47553_moddn_staging_prod_9(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- #
+
+ #
# add the 'add' right to the production DN
# Then do a failing moddn
#
ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
+
_bind_manager(topology)
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.master1.modify_s(PRODUCTION_DN, mod)
_bind_normal(topology)
-
+
try:
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
@@ -945,41 +943,42 @@ def test_ticket47553_moddn_staging_prod_9(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
_bind_manager(topology)
mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
topology.master1.modify_s(PRODUCTION_DN, mod)
_bind_normal(topology)
-
+
# Add the moddn aci that will be evaluated because of the config flag
topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
# remove the moddn aci
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
+
def test_ticket47553_moddn_prod_staging(topology):
'''
This test checks that we can move ACCOUNT11 from staging to prod
but not move back ACCOUNT11 from prod to staging
'''
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (11) ######################\n")
-
+
_bind_normal(topology)
-
+
old_rdn = "cn=%s11" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -991,25 +990,22 @@ def test_ticket47553_moddn_prod_staging(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_bind_normal(topology)
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
-
- #
+
# Now check we can not move back the entry to staging
old_rdn = "cn=%s11" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, PRODUCTION_DN)
new_rdn = old_rdn
new_superior = STAGING_DN
-
+
try:
topology.master1.log.info("Try to move back MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
@@ -1019,7 +1015,7 @@ def test_ticket47553_moddn_prod_staging(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
@@ -1030,14 +1026,14 @@ def test_ticket47553_check_repl_M2_to_M1(topology):
'''
Checks that replication is still working M2->M1, using ACCOUNT12
'''
-
+
topology.master1.log.info("Bind as %s (M2)" % DN_DM)
topology.master2.simple_bind_s(DN_DM, PASSWORD)
-
+
rdn = "cn=%s12" % NEW_ACCOUNT
dn = "%s,%s" % (rdn, STAGING_DN)
-
- # First wait for the ACCOUNT19 entry being replicated on M2
+
+ # First wait for the ACCOUNT19 entry being replicated on M2
loop = 0
while loop <= 10:
try:
@@ -1047,41 +1043,41 @@ def test_ticket47553_check_repl_M2_to_M1(topology):
time.sleep(1)
loop += 1
assert loop <= 10
-
-
+
attribute = 'description'
tested_value = 'Hello world'
mod = [(ldap.MOD_ADD, attribute, tested_value)]
topology.master1.log.info("Update (M2) %s (%s)" % (dn, attribute))
topology.master2.modify_s(dn, mod)
-
+
loop = 0
while loop <= 10:
ent = topology.master1.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
- assert ent != None
+ assert ent is not None
if ent.hasAttr(attribute) and (ent.getValue(attribute) == tested_value):
break
-
+
time.sleep(1)
loop += 1
assert loop < 10
topology.master1.log.info("Update %s (%s) replicated on M1" % (dn, attribute))
+
def test_ticket47553_moddn_staging_prod_except(topology):
'''
This test case MOVE entry NEW_ACCOUNT13 from staging to prod
but fails to move entry NEW_ACCOUNT14 from staging to prod_except
'''
-
+
topology.master1.log.info("\n\n######################### MOVE staging -> Prod (13) ######################\n")
_bind_normal(topology)
-
+
old_rdn = "cn=%s13" % NEW_ACCOUNT
old_dn = "%s,%s" % (old_rdn, STAGING_DN)
new_rdn = old_rdn
new_superior = PRODUCTION_DN
-
- #
+
+ #
# Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
#
try:
@@ -1093,18 +1089,17 @@ def test_ticket47553_moddn_staging_prod_except(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# successfull MOD with the ACI
topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_moddn_aci_deny_tree(topology, mod_type=ldap.MOD_ADD)
_bind_normal(topology)
-
+
topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
+
#
# Now try to move an entry under except
#
@@ -1122,21 +1117,23 @@ def test_ticket47553_moddn_staging_prod_except(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# successfull MOD with the both ACI
_bind_manager(topology)
_moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
_moddn_aci_deny_tree(topology, mod_type=ldap.MOD_DELETE)
_bind_normal(topology)
-
+
+
def test_ticket47553_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
@@ -1145,12 +1142,11 @@ def run_isolated():
global installation2_prefix
installation1_prefix = None
installation2_prefix = None
-
+
topo = topology(True)
topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
test_ticket47553_init(topo)
-
# Check that without appropriate aci we are not allowed to add/delete
test_ticket47553_add(topo)
test_ticket47553_delete(topo)
@@ -1162,27 +1158,25 @@ def run_isolated():
test_ticket47553_moddn_staging_prod_3(topo)
test_ticket47553_moddn_staging_prod_4(topo)
test_ticket47553_moddn_staging_prod_5(topo)
-
+
# tests the ACI with undefined 'target_to'/'target_from'
test_ticket47553_moddn_staging_prod_6(topo)
test_ticket47553_moddn_staging_prod_7(topo)
test_ticket47553_moddn_staging_prod_8(topo)
-
+
# Check we can control the behavior with nsslapd-moddn-aci
test_ticket47553_moddn_staging_prod_9(topo)
-
+
# Check we can move entry 'from' -> 'to' but not 'to' -> 'from'
test_ticket47553_moddn_prod_staging(topo)
-
+
# check replication is still working
test_ticket47553_check_repl_M2_to_M1(topo)
-
+
# check DENY rule is working
test_ticket47553_moddn_staging_prod_except(topo)
-
- test_ticket47553_final(topo)
-
+ test_ticket47553_final(topo)
if __name__ == '__main__':
diff --git a/dirsrvtests/tickets/ticket47560_test.py b/dirsrvtests/tickets/ticket47560_test.py
index af7fdc3..a4b4433 100644
--- a/dirsrvtests/tickets/ticket47560_test.py
+++ b/dirsrvtests/tickets/ticket47560_test.py
@@ -17,6 +17,7 @@ log = logging.getLogger(__name__)
installation_prefix = None
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
@@ -29,7 +30,7 @@ def topology(request):
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -48,60 +49,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=False)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
-
+
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -110,7 +111,7 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
- #
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
@@ -126,21 +127,21 @@ def test_ticket47560(topology):
- Create entry cn=member,SUFFIX
- Update 'cn=member,SUFFIX' to add "memberOf: cn=group,SUFFIX"
- Enable Memberof Plugins
-
- # Here the cn=member entry has a 'memberOf' but
+
+ # Here the cn=member entry has a 'memberOf' but
# cn=group entry does not contain 'cn=member' in its member
-
+
TEST CASE
- start the fixupmemberof task
- read the cn=member entry
- check 'memberOf is now empty
-
+
TEARDOWN
- Delete entry cn=group,SUFFIX
- Delete entry cn=member,SUFFIX
- Disable Memberof Plugins
"""
-
+
def _enable_disable_mbo(value):
"""
Enable or disable mbo plugin depending on 'value' ('on'/'off')
@@ -152,15 +153,15 @@ def test_ticket47560(topology):
topology.standalone.plugins.disable(name=PLUGIN_MEMBER_OF)
log.debug("-------------> _enable_disable_mbo(%s)" % value)
-
+
topology.standalone.stop(timeout=120)
time.sleep(1)
topology.standalone.start(timeout=120)
time.sleep(3)
-
+
# need to reopen a connection toward the instance
topology.standalone.open()
-
+
def _test_ticket47560_setup():
"""
- Create entry cn=group,SUFFIX
@@ -168,10 +169,10 @@ def test_ticket47560(topology):
- Update 'cn=member,SUFFIX' to add "memberOf: cn=group,SUFFIX"
- Enable Memberof Plugins
"""
- log.debug( "-------- > _test_ticket47560_setup\n")
-
+ log.debug("-------- > _test_ticket47560_setup\n")
+
#
- # By default the memberof plugin is disabled create
+ # By default the memberof plugin is disabled create
# - create a group entry
# - create a member entry
# - set the member entry as memberof the group entry
@@ -182,8 +183,7 @@ def test_ticket47560(topology):
try:
topology.standalone.add_s(entry)
except ldap.ALREADY_EXISTS:
- log.debug( "Entry %s already exists" % (group_DN))
-
+ log.debug("Entry %s already exists" % (group_DN))
entry = Entry(member_DN)
entry.setValues('objectclass', 'top', 'person', 'organizationalPerson', 'inetorgperson', 'inetUser')
@@ -193,18 +193,16 @@ def test_ticket47560(topology):
try:
topology.standalone.add_s(entry)
except ldap.ALREADY_EXISTS:
- log.debug( "Entry %s already exists" % (member_DN))
-
+ log.debug("Entry %s already exists" % (member_DN))
+
replace = [(ldap.MOD_REPLACE, 'memberof', group_DN)]
topology.standalone.modify_s(member_DN, replace)
-
-
+
#
# enable the memberof plugin and restart the instance
#
_enable_disable_mbo('on')
-
-
+
#
# check memberof attribute is still present
#
@@ -215,15 +213,15 @@ def test_ticket47560(topology):
#print ent
value = ent.getValue('memberof')
#print "memberof: %s" % (value)
- assert value == group_DN
-
+ assert value == group_DN
+
def _test_ticket47560_teardown():
"""
- Delete entry cn=group,SUFFIX
- Delete entry cn=member,SUFFIX
- Disable Memberof Plugins
"""
- log.debug( "-------- > _test_ticket47560_teardown\n")
+ log.debug("-------- > _test_ticket47560_teardown\n")
# remove the entries group_DN and member_DN
try:
topology.standalone.delete_s(group_DN)
@@ -238,70 +236,69 @@ def test_ticket47560(topology):
#
_enable_disable_mbo('off')
-
-
group_DN = "cn=group,%s" % (SUFFIX)
member_DN = "uid=member,%s" % (SUFFIX)
-
+
#
# Initialize the test case
#
_test_ticket47560_setup()
-
- #
+
+ #
# start the test
# - start the fixup task
# - check the entry is fixed (no longer memberof the group)
#
- log.debug( "-------- > Start ticket tests\n")
-
+ log.debug("-------- > Start ticket tests\n")
+
filt = 'uid=member'
ents = topology.standalone.search_s(member_DN, ldap.SCOPE_BASE, filt)
assert len(ents) == 1
ent = ents[0]
- log.debug( "Unfixed entry %r\n" % ent)
-
+ log.debug("Unfixed entry %r\n" % ent)
+
# run the fixup task
topology.standalone.tasks.fixupMemberOf(suffix=SUFFIX, args={TASK_WAIT: True})
-
+
ents = topology.standalone.search_s(member_DN, ldap.SCOPE_BASE, filt)
assert len(ents) == 1
ent = ents[0]
- log.debug( "Fixed entry %r\n" % ent)
-
+ log.debug("Fixed entry %r\n" % ent)
+
if ent.getValue('memberof') == group_DN:
log.warning("Error the fixupMemberOf did not fix %s" % (member_DN))
result_successful = False
else:
result_successful = True
-
+
#
# cleanup up the test case
#
- _test_ticket47560_teardown()
-
- assert result_successful == True
+ _test_ticket47560_teardown()
+
+ assert result_successful is True
+
def test_ticket47560_final(topology):
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47560(topo)
test_ticket47560_final(topo)
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47573_test.py b/dirsrvtests/tickets/ticket47573_test.py
index 356873d..2641d0b 100644
--- a/dirsrvtests/tickets/ticket47573_test.py
+++ b/dirsrvtests/tickets/ticket47573_test.py
@@ -33,24 +33,26 @@ MAY_OLD = "(postalCode $ street)"
MUST_NEW = "(postalAddress $ preferredLocale)"
MAY_NEW = "(telexNumber $ postalCode $ street)"
+
class TopologyMasterConsumer(object):
def __init__(self, master, consumer):
master.open()
self.master = master
-
+
consumer.open()
self.consumer = consumer
+
def pattern_errorlog(file, log_pattern):
try:
pattern_errorlog.last_pos += 1
except AttributeError:
pattern_errorlog.last_pos = 0
-
+
found = None
log.debug("_pattern_errorlog: start at offset %d" % pattern_errorlog.last_pos)
file.seek(pattern_errorlog.last_pos)
-
+
# Use a while true iteration because 'for line in file: hit a
# python bug that break file.tell()
while True:
@@ -59,11 +61,12 @@ def pattern_errorlog(file, log_pattern):
found = log_pattern.search(line)
if ((line == '') or (found)):
break
-
+
log.debug("_pattern_errorlog: end at offset %d" % file.tell())
pattern_errorlog.last_pos = file.tell()
return found
+
def _oc_definition(oid_ext, name, must=None, may=None):
oid = "1.2.3.4.5.6.7.8.9.10.%d" % oid_ext
desc = 'To test ticket 47573'
@@ -72,20 +75,23 @@ def _oc_definition(oid_ext, name, must=None, may=None):
must = MUST_OLD
if not may:
may = MAY_OLD
-
+
new_oc = "( %s NAME '%s' DESC '%s' SUP %s AUXILIARY MUST %s MAY %s )" % (oid, name, desc, sup, must, may)
return new_oc
+
def add_OC(instance, oid_ext, name):
new_oc = _oc_definition(oid_ext, name)
instance.schema.add_schema('objectClasses', new_oc)
+
def mod_OC(instance, oid_ext, name, old_must=None, old_may=None, new_must=None, new_may=None):
old_oc = _oc_definition(oid_ext, name, old_must, old_may)
new_oc = _oc_definition(oid_ext, name, new_must, new_may)
instance.schema.del_schema('objectClasses', old_oc)
instance.schema.add_schema('objectClasses', new_oc)
-
+
+
def trigger_schema_push(topology):
"""
It triggers an update on the supplier. This will start a replication
@@ -97,7 +103,7 @@ def trigger_schema_push(topology):
trigger_schema_push.value = 1
replace = [(ldap.MOD_REPLACE, 'telephonenumber', str(trigger_schema_push.value))]
topology.master.modify_s(ENTRY_DN, replace)
-
+
# wait 10 seconds that the update is replicated
loop = 0
while loop <= 10:
@@ -114,6 +120,7 @@ def trigger_schema_push(topology):
time.sleep(1)
loop += 1
+
@pytest.fixture(scope="module")
def topology(request):
'''
@@ -121,7 +128,7 @@ def topology(request):
The replicated topology is MASTER -> Consumer.
At the beginning, It may exists a master instance and/or a consumer instance.
It may also exists a backup for the master and/or the consumer.
-
+
Principle:
If master instance exists:
restart it
@@ -145,17 +152,17 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
master = DirSrv(verbose=False)
consumer = DirSrv(verbose=False)
-
+
# Args for the master instance
args_instance[SER_HOST] = HOST_MASTER
args_instance[SER_PORT] = PORT_MASTER
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER
args_master = args_instance.copy()
master.allocate(args_master)
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_CONSUMER
args_instance[SER_PORT] = PORT_CONSUMER
@@ -163,40 +170,40 @@ def topology(request):
args_consumer = args_instance.copy()
consumer.allocate(args_consumer)
-
+
# Get the status of the backups
backup_master = master.checkBackupFS()
backup_consumer = consumer.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_master = master.exists()
+ instance_master = master.exists()
if instance_master:
master.stop(timeout=10)
master.start(timeout=10)
-
+
instance_consumer = consumer.exists()
if instance_consumer:
consumer.stop(timeout=10)
consumer.start(timeout=10)
-
+
if backup_master and backup_consumer:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master:
master.create()
# Used to retrieve configuration information (dbdir, confdir...)
master.open()
-
+
if not instance_consumer:
consumer.create()
# Used to retrieve configuration information (dbdir, confdir...)
consumer.open()
-
+
# restore master from backup
master.stop(timeout=10)
master.restoreFS(backup_master)
master.start(timeout=10)
-
+
# restore consumer from backup
consumer.stop(timeout=10)
consumer.restoreFS(backup_consumer)
@@ -207,56 +214,57 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master:
master.clearBackupFS()
if backup_consumer:
consumer.clearBackupFS()
-
+
# Remove all the instances
if instance_master:
master.delete()
if instance_consumer:
consumer.delete()
-
+
# Create the instances
master.create()
master.open()
consumer.create()
consumer.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER)
consumer.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_CONSUMER)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master.agreement.create(suffix=SUFFIX, host=consumer.host, port=consumer.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
master.agreement.init(SUFFIX, HOST_CONSUMER, PORT_CONSUMER)
master.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = consumer.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -264,12 +272,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master.stop(timeout=10)
master.backupfile = master.backupFS()
master.start(timeout=10)
-
+
consumer.stop(timeout=10)
consumer.backupfile = consumer.backupFS()
consumer.start(timeout=10)
@@ -277,7 +287,7 @@ def topology(request):
# clear the tmp directory
master.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -286,74 +296,74 @@ def topology(request):
def test_ticket47573_init(topology):
- """
+ """
Initialize the test environment
"""
log.debug("test_ticket47573_init topology %r (master %r, consumer %r" % (topology, topology.master, topology.consumer))
- # the test case will check if a warning message is logged in the
+ # the test case will check if a warning message is logged in the
# error log of the supplier
topology.master.errorlog_file = open(topology.master.errlog, "r")
-
+
# This entry will be used to trigger attempt of schema push
topology.master.add_s(Entry((ENTRY_DN, {
'objectclass': "top person".split(),
'sn': 'test_entry',
'cn': 'test_entry'})))
-
+
+
def test_ticket47573_one(topology):
"""
Summary: Add a custom OC with MUST and MAY
MUST = postalAddress $ preferredLocale
MAY = telexNumber $ postalCode $ street
-
+
Final state
- supplier +OCwithMayAttr
- consumer +OCwithMayAttr
-
+
"""
log.debug("test_ticket47573_one topology %r (master %r, consumer %r" % (topology, topology.master, topology.consumer))
- # update the schema of the supplier so that it is a superset of
+ # update the schema of the supplier so that it is a superset of
# consumer. Schema should be pushed
- new_oc = _oc_definition(2, 'OCwithMayAttr',
- must = MUST_OLD,
+ new_oc = _oc_definition(2, 'OCwithMayAttr',
+ must = MUST_OLD,
may = MAY_OLD)
topology.master.schema.add_schema('objectClasses', new_oc)
-
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was updated on the consumer
log.debug("test_ticket47573_one master_schema_csn=%s", master_schema_csn)
log.debug("ctest_ticket47573_one onsumer_schema_csn=%s", consumer_schema_csn)
assert master_schema_csn == consumer_schema_csn
-
+
# Check the error log of the supplier does not contain an error
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
-
+ assert res is None
+
+
def test_ticket47573_two(topology):
"""
Summary: Change OCwithMayAttr to move a MAY attribute to a MUST attribute
-
-
+
+
Final state
- supplier OCwithMayAttr updated
- consumer OCwithMayAttr updated
-
+
"""
-
+
# Update the objectclass so that a MAY attribute is moved to MUST attribute
mod_OC(topology.master, 2, 'OCwithMayAttr', old_must=MUST_OLD, new_must=MUST_NEW, old_may=MAY_OLD, new_may=MAY_NEW)
-
# now push the scheam
trigger_schema_push(topology)
master_schema_csn = topology.master.schema.get_schema_csn()
consumer_schema_csn = topology.consumer.schema.get_schema_csn()
-
+
# Check the schemaCSN was NOT updated on the consumer
log.debug("test_ticket47573_two master_schema_csn=%s", master_schema_csn)
log.debug("test_ticket47573_two consumer_schema_csn=%s", consumer_schema_csn)
@@ -362,7 +372,8 @@ def test_ticket47573_two(topology):
# Check the error log of the supplier does not contain an error
regex = re.compile("must not be overwritten \(set replication log for additional info\)")
res = pattern_errorlog(topology.master.errorlog_file, regex)
- assert res == None
+ assert res is None
+
def test_ticket47573_three(topology):
'''
@@ -370,7 +381,7 @@ def test_ticket47573_three(topology):
'''
# Check replication is working fine
dn = "cn=ticket47573, %s" % SUFFIX
- topology.master.add_s(Entry((dn,
+ topology.master.add_s(Entry((dn,
{'objectclass': "top person OCwithMayAttr".split(),
'sn': 'test_repl',
'cn': 'test_repl',
@@ -379,6 +390,7 @@ def test_ticket47573_three(topology):
'telexNumber': '12$us$21',
'postalCode': '54321'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = topology.consumer.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -386,30 +398,32 @@ def test_ticket47573_three(topology):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
- assert loop <= 10
-
+ if ent is None:
+ assert False
+
+
def test_ticket47573_final(topology):
- topology.master.stop(timeout=10)
- topology.consumer.stop(timeout=10)
+ topology.master.delete()
+ topology.consumer.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47573_init(topo)
test_ticket47573_one(topo)
test_ticket47573_two(topo)
test_ticket47573_three(topo)
-
test_ticket47573_final(topo)
diff --git a/dirsrvtests/tickets/ticket47619_test.py b/dirsrvtests/tickets/ticket47619_test.py
index af391ce..e3e7846 100644
--- a/dirsrvtests/tickets/ticket47619_test.py
+++ b/dirsrvtests/tickets/ticket47619_test.py
@@ -30,13 +30,14 @@ ENTRY_DN = "cn=test_entry, %s" % SUFFIX
OTHER_NAME = 'other_entry'
MAX_OTHERS = 100
-ATTRIBUTES = [ 'street', 'countryName', 'description', 'postalAddress', 'postalCode', 'title', 'l', 'roomNumber' ]
+ATTRIBUTES = ['street', 'countryName', 'description', 'postalAddress', 'postalCode', 'title', 'l', 'roomNumber']
+
class TopologyMasterConsumer(object):
def __init__(self, master, consumer):
master.open()
self.master = master
-
+
consumer.open()
self.consumer = consumer
@@ -51,7 +52,7 @@ def topology(request):
The replicated topology is MASTER -> Consumer.
At the beginning, It may exists a master instance and/or a consumer instance.
It may also exists a backup for the master and/or the consumer.
-
+
Principle:
If master instance exists:
restart it
@@ -75,17 +76,17 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
master = DirSrv(verbose=False)
consumer = DirSrv(verbose=False)
-
+
# Args for the master instance
args_instance[SER_HOST] = HOST_MASTER
args_instance[SER_PORT] = PORT_MASTER
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER
args_master = args_instance.copy()
master.allocate(args_master)
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_CONSUMER
args_instance[SER_PORT] = PORT_CONSUMER
@@ -93,40 +94,40 @@ def topology(request):
args_consumer = args_instance.copy()
consumer.allocate(args_consumer)
-
+
# Get the status of the backups
backup_master = master.checkBackupFS()
backup_consumer = consumer.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
instance_master = master.exists()
if instance_master:
master.stop(timeout=10)
master.start(timeout=10)
-
+
instance_consumer = consumer.exists()
if instance_consumer:
consumer.stop(timeout=10)
consumer.start(timeout=10)
-
+
if backup_master and backup_consumer:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master:
master.create()
# Used to retrieve configuration information (dbdir, confdir...)
master.open()
-
+
if not instance_consumer:
consumer.create()
# Used to retrieve configuration information (dbdir, confdir...)
consumer.open()
-
+
# restore master from backup
master.stop(timeout=10)
master.restoreFS(backup_master)
master.start(timeout=10)
-
+
# restore consumer from backup
consumer.stop(timeout=10)
consumer.restoreFS(backup_consumer)
@@ -137,56 +138,57 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master:
master.clearBackupFS()
if backup_consumer:
consumer.clearBackupFS()
-
+
# Remove all the instances
if instance_master:
master.delete()
if instance_consumer:
consumer.delete()
-
+
# Create the instances
master.create()
master.open()
consumer.create()
consumer.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER)
consumer.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_CONSUMER)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master.agreement.create(suffix=SUFFIX, host=consumer.host, port=consumer.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
master.agreement.init(SUFFIX, HOST_CONSUMER, PORT_CONSUMER)
master.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = consumer.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -194,12 +196,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master.stop(timeout=10)
master.backupfile = master.backupFS()
master.start(timeout=10)
-
+
consumer.stop(timeout=10)
consumer.backupfile = consumer.backupFS()
consumer.start(timeout=10)
@@ -207,7 +211,7 @@ def topology(request):
# clear the tmp directory
master.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -216,7 +220,7 @@ def topology(request):
def test_ticket47619_init(topology):
- """
+ """
Initialize the test environment
"""
topology.master.plugins.enable(name=PLUGIN_RETRO_CHANGELOG)
@@ -224,13 +228,12 @@ def test_ticket47619_init(topology):
#topology.master.plugins.enable(name=PLUGIN_REFER_INTEGRITY)
topology.master.stop(timeout=10)
topology.master.start(timeout=10)
-
+
topology.master.log.info("test_ticket47619_init topology %r" % (topology))
- # the test case will check if a warning message is logged in the
+ # the test case will check if a warning message is logged in the
# error log of the supplier
topology.master.errorlog_file = open(topology.master.errlog, "r")
-
-
+
# add dummy entries
for cpt in range(MAX_OTHERS):
name = "%s%d" % (OTHER_NAME, cpt)
@@ -238,20 +241,21 @@ def test_ticket47619_init(topology):
'objectclass': "top person".split(),
'sn': name,
'cn': name})))
-
+
topology.master.log.info("test_ticket47619_init: %d entries ADDed %s[0..%d]" % (MAX_OTHERS, OTHER_NAME, MAX_OTHERS-1))
-
+
# Check the number of entries in the retro changelog
time.sleep(2)
ents = topology.master.search_s(RETROCL_SUFFIX, ldap.SCOPE_ONELEVEL, "(objectclass=*)")
assert len(ents) == MAX_OTHERS
+
def test_ticket47619_create_index(topology):
-
args = {INDEX_TYPE: 'eq'}
for attr in ATTRIBUTES:
topology.master.index.create(suffix=RETROCL_SUFFIX, attr=attr, args=args)
+
def test_ticket47619_reindex(topology):
'''
Reindex all the attributes in ATTRIBUTES
@@ -261,31 +265,34 @@ def test_ticket47619_reindex(topology):
rc = topology.master.tasks.reindex(suffix=RETROCL_SUFFIX, attrname=attr, args=args)
assert rc == 0
+
def test_ticket47619_check_indexed_search(topology):
for attr in ATTRIBUTES:
ents = topology.master.search_s(RETROCL_SUFFIX, ldap.SCOPE_SUBTREE, "(%s=hello)" % attr)
assert len(ents) == 0
-
+
+
def test_ticket47619_final(topology):
- topology.master.stop(timeout=10)
- topology.consumer.stop(timeout=10)
+ topology.master.delete()
+ topology.consumer.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47619_init(topo)
-
+
test_ticket47619_create_index(topo)
-
+
# important restart that trigger the hang
# at restart, finding the new 'changelog' backend, the backend is acquired in Read
# preventing the reindex task to complete
diff --git a/dirsrvtests/tickets/ticket47653MMR_test.py b/dirsrvtests/tickets/ticket47653MMR_test.py
index bce69c8..3c4c1ef 100644
--- a/dirsrvtests/tickets/ticket47653MMR_test.py
+++ b/dirsrvtests/tickets/ticket47653MMR_test.py
@@ -44,7 +44,8 @@ BIND_PW = 'password'
ENTRY_NAME = 'test_entry'
ENTRY_DN = 'cn=%s, %s' % (ENTRY_NAME, SUFFIX)
ENTRY_OC = "top person %s" % OC_NAME
-
+
+
def _oc_definition(oid_ext, name, must=None, may=None):
oid = "1.2.3.4.5.6.7.8.9.10.%d" % oid_ext
desc = 'To test ticket 47490'
@@ -53,14 +54,16 @@ def _oc_definition(oid_ext, name, must=None, may=None):
must = MUST
if not may:
may = MAY
-
+
new_oc = "( %s NAME '%s' DESC '%s' SUP %s AUXILIARY MUST %s MAY %s )" % (oid, name, desc, sup, must, may)
return new_oc
+
+
class TopologyMaster1Master2(object):
def __init__(self, master1, master2):
master1.open()
self.master1 = master1
-
+
master2.open()
self.master2 = master2
@@ -72,7 +75,7 @@ def topology(request):
The replicated topology is MASTER1 <-> Master2.
At the beginning, It may exists a master2 instance and/or a master2 instance.
It may also exists a backup for the master1 and/or the master2.
-
+
Principle:
If master1 instance exists:
restart it
@@ -96,22 +99,22 @@ def topology(request):
global installation2_prefix
# allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
+
# Args for the master1 instance
args_instance[SER_HOST] = HOST_MASTER_1
args_instance[SER_PORT] = PORT_MASTER_1
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
args_master = args_instance.copy()
master1.allocate(args_master)
-
+
# allocate master1 on a given deployement
master2 = DirSrv(verbose=False)
if installation2_prefix:
args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_MASTER_2
args_instance[SER_PORT] = PORT_MASTER_2
@@ -119,40 +122,39 @@ def topology(request):
args_master = args_instance.copy()
master2.allocate(args_master)
-
# Get the status of the backups
backup_master1 = master1.checkBackupFS()
backup_master2 = master2.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
instance_master1 = master1.exists()
if instance_master1:
master1.stop(timeout=10)
master1.start(timeout=10)
-
+
instance_master2 = master2.exists()
if instance_master2:
master2.stop(timeout=10)
master2.start(timeout=10)
-
+
if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master1:
master1.create()
# Used to retrieve configuration information (dbdir, confdir...)
master1.open()
-
+
if not instance_master2:
master2.create()
# Used to retrieve configuration information (dbdir, confdir...)
master2.open()
-
+
# restore master1 from backup
master1.stop(timeout=10)
master1.restoreFS(backup_master1)
master1.start(timeout=10)
-
+
# restore master2 from backup
master2.stop(timeout=10)
master2.restoreFS(backup_master2)
@@ -163,48 +165,48 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master1:
master1.clearBackupFS()
if backup_master2:
master2.clearBackupFS()
-
+
# Remove all the instances
if instance_master1:
master1.delete()
if instance_master2:
master2.delete()
-
+
# Create the instances
master1.create()
master1.open()
master2.create()
master2.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
@@ -214,13 +216,14 @@ def topology(request):
master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
master1.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master1.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -228,12 +231,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master1.stop(timeout=10)
master1.backupfile = master1.backupFS()
master1.start(timeout=10)
-
+
master2.stop(timeout=10)
master2.backupfile = master2.backupFS()
master2.start(timeout=10)
@@ -241,7 +246,7 @@ def topology(request):
# clear the tmp directory
master1.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -255,15 +260,13 @@ def test_ticket47653_init(topology):
- Objectclass with MAY 'member'
- an entry ('bind_entry') with which we bind to test the 'SELFDN' operation
It deletes the anonymous aci
-
+
"""
-
-
+
topology.master1.log.info("Add %s that allows 'member' attribute" % OC_NAME)
- new_oc = _oc_definition(2, OC_NAME, must = MUST, may = MAY)
+ new_oc = _oc_definition(2, OC_NAME, must=MUST, may=MAY)
topology.master1.schema.add_schema('objectClasses', new_oc)
-
-
+
# entry used to bind with
topology.master1.log.info("Add %s" % BIND_DN)
topology.master1.add_s(Entry((BIND_DN, {
@@ -271,18 +274,18 @@ def test_ticket47653_init(topology):
'sn': BIND_NAME,
'cn': BIND_NAME,
'userpassword': BIND_PW})))
-
+
# enable acl error logging
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(128+8192))] # ACL + REPL
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(128 + 8192))] # ACL + REPL
topology.master1.modify_s(DN_CONFIG, mod)
topology.master2.modify_s(DN_CONFIG, mod)
-
+
# get read of anonymous ACI for use 'read-search' aci in SEARCH test
ACI_ANONYMOUS = "(targetattr!=\"userPassword\")(version 3.0; acl \"Enable anonymous access\"; allow (read, search, compare) userdn=\"ldap:///anyone\";)"
mod = [(ldap.MOD_DELETE, 'aci', ACI_ANONYMOUS)]
topology.master1.modify_s(SUFFIX, mod)
topology.master2.modify_s(SUFFIX, mod)
-
+
# add dummy entries
for cpt in range(MAX_OTHERS):
name = "%s%d" % (OTHER_NAME, cpt)
@@ -291,22 +294,23 @@ def test_ticket47653_init(topology):
'sn': name,
'cn': name})))
+
def test_ticket47653_add(topology):
'''
This test ADD an entry on MASTER1 where 47653 is fixed. Then it checks that entry is replicated
on MASTER2 (even if on MASTER2 47653 is NOT fixed). Then update on MASTER2 and check the update on MASTER1
-
- It checks that, bound as bind_entry,
+
+ It checks that, bound as bind_entry,
- we can not ADD an entry without the proper SELFDN aci.
- with the proper ACI we can not ADD with 'member' attribute
- with the proper ACI and 'member' it succeeds to ADD
'''
topology.master1.log.info("\n\n######################### ADD ######################\n")
-
+
# bind as bind_entry
topology.master1.log.info("Bind as %s" % BIND_DN)
topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
+
# Prepare the entry with multivalued members
entry_with_members = Entry(ENTRY_DN)
entry_with_members.setValues('objectclass', 'top', 'person', 'OCticket47653')
@@ -320,7 +324,7 @@ def test_ticket47653_add(topology):
members.append("cn=%s,%s" % (name, SUFFIX))
members.append(BIND_DN)
entry_with_members.setValues('member', members)
-
+
# Prepare the entry with only one member value
entry_with_member = Entry(ENTRY_DN)
entry_with_member.setValues('objectclass', 'top', 'person', 'OCticket47653')
@@ -331,21 +335,20 @@ def test_ticket47653_add(topology):
member = []
member.append(BIND_DN)
entry_with_member.setValues('member', member)
-
+
# entry to add WITH member being BIND_DN but WITHOUT the ACI -> ldap.INSUFFICIENT_ACCESS
try:
topology.master1.log.info("Try to add Add %s (aci is missing): %r" % (ENTRY_DN, entry_with_member))
-
+
topology.master1.add_s(entry_with_member)
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# Ok Now add the proper ACI
topology.master1.log.info("Bind as %s and add the ADD SELFDN aci" % DN_DM)
topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
+
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
ACI_ALLOW = "(version 3.0; acl \"SelfDN add\"; allow (add)"
@@ -353,11 +356,11 @@ def test_ticket47653_add(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
-
+
# bind as bind_entry
topology.master1.log.info("Bind as %s" % BIND_DN)
topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
+
# entry to add WITHOUT member and WITH the ACI -> ldap.INSUFFICIENT_ACCESS
try:
topology.master1.log.info("Try to add Add %s (member is missing)" % ENTRY_DN)
@@ -370,7 +373,7 @@ def test_ticket47653_add(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# entry to add WITH memberS and WITH the ACI -> ldap.INSUFFICIENT_ACCESS
# member should contain only one value
try:
@@ -379,10 +382,10 @@ def test_ticket47653_add(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
topology.master1.log.info("Try to add Add %s should be successful" % ENTRY_DN)
topology.master1.add_s(entry_with_member)
-
+
#
# Now check the entry as been replicated
#
@@ -397,12 +400,12 @@ def test_ticket47653_add(topology):
time.sleep(1)
loop += 1
assert loop <= 10
-
+
# Now update the entry on Master2 (as DM because 47653 is possibly not fixed on M2)
topology.master1.log.info("Update %s on M2" % ENTRY_DN)
mod = [(ldap.MOD_REPLACE, 'description', 'test_add')]
topology.master2.modify_s(ENTRY_DN, mod)
-
+
topology.master1.simple_bind_s(DN_DM, PASSWORD)
loop = 0
while loop <= 10:
@@ -413,25 +416,26 @@ def test_ticket47653_add(topology):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+
assert ent.getValue('description') == 'test_add'
-
+
+
def test_ticket47653_modify(topology):
'''
This test MOD an entry on MASTER1 where 47653 is fixed. Then it checks that update is replicated
on MASTER2 (even if on MASTER2 47653 is NOT fixed). Then update on MASTER2 (bound as BIND_DN).
This update may fail whether or not 47653 is fixed on MASTER2
- It checks that, bound as bind_entry,
+ It checks that, bound as bind_entry,
- we can not modify an entry without the proper SELFDN aci.
- adding the ACI, we can modify the entry
'''
# bind as bind_entry
topology.master1.log.info("Bind as %s" % BIND_DN)
topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
+
topology.master1.log.info("\n\n######################### MODIFY ######################\n")
-
+
# entry to modify WITH member being BIND_DN but WITHOUT the ACI -> ldap.INSUFFICIENT_ACCESS
try:
topology.master1.log.info("Try to modify %s (aci is missing)" % ENTRY_DN)
@@ -440,12 +444,11 @@ def test_ticket47653_modify(topology):
except Exception as e:
topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# Ok Now add the proper ACI
topology.master1.log.info("Bind as %s and add the WRITE SELFDN aci" % DN_DM)
topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
+
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
ACI_TARGETATTR = "(targetattr = *)"
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
@@ -454,26 +457,24 @@ def test_ticket47653_modify(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETATTR + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.master1.modify_s(SUFFIX, mod)
-
+
# bind as bind_entry
topology.master1.log.info("M1: Bind as %s" % BIND_DN)
topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
+
# modify the entry and checks the value
topology.master1.log.info("M1: Try to modify %s. It should succeeds" % ENTRY_DN)
mod = [(ldap.MOD_REPLACE, 'postalCode', '1928')]
topology.master1.modify_s(ENTRY_DN, mod)
-
+
topology.master1.log.info("M1: Bind as %s" % DN_DM)
topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
+
topology.master1.log.info("M1: Check the update of %s" % ENTRY_DN)
ents = topology.master1.search_s(ENTRY_DN, ldap.SCOPE_BASE, 'objectclass=*')
assert len(ents) == 1
assert ents[0].postalCode == '1928'
-
-
- #
+
# Now check the update has been replicated on M2
topology.master1.log.info("M2: Bind as %s" % DN_DM)
topology.master2.simple_bind_s(DN_DM, PASSWORD)
@@ -489,8 +490,7 @@ def test_ticket47653_modify(topology):
loop += 1
assert loop <= 10
assert ent.getValue('postalCode') == '1928'
-
-
+
# Now update the entry on Master2 bound as BIND_DN (update may fail if 47653 is not fixed on M2)
topology.master1.log.info("M2: Update %s (bound as %s)" % (ENTRY_DN, BIND_DN))
topology.master2.simple_bind_s(BIND_DN, PASSWORD)
@@ -505,7 +505,7 @@ def test_ticket47653_modify(topology):
except Exception as e:
topology.master1.log.info("M2: Exception (not expected): %s" % type(e).__name__)
assert 0
-
+
if not fail:
# Check the update has been replicaed on M1
topology.master1.log.info("M1: Bind as %s" % DN_DM)
@@ -521,15 +521,17 @@ def test_ticket47653_modify(topology):
time.sleep(1)
loop += 1
assert ent.getValue('postalCode') == '1929'
-
+
+
def test_ticket47653_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
@@ -538,18 +540,15 @@ def run_isolated():
global installation2_prefix
installation1_prefix = None
installation2_prefix = None
-
+
topo = topology(True)
test_ticket47653_init(topo)
-
+
test_ticket47653_add(topo)
test_ticket47653_modify(topo)
-
- test_ticket47653_final(topo)
-
+ test_ticket47653_final(topo)
if __name__ == '__main__':
run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47653_test.py b/dirsrvtests/tickets/ticket47653_test.py
index e0dedbc..c217596 100644
--- a/dirsrvtests/tickets/ticket47653_test.py
+++ b/dirsrvtests/tickets/ticket47653_test.py
@@ -31,7 +31,8 @@ BIND_PW = 'password'
ENTRY_NAME = 'test_entry'
ENTRY_DN = 'cn=%s, %s' % (ENTRY_NAME, SUFFIX)
ENTRY_OC = "top person %s" % OC_NAME
-
+
+
def _oc_definition(oid_ext, name, must=None, may=None):
oid = "1.2.3.4.5.6.7.8.9.10.%d" % oid_ext
desc = 'To test ticket 47490'
@@ -40,7 +41,7 @@ def _oc_definition(oid_ext, name, must=None, may=None):
must = MUST
if not may:
may = MAY
-
+
new_oc = "( %s NAME '%s' DESC '%s' SUP %s AUXILIARY MUST %s MAY %s )" % (oid, name, desc, sup, must, may)
return new_oc
@@ -57,7 +58,7 @@ def topology(request):
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -76,60 +77,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=False)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
-
+
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -138,7 +139,7 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
- #
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
@@ -152,15 +153,13 @@ def test_ticket47653_init(topology):
- Objectclass with MAY 'member'
- an entry ('bind_entry') with which we bind to test the 'SELFDN' operation
It deletes the anonymous aci
-
+
"""
-
-
+
topology.standalone.log.info("Add %s that allows 'member' attribute" % OC_NAME)
- new_oc = _oc_definition(2, OC_NAME, must = MUST, may = MAY)
+ new_oc = _oc_definition(2, OC_NAME, must=MUST, may=MAY)
topology.standalone.schema.add_schema('objectClasses', new_oc)
-
-
+
# entry used to bind with
topology.standalone.log.info("Add %s" % BIND_DN)
topology.standalone.add_s(Entry((BIND_DN, {
@@ -168,16 +167,16 @@ def test_ticket47653_init(topology):
'sn': BIND_NAME,
'cn': BIND_NAME,
'userpassword': BIND_PW})))
-
+
# enable acl error logging
mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
topology.standalone.modify_s(DN_CONFIG, mod)
-
+
# get read of anonymous ACI for use 'read-search' aci in SEARCH test
ACI_ANONYMOUS = "(targetattr!=\"userPassword\")(version 3.0; acl \"Enable anonymous access\"; allow (read, search, compare) userdn=\"ldap:///anyone\";)"
mod = [(ldap.MOD_DELETE, 'aci', ACI_ANONYMOUS)]
topology.standalone.modify_s(SUFFIX, mod)
-
+
# add dummy entries
for cpt in range(MAX_OTHERS):
name = "%s%d" % (OTHER_NAME, cpt)
@@ -185,21 +184,21 @@ def test_ticket47653_init(topology):
'objectclass': "top person".split(),
'sn': name,
'cn': name})))
-
-
+
+
def test_ticket47653_add(topology):
'''
- It checks that, bound as bind_entry,
+ It checks that, bound as bind_entry,
- we can not ADD an entry without the proper SELFDN aci.
- with the proper ACI we can not ADD with 'member' attribute
- with the proper ACI and 'member' it succeeds to ADD
'''
topology.standalone.log.info("\n\n######################### ADD ######################\n")
-
+
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
# Prepare the entry with multivalued members
entry_with_members = Entry(ENTRY_DN)
entry_with_members.setValues('objectclass', 'top', 'person', 'OCticket47653')
@@ -213,7 +212,7 @@ def test_ticket47653_add(topology):
members.append("cn=%s,%s" % (name, SUFFIX))
members.append(BIND_DN)
entry_with_members.setValues('member', members)
-
+
# Prepare the entry with one member
entry_with_member = Entry(ENTRY_DN)
entry_with_member.setValues('objectclass', 'top', 'person', 'OCticket47653')
@@ -224,21 +223,20 @@ def test_ticket47653_add(topology):
member = []
member.append(BIND_DN)
entry_with_member.setValues('member', member)
-
+
# entry to add WITH member being BIND_DN but WITHOUT the ACI -> ldap.INSUFFICIENT_ACCESS
try:
topology.standalone.log.info("Try to add Add %s (aci is missing): %r" % (ENTRY_DN, entry_with_member))
-
+
topology.standalone.add_s(entry_with_member)
except Exception as e:
topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
# Ok Now add the proper ACI
topology.standalone.log.info("Bind as %s and add the ADD SELFDN aci" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
ACI_ALLOW = "(version 3.0; acl \"SelfDN add\"; allow (add)"
@@ -246,11 +244,11 @@ def test_ticket47653_add(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.standalone.modify_s(SUFFIX, mod)
-
+
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
# entry to add WITHOUT member and WITH the ACI -> ldap.INSUFFICIENT_ACCESS
try:
topology.standalone.log.info("Try to add Add %s (member is missing)" % ENTRY_DN)
@@ -263,7 +261,7 @@ def test_ticket47653_add(topology):
except Exception as e:
topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# entry to add WITH memberS and WITH the ACI -> ldap.INSUFFICIENT_ACCESS
# member should contain only one value
try:
@@ -272,13 +270,14 @@ def test_ticket47653_add(topology):
except Exception as e:
topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
topology.standalone.log.info("Try to add Add %s should be successful" % ENTRY_DN)
topology.standalone.add_s(entry_with_member)
-
+
+
def test_ticket47653_search(topology):
'''
- It checks that, bound as bind_entry,
+ It checks that, bound as bind_entry,
- we can not search an entry without the proper SELFDN aci.
- adding the ACI, we can search the entry
'''
@@ -286,17 +285,16 @@ def test_ticket47653_search(topology):
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
# entry to search WITH member being BIND_DN but WITHOUT the ACI -> no entry returned
topology.standalone.log.info("Try to search %s (aci is missing)" % ENTRY_DN)
ents = topology.standalone.search_s(ENTRY_DN, ldap.SCOPE_BASE, 'objectclass=*')
assert len(ents) == 0
-
-
+
# Ok Now add the proper ACI
topology.standalone.log.info("Bind as %s and add the READ/SEARCH SELFDN aci" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
ACI_TARGETATTR = "(targetattr = *)"
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
@@ -305,28 +303,29 @@ def test_ticket47653_search(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETATTR + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.standalone.modify_s(SUFFIX, mod)
-
+
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
# entry to search with the proper aci
topology.standalone.log.info("Try to search %s should be successful" % ENTRY_DN)
ents = topology.standalone.search_s(ENTRY_DN, ldap.SCOPE_BASE, 'objectclass=*')
assert len(ents) == 1
-
+
+
def test_ticket47653_modify(topology):
'''
- It checks that, bound as bind_entry,
+ It checks that, bound as bind_entry,
- we can not modify an entry without the proper SELFDN aci.
- adding the ACI, we can modify the entry
'''
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
topology.standalone.log.info("\n\n######################### MODIFY ######################\n")
-
+
# entry to modify WITH member being BIND_DN but WITHOUT the ACI -> ldap.INSUFFICIENT_ACCESS
try:
topology.standalone.log.info("Try to modify %s (aci is missing)" % ENTRY_DN)
@@ -335,12 +334,12 @@ def test_ticket47653_modify(topology):
except Exception as e:
topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
+
+
# Ok Now add the proper ACI
topology.standalone.log.info("Bind as %s and add the WRITE SELFDN aci" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
ACI_TARGETATTR = "(targetattr = *)"
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
@@ -349,32 +348,33 @@ def test_ticket47653_modify(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETATTR + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.standalone.modify_s(SUFFIX, mod)
-
+
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
# modify the entry and checks the value
topology.standalone.log.info("Try to modify %s. It should succeeds" % ENTRY_DN)
mod = [(ldap.MOD_REPLACE, 'postalCode', '1928')]
topology.standalone.modify_s(ENTRY_DN, mod)
-
+
ents = topology.standalone.search_s(ENTRY_DN, ldap.SCOPE_BASE, 'objectclass=*')
assert len(ents) == 1
assert ents[0].postalCode == '1928'
-
+
+
def test_ticket47653_delete(topology):
'''
- It checks that, bound as bind_entry,
+ It checks that, bound as bind_entry,
- we can not delete an entry without the proper SELFDN aci.
- adding the ACI, we can delete the entry
'''
topology.standalone.log.info("\n\n######################### DELETE ######################\n")
-
+
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
# entry to delete WITH member being BIND_DN but WITHOUT the ACI -> ldap.INSUFFICIENT_ACCESS
try:
topology.standalone.log.info("Try to delete %s (aci is missing)" % ENTRY_DN)
@@ -382,11 +382,11 @@ def test_ticket47653_delete(topology):
except Exception as e:
topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
+
# Ok Now add the proper ACI
topology.standalone.log.info("Bind as %s and add the READ/SEARCH SELFDN aci" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
ACI_ALLOW = "(version 3.0; acl \"SelfDN delete\"; allow (delete)"
@@ -394,39 +394,39 @@ def test_ticket47653_delete(topology):
ACI_BODY = ACI_TARGET + ACI_TARGETFILTER + ACI_ALLOW + ACI_SUBJECT
mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
topology.standalone.modify_s(SUFFIX, mod)
-
+
# bind as bind_entry
topology.standalone.log.info("Bind as %s" % BIND_DN)
topology.standalone.simple_bind_s(BIND_DN, BIND_PW)
-
+
# entry to search with the proper aci
topology.standalone.log.info("Try to delete %s should be successful" % ENTRY_DN)
topology.standalone.delete_s(ENTRY_DN)
+
def test_ticket47653_final(topology):
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47653_init(topo)
-
+
test_ticket47653_add(topo)
test_ticket47653_search(topo)
test_ticket47653_modify(topo)
test_ticket47653_delete(topo)
-
+
test_ticket47653_final(topo)
diff --git a/dirsrvtests/tickets/ticket47664_test.py b/dirsrvtests/tickets/ticket47664_test.py
index eaad5dc..4bd100d 100644
--- a/dirsrvtests/tickets/ticket47664_test.py
+++ b/dirsrvtests/tickets/ticket47664_test.py
@@ -27,6 +27,7 @@ _MYLDIF = 'ticket47664.ldif'
SEARCHFILTER = '(objectclass=*)'
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
@@ -39,7 +40,7 @@ def topology(request):
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -58,60 +59,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=False)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -120,7 +121,7 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
- #
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
@@ -140,7 +141,7 @@ def test_ticket47664_run(topology):
# bind as directory manager
topology.standalone.log.info("Bind as %s" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
topology.standalone.log.info("\n\n######################### SETUP SUFFIX o=ticket47664.org ######################\n")
topology.standalone.backend.create(MYSUFFIX, {BACKEND_NAME: MYSUFFIXBE})
@@ -150,7 +151,7 @@ def test_ticket47664_run(topology):
# get tmp dir
mytmp = topology.standalone.getDir(__file__, TMP_DIR)
- if mytmp == None:
+ if mytmp is None:
mytmp = "/tmp"
MYLDIF = '%s%s' % (mytmp, _MYLDIF)
@@ -195,11 +196,11 @@ def test_ticket47664_run(topology):
ger_req_ctrl = GetEffectiveRightsControl(True, "dn: " + DN_DM)
known_ldap_resp_ctrls = {
- SimplePagedResultsControl.controlType:SimplePagedResultsControl,
+ SimplePagedResultsControl.controlType: SimplePagedResultsControl,
}
topology.standalone.log.info("Calling search_ext...")
- msgid = topology.standalone.search_ext(MYSUFFIX,
+ msgid = topology.standalone.search_ext(MYSUFFIX,
ldap.SCOPE_SUBTREE,
SEARCHFILTER,
['cn'],
@@ -214,21 +215,21 @@ def test_ticket47664_run(topology):
rtype, rdata, rmsgid, responcectrls = topology.standalone.result3(msgid, resp_ctrl_classes=known_ldap_resp_ctrls)
topology.standalone.log.info("%d results" % len(rdata))
pageddncnt += len(rdata)
-
+
topology.standalone.log.info("Results:")
for dn, attrs in rdata:
topology.standalone.log.info("dn: %s" % dn)
topology.standalone.log.info("attributeLevelRights: %s" % attrs['attributeLevelRights'][0])
if attrs['attributeLevelRights'][0] != "":
attrlevelrightscnt += 1
-
+
pctrls = [
c for c in responcectrls if c.controlType == SimplePagedResultsControl.controlType
]
if not pctrls:
topology.standalone.log.info('Warning: Server ignores RFC 2696 control.')
break
-
+
if pctrls[0].cookie:
spr_req_ctrl.cookie = pctrls[0].cookie
topology.standalone.log.info("cookie: %s" % spr_req_ctrl.cookie)
@@ -246,25 +247,27 @@ def test_ticket47664_run(topology):
assert dnnum == len(entries)
assert dnnum == attrlevelrightscnt
assert pages == (dnnum / page_size)
- topology.standalone.log.info("ticket47664 was successfully verified.");
+ topology.standalone.log.info("ticket47664 was successfully verified.")
+
def test_ticket47664_final(topology):
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
+
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
installation_prefix = None
-
+
topo = topology(True)
test_ticket47664_run(topo)
-
+
test_ticket47664_final(topo)
diff --git a/dirsrvtests/tickets/ticket47676_test.py b/dirsrvtests/tickets/ticket47676_test.py
index b462fc2..517e10f 100644
--- a/dirsrvtests/tickets/ticket47676_test.py
+++ b/dirsrvtests/tickets/ticket47676_test.py
@@ -56,7 +56,8 @@ ENTRY_DN = 'cn=%s, %s' % (ENTRY_NAME, SUFFIX)
ENTRY_OC = "top person %s" % OC_NAME
BASE_OID = "1.2.3.4.5.6.7.8.9.10"
-
+
+
def _oc_definition(oid_ext, name, must=None, may=None):
oid = "%s.%d" % (BASE_OID, oid_ext)
desc = 'To test ticket 47490'
@@ -65,14 +66,16 @@ def _oc_definition(oid_ext, name, must=None, may=None):
must = MUST
if not may:
may = MAY
-
+
new_oc = "( %s NAME '%s' DESC '%s' SUP %s AUXILIARY MUST %s MAY %s )" % (oid, name, desc, sup, must, may)
return new_oc
+
+
class TopologyMaster1Master2(object):
def __init__(self, master1, master2):
master1.open()
self.master1 = master1
-
+
master2.open()
self.master2 = master2
@@ -84,7 +87,7 @@ def topology(request):
The replicated topology is MASTER1 <-> Master2.
At the beginning, It may exists a master2 instance and/or a master2 instance.
It may also exists a backup for the master1 and/or the master2.
-
+
Principle:
If master1 instance exists:
restart it
@@ -108,22 +111,22 @@ def topology(request):
global installation2_prefix
# allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
+
# Args for the master1 instance
args_instance[SER_HOST] = HOST_MASTER_1
args_instance[SER_PORT] = PORT_MASTER_1
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
args_master = args_instance.copy()
master1.allocate(args_master)
-
+
# allocate master1 on a given deployement
master2 = DirSrv(verbose=False)
if installation2_prefix:
args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_MASTER_2
args_instance[SER_PORT] = PORT_MASTER_2
@@ -131,40 +134,39 @@ def topology(request):
args_master = args_instance.copy()
master2.allocate(args_master)
-
# Get the status of the backups
backup_master1 = master1.checkBackupFS()
backup_master2 = master2.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
instance_master1 = master1.exists()
if instance_master1:
master1.stop(timeout=10)
master1.start(timeout=10)
-
+
instance_master2 = master2.exists()
if instance_master2:
master2.stop(timeout=10)
master2.start(timeout=10)
-
+
if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master1:
master1.create()
# Used to retrieve configuration information (dbdir, confdir...)
master1.open()
-
+
if not instance_master2:
master2.create()
# Used to retrieve configuration information (dbdir, confdir...)
master2.open()
-
+
# restore master1 from backup
master1.stop(timeout=10)
master1.restoreFS(backup_master1)
master1.start(timeout=10)
-
+
# restore master2 from backup
master2.stop(timeout=10)
master2.restoreFS(backup_master2)
@@ -175,48 +177,48 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master1:
master1.clearBackupFS()
if backup_master2:
master2.clearBackupFS()
-
+
# Remove all the instances
if instance_master1:
master1.delete()
if instance_master2:
master2.delete()
-
+
# Create the instances
master1.create()
master1.open()
master2.create()
master2.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
@@ -226,13 +228,14 @@ def topology(request):
master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
master1.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master1.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -240,12 +243,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master1.stop(timeout=10)
master1.backupfile = master1.backupFS()
master1.start(timeout=10)
-
+
master2.stop(timeout=10)
master2.backupfile = master2.backupFS()
master2.start(timeout=10)
@@ -253,7 +258,7 @@ def topology(request):
# clear the tmp directory
master1.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -267,15 +272,13 @@ def test_ticket47676_init(topology):
- Objectclass with MAY 'member'
- an entry ('bind_entry') with which we bind to test the 'SELFDN' operation
It deletes the anonymous aci
-
+
"""
-
-
+
topology.master1.log.info("Add %s that allows 'member' attribute" % OC_NAME)
- new_oc = _oc_definition(OC_OID_EXT, OC_NAME, must = MUST, may = MAY)
+ new_oc = _oc_definition(OC_OID_EXT, OC_NAME, must = MUST, may = MAY)
topology.master1.schema.add_schema('objectClasses', new_oc)
-
-
+
# entry used to bind with
topology.master1.log.info("Add %s" % BIND_DN)
topology.master1.add_s(Entry((BIND_DN, {
@@ -283,12 +286,12 @@ def test_ticket47676_init(topology):
'sn': BIND_NAME,
'cn': BIND_NAME,
'userpassword': BIND_PW})))
-
+
# enable acl error logging
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(128+8192))] # ACL + REPL
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(128 + 8192))] # ACL + REPL
topology.master1.modify_s(DN_CONFIG, mod)
topology.master2.modify_s(DN_CONFIG, mod)
-
+
# add dummy entries
for cpt in range(MAX_OTHERS):
name = "%s%d" % (OTHER_NAME, cpt)
@@ -297,6 +300,7 @@ def test_ticket47676_init(topology):
'sn': name,
'cn': name})))
+
def test_ticket47676_skip_oc_at(topology):
'''
This test ADD an entry on MASTER1 where 47676 is fixed. Then it checks that entry is replicated
@@ -304,11 +308,11 @@ def test_ticket47676_skip_oc_at(topology):
If the schema has successfully been pushed, updating Master2 should succeed
'''
topology.master1.log.info("\n\n######################### ADD ######################\n")
-
+
# bind as 'cn=Directory manager'
topology.master1.log.info("Bind as %s and add the add the entry with specific oc" % DN_DM)
topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
+
# Prepare the entry with multivalued members
entry = Entry(ENTRY_DN)
entry.setValues('objectclass', 'top', 'person', 'OCticket47676')
@@ -322,10 +326,10 @@ def test_ticket47676_skip_oc_at(topology):
members.append("cn=%s,%s" % (name, SUFFIX))
members.append(BIND_DN)
entry.setValues('member', members)
-
+
topology.master1.log.info("Try to add Add %s should be successful" % ENTRY_DN)
topology.master1.add_s(entry)
-
+
#
# Now check the entry as been replicated
#
@@ -340,12 +344,12 @@ def test_ticket47676_skip_oc_at(topology):
time.sleep(2)
loop += 1
assert loop <= 10
-
+
# Now update the entry on Master2 (as DM because 47676 is possibly not fixed on M2)
topology.master1.log.info("Update %s on M2" % ENTRY_DN)
mod = [(ldap.MOD_REPLACE, 'description', 'test_add')]
topology.master2.modify_s(ENTRY_DN, mod)
-
+
topology.master1.simple_bind_s(DN_DM, PASSWORD)
loop = 0
while loop <= 10:
@@ -354,29 +358,30 @@ def test_ticket47676_skip_oc_at(topology):
break
time.sleep(1)
loop += 1
-
+
assert ent.getValue('description') == 'test_add'
+
def test_ticket47676_reject_action(topology):
-
+
topology.master1.log.info("\n\n######################### REJECT ACTION ######################\n")
-
+
topology.master1.simple_bind_s(DN_DM, PASSWORD)
topology.master2.simple_bind_s(DN_DM, PASSWORD)
-
+
# make master1 to refuse to push the schema if OC_NAME is present in consumer schema
- mod = [(ldap.MOD_ADD, 'schemaUpdateObjectclassReject', '%s' % (OC_NAME) )] # ACL + REPL
+ mod = [(ldap.MOD_ADD, 'schemaUpdateObjectclassReject', '%s' % (OC_NAME))] # ACL + REPL
topology.master1.modify_s(REPL_SCHEMA_POLICY_SUPPLIER, mod)
-
+
# Restart is required to take into account that policy
topology.master1.stop(timeout=10)
topology.master1.start(timeout=10)
-
+
# Add a new OC on M1 so that schema CSN will change and M1 will try to push the schema
topology.master1.log.info("Add %s on M1" % OC2_NAME)
- new_oc = _oc_definition(OC2_OID_EXT, OC2_NAME, must = MUST, may = MAY)
+ new_oc = _oc_definition(OC2_OID_EXT, OC2_NAME, must=MUST, may=MAY)
topology.master1.schema.add_schema('objectClasses', new_oc)
-
+
# Safety checking that the schema has been updated on M1
topology.master1.log.info("Check %s is in M1" % OC2_NAME)
ent = topology.master1.getEntry(SCHEMA_DN, ldap.SCOPE_BASE, "(objectclass=*)", ["objectclasses"])
@@ -387,12 +392,12 @@ def test_ticket47676_reject_action(topology):
found = True
break
assert found
-
+
# Do an update of M1 so that M1 will try to push the schema
topology.master1.log.info("Update %s on M1" % ENTRY_DN)
mod = [(ldap.MOD_REPLACE, 'description', 'test_reject')]
topology.master1.modify_s(ENTRY_DN, mod)
-
+
# Check the replication occured and so also M1 attempted to push the schema
topology.master1.log.info("Check updated %s on M2" % ENTRY_DN)
loop = 0
@@ -404,7 +409,7 @@ def test_ticket47676_reject_action(topology):
time.sleep(2)
loop += 1
assert loop <= 10
-
+
# Check that the schema has not been pushed
topology.master1.log.info("Check %s is not in M2" % OC2_NAME)
ent = topology.master2.getEntry(SCHEMA_DN, ldap.SCOPE_BASE, "(objectclass=*)", ["objectclasses"])
@@ -415,22 +420,22 @@ def test_ticket47676_reject_action(topology):
found = True
break
assert not found
-
+
topology.master1.log.info("\n\n######################### NO MORE REJECT ACTION ######################\n")
-
+
# make master1 to do no specific action on OC_NAME
- mod = [(ldap.MOD_DELETE, 'schemaUpdateObjectclassReject', '%s' % (OC_NAME) )] # ACL + REPL
+ mod = [(ldap.MOD_DELETE, 'schemaUpdateObjectclassReject', '%s' % (OC_NAME))] # ACL + REPL
topology.master1.modify_s(REPL_SCHEMA_POLICY_SUPPLIER, mod)
-
+
# Restart is required to take into account that policy
topology.master1.stop(timeout=10)
topology.master1.start(timeout=10)
-
+
# Do an update of M1 so that M1 will try to push the schema
topology.master1.log.info("Update %s on M1" % ENTRY_DN)
mod = [(ldap.MOD_REPLACE, 'description', 'test_no_more_reject')]
topology.master1.modify_s(ENTRY_DN, mod)
-
+
# Check the replication occured and so also M1 attempted to push the schema
topology.master1.log.info("Check updated %s on M2" % ENTRY_DN)
loop = 0
@@ -442,7 +447,7 @@ def test_ticket47676_reject_action(topology):
time.sleep(2)
loop += 1
assert loop <= 10
-
+
# Check that the schema has been pushed
topology.master1.log.info("Check %s is in M2" % OC2_NAME)
ent = topology.master2.getEntry(SCHEMA_DN, ldap.SCOPE_BASE, "(objectclass=*)", ["objectclasses"])
@@ -453,15 +458,17 @@ def test_ticket47676_reject_action(topology):
found = True
break
assert found
-
+
+
def test_ticket47676_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
@@ -470,17 +477,15 @@ def run_isolated():
global installation2_prefix
installation1_prefix = None
installation2_prefix = None
-
+
topo = topology(True)
topo.master1.log.info("\n\n######################### Ticket 47676 ######################\n")
test_ticket47676_init(topo)
-
+
test_ticket47676_skip_oc_at(topo)
test_ticket47676_reject_action(topo)
-
- test_ticket47676_final(topo)
-
+ test_ticket47676_final(topo)
if __name__ == '__main__':
diff --git a/dirsrvtests/tickets/ticket47714_test.py b/dirsrvtests/tickets/ticket47714_test.py
index 6f32224..ef4ebd5 100644
--- a/dirsrvtests/tickets/ticket47714_test.py
+++ b/dirsrvtests/tickets/ticket47714_test.py
@@ -16,7 +16,7 @@ log = logging.getLogger(__name__)
installation_prefix = None
-ACCT_POLICY_CONFIG_DN = 'cn=config,cn=%s,cn=plugins,cn=config' % PLUGIN_ACCT_POLICY
+ACCT_POLICY_CONFIG_DN = 'cn=config,cn=%s,cn=plugins,cn=config' % PLUGIN_ACCT_POLICY
ACCT_POLICY_DN = 'cn=Account Inactivation Pplicy,%s' % SUFFIX
INACTIVITY_LIMIT = '9'
SEARCHFILTER = '(objectclass=*)'
@@ -25,6 +25,7 @@ TEST_USER = 'ticket47714user'
TEST_USER_DN = 'uid=%s,%s' % (TEST_USER, SUFFIX)
TEST_USER_PW = '%s' % TEST_USER
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
@@ -128,6 +129,7 @@ def topology(request):
# Time to return the topology
return TopologyStandalone(standalone)
+
def _header(topology, label):
topology.standalone.log.info("\n\n###############################################")
topology.standalone.log.info("#######")
@@ -135,9 +137,10 @@ def _header(topology, label):
topology.standalone.log.info("#######")
topology.standalone.log.info("###############################################")
+
def test_ticket47714_init(topology):
"""
- 1. Add account policy entry to the DB
+ 1. Add account policy entry to the DB
2. Add a test user to the DB
"""
_header(topology, 'Testing Ticket 47714 - [RFE] Update lastLoginTime also in Account Policy plugin if account lockout is based on passwordExpirationTime.')
@@ -156,6 +159,7 @@ def test_ticket47714_init(topology):
'userPassword': TEST_USER_PW,
'acctPolicySubentry': ACCT_POLICY_DN})))
+
def test_ticket47714_run_0(topology):
"""
Check this change has no inpact to the existing functionality.
@@ -224,6 +228,7 @@ def test_ticket47714_run_0(topology):
log.info("%s was successfully inactivated." % TEST_USER_DN)
pass
+
def test_ticket47714_run_1(topology):
"""
Verify a new config attr alwaysRecordLoginAttr
@@ -278,14 +283,12 @@ def test_ticket47714_run_1(topology):
log.info("First lastLoginTime: %s, Second lastLoginTime: %s" % (lastLoginTime0, lastLoginTime1))
assert lastLoginTime0 < lastLoginTime1
- topology.standalone.log.info("ticket47714 was successfully verified.");
+ topology.standalone.log.info("ticket47714 was successfully verified.")
+
def test_ticket47714_final(topology):
- log.info("\n######################### Adding Account Policy entry: %s ######################\n" % ACCT_POLICY_DN)
- # Enabled the plugins
- topology.standalone.simple_bind_s(DN_DM, PASSWORD)
- topology.standalone.plugins.disable(name=PLUGIN_ACCT_POLICY)
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
+
def run_isolated():
'''
@@ -300,13 +303,13 @@ def run_isolated():
topo = topology(True)
test_ticket47714_init(topo)
-
+
test_ticket47714_run_0(topo)
test_ticket47714_run_1(topo)
-
+
test_ticket47714_final(topo)
-
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47721_test.py b/dirsrvtests/tickets/ticket47721_test.py
index e27a5a8..3b1aa7b 100644
--- a/dirsrvtests/tickets/ticket47721_test.py
+++ b/dirsrvtests/tickets/ticket47721_test.py
@@ -57,18 +57,22 @@ ENTRY_OC = "top person %s" % OC_NAME
BASE_OID = "1.2.3.4.5.6.7.8.9.10"
+
def _add_custom_at_definition(name='ATticket47721'):
new_at = "( %s-oid NAME '%s' DESC 'test AT ticket 47721' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'Test 47721' 'user defined' ) )" % (name, name)
return new_at
+
def _chg_std_at_defintion():
new_at = "( 2.16.840.1.113730.3.1.569 NAME 'cosPriority' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'Netscape Directory Server' )"
return new_at
+
def _add_custom_oc_defintion(name='OCticket47721'):
new_oc = "( %s-oid NAME '%s' DESC 'An group of related automount objects' SUP top STRUCTURAL MUST ou X-ORIGIN 'draft-howard-rfc2307bis' )" % (name, name)
return new_oc
+
def _chg_std_oc_defintion():
new_oc = "( 5.3.6.1.1.1.2.0 NAME 'trustAccount' DESC 'Sets trust accounts information' SUP top AUXILIARY MUST trustModel MAY ( accessTo $ ou ) X-ORIGIN 'nss_ldap/pam_ldap' )"
return new_oc
@@ -78,7 +82,7 @@ class TopologyMaster1Master2(object):
def __init__(self, master1, master2):
master1.open()
self.master1 = master1
-
+
master2.open()
self.master2 = master2
@@ -90,7 +94,7 @@ def topology(request):
The replicated topology is MASTER1 <-> Master2.
At the beginning, It may exists a master2 instance and/or a master2 instance.
It may also exists a backup for the master1 and/or the master2.
-
+
Principle:
If master1 instance exists:
restart it
@@ -114,22 +118,22 @@ def topology(request):
global installation2_prefix
# allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
+
# Args for the master1 instance
args_instance[SER_HOST] = HOST_MASTER_1
args_instance[SER_PORT] = PORT_MASTER_1
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
args_master = args_instance.copy()
master1.allocate(args_master)
-
+
# allocate master1 on a given deployement
master2 = DirSrv(verbose=False)
if installation2_prefix:
args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_MASTER_2
args_instance[SER_PORT] = PORT_MASTER_2
@@ -137,40 +141,39 @@ def topology(request):
args_master = args_instance.copy()
master2.allocate(args_master)
-
# Get the status of the backups
backup_master1 = master1.checkBackupFS()
backup_master2 = master2.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_master1 = master1.exists()
+ instance_master1 = master1.exists()
if instance_master1:
master1.stop(timeout=10)
master1.start(timeout=10)
-
+
instance_master2 = master2.exists()
if instance_master2:
master2.stop(timeout=10)
master2.start(timeout=10)
-
+
if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master1:
master1.create()
# Used to retrieve configuration information (dbdir, confdir...)
master1.open()
-
+
if not instance_master2:
master2.create()
# Used to retrieve configuration information (dbdir, confdir...)
master2.open()
-
+
# restore master1 from backup
master1.stop(timeout=10)
master1.restoreFS(backup_master1)
master1.start(timeout=10)
-
+
# restore master2 from backup
master2.stop(timeout=10)
master2.restoreFS(backup_master2)
@@ -181,48 +184,48 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master1:
master1.clearBackupFS()
if backup_master2:
master2.clearBackupFS()
-
+
# Remove all the instances
if instance_master1:
master1.delete()
if instance_master2:
master2.delete()
-
+
# Create the instances
master1.create()
master1.open()
master2.create()
master2.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
@@ -232,13 +235,14 @@ def topology(request):
master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
master1.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master1.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -246,12 +250,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master1.stop(timeout=10)
master1.backupfile = master1.backupFS()
master1.start(timeout=10)
-
+
master2.stop(timeout=10)
master2.backupfile = master2.backupFS()
master2.start(timeout=10)
@@ -259,7 +265,7 @@ def topology(request):
# clear the tmp directory
master1.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -273,11 +279,9 @@ def test_ticket47721_init(topology):
- Objectclass with MAY 'member'
- an entry ('bind_entry') with which we bind to test the 'SELFDN' operation
It deletes the anonymous aci
-
+
"""
-
-
-
+
# entry used to bind with
topology.master1.log.info("Add %s" % BIND_DN)
topology.master1.add_s(Entry((BIND_DN, {
@@ -285,12 +289,12 @@ def test_ticket47721_init(topology):
'sn': BIND_NAME,
'cn': BIND_NAME,
'userpassword': BIND_PW})))
-
+
# enable acl error logging
mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(8192))] # ACL + REPL
topology.master1.modify_s(DN_CONFIG, mod)
topology.master2.modify_s(DN_CONFIG, mod)
-
+
# add dummy entries
for cpt in range(MAX_OTHERS):
name = "%s%d" % (OTHER_NAME, cpt)
@@ -298,9 +302,12 @@ def test_ticket47721_init(topology):
'objectclass': "top person".split(),
'sn': name,
'cn': name})))
+
+
def test_ticket47721_0(topology):
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
loop = 0
+ ent = None
while loop <= 10:
try:
ent = topology.master2.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -308,32 +315,34 @@ def test_ticket47721_0(topology):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
- assert loop <= 10
-
+ if ent is None:
+ assert False
+
+
def test_ticket47721_1(topology):
- topology.master1.log.info("Attach debugger\n\n" )
+ #topology.master1.log.info("Attach debugger\n\n")
#time.sleep(30)
-
+
new = _add_custom_at_definition()
topology.master1.log.info("Add (M2) %s " % new)
topology.master2.schema.add_schema('attributetypes', new)
-
+
new = _chg_std_at_defintion()
topology.master1.log.info("Chg (M2) %s " % new)
topology.master2.schema.add_schema('attributetypes', new)
-
+
new = _add_custom_oc_defintion()
topology.master1.log.info("Add (M2) %s " % new)
topology.master2.schema.add_schema('objectClasses', new)
-
+
new = _chg_std_oc_defintion()
topology.master1.log.info("Chg (M2) %s " % new)
topology.master2.schema.add_schema('objectClasses', new)
-
+
mod = [(ldap.MOD_REPLACE, 'description', 'Hello world 1')]
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
topology.master2.modify_s(dn, mod)
-
+
loop = 0
while loop <= 10:
try:
@@ -344,12 +353,27 @@ def test_ticket47721_1(topology):
loop += 1
time.sleep(1)
assert loop <= 10
-
+
+ time.sleep(2)
+ schema_csn_master1 = topology.master1.schema.get_schema_csn()
+ schema_csn_master2 = topology.master2.schema.get_schema_csn()
+ if schema_csn_master1 != schema_csn_master2:
+ # We need to give the server a little more time, then check it again
+ log.info('Schema CSNs are not in sync yet: m1 (%s) vs m2 (%s), wait a little...'
+ % (schema_csn_master1, schema_csn_master2))
+ time.sleep(30)
+ schema_csn_master1 = topology.master1.schema.get_schema_csn()
+ schema_csn_master2 = topology.master2.schema.get_schema_csn()
+
+ assert schema_csn_master1 is not None
+ assert schema_csn_master1 == schema_csn_master2
+
+
def test_ticket47721_2(topology):
mod = [(ldap.MOD_REPLACE, 'description', 'Hello world 2')]
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
topology.master1.modify_s(dn, mod)
-
+
loop = 0
while loop <= 10:
try:
@@ -360,12 +384,22 @@ def test_ticket47721_2(topology):
loop += 1
time.sleep(1)
assert loop <= 10
-
+
+ time.sleep(2)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
- assert schema_csn_master1 != None
+ if schema_csn_master1 != schema_csn_master2:
+ # We need to give the server a little more time, then check it again
+ log.info('Schema CSNs are not in sync yet: m1 (%s) vs m2 (%s), wait a little...'
+ % (schema_csn_master1, schema_csn_master2))
+ time.sleep(30)
+ schema_csn_master1 = topology.master1.schema.get_schema_csn()
+ schema_csn_master2 = topology.master2.schema.get_schema_csn()
+
+ assert schema_csn_master1 is not None
assert schema_csn_master1 == schema_csn_master2
-
+
+
def test_ticket47721_3(topology):
'''
Check that the supplier can update its schema from consumer schema
@@ -379,15 +413,15 @@ def test_ticket47721_3(topology):
new = _add_custom_at_definition('ATtest3')
topology.master1.log.info("Update schema (M2) %s " % new)
topology.master2.schema.add_schema('attributetypes', new)
-
+
new = _add_custom_oc_defintion('OCtest3')
topology.master1.log.info("Update schema (M2) %s " % new)
topology.master2.schema.add_schema('objectClasses', new)
-
+
mod = [(ldap.MOD_REPLACE, 'description', 'Hello world 3')]
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
topology.master1.modify_s(dn, mod)
-
+
loop = 0
while loop <= 10:
try:
@@ -398,13 +432,23 @@ def test_ticket47721_3(topology):
loop += 1
time.sleep(1)
assert loop <= 10
-
+
+ time.sleep(2)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
- assert schema_csn_master1 != None
+ if schema_csn_master1 != schema_csn_master2:
+ # We need to give the server a little more time, then check it again
+ log.info('Schema CSNs are not in sync yet: m1 (%s) vs m2 (%s), wait a little...'
+ % (schema_csn_master1, schema_csn_master2))
+ time.sleep(30)
+ schema_csn_master1 = topology.master1.schema.get_schema_csn()
+ schema_csn_master2 = topology.master2.schema.get_schema_csn()
+
+ assert schema_csn_master1 is not None
# schema csn on M2 is larger that on M1. M1 only took the new definitions
assert schema_csn_master1 != schema_csn_master2
-
+
+
def test_ticket47721_4(topology):
'''
Here M2->M1 agreement is disabled.
@@ -415,16 +459,16 @@ def test_ticket47721_4(topology):
new = _add_custom_at_definition('ATtest4')
topology.master1.log.info("Update schema (M1) %s " % new)
topology.master1.schema.add_schema('attributetypes', new)
-
+
new = _add_custom_oc_defintion('OCtest4')
topology.master1.log.info("Update schema (M1) %s " % new)
topology.master1.schema.add_schema('objectClasses', new)
-
+
topology.master1.log.info("trigger replication M1->M2: to update the schema")
mod = [(ldap.MOD_REPLACE, 'description', 'Hello world 4')]
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
topology.master1.modify_s(dn, mod)
-
+
loop = 0
while loop <= 10:
try:
@@ -435,12 +479,12 @@ def test_ticket47721_4(topology):
loop += 1
time.sleep(1)
assert loop <= 10
-
+
topology.master1.log.info("trigger replication M1->M2: to push the schema")
mod = [(ldap.MOD_REPLACE, 'description', 'Hello world 5')]
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
topology.master1.modify_s(dn, mod)
-
+
loop = 0
while loop <= 10:
try:
@@ -451,20 +495,30 @@ def test_ticket47721_4(topology):
loop += 1
time.sleep(1)
assert loop <= 10
-
+
+ time.sleep(2)
schema_csn_master1 = topology.master1.schema.get_schema_csn()
schema_csn_master2 = topology.master2.schema.get_schema_csn()
- assert schema_csn_master1 != None
+ if schema_csn_master1 != schema_csn_master2:
+ # We need to give the server a little more time, then check it again
+ log.info('Schema CSNs are not in sync yet, wait a little...')
+ time.sleep(30)
+ schema_csn_master1 = topology.master1.schema.get_schema_csn()
+ schema_csn_master2 = topology.master2.schema.get_schema_csn()
+
+ assert schema_csn_master1 is not None
assert schema_csn_master1 == schema_csn_master2
-
+
+
def test_ticket47721_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
@@ -473,21 +527,18 @@ def run_isolated():
global installation2_prefix
installation1_prefix = None
installation2_prefix = None
-
+
topo = topology(True)
topo.master1.log.info("\n\n######################### Ticket 47721 ######################\n")
test_ticket47721_init(topo)
-
+
test_ticket47721_0(topo)
test_ticket47721_1(topo)
test_ticket47721_2(topo)
test_ticket47721_3(topo)
test_ticket47721_4(topo)
- sys.exit(0)
-
- test_ticket47721_final(topo)
-
+ test_ticket47721_final(topo)
if __name__ == '__main__':
diff --git a/dirsrvtests/tickets/ticket47781_test.py b/dirsrvtests/tickets/ticket47781_test.py
index 9b58ef3..94f0893 100644
--- a/dirsrvtests/tickets/ticket47781_test.py
+++ b/dirsrvtests/tickets/ticket47781_test.py
@@ -120,7 +120,7 @@ def topology(request):
def test_ticket47781(topology):
"""
- Testing for a deadlock after doing an online import of an LDIF with
+ Testing for a deadlock after doing an online import of an LDIF with
replication data. The replication agreement should be invalid.
"""
@@ -130,7 +130,7 @@ def test_ticket47781(topology):
# Setup Replication
#
log.info('Setting up replication...')
- topology.standalone.replica.enableReplication(suffix=DEFAULT_SUFFIX, role=REPLICAROLE_MASTER,
+ topology.standalone.replica.enableReplication(suffix=DEFAULT_SUFFIX, role=REPLICAROLE_MASTER,
replicaId=REPLICAID_MASTER_1)
properties = {RA_NAME: r'meTo_$host:$port',
@@ -139,9 +139,9 @@ def test_ticket47781(topology):
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
# The agreement should point to a server that does NOT exist (invalid port)
- repl_agreement = topology.standalone.agreement.create(suffix=DEFAULT_SUFFIX,
- host=topology.standalone.host,
- port=5555,
+ repl_agreement = topology.standalone.agreement.create(suffix=DEFAULT_SUFFIX,
+ host=topology.standalone.host,
+ port=5555,
properties=properties)
#
@@ -196,13 +196,13 @@ def test_ticket47781(topology):
except ValueError:
os.remove("/tmp/export.ldif")
assert False
-
+
#
# Search for tombstones - we should not hang/timeout
#
log.info('Search for tombstone entries(should find one and not hang)...')
- topology.standalone.set_option(ldap.OPT_NETWORK_TIMEOUT, 5);
- topology.standalone.set_option(ldap.OPT_TIMEOUT, 5);
+ topology.standalone.set_option(ldap.OPT_NETWORK_TIMEOUT, 5)
+ topology.standalone.set_option(ldap.OPT_TIMEOUT, 5)
try:
entries = topology.standalone.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, 'objectclass=nsTombstone')
if not entries:
@@ -217,7 +217,7 @@ def test_ticket47781(topology):
def test_ticket47781_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -233,6 +233,8 @@ def run_isolated():
topo = topology(True)
test_ticket47781(topo)
+ test_ticket47781_final(topo)
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47787_test.py b/dirsrvtests/tickets/ticket47787_test.py
index e9fa876..528b474 100644
--- a/dirsrvtests/tickets/ticket47787_test.py
+++ b/dirsrvtests/tickets/ticket47787_test.py
@@ -56,11 +56,12 @@ MAX_ACCOUNTS = 20
CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
+
class TopologyMaster1Master2(object):
def __init__(self, master1, master2):
master1.open()
self.master1 = master1
-
+
master2.open()
self.master2 = master2
@@ -72,7 +73,7 @@ def topology(request):
The replicated topology is MASTER1 <-> Master2.
At the beginning, It may exists a master2 instance and/or a master2 instance.
It may also exists a backup for the master1 and/or the master2.
-
+
Principle:
If master1 instance exists:
restart it
@@ -96,22 +97,22 @@ def topology(request):
global installation2_prefix
# allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
+
# Args for the master1 instance
args_instance[SER_HOST] = HOST_MASTER_1
args_instance[SER_PORT] = PORT_MASTER_1
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
args_master = args_instance.copy()
master1.allocate(args_master)
-
+
# allocate master1 on a given deployement
master2 = DirSrv(verbose=False)
if installation2_prefix:
args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_MASTER_2
args_instance[SER_PORT] = PORT_MASTER_2
@@ -119,40 +120,39 @@ def topology(request):
args_master = args_instance.copy()
master2.allocate(args_master)
-
# Get the status of the backups
backup_master1 = master1.checkBackupFS()
backup_master2 = master2.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
instance_master1 = master1.exists()
if instance_master1:
master1.stop(timeout=10)
master1.start(timeout=10)
-
+
instance_master2 = master2.exists()
if instance_master2:
master2.stop(timeout=10)
master2.start(timeout=10)
-
+
if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master1:
master1.create()
# Used to retrieve configuration information (dbdir, confdir...)
master1.open()
-
+
if not instance_master2:
master2.create()
# Used to retrieve configuration information (dbdir, confdir...)
master2.open()
-
+
# restore master1 from backup
master1.stop(timeout=10)
master1.restoreFS(backup_master1)
master1.start(timeout=10)
-
+
# restore master2 from backup
master2.stop(timeout=10)
master2.restoreFS(backup_master2)
@@ -163,48 +163,48 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master1:
master1.clearBackupFS()
if backup_master2:
master2.clearBackupFS()
-
+
# Remove all the instances
if instance_master1:
master1.delete()
if instance_master2:
master2.delete()
-
+
# Create the instances
master1.create()
master1.open()
master2.create()
master2.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
@@ -214,13 +214,14 @@ def topology(request):
master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
master1.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master1.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -228,12 +229,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master1.stop(timeout=10)
master1.backupfile = master1.backupFS()
master1.start(timeout=10)
-
+
master2.stop(timeout=10)
master2.backupfile = master2.backupFS()
master2.start(timeout=10)
@@ -241,7 +244,7 @@ def topology(request):
# clear the tmp directory
master1.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -249,27 +252,29 @@ def topology(request):
return TopologyMaster1Master2(master1, master2)
-
def _bind_manager(server):
server.log.info("Bind as %s " % DN_DM)
server.simple_bind_s(DN_DM, PASSWORD)
+
def _bind_normal(server):
server.log.info("Bind as %s " % BIND_DN)
server.simple_bind_s(BIND_DN, BIND_PW)
-
+
+
def _header(topology, label):
topology.master1.log.info("\n\n###############################################")
topology.master1.log.info("#######")
topology.master1.log.info("####### %s" % label)
topology.master1.log.info("#######")
topology.master1.log.info("###############################################")
-
+
+
def _status_entry_both_server(topology, name=None, desc=None, debug=True):
if not name:
return
topology.master1.log.info("\n\n######################### Tombstone on M1 ######################\n")
- attr = 'description'
+ attr = 'description'
found = False
attempt = 0
while not found and attempt < 10:
@@ -280,42 +285,42 @@ def _status_entry_both_server(topology, name=None, desc=None, debug=True):
time.sleep(1)
attempt = attempt + 1
assert ent_m1
-
+
topology.master1.log.info("\n\n######################### Tombstone on M2 ######################\n")
ent_m2 = _find_tombstone(topology.master2, SUFFIX, 'sn', name)
assert ent_m2
-
+
topology.master1.log.info("\n\n######################### Description ######################\n%s\n" % desc)
topology.master1.log.info("M1 only\n")
for attr in ent_m1.getAttrs():
-
+
if not debug:
assert attr in ent_m2.getAttrs()
-
+
if not attr in ent_m2.getAttrs():
topology.master1.log.info(" %s" % attr)
for val in ent_m1.getValues(attr):
topology.master1.log.info(" %s" % val)
-
+
topology.master1.log.info("M2 only\n")
for attr in ent_m2.getAttrs():
-
+
if not debug:
assert attr in ent_m1.getAttrs()
-
+
if not attr in ent_m1.getAttrs():
topology.master1.log.info(" %s" % attr)
for val in ent_m2.getValues(attr):
topology.master1.log.info(" %s" % val)
-
+
topology.master1.log.info("M1 differs M2\n")
-
+
if not debug:
assert ent_m1.dn == ent_m2.dn
-
+
if ent_m1.dn != ent_m2.dn:
topology.master1.log.info(" M1[dn] = %s\n M2[dn] = %s" % (ent_m1.dn, ent_m2.dn))
-
+
for attr1 in ent_m1.getAttrs():
if attr1 in ent_m2.getAttrs():
for val1 in ent_m1.getValues(attr1):
@@ -324,14 +329,13 @@ def _status_entry_both_server(topology, name=None, desc=None, debug=True):
if val1 == val2:
found = True
break
-
+
if not debug:
assert found
-
+
if not found:
topology.master1.log.info(" M1[%s] = %s" % (attr1, val1))
-
-
+
for attr2 in ent_m2.getAttrs():
if attr2 in ent_m1.getAttrs():
for val2 in ent_m2.getValues(attr2):
@@ -340,43 +344,46 @@ def _status_entry_both_server(topology, name=None, desc=None, debug=True):
if val2 == val1:
found = True
break
-
+
if not debug:
assert found
-
+
if not found:
topology.master1.log.info(" M2[%s] = %s" % (attr2, val2))
-
+
+
def _pause_RAs(topology):
topology.master1.log.info("\n\n######################### Pause RA M1<->M2 ######################\n")
ents = topology.master1.agreement.list(suffix=SUFFIX)
assert len(ents) == 1
topology.master1.agreement.pause(ents[0].dn)
-
+
ents = topology.master2.agreement.list(suffix=SUFFIX)
assert len(ents) == 1
topology.master2.agreement.pause(ents[0].dn)
-
+
+
def _resume_RAs(topology):
topology.master1.log.info("\n\n######################### resume RA M1<->M2 ######################\n")
ents = topology.master1.agreement.list(suffix=SUFFIX)
assert len(ents) == 1
topology.master1.agreement.resume(ents[0].dn)
-
+
ents = topology.master2.agreement.list(suffix=SUFFIX)
assert len(ents) == 1
topology.master2.agreement.resume(ents[0].dn)
-
+
+
def _find_tombstone(instance, base, attr, value):
#
# we can not use a filter with a (&(objeclass=nsTombstone)(sn=name)) because
# tombstone are not index in 'sn' so 'sn=name' will return NULL
# and even if tombstone are indexed for objectclass the '&' will set
# the candidate list to NULL
- #
+ #
filt = '(objectclass=%s)' % REPLICA_OC_TOMBSTONE
ents = instance.search_s(base, ldap.SCOPE_SUBTREE, filt)
- found = False
+ #found = False
for ent in ents:
if ent.hasAttr(attr):
for val in ent.getValues(attr):
@@ -384,43 +391,44 @@ def _find_tombstone(instance, base, attr, value):
instance.log.debug("tombstone found: %r" % ent)
return ent
return None
-
+
def _delete_entry(instance, entry_dn, name):
instance.log.info("\n\n######################### DELETE %s (M1) ######################\n" % name)
-
+
# delete the entry
instance.delete_s(entry_dn)
- assert _find_tombstone(instance, SUFFIX, 'sn', name) != None
-
+ assert _find_tombstone(instance, SUFFIX, 'sn', name) is not None
def _mod_entry(instance, entry_dn, attr, value):
instance.log.info("\n\n######################### MOD %s (M2) ######################\n" % entry_dn)
- mod = [(ldap.MOD_REPLACE, attr, value)]
+ mod = [(ldap.MOD_REPLACE, attr, value)]
instance.modify_s(entry_dn, mod)
-
+
+
def _modrdn_entry(instance=None, entry_dn=None, new_rdn=None, del_old=0, new_superior=None):
- assert instance != None
- assert entry_dn != None
-
+ assert instance is not None
+ assert entry_dn is not None
+
if not new_rdn:
pattern = 'cn=(.*),(.*)'
- rdnre = re.compile(pattern)
- match = rdnre.match(entry_dn)
+ rdnre = re.compile(pattern)
+ match = rdnre.match(entry_dn)
old_value = match.group(1)
new_rdn_val = "%s_modrdn" % old_value
new_rdn = "cn=%s" % new_rdn_val
-
-
+
instance.log.info("\n\n######################### MODRDN %s (M2) ######################\n" % new_rdn)
if new_superior:
instance.rename_s(entry_dn, new_rdn, newsuperior=new_superior, delold=del_old)
else:
instance.rename_s(entry_dn, new_rdn, delold=del_old)
-
+
+
def _check_entry_exists(instance, entry_dn):
loop = 0
+ ent = None
while loop <= 10:
try:
ent = instance.getEntry(entry_dn, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -428,8 +436,10 @@ def _check_entry_exists(instance, entry_dn):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
- assert loop <= 10
-
+ if ent is None:
+ assert False
+
+
def _check_mod_received(instance, base, filt, attr, value):
instance.log.info("\n\n######################### Check MOD replicated on %s ######################\n" % instance.serverid)
loop = 0
@@ -440,43 +450,44 @@ def _check_mod_received(instance, base, filt, attr, value):
time.sleep(1)
loop += 1
assert loop <= 10
-
+
+
def _check_replication(topology, entry_dn):
# prepare the filter to retrieve the entry
filt = entry_dn.split(',')[0]
-
+
topology.master1.log.info("\n######################### Check replicat M1->M2 ######################\n")
loop = 0
while loop <= 10:
attr = 'description'
value = 'test_value_%d' % loop
- mod = [(ldap.MOD_REPLACE, attr, value)]
+ mod = [(ldap.MOD_REPLACE, attr, value)]
topology.master1.modify_s(entry_dn, mod)
_check_mod_received(topology.master2, SUFFIX, filt, attr, value)
loop += 1
-
+
topology.master1.log.info("\n######################### Check replicat M2->M1 ######################\n")
loop = 0
while loop <= 10:
attr = 'description'
value = 'test_value_%d' % loop
- mod = [(ldap.MOD_REPLACE, attr, value)]
+ mod = [(ldap.MOD_REPLACE, attr, value)]
topology.master2.modify_s(entry_dn, mod)
_check_mod_received(topology.master1, SUFFIX, filt, attr, value)
loop += 1
-
-
+
+
def test_ticket47787_init(topology):
"""
Creates
- a staging DIT
- a production DIT
- add accounts in staging DIT
-
+
"""
-
+
topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
+
# entry used to bind with
topology.master1.log.info("Add %s" % BIND_DN)
topology.master1.add_s(Entry((BIND_DN, {
@@ -484,31 +495,26 @@ def test_ticket47787_init(topology):
'sn': BIND_CN,
'cn': BIND_CN,
'userpassword': BIND_PW})))
-
+
# DIT for staging
topology.master1.log.info("Add %s" % STAGING_DN)
topology.master1.add_s(Entry((STAGING_DN, {
'objectclass': "top organizationalRole".split(),
'cn': STAGING_CN,
'description': "staging DIT"})))
-
+
# DIT for production
topology.master1.log.info("Add %s" % PRODUCTION_DN)
topology.master1.add_s(Entry((PRODUCTION_DN, {
'objectclass': "top organizationalRole".split(),
'cn': PRODUCTION_CN,
'description': "production DIT"})))
-
-
+
# enable replication error logging
mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '8192')]
topology.master1.modify_s(DN_CONFIG, mod)
topology.master2.modify_s(DN_CONFIG, mod)
-
-
-
-
# add dummy entries in the staging DIT
for cpt in range(MAX_ACCOUNTS):
name = "%s%d" % (NEW_ACCOUNT, cpt)
@@ -517,64 +523,63 @@ def test_ticket47787_init(topology):
'sn': name,
'cn': name})))
-
+
def test_ticket47787_2(topology):
'''
Disable replication so that updates are not replicated
- Delete an entry on M1. Modrdn it on M2 (chg rdn + delold=0 + same superior).
+ Delete an entry on M1. Modrdn it on M2 (chg rdn + delold=0 + same superior).
update a test entry on M2
Reenable the RA.
checks that entry was deleted on M2 (with the modified RDN)
checks that test entry was replicated on M1 (replication M2->M1 not broken by modrdn)
'''
-
+
_header(topology, "test_ticket47787_2")
_bind_manager(topology.master1)
_bind_manager(topology.master2)
-
+
#entry to test the replication is still working
- name = "%s%d" % (NEW_ACCOUNT, MAX_ACCOUNTS -1)
- test_rdn = "cn=%s" % (name)
+ name = "%s%d" % (NEW_ACCOUNT, MAX_ACCOUNTS - 1)
+ test_rdn = "cn=%s" % (name)
testentry_dn = "%s,%s" % (test_rdn, STAGING_DN)
-
+
name = "%s%d" % (NEW_ACCOUNT, MAX_ACCOUNTS - 2)
- test2_rdn = "cn=%s" % (name)
+ test2_rdn = "cn=%s" % (name)
testentry2_dn = "%s,%s" % (test2_rdn, STAGING_DN)
-
+
# value of updates to test the replication both ways
- attr = 'description'
+ attr = 'description'
value = 'test_ticket47787_2'
-
+
# entry for the modrdn
name = "%s%d" % (NEW_ACCOUNT, 1)
- rdn = "cn=%s" % (name)
+ rdn = "cn=%s" % (name)
entry_dn = "%s,%s" % (rdn, STAGING_DN)
-
+
# created on M1, wait the entry exists on M2
_check_entry_exists(topology.master2, entry_dn)
_check_entry_exists(topology.master2, testentry_dn)
-
+
_pause_RAs(topology)
-
+
# Delete 'entry_dn' on M1.
# dummy update is only have a first CSN before the DEL
# else the DEL will be in min_csn RUV and make diagnostic a bit more complex
_mod_entry(topology.master1, testentry2_dn, attr, 'dummy')
_delete_entry(topology.master1, entry_dn, name)
_mod_entry(topology.master1, testentry2_dn, attr, value)
-
+
time.sleep(1) # important to have MOD.csn != DEL.csn
-
+
# MOD 'entry_dn' on M1.
# dummy update is only have a first CSN before the MOD entry_dn
# else the DEL will be in min_csn RUV and make diagnostic a bit more complex
_mod_entry(topology.master2, testentry_dn, attr, 'dummy')
_mod_entry(topology.master2, entry_dn, attr, value)
_mod_entry(topology.master2, testentry_dn, attr, value)
-
-
+
_resume_RAs(topology)
-
+
topology.master1.log.info("\n\n######################### Check DEL replicated on M2 ######################\n")
loop = 0
while loop <= 10:
@@ -592,9 +597,9 @@ def test_ticket47787_2(topology):
#_check_mod_received(topology.master2, SUFFIX, "(%s)" % (test2_rdn), attr, value)
#
#_check_replication(topology, testentry_dn)
-
+
_status_entry_both_server(topology, name=name, desc="DEL M1 - MOD M2", debug=DEBUG_FLAG)
-
+
topology.master1.log.info("\n\n######################### Check MOD replicated on M1 ######################\n")
loop = 0
while loop <= 10:
@@ -605,18 +610,19 @@ def test_ticket47787_2(topology):
loop += 1
assert loop <= 10
assert ent
- assert ent.hasAttr(attr)
+ assert ent.hasAttr(attr)
assert ent.getValue(attr) == value
def test_ticket47787_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
@@ -625,16 +631,14 @@ def run_isolated():
global installation2_prefix
installation1_prefix = None
installation2_prefix = None
-
+
topo = topology(True)
topo.master1.log.info("\n\n######################### Ticket 47787 ######################\n")
test_ticket47787_init(topo)
-
+
test_ticket47787_2(topo)
test_ticket47787_final(topo)
-
-
if __name__ == '__main__':
diff --git a/dirsrvtests/tickets/ticket47808_test.py b/dirsrvtests/tickets/ticket47808_test.py
index 5a16a1f..eecfd4a 100644
--- a/dirsrvtests/tickets/ticket47808_test.py
+++ b/dirsrvtests/tickets/ticket47808_test.py
@@ -19,7 +19,7 @@ installation_prefix = None
ATTRIBUTE_UNIQUENESS_PLUGIN = 'cn=attribute uniqueness,cn=plugins,cn=config'
ENTRY_NAME = 'test_entry'
-
+
class TopologyStandalone(object):
def __init__(self, standalone):
@@ -33,7 +33,7 @@ def topology(request):
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -52,60 +52,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=True)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
-
+
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -114,7 +114,7 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
- #
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
@@ -130,19 +130,19 @@ def test_ticket47808_run(topology):
If the second add does not crash the server and the following search found none,
the bug is fixed.
"""
-
+
# bind as directory manager
topology.standalone.log.info("Bind as %s" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
topology.standalone.log.info("\n\n######################### SETUP ATTR UNIQ PLUGIN ######################\n")
# enable attribute uniqueness plugin
mod = [(ldap.MOD_REPLACE, 'nsslapd-pluginEnabled', 'on'), (ldap.MOD_REPLACE, 'nsslapd-pluginarg0', 'sn'), (ldap.MOD_REPLACE, 'nsslapd-pluginarg1', SUFFIX)]
topology.standalone.modify_s(ATTRIBUTE_UNIQUENESS_PLUGIN, mod)
-
+
topology.standalone.log.info("\n\n######################### ADD USER 1 ######################\n")
-
+
# Prepare entry 1
entry_name = '%s 1' % (ENTRY_NAME)
entry_dn_1 = 'cn=%s, %s' % (entry_name, SUFFIX)
@@ -156,10 +156,10 @@ def test_ticket47808_run(topology):
topology.standalone.log.info("\n\n######################### Restart Server ######################\n")
topology.standalone.stop(timeout=10)
topology.standalone.start(timeout=10)
-
+
topology.standalone.log.info("\n\n######################### ADD USER 2 ######################\n")
-
- # Prepare entry 2 having the same sn, which crashes the server
+
+ # Prepare entry 2 having the same sn, which crashes the server
entry_name = '%s 2' % (ENTRY_NAME)
entry_dn_2 = 'cn=%s, %s' % (entry_name, SUFFIX)
entry_2 = Entry(entry_dn_2)
@@ -168,10 +168,10 @@ def test_ticket47808_run(topology):
entry_2.setValues('cn', entry_name)
topology.standalone.log.info("Try to add Add %s: %r" % (entry_2, entry_2))
try:
- topology.standalone.add_s(entry_2)
+ topology.standalone.add_s(entry_2)
except:
- topology.standalone.log.warn("Adding %s failed" % entry_dn_2)
- pass
+ topology.standalone.log.warn("Adding %s failed" % entry_dn_2)
+ pass
topology.standalone.log.info("\n\n######################### IS SERVER UP? ######################\n")
ents = topology.standalone.search_s(entry_dn_1, ldap.SCOPE_BASE, '(objectclass=*)')
@@ -184,29 +184,31 @@ def test_ticket47808_run(topology):
ents = topology.standalone.search_s(entry_dn_2, ldap.SCOPE_BASE, '(objectclass=*)')
except ldap.NO_SUCH_OBJECT:
topology.standalone.log.info("Found none")
-
+
topology.standalone.log.info("\n\n######################### DELETE USER 1 ######################\n")
-
+
topology.standalone.log.info("Try to delete %s " % entry_dn_1)
topology.standalone.delete_s(entry_dn_1)
-
+
+
def test_ticket47808_final(topology):
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
+
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
installation_prefix = None
-
+
topo = topology(True)
test_ticket47808_run(topo)
-
+
test_ticket47808_final(topo)
diff --git a/dirsrvtests/tickets/ticket47815_test.py b/dirsrvtests/tickets/ticket47815_test.py
index 9d09240..eaaf616 100644
--- a/dirsrvtests/tickets/ticket47815_test.py
+++ b/dirsrvtests/tickets/ticket47815_test.py
@@ -209,7 +209,7 @@ def test_ticket47815(topology):
def test_ticket47815_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -225,6 +225,7 @@ def run_isolated():
topo = topology(True)
test_ticket47815(topo)
+ test_ticket47815_final(topo)
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47819_test.py b/dirsrvtests/tickets/ticket47819_test.py
index 7b6f2d5..ba5ebc4 100644
--- a/dirsrvtests/tickets/ticket47819_test.py
+++ b/dirsrvtests/tickets/ticket47819_test.py
@@ -327,7 +327,7 @@ def test_ticket47819(topology):
def test_ticket47819_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -343,6 +343,7 @@ def run_isolated():
topo = topology(True)
test_ticket47819(topo)
+ test_ticket47819_final(topo)
if __name__ == '__main__':
run_isolated()
\ No newline at end of file
diff --git a/dirsrvtests/tickets/ticket47823_test.py b/dirsrvtests/tickets/ticket47823_test.py
index f4d3695..e237ccd 100644
--- a/dirsrvtests/tickets/ticket47823_test.py
+++ b/dirsrvtests/tickets/ticket47823_test.py
@@ -18,20 +18,20 @@ log = logging.getLogger(__name__)
installation_prefix = None
-PROVISIONING_CN = "provisioning"
-PROVISIONING_DN = "cn=%s,%s" % (PROVISIONING_CN, SUFFIX)
+PROVISIONING_CN = "provisioning"
+PROVISIONING_DN = "cn=%s,%s" % (PROVISIONING_CN, SUFFIX)
-ACTIVE_CN = "accounts"
-STAGE_CN = "staged users"
-DELETE_CN = "deleted users"
-ACTIVE_DN = "cn=%s,%s" % (ACTIVE_CN, SUFFIX)
-STAGE_DN = "cn=%s,%s" % (STAGE_CN, PROVISIONING_DN)
-DELETE_DN = "cn=%s,%s" % (DELETE_CN, PROVISIONING_DN)
+ACTIVE_CN = "accounts"
+STAGE_CN = "staged users"
+DELETE_CN = "deleted users"
+ACTIVE_DN = "cn=%s,%s" % (ACTIVE_CN, SUFFIX)
+STAGE_DN = "cn=%s,%s" % (STAGE_CN, PROVISIONING_DN)
+DELETE_DN = "cn=%s,%s" % (DELETE_CN, PROVISIONING_DN)
-STAGE_USER_CN = "stage guy"
-STAGE_USER_DN = "cn=%s,%s" % (STAGE_USER_CN, STAGE_DN)
+STAGE_USER_CN = "stage guy"
+STAGE_USER_DN = "cn=%s,%s" % (STAGE_USER_CN, STAGE_DN)
-ACTIVE_USER_CN = "active guy"
+ACTIVE_USER_CN = "active guy"
ACTIVE_USER_DN = "cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN)
ACTIVE_USER_1_CN = "test_1"
@@ -44,9 +44,10 @@ STAGE_USER_1_DN = "cn=%s,%s" % (STAGE_USER_1_CN, STAGE_DN)
STAGE_USER_2_CN = ACTIVE_USER_2_CN
STAGE_USER_2_DN = "cn=%s,%s" % (STAGE_USER_2_CN, STAGE_DN)
-ALL_CONFIG_ATTRS = ['nsslapd-pluginarg0', 'nsslapd-pluginarg1', 'nsslapd-pluginarg2',
+ALL_CONFIG_ATTRS = ['nsslapd-pluginarg0', 'nsslapd-pluginarg1', 'nsslapd-pluginarg2',
'uniqueness-attribute-name', 'uniqueness-subtrees', 'uniqueness-across-all-subtrees']
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
@@ -150,6 +151,7 @@ def topology(request):
# Time to return the topology
return TopologyStandalone(standalone)
+
def _header(topology, label):
topology.standalone.log.info("\n\n###############################################")
topology.standalone.log.info("#######")
@@ -157,11 +159,12 @@ def _header(topology, label):
topology.standalone.log.info("#######")
topology.standalone.log.info("###############################################")
+
def _uniqueness_config_entry(topology, name=None):
if not name:
return None
-
- ent = topology.standalone.getEntry("cn=%s,%s" % (PLUGIN_ATTR_UNIQUENESS, DN_PLUGIN), ldap.SCOPE_BASE,
+
+ ent = topology.standalone.getEntry("cn=%s,%s" % (PLUGIN_ATTR_UNIQUENESS, DN_PLUGIN), ldap.SCOPE_BASE,
"(objectclass=nsSlapdPlugin)",
['objectClass', 'cn', 'nsslapd-pluginPath', 'nsslapd-pluginInitfunc',
'nsslapd-pluginType', 'nsslapd-pluginEnabled', 'nsslapd-plugin-depends-on-type',
@@ -170,11 +173,12 @@ def _uniqueness_config_entry(topology, name=None):
ent.dn = "cn=%s uniqueness,%s" % (name, DN_PLUGIN)
return ent
+
def _build_config(topology, attr_name='cn', subtree_1=None, subtree_2=None, type_config='old', across_subtrees=False):
assert topology
assert attr_name
assert subtree_1
-
+
if type_config == 'old':
# enable the 'cn' uniqueness on Active
config = _uniqueness_config_entry(topology, attr_name)
@@ -193,6 +197,7 @@ def _build_config(topology, attr_name='cn', subtree_1=None, subtree_2=None, type
config.setValue('uniqueness-across-all-subtrees', 'on')
return config
+
def _active_container_invalid_cfg_add(topology):
'''
Check uniqueness is not enforced with ADD (invalid config)
@@ -206,28 +211,29 @@ def _active_container_invalid_cfg_add(topology):
'objectclass': "top person".split(),
'sn': ACTIVE_USER_2_CN,
'cn': [ACTIVE_USER_1_CN, ACTIVE_USER_2_CN]})))
-
+
topology.standalone.delete_s(ACTIVE_USER_1_DN)
topology.standalone.delete_s(ACTIVE_USER_2_DN)
+
def _active_container_add(topology, type_config='old'):
'''
Check uniqueness in a single container (Active)
Add an entry with a given 'cn', then check we can not add an entry with the same 'cn' value
-
+
'''
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config=type_config, across_subtrees=False)
-
+
# remove the 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.restart(timeout=120)
-
+
topology.standalone.log.info('Uniqueness not enforced: create the entries')
-
+
topology.standalone.add_s(Entry((ACTIVE_USER_1_DN, {
'objectclass': "top person".split(),
'sn': ACTIVE_USER_1_CN,
@@ -237,14 +243,14 @@ def _active_container_add(topology, type_config='old'):
'objectclass': "top person".split(),
'sn': ACTIVE_USER_2_CN,
'cn': [ACTIVE_USER_1_CN, ACTIVE_USER_2_CN]})))
-
+
topology.standalone.delete_s(ACTIVE_USER_1_DN)
topology.standalone.delete_s(ACTIVE_USER_2_DN)
-
-
+
+
topology.standalone.log.info('Uniqueness enforced: checks second entry is rejected')
-
- # enable the 'cn' uniqueness on Active
+
+ # enable the 'cn' uniqueness on Active
topology.standalone.add_s(config)
topology.standalone.restart(timeout=120)
topology.standalone.add_s(Entry((ACTIVE_USER_1_DN, {
@@ -260,26 +266,25 @@ def _active_container_add(topology, type_config='old'):
except ldap.CONSTRAINT_VIOLATION:
# yes it is expected
pass
-
+
# cleanup the stuff now
topology.standalone.delete_s(config.dn)
topology.standalone.delete_s(ACTIVE_USER_1_DN)
-
def _active_container_mod(topology, type_config='old'):
'''
Check uniqueness in a single container (active)
Add and entry with a given 'cn', then check we can not modify an entry with the same 'cn' value
-
+
'''
-
+
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config=type_config, across_subtrees=False)
-
+
# enable the 'cn' uniqueness on Active
topology.standalone.add_s(config)
topology.standalone.restart(timeout=120)
-
+
topology.standalone.log.info('Uniqueness enforced: checks MOD ADD entry is rejected')
topology.standalone.add_s(Entry((ACTIVE_USER_1_DN, {
'objectclass': "top person".split(),
@@ -296,33 +301,34 @@ def _active_container_mod(topology, type_config='old'):
except ldap.CONSTRAINT_VIOLATION:
# yes it is expected
pass
-
+
topology.standalone.log.info('Uniqueness enforced: checks MOD REPLACE entry is rejected')
try:
topology.standalone.modify_s(ACTIVE_USER_2_DN, [(ldap.MOD_REPLACE, 'cn', [ACTIVE_USER_1_CN, ACTIVE_USER_2_CN])])
except ldap.CONSTRAINT_VIOLATION:
# yes it is expected
pass
-
+
# cleanup the stuff now
topology.standalone.delete_s(config.dn)
topology.standalone.delete_s(ACTIVE_USER_1_DN)
topology.standalone.delete_s(ACTIVE_USER_2_DN)
-
+
+
def _active_container_modrdn(topology, type_config='old'):
'''
Check uniqueness in a single container
Add and entry with a given 'cn', then check we can not modrdn an entry with the same 'cn' value
-
+
'''
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config=type_config, across_subtrees=False)
-
+
# enable the 'cn' uniqueness on Active
topology.standalone.add_s(config)
topology.standalone.restart(timeout=120)
-
+
topology.standalone.log.info('Uniqueness enforced: checks MODRDN entry is rejected')
-
+
topology.standalone.add_s(Entry((ACTIVE_USER_1_DN, {
'objectclass': "top person".split(),
'sn': ACTIVE_USER_1_CN,
@@ -338,23 +344,23 @@ def _active_container_modrdn(topology, type_config='old'):
except ldap.CONSTRAINT_VIOLATION:
# yes it is expected
pass
-
-
+
# cleanup the stuff now
topology.standalone.delete_s(config.dn)
topology.standalone.delete_s(ACTIVE_USER_1_DN)
topology.standalone.delete_s(ACTIVE_USER_2_DN)
+
def _active_stage_containers_add(topology, type_config='old', across_subtrees=False):
'''
Check uniqueness in several containers
Add an entry on a container with a given 'cn'
with across_subtrees=False check we CAN add an entry with the same 'cn' value on the other container
with across_subtrees=True check we CAN NOT add an entry with the same 'cn' value on the other container
-
+
'''
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=STAGE_DN, type_config=type_config, across_subtrees=False)
-
+
topology.standalone.add_s(config)
topology.standalone.restart(timeout=120)
topology.standalone.add_s(Entry((ACTIVE_USER_1_DN, {
@@ -370,20 +376,21 @@ def _active_stage_containers_add(topology, type_config='old', across_subtrees=Fa
'cn': ACTIVE_USER_1_CN})))
except ldap.CONSTRAINT_VIOLATION:
assert across_subtrees
-
+
# cleanup the stuff now
topology.standalone.delete_s(config.dn)
topology.standalone.delete_s(ACTIVE_USER_1_DN)
topology.standalone.delete_s(STAGE_USER_1_DN)
-
+
+
def _active_stage_containers_mod(topology, type_config='old', across_subtrees=False):
'''
Check uniqueness in a several containers
Add an entry on a container with a given 'cn', then check we CAN mod an entry with the same 'cn' value on the other container
-
+
'''
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=STAGE_DN, type_config=type_config, across_subtrees=False)
-
+
topology.standalone.add_s(config)
topology.standalone.restart(timeout=120)
# adding an entry on active with a different 'cn'
@@ -397,14 +404,14 @@ def _active_stage_containers_mod(topology, type_config='old', across_subtrees=Fa
'objectclass': "top person".split(),
'sn': STAGE_USER_1_CN,
'cn': STAGE_USER_1_CN})))
-
+
try:
-
+
# modify add same value
topology.standalone.modify_s(STAGE_USER_1_DN, [(ldap.MOD_ADD, 'cn', [ACTIVE_USER_2_CN])])
except ldap.CONSTRAINT_VIOLATION:
assert across_subtrees
-
+
topology.standalone.delete_s(STAGE_USER_1_DN)
topology.standalone.add_s(Entry((STAGE_USER_1_DN, {
'objectclass': "top person".split(),
@@ -415,21 +422,22 @@ def _active_stage_containers_mod(topology, type_config='old', across_subtrees=Fa
topology.standalone.modify_s(STAGE_USER_1_DN, [(ldap.MOD_REPLACE, 'cn', [STAGE_USER_2_CN, ACTIVE_USER_1_CN])])
except ldap.CONSTRAINT_VIOLATION:
assert across_subtrees
-
+
# cleanup the stuff now
topology.standalone.delete_s(config.dn)
topology.standalone.delete_s(ACTIVE_USER_1_DN)
topology.standalone.delete_s(STAGE_USER_1_DN)
-
+
+
def _active_stage_containers_modrdn(topology, type_config='old', across_subtrees=False):
'''
Check uniqueness in a several containers
Add and entry with a given 'cn', then check we CAN modrdn an entry with the same 'cn' value on the other container
-
+
'''
-
+
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=STAGE_DN, type_config=type_config, across_subtrees=False)
-
+
# enable the 'cn' uniqueness on Active and Stage
topology.standalone.add_s(config)
topology.standalone.restart(timeout=120)
@@ -443,11 +451,10 @@ def _active_stage_containers_modrdn(topology, type_config='old', across_subtrees
'sn': STAGE_USER_1_CN,
'cn': STAGE_USER_1_CN})))
-
try:
-
+
topology.standalone.rename_s(STAGE_USER_1_DN, 'cn=dummy', delold=0)
-
+
# check stage entry has 'cn=dummy'
stage_ent = topology.standalone.getEntry("cn=dummy,%s" % (STAGE_DN), ldap.SCOPE_BASE, "objectclass=*", ['cn'])
assert stage_ent.hasAttr('cn')
@@ -456,7 +463,7 @@ def _active_stage_containers_modrdn(topology, type_config='old', across_subtrees
if value == 'dummy':
found = True
assert found
-
+
# check active entry has 'cn=dummy'
active_ent = topology.standalone.getEntry(ACTIVE_USER_1_DN, ldap.SCOPE_BASE, "objectclass=*", ['cn'])
assert active_ent.hasAttr('cn')
@@ -465,18 +472,17 @@ def _active_stage_containers_modrdn(topology, type_config='old', across_subtrees
if value == 'dummy':
found = True
assert found
-
+
topology.standalone.delete_s("cn=dummy,%s" % (STAGE_DN))
except ldap.CONSTRAINT_VIOLATION:
assert across_subtrees
topology.standalone.delete_s(STAGE_USER_1_DN)
-
-
-
+
# cleanup the stuff now
topology.standalone.delete_s(config.dn)
topology.standalone.delete_s(ACTIVE_USER_1_DN)
-
+
+
def _config_file(topology, action='save'):
dse_ldif = topology.standalone.confdir + '/dse.ldif'
sav_file = topology.standalone.confdir + '/dse.ldif.ticket47823'
@@ -484,17 +490,18 @@ def _config_file(topology, action='save'):
shutil.copy(dse_ldif, sav_file)
else:
shutil.copy(sav_file, dse_ldif)
-
+
+
def _pattern_errorlog(file, log_pattern):
try:
_pattern_errorlog.last_pos += 1
except AttributeError:
_pattern_errorlog.last_pos = 0
-
+
found = None
log.debug("_pattern_errorlog: start at offset %d" % _pattern_errorlog.last_pos)
file.seek(_pattern_errorlog.last_pos)
-
+
# Use a while true iteration because 'for line in file: hit a
# python bug that break file.tell()
while True:
@@ -503,14 +510,15 @@ def _pattern_errorlog(file, log_pattern):
found = log_pattern.search(line)
if ((line == '') or (found)):
break
-
+
log.debug("_pattern_errorlog: end at offset %d" % file.tell())
_pattern_errorlog.last_pos = file.tell()
return found
-
+
+
def test_ticket47823_init(topology):
"""
-
+
"""
# Enabled the plugins
@@ -518,13 +526,13 @@ def test_ticket47823_init(topology):
topology.standalone.restart(timeout=120)
topology.standalone.add_s(Entry((PROVISIONING_DN, {'objectclass': "top nscontainer".split(),
- 'cn': PROVISIONING_CN})))
- topology.standalone.add_s(Entry((ACTIVE_DN, {'objectclass': "top nscontainer".split(),
- 'cn': ACTIVE_CN})))
- topology.standalone.add_s(Entry((STAGE_DN, {'objectclass': "top nscontainer".split(),
- 'cn': STAGE_CN})))
- topology.standalone.add_s(Entry((DELETE_DN, {'objectclass': "top nscontainer".split(),
- 'cn': DELETE_CN})))
+ 'cn': PROVISIONING_CN})))
+ topology.standalone.add_s(Entry((ACTIVE_DN, {'objectclass': "top nscontainer".split(),
+ 'cn': ACTIVE_CN})))
+ topology.standalone.add_s(Entry((STAGE_DN, {'objectclass': "top nscontainer".split(),
+ 'cn': STAGE_CN})))
+ topology.standalone.add_s(Entry((DELETE_DN, {'objectclass': "top nscontainer".split(),
+ 'cn': DELETE_CN})))
topology.standalone.errorlog_file = open(topology.standalone.errlog, "r")
topology.standalone.stop(timeout=120)
@@ -532,150 +540,155 @@ def test_ticket47823_init(topology):
topology.standalone.start(timeout=120)
time.sleep(3)
-
+
def test_ticket47823_one_container_add(topology):
'''
Check uniqueness in a single container
Add and entry with a given 'cn', then check we can not add an entry with the same 'cn' value
-
+
'''
_header(topology, "With former config (args), check attribute uniqueness with 'cn' (ADD) ")
_active_container_add(topology, type_config='old')
-
+
_header(topology, "With new config (args), check attribute uniqueness with 'cn' (ADD) ")
-
+
_active_container_add(topology, type_config='new')
-
+
+
def test_ticket47823_one_container_mod(topology):
'''
Check uniqueness in a single container
Add and entry with a given 'cn', then check we can not modify an entry with the same 'cn' value
-
+
'''
_header(topology, "With former config (args), check attribute uniqueness with 'cn' (MOD)")
-
+
_active_container_mod(topology, type_config='old')
-
+
_header(topology, "With new config (args), check attribute uniqueness with 'cn' (MOD)")
-
+
_active_container_mod(topology, type_config='new')
-
-
-
+
+
def test_ticket47823_one_container_modrdn(topology):
'''
Check uniqueness in a single container
Add and entry with a given 'cn', then check we can not modrdn an entry with the same 'cn' value
-
+
'''
_header(topology, "With former config (args), check attribute uniqueness with 'cn' (MODRDN)")
-
+
_active_container_modrdn(topology, type_config='old')
-
+
_header(topology, "With former config (args), check attribute uniqueness with 'cn' (MODRDN)")
-
+
_active_container_modrdn(topology, type_config='new')
-
+
+
def test_ticket47823_multi_containers_add(topology):
'''
Check uniqueness in a several containers
Add and entry with a given 'cn', then check we can not add an entry with the same 'cn' value
-
+
'''
_header(topology, "With former config (args), check attribute uniqueness with 'cn' (ADD) ")
_active_stage_containers_add(topology, type_config='old', across_subtrees=False)
-
+
_header(topology, "With new config (args), check attribute uniqueness with 'cn' (ADD) ")
-
+
_active_stage_containers_add(topology, type_config='new', across_subtrees=False)
-
+
+
def test_ticket47823_multi_containers_mod(topology):
'''
Check uniqueness in a several containers
Add an entry on a container with a given 'cn', then check we CAN mod an entry with the same 'cn' value on the other container
-
+
'''
_header(topology, "With former config (args), check attribute uniqueness with 'cn' (MOD) on separated container")
-
-
+
topology.standalone.log.info('Uniqueness not enforced: if same \'cn\' modified (add/replace) on separated containers')
_active_stage_containers_mod(topology, type_config='old', across_subtrees=False)
-
+
_header(topology, "With new config (args), check attribute uniqueness with 'cn' (MOD) on separated container")
-
-
+
topology.standalone.log.info('Uniqueness not enforced: if same \'cn\' modified (add/replace) on separated containers')
_active_stage_containers_mod(topology, type_config='new', across_subtrees=False)
-
+
+
def test_ticket47823_multi_containers_modrdn(topology):
'''
Check uniqueness in a several containers
Add and entry with a given 'cn', then check we CAN modrdn an entry with the same 'cn' value on the other container
-
+
'''
_header(topology, "With former config (args), check attribute uniqueness with 'cn' (MODRDN) on separated containers")
-
+
topology.standalone.log.info('Uniqueness not enforced: checks MODRDN entry is accepted on separated containers')
_active_stage_containers_modrdn(topology, type_config='old', across_subtrees=False)
-
+
topology.standalone.log.info('Uniqueness not enforced: checks MODRDN entry is accepted on separated containers')
_active_stage_containers_modrdn(topology, type_config='old')
+
def test_ticket47823_across_multi_containers_add(topology):
'''
Check uniqueness across several containers, uniquely with the new configuration
Add and entry with a given 'cn', then check we can not add an entry with the same 'cn' value
-
+
'''
_header(topology, "With new config (args), check attribute uniqueness with 'cn' (ADD) across several containers")
_active_stage_containers_add(topology, type_config='old', across_subtrees=True)
-
+
+
def test_ticket47823_across_multi_containers_mod(topology):
'''
Check uniqueness across several containers, uniquely with the new configuration
Add and entry with a given 'cn', then check we can not modifiy an entry with the same 'cn' value
-
+
'''
_header(topology, "With new config (args), check attribute uniqueness with 'cn' (MOD) across several containers")
_active_stage_containers_mod(topology, type_config='old', across_subtrees=True)
+
def test_ticket47823_across_multi_containers_modrdn(topology):
'''
Check uniqueness across several containers, uniquely with the new configuration
Add and entry with a given 'cn', then check we can not modrdn an entry with the same 'cn' value
-
+
'''
_header(topology, "With new config (args), check attribute uniqueness with 'cn' (MODRDN) across several containers")
_active_stage_containers_modrdn(topology, type_config='old', across_subtrees=True)
-
+
+
def test_ticket47823_invalid_config_1(topology):
'''
Check that an invalid config is detected. No uniqueness enforced
Using old config: arg0 is missing
'''
_header(topology, "Invalid config (old): arg0 is missing")
-
+
_config_file(topology, action='save')
-
+
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config='old', across_subtrees=False)
-
+
del config.data['nsslapd-pluginarg0']
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.add_s(config)
- topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
-
+ topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
+
# Check the server did not restart
try:
topology.standalone.restart(timeout=5)
@@ -686,15 +699,15 @@ def test_ticket47823_invalid_config_1(topology):
assert not ent
except ldap.SERVER_DOWN:
pass
-
+
# Check the expected error message
regex = re.compile("Config info: attribute name not defined")
- res =_pattern_errorlog(topology.standalone.errorlog_file, regex)
+ res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
- _config_file(topology, action='restore')
+ _config_file(topology, action='restore')
assert res
-
+
# Check we can restart the server
_config_file(topology, action='restore')
topology.standalone.start(timeout=5)
@@ -703,29 +716,30 @@ def test_ticket47823_invalid_config_1(topology):
except ldap.NO_SUCH_OBJECT:
pass
+
def test_ticket47823_invalid_config_2(topology):
'''
Check that an invalid config is detected. No uniqueness enforced
Using old config: arg1 is missing
'''
_header(topology, "Invalid config (old): arg1 is missing")
-
+
_config_file(topology, action='save')
-
+
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config='old', across_subtrees=False)
-
+
del config.data['nsslapd-pluginarg1']
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.add_s(config)
- topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
-
+ topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
+
# Check the server did not restart
try:
topology.standalone.restart(timeout=5)
@@ -736,15 +750,15 @@ def test_ticket47823_invalid_config_2(topology):
assert not ent
except ldap.SERVER_DOWN:
pass
-
+
# Check the expected error message
regex = re.compile("Config info: No valid subtree is defined")
- res =_pattern_errorlog(topology.standalone.errorlog_file, regex)
+ res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
- _config_file(topology, action='restore')
+ _config_file(topology, action='restore')
assert res
-
+
# Check we can restart the server
_config_file(topology, action='restore')
topology.standalone.start(timeout=5)
@@ -753,30 +767,31 @@ def test_ticket47823_invalid_config_2(topology):
except ldap.NO_SUCH_OBJECT:
pass
+
def test_ticket47823_invalid_config_3(topology):
'''
Check that an invalid config is detected. No uniqueness enforced
Using old config: arg0 is missing
'''
_header(topology, "Invalid config (old): arg0 is missing but new config attrname exists")
-
+
_config_file(topology, action='save')
-
+
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config='old', across_subtrees=False)
-
+
del config.data['nsslapd-pluginarg0']
config.data['uniqueness-attribute-name'] = 'cn'
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.add_s(config)
- topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
-
+ topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
+
# Check the server did not restart
try:
topology.standalone.restart(timeout=5)
@@ -787,15 +802,15 @@ def test_ticket47823_invalid_config_3(topology):
assert not ent
except ldap.SERVER_DOWN:
pass
-
+
# Check the expected error message
regex = re.compile("Config info: objectclass for subtree entries is not defined")
- res =_pattern_errorlog(topology.standalone.errorlog_file, regex)
+ res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
- _config_file(topology, action='restore')
+ _config_file(topology, action='restore')
assert res
-
+
# Check we can restart the server
_config_file(topology, action='restore')
topology.standalone.start(timeout=5)
@@ -803,31 +818,32 @@ def test_ticket47823_invalid_config_3(topology):
topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
except ldap.NO_SUCH_OBJECT:
pass
-
+
+
def test_ticket47823_invalid_config_4(topology):
'''
Check that an invalid config is detected. No uniqueness enforced
Using old config: arg1 is missing
'''
_header(topology, "Invalid config (old): arg1 is missing but new config exist")
-
+
_config_file(topology, action='save')
-
+
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config='old', across_subtrees=False)
-
+
del config.data['nsslapd-pluginarg1']
config.data['uniqueness-subtrees'] = ACTIVE_DN
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.add_s(config)
- topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
-
+ topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
+
# Check the server did not restart
try:
topology.standalone.restart(timeout=5)
@@ -838,15 +854,15 @@ def test_ticket47823_invalid_config_4(topology):
assert not ent
except ldap.SERVER_DOWN:
pass
-
+
# Check the expected error message
regex = re.compile("Config info: No valid subtree is defined")
- res =_pattern_errorlog(topology.standalone.errorlog_file, regex)
+ res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
- _config_file(topology, action='restore')
+ _config_file(topology, action='restore')
assert res
-
+
# Check we can restart the server
_config_file(topology, action='restore')
topology.standalone.start(timeout=5)
@@ -854,30 +870,31 @@ def test_ticket47823_invalid_config_4(topology):
topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
except ldap.NO_SUCH_OBJECT:
pass
-
+
+
def test_ticket47823_invalid_config_5(topology):
'''
Check that an invalid config is detected. No uniqueness enforced
Using new config: uniqueness-attribute-name is missing
'''
_header(topology, "Invalid config (new): uniqueness-attribute-name is missing")
-
+
_config_file(topology, action='save')
-
+
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config='new', across_subtrees=False)
-
+
del config.data['uniqueness-attribute-name']
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.add_s(config)
- topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
-
+ topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
+
# Check the server did not restart
try:
topology.standalone.restart(timeout=5)
@@ -888,15 +905,15 @@ def test_ticket47823_invalid_config_5(topology):
assert not ent
except ldap.SERVER_DOWN:
pass
-
+
# Check the expected error message
regex = re.compile("Config info: attribute name not defined")
- res =_pattern_errorlog(topology.standalone.errorlog_file, regex)
+ res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
- _config_file(topology, action='restore')
+ _config_file(topology, action='restore')
assert res
-
+
# Check we can restart the server
_config_file(topology, action='restore')
topology.standalone.start(timeout=5)
@@ -905,29 +922,30 @@ def test_ticket47823_invalid_config_5(topology):
except ldap.NO_SUCH_OBJECT:
pass
+
def test_ticket47823_invalid_config_6(topology):
'''
Check that an invalid config is detected. No uniqueness enforced
Using new config: uniqueness-subtrees is missing
'''
_header(topology, "Invalid config (new): uniqueness-subtrees is missing")
-
+
_config_file(topology, action='save')
-
+
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1=ACTIVE_DN, subtree_2=None, type_config='new', across_subtrees=False)
-
+
del config.data['uniqueness-subtrees']
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.add_s(config)
- topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
-
+ topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
+
# Check the server did not restart
try:
topology.standalone.restart(timeout=5)
@@ -938,15 +956,15 @@ def test_ticket47823_invalid_config_6(topology):
assert not ent
except ldap.SERVER_DOWN:
pass
-
+
# Check the expected error message
regex = re.compile("Config info: objectclass for subtree entries is not defined")
- res =_pattern_errorlog(topology.standalone.errorlog_file, regex)
+ res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
- _config_file(topology, action='restore')
+ _config_file(topology, action='restore')
assert res
-
+
# Check we can restart the server
_config_file(topology, action='restore')
topology.standalone.start(timeout=5)
@@ -954,29 +972,30 @@ def test_ticket47823_invalid_config_6(topology):
topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
except ldap.NO_SUCH_OBJECT:
pass
-
+
+
def test_ticket47823_invalid_config_7(topology):
'''
Check that an invalid config is detected. No uniqueness enforced
Using new config: uniqueness-subtrees is missing
'''
_header(topology, "Invalid config (new): uniqueness-subtrees are invalid")
-
+
_config_file(topology, action='save')
-
+
# create an invalid config without arg0
config = _build_config(topology, attr_name='cn', subtree_1="this_is dummy DN", subtree_2="an other=dummy DN", type_config='new', across_subtrees=False)
-
+
# replace 'cn' uniqueness entry
try:
topology.standalone.delete_s(config.dn)
-
+
except ldap.NO_SUCH_OBJECT:
pass
topology.standalone.add_s(config)
- topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
-
+ topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
+
# Check the server did not restart
try:
topology.standalone.restart(timeout=5)
@@ -987,15 +1006,15 @@ def test_ticket47823_invalid_config_7(topology):
assert not ent
except ldap.SERVER_DOWN:
pass
-
+
# Check the expected error message
regex = re.compile("Config info: No valid subtree is defined")
- res =_pattern_errorlog(topology.standalone.errorlog_file, regex)
+ res = _pattern_errorlog(topology.standalone.errorlog_file, regex)
if not res:
# be sure to restore a valid config before assert
- _config_file(topology, action='restore')
+ _config_file(topology, action='restore')
assert res
-
+
# Check we can restart the server
_config_file(topology, action='restore')
topology.standalone.start(timeout=5)
@@ -1003,8 +1022,10 @@ def test_ticket47823_invalid_config_7(topology):
topology.standalone.getEntry(config.dn, ldap.SCOPE_BASE, "(objectclass=nsSlapdPlugin)", ALL_CONFIG_ATTRS)
except ldap.NO_SUCH_OBJECT:
pass
+
+
def test_ticket47823_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -1020,12 +1041,12 @@ def run_isolated():
topo = topology(True)
test_ticket47823_init(topo)
-
+
# run old/new config style that makes uniqueness checking on one subtree
test_ticket47823_one_container_add(topo)
test_ticket47823_one_container_mod(topo)
test_ticket47823_one_container_modrdn(topo)
-
+
# run old config style that makes uniqueness checking on each defined subtrees
test_ticket47823_multi_containers_add(topo)
test_ticket47823_multi_containers_mod(topo)
@@ -1033,7 +1054,7 @@ def run_isolated():
test_ticket47823_across_multi_containers_add(topo)
test_ticket47823_across_multi_containers_mod(topo)
test_ticket47823_across_multi_containers_modrdn(topo)
-
+
test_ticket47823_invalid_config_1(topo)
test_ticket47823_invalid_config_2(topo)
test_ticket47823_invalid_config_3(topo)
@@ -1041,9 +1062,9 @@ def run_isolated():
test_ticket47823_invalid_config_5(topo)
test_ticket47823_invalid_config_6(topo)
test_ticket47823_invalid_config_7(topo)
-
+
test_ticket47823_final(topo)
-
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47824_test.py b/dirsrvtests/tickets/ticket47824_test.py
index 98fca97..76e8471 100644
--- a/dirsrvtests/tickets/ticket47824_test.py
+++ b/dirsrvtests/tickets/ticket47824_test.py
@@ -38,6 +38,7 @@ _SUBLDIF2 = 'ticket47824_2.ldif'
SEARCHFILTER = '(objectclass=*)'
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
@@ -50,7 +51,7 @@ def topology(request):
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -69,60 +70,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=False)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -131,7 +132,7 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
- #
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
@@ -151,7 +152,7 @@ def test_ticket47824_run(topology):
# bind as directory manager
topology.standalone.log.info("Bind as %s" % DN_DM)
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
-
+
topology.standalone.log.info("\n\n######################### SETUP SUFFIX o=ticket47824.org ######################\n")
topology.standalone.backend.create(MYSUFFIX, {BACKEND_NAME: MYSUFFIXBE})
@@ -176,7 +177,7 @@ def test_ticket47824_run(topology):
# get tmp dir
mytmp = topology.standalone.getDir(__file__, TMP_DIR)
- if mytmp == None:
+ if mytmp is None:
mytmp = "/tmp"
MYLDIF = '%s%s' % (mytmp, _MYLDIF)
@@ -244,7 +245,7 @@ def test_ticket47824_run(topology):
req_ctrl = SimplePagedResultsControl(True, size=page_size, cookie='')
known_ldap_resp_ctrls = {
- SimplePagedResultsControl.controlType:SimplePagedResultsControl,
+ SimplePagedResultsControl.controlType: SimplePagedResultsControl,
}
topology.standalone.log.info("Calling search_ext...")
@@ -259,18 +260,18 @@ def test_ticket47824_run(topology):
rtype, rdata, rmsgid, serverctrls = topology.standalone.result3(msgid, resp_ctrl_classes=known_ldap_resp_ctrls)
topology.standalone.log.info("%d results" % len(rdata))
pageddncnt += len(rdata)
-
+
topology.standalone.log.info("Results:")
for dn, attrs in rdata:
topology.standalone.log.info("dn: %s" % dn)
-
+
pctrls = [
c for c in serverctrls if c.controlType == SimplePagedResultsControl.controlType
]
if not pctrls:
topology.standalone.log.info('Warning: Server ignores RFC 2696 control.')
break
-
+
if pctrls[0].cookie:
req_ctrl.cookie = pctrls[0].cookie
topology.standalone.log.info("cookie: %s" % req_ctrl.cookie)
@@ -286,25 +287,27 @@ def test_ticket47824_run(topology):
topology.standalone.log.info("Paged result search returned %d entries.\n", pageddncnt)
assert dnnum == len(entries)
- topology.standalone.log.info("ticket47824 was successfully verified.");
+ topology.standalone.log.info("ticket47824 was successfully verified.")
+
def test_ticket47824_final(topology):
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
+
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
installation_prefix = None
-
+
topo = topology(True)
test_ticket47824_run(topo)
-
+
test_ticket47824_final(topo)
diff --git a/dirsrvtests/tickets/ticket47829_test.py b/dirsrvtests/tickets/ticket47829_test.py
index ab8be77..ffbab03 100644
--- a/dirsrvtests/tickets/ticket47829_test.py
+++ b/dirsrvtests/tickets/ticket47829_test.py
@@ -23,9 +23,6 @@ SCOPE_OUT_DN = 'cn=%s,%s' % (SCOPE_OUT_CN, SUFFIX)
PROVISIONING_CN = "provisioning"
PROVISIONING_DN = "cn=%s,%s" % (PROVISIONING_CN, SCOPE_IN_DN)
-
-
-
ACTIVE_CN = "accounts"
STAGE_CN = "staged users"
DELETE_CN = "deleted users"
@@ -54,8 +51,6 @@ OUT_GROUP_DN = "cn=%s,%s" % (OUT_GROUP_CN, SCOPE_OUT_DN)
INDIRECT_ACTIVE_GROUP_CN = "indirect active group"
INDIRECT_ACTIVE_GROUP_DN = "cn=%s,%s" % (INDIRECT_ACTIVE_GROUP_CN, ACTIVE_DN)
-
-
log = logging.getLogger(__name__)
installation_prefix = None
@@ -67,14 +62,13 @@ class TopologyStandalone(object):
self.standalone = standalone
-
@pytest.fixture(scope="module")
def topology(request):
'''
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -93,60 +87,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=False)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
-
+
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -155,20 +149,22 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
- #
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
# Time to return the topology
return TopologyStandalone(standalone)
+
def _header(topology, label):
topology.standalone.log.info("\n\n###############################################")
topology.standalone.log.info("#######")
topology.standalone.log.info("####### %s" % label)
topology.standalone.log.info("#######")
topology.standalone.log.info("###############################################")
-
+
+
def _add_user(topology, type='active'):
if type == 'active':
topology.standalone.add_s(Entry((ACTIVE_USER_DN, {
@@ -186,6 +182,7 @@ def _add_user(topology, type='active'):
'sn': OUT_USER_CN,
'cn': OUT_USER_CN})))
+
def _find_memberof(topology, user_dn=None, group_dn=None, find_result=True):
assert(topology)
assert(user_dn)
@@ -199,12 +196,13 @@ def _find_memberof(topology, user_dn=None, group_dn=None, find_result=True):
if val == group_dn:
found = True
break
-
+
if find_result:
- assert(found)
+ assert(found)
else:
assert(not found)
+
def _find_member(topology, user_dn=None, group_dn=None, find_result=True):
assert(topology)
assert(user_dn)
@@ -218,18 +216,18 @@ def _find_member(topology, user_dn=None, group_dn=None, find_result=True):
if val == user_dn:
found = True
break
-
+
if find_result:
- assert(found)
+ assert(found)
else:
assert(not found)
-
+
+
def _modrdn_entry(topology=None, entry_dn=None, new_rdn=None, del_old=0, new_superior=None):
- assert topology != None
- assert entry_dn != None
- assert new_rdn != None
-
-
+ assert topology is not None
+ assert entry_dn is not None
+ assert new_rdn is not None
+
topology.standalone.log.info("\n\n######################### MODRDN %s ######################\n" % new_rdn)
try:
if new_superior:
@@ -245,19 +243,20 @@ def _modrdn_entry(topology=None, entry_dn=None, new_rdn=None, del_old=0, new_sup
else:
base = ','.join(entry_dn.split(",")[1:])
dn = "%s, %s" % (new_rdn, base)
- filter = entry_dn.split(',')[0]
-
+ myfilter = entry_dn.split(',')[0]
+
while attempt < 10:
try:
- ent = topology.standalone.getEntry(dn, ldap.SCOPE_BASE, filter)
+ ent = topology.standalone.getEntry(dn, ldap.SCOPE_BASE, myfilter)
break
except ldap.NO_SUCH_OBJECT:
topology.standalone.log.info("Accept failure due to 47833: unable to find (base) a modrdn entry")
attempt += 1
time.sleep(1)
if attempt == 10:
- ent = topology.standalone.getEntry(base, ldap.SCOPE_SUBTREE, filter)
- ent = topology.standalone.getEntry(dn, ldap.SCOPE_BASE, filter)
+ ent = topology.standalone.getEntry(base, ldap.SCOPE_SUBTREE, myfilter)
+ ent = topology.standalone.getEntry(dn, ldap.SCOPE_BASE, myfilter)
+
def _check_memberof(topology=None, action=None, user_dn=None, group_dn=None, find_result=None):
assert(topology)
@@ -271,12 +270,10 @@ def _check_memberof(topology=None, action=None, user_dn=None, group_dn=None, fin
txt = 'replace'
topology.standalone.log.info('\n%s entry %s' % (txt, user_dn))
topology.standalone.log.info('to group %s' % group_dn)
-
+
topology.standalone.modify_s(group_dn, [(action, 'member', user_dn)])
time.sleep(1)
_find_memberof(topology, user_dn=user_dn, group_dn=group_dn, find_result=find_result)
-
-
def test_ticket47829_init(topology):
@@ -298,7 +295,7 @@ def test_ticket47829_init(topology):
topology.standalone.add_s(Entry((DELETE_DN, {
'objectclass': "top nscontainer".split(),
'cn': DELETE_CN})))
-
+
# add groups
topology.standalone.add_s(Entry((ACTIVE_GROUP_DN, {
'objectclass': "top groupOfNames inetuser".split(),
@@ -312,374 +309,372 @@ def test_ticket47829_init(topology):
topology.standalone.add_s(Entry((INDIRECT_ACTIVE_GROUP_DN, {
'objectclass': "top groupOfNames".split(),
'cn': INDIRECT_ACTIVE_GROUP_CN})))
-
+
# add users
_add_user(topology, 'active')
_add_user(topology, 'stage')
_add_user(topology, 'out')
-
-
# enable memberof of with scope IN except provisioning
topology.standalone.plugins.enable(name=PLUGIN_MEMBER_OF)
dn = "cn=%s,%s" % (PLUGIN_MEMBER_OF, DN_PLUGIN)
topology.standalone.modify_s(dn, [(ldap.MOD_REPLACE, 'memberOfEntryScope', SCOPE_IN_DN)])
topology.standalone.modify_s(dn, [(ldap.MOD_REPLACE, 'memberOfEntryScopeExcludeSubtree', PROVISIONING_DN)])
-
+
# enable RI with scope IN except provisioning
topology.standalone.plugins.enable(name=PLUGIN_REFER_INTEGRITY)
dn = "cn=%s,%s" % (PLUGIN_REFER_INTEGRITY, DN_PLUGIN)
topology.standalone.modify_s(dn, [(ldap.MOD_REPLACE, 'nsslapd-pluginentryscope', SCOPE_IN_DN)])
topology.standalone.modify_s(dn, [(ldap.MOD_REPLACE, 'nsslapd-plugincontainerscope', SCOPE_IN_DN)])
topology.standalone.modify_s(dn, [(ldap.MOD_REPLACE, 'nsslapd-pluginExcludeEntryScope', PROVISIONING_DN)])
-
-
+
topology.standalone.restart(timeout=10)
+
def test_ticket47829_mod_active_user_1(topology):
_header(topology, 'MOD: add an active user to an active group')
-
+
# add active user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member (topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# remove active user to active group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+
+
def test_ticket47829_mod_active_user_2(topology):
_header(topology, 'MOD: add an Active user to a Stage group')
-
+
# add active user to stage group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=ACTIVE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=ACTIVE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=True)
+
# remove active user to stage group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=ACTIVE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=False)
-
+
+
def test_ticket47829_mod_active_user_3(topology):
_header(topology, 'MOD: add an Active user to a out of scope group')
-
+
# add active user to out of scope group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=OUT_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=ACTIVE_USER_DN, group_dn=OUT_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=ACTIVE_USER_DN, group_dn=OUT_GROUP_DN, find_result=True)
+
# remove active user to out of scope group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=ACTIVE_USER_DN, group_dn=OUT_GROUP_DN, find_result=False)
-
+
def test_ticket47829_mod_stage_user_1(topology):
_header(topology, 'MOD: add an Stage user to a Active group')
-
+
# add stage user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# remove stage user to active group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+
+
def test_ticket47829_mod_stage_user_2(topology):
_header(topology, 'MOD: add an Stage user to a Stage group')
-
+
# add stage user to stage group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=STAGE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=True)
+
# remove stage user to stage group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=STAGE_USER_DN, group_dn=STAGE_GROUP_DN, find_result=False)
-
+
def test_ticket47829_mod_stage_user_3(topology):
_header(topology, 'MOD: add an Stage user to a out of scope group')
-
+
# add stage user to an out of scope group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=STAGE_USER_DN, group_dn=OUT_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=OUT_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=OUT_GROUP_DN, find_result=True)
+
# remove stage user to out of scope group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=STAGE_USER_DN, group_dn=OUT_GROUP_DN, find_result=False)
-
def test_ticket47829_mod_out_user_1(topology):
_header(topology, 'MOD: add an out of scope user to an active group')
-
+
# add out of scope user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=OUT_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=OUT_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=OUT_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# remove out of scope user to active group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=OUT_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+
def test_ticket47829_mod_out_user_2(topology):
_header(topology, 'MOD: add an out of scope user to a Stage group')
-
+
# add out of scope user to stage group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=OUT_USER_DN, group_dn=STAGE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=OUT_USER_DN, group_dn=STAGE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=OUT_USER_DN, group_dn=STAGE_GROUP_DN, find_result=True)
+
# remove out of scope user to stage group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=OUT_USER_DN, group_dn=STAGE_GROUP_DN, find_result=False)
-
+
def test_ticket47829_mod_out_user_3(topology):
_header(topology, 'MOD: add an out of scope user to an out of scope group')
-
+
# add out of scope user to stage group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=OUT_USER_DN, group_dn=OUT_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=OUT_USER_DN, group_dn=OUT_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=OUT_USER_DN, group_dn=OUT_GROUP_DN, find_result=True)
+
# remove out of scope user to stage group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=OUT_USER_DN, group_dn=OUT_GROUP_DN, find_result=False)
def test_ticket47829_mod_active_user_modrdn_active_user_1(topology):
_header(topology, 'add an Active user to a Active group. Then move Active user to Active')
-
+
# add Active user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member (topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Active entry to active, expect 'member' and 'memberof'
_modrdn_entry(topology, entry_dn=ACTIVE_USER_DN, new_rdn="cn=x%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
- _find_memberof(topology, user_dn="cn=x%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member(topology, user_dn="cn=x%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn="cn=x%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
+ _find_member(topology, user_dn="cn=x%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Active entry to active, expect 'member' and no 'memberof'
- _modrdn_entry(topology, entry_dn="cn=x%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _modrdn_entry(topology, entry_dn="cn=x%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# remove active user to active group
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
-
-
-
def test_ticket47829_mod_active_user_modrdn_stage_user_1(topology):
_header(topology, 'add an Active user to a Active group. Then move Active user to Stage')
-
+
# add Active user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member (topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Active entry to stage, expect no 'member' and 'memberof'
_modrdn_entry(topology, entry_dn=ACTIVE_USER_DN, new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=STAGE_DN)
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+
# move the Active entry to Stage, expect 'member' and no 'memberof'
- _modrdn_entry(topology, entry_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+ _modrdn_entry(topology, entry_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+
def test_ticket47829_mod_active_user_modrdn_out_user_1(topology):
_header(topology, 'add an Active user to a Active group. Then move Active user to out of scope')
-
+
# add Active user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member (topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Active entry to out of scope, expect no 'member' and no 'memberof'
_modrdn_entry(topology, entry_dn=ACTIVE_USER_DN, new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=OUT_GROUP_DN)
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, OUT_GROUP_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, OUT_GROUP_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, OUT_GROUP_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, OUT_GROUP_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+
# move the Active entry to out of scope, expect no 'member' and no 'memberof'
- _modrdn_entry(topology, entry_dn="cn=%s,%s" %(ACTIVE_USER_CN, OUT_GROUP_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _modrdn_entry(topology, entry_dn="cn=%s,%s" % (ACTIVE_USER_CN, OUT_GROUP_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+
-
def test_ticket47829_mod_modrdn_1(topology):
_header(topology, 'add an Stage user to a Active group. Then move Stage user to Active')
-
+
# add Stage user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Stage entry to active, expect 'member' and 'memberof'
_modrdn_entry(topology, entry_dn=STAGE_USER_DN, new_rdn="cn=%s" % STAGE_USER_CN, new_superior=ACTIVE_DN)
- _find_memberof(topology, user_dn="cn=%s,%s" %(STAGE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member(topology, user_dn="cn=%s,%s" %(STAGE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn="cn=%s,%s" % (STAGE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
+ _find_member(topology, user_dn="cn=%s,%s" % (STAGE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Active entry to Stage, expect no 'member' and no 'memberof'
- _modrdn_entry(topology, entry_dn="cn=%s,%s" %(STAGE_USER_CN, ACTIVE_DN), new_rdn="cn=%s" % STAGE_USER_CN, new_superior=STAGE_DN)
- _find_memberof(topology, user_dn="cn=%s,%s" %(STAGE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(STAGE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
-
-
-
-
+ _modrdn_entry(topology, entry_dn="cn=%s,%s" % (STAGE_USER_CN, ACTIVE_DN), new_rdn="cn=%s" % STAGE_USER_CN, new_superior=STAGE_DN)
+ _find_memberof(topology, user_dn="cn=%s,%s" % (STAGE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (STAGE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+
+
def test_ticket47829_mod_stage_user_modrdn_active_user_1(topology):
_header(topology, 'add an Stage user to a Active group. Then move Stage user to Active')
-
+
stage_user_dn = STAGE_USER_DN
stage_user_rdn = "cn=%s" % STAGE_USER_CN
active_user_dn = "cn=%s,%s" % (STAGE_USER_CN, ACTIVE_DN)
-
+
# add Stage user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Stage entry to Actve, expect 'member' and 'memberof'
- _modrdn_entry (topology, entry_dn=stage_user_dn, new_rdn=stage_user_rdn, new_superior=ACTIVE_DN)
+ _modrdn_entry(topology, entry_dn=stage_user_dn, new_rdn=stage_user_rdn, new_superior=ACTIVE_DN)
_find_memberof(topology, user_dn=active_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member (topology, user_dn=active_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=active_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Active entry to Stage, expect no 'member' and no 'memberof'
- _modrdn_entry (topology, entry_dn=active_user_dn, new_rdn=stage_user_rdn, new_superior=STAGE_DN)
- _find_memberof(topology, user_dn=stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=stage_user_dn , group_dn=ACTIVE_GROUP_DN, find_result=False)
-
-
+ _modrdn_entry(topology, entry_dn=active_user_dn, new_rdn=stage_user_rdn, new_superior=STAGE_DN)
+ _find_memberof(topology, user_dn=stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn=stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
+
+
def test_ticket47829_mod_stage_user_modrdn_stage_user_1(topology):
_header(topology, 'add an Stage user to a Active group. Then move Stage user to Stage')
-
+
_header(topology, 'Return because it requires a fix for 47833')
return
-
- old_stage_user_dn = STAGE_USER_DN
+
+ old_stage_user_dn = STAGE_USER_DN
old_stage_user_rdn = "cn=%s" % STAGE_USER_CN
new_stage_user_rdn = "cn=x%s" % STAGE_USER_CN
new_stage_user_dn = "%s,%s" % (new_stage_user_rdn, STAGE_DN)
-
+
# add Stage user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=old_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=old_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_member(topology, user_dn=old_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move the Stage entry to Stage, expect no 'member' and 'memberof'
- _modrdn_entry (topology, entry_dn=old_stage_user_dn, new_rdn=new_stage_user_rdn, new_superior=STAGE_DN)
+ _modrdn_entry(topology, entry_dn=old_stage_user_dn, new_rdn=new_stage_user_rdn, new_superior=STAGE_DN)
_find_memberof(topology, user_dn=new_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=new_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+ _find_member(topology, user_dn=new_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
+
# move the Stage entry to Stage, expect no 'member' and no 'memberof'
- _modrdn_entry (topology, entry_dn=new_stage_user_dn, new_rdn=old_stage_user_rdn, new_superior=STAGE_DN)
- _find_memberof(topology, user_dn=old_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=old_stage_user_dn , group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+ _modrdn_entry(topology, entry_dn=new_stage_user_dn, new_rdn=old_stage_user_rdn, new_superior=STAGE_DN)
+ _find_memberof(topology, user_dn=old_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn=old_stage_user_dn, group_dn=ACTIVE_GROUP_DN, find_result=False)
+
+
def test_ticket47829_indirect_active_group_1(topology):
_header(topology, 'add an Active group (G1) to an active group (G0). Then add active user to G1')
-
+
topology.standalone.modify_s(INDIRECT_ACTIVE_GROUP_DN, [(ldap.MOD_ADD, 'member', ACTIVE_GROUP_DN)])
-
+
# add an active user to G1. Checks that user is memberof G1
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=True)
+
# remove G1 from G0
topology.standalone.modify_s(INDIRECT_ACTIVE_GROUP_DN, [(ldap.MOD_DELETE, 'member', ACTIVE_GROUP_DN)])
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# remove active user from G1
_check_memberof(topology, action=ldap.MOD_DELETE, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+
+
def test_ticket47829_indirect_active_group_2(topology):
_header(topology, 'add an Active group (G1) to an active group (G0). Then add active user to G1. Then move active user to stage')
-
+
topology.standalone.modify_s(INDIRECT_ACTIVE_GROUP_DN, [(ldap.MOD_ADD, 'member', ACTIVE_GROUP_DN)])
-
+
# add an active user to G1. Checks that user is memberof G1
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=True)
+
# remove G1 from G0
topology.standalone.modify_s(INDIRECT_ACTIVE_GROUP_DN, [(ldap.MOD_DELETE, 'member', ACTIVE_GROUP_DN)])
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move active user to stage
_modrdn_entry(topology, entry_dn=ACTIVE_USER_DN, new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=STAGE_DN)
-
+
# stage user is no long member of active group and indirect active group
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
-
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+
# active group and indirect active group do no longer have stage user as member
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
-
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+
# return back the entry to active. It remains not member
- _modrdn_entry(topology, entry_dn="cn=%s,%s" %(ACTIVE_USER_CN, STAGE_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
-
+ _modrdn_entry(topology, entry_dn="cn=%s,%s" % (ACTIVE_USER_CN, STAGE_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+
+
def test_ticket47829_indirect_active_group_3(topology):
_header(topology, 'add an Active group (G1) to an active group (G0). Then add active user to G1. Then move active user to out of the scope')
-
+
topology.standalone.modify_s(INDIRECT_ACTIVE_GROUP_DN, [(ldap.MOD_ADD, 'member', ACTIVE_GROUP_DN)])
-
+
# add an active user to G1. Checks that user is memberof G1
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=True)
+
# remove G1 from G0
topology.standalone.modify_s(INDIRECT_ACTIVE_GROUP_DN, [(ldap.MOD_DELETE, 'member', ACTIVE_GROUP_DN)])
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
- _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+ _find_memberof(topology, user_dn=ACTIVE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+
# move active user to out of the scope
_modrdn_entry(topology, entry_dn=ACTIVE_USER_DN, new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=SCOPE_OUT_DN)
-
+
# stage user is no long member of active group and indirect active group
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_memberof(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
-
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_memberof(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+
# active group and indirect active group do no longer have stage user as member
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
-
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, SCOPE_OUT_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+
# return back the entry to active. It remains not member
- _modrdn_entry(topology, entry_dn="cn=%s,%s" %(ACTIVE_USER_CN, SCOPE_OUT_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member(topology, user_dn="cn=%s,%s" %(ACTIVE_USER_CN, ACTIVE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+ _modrdn_entry(topology, entry_dn="cn=%s,%s" % (ACTIVE_USER_CN, SCOPE_OUT_DN), new_rdn="cn=%s" % ACTIVE_USER_CN, new_superior=ACTIVE_DN)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn="cn=%s,%s" % (ACTIVE_USER_CN, ACTIVE_DN), group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+
def test_ticket47829_indirect_active_group_4(topology):
_header(topology, 'add an Active group (G1) to an active group (G0). Then add stage user to G1. Then move user to active. Then move it back')
-
+
topology.standalone.modify_s(INDIRECT_ACTIVE_GROUP_DN, [(ldap.MOD_ADD, 'member', ACTIVE_GROUP_DN)])
-
+
# add stage user to active group
_check_memberof(topology, action=ldap.MOD_ADD, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=True)
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
_find_memberof(topology, user_dn=STAGE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
_find_memberof(topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+
# move stage user to active
_modrdn_entry(topology, entry_dn=STAGE_USER_DN, new_rdn="cn=%s" % STAGE_USER_CN, new_superior=ACTIVE_DN)
- renamed_stage_dn = "cn=%s,%s" %(STAGE_USER_CN, ACTIVE_DN)
- _find_member (topology, user_dn=renamed_stage_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
- _find_member (topology, user_dn=renamed_stage_dn, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+ renamed_stage_dn = "cn=%s,%s" % (STAGE_USER_CN, ACTIVE_DN)
+ _find_member(topology, user_dn=renamed_stage_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
+ _find_member(topology, user_dn=renamed_stage_dn, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
_find_memberof(topology, user_dn=renamed_stage_dn, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=True)
_find_memberof(topology, user_dn=renamed_stage_dn, group_dn=ACTIVE_GROUP_DN, find_result=True)
-
+
# move back active to stage
- _modrdn_entry(topology, entry_dn=renamed_stage_dn, new_rdn="cn=%s" % STAGE_USER_CN, new_superior=STAGE_DN)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
- _find_member (topology, user_dn=STAGE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
+ _modrdn_entry(topology, entry_dn=renamed_stage_dn, new_rdn="cn=%s" % STAGE_USER_CN, new_superior=STAGE_DN)
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
+ _find_member(topology, user_dn=STAGE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
_find_memberof(topology, user_dn=STAGE_USER_DN, group_dn=INDIRECT_ACTIVE_GROUP_DN, find_result=False)
_find_memberof(topology, user_dn=STAGE_USER_DN, group_dn=ACTIVE_GROUP_DN, find_result=False)
-
+
+
def test_ticket47829_final(topology):
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47829_init(topo)
@@ -692,21 +687,22 @@ def run_isolated():
test_ticket47829_mod_out_user_1(topo)
test_ticket47829_mod_out_user_2(topo)
test_ticket47829_mod_out_user_3(topo)
-
+
test_ticket47829_mod_active_user_modrdn_active_user_1(topo)
test_ticket47829_mod_active_user_modrdn_stage_user_1(topo)
test_ticket47829_mod_active_user_modrdn_out_user_1(topo)
-
+
test_ticket47829_mod_stage_user_modrdn_active_user_1(topo)
test_ticket47829_mod_stage_user_modrdn_stage_user_1(topo)
-
+
test_ticket47829_indirect_active_group_1(topo)
test_ticket47829_indirect_active_group_2(topo)
test_ticket47829_indirect_active_group_3(topo)
test_ticket47829_indirect_active_group_4(topo)
-
+
test_ticket47829_final(topo)
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47838_test.py b/dirsrvtests/tickets/ticket47838_test.py
index 50a4b50..4a59e14 100644
--- a/dirsrvtests/tickets/ticket47838_test.py
+++ b/dirsrvtests/tickets/ticket47838_test.py
@@ -28,11 +28,13 @@ plus_all_dcount = 0
plus_all_ecount_noweak = 0
plus_all_dcount_noweak = 0
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
self.standalone = standalone
+
@pytest.fixture(scope="module")
def topology(request):
'''
@@ -130,6 +132,7 @@ def topology(request):
# Time to return the topology
return TopologyStandalone(standalone)
+
def _header(topology, label):
topology.standalone.log.info("\n\n###############################################")
topology.standalone.log.info("#######")
@@ -137,6 +140,7 @@ def _header(topology, label):
topology.standalone.log.info("#######")
topology.standalone.log.info("###############################################")
+
def test_ticket47838_init(topology):
"""
Generate self signed cert and import it to the DS cert db.
@@ -217,6 +221,7 @@ def test_ticket47838_init(topology):
'nsSSLToken': 'internal (software)',
'nsSSLActivation': 'on'})))
+
def comp_nsSSLEnableCipherCount(topology, ecount):
"""
Check nsSSLEnabledCipher count with ecount
@@ -230,11 +235,12 @@ def comp_nsSSLEnableCipherCount(topology, ecount):
topology.standalone.log.info("Results:")
for dn, attrs in rdata:
topology.standalone.log.info("dn: %s" % dn)
- if attrs.has_key('nsSSLEnabledCiphers'):
+ if 'nsSSLEnabledCiphers' in attrs:
enabledciphercnt = len(attrs['nsSSLEnabledCiphers'])
topology.standalone.log.info("enabledCipherCount: %d" % enabledciphercnt)
assert ecount == enabledciphercnt
+
def test_ticket47838_run_0(topology):
"""
Check nsSSL3Ciphers: +all
@@ -269,6 +275,7 @@ def test_ticket47838_run_0(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_1(topology):
"""
Check nsSSL3Ciphers: +all
@@ -310,6 +317,7 @@ def test_ticket47838_run_1(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_2(topology):
"""
Check nsSSL3Ciphers: +rsa_aes_128_sha,+rsa_aes_256_sha
@@ -341,6 +349,7 @@ def test_ticket47838_run_2(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_3(topology):
"""
Check nsSSL3Ciphers: -all
@@ -371,6 +380,7 @@ def test_ticket47838_run_3(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_4(topology):
"""
Check no nsSSL3Ciphers
@@ -406,6 +416,7 @@ def test_ticket47838_run_4(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_5(topology):
"""
Check nsSSL3Ciphers: default
@@ -441,6 +452,7 @@ def test_ticket47838_run_5(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_6(topology):
"""
Check nssSSL3Chiphers: +all,-rsa_rc4_128_md5
@@ -474,6 +486,7 @@ def test_ticket47838_run_6(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_7(topology):
"""
Check nssSSL3Chiphers: -all,+rsa_rc4_128_md5
@@ -505,6 +518,7 @@ def test_ticket47838_run_7(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_8(topology):
"""
Check nsSSL3Ciphers: default + allowWeakCipher: off
@@ -540,6 +554,7 @@ def test_ticket47838_run_8(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_9(topology):
"""
Check no nsSSL3Ciphers
@@ -576,6 +591,7 @@ def test_ticket47838_run_9(topology):
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_10(topology):
"""
Check nssSSL3Chiphers: -TLS_RSA_WITH_NULL_MD5,+TLS_RSA_WITH_RC4_128_MD5,
@@ -592,7 +608,7 @@ def test_ticket47838_run_10(topology):
_header(topology, 'Test Case 11 - Check nssSSL3Chiphers: long list using the NSS Cipher Suite name with allowWeakCipher on')
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
- topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3Ciphers',
+ topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3Ciphers',
'-TLS_RSA_WITH_NULL_MD5,+TLS_RSA_WITH_RC4_128_MD5,+TLS_RSA_EXPORT_WITH_RC4_40_MD5,+TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,+TLS_DHE_RSA_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_DES_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,+TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,-SSL_CK_RC4_128_WITH_MD5,-SSL_CK_RC4_128_EXPORT40_WITH_MD5,-SSL_CK_RC2_128_CBC_WITH_MD5,-SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL_CK_DES_64_CBC_WITH_MD5,-SSL_CK_DES_192_EDE3_CBC_WITH_MD5')])
log.info("\n######################### Restarting the server ######################\n")
@@ -616,10 +632,11 @@ def test_ticket47838_run_10(topology):
wcount = int(weak.readline().rstrip())
log.info("Weak ciphers in the default setting: %d" % wcount)
- topology.standalone.log.info("ticket47838 was successfully verified.");
+ topology.standalone.log.info("ticket47838 was successfully verified.")
comp_nsSSLEnableCipherCount(topology, ecount)
+
def test_ticket47838_run_11(topology):
"""
Check nssSSL3Chiphers: +fortezza
@@ -646,6 +663,7 @@ def test_ticket47838_run_11(topology):
comp_nsSSLEnableCipherCount(topology, 0)
+
def test_ticket47928_run_0(topology):
"""
No SSL version config parameters.
@@ -679,6 +697,7 @@ def test_ticket47928_run_0(topology):
log.info("Expected message was not found")
assert False
+
def test_ticket47928_run_1(topology):
"""
No nsSSL3, nsTLS1; sslVersionMin > sslVersionMax
@@ -712,6 +731,7 @@ def test_ticket47928_run_1(topology):
log.info("Expected message was not found")
assert False
+
def test_ticket47928_run_2(topology):
"""
nsSSL3: on; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
@@ -754,6 +774,7 @@ def test_ticket47928_run_2(topology):
log.info("Expected message was not found")
assert False
+
def test_ticket47928_run_3(topology):
"""
nsSSL3: on; nsTLS1: off; sslVersionMin: TLS1.1; sslVersionMax: TLS1.2
@@ -797,6 +818,7 @@ def test_ticket47928_run_3(topology):
log.info("Expected message was not found")
assert False
+
def test_ticket47838_run_last(topology):
"""
Check nssSSL3Chiphers: all <== invalid value
@@ -824,14 +846,12 @@ def test_ticket47838_run_last(topology):
comp_nsSSLEnableCipherCount(topology, 0)
- topology.standalone.log.info("ticket47838, 47880, 47908, 47928 were successfully verified.");
+ topology.standalone.log.info("ticket47838, 47880, 47908, 47928 were successfully verified.")
+
def test_ticket47838_final(topology):
- topology.standalone.simple_bind_s(DN_DM, PASSWORD)
- topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', None)])
- topology.standalone.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3Ciphers', 'default'),
- (ldap.MOD_REPLACE, 'allowWeakCipher', 'on')])
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
+
def run_isolated():
'''
@@ -846,7 +866,7 @@ def run_isolated():
topo = topology(True)
test_ticket47838_init(topo)
-
+
test_ticket47838_run_0(topo)
test_ticket47838_run_1(topo)
test_ticket47838_run_2(topo)
@@ -865,8 +885,9 @@ def run_isolated():
test_ticket47928_run_3(topo)
test_ticket47838_run_last(topo)
-
+
test_ticket47838_final(topo)
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47869MMR_test.py b/dirsrvtests/tickets/ticket47869MMR_test.py
index 47ac5b2..3e21aed 100644
--- a/dirsrvtests/tickets/ticket47869MMR_test.py
+++ b/dirsrvtests/tickets/ticket47869MMR_test.py
@@ -32,14 +32,16 @@ BIND_NAME = 'bind_entry'
BIND_DN = 'cn=%s, %s' % (BIND_NAME, SUFFIX)
BIND_PW = 'password'
+
class TopologyMaster1Master2(object):
def __init__(self, master1, master2):
master1.open()
self.master1 = master1
-
+
master2.open()
self.master2 = master2
+
@pytest.fixture(scope="module")
def topology(request):
'''
@@ -47,7 +49,7 @@ def topology(request):
The replicated topology is MASTER1 <-> Master2.
At the beginning, It may exists a master2 instance and/or a master2 instance.
It may also exists a backup for the master1 and/or the master2.
-
+
Principle:
If master1 instance exists:
restart it
@@ -74,19 +76,19 @@ def topology(request):
master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
+
# Args for the master1 instance
args_instance[SER_HOST] = HOST_MASTER_1
args_instance[SER_PORT] = PORT_MASTER_1
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
args_master = args_instance.copy()
master1.allocate(args_master)
-
+
# allocate master1 on a given deployement
master2 = DirSrv(verbose=False)
if installation2_prefix:
args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_MASTER_2
args_instance[SER_PORT] = PORT_MASTER_2
@@ -94,40 +96,39 @@ def topology(request):
args_master = args_instance.copy()
master2.allocate(args_master)
-
# Get the status of the backups
backup_master1 = master1.checkBackupFS()
backup_master2 = master2.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
instance_master1 = master1.exists()
if instance_master1:
master1.stop(timeout=10)
master1.start(timeout=10)
-
+
instance_master2 = master2.exists()
if instance_master2:
master2.stop(timeout=10)
master2.start(timeout=10)
-
+
if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master1:
master1.create()
# Used to retrieve configuration information (dbdir, confdir...)
master1.open()
-
+
if not instance_master2:
master2.create()
# Used to retrieve configuration information (dbdir, confdir...)
master2.open()
-
+
# restore master1 from backup
master1.stop(timeout=10)
master1.restoreFS(backup_master1)
master1.start(timeout=10)
-
+
# restore master2 from backup
master2.stop(timeout=10)
master2.restoreFS(backup_master2)
@@ -138,48 +139,48 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master1:
master1.clearBackupFS()
if backup_master2:
master2.clearBackupFS()
-
+
# Remove all the instances
if instance_master1:
master1.delete()
if instance_master2:
master2.delete()
-
+
# Create the instances
master1.create()
master1.open()
master2.create()
master2.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
@@ -189,12 +190,13 @@ def topology(request):
master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
master1.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master1.add_s(Entry((TEST_REPL_DN, {'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -202,12 +204,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master1.stop(timeout=10)
master1.backupfile = master1.backupFS()
master1.start(timeout=10)
-
+
master2.stop(timeout=10)
master2.backupfile = master2.backupFS()
master2.start(timeout=10)
@@ -215,24 +219,25 @@ def topology(request):
# clear the tmp directory
master1.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
# Time to return the topology
return TopologyMaster1Master2(master1, master2)
+
def test_ticket47869_init(topology):
"""
It adds an entry ('bind_entry') and 10 test entries
It sets the anonymous aci
-
+
"""
# enable acl error logging
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(8192))] # REPL
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(8192))] # REPL
topology.master1.modify_s(DN_CONFIG, mod)
topology.master2.modify_s(DN_CONFIG, mod)
-
+
# entry used to bind with
topology.master1.log.info("Add %s" % BIND_DN)
topology.master1.add_s(Entry((BIND_DN, {
@@ -241,6 +246,7 @@ def test_ticket47869_init(topology):
'cn': BIND_NAME,
'userpassword': BIND_PW})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = topology.master2.getEntry(BIND_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -248,13 +254,15 @@ def test_ticket47869_init(topology):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# keep anonymous ACI for use 'read-search' aci in SEARCH test
ACI_ANONYMOUS = "(targetattr!=\"userPassword\")(version 3.0; acl \"Enable anonymous access\"; allow (read, search, compare) userdn=\"ldap:///anyone\";)"
mod = [(ldap.MOD_REPLACE, 'aci', ACI_ANONYMOUS)]
topology.master1.modify_s(SUFFIX, mod)
topology.master2.modify_s(SUFFIX, mod)
-
+
# add entries
for cpt in range(MAX_ENTRIES):
name = "%s%d" % (ENTRY_NAME, cpt)
@@ -264,6 +272,7 @@ def test_ticket47869_init(topology):
'sn': name,
'cn': name})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = topology.master2.getEntry(mydn, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -271,6 +280,9 @@ def test_ticket47869_init(topology):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
+ if ent is None:
+ assert False
+
def test_ticket47869_check(topology):
'''
@@ -288,7 +300,7 @@ def test_ticket47869_check(topology):
Check nscpEntryWsi is not returned.
'''
topology.master1.log.info("\n\n######################### CHECK nscpentrywsi ######################\n")
-
+
topology.master1.log.info("##### Master1: Bind as %s #####" % DN_DM)
topology.master1.simple_bind_s(DN_DM, PASSWORD)
@@ -297,12 +309,13 @@ def test_ticket47869_check(topology):
nscpentrywsicnt = 0
rtype, rdata, rmsgid = topology.master1.result2(msgid)
topology.master1.log.info("%d results" % len(rdata))
-
+
topology.master1.log.info("Results:")
for dn, attrs in rdata:
topology.master1.log.info("dn: %s" % dn)
- if attrs.has_key('nscpentrywsi'):
+ if 'nscpentrywsi' in attrs:
nscpentrywsicnt += 1
+
topology.master1.log.info("Master1: count of nscpentrywsi: %d" % nscpentrywsicnt)
topology.master2.log.info("##### Master2: Bind as %s #####" % DN_DM)
@@ -313,26 +326,27 @@ def test_ticket47869_check(topology):
nscpentrywsicnt = 0
rtype, rdata, rmsgid = topology.master2.result2(msgid)
topology.master2.log.info("%d results" % len(rdata))
-
+
topology.master2.log.info("Results:")
for dn, attrs in rdata:
topology.master2.log.info("dn: %s" % dn)
- if attrs.has_key('nscpentrywsi'):
+ if 'nscpentrywsi' in attrs:
nscpentrywsicnt += 1
+
topology.master2.log.info("Master2: count of nscpentrywsi: %d" % nscpentrywsicnt)
# bind as bind_entry
topology.master1.log.info("##### Master1: Bind as %s #####" % BIND_DN)
topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
+
topology.master1.log.info("Master1: Calling search_ext...")
msgid = topology.master1.search_ext(SUFFIX, ldap.SCOPE_SUBTREE, 'objectclass=*', ['nscpentrywsi'])
nscpentrywsicnt = 0
rtype, rdata, rmsgid = topology.master1.result2(msgid)
topology.master1.log.info("%d results" % len(rdata))
-
+
for dn, attrs in rdata:
- if attrs.has_key('nscpentrywsi'):
+ if 'nscpentrywsi' in attrs:
nscpentrywsicnt += 1
assert nscpentrywsicnt == 0
topology.master1.log.info("Master1: count of nscpentrywsi: %d" % nscpentrywsicnt)
@@ -346,9 +360,9 @@ def test_ticket47869_check(topology):
nscpentrywsicnt = 0
rtype, rdata, rmsgid = topology.master2.result2(msgid)
topology.master2.log.info("%d results" % len(rdata))
-
+
for dn, attrs in rdata:
- if attrs.has_key('nscpentrywsi'):
+ if 'nscpentrywsi' in attrs:
nscpentrywsicnt += 1
assert nscpentrywsicnt == 0
topology.master2.log.info("Master2: count of nscpentrywsi: %d" % nscpentrywsicnt)
@@ -356,15 +370,15 @@ def test_ticket47869_check(topology):
# bind as anonymous
topology.master1.log.info("##### Master1: Bind as anonymous #####")
topology.master1.simple_bind_s("", "")
-
+
topology.master1.log.info("Master1: Calling search_ext...")
msgid = topology.master1.search_ext(SUFFIX, ldap.SCOPE_SUBTREE, 'objectclass=*', ['nscpentrywsi'])
nscpentrywsicnt = 0
rtype, rdata, rmsgid = topology.master1.result2(msgid)
topology.master1.log.info("%d results" % len(rdata))
-
+
for dn, attrs in rdata:
- if attrs.has_key('nscpentrywsi'):
+ if 'nscpentrywsi' in attrs:
nscpentrywsicnt += 1
assert nscpentrywsicnt == 0
topology.master1.log.info("Master1: count of nscpentrywsi: %d" % nscpentrywsicnt)
@@ -378,23 +392,25 @@ def test_ticket47869_check(topology):
nscpentrywsicnt = 0
rtype, rdata, rmsgid = topology.master2.result2(msgid)
topology.master2.log.info("%d results" % len(rdata))
-
+
for dn, attrs in rdata:
- if attrs.has_key('nscpentrywsi'):
+ if 'nscpentrywsi' in attrs:
nscpentrywsicnt += 1
assert nscpentrywsicnt == 0
topology.master2.log.info("Master2: count of nscpentrywsi: %d" % nscpentrywsicnt)
- topology.master1.log.info("##### ticket47869 was successfully verified. #####");
+ topology.master1.log.info("##### ticket47869 was successfully verified. #####")
+
def test_ticket47869_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
+ topology.master1.delete()
+ topology.master2.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
@@ -403,14 +419,15 @@ def run_isolated():
global installation2_prefix
installation1_prefix = None
installation2_prefix = None
-
+
topo = topology(True)
test_ticket47869_init(topo)
-
+
test_ticket47869_check(topo)
-
+
test_ticket47869_final(topo)
+
if __name__ == '__main__':
run_isolated()
diff --git a/dirsrvtests/tickets/ticket47871_test.py b/dirsrvtests/tickets/ticket47871_test.py
index 1d1351b..5ddf315 100644
--- a/dirsrvtests/tickets/ticket47871_test.py
+++ b/dirsrvtests/tickets/ticket47871_test.py
@@ -30,13 +30,14 @@ ENTRY_DN = "cn=test_entry, %s" % SUFFIX
OTHER_NAME = 'other_entry'
MAX_OTHERS = 10
-ATTRIBUTES = [ 'street', 'countryName', 'description', 'postalAddress', 'postalCode', 'title', 'l', 'roomNumber' ]
+ATTRIBUTES = ['street', 'countryName', 'description', 'postalAddress', 'postalCode', 'title', 'l', 'roomNumber']
+
class TopologyMasterConsumer(object):
def __init__(self, master, consumer):
master.open()
self.master = master
-
+
consumer.open()
self.consumer = consumer
@@ -51,7 +52,7 @@ def topology(request):
The replicated topology is MASTER -> Consumer.
At the beginning, It may exists a master instance and/or a consumer instance.
It may also exists a backup for the master and/or the consumer.
-
+
Principle:
If master instance exists:
restart it
@@ -75,17 +76,17 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
master = DirSrv(verbose=False)
consumer = DirSrv(verbose=False)
-
+
# Args for the master instance
args_instance[SER_HOST] = HOST_MASTER
args_instance[SER_PORT] = PORT_MASTER
args_instance[SER_SERVERID_PROP] = SERVERID_MASTER
args_master = args_instance.copy()
master.allocate(args_master)
-
+
# Args for the consumer instance
args_instance[SER_HOST] = HOST_CONSUMER
args_instance[SER_PORT] = PORT_CONSUMER
@@ -93,40 +94,40 @@ def topology(request):
args_consumer = args_instance.copy()
consumer.allocate(args_consumer)
-
+
# Get the status of the backups
backup_master = master.checkBackupFS()
backup_consumer = consumer.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_master = master.exists()
+ instance_master = master.exists()
if instance_master:
master.stop(timeout=10)
master.start(timeout=10)
-
+
instance_consumer = consumer.exists()
if instance_consumer:
consumer.stop(timeout=10)
consumer.start(timeout=10)
-
+
if backup_master and backup_consumer:
- # The backups exist, assuming they are correct
+ # The backups exist, assuming they are correct
# we just re-init the instances with them
if not instance_master:
master.create()
# Used to retrieve configuration information (dbdir, confdir...)
master.open()
-
+
if not instance_consumer:
consumer.create()
# Used to retrieve configuration information (dbdir, confdir...)
consumer.open()
-
+
# restore master from backup
master.stop(timeout=10)
master.restoreFS(backup_master)
master.start(timeout=10)
-
+
# restore consumer from backup
consumer.stop(timeout=10)
consumer.restoreFS(backup_consumer)
@@ -137,56 +138,57 @@ def topology(request):
# so we need to create everything
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove all the backups. So even if we have a specific backup file
# (e.g backup_master) we clear all backups that an instance my have created
if backup_master:
master.clearBackupFS()
if backup_consumer:
consumer.clearBackupFS()
-
+
# Remove all the instances
if instance_master:
master.delete()
if instance_consumer:
consumer.delete()
-
+
# Create the instances
master.create()
master.open()
consumer.create()
consumer.open()
-
- #
+
+ #
# Now prepare the Master-Consumer topology
#
# First Enable replication
master.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER)
consumer.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_CONSUMER)
-
+
# Initialize the supplier->consumer
-
+
properties = {RA_NAME: r'meTo_$host:$port',
RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
repl_agreement = master.agreement.create(suffix=SUFFIX, host=consumer.host, port=consumer.port, properties=properties)
-
+
if not repl_agreement:
log.fatal("Fail to create a replica agreement")
sys.exit(1)
-
+
log.debug("%s created" % repl_agreement)
master.agreement.init(SUFFIX, HOST_CONSUMER, PORT_CONSUMER)
master.waitForReplInit(repl_agreement)
-
+
# Check replication is working fine
master.add_s(Entry((TEST_REPL_DN, {
'objectclass': "top person".split(),
'sn': 'test_repl',
'cn': 'test_repl'})))
loop = 0
+ ent = None
while loop <= 10:
try:
ent = consumer.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
@@ -194,12 +196,14 @@ def topology(request):
except ldap.NO_SUCH_OBJECT:
time.sleep(1)
loop += 1
-
+ if ent is None:
+ assert False
+
# Time to create the backups
master.stop(timeout=10)
master.backupfile = master.backupFS()
master.start(timeout=10)
-
+
consumer.stop(timeout=10)
consumer.backupfile = consumer.backupFS()
consumer.start(timeout=10)
@@ -207,7 +211,7 @@ def topology(request):
# clear the tmp directory
master.clearTmpDir(__file__)
- #
+ #
# Here we have two instances master and consumer
# with replication working. Either coming from a backup recovery
# or from a fresh (re)init
@@ -216,24 +220,24 @@ def topology(request):
def test_ticket47871_init(topology):
- """
+ """
Initialize the test environment
"""
topology.master.plugins.enable(name=PLUGIN_RETRO_CHANGELOG)
- mod = [(ldap.MOD_REPLACE, 'nsslapd-changelogmaxage', "10s"), # 10 second triming
- (ldap.MOD_REPLACE, 'nsslapd-changelog-trim-interval', "5s")]
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-changelogmaxage', "10s"), # 10 second triming
+ (ldap.MOD_REPLACE, 'nsslapd-changelog-trim-interval', "5s")]
topology.master.modify_s("cn=%s,%s" % (PLUGIN_RETRO_CHANGELOG, DN_PLUGIN), mod)
#topology.master.plugins.enable(name=PLUGIN_MEMBER_OF)
#topology.master.plugins.enable(name=PLUGIN_REFER_INTEGRITY)
topology.master.stop(timeout=10)
topology.master.start(timeout=10)
-
+
topology.master.log.info("test_ticket47871_init topology %r" % (topology))
- # the test case will check if a warning message is logged in the
+ # the test case will check if a warning message is logged in the
# error log of the supplier
topology.master.errorlog_file = open(topology.master.errlog, "r")
-
-
+
+
def test_ticket47871_1(topology):
'''
ADD entries and check they are all in the retrocl
@@ -245,9 +249,9 @@ def test_ticket47871_1(topology):
'objectclass': "top person".split(),
'sn': name,
'cn': name})))
-
- topology.master.log.info("test_ticket47871_init: %d entries ADDed %s[0..%d]" % (MAX_OTHERS, OTHER_NAME, MAX_OTHERS-1))
-
+
+ topology.master.log.info("test_ticket47871_init: %d entries ADDed %s[0..%d]" % (MAX_OTHERS, OTHER_NAME, MAX_OTHERS - 1))
+
# Check the number of entries in the retro changelog
time.sleep(1)
ents = topology.master.search_s(RETROCL_SUFFIX, ldap.SCOPE_ONELEVEL, "(objectclass=*)")
@@ -256,6 +260,7 @@ def test_ticket47871_1(topology):
for ent in ents:
topology.master.log.info("%s" % ent.dn)
+
def test_ticket47871_2(topology):
'''
Wait until there is just a last entries
@@ -263,7 +268,7 @@ def test_ticket47871_2(topology):
MAX_TRIES = 10
TRY_NO = 1
while TRY_NO <= MAX_TRIES:
- time.sleep(6) # at least 1 trimming occurred
+ time.sleep(6) # at least 1 trimming occurred
ents = topology.master.search_s(RETROCL_SUFFIX, ldap.SCOPE_ONELEVEL, "(objectclass=*)")
assert len(ents) <= MAX_OTHERS
topology.master.log.info("\nTry no %d it remains %d entries" % (TRY_NO, len(ents)))
@@ -275,24 +280,24 @@ def test_ticket47871_2(topology):
break
assert TRY_NO <= MAX_TRIES
assert len(ents) <= 1
-
-
+
def test_ticket47871_final(topology):
- topology.master.stop(timeout=10)
- topology.consumer.stop(timeout=10)
+ topology.master.delete()
+ topology.consumer.delete()
+
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47871_init(topo)
test_ticket47871_1(topo)
@@ -303,4 +308,3 @@ def run_isolated():
if __name__ == '__main__':
run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47900_test.py b/dirsrvtests/tickets/ticket47900_test.py
index 4e6f5d7..2200eba 100644
--- a/dirsrvtests/tickets/ticket47900_test.py
+++ b/dirsrvtests/tickets/ticket47900_test.py
@@ -23,6 +23,7 @@ ENTRY_NAME = 'Joe Schmo'
ENTRY_DN = 'cn=%s,%s' % (ENTRY_NAME, SUFFIX)
INVALID_PWDS = ('2_Short', 'No_Number', 'N0Special', '{SSHA}bBy8UdtPZwu8uZna9QOYG3Pr41RpIRVDl8wddw==')
+
class TopologyStandalone(object):
def __init__(self, standalone):
standalone.open()
@@ -131,10 +132,10 @@ def test_ticket47900(topology):
We need to test how passwords are modified in
existing entries, and when adding new entries.
-
+
Create the Password Admin entry, but do not set
it as an admin yet. Use the entry to verify invalid
- passwords are caught. Then activate the password
+ passwords are caught. Then activate the password
admin and make sure it can bypass password policy.
"""
@@ -224,27 +225,26 @@ def test_ticket47900(topology):
"with an invalid password (%s)" % (passwd))
assert False
-
#
# Now activate a password administator, bind as root dn to do the config
# update, then rebind as the password admin
#
topology.standalone.log.info("Activate the Password Administator...")
-
+
# Bind as Root DN
try:
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
except ldap.LDAPError, e:
topology.standalone.log.error('Root DN failed to authenticate: ' + e.message['desc'])
- assert False
-
+ assert False
+
# Update config
try:
topology.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'passwordAdminDN', ADMIN_DN)])
except ldap.LDAPError, e:
topology.standalone.log.error('Failed to add password admin to config: ' + e.message['desc'])
assert False
-
+
# Bind as Password Admin
try:
topology.standalone.simple_bind_s(ADMIN_DN, ADMIN_PWD)
@@ -274,7 +274,6 @@ def test_ticket47900(topology):
topology.standalone.log.error('Failed to delete entry: %s' % (e.message['desc']))
assert False
-
#
# Add the entry for the next round of testing (modify password)
#
@@ -290,13 +289,13 @@ def test_ticket47900(topology):
# Deactivate the password admin and make sure invalid password updates fail
#
topology.standalone.log.info("Deactivate Password Administator and try invalid password updates...")
-
+
# Bind as root DN
try:
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
except ldap.LDAPError, e:
topology.standalone.log.error('Root DN failed to authenticate: ' + e.message['desc'])
- assert False
+ assert False
# Update config
try:
@@ -311,7 +310,7 @@ def test_ticket47900(topology):
except ldap.LDAPError, e:
topology.standalone.log.error('Failed to bind as the Password Admin: ' + e.message['desc'])
assert False
-
+
#
# Make invalid password updates that should fail
#
@@ -335,13 +334,13 @@ def test_ticket47900(topology):
# Now activate a password administator
#
topology.standalone.log.info("Activate Password Administator and try updates again...")
-
+
# Bind as root DN
try:
topology.standalone.simple_bind_s(DN_DM, PASSWORD)
except ldap.LDAPError, e:
topology.standalone.log.error('Root DN failed to authenticate: ' + e.message['desc'])
- assert False
+ assert False
# Update config
try:
@@ -349,7 +348,7 @@ def test_ticket47900(topology):
except ldap.LDAPError, e:
topology.standalone.log.error('Failed to add password admin to config: ' + e.message['desc'])
assert False
-
+
# Bind as Password Admin
try:
topology.standalone.simple_bind_s(ADMIN_DN, ADMIN_PWD)
@@ -368,7 +367,7 @@ def test_ticket47900(topology):
topology.standalone.log.error('Password update failed unexpectedly: password (%s) result (%s)'
% (passwd, e.message['desc']))
assert False
- topology.standalone.log.info('Password update succeeded (%s)' % passwd)
+ topology.standalone.log.info('Password update succeeded (%s)' % passwd)
#
# Test passed
#
@@ -376,7 +375,7 @@ def test_ticket47900(topology):
def test_ticket47900_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -392,7 +391,7 @@ def run_isolated():
topo = topology(True)
test_ticket47900(topo)
+ test_ticket47900_final(topo)
if __name__ == '__main__':
run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47920_test.py b/dirsrvtests/tickets/ticket47920_test.py
index 1e04626..1b6455d 100644
--- a/dirsrvtests/tickets/ticket47920_test.py
+++ b/dirsrvtests/tickets/ticket47920_test.py
@@ -24,9 +24,6 @@ SCOPE_OUT_DN = 'cn=%s,%s' % (SCOPE_OUT_CN, SUFFIX)
PROVISIONING_CN = "provisioning"
PROVISIONING_DN = "cn=%s,%s" % (PROVISIONING_CN, SCOPE_IN_DN)
-
-
-
ACTIVE_CN = "accounts"
STAGE_CN = "staged users"
DELETE_CN = "deleted users"
@@ -55,10 +52,8 @@ OUT_GROUP_DN = "cn=%s,%s" % (OUT_GROUP_CN, SCOPE_OUT_DN)
INDIRECT_ACTIVE_GROUP_CN = "indirect active group"
INDIRECT_ACTIVE_GROUP_DN = "cn=%s,%s" % (INDIRECT_ACTIVE_GROUP_CN, ACTIVE_DN)
-INITIAL_DESC="inital description"
-FINAL_DESC ="final description"
-
-
+INITIAL_DESC = "inital description"
+FINAL_DESC = "final description"
log = logging.getLogger(__name__)
@@ -71,14 +66,13 @@ class TopologyStandalone(object):
self.standalone = standalone
-
@pytest.fixture(scope="module")
def topology(request):
'''
This fixture is used to standalone topology for the 'module'.
At the beginning, It may exists a standalone instance.
It may also exists a backup for the standalone instance.
-
+
Principle:
If standalone instance exists:
restart it
@@ -97,60 +91,60 @@ def topology(request):
if installation_prefix:
args_instance[SER_DEPLOYED_DIR] = installation_prefix
-
+
standalone = DirSrv(verbose=False)
-
+
# Args for the standalone instance
args_instance[SER_HOST] = HOST_STANDALONE
args_instance[SER_PORT] = PORT_STANDALONE
args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
args_standalone = args_instance.copy()
standalone.allocate(args_standalone)
-
+
# Get the status of the backups
backup_standalone = standalone.checkBackupFS()
-
+
# Get the status of the instance and restart it if it exists
- instance_standalone = standalone.exists()
+ instance_standalone = standalone.exists()
if instance_standalone:
# assuming the instance is already stopped, just wait 5 sec max
standalone.stop(timeout=5)
standalone.start(timeout=10)
-
+
if backup_standalone:
- # The backup exist, assuming it is correct
+ # The backup exist, assuming it is correct
# we just re-init the instance with it
if not instance_standalone:
standalone.create()
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# restore standalone instance from backup
standalone.stop(timeout=10)
standalone.restoreFS(backup_standalone)
standalone.start(timeout=10)
-
+
else:
# We should be here only in two conditions
# - This is the first time a test involve standalone instance
# - Something weird happened (instance/backup destroyed)
# so we discard everything and recreate all
-
+
# Remove the backup. So even if we have a specific backup file
# (e.g backup_standalone) we clear backup that an instance may have created
if backup_standalone:
standalone.clearBackupFS()
-
+
# Remove the instance
if instance_standalone:
standalone.delete()
-
+
# Create the instance
standalone.create()
-
+
# Used to retrieve configuration information (dbdir, confdir...)
standalone.open()
-
+
# Time to create the backups
standalone.stop(timeout=10)
standalone.backupfile = standalone.backupFS()
@@ -159,20 +153,22 @@ def topology(request):
# clear the tmp directory
standalone.clearTmpDir(__file__)
- #
+ #
# Here we have standalone instance up and running
# Either coming from a backup recovery
# or from a fresh (re)init
# Time to return the topology
return TopologyStandalone(standalone)
+
def _header(topology, label):
topology.standalone.log.info("\n\n###############################################")
topology.standalone.log.info("#######")
topology.standalone.log.info("####### %s" % label)
topology.standalone.log.info("#######")
topology.standalone.log.info("###############################################")
-
+
+
def _add_user(topology, type='active'):
if type == 'active':
topology.standalone.add_s(Entry((ACTIVE_USER_DN, {
@@ -191,6 +187,7 @@ def _add_user(topology, type='active'):
'sn': OUT_USER_CN,
'cn': OUT_USER_CN})))
+
def test_ticket47920_init(topology):
topology.standalone.add_s(Entry((SCOPE_IN_DN, {
'objectclass': "top nscontainer".split(),
@@ -205,47 +202,47 @@ def test_ticket47920_init(topology):
def test_ticket47920_mod_readentry_ctrl(topology):
_header(topology, 'MOD: with a readentry control')
-
+
topology.standalone.log.info("Check the initial value of the entry")
ent = topology.standalone.getEntry(ACTIVE_USER_DN, ldap.SCOPE_BASE, "(objectclass=*)", ['description'])
assert ent.hasAttr('description')
assert ent.getValue('description') == INITIAL_DESC
- pr = PostReadControl(criticality=True,attrList=['cn', 'description'])
- _,_,_,resp_ctrls = topology.standalone.modify_ext_s(ACTIVE_USER_DN, [(ldap.MOD_REPLACE, 'description', [FINAL_DESC])], serverctrls= [pr])
+ pr = PostReadControl(criticality=True, attrList=['cn', 'description'])
+ _, _, _, resp_ctrls = topology.standalone.modify_ext_s(ACTIVE_USER_DN, [(ldap.MOD_REPLACE, 'description', [FINAL_DESC])], serverctrls=[pr])
assert resp_ctrls[0].dn == ACTIVE_USER_DN
- assert resp_ctrls[0].entry.has_key('description')
- assert resp_ctrls[0].entry.has_key('cn')
+ assert 'description' in resp_ctrls[0].entry
+ assert 'cn' in resp_ctrls[0].entry
print resp_ctrls[0].entry['description']
ent = topology.standalone.getEntry(ACTIVE_USER_DN, ldap.SCOPE_BASE, "(objectclass=*)", ['description'])
assert ent.hasAttr('description')
assert ent.getValue('description') == FINAL_DESC
-
+
+
def test_ticket47920_final(topology):
- topology.standalone.stop(timeout=10)
-
+ topology.standalone.delete()
def run_isolated():
'''
run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
+ To run isolated without py.test, you need to
- edit this file and comment '@pytest.fixture' line before 'topology' function.
- set the installation prefix
- run this program
'''
global installation_prefix
- installation_prefix = None
-
+ installation_prefix = None
+
topo = topology(True)
test_ticket47920_init(topo)
test_ticket47920_mod_readentry_ctrl(topo)
-
+
test_ticket47920_final(topo)
+
if __name__ == '__main__':
run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47937_test.py b/dirsrvtests/tickets/ticket47937_test.py
index 09ee714..3554a71 100644
--- a/dirsrvtests/tickets/ticket47937_test.py
+++ b/dirsrvtests/tickets/ticket47937_test.py
@@ -216,7 +216,7 @@ def test_ticket47937(topology):
def test_ticket47937_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -232,6 +232,8 @@ def run_isolated():
topo = topology(True)
test_ticket47937(topo)
+ test_ticket47937_final(topo)
+
if __name__ == '__main__':
- run_isolated()
\ No newline at end of file
+ run_isolated()
diff --git a/dirsrvtests/tickets/ticket47950_test.py b/dirsrvtests/tickets/ticket47950_test.py
index 976f964..81ce0f7 100644
--- a/dirsrvtests/tickets/ticket47950_test.py
+++ b/dirsrvtests/tickets/ticket47950_test.py
@@ -252,7 +252,7 @@ def test_ticket47950(topology):
def test_ticket47953_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -268,6 +268,8 @@ def run_isolated():
topo = topology(True)
test_ticket47950(topo)
+ test_ticket47953_final(topo)
+
if __name__ == '__main__':
- run_isolated()
\ No newline at end of file
+ run_isolated()
diff --git a/dirsrvtests/tickets/ticket47953_test.py b/dirsrvtests/tickets/ticket47953_test.py
index 5a1241b..b9d0670 100644
--- a/dirsrvtests/tickets/ticket47953_test.py
+++ b/dirsrvtests/tickets/ticket47953_test.py
@@ -157,7 +157,7 @@ def test_ticket47953(topology):
def test_ticket47953_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -173,6 +173,8 @@ def run_isolated():
topo = topology(True)
test_ticket47953(topo)
+ test_ticket47953_final(topo)
+
if __name__ == '__main__':
- run_isolated()
\ No newline at end of file
+ run_isolated()
diff --git a/dirsrvtests/tickets/ticket47970_test.py b/dirsrvtests/tickets/ticket47970_test.py
index 49d505a..54895eb 100644
--- a/dirsrvtests/tickets/ticket47970_test.py
+++ b/dirsrvtests/tickets/ticket47970_test.py
@@ -185,7 +185,7 @@ def test_ticket47970(topology):
def test_ticket47970_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -201,6 +201,8 @@ def run_isolated():
topo = topology(True)
test_ticket47970(topo)
+ test_ticket47970_final(topo)
+
if __name__ == '__main__':
- run_isolated()
\ No newline at end of file
+ run_isolated()
diff --git a/dirsrvtests/tickets/ticket47973_test.py b/dirsrvtests/tickets/ticket47973_test.py
index 11b1ac8..259d9ac 100644
--- a/dirsrvtests/tickets/ticket47973_test.py
+++ b/dirsrvtests/tickets/ticket47973_test.py
@@ -214,7 +214,7 @@ def test_ticket47973(topology):
def test_ticket47973_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -230,6 +230,8 @@ def run_isolated():
topo = topology(True)
test_ticket47973(topo)
+ test_ticket47973_final(topo)
+
if __name__ == '__main__':
- run_isolated()
\ No newline at end of file
+ run_isolated()
diff --git a/dirsrvtests/tickets/ticket47980_test.py b/dirsrvtests/tickets/ticket47980_test.py
index 406d72d..51e37dc 100644
--- a/dirsrvtests/tickets/ticket47980_test.py
+++ b/dirsrvtests/tickets/ticket47980_test.py
@@ -689,7 +689,7 @@ def test_ticket47980(topology):
def test_ticket47980_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -705,6 +705,8 @@ def run_isolated():
topo = topology(True)
test_ticket47980(topo)
+ test_ticket47980_final(topo)
+
if __name__ == '__main__':
- run_isolated()
\ No newline at end of file
+ run_isolated()
diff --git a/dirsrvtests/tickets/ticket47981_test.py b/dirsrvtests/tickets/ticket47981_test.py
index 2a16ce6..26de221 100644
--- a/dirsrvtests/tickets/ticket47981_test.py
+++ b/dirsrvtests/tickets/ticket47981_test.py
@@ -324,7 +324,7 @@ def test_ticket47981(topology):
def test_ticket47981_final(topology):
- topology.standalone.stop(timeout=10)
+ topology.standalone.delete()
def run_isolated():
@@ -340,6 +340,8 @@ def run_isolated():
topo = topology(True)
test_ticket47981(topo)
+ test_ticket47981_final(topo)
+
if __name__ == '__main__':
- run_isolated()
\ No newline at end of file
+ run_isolated()
1
0
ldap/servers/slapd/tools/ldclt/ldapfct.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
New commits:
commit d26ed48cb78c034462757dece5dfcb2ef569bdd1
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 21 17:36:29 2015 -0800
Ticket #47996 - ldclt needs to support SSL Version range
Description: ldclt did not have a code to set the enabled SSL version.
This patch sets the range.min and range.max based upon the range that
the linked NSS provides.
https://fedorahosted.org/389/ticket/47996
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit 7c30e11f6f337472dace6f146845bb14f5601e2b)
(cherry picked from commit 6431142506a05e9ef4c095b538d7d852f176e300)
(cherry picked from commit cef5810bd981d2080820ce58f20504fbfd95c54c)
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index 8fd3304..1c9aea0 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -275,6 +275,7 @@ int ldclt_build_control( char *oid, BerElement *ber, int freeber, char iscritica
#endif
int ldclt_alloc_ber( LDAP *ld, BerElement **berp );
+static SSLVersionRange enabledNSSVersions;
/* ****************************************************************************
FUNCTION : my_ldap_err2string
@@ -647,14 +648,6 @@ ldclt_clientauth(thread_context *tttctx, LDAP *ld, const char *path, const char
thrdNum = tttctx->thrdNum;
}
- rc = NSS_Initialize(path, "", "", SECMOD_DB, NSS_INIT_READONLY);
- if (rc != SECSuccess) {
- printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
- mctx.pid, thrdNum, path, PR_GetError());
- fflush(stdout);
- goto done;
- }
-
if ((colon = PL_strchr(certname, ':' ))) {
token_name = PL_strndup(certname, colon-certname);
}
@@ -741,6 +734,7 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
int thrdNum = 0;
int ret = -1;
int binded = 0;
+ SSLVersionRange range;
if (tttctx) {
thrdNum = tttctx->thrdNum;
@@ -787,6 +781,21 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
free(certdir);
goto done;
}
+ /* Initialize NSS */
+ ret = NSS_Initialize(certdir, "", "", SECMOD_DB, NSS_INIT_READONLY);
+ if (ret != SECSuccess) {
+ printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
+ mctx.pid, thrdNum, certdir, PR_GetError());
+ fflush(stdout);
+ goto done;
+ }
+
+ /* Set supported SSL version range. */
+ SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
+ range.min = enabledNSSVersions.min;
+ range.max = enabledNSSVersions.max;
+ SSL_VersionRangeSetDefault(ssl_variant_stream, &range);
+
if ((mode & CLTAUTH) &&
(ret = ldclt_clientauth(tttctx, ld, certdir, mctx.cltcertname, mctx.keydbpin))) {
free(certdir);
1
0
ldap/servers/slapd/tools/ldclt/ldapfct.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
New commits:
commit cef5810bd981d2080820ce58f20504fbfd95c54c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 21 17:36:29 2015 -0800
Ticket #47996 - ldclt needs to support SSL Version range
Description: ldclt did not have a code to set the enabled SSL version.
This patch sets the range.min and range.max based upon the range that
the linked NSS provides.
https://fedorahosted.org/389/ticket/47996
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit 7c30e11f6f337472dace6f146845bb14f5601e2b)
(cherry picked from commit 6431142506a05e9ef4c095b538d7d852f176e300)
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index 4eadf59..45796db 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -275,6 +275,7 @@ int ldclt_build_control( char *oid, BerElement *ber, int freeber, char iscritica
#endif
int ldclt_alloc_ber( LDAP *ld, BerElement **berp );
+static SSLVersionRange enabledNSSVersions;
/* ****************************************************************************
FUNCTION : my_ldap_err2string
@@ -647,14 +648,6 @@ ldclt_clientauth(thread_context *tttctx, LDAP *ld, const char *path, const char
thrdNum = tttctx->thrdNum;
}
- rc = NSS_Initialize(path, "", "", SECMOD_DB, NSS_INIT_READONLY);
- if (rc != SECSuccess) {
- printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
- mctx.pid, thrdNum, path, PR_GetError());
- fflush(stdout);
- goto done;
- }
-
if ((colon = PL_strchr(certname, ':' ))) {
token_name = PL_strndup(certname, colon-certname);
}
@@ -741,6 +734,7 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
int thrdNum = 0;
int ret = -1;
int binded = 0;
+ SSLVersionRange range;
if (tttctx) {
thrdNum = tttctx->thrdNum;
@@ -787,6 +781,21 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
free(certdir);
goto done;
}
+ /* Initialize NSS */
+ ret = NSS_Initialize(certdir, "", "", SECMOD_DB, NSS_INIT_READONLY);
+ if (ret != SECSuccess) {
+ printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
+ mctx.pid, thrdNum, certdir, PR_GetError());
+ fflush(stdout);
+ goto done;
+ }
+
+ /* Set supported SSL version range. */
+ SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
+ range.min = enabledNSSVersions.min;
+ range.max = enabledNSSVersions.max;
+ SSL_VersionRangeSetDefault(ssl_variant_stream, &range);
+
if ((mode & CLTAUTH) &&
(ret = ldclt_clientauth(tttctx, ld, certdir, mctx.cltcertname, mctx.keydbpin))) {
free(certdir);
1
0
ldap/servers/slapd/tools/ldclt/ldapfct.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
New commits:
commit 6431142506a05e9ef4c095b538d7d852f176e300
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 21 17:36:29 2015 -0800
Ticket #47996 - ldclt needs to support SSL Version range
Description: ldclt did not have a code to set the enabled SSL version.
This patch sets the range.min and range.max based upon the range that
the linked NSS provides.
https://fedorahosted.org/389/ticket/47996
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit 7c30e11f6f337472dace6f146845bb14f5601e2b)
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index 26867a6..110ad78 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -275,6 +275,7 @@ int ldclt_build_control( char *oid, BerElement *ber, int freeber, char iscritica
#endif
int ldclt_alloc_ber( LDAP *ld, BerElement **berp );
+static SSLVersionRange enabledNSSVersions;
/* ****************************************************************************
FUNCTION : my_ldap_err2string
@@ -647,14 +648,6 @@ ldclt_clientauth(thread_context *tttctx, LDAP *ld, const char *path, const char
thrdNum = tttctx->thrdNum;
}
- rc = NSS_Initialize(path, "", "", SECMOD_DB, NSS_INIT_READONLY);
- if (rc != SECSuccess) {
- printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
- mctx.pid, thrdNum, path, PR_GetError());
- fflush(stdout);
- goto done;
- }
-
if ((colon = PL_strchr(certname, ':' ))) {
token_name = PL_strndup(certname, colon-certname);
}
@@ -741,6 +734,7 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
int thrdNum = 0;
int ret = -1;
int binded = 0;
+ SSLVersionRange range;
if (tttctx) {
thrdNum = tttctx->thrdNum;
@@ -787,6 +781,21 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
free(certdir);
goto done;
}
+ /* Initialize NSS */
+ ret = NSS_Initialize(certdir, "", "", SECMOD_DB, NSS_INIT_READONLY);
+ if (ret != SECSuccess) {
+ printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
+ mctx.pid, thrdNum, certdir, PR_GetError());
+ fflush(stdout);
+ goto done;
+ }
+
+ /* Set supported SSL version range. */
+ SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
+ range.min = enabledNSSVersions.min;
+ range.max = enabledNSSVersions.max;
+ SSL_VersionRangeSetDefault(ssl_variant_stream, &range);
+
if ((mode & CLTAUTH) &&
(ret = ldclt_clientauth(tttctx, ld, certdir, mctx.cltcertname, mctx.keydbpin))) {
free(certdir);
1
0
ldap/servers/slapd/tools/ldclt/ldapfct.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
New commits:
commit 7c30e11f6f337472dace6f146845bb14f5601e2b
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 21 17:36:29 2015 -0800
Ticket #47996 - ldclt needs to support SSL Version range
Description: ldclt did not have a code to set the enabled SSL version.
This patch sets the range.min and range.max based upon the range that
the linked NSS provides.
https://fedorahosted.org/389/ticket/47996
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index 26867a6..110ad78 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -275,6 +275,7 @@ int ldclt_build_control( char *oid, BerElement *ber, int freeber, char iscritica
#endif
int ldclt_alloc_ber( LDAP *ld, BerElement **berp );
+static SSLVersionRange enabledNSSVersions;
/* ****************************************************************************
FUNCTION : my_ldap_err2string
@@ -647,14 +648,6 @@ ldclt_clientauth(thread_context *tttctx, LDAP *ld, const char *path, const char
thrdNum = tttctx->thrdNum;
}
- rc = NSS_Initialize(path, "", "", SECMOD_DB, NSS_INIT_READONLY);
- if (rc != SECSuccess) {
- printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
- mctx.pid, thrdNum, path, PR_GetError());
- fflush(stdout);
- goto done;
- }
-
if ((colon = PL_strchr(certname, ':' ))) {
token_name = PL_strndup(certname, colon-certname);
}
@@ -741,6 +734,7 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
int thrdNum = 0;
int ret = -1;
int binded = 0;
+ SSLVersionRange range;
if (tttctx) {
thrdNum = tttctx->thrdNum;
@@ -787,6 +781,21 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
free(certdir);
goto done;
}
+ /* Initialize NSS */
+ ret = NSS_Initialize(certdir, "", "", SECMOD_DB, NSS_INIT_READONLY);
+ if (ret != SECSuccess) {
+ printf ("ldclt[%d]: T%03d: Cannot NSS_Initialize(%s) %d\n",
+ mctx.pid, thrdNum, certdir, PR_GetError());
+ fflush(stdout);
+ goto done;
+ }
+
+ /* Set supported SSL version range. */
+ SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
+ range.min = enabledNSSVersions.min;
+ range.max = enabledNSSVersions.max;
+ SSL_VersionRangeSetDefault(ssl_variant_stream, &range);
+
if ((mode & CLTAUTH) &&
(ret = ldclt_clientauth(tttctx, ld, certdir, mctx.cltcertname, mctx.keydbpin))) {
free(certdir);
1
0
ldap/servers/plugins/acl/acllas.c | 34 +++++++++++++++++-----------------
ldap/servers/plugins/acl/aclparse.c | 4 ++--
ldap/servers/plugins/acl/aclutil.c | 6 +++---
3 files changed, 22 insertions(+), 22 deletions(-)
New commits:
commit 45ee5cb427f2de85c7efc5cc964eab0a9327adc5
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 21 15:51:30 2015 -0500
Ticket 47738 - use PL_strcasestr instead of strcasestr
Bug Description: The use of strcasestr results in unresolved symbols for
libacl-plugin.so on build on Solaris
Fix Description: Use PR_strcasestr
Original patch submitted by: cgrzemba(Thanks!)
https://fedorahosted.org/389/ticket/47738
Reviewed by: mreynolds
(cherry picked from commit 67177a2108ebf04094be003662f8091ecde5706b)
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 4738a40..e3c1778 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -584,9 +584,9 @@ DS_LASUserDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* URL format */
- if ((strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( s_user, &lasinfo,
ACL_EVAL_USER);
@@ -856,9 +856,9 @@ DS_LASGroupDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
"Group not evaluated(%s)\n", groupName);
break;
} else {
- if ((strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( groupName, &lasinfo,
ACL_EVAL_GROUP);
slapi_log_error ( SLAPI_LOG_ACL, plugin_name,
@@ -1075,9 +1075,9 @@ DS_LASRoleDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* Take care of param strings */
- if ((strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( role, &lasinfo,
ACL_EVAL_ROLE);
@@ -2626,9 +2626,9 @@ DS_LASGroupDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
/* In this case "grppupdnattr="ldap:///base??attr" */
- if ((strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( attrName, &lasinfo,
ACL_EVAL_GROUPDNATTR);
@@ -4199,12 +4199,12 @@ acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) {
int has_macro_levels = 0;
/* Determine what the rule's got once */
- if ( strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
+ if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
/* ($dn) exists */
has_macro_dn = 1;
}
- if ( strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
+ if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
/* [$dn] exists */
has_macro_levels = 1;
}
@@ -4308,7 +4308,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
int l;
Slapi_Attr *attr = NULL;
- str = strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
if ( str == NULL ) {
charray_add(&a, slapi_ch_strdup(rule));
@@ -4317,7 +4317,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
} else {
working_rule = slapi_ch_strdup(rule);
- str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
charray_add(&working_list, working_rule );
while( str != NULL) {
@@ -4415,7 +4415,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
slapi_ch_free_string(¯o_str);
slapi_ch_free_string(¯o_attr_name);
- str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
}/* while */
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index fd262e8..24b186e 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -318,8 +318,8 @@ __aclp__parse_aci(char *str, aci_t *aci_item, char **errbuf)
* have a target and it must have a macro.
*/
- if ((strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
+ if ((PL_strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
/* Must have a targetmacro */
if ( !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) {
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index 0720dae..619f857 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -1250,7 +1250,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
char *working_s, *suffix, *prefix, *patched;
int replace_with_len, substr_len, prefix_len, suffix_len;
- if (strcasestr(s, substr) == NULL) {
+ if (PL_strcasestr(s, substr) == NULL) {
return(slapi_ch_strdup(s));
} else {
@@ -1260,7 +1260,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = slapi_ch_strdup(s);
prefix = working_s;
- str = strcasestr(prefix, substr);
+ str = PL_strcasestr(prefix, substr);
while (str != NULL) {
@@ -1287,7 +1287,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = patched;
prefix = working_s;
- str = strcasestr(prefix, substr);
+ str = PL_strcasestr(prefix, substr);
}
1
0
ldap/servers/plugins/acl/acllas.c | 34 +++++++++++++++++-----------------
ldap/servers/plugins/acl/aclparse.c | 4 ++--
ldap/servers/plugins/acl/aclutil.c | 6 +++---
3 files changed, 22 insertions(+), 22 deletions(-)
New commits:
commit 67177a2108ebf04094be003662f8091ecde5706b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 21 15:51:30 2015 -0500
Ticket 47738 - use PL_strcasestr instead of strcasestr
Bug Description: The use of strcasestr results in unresolved symbols for
libacl-plugin.so on build on Solaris
Fix Description: Use PR_strcasestr
Original patch submitted by: cgrzemba(Thanks!)
https://fedorahosted.org/389/ticket/47738
Reviewed by: mreynolds
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 4738a40..e3c1778 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -584,9 +584,9 @@ DS_LASUserDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* URL format */
- if ((strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( s_user, &lasinfo,
ACL_EVAL_USER);
@@ -856,9 +856,9 @@ DS_LASGroupDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
"Group not evaluated(%s)\n", groupName);
break;
} else {
- if ((strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( groupName, &lasinfo,
ACL_EVAL_GROUP);
slapi_log_error ( SLAPI_LOG_ACL, plugin_name,
@@ -1075,9 +1075,9 @@ DS_LASRoleDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* Take care of param strings */
- if ((strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( role, &lasinfo,
ACL_EVAL_ROLE);
@@ -2626,9 +2626,9 @@ DS_LASGroupDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
/* In this case "grppupdnattr="ldap:///base??attr" */
- if ((strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((PL_strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (PL_strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( attrName, &lasinfo,
ACL_EVAL_GROUPDNATTR);
@@ -4199,12 +4199,12 @@ acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) {
int has_macro_levels = 0;
/* Determine what the rule's got once */
- if ( strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
+ if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
/* ($dn) exists */
has_macro_dn = 1;
}
- if ( strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
+ if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
/* [$dn] exists */
has_macro_levels = 1;
}
@@ -4308,7 +4308,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
int l;
Slapi_Attr *attr = NULL;
- str = strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
if ( str == NULL ) {
charray_add(&a, slapi_ch_strdup(rule));
@@ -4317,7 +4317,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
} else {
working_rule = slapi_ch_strdup(rule);
- str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
charray_add(&working_list, working_rule );
while( str != NULL) {
@@ -4415,7 +4415,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
slapi_ch_free_string(¯o_str);
slapi_ch_free_string(¯o_attr_name);
- str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
}/* while */
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index fd262e8..24b186e 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -318,8 +318,8 @@ __aclp__parse_aci(char *str, aci_t *aci_item, char **errbuf)
* have a target and it must have a macro.
*/
- if ((strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
+ if ((PL_strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (PL_strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
/* Must have a targetmacro */
if ( !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) {
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index 0720dae..619f857 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -1250,7 +1250,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
char *working_s, *suffix, *prefix, *patched;
int replace_with_len, substr_len, prefix_len, suffix_len;
- if (strcasestr(s, substr) == NULL) {
+ if (PL_strcasestr(s, substr) == NULL) {
return(slapi_ch_strdup(s));
} else {
@@ -1260,7 +1260,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = slapi_ch_strdup(s);
prefix = working_s;
- str = strcasestr(prefix, substr);
+ str = PL_strcasestr(prefix, substr);
while (str != NULL) {
@@ -1287,7 +1287,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = patched;
prefix = working_s;
- str = strcasestr(prefix, substr);
+ str = PL_strcasestr(prefix, substr);
}
1
0
ldap/servers/slapd/entry.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
New commits:
commit 340b9dc5f979d75ab5bb92c7aa61808ff1fddd1f
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Jun 13 18:22:21 2013 -0700
Ticket #569 - examine replication code to reduce amount of stored state information
Description: commit c7f6f161f4967635d6f02b029be571d88ec61961
made this change:
In case the deleted value list in an attribute is empty:
* this means the entry is deleted and has no more attributes,
* when writing the attr to disk we would loose the AD-csn.
* Add an empty value to the set of deleted values. This will
* never be seen by any client. It will never be moved to the
* present values and is only used to preserve the AD-csn.
The AD-csn size was not counted for the buffer size to allocate.
This patch adds the size.
https://fedorahosted.org/389/ticket/569
Reviewed by Nathan (Thanks!!)
(cherry picked from commit ca02529c797903139c56bd9b8b90e8cd5bd0c3f4)
Conflicts:
ldap/servers/slapd/entry.c
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 1341296..340844d 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -1476,7 +1476,17 @@ entry2str_internal_size_attrlist( const Slapi_Attr *attrlist, int entry2str_ctrl
/* ";adcsn-" + a->a_deletioncsn */
if ( a->a_deletioncsn )
{
- elen+= 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ }
+ if ( valueset_isempty(&a->a_deleted_values)) {
+ /* this means the entry is deleted and has no more attributes,
+ * when writing the attr to disk we would loose the AD-csn.
+ * Add an empty value to the set of deleted values. This will
+ * never be seen by any client. It will never be moved to the
+ * present values and is only used to preserve the AD-csn
+ * We need to add the size for that.
+ */
+ elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
}
}
}
1
0
Changes since the dawn of time:
Endi S. Dewata (3):
Bug 496863 - 'Construct' button creates incorrect referral urls
Resolves: bug 574098
Bug 563513 - New replication -> No changelong configured-msg
Mark Reynolds (10):
Ticket 370 - Opening merge qualifier CoS entry using RHDS console changes the entry
Bumped version to 1.2.7
Ticket 96 - Window too large for Manage password policy
Ticket 47883 - DS Console - java exception when refreshing
Ticket 176 - DS Console should timeout when mismatched port
Ticket 47886 - DS Console - mouse wheel speed very slow
Ticket 47485 - DS instance cannot be restored from remote console
Ticket 47887 - DS Console does not correctly disable SSL
Ticket 135 - DS console - right clicking an object does not select that object
Ticket 47994 - DS Console always sets nsSSL3 to "on" when a securty setting is adjusted
Nathan Kinder (28):
171941 - Adjusted the version number and branding. I had to modify the checkVersion method to deal with running in Console 1.0. I also cleaned up references to consolesdk in the Ant build files. They should be console instead since we dropped the consolesdk naming. The external and internal imports files were adjusted to pick up the new 1.0 Console component.
171941 - checkVersion was comparing versions with greater than when it should have been using greater than or equal to
177696 - Changed usage of enum keyword as a variable name for Java 1.5 compatibility
Bug(s) fixed: 181570
Resolves: 246513
Summary: Initial fedora-ds-console specfile.
Resolves: ?
Resolves: 250137
Resolves: 250145
Resolves: 204510
Resolves: 250636
Resolves: 252036
Add default ldapjdk path as well as a settable parameter
Fixed typo from last checkin
Use less restrictive version of Open Publication License for online help docs.
Resolves: 308221
Resolves: 333171
Resolves: 178247
Resolves: 379191
Bug 599732 - Root node in directory browser shows DN syntax error
Bug 229693 - Update naming attribute when objectclass is removed
Bug 474113 - Allow access log level to be configured from Console
Bug 504803 - Allow nsslapd-*-logmaxdiskspace to be set to -1 in UI
Bug 158262 - Windows Sync UI is inconistent
Bug 533505 - Warn about CA cert trust when enabling SSL in Console
Bug 616707 - Add attribute matching rule UI to Console
Bug 705753 - Refresh problem in Console directory browser
Bug 700908 - Validate matching rules when creating a new attribute
Noriko Hosoi (23):
Changed the ldapconsole package name to <brand>-ds-<version>.jar
Modified ant move syntax to support ant 1.6.2
[186105] Admin Server Makefile updates for Internal build
Resolves: #247215
Resolves: #248073
Resolves: #379191
Resolves: #386041
Resolves: #379191
Resolves: #379191
Resolves: #379191
Resolves: #379191
Resolves: #379191
Resolves: 178947
Bug 553066 - Directory Console: do not display "subtree" index type
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
Bug 661116 - 389-console Configuration tab admin permissions
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 450016 - RFE- Console display values in KB/MB/GB
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 757773 - SSL Port issue in Console
Ticket #47380 - RFE: Winsync loses connection with AD objects when they move from the console.
Bumped version to 1.2.8
Bumped version to 1.2.9
Rich Megginson (39):
Bug(s) fixed: 167761
allow the definition of the console location on the command line with different directory layouts than the default
Bug(s) fixed: 178478
The console now builds jar files in the format
bump version to 1.0.3
updated spec for Fedora DS 1.1 release
Resolves: bug 428357
Bump version to 1.1.2
this is for the 1.1.2 release
Resolves: bug 469261
Resolves: bug 469261
Resolves: bug 234948
Resolves: bug 452596
Resolves: bug 178947
Resolves: bug 177334
Resolves: bug 249120
Resolves: bug 238762
Resolves: bug 179193
Resolves: bug 179184
change version to 1.1.3
Resolves: bug 487831
Resolves: bug 481213
Resolves: bug 483660
Resolves: bug 483660
updated for 1.1.3
version must correspond to ds base version - 1.2.0
rename to 389
change mode of spec file to 644
added separate doc subpackage
update to version 1.2.1
Bug 586571 - DS Console shows escaped DNs
bump version to 1.2.2
Bug 586571 - DS Console shows escaped DNs
Bug 591989 - [console] mis-matched trademark and text
bump version to 1.2.4
bump version to 1.2.5
add skin support
move dsbanner.gif to the localized jar for l10n/skinning
dsbannerlite.gif is obsolete
foxworth (2):
Import initial source drop of Fedora DirectoryConsole
Import initial source drop of Fedora DirectoryConsole
1
0
build.properties | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit f9c99a54c56bcedfdb6b3d08c492c4cb43476572
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 15:10:04 2015 -0800
Bumped version to 1.2.9
diff --git a/build.properties b/build.properties
index 1d99d68..49b83dd 100755
--- a/build.properties
+++ b/build.properties
@@ -21,7 +21,7 @@
lang=en
ldapconsole.root=..
-ldapconsole.version=1.2.8
+ldapconsole.version=1.2.9
ldapconsole.gen.version=1.2
brand=389
ldapconsole.name=${brand}-ds-${ldapconsole.version}
1
0
Changes since 389-admin-1.1.11:
Endi S. Dewata (3):
Bug 573889 - Migration does not remove deprecated schema
Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries
Bug 470576 - Migration could do addition checks before commiting actions
Ludwig (1):
Ticket 47563 - cannot restart directory server from console
Mark Reynolds (15):
Ticket #286 - compilation fixes for 'format-security'
Ticket 401 - Console login fails with anonymous access disabled
Ticket 400 - BIND operation result not checked properly in admin server
Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry
Ticket 47495 - admin express: wrong instance creation time
Ticket 47497 - Admin Express - remove "Security Level"
Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time
Ticket 47300 - Update man page for remove-ds-admin.pl
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain
Ticket 47548 - register-ds-admin does not register into remote config ds
Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot
Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c
Ticket 201 - nCipher HSM cannot be configured via the console
Ticket 47929 - Admin Server - disable SSLv3 by default
Nathan Kinder (49):
Bug 648949 - Merge selinux policy into base OS
Regenerated autoconf files
Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled
Bug 668950 - Add posix group support to Console
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 618897 - Wrong permissions when creating instance from Console
Bug 493424 - remove unneeded modules for admin server apache config
Bug 614690 - Don't use exec to call genrb
Bug 699815 - (cov#10859) Add missing braces in mod_admserv code
Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi
Bug 699815 - (cov#10849,10851) Remove unused variables
Bug 699907 - (cov#10844) Uninitialized time struct
Bug 699907 - (cov#10843) Use of uninitialized variable in logging code
Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi
Bug 699907 - (cov#10836) Use of uninitialized var in http conn code
Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code
Bug 700532 - (cov#10832) Incorrect if condition in dsalib
Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib
Bug 700890 - (cov#10812) Check return value of open() properly in libadmin
Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi
Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication
Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi
Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 702150 - (cov#10823) File descriptors leaked in help cgi
Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi
Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi
Bug 702150 - leak of config array in dsalib
Bug 702150 - (cov#10816) file descriptor leak in dsalib
Bug 702150 - (cov#10817) Leak of string in libdsa
Bug 702150 - Resouce leaks in htmladmin.c
Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin
Bug 702705 - NULL pointer dereferences in viewlog cgi
Bug 702705 - (cov#10803) NULL pointer dereference in security cgi
Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl
Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib
Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy
Bug 724808 - startup CGIs write temp file to /
Bug 730079 - Update SELinux policy during upgrades
Ticket #329 - Port modules to httpd 2.4
Ticket #47333 - Relabel lockfile when starting Admin Server
Ticket #47334 - Avoid quoting all settings in console.conf
Ticket 47468 - Change security password validation error is out of order
Ticket 47466 - Importing CA cert with existing name crashes security CGI
Ticket 362 - Directory Console generates insufficient key strength
Ticket 47467 - Improve CRL import error messages
Noriko Hosoi (26):
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
start-ds-admin.in -- replaced "return 1" with "exit 1"
Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies
Bug 618858 - move start-ds-admin env file into main admin server
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 245278 - Changing to a password with a single quote does not work
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 158926 - Unable to install CA certificate when using
Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user
Bug 476925 - Admin Server: Do not allow 8-bit passwords for
Trac Ticket #307 - htmladmin keeps segfaulting
If htmladmin fails to connect to the server, the cgi could crash.
Ticket #293 - remove-ds-admin.pl does not remove everything
Ticket #476 - 389 ds do not start on F18 due to missing modules
bump version to 1.1.31
Ticket #567 - Restart of Admin server from console fails on segfault
bump version to 1.1.32
bump version to 1.1.33
bump version to 1.1.34
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.36
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket #47995 - Admin Server: source code cleaning
bump version to 1.1.37
Rich Megginson (66):
bump version to 1.1.12.a1
initial support for openldap
add selinux policy for dsgw
skip LD_PRELOAD if using openldap
add more log information if nss init fails
add even more nss debugging
Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized
bump version to 1.1.12.a2
fix building with mozldap
bump version to 1.1.12.a3
fix autotool build issues with properties files
setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error
Bug 656441 - Missing library path entry causes LD_PRELOAD error
bump version to 1.1.13
bump version to 1.1.14.a1
Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required
bump version to 1.1.14
bump version to 1.1.15
bump version to 1.1.16
Bug 703990 - Support upgrade from Red Hat Directory Server
bump version to 1.1.17
add support for different skins
skip rebranding current brand
bump version to 1.1.18
look for separate openldap ldif library
bump version to 1.1.19
Bug 710372 - Not able to open the Manage Certificate from DS-console
better NSS error handling - reduce memory leaks
fix typo in NSS_Shutdown warning message
added tests for the security cgi
Bug 713000 - Migration stops if old admin server cannot be stopped
Bug 718079 - Perl errors when running migrate-ds-admin.pl
Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts
bump version to 1.1.20
bump version to 1.1.21
handle binary upgrade
add man pages for ds_removal and ds_unregister
bump version to 1.1.22
fix binary paths
bump version to 1.1.23
bump version to 1.1.24
Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd
Bug 740959 - 389-console put CA certificates into wrong database
bump version to 1.1.25
Bug 767823 - selinux: need to allow admin server to connect to ldap port
bump version to 1.1.26
Ticket #161 - Review and address latest Coverity issues
Ticket #281 - TLS not working with latest openldap
bump version to 1.1.27
bump version to 1.1.28
bump version to 1.1.29
bump version to 1.1.30
ignore files generated by Eclipse
Ticket #47486 compiler warnings in adminutil, admin, dsgw
Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw
add more debugging for SSL connection problems
Ticket #47413 389-admin fails to build with latest httpd
compiler warning - ldif_read_record lineno type depends on openldap version
add Eclipse and patch files
bump version to 1.1.35
Ticket #47498 Error Message for Failed to create the configuration directory server
Ticket #418 Error with register-ds-admin.pl
Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down.
Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>"
Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour
Ticket #47478 No groups file? error restarting Admin server
Wes Hardin (1):
fix for bug 377 - Unchecked use of SELinux command
noriko (1):
Ticket #47298 - remove-ds-admin.pl does not stop the admin server
---
.gitignore | 4
Makefile.am | 109
Makefile.in | 1767 -
VERSION.sh | 4
aclocal.m4 | 7258 ----
admserv/cfgstuff/console.conf.in | 2
admserv/cfgstuff/httpd-2.2.conf.in | 13
admserv/cfgstuff/httpd-2.4.conf.in | 742
admserv/cfgstuff/httpd.conf.in | 2
admserv/cfgstuff/initconfig.in | 5
admserv/cfgstuff/start-ds-admin.in | 83
admserv/cgi-ds/ds_listdb.c | 26
admserv/cgi-ds/ds_snmpctrl.c | 5
admserv/cgi-src40/ReadLog.c | 18
admserv/cgi-src40/admlib.mk | 119
admserv/cgi-src40/admpw.c | 79
admserv/cgi-src40/cgicommon.h | 1
admserv/cgi-src40/cgicommon.properties | 3
admserv/cgi-src40/config.c | 43
admserv/cgi-src40/dllglue.c | 42
admserv/cgi-src40/ds_create.in | 18
admserv/cgi-src40/dsconfig.c | 10
admserv/cgi-src40/head.html | 1
admserv/cgi-src40/help.c | 15
admserv/cgi-src40/htmladmin.c | 810
admserv/cgi-src40/htmladmin.properties | 42
admserv/cgi-src40/monreplication.c | 7
admserv/cgi-src40/repl-monitor-cgi.pl.in | 37
admserv/cgi-src40/restartsrv.c | 9
admserv/cgi-src40/sec-activate.c | 163
admserv/cgi-src40/security.c | 314
admserv/cgi-src40/security.properties | 6
admserv/cgi-src40/start_config_ds.c | 11
admserv/cgi-src40/statpingserv.c | 82
admserv/cgi-src40/stopsrv.c | 10
admserv/cgi-src40/ugdsconfig.c | 39
admserv/cgi-src40/viewdata.c | 264
admserv/cgi-src40/viewdata.properties | 2
admserv/cgi-src40/viewlog.c | 75
admserv/cgi-src40/viewlog.properties | 6
admserv/genrb_wrapper.sh | 2
admserv/html/admserv.html.in | 11
admserv/html/htmladmin.html.in | 13
admserv/html/monreplication.html | 20
admserv/html/viewdata.html | 6
admserv/html/viewlog.html | 14
admserv/makeUpgradeTar.sh | 30
admserv/newinst/src/25changefedorato389.pl | 250
admserv/newinst/src/25rebrand.pl.in | 413
admserv/newinst/src/30updateglobalpref.pl.in | 9
admserv/newinst/src/AdminMigration.pm.in | 79
admserv/newinst/src/AdminServer.pm.in | 266
admserv/newinst/src/AdminUtil.pm.in | 91
admserv/newinst/src/ConfigDSDialogs.pm | 42
admserv/newinst/src/dirserver.map.in | 1
admserv/newinst/src/register-ds-admin.pl.in | 714
admserv/newinst/src/register-ds-admin.res.in | 36
admserv/newinst/src/register_param.map.in | 4
admserv/newinst/src/register_server.pl.in | 6
admserv/newinst/src/remove-ds-admin.pl.in | 8
admserv/newinst/src/setup-ds-admin.pl.in | 6
admserv/newinst/src/setup-ds-admin.res.in | 20
admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49
admserv/schema/ldif/10dsdata.ldif.tmpl | 39
compile | 240
config.guess | 529
config.h.in | 33
config.sub | 379
configure |38698 +++++++++-------------
configure.ac | 111
depcomp | 343
include/base/file.h | 3
include/base/util.h | 3
include/libadmin/dbtlibadmin.h | 2
include/libadmin/libadmin.h | 92
include/libdsa/dsalib.h | 15
install-sh | 538
lib/base/file.cpp | 30
lib/base/nscputil.cpp | 51
lib/libadmin/dllglue.c | 77
lib/libadmin/httpcon.c | 5
lib/libadmin/referer.c | 4
lib/libadmin/template.c | 29
lib/libadmin/util.c | 973
lib/libdsa/dsalib_conf.c | 37
lib/libdsa/dsalib_confs.c | 93
lib/libdsa/dsalib_location.c | 56
lib/libdsa/dsalib_tailf.c | 1
lib/libdsa/dsalib_updown.c | 118
lib/libdsa/dsalib_util.c | 56
ltmain.sh |14878 +++++---
m4/adminutil.m4 | 4
m4/httpd.m4 | 3
m4/mozldap.m4 | 116
m4/openldap.m4 | 138
m4/selinux.m4 | 3
man/man8/ds_removal.8 | 54
man/man8/ds_unregister.8 | 48
man/man8/register-ds-admin.pl.8 | 139
man/man8/remove-ds-admin.pl.8 | 10
man/man8/restart-ds-admin.8 | 10
man/man8/start-ds-admin.8 | 10
man/man8/stop-ds-admin.8 | 10
missing | 234
mod_admserv/mod_admserv.c | 564
mod_admserv/mod_admserv.h | 15
mod_restartd/mod_restartd-2.2.c | 22
selinux/dirsrv-admin.fc.in | 5
selinux/dirsrv-admin.te | 2
tests/ds_create/testget.1 | 2
tests/htmladmin/testget.2 | 2
tests/htmladmin/testget.3 | 2
tests/htmladmin/testget.4 | 2
tests/htmladmin/testget.5 | 2
tests/htmladmin/testget.6 | 2
tests/htmladmin/testget.7 | 2
tests/htmladmin/testget.8 | 2
tests/security/testpost.1 | 1
tests/security/testpost.10 | 1
tests/security/testpost.11 | 1
tests/security/testpost.12 | 1
tests/security/testpost.13 | 1
tests/security/testpost.14 | 1
tests/security/testpost.15 | 1
tests/security/testpost.16 | 1
tests/security/testpost.17 | 1
tests/security/testpost.18 | 1
tests/security/testpost.19 | 1
tests/security/testpost.2 | 1
tests/security/testpost.20 | 1
tests/security/testpost.21 | 1
tests/security/testpost.3 | 1
tests/security/testpost.4 | 1
tests/security/testpost.5 | 1
tests/security/testpost.6 | 1
tests/security/testpost.7 | 1
tests/security/testpost.8 | 1
tests/security/testpost.9 | 1
tests/setup.sh | 250
tests/ugdsconfig/testget.10 | 2
tests/viewdata/testget.2 | 2
tests/viewdata/testget.3 | 2
tests/viewdata/testget.4 | 2
tests/viewlog/testget.3 | 2
tests/viewlog/testget.4 | 2
wrappers/initscript.in | 3
wrappers/systemd.service.in | 24
147 files changed, 35279 insertions(+), 38203 deletions(-)
---
1
0
VERSION.sh | 2 +-
lib/libadmin/httpcon.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
New commits:
commit 963909573337291e400ce25964bf42fdf9134713
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 13:36:36 2015 -0800
bump version to 1.1.37
diff --git a/VERSION.sh b/VERSION.sh
index 2942ec3..366bcab 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -11,7 +11,7 @@ vendorurl=http://port389.org
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=1
-VERSION_MAINT=36
+VERSION_MAINT=37
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
commit 9ea342d2e63ca060bf6a7f195610815c29b99550
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 13:56:31 2015 -0800
Ticket #47995 - Admin Server: source code cleaning
Description: Removing unnecessary full path. Note: it's in the
DEBUG_TRACE which is not enabled.
https://fedorahosted.org/389/ticket/47995
diff --git a/lib/libadmin/httpcon.c b/lib/libadmin/httpcon.c
index 4bc5abe..24a39e1 100644
--- a/lib/libadmin/httpcon.c
+++ b/lib/libadmin/httpcon.c
@@ -69,7 +69,8 @@ extern void SEC_Init(void);
#ifdef DEBUG_TRACE
FILE *dbf = NULL;
int numconns = 0;
-char *dbd = "/tmp/http_trace.%d";
+/* Replace '/path/to' with a real path when DEBUG_TRACE is enabled. */
+char *dbd = "/path/to/http_trace.%d";
char dbp[256];
#endif
1
0
admserv/newinst/src/AdminServer.pm.in | 44 +++++++++++++++++++++++-------
admserv/newinst/src/setup-ds-admin.res.in | 2 +
2 files changed, 36 insertions(+), 10 deletions(-)
New commits:
commit 894e5b9a64c2edaea6f1a1ef089015a1920169df
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 20 13:18:59 2015 -0800
Ticket 47891 - Admin Server reconfig breaks SSL config
Description:
1) Use mkdtemp to reduce the risk to disclose the sec file backup
location that is in the same file system as the original files
exist.
2) reconfig_backup_secfiles and reconfig_restore_secfiles expect
the admin config dir, e.g., "/etc/dirsrv/admin-serv" or the dir
specified by the environment variable.
3) Update (--update) did not call reconfig_restore_secfiles in which
restores and delete the backup dir.
4) If creating or accessing the sec backup dir fails, it issues a
fatal error and quits the reconfiguration.
https://fedorahosted.org/389/ticket/47891
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/admserv/newinst/src/AdminServer.pm.in b/admserv/newinst/src/AdminServer.pm.in
index a189c66..0c98a6e 100644
--- a/admserv/newinst/src/AdminServer.pm.in
+++ b/admserv/newinst/src/AdminServer.pm.in
@@ -30,8 +30,11 @@ require Exporter;
use File::Path;
use File::Copy;
+use File::Basename;
+use File::Temp;
-my $secfile_backup_dir = "/tmp/adm-sec-files." . $$;
+my $template_backup_dir = "tmpdirXXXX";
+my $secfile_backup_dir = "";
# tempfiles
use File::Temp qw(tempfile tempdir);
@@ -515,8 +518,12 @@ sub reconfig_backup_secfiles
#
my $configdir = shift;
+ my $dirname = dirname $configdir;
+ my $my_template_backup_dir = $dirname . "/" . $template_backup_dir;
+ $secfile_backup_dir = mkdtemp($my_template_backup_dir);
if ( ! -d $secfile_backup_dir){
- mkdir ($secfile_backup_dir, 0755);
+ $setup->msg($FATAL, 'error_creating_secfile_backup', $secfile_backup_dir, $!);
+ return 0;
}
foreach my $savefile (@reconfigsavefiles) {
if ( -e "$configdir/$savefile"){
@@ -527,6 +534,7 @@ sub reconfig_backup_secfiles
}
}
}
+ return 1;
}
sub reconfig_restore_secfiles
@@ -536,11 +544,16 @@ sub reconfig_restore_secfiles
#
my $configdir = shift;
+ if ( ! -d $secfile_backup_dir){
+ $setup->msg($FATAL, 'error_accessing_secfile_backup', $secfile_backup_dir);
+ return 0;
+ }
foreach my $savefile (@reconfigsavefiles) {
move ("$secfile_backup_dir/$savefile" ,"$configdir/$savefile");
debug(1, "Restoring $configdir/$savefile with $secfile_backup_dir/$savefile\n");
}
rmdir ($secfile_backup_dir);
+ return 1;
}
sub createAdminServer {
@@ -548,13 +561,6 @@ sub createAdminServer {
my $reconfig = shift;
# setup has inf, res, and log
- if ($reconfig) {
- $setup->msg('begin_reconfig_adminserver');
- reconfig_backup_secfiles($setup->{inf}->{admin}->{config_dir});
- } else {
- $setup->msg('begin_create_adminserver');
- }
-
if (!setDefaults($setup)) {
return 0;
}
@@ -578,6 +584,15 @@ sub createAdminServer {
$ENV{ADMSERV_PID_DIR} ||
"@piddir@";
+ if ($reconfig) {
+ $setup->msg('begin_reconfig_adminserver');
+ if (!reconfig_backup_secfiles($configdir)) {
+ return 0;
+ }
+ } else {
+ $setup->msg('begin_create_adminserver');
+ }
+
# if we're just doing the update, just register and return
if ($setup->{update}) {
if (!registerASWithConfigDS($setup, $configdir)) {
@@ -587,6 +602,13 @@ sub createAdminServer {
# Update SELinux policy if needed
updateSelinuxPolicy($setup, $configdir, $securitydir, $logdir, $rundir);
+ # Restore the security files before we start the server
+ if ($reconfig) {
+ if (!reconfig_restore_secfiles($configdir)) {
+ return 0;
+ }
+ }
+
return 1;
}
@@ -619,7 +641,9 @@ sub createAdminServer {
# Restore the security files before we start the server
if ($reconfig) {
- reconfig_restore_secfiles($setup->{inf}->{admin}->{config_dir});
+ if (!reconfig_restore_secfiles($configdir)) {
+ return 0;
+ }
}
if (!startAdminServer($setup, $configdir, $logdir, $rundir)) {
diff --git a/admserv/newinst/src/setup-ds-admin.res.in b/admserv/newinst/src/setup-ds-admin.res.in
index e83d045..b03bc0c 100644
--- a/admserv/newinst/src/setup-ds-admin.res.in
+++ b/admserv/newinst/src/setup-ds-admin.res.in
@@ -161,3 +161,5 @@ error_removing_port_label = Error: could not remove selinux label from port '%s'
error_product_already_exists = Error: the product %s already exists.\
If you want to delete this entry and force the conversion of the older\
product, run this program again with the --force option.\n\n
+error_creating_secfile_backup = Could not create temporary directory %s to backup security files. Error: %s\n
+error_accessing_secfile_backup = Could not access temporary directory %s to restore security files.\n
1
0
Branch '389-ds-base-1.3.3' - aclocal.m4 config.guess config.sub dirsrvtests/tickets ldap/admin ldap/ldif ldap/servers Makefile.am Makefile.in
by Mark Reynolds 20 Jan '15
by Mark Reynolds 20 Jan '15
20 Jan '15
Makefile.am | 14
Makefile.in | 104 ++--
aclocal.m4 | 15
config.guess | 192 +-------
config.sub | 40 +
dirsrvtests/tickets/ticket47462_test.py | 452 +++++++++++++++++++
ldap/admin/src/scripts/50AES-pbe-plugin.ldif | 16
ldap/admin/src/scripts/52updateAESplugin.pl | 84 +++
ldap/ldif/50replication-plugins.ldif | 2
ldap/ldif/template-dse.ldif.in | 16
ldap/servers/plugins/rever/des.c | 551 -----------------------
ldap/servers/plugins/rever/pbe.c | 621 +++++++++++++++++++++++++++
ldap/servers/plugins/rever/rever.c | 116 +++--
ldap/servers/plugins/rever/rever.h | 11
ldap/servers/slapd/daemon.c | 244 ++++++++++
ldap/servers/slapd/proto-slap.h | 1
ldap/servers/slapd/pw.c | 82 ++-
ldap/servers/slapd/pw.h | 2
ldap/servers/slapd/result.c | 3
ldap/servers/slapd/security_wrappers.c | 6
ldap/servers/slapd/slap.h | 10
ldap/servers/slapd/slapi-plugin.h | 1
ldap/servers/slapd/ssl.c | 4
23 files changed, 1731 insertions(+), 856 deletions(-)
New commits:
commit 603501ec6bbe6ee9b3f033e924a4eef2a4925aa7
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 10:59:05 2015 -0500
Ticket 47462 - Stop using DES in the reversible password
encryption plug-in
Bug Description: DES is not a safe cipher to use for Password Based Encryption(pbe).
AES should be used instead.
Fix Description: Use AES for all new password encodings. AES requires that the
algorithm ID used to encode the password, must also be used to
decode it. So, the algorithm ID is now stored in the cipher prefix:
{AES-<BASE64 encoded alg ID>}<ENCODED PASSWORD>
Since DES is no longer being used, the library has been renamed to a
more apprpriate name:
libdes-plugin -> libpbe-plugin
During upgrades the DES plugin entry has its library path updated
to use libpbe-plugin. The MMR plugin changes its dependency from
DES to AES, and the AES plugin entry is added, and all the password
attributes found in the old DES Plugin are migrated over to the new
AES Plugin entry.
When the server is restarted it checks for any DES passwords in the
database and cn=config. If any are found they are converted to AES,
and the DES plugin is disabled.
Also created a new operation flag: SLAPI_OP_FLAG_IGNORE_UNINDEXED
This flag prevents an internal unnidexed search from being logged
in the "errors" log. When the server starts up it can potentially
do unindexed searches while looking for DES passwords. We don't
want this log "noise" in the errors log everytime the server starts.
https://fedorahosted.org/389/ticket/47462
Design Doc: http://www.port389.org/docs/389ds/design/pbe.html
Valgrind: Passed
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit a57494fcaffccb6fdd060a93ba605d432e38bc09)
diff --git a/Makefile.am b/Makefile.am
index 049ff74..17aadff 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -225,7 +225,7 @@ endif
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -583,7 +583,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -1016,14 +1018,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
diff --git a/Makefile.in b/Makefile.in
index 24a9ddf..dff7462 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -396,15 +396,6 @@ libderef_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libderef_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
-libdes_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
-am_libdes_plugin_la_OBJECTS = \
- ldap/servers/plugins/rever/libdes_plugin_la-des.lo \
- ldap/servers/plugins/rever/libdes_plugin_la-rever.lo
-libdes_plugin_la_OBJECTS = $(am_libdes_plugin_la_OBJECTS)
-libdes_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
- $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libdes_plugin_la_LDFLAGS) $(LDFLAGS) \
- -o $@
libdistrib_plugin_la_DEPENDENCIES = libslapd.la
am_libdistrib_plugin_la_OBJECTS = \
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo
@@ -548,6 +539,15 @@ libpassthru_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libpassthru_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
+libpbe_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
+am_libpbe_plugin_la_OBJECTS = \
+ ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo \
+ ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo
+libpbe_plugin_la_OBJECTS = $(am_libpbe_plugin_la_OBJECTS)
+libpbe_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+ $(AM_CFLAGS) $(CFLAGS) $(libpbe_plugin_la_LDFLAGS) $(LDFLAGS) \
+ -o $@
libposix_winsync_plugin_la_DEPENDENCIES = libslapd.la \
$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1)
am_libposix_winsync_plugin_la_OBJECTS = ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo \
@@ -1154,14 +1154,13 @@ SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1190,14 +1189,13 @@ DIST_SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1637,7 +1635,7 @@ server_LTLIBRARIES = libslapd.la libns-dshttpd.la
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -1991,7 +1989,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -2363,14 +2363,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
@@ -3596,21 +3596,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: \
libderef-plugin.la: $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_DEPENDENCIES) $(EXTRA_libderef_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libderef_plugin_la_LINK) -rpath $(serverplugindir) $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_LIBADD) $(LIBS)
-ldap/servers/plugins/rever/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever
- @: > ldap/servers/plugins/rever/$(am__dirstamp)
-ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
- @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-
-libdes-plugin.la: $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_DEPENDENCIES) $(EXTRA_libdes_plugin_la_DEPENDENCIES)
- $(AM_V_CCLD)$(libdes_plugin_la_LINK) -rpath $(serverplugindir) $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/distrib/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/distrib
@: > ldap/servers/plugins/distrib/$(am__dirstamp)
@@ -3900,6 +3885,21 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: \
libpassthru-plugin.la: $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_DEPENDENCIES) $(EXTRA_libpassthru_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libpassthru_plugin_la_LINK) -rpath $(serverplugindir) $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_LIBADD) $(LIBS)
+ldap/servers/plugins/rever/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever
+ @: > ldap/servers/plugins/rever/$(am__dirstamp)
+ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
+ @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+
+libpbe-plugin.la: $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_DEPENDENCIES) $(EXTRA_libpbe_plugin_la_DEPENDENCIES)
+ $(AM_V_CCLD)$(libpbe_plugin_la_LINK) -rpath $(serverplugindir) $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/posix-winsync/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/posix-winsync
@: > ldap/servers/plugins/posix-winsync/$(am__dirstamp)
@@ -5441,8 +5441,8 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_po.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_rootdse.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_trim.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_cache.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_plugin.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rootdn_access/$(DEPDIR)/librootdn_access_plugin_la-rootdn_access.Plo@am__quote@
@@ -6739,20 +6739,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: ldap/servers/plugins/der
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libderef_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/deref/libderef_plugin_la-deref.lo `test -f 'ldap/servers/plugins/deref/deref.c' || echo '$(srcdir)/'`ldap/servers/plugins/deref/deref.c
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-des.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/des.c' object='ldap/servers/plugins/rever/libdes_plugin_la-des.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libdes_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo: ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdistrib_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo -MD -MP -MF ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo -c -o ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo `test -f 'ldap/servers/plugins/distrib/distrib.c' || echo '$(srcdir)/'`ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Plo
@@ -6991,6 +6977,20 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: ldap/servers/plug
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpassthru_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo `test -f 'ldap/servers/plugins/passthru/ptutil.c' || echo '$(srcdir)/'`ldap/servers/plugins/passthru/ptutil.c
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/pbe.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+
ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo: ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libposix_winsync_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo -MD -MP -MF ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo -c -o ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo `test -f 'ldap/servers/plugins/posix-winsync/posix-winsync.c' || echo '$(srcdir)/'`ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Plo
diff --git a/aclocal.m4 b/aclocal.m4
index 8136dd1..7afd01a 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -220,6 +220,21 @@ m4_popdef([pkg_default])
m4_popdef([pkg_description])
]) dnl PKG_NOARCH_INSTALLDIR
+
+# PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+# -------------------------------------------
+# Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])# PKG_CHECK_VAR
+
# Copyright (C) 2002-2013 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
diff --git a/config.guess b/config.guess
index b79252d..1f5c50c 100755
--- a/config.guess
+++ b/config.guess
@@ -1,8 +1,8 @@
#! /bin/sh
# Attempt to guess a canonical system name.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-06-10'
+timestamp='2014-03-23'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -50,7 +50,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -149,7 +149,7 @@ Linux|GNU|GNU/*)
LIBC=gnu
#endif
EOF
- eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+ eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
;;
esac
@@ -826,7 +826,7 @@ EOF
*:MINGW*:*)
echo ${UNAME_MACHINE}-pc-mingw32
exit ;;
- i*:MSYS*:*)
+ *:MSYS*:*)
echo ${UNAME_MACHINE}-pc-msys
exit ;;
i*:windows32*:*)
@@ -969,10 +969,10 @@ EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
;;
- or1k:Linux:*:*)
- echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+ openrisc*:Linux:*:*)
+ echo or1k-unknown-linux-${LIBC}
exit ;;
- or32:Linux:*:*)
+ or32:Linux:*:* | or1k*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
padre:Linux:*:*)
@@ -1260,16 +1260,26 @@ EOF
if test "$UNAME_PROCESSOR" = unknown ; then
UNAME_PROCESSOR=powerpc
fi
- if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
- if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
- (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
- grep IS_64BIT_ARCH >/dev/null
- then
- case $UNAME_PROCESSOR in
- i386) UNAME_PROCESSOR=x86_64 ;;
- powerpc) UNAME_PROCESSOR=powerpc64 ;;
- esac
+ if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
+ if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+ if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+ grep IS_64BIT_ARCH >/dev/null
+ then
+ case $UNAME_PROCESSOR in
+ i386) UNAME_PROCESSOR=x86_64 ;;
+ powerpc) UNAME_PROCESSOR=powerpc64 ;;
+ esac
+ fi
fi
+ elif test "$UNAME_PROCESSOR" = i386 ; then
+ # Avoid executing cc on OS X 10.9, as it ships with a stub
+ # that puts up a graphical alert prompting to install
+ # developer tools. Any system running Mac OS X 10.7 or
+ # later (Darwin 11 and later) is required to have a 64-bit
+ # processor. This is not true of the ARM version of Darwin
+ # that Apple uses in portable devices.
+ UNAME_PROCESSOR=x86_64
fi
echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
exit ;;
@@ -1361,154 +1371,6 @@ EOF
exit ;;
esac
-eval $set_cc_for_build
-cat >$dummy.c <<EOF
-#ifdef _SEQUENT_
-# include <sys/types.h>
-# include <sys/utsname.h>
-#endif
-main ()
-{
-#if defined (sony)
-#if defined (MIPSEB)
- /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed,
- I don't know.... */
- printf ("mips-sony-bsd\n"); exit (0);
-#else
-#include <sys/param.h>
- printf ("m68k-sony-newsos%s\n",
-#ifdef NEWSOS4
- "4"
-#else
- ""
-#endif
- ); exit (0);
-#endif
-#endif
-
-#if defined (__arm) && defined (__acorn) && defined (__unix)
- printf ("arm-acorn-riscix\n"); exit (0);
-#endif
-
-#if defined (hp300) && !defined (hpux)
- printf ("m68k-hp-bsd\n"); exit (0);
-#endif
-
-#if defined (NeXT)
-#if !defined (__ARCHITECTURE__)
-#define __ARCHITECTURE__ "m68k"
-#endif
- int version;
- version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
- if (version < 4)
- printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
- else
- printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
- exit (0);
-#endif
-
-#if defined (MULTIMAX) || defined (n16)
-#if defined (UMAXV)
- printf ("ns32k-encore-sysv\n"); exit (0);
-#else
-#if defined (CMU)
- printf ("ns32k-encore-mach\n"); exit (0);
-#else
- printf ("ns32k-encore-bsd\n"); exit (0);
-#endif
-#endif
-#endif
-
-#if defined (__386BSD__)
- printf ("i386-pc-bsd\n"); exit (0);
-#endif
-
-#if defined (sequent)
-#if defined (i386)
- printf ("i386-sequent-dynix\n"); exit (0);
-#endif
-#if defined (ns32000)
- printf ("ns32k-sequent-dynix\n"); exit (0);
-#endif
-#endif
-
-#if defined (_SEQUENT_)
- struct utsname un;
-
- uname(&un);
-
- if (strncmp(un.version, "V2", 2) == 0) {
- printf ("i386-sequent-ptx2\n"); exit (0);
- }
- if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
- printf ("i386-sequent-ptx1\n"); exit (0);
- }
- printf ("i386-sequent-ptx\n"); exit (0);
-
-#endif
-
-#if defined (vax)
-# if !defined (ultrix)
-# include <sys/param.h>
-# if defined (BSD)
-# if BSD == 43
- printf ("vax-dec-bsd4.3\n"); exit (0);
-# else
-# if BSD == 199006
- printf ("vax-dec-bsd4.3reno\n"); exit (0);
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# endif
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# else
- printf ("vax-dec-ultrix\n"); exit (0);
-# endif
-#endif
-
-#if defined (alliant) && defined (i860)
- printf ("i860-alliant-bsd\n"); exit (0);
-#endif
-
- exit (1);
-}
-EOF
-
-$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
- { echo "$SYSTEM_NAME"; exit; }
-
-# Apollos put the system type in the environment.
-
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
-
-# Convex versions that predate uname can use getsysinfo(1)
-
-if [ -x /usr/convex/getsysinfo ]
-then
- case `getsysinfo -f cpu_type` in
- c1*)
- echo c1-convex-bsd
- exit ;;
- c2*)
- if getsysinfo -f scalar_acc
- then echo c32-convex-bsd
- else echo c2-convex-bsd
- fi
- exit ;;
- c34*)
- echo c34-convex-bsd
- exit ;;
- c38*)
- echo c38-convex-bsd
- exit ;;
- c4*)
- echo c4-convex-bsd
- exit ;;
- esac
-fi
-
cat >&2 <<EOF
$0: unable to guess system type
diff --git a/config.sub b/config.sub
index c765b34..66c5074 100755
--- a/config.sub
+++ b/config.sub
@@ -1,8 +1,8 @@
#! /bin/sh
# Configuration validation subroutine script.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-04-24'
+timestamp='2014-07-28'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -68,7 +68,7 @@ Report bugs and patches to <config-patches(a)gnu.org>."
version="\
GNU config.sub ($timestamp)
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -257,7 +257,7 @@ case $basic_machine in
| avr | avr32 \
| be32 | be64 \
| bfin \
- | c4x | clipper \
+ | c4x | c8051 | clipper \
| d10v | d30v | dlx | dsp16xx \
| epiphany \
| fido | fr30 | frv \
@@ -265,6 +265,7 @@ case $basic_machine in
| hexagon \
| i370 | i860 | i960 | ia64 \
| ip2k | iq2000 \
+ | k1om \
| le32 | le64 \
| lm32 \
| m32c | m32r | m32rle | m68000 | m68k | m88k \
@@ -282,8 +283,10 @@ case $basic_machine in
| mips64vr5900 | mips64vr5900el \
| mipsisa32 | mipsisa32el \
| mipsisa32r2 | mipsisa32r2el \
+ | mipsisa32r6 | mipsisa32r6el \
| mipsisa64 | mipsisa64el \
| mipsisa64r2 | mipsisa64r2el \
+ | mipsisa64r6 | mipsisa64r6el \
| mipsisa64sb1 | mipsisa64sb1el \
| mipsisa64sr71k | mipsisa64sr71kel \
| mipsr5900 | mipsr5900el \
@@ -295,8 +298,7 @@ case $basic_machine in
| nds32 | nds32le | nds32be \
| nios | nios2 | nios2eb | nios2el \
| ns16k | ns32k \
- | open8 \
- | or1k | or32 \
+ | open8 | or1k | or1knd | or32 \
| pdp10 | pdp11 | pj | pjl \
| powerpc | powerpc64 | powerpc64le | powerpcle \
| pyramid \
@@ -324,7 +326,7 @@ case $basic_machine in
c6x)
basic_machine=tic6x-unknown
;;
- m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip)
+ m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
basic_machine=$basic_machine-unknown
os=-none
;;
@@ -372,7 +374,7 @@ case $basic_machine in
| be32-* | be64-* \
| bfin-* | bs2000-* \
| c[123]* | c30-* | [cjt]90-* | c4x-* \
- | clipper-* | craynv-* | cydra-* \
+ | c8051-* | clipper-* | craynv-* | cydra-* \
| d10v-* | d30v-* | dlx-* \
| elxsi-* \
| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
@@ -381,6 +383,7 @@ case $basic_machine in
| hexagon-* \
| i*86-* | i860-* | i960-* | ia64-* \
| ip2k-* | iq2000-* \
+ | k1om-* \
| le32-* | le64-* \
| lm32-* \
| m32c-* | m32r-* | m32rle-* \
@@ -400,8 +403,10 @@ case $basic_machine in
| mips64vr5900-* | mips64vr5900el-* \
| mipsisa32-* | mipsisa32el-* \
| mipsisa32r2-* | mipsisa32r2el-* \
+ | mipsisa32r6-* | mipsisa32r6el-* \
| mipsisa64-* | mipsisa64el-* \
| mipsisa64r2-* | mipsisa64r2el-* \
+ | mipsisa64r6-* | mipsisa64r6el-* \
| mipsisa64sb1-* | mipsisa64sb1el-* \
| mipsisa64sr71k-* | mipsisa64sr71kel-* \
| mipsr5900-* | mipsr5900el-* \
@@ -413,6 +418,7 @@ case $basic_machine in
| nios-* | nios2-* | nios2eb-* | nios2el-* \
| none-* | np1-* | ns16k-* | ns32k-* \
| open8-* \
+ | or1k*-* \
| orion-* \
| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
@@ -794,7 +800,7 @@ case $basic_machine in
os=-mingw64
;;
mingw32)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-mingw32
;;
mingw32ce)
@@ -822,6 +828,10 @@ case $basic_machine in
basic_machine=powerpc-unknown
os=-morphos
;;
+ moxiebox)
+ basic_machine=moxie-unknown
+ os=-moxiebox
+ ;;
msdos)
basic_machine=i386-pc
os=-msdos
@@ -830,7 +840,7 @@ case $basic_machine in
basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
;;
msys)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-msys
;;
mvs)
@@ -1367,14 +1377,14 @@ case $os in
| -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
| -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
| -linux-newlib* | -linux-musl* | -linux-uclibc* \
- | -uxpv* | -beos* | -mpeix* | -udk* \
+ | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
| -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
| -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
| -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
| -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
| -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
| -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
- | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
+ | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
# Remember, each alternative MUST END IN *, to match a version number.
;;
-qnx*)
@@ -1546,6 +1556,9 @@ case $basic_machine in
c4x-* | tic4x-*)
os=-coff
;;
+ c8051-*)
+ os=-elf
+ ;;
hexagon-*)
os=-elf
;;
@@ -1589,9 +1602,6 @@ case $basic_machine in
mips*-*)
os=-elf
;;
- or1k-*)
- os=-elf
- ;;
or32-*)
os=-coff
;;
diff --git a/dirsrvtests/tickets/ticket47462_test.py b/dirsrvtests/tickets/ticket47462_test.py
new file mode 100644
index 0000000..a909b37
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47462_test.py
@@ -0,0 +1,452 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import time
+import logging
+import pytest
+import re
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+from lib389._constants import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
+installation1_prefix = None
+installation2_prefix = None
+
+DES_PLUGIN = 'cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config'
+AES_PLUGIN = 'cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config'
+MMR_PLUGIN = 'cn=Multimaster Replication Plugin,cn=plugins,cn=config'
+AGMT_DN = ''
+USER_DN = 'cn=test_user,' + DEFAULT_SUFFIX
+USER1_DN = 'cn=test_user1,' + DEFAULT_SUFFIX
+TEST_REPL_DN = 'cn=test repl,' + DEFAULT_SUFFIX
+
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ At the beginning, It may exists a master2 instance and/or a master2 instance.
+ It may also exists a backup for the master1 and/or the master2.
+
+ Principle:
+ If master1 instance exists:
+ restart it
+ If master2 instance exists:
+ restart it
+ If backup of master1 AND backup of master2 exists:
+ create or rebind to master1
+ create or rebind to master2
+
+ restore master1 from backup
+ restore master2 from backup
+ else:
+ Cleanup everything
+ remove instances
+ remove backups
+ Create instances
+ Initialize replication
+ Create backups
+ '''
+ global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+ # Get the status of the backups
+ backup_master1 = master1.checkBackupFS()
+ backup_master2 = master2.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.stop(timeout=10)
+ master1.start(timeout=10)
+
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.stop(timeout=10)
+ master2.start(timeout=10)
+
+ if backup_master1 and backup_master2:
+ # The backups exist, assuming they are correct
+ # we just re-init the instances with them
+ if not instance_master1:
+ master1.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master1.open()
+
+ if not instance_master2:
+ master2.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master2.open()
+
+ # restore master1 from backup
+ master1.stop(timeout=10)
+ master1.restoreFS(backup_master1)
+ master1.start(timeout=10)
+
+ # restore master2 from backup
+ master2.stop(timeout=10)
+ master2.restoreFS(backup_master2)
+ master2.start(timeout=10)
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve master-consumer
+ # so we need to create everything
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove all the backups. So even if we have a specific backup file
+ # (e.g backup_master) we clear all backups that an instance my have created
+ if backup_master1:
+ master1.clearBackupFS()
+ if backup_master2:
+ master2.clearBackupFS()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ AGMT_DN = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ master1.agreement
+ if not AGMT_DN:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % AGMT_DN)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=DEFAULT_SUFFIX, host=master1.host, port=master1.port, properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(AGMT_DN)
+
+ # Check replication is working fine
+ master1.add_s(Entry((TEST_REPL_DN, {'objectclass': "top person".split(),
+ 'sn': 'test_repl',
+ 'cn': 'test_repl'})))
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication is not working!')
+ assert False
+
+ # Time to create the backups
+ master1.stop(timeout=10)
+ master1.backupfile = master1.backupFS()
+ master1.start(timeout=10)
+
+ master2.stop(timeout=10)
+ master2.backupfile = master2.backupFS()
+ master2.start(timeout=10)
+
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
+
+ #
+ # Here we have two instances master and consumer
+ # with replication working. Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyMaster1Master2(master1, master2)
+
+
+def test_ticket47462(topology):
+ """
+ Test that AES properly replaces DES during an update/restart, and that
+ replication also works correctly.
+ """
+
+ #
+ # First set config as if it's an older version. Set DES to use libdes-plugin,
+ # MMR to depend on DES, delete the existing AES plugin, and set a DES password
+ # for the replication agreement.
+ #
+
+ #
+ # Add an extra attribute to the DES plugin args
+ #
+ try:
+ topology.master1.modify_s(DES_PLUGIN,
+ [(ldap.MOD_REPLACE, 'nsslapd-pluginPath', 'libdes-plugin'),
+ (ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')])
+
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.master1.modify_s(MMR_PLUGIN,
+ [(ldap.MOD_DELETE, 'nsslapd-plugin-depends-on-named', 'AES')])
+
+ except ldap.NO_SUCH_ATTRIBUTE:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ #
+ # Delete the AES plugin
+ #
+ try:
+ topology.master1.delete_s(AES_PLUGIN)
+ except ldap.NO_SUCH_OBJECT:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to delete AES plugin, error: ' + e.message['desc'])
+ assert False
+
+ # restart the server so we must use DES plugin
+ topology.master1.restart(timeout=10)
+
+ #
+ # Get the agmt dn, and set the password
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'objectclass=nsDS5ReplicationAgreement')
+ if entry:
+ agmt_dn = entry[0].dn
+ log.info('Found agmt dn (%s)' % agmt_dn)
+ else:
+ log.fatal('No replication agreements!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ try:
+ properties = {RA_BINDPW: "password"}
+ topology.master1.agreement.setProperties(None, agmt_dn, None, properties)
+ log.info('Successfully modified replication agreement')
+ except ValueError:
+ log.error('Failed to update replica agreement: ' + AGMT_DN)
+ assert False
+
+ #
+ # Check replication works with the new DES password
+ #
+ try:
+ topology.master1.add_s(Entry((USER1_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER1_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed fo user1!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # Run the upgrade...
+ #
+ topology.master1.upgrade('online')
+ topology.master1.restart(timeout=10)
+ topology.master2.restart(timeout=10)
+
+ #
+ # Check that the restart converted existing DES credentials
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'nsDS5ReplicaCredentials=*')
+ if entry:
+ val = entry[0].getValue('nsDS5ReplicaCredentials')
+ if val.startswith('{AES-'):
+ log.info('The DES credentials have been converted to AES')
+ else:
+ log.fatal('Failed to convert credentials from DES to AES!')
+ assert False
+ else:
+ log.fatal('Failed to find any entries with nsDS5ReplicaCredentials ')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the AES plugin exists, and has all the attributes listed in DES plugin.
+ # The attributes might not be in the expected order so check all the attributes.
+ #
+ try:
+ entry = topology.master1.search_s(AES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginarg0', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg1', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg2', 'description'):
+ log.fatal('The AES plugin did not have the DES attribute copied over correctly')
+ assert False
+ else:
+ log.info('The AES plugin was correctly setup')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the MMR plugin was updated
+ #
+ try:
+ entry = topology.master1.search_s(MMR_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-plugin-depends-on-named', 'AES'):
+ log.fatal('The MMR Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The MMR plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the DES plugin was correctly updated
+ #
+ try:
+ entry = topology.master1.search_s(DES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginPath', 'libpbe-plugin'):
+ log.fatal('The DES Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The DES plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check replication one last time
+ #
+ try:
+ topology.master1.add_s(Entry((USER_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # If we got here the test passed
+ #
+ log.info('Test PASSED')
+
+
+def test_ticket47462_final(topology):
+ topology.master1.stop(timeout=10)
+ topology.master2.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation1_prefix
+ global installation2_prefix
+ installation1_prefix = None
+ installation2_prefix = None
+
+ topo = topology(True)
+ test_ticket47462(topo)
+
+if __name__ == '__main__':
+ run_isolated()
diff --git a/ldap/admin/src/scripts/50AES-pbe-plugin.ldif b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
new file mode 100644
index 0000000..564ceae
--- /dev/null
+++ b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
@@ -0,0 +1,16 @@
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginprecedence: 1
+nsslapd-pluginid: ID
+nsslapd-pluginDescription: DESC
+nsslapd-pluginVersion: PACKAGE_VERSION
+nsslapd-pluginVendor: VENDOR
diff --git a/ldap/admin/src/scripts/52updateAESplugin.pl b/ldap/admin/src/scripts/52updateAESplugin.pl
new file mode 100644
index 0000000..6a8a885
--- /dev/null
+++ b/ldap/admin/src/scripts/52updateAESplugin.pl
@@ -0,0 +1,84 @@
+use Mozilla::LDAP::Conn;
+use Mozilla::LDAP::Entry;
+use Mozilla::LDAP::Utils qw(normalizeDN);
+use Mozilla::LDAP::API qw(:constant ldap_url_parse ldap_explode_dn);
+use File::Basename;
+use File::Copy;
+use DSUtil qw(debug serverIsRunning);
+
+#
+# Check if there is a DES plugin and make sure the AES plugin contains the same attributes
+#
+sub runinst {
+ my ($inf, $inst, $dseldif, $conn) = @_;
+ my @attrs;
+ my @attrs_to_add;
+ my $aes_count = 0;
+ my $des_count = 0;
+ my $i = 0;
+
+ my $aes_dn = "cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $aes_entry = $conn->search($aes_dn, "base", "(cn=*)");
+ if (!$aes_entry) {
+ # No AES plugin - nothing to do
+ return ();
+ }
+
+ # We need to grab the AES plugin args...
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $aes_entry->getValues($argattr);
+ if($val ne ""){
+ $attrs[$aes_count] = $val;
+ $aes_count++;
+ } else {
+ last;
+ }
+ $i++;
+ }
+
+ # Grab the DES plugin
+ my $des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $des_entry = $conn->search($des_dn, "base", "(cn=*)");
+ if (!$des_entry) {
+ # No DES plugin - nothing to do
+ return ();
+ }
+
+ # We need to check the DES plugin args against the AES args.
+ $i = 0;
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $des_entry->getValues($argattr);
+ if($val eq ""){
+ last;
+ }
+ if(!($val ~~ @attrs) ){
+ $attrs_to_add[$des_count] = $val;
+ $des_count++;
+ }
+ $i++;
+ }
+
+ # Add the missing attributes to the AES plugin
+ if($#attrs_to_add >= 0){
+ foreach $val (@attrs_to_add){
+ $aes_entry->addValue("nsslapd-pluginarg" . $aes_count, $val);
+ $aes_count++;
+ }
+ $conn->update($aes_entry);
+ }
+
+ # Change replication plugin dependency from DES to AES
+ my $mmr_entry = $conn->search("cn=Multimaster Replication Plugin,cn=plugins,cn=config", "base", "(cn=*)");
+ $mmr_entry->removeValue("nsslapd-plugin-depends-on-named", "DES");
+ $mmr_entry->addValue("nsslapd-plugin-depends-on-named", "AES");
+ $conn->update($mmr_entry);
+
+ # Change the des plugin to use the new libpbe-plugin library
+ $des_entry->{"nsslapd-pluginPath"} = [ "libpbe-plugin" ];
+ $conn->update($des_entry);
+
+ return ();
+}
+
diff --git a/ldap/ldif/50replication-plugins.ldif b/ldap/ldif/50replication-plugins.ldif
index 0b4924c..71afbea 100644
--- a/ldap/ldif/50replication-plugins.ldif
+++ b/ldap/ldif/50replication-plugins.ldif
@@ -22,6 +22,6 @@ nsslapd-plugintype: object
nsslapd-pluginbetxn: on
nsslapd-pluginenabled: on
nsslapd-plugin-depends-on-named: ldbm database
-nsslapd-plugin-depends-on-named: DES
+nsslapd-plugin-depends-on-named: AES
nsslapd-plugin-depends-on-named: Class of Service
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index 720ebad..6acbfae 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -207,12 +207,26 @@ nsslapd-plugininitfunc: ns_mta_md5_pwd_storage_scheme_init
nsslapd-plugintype: pwdstoragescheme
nsslapd-pluginenabled: on
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginid: aes-storage-scheme
+nsslapd-pluginprecedence: 1
+
dn: cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config
objectclass: top
objectclass: nsSlapdPlugin
objectclass: extensibleObject
cn: DES
-nsslapd-pluginpath: libdes-plugin
+nsslapd-pluginpath: libpbe-plugin
nsslapd-plugininitfunc: des_init
nsslapd-plugintype: reverpwdstoragescheme
nsslapd-pluginenabled: on
diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c
deleted file mode 100644
index 73830f0..0000000
--- a/ldap/servers/plugins/rever/des.c
+++ /dev/null
@@ -1,551 +0,0 @@
-/** BEGIN COPYRIGHT BLOCK
- * This Program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; version 2 of the License.
- *
- * This Program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place, Suite 330, Boston, MA 02111-1307 USA.
- *
- * In addition, as a special exception, Red Hat, Inc. gives You the additional
- * right to link the code of this Program with code not covered under the GNU
- * General Public License ("Non-GPL Code") and to distribute linked combinations
- * including the two, subject to the limitations in this paragraph. Non-GPL Code
- * permitted under this exception must only link to the code of this Program
- * through those well defined interfaces identified in the file named EXCEPTION
- * found in the source code files (the "Approved Interfaces"). The files of
- * Non-GPL Code may instantiate templates or use macros or inline functions from
- * the Approved Interfaces without causing the resulting work to be covered by
- * the GNU General Public License. Only Red Hat, Inc. may make changes or
- * additions to the list of Approved Interfaces. You must obey the GNU General
- * Public License in all respects for all of the Program code and other code used
- * in conjunction with the Program except the Non-GPL Code covered by this
- * exception. If you modify this file, you may extend this exception to your
- * version of the file, but you are not obligated to do so. If you do not wish to
- * provide this exception without modification, you must delete this exception
- * statement from your version and license this file solely under the GPL without
- * exception.
- *
- *
- * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
- * Copyright (C) 2005 Red Hat, Inc.
- * All rights reserved.
- * END COPYRIGHT BLOCK **/
-
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-#endif
-
-/* from /usr/project/iplanet/ws/ds5.ke/ns/svrcore/pkcs7/tstarchive.c */
-
-#include <string.h>
-#include <stdio.h>
-
-#include <ldap.h>
-#include <nspr.h>
-#include <nss.h>
-#include <secmod.h>
-/*
-#include <secasn1.h>
-#include <secpkcs7.h>
-*/
-#include <key.h>
-#include <certdb.h>
-#include <cert.h>
-#include <svrcore.h>
-#include <secmodt.h>
-#include <prtypes.h>
-#include <seccomon.h>
-#include <pk11func.h>
-
-#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */
-#include "rever.h"
-#include <slap.h>
-#include "slapi-plugin.h"
-#include <uuid.h>
-
-
-struct pk11MechItem
-{
- CK_MECHANISM_TYPE type;
- const char *mechName;
-};
-static const struct pk11MechItem mymech = { CKM_DES_CBC, "DES CBC encryption" };
-
-
-static Slapi_Mutex *mylock = NULL;
-
-struct pk11ContextStore
-{
- PK11SlotInfo *slot;
- const struct pk11MechItem *mech;
-
- PK11SymKey *key;
- SECItem *params;
-
- int length;
- unsigned char *crypt;
-};
-
-static int encode_path(char *inPlain, char **outCipher, char *path);
-static int decode_path(char *inCipher, char **outPlain, char *path);
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path);
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
-static void freeDes(struct pk11ContextStore *out);
-
-void
-init_des_plugin()
-{
- mylock = slapi_new_mutex();
-}
-
-int
-encode(char *inPlain, char **outCipher)
-{
- return encode_path(inPlain, outCipher, NULL);
-}
-
-static int
-encode_path(char *inPlain, char **outCipher, char *path)
-{
- struct pk11ContextStore *context = NULL;
- int err;
-
- unsigned char *cipher = NULL;
- char *tmp = NULL;
- char *base = NULL;
-
-
- *outCipher = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* Try an encryption */
- if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success )
- {
- base = BTOA_DataToAscii(cipher, context->length);
- if ( base != NULL )
- {
- tmp = slapi_ch_malloc( 3 + strlen(REVER_SCHEME_NAME) + strlen(base));
- if ( tmp != NULL )
- {
- sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, REVER_SCHEME_NAME, PWD_HASH_PREFIX_END, base);
- *outCipher = tmp;
- tmp = NULL;
- err = 0;
- }
- PORT_Free(base);
- }
- }
- }
-
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-int
-decode(char *inCipher, char **outPlain)
-{
- return decode_path(inCipher, outPlain, NULL);
-}
-
-
-static int
-decode_path(char *inCipher, char **outPlain, char *path)
-{
- struct pk11ContextStore *context = NULL;
- char *plain= NULL;
- int err;
-
- unsigned char *base = NULL;
- int len = 0;
-
-
- *outPlain = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* it seems that there is memory leak in that function: bug 400170 */
-
- base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
- if ( base != NULL )
- {
- if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success )
- {
- *outPlain = plain;
- err = 0;
- }
- }
- }
-
- PORT_Free(base);
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-static void freeDes(struct pk11ContextStore *out)
-{
- if (out)
- {
- if (out->slot)
- slapd_pk11_freeSlot(out->slot);
- if (out->key)
- slapd_pk11_freeSymKey(out->key);
- if (out->params)
- SECITEM_FreeItem(out->params,PR_TRUE);
- if (out->crypt)
- free(out->crypt);
- }
-}
-
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path)
-{
- SVRCOREError err = SVRCORE_Success;
- struct pk11ContextStore *store = NULL;
- SECItem *pwitem = NULL;
- SECItem *result = NULL;
- SECAlgorithmID *algid = NULL;
- SECOidTag algoid;
- SECItem *salt = NULL;
- CK_MECHANISM pbeMech;
- CK_MECHANISM cryptoMech;
-
- char *configdir = NULL;
- char *iv = NULL;
-
- store = (struct pk11ContextStore*)slapi_ch_malloc(sizeof(*store));
- if (store == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- *out = store;
-
- /* Low-level init */
- store->slot = NULL;
- store->key = NULL;
- store->params = NULL;
- store->crypt = NULL;
-
- /* Use the tokenName to find a PKCS11 slot */
- store->slot = slapd_pk11_findSlotByName((char *)token);
- if (store->slot == NULL)
- {
- err = SVRCORE_NoSuchToken_Error;
- goto done;
- }
-
- /* Generate a key and parameters to do the encryption */
- store->mech = &mymech;
-
- /* Generate a unique id, used as salt for the key generation */
- if ( path == NULL )
- {
- configdir = config_get_configdir();
- if ( configdir == NULL )
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- }
- else
- {
- configdir = slapi_ch_strdup(path);
- }
- if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS )
- {
- slapi_ch_free((void**)&configdir);
- err = SVRCORE_System_Error;
- goto done;
- }
- slapi_ch_free((void**)&configdir);
-
- pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (pwitem == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- pwitem->type = siBuffer;
- pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if (pwitem->data == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)pwitem->data, iv);
- pwitem->len = strlen(iv) + 1;
-
- algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
-
- salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (salt == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- salt->type = siBuffer;
- salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if ( salt->data == NULL )
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)salt->data, iv);
- salt->len = strlen(iv) + 1;
-
- algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
-
- slapi_lock_mutex(mylock);
- store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
- if (store->key == 0)
- {
- slapi_unlock_mutex(mylock);
- err = SVRCORE_System_Error;
- goto done;
- }
-
- slapi_unlock_mutex(mylock);
- pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
- result = slapd_pk11_paramFromAlgid(algid);
- secoid_destroyAlgorithmID(algid, PR_TRUE);
- pbeMech.pParameter = result->data;
- pbeMech.ulParameterLen = result->len;
- if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
- PR_FALSE) != CKR_OK)
- {
- SECITEM_FreeItem(result, PR_TRUE);
- err = SVRCORE_System_Error;
- goto done;
- }
- SECITEM_FreeItem(result, PR_TRUE);
- SECITEM_FreeItem(pwitem, PR_TRUE);
- SECITEM_FreeItem(salt, PR_TRUE);
- store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (store->params == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- store->params->type = store->mech->type;
- store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
- if (store->params->data == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
- store->params->len = cryptoMech.ulParameterLen;
- PORT_Free(cryptoMech.pParameter);
-
-done:
- slapi_ch_free((void**)&iv);
- return (err);
-}
-
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
-{
- SVRCOREError err = SVRCORE_Success;
- unsigned char *plain = NULL;
- unsigned char *cipher_with_padding = NULL;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = len;
-
- /* store->length is the max. length of the returned clear text -
- must be >= length of crypted bytes - also must be a multiple
- of blocksize */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* plain will hold the returned clear text */
- plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!plain)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer holding the original cipher bytes, padded with
- zeros to a multiple of blocksize - do not need +1 since buffer is not
- a string */
- cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length);
- if (!cipher_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- memcpy(cipher_with_padding, cipher, len);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- /* warning - there is a purify UMR in the NSS des code - you may see it when the
- password is not a multiple of 8 bytes long */
- rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
- cipher_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- {
- *out = (char *)plain;
- }
- else
- {
- slapi_ch_free((void **)&plain);
- }
-
- slapi_ch_free((void **)&cipher_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
-{
- SVRCOREError err = SVRCORE_Success;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
- unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = strlen(clear);
-
- /* the size of the clear text buffer passed to the des encryption functions
- must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
- of this size, copy the clear text password into it, and pad the rest with
- zeros */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* store->crypt will hold the crypted password - it must be >= clear length */
- /* store->crypt is freed in NSS; let's not use slapi_ch_calloc */
- store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
- store->length+1);
- if (!store->crypt)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer big enough to hold the clear text password and padding */
- clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!clear_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- /* copy the clear text password into the buffer - the calloc insures the
- remainder is zero padded */
- strcpy((char *)clear_with_padding, clear);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
- clear_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- *out = store->crypt;
-
- slapi_ch_free((void **)&clear_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-/*
- The UUID name based generator was broken on x86 platforms. We use
- this to generate the password encryption key. During migration,
- we have to fix this so we can use the fixed generator. The env.
- var USE_BROKEN_UUID tells the uuid generator to use the old
- broken method to create the UUID. That will allow us to decrypt
- the password to the correct clear text, then we can turn off
- the broken method and use the fixed method to encrypt the
- password.
-*/
-char *
-migrateCredentials(char *oldpath, char *newpath, char *oldcred)
-{
- static char *useBrokenUUID = "USE_BROKEN_UUID=1";
- static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
- char *plain = NULL;
- char *cipher = NULL;
-
- init_des_plugin();
-
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
- NSS_NoDB_Init(NULL);
-
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(useBrokenUUID);
- }
-
- if ( decode_path(oldcred, &plain, oldpath) == 0 )
- {
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(disableBrokenUUID);
- }
- if ( encode_path(plain, &cipher, newpath) != 0 )
- return(NULL);
- else
- return(cipher);
- }
- else
- return(NULL);
-}
diff --git a/ldap/servers/plugins/rever/pbe.c b/ldap/servers/plugins/rever/pbe.c
new file mode 100644
index 0000000..abb8d1b
--- /dev/null
+++ b/ldap/servers/plugins/rever/pbe.c
@@ -0,0 +1,621 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This Program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; version 2 of the License.
+ *
+ * This Program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * In addition, as a special exception, Red Hat, Inc. gives You the additional
+ * right to link the code of this Program with code not covered under the GNU
+ * General Public License ("Non-GPL Code") and to distribute linked combinations
+ * including the two, subject to the limitations in this paragraph. Non-GPL Code
+ * permitted under this exception must only link to the code of this Program
+ * through those well defined interfaces identified in the file named EXCEPTION
+ * found in the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline functions from
+ * the Approved Interfaces without causing the resulting work to be covered by
+ * the GNU General Public License. Only Red Hat, Inc. may make changes or
+ * additions to the list of Approved Interfaces. You must obey the GNU General
+ * Public License in all respects for all of the Program code and other code used
+ * in conjunction with the Program except the Non-GPL Code covered by this
+ * exception. If you modify this file, you may extend this exception to your
+ * version of the file, but you are not obligated to do so. If you do not wish to
+ * provide this exception without modification, you must delete this exception
+ * statement from your version and license this file solely under the GPL without
+ * exception.
+ *
+ *
+ * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
+ * Copyright (C) 2015 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <string.h>
+#include <stdio.h>
+
+#include <ldap.h>
+#include <nspr.h>
+#include <nss.h>
+#include <secmod.h>
+/*
+#include <secasn1.h>
+#include <secpkcs7.h>
+*/
+#include <key.h>
+#include <certdb.h>
+#include <cert.h>
+#include <svrcore.h>
+#include <secmodt.h>
+#include <prtypes.h>
+#include <seccomon.h>
+#include <pk11func.h>
+
+#define NEED_TOK_PBE /* see slap.h - defines tokPBE and ptokPBE */
+#include "rever.h"
+#include <slap.h>
+#include "slapi-plugin.h"
+#include <uuid.h>
+#include <plbase64.h>
+
+struct pk11MechItem
+{
+ CK_MECHANISM_TYPE type;
+ const char *mechName;
+};
+
+static const struct pk11MechItem DESmech = { CKM_DES_CBC, "DES CBC encryption" };
+static const struct pk11MechItem AESmech = { CKM_AES_CBC, "AES CBC encryption" };
+static Slapi_Mutex *pbe_lock = NULL;
+
+struct pk11ContextStore
+{
+ PK11SlotInfo *slot;
+ const struct pk11MechItem *mech;
+ PK11SymKey *key;
+ SECItem *params;
+ int length;
+ unsigned char *crypt;
+ char *algid_base64;
+};
+
+/*
+ * der_algid converting functions:
+ *
+ * SECStatus ATOB_ConvertAsciiToItem(SECItem *binary_item, const char *ascii);
+ * char * BTOA_ConvertItemToAscii(SECItem *binary_item);
+ *
+ */
+
+static int encode_path(char *inPlain, char **outCipher, char *path, int mech);
+static int decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid);
+static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *algid);
+static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
+static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
+static void freePBE(struct pk11ContextStore *store);
+
+void
+init_pbe_plugin()
+{
+ if(!pbe_lock){
+ pbe_lock = slapi_new_mutex();
+ }
+}
+
+int
+encode(char *inPlain, char **outCipher, int mech)
+{
+ return encode_path(inPlain, outCipher, NULL, mech);
+}
+
+static int
+encode_path(char *inPlain, char **outCipher, char *path, int mech)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *cipher = NULL;
+ char *tmp = NULL;
+ char *base = NULL;
+ int len = 0;
+ int err;
+
+ *outCipher = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, NULL) == SVRCORE_Success ){
+ /* Try an encryption */
+ if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ){
+ base = BTOA_DataToAscii(cipher, context->length);
+ if ( base != NULL ){
+ const char *scheme;
+ if (mech == AES_MECH){
+ scheme = AES_REVER_SCHEME_NAME;
+ len = 3 + strlen(scheme)+ strlen(context->algid_base64) + strlen(base) + 1;
+ if( (tmp = slapi_ch_malloc( len )) ){
+ /*
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ sprintf( tmp, "%c%s-%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ context->algid_base64,PWD_HASH_PREFIX_END, base);
+ }
+ } else {
+ /* Old school DES */
+ scheme = DES_REVER_SCHEME_NAME;
+ if((tmp = slapi_ch_malloc( 3 + strlen(scheme) + strlen(base)))){
+ sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ PWD_HASH_PREFIX_END, base);
+ }
+ }
+ if ( tmp != NULL ){
+ *outCipher = tmp;
+ tmp = NULL;
+ err = 0;
+ }
+ PORT_Free(base);
+ }
+ }
+ }
+ freePBE(context);
+
+ return(err);
+}
+
+int
+decode(char *inCipher, char **outPlain, int mech, char *algid)
+{
+ return decode_path(inCipher, outPlain, NULL, mech, algid);
+}
+
+
+static int
+decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *base = NULL;
+ char *plain = NULL;
+ int err;
+ int len = 0;
+
+ *outPlain = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, algid) == SVRCORE_Success ){
+ /* it seems that there is memory leak in that function: bug 400170 */
+ base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
+ if ( base != NULL ){
+ if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ){
+ *outPlain = plain;
+ err = 0;
+ }
+ }
+ }
+
+ slapi_ch_free_string(&algid);
+ PORT_Free(base);
+ PORT_FreeArena(arena, PR_TRUE);
+ freePBE(context);
+
+ return(err);
+}
+
+static void
+freePBE(struct pk11ContextStore *store)
+{
+ if (store){
+ if (store->slot)
+ slapd_pk11_freeSlot(store->slot);
+ if (store->key)
+ slapd_pk11_freeSymKey(store->key);
+ if (store->params)
+ SECITEM_FreeItem(store->params, PR_TRUE);
+ slapi_ch_free((void **)&store->crypt);
+ slapi_ch_free_string(&store->algid_base64);
+ slapi_ch_free((void **)&store);
+ }
+}
+
+static SVRCOREError
+genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *alg)
+{
+ SVRCOREError err = SVRCORE_Success;
+ struct pk11ContextStore *store = NULL;
+ SECItem *pwitem = NULL;
+ SECItem *result = NULL;
+ SECItem *salt = NULL;
+ SECItem der_algid;
+ SECAlgorithmID *algid = NULL;
+ SECOidTag algoid;
+ CK_MECHANISM pbeMech;
+ CK_MECHANISM cryptoMech;
+ SECAlgorithmID my_algid;
+ char *configdir = NULL;
+ char *der_ascii = NULL;
+ char *iv = NULL;
+ int free_it = 0;
+
+ arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+
+ store = (struct pk11ContextStore*)slapi_ch_calloc(1, sizeof(*store));
+ if (store == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ *out = store;
+
+ /* Use the tokenName to find a PKCS11 slot */
+ store->slot = slapd_pk11_findSlotByName((char *)token);
+ if (store->slot == NULL){
+ err = SVRCORE_NoSuchToken_Error;
+ goto done;
+ }
+
+ /* Generate a key and parameters to do the encryption */
+ if(mech == AES_MECH){
+ store->mech = &AESmech;
+ algoid = SEC_OID_AES_256_CBC;
+ } else {
+ store->mech = &DESmech;
+ algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
+ }
+
+ /* Generate a unique id, used as salt for the key generation */
+ if ( path == NULL ){
+ configdir = config_get_configdir();
+ if ( configdir == NULL ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ } else {
+ configdir = slapi_ch_strdup(path);
+ }
+ if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (pwitem == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ pwitem->type = siBuffer;
+ pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if (pwitem->data == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)pwitem->data, iv);
+ pwitem->len = strlen(iv) + 1;
+
+ salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (salt == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ salt->type = siBuffer;
+ salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if ( salt->data == NULL ){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)salt->data, iv);
+ salt->len = strlen(iv) + 1;
+
+ PORT_Memset(&der_algid, 0, sizeof(der_algid));
+ if(!alg){
+ /*
+ * This is DES, or we are encoding AES - the process is the same.
+ */
+ algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
+ free_it = 1; /* we need to free this algid */
+
+ /*
+ * The following is only need for AES - we need to store
+ * algid for future decodings(unlike with DES). So convert
+ * algid to its DER encoding. Then convert the DER to ascii,
+ * and finally convert the DER ascii to base64 so we can store
+ * it in the cipher prefix.
+ */
+ SEC_ASN1EncodeItem(arena, &der_algid, algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate));
+ der_ascii = BTOA_ConvertItemToAscii(&der_algid);
+ store->algid_base64 = PL_Base64Encode(der_ascii,strlen(der_ascii), NULL);
+ slapi_ch_free_string(&der_ascii);
+ } else {
+ /*
+ * We are decoding AES - use the supplied algid
+ */
+ PORT_Memset(&my_algid, 0, sizeof(my_algid));
+
+ /* Decode the base64 der encoding */
+ der_ascii = PL_Base64Decode(alg, strlen(alg), NULL);
+
+ /* convert the der ascii to the SEC item */
+ ATOB_ConvertAsciiToItem(&der_algid, der_ascii);
+ SEC_ASN1DecodeItem(arena, &my_algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate), &der_algid);
+ SECITEM_FreeItem(&der_algid, PR_FALSE);
+ algid = &my_algid;
+ slapi_ch_free_string(&der_ascii);
+ }
+
+ slapi_lock_mutex(pbe_lock);
+ store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
+ if (store->key == 0){
+ slapi_unlock_mutex(pbe_lock);
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ slapi_unlock_mutex(pbe_lock);
+
+ if(mech == AES_MECH)
+ {
+ cryptoMech.mechanism = PK11_GetPBECryptoMechanism(algid, &store->params, pwitem);
+ if (cryptoMech.mechanism == CKM_INVALID_MECHANISM) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ }
+ else
+ {
+ /* DES */
+ pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
+ result = slapd_pk11_paramFromAlgid(algid);
+ if(result){
+ pbeMech.pParameter = result->data;
+ pbeMech.ulParameterLen = result->len;
+ }
+ if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
+ PR_FALSE) != CKR_OK){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (store->params == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ store->params->type = store->mech->type;
+ store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
+ if (store->params->data == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
+ store->params->len = cryptoMech.ulParameterLen;
+ PORT_Free(cryptoMech.pParameter);
+ }
+
+done:
+ SECITEM_FreeItem(result, PR_TRUE);
+ SECITEM_FreeItem(pwitem, PR_TRUE);
+ SECITEM_FreeItem(salt, PR_TRUE);
+ if(free_it){
+ secoid_destroyAlgorithmID(algid, PR_TRUE);
+ }
+ slapi_ch_free_string(&configdir);
+ slapi_ch_free_string(&iv);
+ if (arena) {
+ PORT_FreeArena(arena, PR_TRUE);
+ }
+ return (err);
+}
+
+static SVRCOREError
+decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
+{
+ SVRCOREError err = SVRCORE_Success;
+ unsigned char *plain = NULL;
+ unsigned char *cipher_with_padding = NULL;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ int outLen = 0;
+ int blocksize = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = len;
+
+ /*
+ * store->length is the max. length of the returned clear text -
+ * must be >= length of crypted bytes - also must be a multiple
+ * of blocksize
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /* plain will hold the returned clear text */
+ plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!plain){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /*
+ * create a buffer holding the original cipher bytes, padded with
+ * zeros to a multiple of blocksize - do not need +1 since buffer is not
+ * a string
+ */
+ cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length);
+ if (!cipher_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ memcpy(cipher_with_padding, cipher, len);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ /*
+ * Warning - there is a purify UMR in the NSS des code - you may see it when the
+ * password is not a multiple of 8 bytes long
+ */
+ rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
+ cipher_with_padding, store->length);
+ if (rv){
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err))
+ err = SVRCORE_System_Error;
+
+done:
+ if (err == SVRCORE_Success){
+ *out = (char *)plain;
+ } else {
+ slapi_ch_free((void **)&plain);
+ }
+
+ slapi_ch_free((void **)&cipher_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+static SVRCOREError
+cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
+{
+ SVRCOREError err = SVRCORE_Success;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
+ int blocksize = 0;
+ int outLen = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = strlen(clear);
+
+ /*
+ * The size of the clear text buffer passed to the encryption functions
+ * must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
+ * of this size, copy the clear text password into it, and pad the rest with
+ * zeros.
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /*
+ * store->crypt will hold the crypted password - it must be >= clear length
+ * store->crypt is freed in NSS; let's not use slapi_ch_calloc
+ */
+ store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!store->crypt) {
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /* Create a buffer big enough to hold the clear text password and padding */
+ clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!clear_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ /*
+ * Copy the clear text password into the buffer - the calloc insures the
+ * remainder is zero padded .
+ */
+ strcpy((char *)clear_with_padding, clear);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
+ clear_with_padding, store->length);
+ if (rv) {
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err)){
+ err = SVRCORE_System_Error;
+ }
+
+done:
+ if (err == SVRCORE_Success){
+ *out = store->crypt;
+ }
+
+ slapi_ch_free((void **)&clear_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+/*
+ * The UUID name based generator was broken on x86 platforms. We use
+ * this to generate the password encryption key. During migration,
+ * we have to fix this so we can use the fixed generator. The env.
+ * var USE_BROKEN_UUID tells the uuid generator to use the old
+ * broken method to create the UUID. That will allow us to decrypt
+ * the password to the correct clear text, then we can turn off
+ * the broken method and use the fixed method to encrypt the
+ * password.
+ */
+char *
+migrateCredentials(char *oldpath, char *newpath, char *oldcred)
+{
+ static char *useBrokenUUID = "USE_BROKEN_UUID=1";
+ static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
+ char *plain = NULL;
+ char *cipher = NULL;
+
+ init_pbe_plugin();
+
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
+ NSS_NoDB_Init(NULL);
+
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(useBrokenUUID);
+ }
+
+ if ( decode_path(oldcred, &plain, oldpath, DES_MECH, NULL) == 0 ){
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(disableBrokenUUID);
+ }
+ if ( encode_path(plain, &cipher, newpath, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return(cipher);
+ }
+ } else {
+ return(NULL);
+ }
+}
diff --git a/ldap/servers/plugins/rever/rever.c b/ldap/servers/plugins/rever/rever.c
index 9d7e82d..51d602f 100644
--- a/ldap/servers/plugins/rever/rever.c
+++ b/ldap/servers/plugins/rever/rever.c
@@ -43,25 +43,92 @@
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
-
#include "rever.h"
-static Slapi_PluginDesc pdesc = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_aes = { "aes-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "AES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_des = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+
static char *plugin_name = "ReverStoragePlugin";
+#define AES_MECH 1
+#define DES_MECH 2
+
+int
+aes_cmp( char *userpwd, char *dbpwd )
+{
+ char *cipher = NULL;
+ int rc = 0;
+
+ if ( encode(userpwd, &cipher, AES_MECH) != 0 ){
+ rc = 1;
+ } else {
+ rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
+
+ return rc;
+}
+
+char *
+aes_enc( char *pwd )
+{
+ char *cipher = NULL;
+
+ if ( encode(pwd, &cipher, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return( cipher );
+ }
+}
+
+char *
+aes_dec( char *pwd, char *alg )
+{
+ char *plain = NULL;
+
+ if ( decode(pwd, &plain, AES_MECH, alg) != 0 ){
+ return(NULL);
+ } else {
+ return( plain );
+ }
+}
+
+int
+aes_init( Slapi_PBlock *pb)
+{
+ char *name = slapi_ch_strdup(AES_REVER_SCHEME_NAME);
+ int rc;
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> aes_init\n" );
+
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_aes );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) aes_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) aes_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) aes_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= aes_init %d\n", rc );
+
+ return( rc );
+}
+
int
des_cmp( char *userpwd, char *dbpwd )
{
char *cipher = NULL;
int rc = 0;
- if ( encode(userpwd, &cipher) != 0 )
+ if ( encode(userpwd, &cipher, DES_MECH) != 0 ){
rc = 1;
- else
+ } else {
rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
- slapi_ch_free((void**)&cipher);
return rc;
}
@@ -70,10 +137,11 @@ des_enc( char *pwd )
{
char *cipher = NULL;
- if ( encode(pwd, &cipher) != 0 )
+ if ( encode(pwd, &cipher, DES_MECH ) != 0 ){
return(NULL);
- else
+ } else {
return( cipher );
+ }
}
char *
@@ -81,37 +149,31 @@ des_dec( char *pwd )
{
char *plain = NULL;
- if ( decode(pwd, &plain) != 0 )
+ if ( decode(pwd, &plain, DES_MECH, NULL) != 0 ){
return(NULL);
- else
+ } else {
return( plain );
+ }
}
int
des_init( Slapi_PBlock *pb )
{
+ char *name = slapi_ch_strdup(DES_REVER_SCHEME_NAME);
int rc;
- char *name;
slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> des_init\n" );
- rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
- (void *) SLAPI_PLUGIN_VERSION_01 );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION,
- (void *)&pdesc );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN,
- (void *) des_enc);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN,
- (void *) des_cmp );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN,
- (void *) des_dec );
- name = slapi_ch_strdup(REVER_SCHEME_NAME);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME,
- name );
-
- init_des_plugin();
-
- slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n\n", rc );
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_des );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) des_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) des_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) des_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n", rc );
return( rc );
}
diff --git a/ldap/servers/plugins/rever/rever.h b/ldap/servers/plugins/rever/rever.h
index 8ea6279..9edddd8 100644
--- a/ldap/servers/plugins/rever/rever.h
+++ b/ldap/servers/plugins/rever/rever.h
@@ -49,7 +49,10 @@
#include "slap.h"
#include "ldaplog.h"
-#define REVER_SCHEME_NAME "DES"
+#define AES_MECH 1
+#define DES_MECH 2
+#define AES_REVER_SCHEME_NAME "AES"
+#define DES_REVER_SCHEME_NAME "DES"
#define PWD_HASH_PREFIX_START '{'
#define PWD_HASH_PREFIX_END '}'
@@ -58,10 +61,10 @@ int rever_cmp( char *userpwd, char *dbpwd );
char *rever_enc( char *pwd );
char *rever_dec( char *pwd );
int rever_init( Slapi_PBlock *pb );
-void init_des_plugin();
+void init_pbe_plugin();
-int encode(char *inPlain, char ** outCipher);
-int decode(char *inCipher, char **outPlain);
+int encode(char *inPlain, char **outCipher, int mech);
+int decode(char *inCipher, char **outPlain, int mech, char *algid);
char *migrateCredentials(char *oldpath, char *newpath, char *oldcred);
typedef char *(*migrate_fn_type)(char *, char *, char *);
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 0c11238..3cb8451 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -937,6 +937,244 @@ handle_listeners(Connection_Table *ct, listener_info *listener_idxs, int n_liste
return;
}
+/*
+ * Convert any pre-existing DES passwords to AES.
+ *
+ * Grab the "password" attributes and search all the backends for
+ * these attributes and convert them to AES if they are DES encoded.
+ */
+static void
+convert_pbe_des_to_aes()
+{
+ Slapi_PBlock *pb = NULL;
+ Slapi_Entry **entries = NULL;
+ struct slapdplugin *plugin = NULL;
+ char **attrs = NULL;
+ char **backends = NULL;
+ char *val = NULL;
+ int converted_des = 0;
+ int result = -1;
+ int have_aes = 0;
+ int have_des = 0;
+ int i = 0, ii = 0, be_idx = 0;
+
+ /*
+ * Check that AES plugin is enabled, and grab all the unique
+ * password attributes.
+ */
+ for ( plugin = get_plugin_list(PLUGIN_LIST_REVER_PWD_STORAGE_SCHEME);
+ plugin != NULL;
+ plugin = plugin->plg_next )
+ {
+ char *arg = NULL;
+
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "AES") == 0){
+ /* We have the AES plugin, and its enabled */
+ have_aes = 1;
+ }
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "DES") == 0){
+ /* We have the DES plugin, and its enabled */
+ have_des = 1;
+ }
+ /* Gather all the unique password attributes from all the PBE plugins */
+ for ( i = 0, arg = plugin->plg_argv[i];
+ i < plugin->plg_argc;
+ arg = plugin->plg_argv[++i] )
+ {
+ if(charray_inlist(attrs, arg)){
+ continue;
+ }
+ charray_add(&attrs, slapi_ch_strdup(arg));
+ }
+ }
+
+ if(have_aes && have_des){
+ /*
+ * Build a list of all the backend dn's
+ */
+ Slapi_Backend *be = NULL;
+ struct suffixlist *list;
+ char *cookie = NULL;
+
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Converting DES passwords to AES...\n",0,0,0);
+
+ be = slapi_get_first_backend(&cookie);
+ while (be){
+ int suffix_idx = 0;
+ int count = slapi_counter_get_value(be->be_suffixcounter);
+
+ list = be->be_suffixlist;
+ for (suffix_idx = 0; list && suffix_idx < count; suffix_idx++) {
+ char *suffix = (char *)slapi_sdn_get_ndn(list->be_suffix);
+ if(charray_inlist(backends, suffix) || strlen(suffix) == 0){
+ list = list->next;
+ continue;
+ }
+ charray_add(&backends, slapi_ch_strdup(suffix));
+ list = list->next;
+ }
+ be = slapi_get_next_backend (cookie);
+ }
+ slapi_ch_free ((void **)&cookie);
+
+ /*
+ * Search for the password attributes
+ */
+ for (i = 0; attrs && attrs[i]; i++){
+ char *filter = PR_smprintf("%s=*", attrs[i]);
+ /*
+ * Loop over all the backends looking for the password attribute
+ */
+ for(be_idx = 0; backends[be_idx]; be_idx++){
+ pb = slapi_pblock_new();
+ slapi_search_internal_set_pb(pb, backends[be_idx],
+ LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
+ (void *)plugin_get_default_component_id(),
+ SLAPI_OP_FLAG_IGNORE_UNINDEXED);
+ slapi_search_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to search for password on (%s) error (%d)\n",
+ backends[be_idx], result, 0);
+ goto done;
+ }
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
+ for (ii = 0; entries && entries[ii]; ii++){
+ if((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))){
+ if(strlen(val) >= 5 && strncmp(val,"{DES}", 5) == 0){
+ /*
+ * We have a DES encoded password, convert it AES
+ */
+ Slapi_PBlock *mod_pb = NULL;
+ Slapi_Value *sval = NULL;
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *passwd = NULL;
+
+ /* decode the DES password */
+ if(pw_rever_decode(val, &passwd, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to decode existing DES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* encode the password */
+ sval = slapi_value_new_string(passwd);
+ if(pw_rever_encode(&sval, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to encode AES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* replace the attribute in the entry */
+ replace_val[0] = (char *)slapi_value_get_string(sval);
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = attrs[i];
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ mod_pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(mod_pb, slapi_entry_get_dn(entries[ii]),
+ mods, 0, 0, (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(mod_pb);
+
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to convert password for (%s) error (%d)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = -1;
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "successfully converted password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = 1;
+
+ }
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ slapi_pblock_destroy(mod_pb);
+ if(result){
+ goto done;
+ }
+ }
+ slapi_ch_free_string(&val);
+ }
+ }
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+ pb = NULL;
+ }
+ slapi_ch_free_string(&filter);
+ }
+ }
+
+done:
+ charray_free(attrs);
+ charray_free(backends);
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+
+ if (have_aes && have_des){
+ /*
+ * If a conversion attempt did not fail, disable DES plugin
+ */
+ if(converted_des != -1){
+ /*
+ * Disable the DES plugin - this also prevents potentially expensive
+ * searches at every server startup.
+ */
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+
+ replace_val[0] = "off";
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = "nsslapd-pluginEnabled";
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(pb, des_dn, mods, 0, 0,
+ (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Failed to disable DES plugin (%s), error (%d)\n",
+ des_dn, result, 0);
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Successfully disabled DES plugin (%s)\n",
+ des_dn, 0, 0);
+ }
+ slapi_pblock_destroy(pb);
+ }
+ if(converted_des == 1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Finished - all DES passwords have been converted to AES.\n",
+ 0, 0, 0);
+ } else if (converted_des == 0){
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Finished - no DES passwords to convert.\n",0,0,0);
+ }
+ }
+}
+
void slapd_daemon( daemon_ports_t *ports )
{
/* We are passed some ports---one for regular connections, one
@@ -1140,7 +1378,6 @@ void slapd_daemon( daemon_ports_t *ports )
}
#endif /* ENABLE_LDAPI */
#endif
-
listener_idxs = (listener_info *)slapi_ch_calloc(n_listeners, sizeof(*listener_idxs));
/* Now we write the pid file, indicating that the server is finally and listening for connections */
write_pid_file();
@@ -1148,6 +1385,11 @@ void slapd_daemon( daemon_ports_t *ports )
/* The server is ready and listening for connections. Logging "slapd started" message. */
unfurl_banners(the_connection_table,ports,n_tcps,s_tcps,i_unix);
+ /*
+ * Convert old DES encoded passwords to AES
+ */
+ convert_pbe_des_to_aes();
+
/* The meat of the operation is in a loop on a call to select */
while(!g_get_shutdown())
{
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 48188ed..35b45e3 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1123,6 +1123,7 @@ void slapd_pk11_DestroyPublicKey(SECKEYPublicKey *key);
PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm);
PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx);
+CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem);
/*
* start_tls_extop.c
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 082f69a..43a11c7 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -384,9 +384,8 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
if ((!enc) && (( enc = (*pws_enc)( (char*)slapi_value_get_string(vals[ i ]) )) == NULL )) {
return( -1 );
}
-
- slapi_value_free(&vals[ i ]);
- vals[ i ] = slapi_value_new_string_passin(enc);
+ slapi_value_free(&vals[ i ]);
+ vals[ i ] = slapi_value_new_string_passin(enc);
}
return( 0 );
@@ -396,28 +395,57 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
* Check if the prefix of the cipher is the one that is supposed to be
* Extract from the whole cipher the encrypted password (remove the prefix)
*/
-int checkPrefix(char *cipher, char *schemaName, char **encrypt)
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid)
{
int namelen;
/* buf contains the extracted schema name */
char *end, buf[ 3*PWD_MAX_NAME_LEN + 1 ];
+ char *delim = NULL;
if ( (*cipher == PWD_HASH_PREFIX_START) &&
- ((end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) &&
- ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)) )
+ (end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL)
{
- memcpy( buf, cipher + 1, namelen );
- buf[ namelen ] = '\0';
- if ( strcasecmp( buf, schemaName) != 0 )
- {
- /* schema names are different, error */
- return 1;
- }
- else
- {
- /* extract the encrypted password */
- *encrypt = cipher + strlen(schemaName) + 2;
- return 0;
+ if((delim = strchr(cipher, PWD_PBE_DELIM)) != NULL){
+ /*
+ * We have an algid in the prefix:
+ *
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ if((namelen = delim - cipher - 1) <= (3*PWD_MAX_NAME_LEN)){
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+
+ if ( strcasecmp( buf, schemaName) != 0 ){
+ /* schema names are different, error */
+ return 1;
+ } else {
+ char algid_buf[256];
+
+ /* extract the algid (length is never greater than 216 */
+ memcpy(algid_buf, delim + 1 , (end - delim));
+ algid_buf[end - delim - 1] = '\0';
+ *algid = strdup(algid_buf);
+
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(*algid) + strlen (schemaName) + 3;
+ return 0;
+ }
+ }
+ } else if ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)){
+ /* no delimiter - must be old school DES */
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+ if ( strcasecmp( buf, schemaName) != 0 )
+ {
+ /* schema names are different, error */
+ return 1;
+ }
+ else
+ {
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(schemaName) + 2;
+ return 0;
+ }
}
}
/* cipher is not prefixed, already in clear ? */
@@ -443,6 +471,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
char *L_attr = NULL;
int i = 0;
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK = -1;
/* Get the appropriate decoding function */
@@ -450,10 +479,9 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
if (slapi_attr_types_equivalent(L_attr, attr_name))
{
- typedef char * (*ENCFP)(char *);
+ typedef char * (*ENCFP)(char *, char *);
pwsp = (struct pw_scheme *) slapi_ch_calloc (1, sizeof(struct pw_scheme));
-
pwsp->pws_dec = (ENCFP)p->plg_pwdstorageschemedec;
pwsp->pws_name = slapi_ch_strdup( p->plg_pwdstorageschemename );
pwsp->pws_len = strlen(pwsp->pws_name) ;
@@ -461,7 +489,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
/* check that the prefix of the cipher is the same name
as the scheme name */
- prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt);
+ prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt, &algid);
if ( prefixOK == -1 )
{
/* no prefix, already in clear ? */
@@ -471,13 +499,15 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
}
else if ( prefixOK == 1 )
{
- /* scheme names are different */
+ /* scheme names are different, try the next plugin */
ret_code = -1;
- goto free_and_return;
+ free_pw_scheme( pwsp );
+ pwsp = NULL;
+ continue;
}
else
{
- if ( ( *plain = (pwsp->pws_dec)( encrypt )) == NULL )
+ if ( ( *plain = (pwsp->pws_dec)( encrypt, algid )) == NULL )
{
/* pb during decoding */
ret_code = -1;
@@ -536,11 +566,13 @@ pw_rever_encode(Slapi_Value **vals, char * attr_name)
for ( i = 0; vals[i] != NULL; ++i )
{
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK;
prefixOK = checkPrefix((char*)slapi_value_get_string(vals[i]),
pwsp->pws_name,
- &encrypt);
+ &encrypt, &algid);
+ slapi_ch_free_string(&algid);
if ( prefixOK == 0 )
{
/* Don't touch already encoded value */
diff --git a/ldap/servers/slapd/pw.h b/ldap/servers/slapd/pw.h
index 7190a1d..79a90a0 100644
--- a/ldap/servers/slapd/pw.h
+++ b/ldap/servers/slapd/pw.h
@@ -61,7 +61,7 @@ struct pw_scheme *pw_name2scheme( char *name );
struct pw_scheme *pw_val2scheme( char *val, char **valpwdp, int first_is_default );
int pw_encodevals( Slapi_Value **vals );
int pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals );
-int checkPrefix(char *cipher, char *schemaName, char **encrypt);
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid);
struct passwordpolicyarray *new_passwdPolicy ( Slapi_PBlock *pb, const char *dn );
void delete_passwdPolicy( struct passwordpolicyarray **pwpolicy);
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 2198337..544a9c7 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -2083,7 +2083,8 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie
slapi_pblock_get( pb, SLAPI_OPERATION_TYPE, &optype );
if(optype == SLAPI_OPERATION_SEARCH && /* search, */
strcmp(notes_str,"") && /* that's unindexed, */
- !(config_get_accesslog_level() & LDAP_DEBUG_ARGS)) /* and not logged in access log */
+ !(config_get_accesslog_level() & LDAP_DEBUG_ARGS) && /* and not logged in access log */
+ !(op->o_flags & SLAPI_OP_FLAG_IGNORE_UNINDEXED) ) /* and not ignoring unindexed search */
{
struct slapdplugin *plugin = NULL;
struct slapi_componentid *cid = NULL;
diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c
index 33d512f..4ffda8b 100644
--- a/ldap/servers/slapd/security_wrappers.c
+++ b/ldap/servers/slapd/security_wrappers.c
@@ -409,3 +409,9 @@ PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot,
return PK11_TokenKeyGenWithFlags(slot, type, param, keySize, keyid,
opFlags, attrFlags, wincx);
}
+
+CK_MECHANISM_TYPE
+slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem)
+{
+ return PK11_GetPBECryptoMechanism(algid, params, pwitem );
+}
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index d234c13..3db8fe7 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -53,9 +53,9 @@
/* Used by SSL and DES plugin */
-#ifdef NEED_TOK_DES
-static char tokDes[34] = "Communicator Generic Crypto Svcs";
-static char ptokDes[34] = "Internal (Software) Token ";
+#ifdef NEED_TOK_PBE
+static char tokPBE[34] = "Communicator Generic Crypto Svcs";
+static char ptokPBE[34] = "Internal (Software) Token ";
#endif
/*
@@ -307,6 +307,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */
#define ATTR_NETSCAPEMDSUFFIX "netscapemdsuffix"
+#define PWD_PBE_DELIM '-'
+
#define REFERRAL_REMOVE_CMD "remove"
/* Filenames for DSE storage */
@@ -1592,7 +1594,7 @@ struct pw_scheme {
char *(*pws_enc)( char *pwd );
/* thread-safe decoding function (returns pointer to malloc'd string) */
- char *(*pws_dec)( char *pwd );
+ char *(*pws_dec)( char *pwd, char *algid);
};
typedef struct passwordpolicyarray {
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index a61d954..41dd2c8 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -222,6 +222,7 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...)
#define SLAPI_OP_FLAG_NO_ACCESS_CHECK 0x10000 /* Do not check for access control - bypass them */
#define SLAPI_OP_FLAG_BYPASS_REFERRALS 0x40000 /* Useful for performing internal operations on read-only replica */
#define SLAPI_OP_FLAG_NEVER_CACHE 0x200000 /* added entry should not be kept in cache */
+#define SLAPI_OP_FLAG_IGNORE_UNINDEXED 0x800000 /* Do not log unindexed search */
#define SLAPI_OC_FLAG_REQUIRED 0x0001
#define SLAPI_OC_FLAG_ALLOWED 0x0002
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 6b51e0c..67d01cd 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -64,7 +64,7 @@
#include <string.h>
#include <errno.h>
-#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */
+#define NEED_TOK_PBE /* defines tokPBE and ptokPBE - see slap.h */
#include "slap.h"
#include "svrcore.h"
@@ -1108,7 +1108,7 @@ slapd_nss_init(int init_ssl, int config_available)
/******** Initialise NSS *********/
nssFlags &= (~NSS_INIT_READONLY);
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags);
dongle_file_name = PR_smprintf("%s/pin.txt", certdir);
1
0
aclocal.m4 config.guess config.sub dirsrvtests/tickets ldap/admin ldap/ldif ldap/servers Makefile.am Makefile.in
by Mark Reynolds 20 Jan '15
by Mark Reynolds 20 Jan '15
20 Jan '15
Makefile.am | 14
Makefile.in | 104 ++--
aclocal.m4 | 15
config.guess | 192 +-------
config.sub | 40 +
dirsrvtests/tickets/ticket47462_test.py | 452 +++++++++++++++++++
ldap/admin/src/scripts/50AES-pbe-plugin.ldif | 16
ldap/admin/src/scripts/52updateAESplugin.pl | 84 +++
ldap/ldif/50replication-plugins.ldif | 2
ldap/ldif/template-dse.ldif.in | 16
ldap/servers/plugins/rever/des.c | 551 -----------------------
ldap/servers/plugins/rever/pbe.c | 621 +++++++++++++++++++++++++++
ldap/servers/plugins/rever/rever.c | 116 +++--
ldap/servers/plugins/rever/rever.h | 11
ldap/servers/slapd/daemon.c | 244 ++++++++++
ldap/servers/slapd/proto-slap.h | 1
ldap/servers/slapd/pw.c | 82 ++-
ldap/servers/slapd/pw.h | 2
ldap/servers/slapd/result.c | 3
ldap/servers/slapd/security_wrappers.c | 6
ldap/servers/slapd/slap.h | 10
ldap/servers/slapd/slapi-plugin.h | 1
ldap/servers/slapd/ssl.c | 4
23 files changed, 1731 insertions(+), 856 deletions(-)
New commits:
commit a57494fcaffccb6fdd060a93ba605d432e38bc09
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 10:59:05 2015 -0500
Ticket 47462 - Stop using DES in the reversible password
encryption plug-in
Bug Description: DES is not a safe cipher to use for Password Based Encryption(pbe).
AES should be used instead.
Fix Description: Use AES for all new password encodings. AES requires that the
algorithm ID used to encode the password, must also be used to
decode it. So, the algorithm ID is now stored in the cipher prefix:
{AES-<BASE64 encoded alg ID>}<ENCODED PASSWORD>
Since DES is no longer being used, the library has been renamed to a
more apprpriate name:
libdes-plugin -> libpbe-plugin
During upgrades the DES plugin entry has its library path updated
to use libpbe-plugin. The MMR plugin changes its dependency from
DES to AES, and the AES plugin entry is added, and all the password
attributes found in the old DES Plugin are migrated over to the new
AES Plugin entry.
When the server is restarted it checks for any DES passwords in the
database and cn=config. If any are found they are converted to AES,
and the DES plugin is disabled.
Also created a new operation flag: SLAPI_OP_FLAG_IGNORE_UNINDEXED
This flag prevents an internal unnidexed search from being logged
in the "errors" log. When the server starts up it can potentially
do unindexed searches while looking for DES passwords. We don't
want this log "noise" in the errors log everytime the server starts.
https://fedorahosted.org/389/ticket/47462
Design Doc: http://www.port389.org/docs/389ds/design/pbe.html
Valgrind: Passed
Reviewed by: nhosoi(Thanks!)
diff --git a/Makefile.am b/Makefile.am
index 049ff74..17aadff 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -225,7 +225,7 @@ endif
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -583,7 +583,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -1016,14 +1018,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
diff --git a/Makefile.in b/Makefile.in
index 24a9ddf..dff7462 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -396,15 +396,6 @@ libderef_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libderef_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
-libdes_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
-am_libdes_plugin_la_OBJECTS = \
- ldap/servers/plugins/rever/libdes_plugin_la-des.lo \
- ldap/servers/plugins/rever/libdes_plugin_la-rever.lo
-libdes_plugin_la_OBJECTS = $(am_libdes_plugin_la_OBJECTS)
-libdes_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
- $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libdes_plugin_la_LDFLAGS) $(LDFLAGS) \
- -o $@
libdistrib_plugin_la_DEPENDENCIES = libslapd.la
am_libdistrib_plugin_la_OBJECTS = \
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo
@@ -548,6 +539,15 @@ libpassthru_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
$(AM_CFLAGS) $(CFLAGS) $(libpassthru_plugin_la_LDFLAGS) \
$(LDFLAGS) -o $@
+libpbe_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1)
+am_libpbe_plugin_la_OBJECTS = \
+ ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo \
+ ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo
+libpbe_plugin_la_OBJECTS = $(am_libpbe_plugin_la_OBJECTS)
+libpbe_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+ $(AM_CFLAGS) $(CFLAGS) $(libpbe_plugin_la_LDFLAGS) $(LDFLAGS) \
+ -o $@
libposix_winsync_plugin_la_DEPENDENCIES = libslapd.la \
$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1)
am_libposix_winsync_plugin_la_OBJECTS = ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo \
@@ -1154,14 +1154,13 @@ SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1190,14 +1189,13 @@ DIST_SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
$(libcollation_plugin_la_SOURCES) \
$(libcontentsync_plugin_la_SOURCES) \
$(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \
- $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \
- $(libdna_plugin_la_SOURCES) \
+ $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \
$(libhttp_client_plugin_la_SOURCES) \
$(liblinkedattrs_plugin_la_SOURCES) \
$(libmanagedentries_plugin_la_SOURCES) \
$(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \
$(libpam_passthru_plugin_la_SOURCES) \
- $(libpassthru_plugin_la_SOURCES) \
+ $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \
$(libposix_winsync_plugin_la_SOURCES) \
$(libpresence_plugin_la_SOURCES) \
$(libpwdstorage_plugin_la_SOURCES) \
@@ -1637,7 +1635,7 @@ server_LTLIBRARIES = libslapd.la libns-dshttpd.la
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \
libcollation-plugin.la libcos-plugin.la libderef-plugin.la \
- libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
+ libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \
liblinkedattrs-plugin.la libmanagedentries-plugin.la \
libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \
libcontentsync-plugin.la \
@@ -1991,7 +1989,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
ldap/admin/src/scripts/82targetuniqueidindex.pl \
ldap/admin/src/scripts/90subtreerename.pl \
ldap/admin/src/scripts/91subtreereindex.pl \
+ ldap/admin/src/scripts/50AES-pbe-plugin.ldif\
ldap/admin/src/scripts/50updateconfig.ldif \
+ ldap/admin/src/scripts/52updateAESplugin.pl \
ldap/admin/src/scripts/dnaplugindepends.ldif
update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh
@@ -2363,14 +2363,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
libderef_plugin_la_LDFLAGS = -avoid-version
#------------------------
-# libdes-plugin
+# libpbe-plugin
#-----------------------
-libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \
+libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \
ldap/servers/plugins/rever/rever.c
-libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
-libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
-libdes_plugin_la_LDFLAGS = -avoid-version
+libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@
+libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK)
+libpbe_plugin_la_LDFLAGS = -avoid-version
#------------------------
# libdistrib-plugin
@@ -3596,21 +3596,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: \
libderef-plugin.la: $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_DEPENDENCIES) $(EXTRA_libderef_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libderef_plugin_la_LINK) -rpath $(serverplugindir) $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_LIBADD) $(LIBS)
-ldap/servers/plugins/rever/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever
- @: > ldap/servers/plugins/rever/$(am__dirstamp)
-ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
- @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
- @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: \
- ldap/servers/plugins/rever/$(am__dirstamp) \
- ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
-
-libdes-plugin.la: $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_DEPENDENCIES) $(EXTRA_libdes_plugin_la_DEPENDENCIES)
- $(AM_V_CCLD)$(libdes_plugin_la_LINK) -rpath $(serverplugindir) $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/distrib/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/distrib
@: > ldap/servers/plugins/distrib/$(am__dirstamp)
@@ -3900,6 +3885,21 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: \
libpassthru-plugin.la: $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_DEPENDENCIES) $(EXTRA_libpassthru_plugin_la_DEPENDENCIES)
$(AM_V_CCLD)$(libpassthru_plugin_la_LINK) -rpath $(serverplugindir) $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_LIBADD) $(LIBS)
+ldap/servers/plugins/rever/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever
+ @: > ldap/servers/plugins/rever/$(am__dirstamp)
+ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp):
+ @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR)
+ @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: \
+ ldap/servers/plugins/rever/$(am__dirstamp) \
+ ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp)
+
+libpbe-plugin.la: $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_DEPENDENCIES) $(EXTRA_libpbe_plugin_la_DEPENDENCIES)
+ $(AM_V_CCLD)$(libpbe_plugin_la_LINK) -rpath $(serverplugindir) $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_LIBADD) $(LIBS)
ldap/servers/plugins/posix-winsync/$(am__dirstamp):
@$(MKDIR_P) ldap/servers/plugins/posix-winsync
@: > ldap/servers/plugins/posix-winsync/$(am__dirstamp)
@@ -5441,8 +5441,8 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_po.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_rootdse.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_trim.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_cache.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_plugin.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rootdn_access/$(DEPDIR)/librootdn_access_plugin_la-rootdn_access.Plo@am__quote@
@@ -6739,20 +6739,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: ldap/servers/plugins/der
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libderef_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/deref/libderef_plugin_la-deref.lo `test -f 'ldap/servers/plugins/deref/deref.c' || echo '$(srcdir)/'`ldap/servers/plugins/deref/deref.c
-ldap/servers/plugins/rever/libdes_plugin_la-des.lo: ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-des.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/des.c' object='ldap/servers/plugins/rever/libdes_plugin_la-des.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c
-
-ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libdes_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
-
ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo: ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdistrib_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo -MD -MP -MF ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo -c -o ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo `test -f 'ldap/servers/plugins/distrib/distrib.c' || echo '$(srcdir)/'`ldap/servers/plugins/distrib/distrib.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Plo
@@ -6991,6 +6977,20 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: ldap/servers/plug
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpassthru_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo `test -f 'ldap/servers/plugins/passthru/ptutil.c' || echo '$(srcdir)/'`ldap/servers/plugins/passthru/ptutil.c
+ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/pbe.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c
+
+ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c
+
ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo: ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libposix_winsync_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo -MD -MP -MF ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo -c -o ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo `test -f 'ldap/servers/plugins/posix-winsync/posix-winsync.c' || echo '$(srcdir)/'`ldap/servers/plugins/posix-winsync/posix-winsync.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Plo
diff --git a/aclocal.m4 b/aclocal.m4
index 8136dd1..7afd01a 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -220,6 +220,21 @@ m4_popdef([pkg_default])
m4_popdef([pkg_description])
]) dnl PKG_NOARCH_INSTALLDIR
+
+# PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+# -------------------------------------------
+# Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])# PKG_CHECK_VAR
+
# Copyright (C) 2002-2013 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
diff --git a/config.guess b/config.guess
index b79252d..1f5c50c 100755
--- a/config.guess
+++ b/config.guess
@@ -1,8 +1,8 @@
#! /bin/sh
# Attempt to guess a canonical system name.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-06-10'
+timestamp='2014-03-23'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -50,7 +50,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -149,7 +149,7 @@ Linux|GNU|GNU/*)
LIBC=gnu
#endif
EOF
- eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+ eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
;;
esac
@@ -826,7 +826,7 @@ EOF
*:MINGW*:*)
echo ${UNAME_MACHINE}-pc-mingw32
exit ;;
- i*:MSYS*:*)
+ *:MSYS*:*)
echo ${UNAME_MACHINE}-pc-msys
exit ;;
i*:windows32*:*)
@@ -969,10 +969,10 @@ EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
;;
- or1k:Linux:*:*)
- echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+ openrisc*:Linux:*:*)
+ echo or1k-unknown-linux-${LIBC}
exit ;;
- or32:Linux:*:*)
+ or32:Linux:*:* | or1k*:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
padre:Linux:*:*)
@@ -1260,16 +1260,26 @@ EOF
if test "$UNAME_PROCESSOR" = unknown ; then
UNAME_PROCESSOR=powerpc
fi
- if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
- if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
- (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
- grep IS_64BIT_ARCH >/dev/null
- then
- case $UNAME_PROCESSOR in
- i386) UNAME_PROCESSOR=x86_64 ;;
- powerpc) UNAME_PROCESSOR=powerpc64 ;;
- esac
+ if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
+ if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+ if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+ grep IS_64BIT_ARCH >/dev/null
+ then
+ case $UNAME_PROCESSOR in
+ i386) UNAME_PROCESSOR=x86_64 ;;
+ powerpc) UNAME_PROCESSOR=powerpc64 ;;
+ esac
+ fi
fi
+ elif test "$UNAME_PROCESSOR" = i386 ; then
+ # Avoid executing cc on OS X 10.9, as it ships with a stub
+ # that puts up a graphical alert prompting to install
+ # developer tools. Any system running Mac OS X 10.7 or
+ # later (Darwin 11 and later) is required to have a 64-bit
+ # processor. This is not true of the ARM version of Darwin
+ # that Apple uses in portable devices.
+ UNAME_PROCESSOR=x86_64
fi
echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
exit ;;
@@ -1361,154 +1371,6 @@ EOF
exit ;;
esac
-eval $set_cc_for_build
-cat >$dummy.c <<EOF
-#ifdef _SEQUENT_
-# include <sys/types.h>
-# include <sys/utsname.h>
-#endif
-main ()
-{
-#if defined (sony)
-#if defined (MIPSEB)
- /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed,
- I don't know.... */
- printf ("mips-sony-bsd\n"); exit (0);
-#else
-#include <sys/param.h>
- printf ("m68k-sony-newsos%s\n",
-#ifdef NEWSOS4
- "4"
-#else
- ""
-#endif
- ); exit (0);
-#endif
-#endif
-
-#if defined (__arm) && defined (__acorn) && defined (__unix)
- printf ("arm-acorn-riscix\n"); exit (0);
-#endif
-
-#if defined (hp300) && !defined (hpux)
- printf ("m68k-hp-bsd\n"); exit (0);
-#endif
-
-#if defined (NeXT)
-#if !defined (__ARCHITECTURE__)
-#define __ARCHITECTURE__ "m68k"
-#endif
- int version;
- version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
- if (version < 4)
- printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
- else
- printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
- exit (0);
-#endif
-
-#if defined (MULTIMAX) || defined (n16)
-#if defined (UMAXV)
- printf ("ns32k-encore-sysv\n"); exit (0);
-#else
-#if defined (CMU)
- printf ("ns32k-encore-mach\n"); exit (0);
-#else
- printf ("ns32k-encore-bsd\n"); exit (0);
-#endif
-#endif
-#endif
-
-#if defined (__386BSD__)
- printf ("i386-pc-bsd\n"); exit (0);
-#endif
-
-#if defined (sequent)
-#if defined (i386)
- printf ("i386-sequent-dynix\n"); exit (0);
-#endif
-#if defined (ns32000)
- printf ("ns32k-sequent-dynix\n"); exit (0);
-#endif
-#endif
-
-#if defined (_SEQUENT_)
- struct utsname un;
-
- uname(&un);
-
- if (strncmp(un.version, "V2", 2) == 0) {
- printf ("i386-sequent-ptx2\n"); exit (0);
- }
- if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
- printf ("i386-sequent-ptx1\n"); exit (0);
- }
- printf ("i386-sequent-ptx\n"); exit (0);
-
-#endif
-
-#if defined (vax)
-# if !defined (ultrix)
-# include <sys/param.h>
-# if defined (BSD)
-# if BSD == 43
- printf ("vax-dec-bsd4.3\n"); exit (0);
-# else
-# if BSD == 199006
- printf ("vax-dec-bsd4.3reno\n"); exit (0);
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# endif
-# else
- printf ("vax-dec-bsd\n"); exit (0);
-# endif
-# else
- printf ("vax-dec-ultrix\n"); exit (0);
-# endif
-#endif
-
-#if defined (alliant) && defined (i860)
- printf ("i860-alliant-bsd\n"); exit (0);
-#endif
-
- exit (1);
-}
-EOF
-
-$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
- { echo "$SYSTEM_NAME"; exit; }
-
-# Apollos put the system type in the environment.
-
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
-
-# Convex versions that predate uname can use getsysinfo(1)
-
-if [ -x /usr/convex/getsysinfo ]
-then
- case `getsysinfo -f cpu_type` in
- c1*)
- echo c1-convex-bsd
- exit ;;
- c2*)
- if getsysinfo -f scalar_acc
- then echo c32-convex-bsd
- else echo c2-convex-bsd
- fi
- exit ;;
- c34*)
- echo c34-convex-bsd
- exit ;;
- c38*)
- echo c38-convex-bsd
- exit ;;
- c4*)
- echo c4-convex-bsd
- exit ;;
- esac
-fi
-
cat >&2 <<EOF
$0: unable to guess system type
diff --git a/config.sub b/config.sub
index c765b34..66c5074 100755
--- a/config.sub
+++ b/config.sub
@@ -1,8 +1,8 @@
#! /bin/sh
# Configuration validation subroutine script.
-# Copyright 1992-2013 Free Software Foundation, Inc.
+# Copyright 1992-2014 Free Software Foundation, Inc.
-timestamp='2013-04-24'
+timestamp='2014-07-28'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -68,7 +68,7 @@ Report bugs and patches to <config-patches(a)gnu.org>."
version="\
GNU config.sub ($timestamp)
-Copyright 1992-2013 Free Software Foundation, Inc.
+Copyright 1992-2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -257,7 +257,7 @@ case $basic_machine in
| avr | avr32 \
| be32 | be64 \
| bfin \
- | c4x | clipper \
+ | c4x | c8051 | clipper \
| d10v | d30v | dlx | dsp16xx \
| epiphany \
| fido | fr30 | frv \
@@ -265,6 +265,7 @@ case $basic_machine in
| hexagon \
| i370 | i860 | i960 | ia64 \
| ip2k | iq2000 \
+ | k1om \
| le32 | le64 \
| lm32 \
| m32c | m32r | m32rle | m68000 | m68k | m88k \
@@ -282,8 +283,10 @@ case $basic_machine in
| mips64vr5900 | mips64vr5900el \
| mipsisa32 | mipsisa32el \
| mipsisa32r2 | mipsisa32r2el \
+ | mipsisa32r6 | mipsisa32r6el \
| mipsisa64 | mipsisa64el \
| mipsisa64r2 | mipsisa64r2el \
+ | mipsisa64r6 | mipsisa64r6el \
| mipsisa64sb1 | mipsisa64sb1el \
| mipsisa64sr71k | mipsisa64sr71kel \
| mipsr5900 | mipsr5900el \
@@ -295,8 +298,7 @@ case $basic_machine in
| nds32 | nds32le | nds32be \
| nios | nios2 | nios2eb | nios2el \
| ns16k | ns32k \
- | open8 \
- | or1k | or32 \
+ | open8 | or1k | or1knd | or32 \
| pdp10 | pdp11 | pj | pjl \
| powerpc | powerpc64 | powerpc64le | powerpcle \
| pyramid \
@@ -324,7 +326,7 @@ case $basic_machine in
c6x)
basic_machine=tic6x-unknown
;;
- m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip)
+ m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
basic_machine=$basic_machine-unknown
os=-none
;;
@@ -372,7 +374,7 @@ case $basic_machine in
| be32-* | be64-* \
| bfin-* | bs2000-* \
| c[123]* | c30-* | [cjt]90-* | c4x-* \
- | clipper-* | craynv-* | cydra-* \
+ | c8051-* | clipper-* | craynv-* | cydra-* \
| d10v-* | d30v-* | dlx-* \
| elxsi-* \
| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
@@ -381,6 +383,7 @@ case $basic_machine in
| hexagon-* \
| i*86-* | i860-* | i960-* | ia64-* \
| ip2k-* | iq2000-* \
+ | k1om-* \
| le32-* | le64-* \
| lm32-* \
| m32c-* | m32r-* | m32rle-* \
@@ -400,8 +403,10 @@ case $basic_machine in
| mips64vr5900-* | mips64vr5900el-* \
| mipsisa32-* | mipsisa32el-* \
| mipsisa32r2-* | mipsisa32r2el-* \
+ | mipsisa32r6-* | mipsisa32r6el-* \
| mipsisa64-* | mipsisa64el-* \
| mipsisa64r2-* | mipsisa64r2el-* \
+ | mipsisa64r6-* | mipsisa64r6el-* \
| mipsisa64sb1-* | mipsisa64sb1el-* \
| mipsisa64sr71k-* | mipsisa64sr71kel-* \
| mipsr5900-* | mipsr5900el-* \
@@ -413,6 +418,7 @@ case $basic_machine in
| nios-* | nios2-* | nios2eb-* | nios2el-* \
| none-* | np1-* | ns16k-* | ns32k-* \
| open8-* \
+ | or1k*-* \
| orion-* \
| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
@@ -794,7 +800,7 @@ case $basic_machine in
os=-mingw64
;;
mingw32)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-mingw32
;;
mingw32ce)
@@ -822,6 +828,10 @@ case $basic_machine in
basic_machine=powerpc-unknown
os=-morphos
;;
+ moxiebox)
+ basic_machine=moxie-unknown
+ os=-moxiebox
+ ;;
msdos)
basic_machine=i386-pc
os=-msdos
@@ -830,7 +840,7 @@ case $basic_machine in
basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
;;
msys)
- basic_machine=i386-pc
+ basic_machine=i686-pc
os=-msys
;;
mvs)
@@ -1367,14 +1377,14 @@ case $os in
| -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
| -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
| -linux-newlib* | -linux-musl* | -linux-uclibc* \
- | -uxpv* | -beos* | -mpeix* | -udk* \
+ | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
| -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
| -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
| -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
| -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
| -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
| -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
- | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
+ | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
# Remember, each alternative MUST END IN *, to match a version number.
;;
-qnx*)
@@ -1546,6 +1556,9 @@ case $basic_machine in
c4x-* | tic4x-*)
os=-coff
;;
+ c8051-*)
+ os=-elf
+ ;;
hexagon-*)
os=-elf
;;
@@ -1589,9 +1602,6 @@ case $basic_machine in
mips*-*)
os=-elf
;;
- or1k-*)
- os=-elf
- ;;
or32-*)
os=-coff
;;
diff --git a/dirsrvtests/tickets/ticket47462_test.py b/dirsrvtests/tickets/ticket47462_test.py
new file mode 100644
index 0000000..a909b37
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47462_test.py
@@ -0,0 +1,452 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import time
+import logging
+import pytest
+import re
+from lib389 import DirSrv, Entry, tools
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from constants import *
+from lib389._constants import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
+installation1_prefix = None
+installation2_prefix = None
+
+DES_PLUGIN = 'cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config'
+AES_PLUGIN = 'cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config'
+MMR_PLUGIN = 'cn=Multimaster Replication Plugin,cn=plugins,cn=config'
+AGMT_DN = ''
+USER_DN = 'cn=test_user,' + DEFAULT_SUFFIX
+USER1_DN = 'cn=test_user1,' + DEFAULT_SUFFIX
+TEST_REPL_DN = 'cn=test repl,' + DEFAULT_SUFFIX
+
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ At the beginning, It may exists a master2 instance and/or a master2 instance.
+ It may also exists a backup for the master1 and/or the master2.
+
+ Principle:
+ If master1 instance exists:
+ restart it
+ If master2 instance exists:
+ restart it
+ If backup of master1 AND backup of master2 exists:
+ create or rebind to master1
+ create or rebind to master2
+
+ restore master1 from backup
+ restore master2 from backup
+ else:
+ Cleanup everything
+ remove instances
+ remove backups
+ Create instances
+ Initialize replication
+ Create backups
+ '''
+ global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+ # Get the status of the backups
+ backup_master1 = master1.checkBackupFS()
+ backup_master2 = master2.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.stop(timeout=10)
+ master1.start(timeout=10)
+
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.stop(timeout=10)
+ master2.start(timeout=10)
+
+ if backup_master1 and backup_master2:
+ # The backups exist, assuming they are correct
+ # we just re-init the instances with them
+ if not instance_master1:
+ master1.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master1.open()
+
+ if not instance_master2:
+ master2.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ master2.open()
+
+ # restore master1 from backup
+ master1.stop(timeout=10)
+ master1.restoreFS(backup_master1)
+ master1.start(timeout=10)
+
+ # restore master2 from backup
+ master2.stop(timeout=10)
+ master2.restoreFS(backup_master2)
+ master2.start(timeout=10)
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve master-consumer
+ # so we need to create everything
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove all the backups. So even if we have a specific backup file
+ # (e.g backup_master) we clear all backups that an instance my have created
+ if backup_master1:
+ master1.clearBackupFS()
+ if backup_master2:
+ master2.clearBackupFS()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ AGMT_DN = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ master1.agreement
+ if not AGMT_DN:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % AGMT_DN)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=DEFAULT_SUFFIX, host=master1.host, port=master1.port, properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(AGMT_DN)
+
+ # Check replication is working fine
+ master1.add_s(Entry((TEST_REPL_DN, {'objectclass': "top person".split(),
+ 'sn': 'test_repl',
+ 'cn': 'test_repl'})))
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication is not working!')
+ assert False
+
+ # Time to create the backups
+ master1.stop(timeout=10)
+ master1.backupfile = master1.backupFS()
+ master1.start(timeout=10)
+
+ master2.stop(timeout=10)
+ master2.backupfile = master2.backupFS()
+ master2.start(timeout=10)
+
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
+
+ #
+ # Here we have two instances master and consumer
+ # with replication working. Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyMaster1Master2(master1, master2)
+
+
+def test_ticket47462(topology):
+ """
+ Test that AES properly replaces DES during an update/restart, and that
+ replication also works correctly.
+ """
+
+ #
+ # First set config as if it's an older version. Set DES to use libdes-plugin,
+ # MMR to depend on DES, delete the existing AES plugin, and set a DES password
+ # for the replication agreement.
+ #
+
+ #
+ # Add an extra attribute to the DES plugin args
+ #
+ try:
+ topology.master1.modify_s(DES_PLUGIN,
+ [(ldap.MOD_REPLACE, 'nsslapd-pluginPath', 'libdes-plugin'),
+ (ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')])
+
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.master1.modify_s(MMR_PLUGIN,
+ [(ldap.MOD_DELETE, 'nsslapd-plugin-depends-on-named', 'AES')])
+
+ except ldap.NO_SUCH_ATTRIBUTE:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to reset DES plugin, error: ' + e.message['desc'])
+ assert False
+
+ #
+ # Delete the AES plugin
+ #
+ try:
+ topology.master1.delete_s(AES_PLUGIN)
+ except ldap.NO_SUCH_OBJECT:
+ pass
+ except ldap.LDAPError, e:
+ log.fatal('Failed to delete AES plugin, error: ' + e.message['desc'])
+ assert False
+
+ # restart the server so we must use DES plugin
+ topology.master1.restart(timeout=10)
+
+ #
+ # Get the agmt dn, and set the password
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'objectclass=nsDS5ReplicationAgreement')
+ if entry:
+ agmt_dn = entry[0].dn
+ log.info('Found agmt dn (%s)' % agmt_dn)
+ else:
+ log.fatal('No replication agreements!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ try:
+ properties = {RA_BINDPW: "password"}
+ topology.master1.agreement.setProperties(None, agmt_dn, None, properties)
+ log.info('Successfully modified replication agreement')
+ except ValueError:
+ log.error('Failed to update replica agreement: ' + AGMT_DN)
+ assert False
+
+ #
+ # Check replication works with the new DES password
+ #
+ try:
+ topology.master1.add_s(Entry((USER1_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER1_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed fo user1!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # Run the upgrade...
+ #
+ topology.master1.upgrade('online')
+ topology.master1.restart(timeout=10)
+ topology.master2.restart(timeout=10)
+
+ #
+ # Check that the restart converted existing DES credentials
+ #
+ try:
+ entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'nsDS5ReplicaCredentials=*')
+ if entry:
+ val = entry[0].getValue('nsDS5ReplicaCredentials')
+ if val.startswith('{AES-'):
+ log.info('The DES credentials have been converted to AES')
+ else:
+ log.fatal('Failed to convert credentials from DES to AES!')
+ assert False
+ else:
+ log.fatal('Failed to find any entries with nsDS5ReplicaCredentials ')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Failed to search for replica credentials: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the AES plugin exists, and has all the attributes listed in DES plugin.
+ # The attributes might not be in the expected order so check all the attributes.
+ #
+ try:
+ entry = topology.master1.search_s(AES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginarg0', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg1', 'description') and \
+ not entry[0].hasValue('nsslapd-pluginarg2', 'description'):
+ log.fatal('The AES plugin did not have the DES attribute copied over correctly')
+ assert False
+ else:
+ log.info('The AES plugin was correctly setup')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the MMR plugin was updated
+ #
+ try:
+ entry = topology.master1.search_s(MMR_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-plugin-depends-on-named', 'AES'):
+ log.fatal('The MMR Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The MMR plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check that the DES plugin was correctly updated
+ #
+ try:
+ entry = topology.master1.search_s(DES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*')
+ if not entry[0].hasValue('nsslapd-pluginPath', 'libpbe-plugin'):
+ log.fatal('The DES Plugin was not correctly updated')
+ assert False
+ else:
+ log.info('The DES plugin was correctly updated')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to find AES plugin: ' + e.message['desc'])
+ assert False
+
+ #
+ # Check replication one last time
+ #
+ try:
+ topology.master1.add_s(Entry((USER_DN,
+ {'objectclass': "top person".split(),
+ 'sn': 'sn',
+ 'cn': 'test_user'})))
+ loop = 0
+ ent = None
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(USER_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ if not ent:
+ log.fatal('Replication test failed!')
+ assert False
+ else:
+ log.info('Replication test passed')
+ except ldap.LDAPError, e:
+ log.fatal('Failed to add test user: ' + e.message['desc'])
+ assert False
+
+ #
+ # If we got here the test passed
+ #
+ log.info('Test PASSED')
+
+
+def test_ticket47462_final(topology):
+ topology.master1.stop(timeout=10)
+ topology.master2.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation1_prefix
+ global installation2_prefix
+ installation1_prefix = None
+ installation2_prefix = None
+
+ topo = topology(True)
+ test_ticket47462(topo)
+
+if __name__ == '__main__':
+ run_isolated()
diff --git a/ldap/admin/src/scripts/50AES-pbe-plugin.ldif b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
new file mode 100644
index 0000000..564ceae
--- /dev/null
+++ b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif
@@ -0,0 +1,16 @@
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginprecedence: 1
+nsslapd-pluginid: ID
+nsslapd-pluginDescription: DESC
+nsslapd-pluginVersion: PACKAGE_VERSION
+nsslapd-pluginVendor: VENDOR
diff --git a/ldap/admin/src/scripts/52updateAESplugin.pl b/ldap/admin/src/scripts/52updateAESplugin.pl
new file mode 100644
index 0000000..6a8a885
--- /dev/null
+++ b/ldap/admin/src/scripts/52updateAESplugin.pl
@@ -0,0 +1,84 @@
+use Mozilla::LDAP::Conn;
+use Mozilla::LDAP::Entry;
+use Mozilla::LDAP::Utils qw(normalizeDN);
+use Mozilla::LDAP::API qw(:constant ldap_url_parse ldap_explode_dn);
+use File::Basename;
+use File::Copy;
+use DSUtil qw(debug serverIsRunning);
+
+#
+# Check if there is a DES plugin and make sure the AES plugin contains the same attributes
+#
+sub runinst {
+ my ($inf, $inst, $dseldif, $conn) = @_;
+ my @attrs;
+ my @attrs_to_add;
+ my $aes_count = 0;
+ my $des_count = 0;
+ my $i = 0;
+
+ my $aes_dn = "cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $aes_entry = $conn->search($aes_dn, "base", "(cn=*)");
+ if (!$aes_entry) {
+ # No AES plugin - nothing to do
+ return ();
+ }
+
+ # We need to grab the AES plugin args...
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $aes_entry->getValues($argattr);
+ if($val ne ""){
+ $attrs[$aes_count] = $val;
+ $aes_count++;
+ } else {
+ last;
+ }
+ $i++;
+ }
+
+ # Grab the DES plugin
+ my $des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+ my $des_entry = $conn->search($des_dn, "base", "(cn=*)");
+ if (!$des_entry) {
+ # No DES plugin - nothing to do
+ return ();
+ }
+
+ # We need to check the DES plugin args against the AES args.
+ $i = 0;
+ while(1){
+ my $argattr = "nsslapd-pluginarg" . $i;
+ my $val = $des_entry->getValues($argattr);
+ if($val eq ""){
+ last;
+ }
+ if(!($val ~~ @attrs) ){
+ $attrs_to_add[$des_count] = $val;
+ $des_count++;
+ }
+ $i++;
+ }
+
+ # Add the missing attributes to the AES plugin
+ if($#attrs_to_add >= 0){
+ foreach $val (@attrs_to_add){
+ $aes_entry->addValue("nsslapd-pluginarg" . $aes_count, $val);
+ $aes_count++;
+ }
+ $conn->update($aes_entry);
+ }
+
+ # Change replication plugin dependency from DES to AES
+ my $mmr_entry = $conn->search("cn=Multimaster Replication Plugin,cn=plugins,cn=config", "base", "(cn=*)");
+ $mmr_entry->removeValue("nsslapd-plugin-depends-on-named", "DES");
+ $mmr_entry->addValue("nsslapd-plugin-depends-on-named", "AES");
+ $conn->update($mmr_entry);
+
+ # Change the des plugin to use the new libpbe-plugin library
+ $des_entry->{"nsslapd-pluginPath"} = [ "libpbe-plugin" ];
+ $conn->update($des_entry);
+
+ return ();
+}
+
diff --git a/ldap/ldif/50replication-plugins.ldif b/ldap/ldif/50replication-plugins.ldif
index 0b4924c..71afbea 100644
--- a/ldap/ldif/50replication-plugins.ldif
+++ b/ldap/ldif/50replication-plugins.ldif
@@ -22,6 +22,6 @@ nsslapd-plugintype: object
nsslapd-pluginbetxn: on
nsslapd-pluginenabled: on
nsslapd-plugin-depends-on-named: ldbm database
-nsslapd-plugin-depends-on-named: DES
+nsslapd-plugin-depends-on-named: AES
nsslapd-plugin-depends-on-named: Class of Service
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index 720ebad..6acbfae 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -207,12 +207,26 @@ nsslapd-plugininitfunc: ns_mta_md5_pwd_storage_scheme_init
nsslapd-plugintype: pwdstoragescheme
nsslapd-pluginenabled: on
+dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: AES
+nsslapd-pluginpath: libpbe-plugin
+nsslapd-plugininitfunc: aes_init
+nsslapd-plugintype: reverpwdstoragescheme
+nsslapd-pluginenabled: on
+nsslapd-pluginarg0: nsmultiplexorcredentials
+nsslapd-pluginarg1: nsds5ReplicaCredentials
+nsslapd-pluginid: aes-storage-scheme
+nsslapd-pluginprecedence: 1
+
dn: cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config
objectclass: top
objectclass: nsSlapdPlugin
objectclass: extensibleObject
cn: DES
-nsslapd-pluginpath: libdes-plugin
+nsslapd-pluginpath: libpbe-plugin
nsslapd-plugininitfunc: des_init
nsslapd-plugintype: reverpwdstoragescheme
nsslapd-pluginenabled: on
diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c
deleted file mode 100644
index 73830f0..0000000
--- a/ldap/servers/plugins/rever/des.c
+++ /dev/null
@@ -1,551 +0,0 @@
-/** BEGIN COPYRIGHT BLOCK
- * This Program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free Software
- * Foundation; version 2 of the License.
- *
- * This Program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
- * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place, Suite 330, Boston, MA 02111-1307 USA.
- *
- * In addition, as a special exception, Red Hat, Inc. gives You the additional
- * right to link the code of this Program with code not covered under the GNU
- * General Public License ("Non-GPL Code") and to distribute linked combinations
- * including the two, subject to the limitations in this paragraph. Non-GPL Code
- * permitted under this exception must only link to the code of this Program
- * through those well defined interfaces identified in the file named EXCEPTION
- * found in the source code files (the "Approved Interfaces"). The files of
- * Non-GPL Code may instantiate templates or use macros or inline functions from
- * the Approved Interfaces without causing the resulting work to be covered by
- * the GNU General Public License. Only Red Hat, Inc. may make changes or
- * additions to the list of Approved Interfaces. You must obey the GNU General
- * Public License in all respects for all of the Program code and other code used
- * in conjunction with the Program except the Non-GPL Code covered by this
- * exception. If you modify this file, you may extend this exception to your
- * version of the file, but you are not obligated to do so. If you do not wish to
- * provide this exception without modification, you must delete this exception
- * statement from your version and license this file solely under the GPL without
- * exception.
- *
- *
- * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
- * Copyright (C) 2005 Red Hat, Inc.
- * All rights reserved.
- * END COPYRIGHT BLOCK **/
-
-#ifdef HAVE_CONFIG_H
-# include <config.h>
-#endif
-
-/* from /usr/project/iplanet/ws/ds5.ke/ns/svrcore/pkcs7/tstarchive.c */
-
-#include <string.h>
-#include <stdio.h>
-
-#include <ldap.h>
-#include <nspr.h>
-#include <nss.h>
-#include <secmod.h>
-/*
-#include <secasn1.h>
-#include <secpkcs7.h>
-*/
-#include <key.h>
-#include <certdb.h>
-#include <cert.h>
-#include <svrcore.h>
-#include <secmodt.h>
-#include <prtypes.h>
-#include <seccomon.h>
-#include <pk11func.h>
-
-#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */
-#include "rever.h"
-#include <slap.h>
-#include "slapi-plugin.h"
-#include <uuid.h>
-
-
-struct pk11MechItem
-{
- CK_MECHANISM_TYPE type;
- const char *mechName;
-};
-static const struct pk11MechItem mymech = { CKM_DES_CBC, "DES CBC encryption" };
-
-
-static Slapi_Mutex *mylock = NULL;
-
-struct pk11ContextStore
-{
- PK11SlotInfo *slot;
- const struct pk11MechItem *mech;
-
- PK11SymKey *key;
- SECItem *params;
-
- int length;
- unsigned char *crypt;
-};
-
-static int encode_path(char *inPlain, char **outCipher, char *path);
-static int decode_path(char *inCipher, char **outPlain, char *path);
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path);
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
-static void freeDes(struct pk11ContextStore *out);
-
-void
-init_des_plugin()
-{
- mylock = slapi_new_mutex();
-}
-
-int
-encode(char *inPlain, char **outCipher)
-{
- return encode_path(inPlain, outCipher, NULL);
-}
-
-static int
-encode_path(char *inPlain, char **outCipher, char *path)
-{
- struct pk11ContextStore *context = NULL;
- int err;
-
- unsigned char *cipher = NULL;
- char *tmp = NULL;
- char *base = NULL;
-
-
- *outCipher = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* Try an encryption */
- if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success )
- {
- base = BTOA_DataToAscii(cipher, context->length);
- if ( base != NULL )
- {
- tmp = slapi_ch_malloc( 3 + strlen(REVER_SCHEME_NAME) + strlen(base));
- if ( tmp != NULL )
- {
- sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, REVER_SCHEME_NAME, PWD_HASH_PREFIX_END, base);
- *outCipher = tmp;
- tmp = NULL;
- err = 0;
- }
- PORT_Free(base);
- }
- }
- }
-
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-int
-decode(char *inCipher, char **outPlain)
-{
- return decode_path(inCipher, outPlain, NULL);
-}
-
-
-static int
-decode_path(char *inCipher, char **outPlain, char *path)
-{
- struct pk11ContextStore *context = NULL;
- char *plain= NULL;
- int err;
-
- unsigned char *base = NULL;
- int len = 0;
-
-
- *outPlain = NULL;
- err = 1;
-
- if ( genKey(&context, tokDes, path) == SVRCORE_Success )
- {
- /* it seems that there is memory leak in that function: bug 400170 */
-
- base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
- if ( base != NULL )
- {
- if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success )
- {
- *outPlain = plain;
- err = 0;
- }
- }
- }
-
- PORT_Free(base);
- freeDes(context);
- slapi_ch_free((void **) &context);
- return(err);
-}
-
-static void freeDes(struct pk11ContextStore *out)
-{
- if (out)
- {
- if (out->slot)
- slapd_pk11_freeSlot(out->slot);
- if (out->key)
- slapd_pk11_freeSymKey(out->key);
- if (out->params)
- SECITEM_FreeItem(out->params,PR_TRUE);
- if (out->crypt)
- free(out->crypt);
- }
-}
-
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path)
-{
- SVRCOREError err = SVRCORE_Success;
- struct pk11ContextStore *store = NULL;
- SECItem *pwitem = NULL;
- SECItem *result = NULL;
- SECAlgorithmID *algid = NULL;
- SECOidTag algoid;
- SECItem *salt = NULL;
- CK_MECHANISM pbeMech;
- CK_MECHANISM cryptoMech;
-
- char *configdir = NULL;
- char *iv = NULL;
-
- store = (struct pk11ContextStore*)slapi_ch_malloc(sizeof(*store));
- if (store == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- *out = store;
-
- /* Low-level init */
- store->slot = NULL;
- store->key = NULL;
- store->params = NULL;
- store->crypt = NULL;
-
- /* Use the tokenName to find a PKCS11 slot */
- store->slot = slapd_pk11_findSlotByName((char *)token);
- if (store->slot == NULL)
- {
- err = SVRCORE_NoSuchToken_Error;
- goto done;
- }
-
- /* Generate a key and parameters to do the encryption */
- store->mech = &mymech;
-
- /* Generate a unique id, used as salt for the key generation */
- if ( path == NULL )
- {
- configdir = config_get_configdir();
- if ( configdir == NULL )
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- }
- else
- {
- configdir = slapi_ch_strdup(path);
- }
- if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS )
- {
- slapi_ch_free((void**)&configdir);
- err = SVRCORE_System_Error;
- goto done;
- }
- slapi_ch_free((void**)&configdir);
-
- pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (pwitem == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- pwitem->type = siBuffer;
- pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if (pwitem->data == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)pwitem->data, iv);
- pwitem->len = strlen(iv) + 1;
-
- algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
-
- salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (salt == NULL)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- salt->type = siBuffer;
- salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
- if ( salt->data == NULL )
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- strcpy((char*)salt->data, iv);
- salt->len = strlen(iv) + 1;
-
- algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
-
- slapi_lock_mutex(mylock);
- store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
- if (store->key == 0)
- {
- slapi_unlock_mutex(mylock);
- err = SVRCORE_System_Error;
- goto done;
- }
-
- slapi_unlock_mutex(mylock);
- pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
- result = slapd_pk11_paramFromAlgid(algid);
- secoid_destroyAlgorithmID(algid, PR_TRUE);
- pbeMech.pParameter = result->data;
- pbeMech.ulParameterLen = result->len;
- if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
- PR_FALSE) != CKR_OK)
- {
- SECITEM_FreeItem(result, PR_TRUE);
- err = SVRCORE_System_Error;
- goto done;
- }
- SECITEM_FreeItem(result, PR_TRUE);
- SECITEM_FreeItem(pwitem, PR_TRUE);
- SECITEM_FreeItem(salt, PR_TRUE);
- store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
- if (store->params == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- store->params->type = store->mech->type;
- store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
- if (store->params->data == NULL)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
- memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
- store->params->len = cryptoMech.ulParameterLen;
- PORT_Free(cryptoMech.pParameter);
-
-done:
- slapi_ch_free((void**)&iv);
- return (err);
-}
-
-static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
-{
- SVRCOREError err = SVRCORE_Success;
- unsigned char *plain = NULL;
- unsigned char *cipher_with_padding = NULL;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = len;
-
- /* store->length is the max. length of the returned clear text -
- must be >= length of crypted bytes - also must be a multiple
- of blocksize */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* plain will hold the returned clear text */
- plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!plain)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer holding the original cipher bytes, padded with
- zeros to a multiple of blocksize - do not need +1 since buffer is not
- a string */
- cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length);
- if (!cipher_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- memcpy(cipher_with_padding, cipher, len);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- /* warning - there is a purify UMR in the NSS des code - you may see it when the
- password is not a multiple of 8 bytes long */
- rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
- cipher_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- {
- *out = (char *)plain;
- }
- else
- {
- slapi_ch_free((void **)&plain);
- }
-
- slapi_ch_free((void **)&cipher_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
-{
- SVRCOREError err = SVRCORE_Success;
- SECStatus rv;
- PK11Context *ctx = 0;
- int outLen = 0;
- int blocksize = 0;
- unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
-
- blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
- store->length = strlen(clear);
-
- /* the size of the clear text buffer passed to the des encryption functions
- must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
- of this size, copy the clear text password into it, and pad the rest with
- zeros */
- if (blocksize != 0)
- {
- store->length += blocksize - (store->length % blocksize);
- }
-
- /* store->crypt will hold the crypted password - it must be >= clear length */
- /* store->crypt is freed in NSS; let's not use slapi_ch_calloc */
- store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
- store->length+1);
- if (!store->crypt)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
-
- /* create a buffer big enough to hold the clear text password and padding */
- clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
- store->length+1);
- if (!clear_with_padding)
- {
- err = SVRCORE_NoMemory_Error;
- goto done;
- }
- /* copy the clear text password into the buffer - the calloc insures the
- remainder is zero padded */
- strcpy((char *)clear_with_padding, clear);
-
- ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
- store->key, store->params);
- if (!ctx)
- {
- err = SVRCORE_System_Error;
- goto done;
- }
-
- rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
- clear_with_padding, store->length);
- if (rv)
- {
- err = SVRCORE_System_Error;
- }
-
- rv = slapd_pk11_finalize(ctx);
- /* we must do the finalize, but we only want to set the err return
- code if it is not already set */
- if (rv && (SVRCORE_Success == err))
- err = SVRCORE_System_Error;
-
-done:
- if (err == SVRCORE_Success)
- *out = store->crypt;
-
- slapi_ch_free((void **)&clear_with_padding);
- /* We should free the PK11Context... Something like : */
- if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE);
-
- return err;
-}
-
-/*
- The UUID name based generator was broken on x86 platforms. We use
- this to generate the password encryption key. During migration,
- we have to fix this so we can use the fixed generator. The env.
- var USE_BROKEN_UUID tells the uuid generator to use the old
- broken method to create the UUID. That will allow us to decrypt
- the password to the correct clear text, then we can turn off
- the broken method and use the fixed method to encrypt the
- password.
-*/
-char *
-migrateCredentials(char *oldpath, char *newpath, char *oldcred)
-{
- static char *useBrokenUUID = "USE_BROKEN_UUID=1";
- static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
- char *plain = NULL;
- char *cipher = NULL;
-
- init_des_plugin();
-
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
- NSS_NoDB_Init(NULL);
-
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(useBrokenUUID);
- }
-
- if ( decode_path(oldcred, &plain, oldpath) == 0 )
- {
- if (getenv("MIGRATE_BROKEN_PWD")) {
- putenv(disableBrokenUUID);
- }
- if ( encode_path(plain, &cipher, newpath) != 0 )
- return(NULL);
- else
- return(cipher);
- }
- else
- return(NULL);
-}
diff --git a/ldap/servers/plugins/rever/pbe.c b/ldap/servers/plugins/rever/pbe.c
new file mode 100644
index 0000000..abb8d1b
--- /dev/null
+++ b/ldap/servers/plugins/rever/pbe.c
@@ -0,0 +1,621 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This Program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation; version 2 of the License.
+ *
+ * This Program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * In addition, as a special exception, Red Hat, Inc. gives You the additional
+ * right to link the code of this Program with code not covered under the GNU
+ * General Public License ("Non-GPL Code") and to distribute linked combinations
+ * including the two, subject to the limitations in this paragraph. Non-GPL Code
+ * permitted under this exception must only link to the code of this Program
+ * through those well defined interfaces identified in the file named EXCEPTION
+ * found in the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline functions from
+ * the Approved Interfaces without causing the resulting work to be covered by
+ * the GNU General Public License. Only Red Hat, Inc. may make changes or
+ * additions to the list of Approved Interfaces. You must obey the GNU General
+ * Public License in all respects for all of the Program code and other code used
+ * in conjunction with the Program except the Non-GPL Code covered by this
+ * exception. If you modify this file, you may extend this exception to your
+ * version of the file, but you are not obligated to do so. If you do not wish to
+ * provide this exception without modification, you must delete this exception
+ * statement from your version and license this file solely under the GPL without
+ * exception.
+ *
+ *
+ * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
+ * Copyright (C) 2015 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <string.h>
+#include <stdio.h>
+
+#include <ldap.h>
+#include <nspr.h>
+#include <nss.h>
+#include <secmod.h>
+/*
+#include <secasn1.h>
+#include <secpkcs7.h>
+*/
+#include <key.h>
+#include <certdb.h>
+#include <cert.h>
+#include <svrcore.h>
+#include <secmodt.h>
+#include <prtypes.h>
+#include <seccomon.h>
+#include <pk11func.h>
+
+#define NEED_TOK_PBE /* see slap.h - defines tokPBE and ptokPBE */
+#include "rever.h"
+#include <slap.h>
+#include "slapi-plugin.h"
+#include <uuid.h>
+#include <plbase64.h>
+
+struct pk11MechItem
+{
+ CK_MECHANISM_TYPE type;
+ const char *mechName;
+};
+
+static const struct pk11MechItem DESmech = { CKM_DES_CBC, "DES CBC encryption" };
+static const struct pk11MechItem AESmech = { CKM_AES_CBC, "AES CBC encryption" };
+static Slapi_Mutex *pbe_lock = NULL;
+
+struct pk11ContextStore
+{
+ PK11SlotInfo *slot;
+ const struct pk11MechItem *mech;
+ PK11SymKey *key;
+ SECItem *params;
+ int length;
+ unsigned char *crypt;
+ char *algid_base64;
+};
+
+/*
+ * der_algid converting functions:
+ *
+ * SECStatus ATOB_ConvertAsciiToItem(SECItem *binary_item, const char *ascii);
+ * char * BTOA_ConvertItemToAscii(SECItem *binary_item);
+ *
+ */
+
+static int encode_path(char *inPlain, char **outCipher, char *path, int mech);
+static int decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid);
+static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *algid);
+static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
+static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
+static void freePBE(struct pk11ContextStore *store);
+
+void
+init_pbe_plugin()
+{
+ if(!pbe_lock){
+ pbe_lock = slapi_new_mutex();
+ }
+}
+
+int
+encode(char *inPlain, char **outCipher, int mech)
+{
+ return encode_path(inPlain, outCipher, NULL, mech);
+}
+
+static int
+encode_path(char *inPlain, char **outCipher, char *path, int mech)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *cipher = NULL;
+ char *tmp = NULL;
+ char *base = NULL;
+ int len = 0;
+ int err;
+
+ *outCipher = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, NULL) == SVRCORE_Success ){
+ /* Try an encryption */
+ if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ){
+ base = BTOA_DataToAscii(cipher, context->length);
+ if ( base != NULL ){
+ const char *scheme;
+ if (mech == AES_MECH){
+ scheme = AES_REVER_SCHEME_NAME;
+ len = 3 + strlen(scheme)+ strlen(context->algid_base64) + strlen(base) + 1;
+ if( (tmp = slapi_ch_malloc( len )) ){
+ /*
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ sprintf( tmp, "%c%s-%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ context->algid_base64,PWD_HASH_PREFIX_END, base);
+ }
+ } else {
+ /* Old school DES */
+ scheme = DES_REVER_SCHEME_NAME;
+ if((tmp = slapi_ch_malloc( 3 + strlen(scheme) + strlen(base)))){
+ sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, scheme,
+ PWD_HASH_PREFIX_END, base);
+ }
+ }
+ if ( tmp != NULL ){
+ *outCipher = tmp;
+ tmp = NULL;
+ err = 0;
+ }
+ PORT_Free(base);
+ }
+ }
+ }
+ freePBE(context);
+
+ return(err);
+}
+
+int
+decode(char *inCipher, char **outPlain, int mech, char *algid)
+{
+ return decode_path(inCipher, outPlain, NULL, mech, algid);
+}
+
+
+static int
+decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid)
+{
+ struct pk11ContextStore *context = NULL;
+ PRArenaPool *arena = NULL;
+ unsigned char *base = NULL;
+ char *plain = NULL;
+ int err;
+ int len = 0;
+
+ *outPlain = NULL;
+ err = 1;
+
+ if ( genKey(&context, tokPBE, path, mech, arena, algid) == SVRCORE_Success ){
+ /* it seems that there is memory leak in that function: bug 400170 */
+ base = ATOB_AsciiToData(inCipher, (unsigned int*)&len);
+ if ( base != NULL ){
+ if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ){
+ *outPlain = plain;
+ err = 0;
+ }
+ }
+ }
+
+ slapi_ch_free_string(&algid);
+ PORT_Free(base);
+ PORT_FreeArena(arena, PR_TRUE);
+ freePBE(context);
+
+ return(err);
+}
+
+static void
+freePBE(struct pk11ContextStore *store)
+{
+ if (store){
+ if (store->slot)
+ slapd_pk11_freeSlot(store->slot);
+ if (store->key)
+ slapd_pk11_freeSymKey(store->key);
+ if (store->params)
+ SECITEM_FreeItem(store->params, PR_TRUE);
+ slapi_ch_free((void **)&store->crypt);
+ slapi_ch_free_string(&store->algid_base64);
+ slapi_ch_free((void **)&store);
+ }
+}
+
+static SVRCOREError
+genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *alg)
+{
+ SVRCOREError err = SVRCORE_Success;
+ struct pk11ContextStore *store = NULL;
+ SECItem *pwitem = NULL;
+ SECItem *result = NULL;
+ SECItem *salt = NULL;
+ SECItem der_algid;
+ SECAlgorithmID *algid = NULL;
+ SECOidTag algoid;
+ CK_MECHANISM pbeMech;
+ CK_MECHANISM cryptoMech;
+ SECAlgorithmID my_algid;
+ char *configdir = NULL;
+ char *der_ascii = NULL;
+ char *iv = NULL;
+ int free_it = 0;
+
+ arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+
+ store = (struct pk11ContextStore*)slapi_ch_calloc(1, sizeof(*store));
+ if (store == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ *out = store;
+
+ /* Use the tokenName to find a PKCS11 slot */
+ store->slot = slapd_pk11_findSlotByName((char *)token);
+ if (store->slot == NULL){
+ err = SVRCORE_NoSuchToken_Error;
+ goto done;
+ }
+
+ /* Generate a key and parameters to do the encryption */
+ if(mech == AES_MECH){
+ store->mech = &AESmech;
+ algoid = SEC_OID_AES_256_CBC;
+ } else {
+ store->mech = &DESmech;
+ algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC;
+ }
+
+ /* Generate a unique id, used as salt for the key generation */
+ if ( path == NULL ){
+ configdir = config_get_configdir();
+ if ( configdir == NULL ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ } else {
+ configdir = slapi_ch_strdup(path);
+ }
+ if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (pwitem == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ pwitem->type = siBuffer;
+ pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if (pwitem->data == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)pwitem->data, iv);
+ pwitem->len = strlen(iv) + 1;
+
+ salt = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (salt == NULL){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ salt->type = siBuffer;
+ salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1);
+ if ( salt->data == NULL ){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ strcpy((char*)salt->data, iv);
+ salt->len = strlen(iv) + 1;
+
+ PORT_Memset(&der_algid, 0, sizeof(der_algid));
+ if(!alg){
+ /*
+ * This is DES, or we are encoding AES - the process is the same.
+ */
+ algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt);
+ free_it = 1; /* we need to free this algid */
+
+ /*
+ * The following is only need for AES - we need to store
+ * algid for future decodings(unlike with DES). So convert
+ * algid to its DER encoding. Then convert the DER to ascii,
+ * and finally convert the DER ascii to base64 so we can store
+ * it in the cipher prefix.
+ */
+ SEC_ASN1EncodeItem(arena, &der_algid, algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate));
+ der_ascii = BTOA_ConvertItemToAscii(&der_algid);
+ store->algid_base64 = PL_Base64Encode(der_ascii,strlen(der_ascii), NULL);
+ slapi_ch_free_string(&der_ascii);
+ } else {
+ /*
+ * We are decoding AES - use the supplied algid
+ */
+ PORT_Memset(&my_algid, 0, sizeof(my_algid));
+
+ /* Decode the base64 der encoding */
+ der_ascii = PL_Base64Decode(alg, strlen(alg), NULL);
+
+ /* convert the der ascii to the SEC item */
+ ATOB_ConvertAsciiToItem(&der_algid, der_ascii);
+ SEC_ASN1DecodeItem(arena, &my_algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate), &der_algid);
+ SECITEM_FreeItem(&der_algid, PR_FALSE);
+ algid = &my_algid;
+ slapi_ch_free_string(&der_ascii);
+ }
+
+ slapi_lock_mutex(pbe_lock);
+ store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0);
+ if (store->key == 0){
+ slapi_unlock_mutex(pbe_lock);
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ slapi_unlock_mutex(pbe_lock);
+
+ if(mech == AES_MECH)
+ {
+ cryptoMech.mechanism = PK11_GetPBECryptoMechanism(algid, &store->params, pwitem);
+ if (cryptoMech.mechanism == CKM_INVALID_MECHANISM) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ }
+ else
+ {
+ /* DES */
+ pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid);
+ result = slapd_pk11_paramFromAlgid(algid);
+ if(result){
+ pbeMech.pParameter = result->data;
+ pbeMech.ulParameterLen = result->len;
+ }
+ if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem,
+ PR_FALSE) != CKR_OK){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ store->params = (SECItem *) PORT_Alloc(sizeof(SECItem));
+ if (store->params == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ store->params->type = store->mech->type;
+ store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen);
+ if (store->params->data == NULL){
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+ memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen);
+ store->params->len = cryptoMech.ulParameterLen;
+ PORT_Free(cryptoMech.pParameter);
+ }
+
+done:
+ SECITEM_FreeItem(result, PR_TRUE);
+ SECITEM_FreeItem(pwitem, PR_TRUE);
+ SECITEM_FreeItem(salt, PR_TRUE);
+ if(free_it){
+ secoid_destroyAlgorithmID(algid, PR_TRUE);
+ }
+ slapi_ch_free_string(&configdir);
+ slapi_ch_free_string(&iv);
+ if (arena) {
+ PORT_FreeArena(arena, PR_TRUE);
+ }
+ return (err);
+}
+
+static SVRCOREError
+decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len)
+{
+ SVRCOREError err = SVRCORE_Success;
+ unsigned char *plain = NULL;
+ unsigned char *cipher_with_padding = NULL;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ int outLen = 0;
+ int blocksize = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = len;
+
+ /*
+ * store->length is the max. length of the returned clear text -
+ * must be >= length of crypted bytes - also must be a multiple
+ * of blocksize
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /* plain will hold the returned clear text */
+ plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!plain){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /*
+ * create a buffer holding the original cipher bytes, padded with
+ * zeros to a multiple of blocksize - do not need +1 since buffer is not
+ * a string
+ */
+ cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length);
+ if (!cipher_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ memcpy(cipher_with_padding, cipher, len);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ /*
+ * Warning - there is a purify UMR in the NSS des code - you may see it when the
+ * password is not a multiple of 8 bytes long
+ */
+ rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length,
+ cipher_with_padding, store->length);
+ if (rv){
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err))
+ err = SVRCORE_System_Error;
+
+done:
+ if (err == SVRCORE_Success){
+ *out = (char *)plain;
+ } else {
+ slapi_ch_free((void **)&plain);
+ }
+
+ slapi_ch_free((void **)&cipher_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+static SVRCOREError
+cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out)
+{
+ SVRCOREError err = SVRCORE_Success;
+ SECStatus rv;
+ PK11Context *ctx = NULL;
+ unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */
+ int blocksize = 0;
+ int outLen = 0;
+
+ blocksize = slapd_pk11_getBlockSize(store->mech->type, 0);
+ store->length = strlen(clear);
+
+ /*
+ * The size of the clear text buffer passed to the encryption functions
+ * must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer
+ * of this size, copy the clear text password into it, and pad the rest with
+ * zeros.
+ */
+ if (blocksize != 0){
+ store->length += blocksize - (store->length % blocksize);
+ }
+
+ /*
+ * store->crypt will hold the crypted password - it must be >= clear length
+ * store->crypt is freed in NSS; let's not use slapi_ch_calloc
+ */
+ store->crypt = (unsigned char *)calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!store->crypt) {
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+
+ /* Create a buffer big enough to hold the clear text password and padding */
+ clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char),
+ store->length+1);
+ if (!clear_with_padding){
+ err = SVRCORE_NoMemory_Error;
+ goto done;
+ }
+ /*
+ * Copy the clear text password into the buffer - the calloc insures the
+ * remainder is zero padded .
+ */
+ strcpy((char *)clear_with_padding, clear);
+
+ ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT,
+ store->key, store->params);
+ if (!ctx) {
+ err = SVRCORE_System_Error;
+ goto done;
+ }
+
+ rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length,
+ clear_with_padding, store->length);
+ if (rv) {
+ err = SVRCORE_System_Error;
+ }
+
+ rv = slapd_pk11_finalize(ctx);
+ /*
+ * We must do the finalize, but we only want to set the err return
+ * code if it is not already set
+ */
+ if (rv && (SVRCORE_Success == err)){
+ err = SVRCORE_System_Error;
+ }
+
+done:
+ if (err == SVRCORE_Success){
+ *out = store->crypt;
+ }
+
+ slapi_ch_free((void **)&clear_with_padding);
+ /* We should free the PK11Context... Something like : */
+ if (ctx){
+ slapd_pk11_destroyContext(ctx, PR_TRUE);
+ }
+
+ return err;
+}
+
+/*
+ * The UUID name based generator was broken on x86 platforms. We use
+ * this to generate the password encryption key. During migration,
+ * we have to fix this so we can use the fixed generator. The env.
+ * var USE_BROKEN_UUID tells the uuid generator to use the old
+ * broken method to create the UUID. That will allow us to decrypt
+ * the password to the correct clear text, then we can turn off
+ * the broken method and use the fixed method to encrypt the
+ * password.
+ */
+char *
+migrateCredentials(char *oldpath, char *newpath, char *oldcred)
+{
+ static char *useBrokenUUID = "USE_BROKEN_UUID=1";
+ static char *disableBrokenUUID = "USE_BROKEN_UUID=0";
+ char *plain = NULL;
+ char *cipher = NULL;
+
+ init_pbe_plugin();
+
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
+ NSS_NoDB_Init(NULL);
+
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(useBrokenUUID);
+ }
+
+ if ( decode_path(oldcred, &plain, oldpath, DES_MECH, NULL) == 0 ){
+ if (getenv("MIGRATE_BROKEN_PWD")) {
+ putenv(disableBrokenUUID);
+ }
+ if ( encode_path(plain, &cipher, newpath, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return(cipher);
+ }
+ } else {
+ return(NULL);
+ }
+}
diff --git a/ldap/servers/plugins/rever/rever.c b/ldap/servers/plugins/rever/rever.c
index 9d7e82d..51d602f 100644
--- a/ldap/servers/plugins/rever/rever.c
+++ b/ldap/servers/plugins/rever/rever.c
@@ -43,25 +43,92 @@
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
-
#include "rever.h"
-static Slapi_PluginDesc pdesc = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_aes = { "aes-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "AES storage scheme plugin" };
+static Slapi_PluginDesc pdesc_des = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" };
+
static char *plugin_name = "ReverStoragePlugin";
+#define AES_MECH 1
+#define DES_MECH 2
+
+int
+aes_cmp( char *userpwd, char *dbpwd )
+{
+ char *cipher = NULL;
+ int rc = 0;
+
+ if ( encode(userpwd, &cipher, AES_MECH) != 0 ){
+ rc = 1;
+ } else {
+ rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
+
+ return rc;
+}
+
+char *
+aes_enc( char *pwd )
+{
+ char *cipher = NULL;
+
+ if ( encode(pwd, &cipher, AES_MECH) != 0 ){
+ return(NULL);
+ } else {
+ return( cipher );
+ }
+}
+
+char *
+aes_dec( char *pwd, char *alg )
+{
+ char *plain = NULL;
+
+ if ( decode(pwd, &plain, AES_MECH, alg) != 0 ){
+ return(NULL);
+ } else {
+ return( plain );
+ }
+}
+
+int
+aes_init( Slapi_PBlock *pb)
+{
+ char *name = slapi_ch_strdup(AES_REVER_SCHEME_NAME);
+ int rc;
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> aes_init\n" );
+
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_aes );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) aes_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) aes_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) aes_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= aes_init %d\n", rc );
+
+ return( rc );
+}
+
int
des_cmp( char *userpwd, char *dbpwd )
{
char *cipher = NULL;
int rc = 0;
- if ( encode(userpwd, &cipher) != 0 )
+ if ( encode(userpwd, &cipher, DES_MECH) != 0 ){
rc = 1;
- else
+ } else {
rc = strcmp(cipher, dbpwd);
+ }
+ slapi_ch_free_string(&cipher);
- slapi_ch_free((void**)&cipher);
return rc;
}
@@ -70,10 +137,11 @@ des_enc( char *pwd )
{
char *cipher = NULL;
- if ( encode(pwd, &cipher) != 0 )
+ if ( encode(pwd, &cipher, DES_MECH ) != 0 ){
return(NULL);
- else
+ } else {
return( cipher );
+ }
}
char *
@@ -81,37 +149,31 @@ des_dec( char *pwd )
{
char *plain = NULL;
- if ( decode(pwd, &plain) != 0 )
+ if ( decode(pwd, &plain, DES_MECH, NULL) != 0 ){
return(NULL);
- else
+ } else {
return( plain );
+ }
}
int
des_init( Slapi_PBlock *pb )
{
+ char *name = slapi_ch_strdup(DES_REVER_SCHEME_NAME);
int rc;
- char *name;
slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> des_init\n" );
- rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION,
- (void *) SLAPI_PLUGIN_VERSION_01 );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION,
- (void *)&pdesc );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN,
- (void *) des_enc);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN,
- (void *) des_cmp );
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN,
- (void *) des_dec );
- name = slapi_ch_strdup(REVER_SCHEME_NAME);
- rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME,
- name );
-
- init_des_plugin();
-
- slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n\n", rc );
+ rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_des );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) des_enc);
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) des_cmp );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) des_dec );
+ rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name );
+
+ init_pbe_plugin();
+
+ slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n", rc );
return( rc );
}
diff --git a/ldap/servers/plugins/rever/rever.h b/ldap/servers/plugins/rever/rever.h
index 8ea6279..9edddd8 100644
--- a/ldap/servers/plugins/rever/rever.h
+++ b/ldap/servers/plugins/rever/rever.h
@@ -49,7 +49,10 @@
#include "slap.h"
#include "ldaplog.h"
-#define REVER_SCHEME_NAME "DES"
+#define AES_MECH 1
+#define DES_MECH 2
+#define AES_REVER_SCHEME_NAME "AES"
+#define DES_REVER_SCHEME_NAME "DES"
#define PWD_HASH_PREFIX_START '{'
#define PWD_HASH_PREFIX_END '}'
@@ -58,10 +61,10 @@ int rever_cmp( char *userpwd, char *dbpwd );
char *rever_enc( char *pwd );
char *rever_dec( char *pwd );
int rever_init( Slapi_PBlock *pb );
-void init_des_plugin();
+void init_pbe_plugin();
-int encode(char *inPlain, char ** outCipher);
-int decode(char *inCipher, char **outPlain);
+int encode(char *inPlain, char **outCipher, int mech);
+int decode(char *inCipher, char **outPlain, int mech, char *algid);
char *migrateCredentials(char *oldpath, char *newpath, char *oldcred);
typedef char *(*migrate_fn_type)(char *, char *, char *);
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index 0c11238..3cb8451 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -937,6 +937,244 @@ handle_listeners(Connection_Table *ct, listener_info *listener_idxs, int n_liste
return;
}
+/*
+ * Convert any pre-existing DES passwords to AES.
+ *
+ * Grab the "password" attributes and search all the backends for
+ * these attributes and convert them to AES if they are DES encoded.
+ */
+static void
+convert_pbe_des_to_aes()
+{
+ Slapi_PBlock *pb = NULL;
+ Slapi_Entry **entries = NULL;
+ struct slapdplugin *plugin = NULL;
+ char **attrs = NULL;
+ char **backends = NULL;
+ char *val = NULL;
+ int converted_des = 0;
+ int result = -1;
+ int have_aes = 0;
+ int have_des = 0;
+ int i = 0, ii = 0, be_idx = 0;
+
+ /*
+ * Check that AES plugin is enabled, and grab all the unique
+ * password attributes.
+ */
+ for ( plugin = get_plugin_list(PLUGIN_LIST_REVER_PWD_STORAGE_SCHEME);
+ plugin != NULL;
+ plugin = plugin->plg_next )
+ {
+ char *arg = NULL;
+
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "AES") == 0){
+ /* We have the AES plugin, and its enabled */
+ have_aes = 1;
+ }
+ if(plugin->plg_started && strcasecmp(plugin->plg_name, "DES") == 0){
+ /* We have the DES plugin, and its enabled */
+ have_des = 1;
+ }
+ /* Gather all the unique password attributes from all the PBE plugins */
+ for ( i = 0, arg = plugin->plg_argv[i];
+ i < plugin->plg_argc;
+ arg = plugin->plg_argv[++i] )
+ {
+ if(charray_inlist(attrs, arg)){
+ continue;
+ }
+ charray_add(&attrs, slapi_ch_strdup(arg));
+ }
+ }
+
+ if(have_aes && have_des){
+ /*
+ * Build a list of all the backend dn's
+ */
+ Slapi_Backend *be = NULL;
+ struct suffixlist *list;
+ char *cookie = NULL;
+
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Converting DES passwords to AES...\n",0,0,0);
+
+ be = slapi_get_first_backend(&cookie);
+ while (be){
+ int suffix_idx = 0;
+ int count = slapi_counter_get_value(be->be_suffixcounter);
+
+ list = be->be_suffixlist;
+ for (suffix_idx = 0; list && suffix_idx < count; suffix_idx++) {
+ char *suffix = (char *)slapi_sdn_get_ndn(list->be_suffix);
+ if(charray_inlist(backends, suffix) || strlen(suffix) == 0){
+ list = list->next;
+ continue;
+ }
+ charray_add(&backends, slapi_ch_strdup(suffix));
+ list = list->next;
+ }
+ be = slapi_get_next_backend (cookie);
+ }
+ slapi_ch_free ((void **)&cookie);
+
+ /*
+ * Search for the password attributes
+ */
+ for (i = 0; attrs && attrs[i]; i++){
+ char *filter = PR_smprintf("%s=*", attrs[i]);
+ /*
+ * Loop over all the backends looking for the password attribute
+ */
+ for(be_idx = 0; backends[be_idx]; be_idx++){
+ pb = slapi_pblock_new();
+ slapi_search_internal_set_pb(pb, backends[be_idx],
+ LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL,
+ (void *)plugin_get_default_component_id(),
+ SLAPI_OP_FLAG_IGNORE_UNINDEXED);
+ slapi_search_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to search for password on (%s) error (%d)\n",
+ backends[be_idx], result, 0);
+ goto done;
+ }
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries);
+ for (ii = 0; entries && entries[ii]; ii++){
+ if((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))){
+ if(strlen(val) >= 5 && strncmp(val,"{DES}", 5) == 0){
+ /*
+ * We have a DES encoded password, convert it AES
+ */
+ Slapi_PBlock *mod_pb = NULL;
+ Slapi_Value *sval = NULL;
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *passwd = NULL;
+
+ /* decode the DES password */
+ if(pw_rever_decode(val, &passwd, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to decode existing DES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* encode the password */
+ sval = slapi_value_new_string(passwd);
+ if(pw_rever_encode(&sval, attrs[i]) == -1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to encode AES password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), 0, 0);
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ converted_des = 0;
+ goto done;
+ }
+
+ /* replace the attribute in the entry */
+ replace_val[0] = (char *)slapi_value_get_string(sval);
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = attrs[i];
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ mod_pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(mod_pb, slapi_entry_get_dn(entries[ii]),
+ mods, 0, 0, (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(mod_pb);
+
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "failed to convert password for (%s) error (%d)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = -1;
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "successfully converted password for (%s)\n",
+ slapi_entry_get_dn(entries[ii]), result, 0);
+ converted_des = 1;
+
+ }
+ slapi_ch_free_string(&passwd);
+ slapi_value_free(&sval);
+ slapi_pblock_destroy(mod_pb);
+ if(result){
+ goto done;
+ }
+ }
+ slapi_ch_free_string(&val);
+ }
+ }
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+ pb = NULL;
+ }
+ slapi_ch_free_string(&filter);
+ }
+ }
+
+done:
+ charray_free(attrs);
+ charray_free(backends);
+ slapi_free_search_results_internal(pb);
+ slapi_pblock_destroy(pb);
+
+ if (have_aes && have_des){
+ /*
+ * If a conversion attempt did not fail, disable DES plugin
+ */
+ if(converted_des != -1){
+ /*
+ * Disable the DES plugin - this also prevents potentially expensive
+ * searches at every server startup.
+ */
+ LDAPMod mod_replace;
+ LDAPMod *mods[2];
+ char *replace_val[2];
+ char *des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config";
+
+ replace_val[0] = "off";
+ replace_val[1] = NULL;
+ mod_replace.mod_op = LDAP_MOD_REPLACE;
+ mod_replace.mod_type = "nsslapd-pluginEnabled";
+ mod_replace.mod_values = replace_val;
+ mods[0] = &mod_replace;
+ mods[1] = 0;
+
+ pb = slapi_pblock_new();
+ slapi_modify_internal_set_pb(pb, des_dn, mods, 0, 0,
+ (void *)plugin_get_default_component_id(), 0);
+ slapi_modify_internal_pb(pb);
+ slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result);
+ if (LDAP_SUCCESS != result) {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Failed to disable DES plugin (%s), error (%d)\n",
+ des_dn, result, 0);
+ } else {
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Successfully disabled DES plugin (%s)\n",
+ des_dn, 0, 0);
+ }
+ slapi_pblock_destroy(pb);
+ }
+ if(converted_des == 1){
+ LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: "
+ "Finished - all DES passwords have been converted to AES.\n",
+ 0, 0, 0);
+ } else if (converted_des == 0){
+ LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: "
+ "Finished - no DES passwords to convert.\n",0,0,0);
+ }
+ }
+}
+
void slapd_daemon( daemon_ports_t *ports )
{
/* We are passed some ports---one for regular connections, one
@@ -1140,7 +1378,6 @@ void slapd_daemon( daemon_ports_t *ports )
}
#endif /* ENABLE_LDAPI */
#endif
-
listener_idxs = (listener_info *)slapi_ch_calloc(n_listeners, sizeof(*listener_idxs));
/* Now we write the pid file, indicating that the server is finally and listening for connections */
write_pid_file();
@@ -1148,6 +1385,11 @@ void slapd_daemon( daemon_ports_t *ports )
/* The server is ready and listening for connections. Logging "slapd started" message. */
unfurl_banners(the_connection_table,ports,n_tcps,s_tcps,i_unix);
+ /*
+ * Convert old DES encoded passwords to AES
+ */
+ convert_pbe_des_to_aes();
+
/* The meat of the operation is in a loop on a call to select */
while(!g_get_shutdown())
{
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 48188ed..35b45e3 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1123,6 +1123,7 @@ void slapd_pk11_DestroyPublicKey(SECKEYPublicKey *key);
PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm);
PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx);
+CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem);
/*
* start_tls_extop.c
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 082f69a..43a11c7 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -384,9 +384,8 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
if ((!enc) && (( enc = (*pws_enc)( (char*)slapi_value_get_string(vals[ i ]) )) == NULL )) {
return( -1 );
}
-
- slapi_value_free(&vals[ i ]);
- vals[ i ] = slapi_value_new_string_passin(enc);
+ slapi_value_free(&vals[ i ]);
+ vals[ i ] = slapi_value_new_string_passin(enc);
}
return( 0 );
@@ -396,28 +395,57 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals )
* Check if the prefix of the cipher is the one that is supposed to be
* Extract from the whole cipher the encrypted password (remove the prefix)
*/
-int checkPrefix(char *cipher, char *schemaName, char **encrypt)
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid)
{
int namelen;
/* buf contains the extracted schema name */
char *end, buf[ 3*PWD_MAX_NAME_LEN + 1 ];
+ char *delim = NULL;
if ( (*cipher == PWD_HASH_PREFIX_START) &&
- ((end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) &&
- ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)) )
+ (end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL)
{
- memcpy( buf, cipher + 1, namelen );
- buf[ namelen ] = '\0';
- if ( strcasecmp( buf, schemaName) != 0 )
- {
- /* schema names are different, error */
- return 1;
- }
- else
- {
- /* extract the encrypted password */
- *encrypt = cipher + strlen(schemaName) + 2;
- return 0;
+ if((delim = strchr(cipher, PWD_PBE_DELIM)) != NULL){
+ /*
+ * We have an algid in the prefix:
+ *
+ * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD>
+ */
+ if((namelen = delim - cipher - 1) <= (3*PWD_MAX_NAME_LEN)){
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+
+ if ( strcasecmp( buf, schemaName) != 0 ){
+ /* schema names are different, error */
+ return 1;
+ } else {
+ char algid_buf[256];
+
+ /* extract the algid (length is never greater than 216 */
+ memcpy(algid_buf, delim + 1 , (end - delim));
+ algid_buf[end - delim - 1] = '\0';
+ *algid = strdup(algid_buf);
+
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(*algid) + strlen (schemaName) + 3;
+ return 0;
+ }
+ }
+ } else if ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)){
+ /* no delimiter - must be old school DES */
+ memcpy( buf, cipher + 1, namelen );
+ buf[ namelen ] = '\0';
+ if ( strcasecmp( buf, schemaName) != 0 )
+ {
+ /* schema names are different, error */
+ return 1;
+ }
+ else
+ {
+ /* extract the encrypted password */
+ *encrypt = cipher + strlen(schemaName) + 2;
+ return 0;
+ }
}
}
/* cipher is not prefixed, already in clear ? */
@@ -443,6 +471,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
char *L_attr = NULL;
int i = 0;
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK = -1;
/* Get the appropriate decoding function */
@@ -450,10 +479,9 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
if (slapi_attr_types_equivalent(L_attr, attr_name))
{
- typedef char * (*ENCFP)(char *);
+ typedef char * (*ENCFP)(char *, char *);
pwsp = (struct pw_scheme *) slapi_ch_calloc (1, sizeof(struct pw_scheme));
-
pwsp->pws_dec = (ENCFP)p->plg_pwdstorageschemedec;
pwsp->pws_name = slapi_ch_strdup( p->plg_pwdstorageschemename );
pwsp->pws_len = strlen(pwsp->pws_name) ;
@@ -461,7 +489,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
{
/* check that the prefix of the cipher is the same name
as the scheme name */
- prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt);
+ prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt, &algid);
if ( prefixOK == -1 )
{
/* no prefix, already in clear ? */
@@ -471,13 +499,15 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name)
}
else if ( prefixOK == 1 )
{
- /* scheme names are different */
+ /* scheme names are different, try the next plugin */
ret_code = -1;
- goto free_and_return;
+ free_pw_scheme( pwsp );
+ pwsp = NULL;
+ continue;
}
else
{
- if ( ( *plain = (pwsp->pws_dec)( encrypt )) == NULL )
+ if ( ( *plain = (pwsp->pws_dec)( encrypt, algid )) == NULL )
{
/* pb during decoding */
ret_code = -1;
@@ -536,11 +566,13 @@ pw_rever_encode(Slapi_Value **vals, char * attr_name)
for ( i = 0; vals[i] != NULL; ++i )
{
char *encrypt = NULL;
+ char *algid = NULL;
int prefixOK;
prefixOK = checkPrefix((char*)slapi_value_get_string(vals[i]),
pwsp->pws_name,
- &encrypt);
+ &encrypt, &algid);
+ slapi_ch_free_string(&algid);
if ( prefixOK == 0 )
{
/* Don't touch already encoded value */
diff --git a/ldap/servers/slapd/pw.h b/ldap/servers/slapd/pw.h
index 7190a1d..79a90a0 100644
--- a/ldap/servers/slapd/pw.h
+++ b/ldap/servers/slapd/pw.h
@@ -61,7 +61,7 @@ struct pw_scheme *pw_name2scheme( char *name );
struct pw_scheme *pw_val2scheme( char *val, char **valpwdp, int first_is_default );
int pw_encodevals( Slapi_Value **vals );
int pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals );
-int checkPrefix(char *cipher, char *schemaName, char **encrypt);
+int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid);
struct passwordpolicyarray *new_passwdPolicy ( Slapi_PBlock *pb, const char *dn );
void delete_passwdPolicy( struct passwordpolicyarray **pwpolicy);
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 2198337..544a9c7 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -2083,7 +2083,8 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie
slapi_pblock_get( pb, SLAPI_OPERATION_TYPE, &optype );
if(optype == SLAPI_OPERATION_SEARCH && /* search, */
strcmp(notes_str,"") && /* that's unindexed, */
- !(config_get_accesslog_level() & LDAP_DEBUG_ARGS)) /* and not logged in access log */
+ !(config_get_accesslog_level() & LDAP_DEBUG_ARGS) && /* and not logged in access log */
+ !(op->o_flags & SLAPI_OP_FLAG_IGNORE_UNINDEXED) ) /* and not ignoring unindexed search */
{
struct slapdplugin *plugin = NULL;
struct slapi_componentid *cid = NULL;
diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c
index 33d512f..4ffda8b 100644
--- a/ldap/servers/slapd/security_wrappers.c
+++ b/ldap/servers/slapd/security_wrappers.c
@@ -409,3 +409,9 @@ PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot,
return PK11_TokenKeyGenWithFlags(slot, type, param, keySize, keyid,
opFlags, attrFlags, wincx);
}
+
+CK_MECHANISM_TYPE
+slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem)
+{
+ return PK11_GetPBECryptoMechanism(algid, params, pwitem );
+}
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index d234c13..3db8fe7 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -53,9 +53,9 @@
/* Used by SSL and DES plugin */
-#ifdef NEED_TOK_DES
-static char tokDes[34] = "Communicator Generic Crypto Svcs";
-static char ptokDes[34] = "Internal (Software) Token ";
+#ifdef NEED_TOK_PBE
+static char tokPBE[34] = "Communicator Generic Crypto Svcs";
+static char ptokPBE[34] = "Internal (Software) Token ";
#endif
/*
@@ -307,6 +307,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */
#define ATTR_NETSCAPEMDSUFFIX "netscapemdsuffix"
+#define PWD_PBE_DELIM '-'
+
#define REFERRAL_REMOVE_CMD "remove"
/* Filenames for DSE storage */
@@ -1592,7 +1594,7 @@ struct pw_scheme {
char *(*pws_enc)( char *pwd );
/* thread-safe decoding function (returns pointer to malloc'd string) */
- char *(*pws_dec)( char *pwd );
+ char *(*pws_dec)( char *pwd, char *algid);
};
typedef struct passwordpolicyarray {
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index a61d954..41dd2c8 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -222,6 +222,7 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...)
#define SLAPI_OP_FLAG_NO_ACCESS_CHECK 0x10000 /* Do not check for access control - bypass them */
#define SLAPI_OP_FLAG_BYPASS_REFERRALS 0x40000 /* Useful for performing internal operations on read-only replica */
#define SLAPI_OP_FLAG_NEVER_CACHE 0x200000 /* added entry should not be kept in cache */
+#define SLAPI_OP_FLAG_IGNORE_UNINDEXED 0x800000 /* Do not log unindexed search */
#define SLAPI_OC_FLAG_REQUIRED 0x0001
#define SLAPI_OC_FLAG_ALLOWED 0x0002
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 6b51e0c..67d01cd 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -64,7 +64,7 @@
#include <string.h>
#include <errno.h>
-#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */
+#define NEED_TOK_PBE /* defines tokPBE and ptokPBE - see slap.h */
#include "slap.h"
#include "svrcore.h"
@@ -1108,7 +1108,7 @@ slapd_nss_init(int init_ssl, int config_available)
/******** Initialise NSS *********/
nssFlags &= (~NSS_INIT_READONLY);
- slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 );
+ slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 );
secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags);
dongle_file_name = PR_smprintf("%s/pin.txt", certdir);
1
0
ldap/servers/slapd/extendop.c | 2 ++
1 file changed, 2 insertions(+)
New commits:
commit 8a8e1fc6b3fd4662ba3d5828934d2c0a4dab9373
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 14:37:59 2015 -0500
Ticket 47807 - SLAPI_REQUESTOR_ISROOT not set for extended operation plugins
Bug Description: SLAPI_REQUESTOR_ISROOT not set for extended operation plugins
Fix Description: Added the appropriate call to slapi_pblock_set just before
the plugin functions get called in extendop.c
https://fedorahosted.org/389/ticket/47807
Patch proivded by: Jochen Schneider <scne59(a)gmail.com> (Thanks!!)
Reviewed by: mreynolds
(cherry picked from commit ce4ff66498c66a3dd0d59dc2537cc95035c95fd1)
diff --git a/ldap/servers/slapd/extendop.c b/ldap/servers/slapd/extendop.c
index ced632d..4710c98 100644
--- a/ldap/servers/slapd/extendop.c
+++ b/ldap/servers/slapd/extendop.c
@@ -361,6 +361,8 @@ do_extended( Slapi_PBlock *pb )
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_OID, extoid );
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_VALUE, &extval );
+ slapi_pblock_set( pb, SLAPI_REQUESTOR_ISROOT, &pb->pb_op->o_isroot);
+
rc = plugin_call_exop_plugins( pb, extoid );
if ( SLAPI_PLUGIN_EXTENDED_SENT_RESULT != rc ) {
1
0
ldap/servers/slapd/extendop.c | 2 ++
1 file changed, 2 insertions(+)
New commits:
commit ce4ff66498c66a3dd0d59dc2537cc95035c95fd1
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 14:37:59 2015 -0500
Ticket 47807 - SLAPI_REQUESTOR_ISROOT not set for extended operation plugins
Bug Description: SLAPI_REQUESTOR_ISROOT not set for extended operation plugins
Fix Description: Added the appropriate call to slapi_pblock_set just before
the plugin functions get called in extendop.c
https://fedorahosted.org/389/ticket/47807
Patch proivded by: Jochen Schneider <scne59(a)gmail.com> (Thanks!!)
Reviewed by: mreynolds
diff --git a/ldap/servers/slapd/extendop.c b/ldap/servers/slapd/extendop.c
index ced632d..4710c98 100644
--- a/ldap/servers/slapd/extendop.c
+++ b/ldap/servers/slapd/extendop.c
@@ -361,6 +361,8 @@ do_extended( Slapi_PBlock *pb )
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_OID, extoid );
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_VALUE, &extval );
+ slapi_pblock_set( pb, SLAPI_REQUESTOR_ISROOT, &pb->pb_op->o_isroot);
+
rc = plugin_call_exop_plugins( pb, extoid );
if ( SLAPI_PLUGIN_EXTENDED_SENT_RESULT != rc ) {
1
0
src/com/netscape/admin/dirserv/panel/EncryptionPanel.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit f668294a80f37dad8be85348fbe582e817ef2361
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Jan 20 12:47:37 2015 -0500
Ticket 47994 - DS Console always sets nsSSL3 to "on" when a securty setting is adjusted
Bug Description: The DS console always sets "nsSSL3: on" when a security
setting is changed. SSL3 should not be enabled.
Fix Description: Instead set "nsTLS1: on" which is what we really want.
https://fedorahosted.org/389/ticket/47994
Reviewed by: rmeggins(Thanks!)
diff --git a/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java b/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java
index 20d885f..6b2cbc3 100644
--- a/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java
+++ b/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java
@@ -898,7 +898,7 @@ class EncryptionConfigData {
attrs.add(new LDAPAttribute("nsssltoken", setup.selectedDevice));
if (setup.selectedCertificate.length() >= 1) {
- // Strip off the "<token>:" prefix for certs on extrnal tokens
+ // Strip off the "<token>:" prefix for certs on external tokens
String cert = setup.selectedCertificate;
String tokenPrefix = setup.selectedDevice + ":";
if (cert.startsWith(tokenPrefix)) {
@@ -921,7 +921,7 @@ class EncryptionConfigData {
// cn=encryption,cn=config
LDAPModificationSet modSet = new LDAPModificationSet();
String v = sslServerOn ? "on" : "off";
- modSet.add(LDAPModification.REPLACE, new LDAPAttribute("nsssl3", v));
+ modSet.add(LDAPModification.REPLACE, new LDAPAttribute("nsTLS1", v));
switch(clientAuth) {
case CLIENT_AUTH_ALLOWED:
v = "allowed";
1
0
ldap/admin/src/scripts/60upgradeconfigfiles.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 96850932c054edcc477d070cf619006344b1d443
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Tue Jan 20 10:34:41 2015 +0100
Ticket 47991 - upgrade script fails if /etc and /var are on different file systems
Bug Description: the script to upgrade configfiles creates a backup dir in /var
and tries to move files fro /etc to this backup dir
using the perl rename function.
this fails if /etc and /var are different fiel systems
Fix Description: create the backup dir also in /etc
https://fedorahosted.org/389/ticket/47991
Reviewed by: Mark, Thanks
diff --git a/ldap/admin/src/scripts/60upgradeconfigfiles.pl b/ldap/admin/src/scripts/60upgradeconfigfiles.pl
index 4b37353..189eb03 100644
--- a/ldap/admin/src/scripts/60upgradeconfigfiles.pl
+++ b/ldap/admin/src/scripts/60upgradeconfigfiles.pl
@@ -16,7 +16,7 @@ sub runinst {
# make a backup directory to store the deleted config file, then
# don't really delete it, just move it to that directory
my $mode = (stat($inf->{slapd}->{config_dir}))[2];
- my $bakdir = $inf->{slapd}->{bak_dir} . ".bak";
+ my $bakdir = $inf->{slapd}->{config_dir} . "/bak" ;
if (! -d $bakdir) {
$! = 0; # clear
mkdir $bakdir, $mode;
1
0
ldap/admin/src/scripts/60upgradeconfigfiles.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 4b914f299683d66bebd39a170c2c4ca10c037ed0
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Tue Jan 20 10:34:41 2015 +0100
Ticket 47991 - upgrade script fails if /etc and /var are on different file systems
Bug Description: the script to upgrade configfiles creates a backup dir in /var
and tries to move files fro /etc to this backup dir
using the perl rename function.
this fails if /etc and /var are different fiel systems
Fix Description: create the backup dir also in /etc
https://fedorahosted.org/389/ticket/47991
Reviewed by: Mark, Thanks
diff --git a/ldap/admin/src/scripts/60upgradeconfigfiles.pl b/ldap/admin/src/scripts/60upgradeconfigfiles.pl
index 4b37353..189eb03 100644
--- a/ldap/admin/src/scripts/60upgradeconfigfiles.pl
+++ b/ldap/admin/src/scripts/60upgradeconfigfiles.pl
@@ -16,7 +16,7 @@ sub runinst {
# make a backup directory to store the deleted config file, then
# don't really delete it, just move it to that directory
my $mode = (stat($inf->{slapd}->{config_dir}))[2];
- my $bakdir = $inf->{slapd}->{bak_dir} . ".bak";
+ my $bakdir = $inf->{slapd}->{config_dir} . "/bak" ;
if (! -d $bakdir) {
$! = 0; # clear
mkdir $bakdir, $mode;
1
0
ldap/admin/src/scripts/60upgradeconfigfiles.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit c0d233b60311e2bf65dc13eee6f12abe221be932
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Tue Jan 20 10:34:41 2015 +0100
Ticket 47991 - upgrade script fails if /etc and /var are on different file systems
Bug Description: the script to upgrade configfiles creates a backup dir in /var
and tries to move files fro /etc to this backup dir
using the perl rename function.
this fails if /etc and /var are different fiel systems
Fix Description: create the backup dir also in /etc
https://fedorahosted.org/389/ticket/47991
Reviewed by: Mark, Thanks
diff --git a/ldap/admin/src/scripts/60upgradeconfigfiles.pl b/ldap/admin/src/scripts/60upgradeconfigfiles.pl
index 4b37353..189eb03 100644
--- a/ldap/admin/src/scripts/60upgradeconfigfiles.pl
+++ b/ldap/admin/src/scripts/60upgradeconfigfiles.pl
@@ -16,7 +16,7 @@ sub runinst {
# make a backup directory to store the deleted config file, then
# don't really delete it, just move it to that directory
my $mode = (stat($inf->{slapd}->{config_dir}))[2];
- my $bakdir = $inf->{slapd}->{bak_dir} . ".bak";
+ my $bakdir = $inf->{slapd}->{config_dir} . "/bak" ;
if (! -d $bakdir) {
$! = 0; # clear
mkdir $bakdir, $mode;
1
0
ldap/servers/plugins/replication/windows_connection.c | 4 ----
ldap/servers/plugins/replication/windows_protocol_util.c | 8 ++++++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit a605e94c625cb46715516b7afb83fca719485f49
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 16 16:28:06 2015 -0800
Ticket #47989 - Windows Sync accidentally cleared raw_entry
Description: raw_entry in the private area in Windows Agreement stores
raw_entry that is un-schema processed last entry read from AD.
The pointer was cleared before it is being accessed by the Plug-ins that
call Windows Sync API, e.g., Posix Sync. The bug was introduced by
commit f6397113666f06848412bb12f754f04258cfa5fa.
This patch removed the raw_entry cleanup code in windows_search_entry_ext.
And in case the raw_entry is NULL, pass remote_entry for the AD entry.
https://fedorahosted.org/389/ticket/47989
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 3305a6b849f79a9684799bec4cc155c7147daea6)
(cherry picked from commit f6d8b2ec3dee5760826892f522c0f1e1989f9fcb)
(cherry picked from commit 19af1afa4012a66fda2bc5e2e70ac315b70444af)
(cherry picked from commit bf55d5ac6547028ebabdcf19df28cfdd4017872f)
diff --git a/ldap/servers/plugins/replication/windows_connection.c b/ldap/servers/plugins/replication/windows_connection.c
index 105c205..b0f9bb3 100644
--- a/ldap/servers/plugins/replication/windows_connection.c
+++ b/ldap/servers/plugins/replication/windows_connection.c
@@ -671,10 +671,6 @@ windows_search_entry_ext(Repl_Connection *conn, char* searchbase, char *filter,
attrs = NULL;
ldap_controls_free(serverctrls_copy);
serverctrls_copy = NULL;
-
- /* clear it here in case the search fails and
- we are left with a bogus old entry */
- windows_private_set_raw_entry(conn->agmt, NULL);
if (LDAP_SUCCESS == ldap_rc)
{
LDAPMessage *message = ldap_first_entry(conn->ld, res);
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index c95bdbb..12acf94 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -1616,7 +1616,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
windows_map_mods_for_replay(prp,op->p.p_modify.modify_mods, &mapped_mods, is_user, &password);
if (is_user) {
winsync_plugin_call_pre_ad_mod_user_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
@@ -1624,7 +1626,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
&mapped_mods);
} else if (is_group) {
winsync_plugin_call_pre_ad_mod_group_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
1
0
ldap/servers/plugins/replication/windows_connection.c | 4 ----
ldap/servers/plugins/replication/windows_protocol_util.c | 8 ++++++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit bf55d5ac6547028ebabdcf19df28cfdd4017872f
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 16 16:28:06 2015 -0800
Ticket #47989 - Windows Sync accidentally cleared raw_entry
Description: raw_entry in the private area in Windows Agreement stores
raw_entry that is un-schema processed last entry read from AD.
The pointer was cleared before it is being accessed by the Plug-ins that
call Windows Sync API, e.g., Posix Sync. The bug was introduced by
commit f6397113666f06848412bb12f754f04258cfa5fa.
This patch removed the raw_entry cleanup code in windows_search_entry_ext.
And in case the raw_entry is NULL, pass remote_entry for the AD entry.
https://fedorahosted.org/389/ticket/47989
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 3305a6b849f79a9684799bec4cc155c7147daea6)
(cherry picked from commit f6d8b2ec3dee5760826892f522c0f1e1989f9fcb)
(cherry picked from commit 19af1afa4012a66fda2bc5e2e70ac315b70444af)
Conflicts:
ldap/servers/plugins/replication/windows_connection.c
diff --git a/ldap/servers/plugins/replication/windows_connection.c b/ldap/servers/plugins/replication/windows_connection.c
index 105c205..b0f9bb3 100644
--- a/ldap/servers/plugins/replication/windows_connection.c
+++ b/ldap/servers/plugins/replication/windows_connection.c
@@ -671,10 +671,6 @@ windows_search_entry_ext(Repl_Connection *conn, char* searchbase, char *filter,
attrs = NULL;
ldap_controls_free(serverctrls_copy);
serverctrls_copy = NULL;
-
- /* clear it here in case the search fails and
- we are left with a bogus old entry */
- windows_private_set_raw_entry(conn->agmt, NULL);
if (LDAP_SUCCESS == ldap_rc)
{
LDAPMessage *message = ldap_first_entry(conn->ld, res);
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 252694d..c08ecd9 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -1616,7 +1616,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
windows_map_mods_for_replay(prp,op->p.p_modify.modify_mods, &mapped_mods, is_user, &password);
if (is_user) {
winsync_plugin_call_pre_ad_mod_user_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
@@ -1624,7 +1626,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
&mapped_mods);
} else if (is_group) {
winsync_plugin_call_pre_ad_mod_group_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
1
0
ldap/servers/plugins/replication/windows_connection.c | 4 ----
ldap/servers/plugins/replication/windows_protocol_util.c | 8 ++++++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit 19af1afa4012a66fda2bc5e2e70ac315b70444af
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 16 16:28:06 2015 -0800
Ticket #47989 - Windows Sync accidentally cleared raw_entry
Description: raw_entry in the private area in Windows Agreement stores
raw_entry that is un-schema processed last entry read from AD.
The pointer was cleared before it is being accessed by the Plug-ins that
call Windows Sync API, e.g., Posix Sync. The bug was introduced by
commit f6397113666f06848412bb12f754f04258cfa5fa.
This patch removed the raw_entry cleanup code in windows_search_entry_ext.
And in case the raw_entry is NULL, pass remote_entry for the AD entry.
https://fedorahosted.org/389/ticket/47989
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 3305a6b849f79a9684799bec4cc155c7147daea6)
(cherry picked from commit f6d8b2ec3dee5760826892f522c0f1e1989f9fcb)
diff --git a/ldap/servers/plugins/replication/windows_connection.c b/ldap/servers/plugins/replication/windows_connection.c
index e78c367..317386b 100644
--- a/ldap/servers/plugins/replication/windows_connection.c
+++ b/ldap/servers/plugins/replication/windows_connection.c
@@ -814,10 +814,6 @@ next:
slapi_ch_free_string(&filter_copy);
ldap_controls_free(serverctrls_copy);
serverctrls_copy = NULL;
-
- /* clear it here in case the search fails and
- we are left with a bogus old entry */
- windows_private_set_raw_entry(conn->agmt, NULL);
conn->last_ldap_error = ldap_rc;
if (NULL != res)
{
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index caeb388..1e31994 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -1688,7 +1688,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
windows_map_mods_for_replay(prp,op->p.p_modify.modify_mods, &mapped_mods, is_user, &password);
if (is_user) {
winsync_plugin_call_pre_ad_mod_user_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
@@ -1696,7 +1698,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
&mapped_mods);
} else if (is_group) {
winsync_plugin_call_pre_ad_mod_group_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
1
0
ldap/servers/plugins/replication/windows_connection.c | 4 ----
ldap/servers/plugins/replication/windows_protocol_util.c | 8 ++++++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit f6d8b2ec3dee5760826892f522c0f1e1989f9fcb
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 16 16:28:06 2015 -0800
Ticket #47989 - Windows Sync accidentally cleared raw_entry
Description: raw_entry in the private area in Windows Agreement stores
raw_entry that is un-schema processed last entry read from AD.
The pointer was cleared before it is being accessed by the Plug-ins that
call Windows Sync API, e.g., Posix Sync. The bug was introduced by
commit f6397113666f06848412bb12f754f04258cfa5fa.
This patch removed the raw_entry cleanup code in windows_search_entry_ext.
And in case the raw_entry is NULL, pass remote_entry for the AD entry.
https://fedorahosted.org/389/ticket/47989
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 3305a6b849f79a9684799bec4cc155c7147daea6)
diff --git a/ldap/servers/plugins/replication/windows_connection.c b/ldap/servers/plugins/replication/windows_connection.c
index e78c367..317386b 100644
--- a/ldap/servers/plugins/replication/windows_connection.c
+++ b/ldap/servers/plugins/replication/windows_connection.c
@@ -814,10 +814,6 @@ next:
slapi_ch_free_string(&filter_copy);
ldap_controls_free(serverctrls_copy);
serverctrls_copy = NULL;
-
- /* clear it here in case the search fails and
- we are left with a bogus old entry */
- windows_private_set_raw_entry(conn->agmt, NULL);
conn->last_ldap_error = ldap_rc;
if (NULL != res)
{
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index c424590..dabc936 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -1689,7 +1689,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
windows_map_mods_for_replay(prp,op->p.p_modify.modify_mods, &mapped_mods, is_user, &password);
if (is_user) {
winsync_plugin_call_pre_ad_mod_user_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
@@ -1697,7 +1699,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
&mapped_mods);
} else if (is_group) {
winsync_plugin_call_pre_ad_mod_group_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
1
0
ldap/servers/plugins/replication/windows_connection.c | 4 ----
ldap/servers/plugins/replication/windows_protocol_util.c | 8 ++++++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit 3305a6b849f79a9684799bec4cc155c7147daea6
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 16 16:28:06 2015 -0800
Ticket #47989 - Windows Sync accidentally cleared raw_entry
Description: raw_entry in the private area in Windows Agreement stores
raw_entry that is un-schema processed last entry read from AD.
The pointer was cleared before it is being accessed by the Plug-ins that
call Windows Sync API, e.g., Posix Sync. The bug was introduced by
commit f6397113666f06848412bb12f754f04258cfa5fa.
This patch removed the raw_entry cleanup code in windows_search_entry_ext.
And in case the raw_entry is NULL, pass remote_entry for the AD entry.
https://fedorahosted.org/389/ticket/47989
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/plugins/replication/windows_connection.c b/ldap/servers/plugins/replication/windows_connection.c
index e78c367..317386b 100644
--- a/ldap/servers/plugins/replication/windows_connection.c
+++ b/ldap/servers/plugins/replication/windows_connection.c
@@ -814,10 +814,6 @@ next:
slapi_ch_free_string(&filter_copy);
ldap_controls_free(serverctrls_copy);
serverctrls_copy = NULL;
-
- /* clear it here in case the search fails and
- we are left with a bogus old entry */
- windows_private_set_raw_entry(conn->agmt, NULL);
conn->last_ldap_error = ldap_rc;
if (NULL != res)
{
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index c424590..dabc936 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -1689,7 +1689,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
windows_map_mods_for_replay(prp,op->p.p_modify.modify_mods, &mapped_mods, is_user, &password);
if (is_user) {
winsync_plugin_call_pre_ad_mod_user_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
@@ -1697,7 +1699,9 @@ windows_replay_update(Private_Repl_Protocol *prp, slapi_operation_parameters *op
&mapped_mods);
} else if (is_group) {
winsync_plugin_call_pre_ad_mod_group_mods_cb(prp->agmt,
- windows_private_get_raw_entry(prp->agmt),
+ windows_private_get_raw_entry(prp->agmt)?
+ windows_private_get_raw_entry(prp->agmt):
+ remote_entry,
local_dn,
local_entry,
op->p.p_modify.modify_mods,
1
0
ldap/servers/slapd/entry.c | 2 ++
ldap/servers/slapd/entrywsi.c | 8 ++++++--
2 files changed, 8 insertions(+), 2 deletions(-)
New commits:
commit 391539ad412f3ba215c1ebebc465a1adb5b1674d
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Fri Jan 9 13:28:05 2015 +0100
Ticket 47964 - v2 - Incorrect search result after replacing an empty attribute
Bug Description: when a replace operation for a nonexisting attribute is
done without providing new values the entry is stored
with incorrect meta data: an empty deleted value without
attribute deletion csn.
Fix Description: in the delete phase of the replace operation already create
the attribute to set the deletion csn. It would be created anyway
in the add part of the replace operation.
The function to calculate the required size to write the entry
needs also to be adjusted.
https://fedorahosted.org/389/ticket/47964
Reviewed by: Rich, thanks
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 718d78a..203c742 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -1554,6 +1554,8 @@ entry2str_internal_size_attrlist( const Slapi_Attr *attrlist, int entry2str_ctrl
* We need to add the size for that.
*/
elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ /* need also space for ";deletedattribute;deleted" */
+ elen += DELETED_ATTR_STRSIZE + DELETED_VALUE_STRSIZE;
}
}
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 41afe1a..8931db1 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -680,9 +680,13 @@ entry_delete_present_values_wsi(Slapi_Entry *e, const char *type, struct berval
}
retVal = LDAP_NO_SUCH_ATTRIBUTE;
}
- if ((LDAP_MOD_REPLACE == mod_op) && replacevals && replacevals[0])
+ if ((LDAP_MOD_REPLACE == mod_op))
{
- /* Create a new attribute and set the adcsn */
+ /* Create a new attribute and set the adcsn
+ * We need to do this always to set the deletion csn
+ * The attribute would otherwise be created in the
+ * entry_add_.. function
+ */
Slapi_Attr *a = slapi_attr_new();
slapi_attr_init(a, type);
attr_set_deletion_csn(a,csn);
1
0
ldap/servers/slapd/entry.c | 2 ++
ldap/servers/slapd/entrywsi.c | 8 ++++++--
2 files changed, 8 insertions(+), 2 deletions(-)
New commits:
commit a37956520f3678c3975979570eb3c163da584e5f
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Fri Jan 9 13:28:05 2015 +0100
Ticket 47964 - v2 - Incorrect search result after replacing an empty attribute
Bug Description: when a replace operation for a nonexisting attribute is
done without providing new values the entry is stored
with incorrect meta data: an empty deleted value without
attribute deletion csn.
Fix Description: in the delete phase of the replace operation already create
the attribute to set the deletion csn. It would be created anyway
in the add part of the replace operation.
The function to calculate the required size to write the entry
needs also to be adjusted.
https://fedorahosted.org/389/ticket/47964
Reviewed by: Rich, thanks
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 0679eb7..70c7f13 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -1536,6 +1536,8 @@ entry2str_internal_size_attrlist( const Slapi_Attr *attrlist, int entry2str_ctrl
* We need to add the size for that.
*/
elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ /* need also space for ";deletedattribute;deleted" */
+ elen += DELETED_ATTR_STRSIZE + DELETED_VALUE_STRSIZE;
}
}
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index c8055d8..be83580 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -680,9 +680,13 @@ entry_delete_present_values_wsi(Slapi_Entry *e, const char *type, struct berval
}
retVal = LDAP_NO_SUCH_ATTRIBUTE;
}
- if ((LDAP_MOD_REPLACE == mod_op) && replacevals && replacevals[0])
+ if ((LDAP_MOD_REPLACE == mod_op))
{
- /* Create a new attribute and set the adcsn */
+ /* Create a new attribute and set the adcsn
+ * We need to do this always to set the deletion csn
+ * The attribute would otherwise be created in the
+ * entry_add_.. function
+ */
Slapi_Attr *a = slapi_attr_new();
slapi_attr_init(a, type);
attr_set_deletion_csn(a,csn);
1
0
ldap/servers/slapd/entry.c | 2 ++
ldap/servers/slapd/entrywsi.c | 8 ++++++--
2 files changed, 8 insertions(+), 2 deletions(-)
New commits:
commit 3182d2e8524c319393ab37ffcf6a8aefb9b92b54
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Fri Jan 9 13:28:05 2015 +0100
Ticket 47964 - v2 - Incorrect search result after replacing an empty attribute
Bug Description: when a replace operation for a nonexisting attribute is
done without providing new values the entry is stored
with incorrect meta data: an empty deleted value without
attribute deletion csn.
Fix Description: in the delete phase of the replace operation already create
the attribute to set the deletion csn. It would be created anyway
in the add part of the replace operation.
The function to calculate the required size to write the entry
needs also to be adjusted.
https://fedorahosted.org/389/ticket/47964
Reviewed by: Rich, thanks
diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c
index 718d78a..203c742 100644
--- a/ldap/servers/slapd/entry.c
+++ b/ldap/servers/slapd/entry.c
@@ -1554,6 +1554,8 @@ entry2str_internal_size_attrlist( const Slapi_Attr *attrlist, int entry2str_ctrl
* We need to add the size for that.
*/
elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE;
+ /* need also space for ";deletedattribute;deleted" */
+ elen += DELETED_ATTR_STRSIZE + DELETED_VALUE_STRSIZE;
}
}
}
diff --git a/ldap/servers/slapd/entrywsi.c b/ldap/servers/slapd/entrywsi.c
index 41afe1a..8931db1 100644
--- a/ldap/servers/slapd/entrywsi.c
+++ b/ldap/servers/slapd/entrywsi.c
@@ -680,9 +680,13 @@ entry_delete_present_values_wsi(Slapi_Entry *e, const char *type, struct berval
}
retVal = LDAP_NO_SUCH_ATTRIBUTE;
}
- if ((LDAP_MOD_REPLACE == mod_op) && replacevals && replacevals[0])
+ if ((LDAP_MOD_REPLACE == mod_op))
{
- /* Create a new attribute and set the adcsn */
+ /* Create a new attribute and set the adcsn
+ * We need to do this always to set the deletion csn
+ * The attribute would otherwise be created in the
+ * entry_add_.. function
+ */
Slapi_Attr *a = slapi_attr_new();
slapi_attr_init(a, type);
attr_set_deletion_csn(a,csn);
1
0
Changes since the dawn of time:
David Boreham (17):
Merge over new code: fractional replication, wan replication and windows sync plus associated UI
Merge password sync code from Bozeman Pass
Change password sync copyright notices, merge fixes to password sync code
Fix instability in re-try and backoff mechanism
Add new NT4 LDAP Service, used by windows sync
Fix handling of group membership, fix installer GUID, fix handling of entry description
Change GUID for installer
Fix display names in pass sync to say Fedora
Fix display name to say Fedora...
Fix various bad memory free bugs
Merge fixes over
Fixes for memory leaks in ntds
Patches we apply to apache ds 0.9
Update packaging for ntds
Fix ntds installer to allow repair and removal
Memory Leak Fixes for Apache DS
Fix for #157895 : logon hours doesn't work
Nathan Kinder (22):
Copyright updates
155068 - Added license to source files
Fixed licensing typo
Fix search scope for AD password sync - 159037
170321 - Increase winsync version to 1.0.1
170328 - Fixed modify type installation so it actually updates the registry
170558 - Add certutil, pk12util and missing dlls to PassSync.msi
170558 - Add certutil, pk12util and missing dlls to PassSync.msi
170135 - Improved passsync logging facilities
170556 - Make passsync obey backoff for retries when DS is down
170816 - Don't consume password changes if modify fails
170071 - Automatically add grouptype for new groups being synchd to NT4
Initial drop of new stand-alone winsync build-system
Changed unix style line endings to DOS style for nmake makefiles
Remove carriage returns from nmake makefiles
Initial checkin of stand-alone winsync build-system
186765 - Fixed memory leaks in passsync service
186171 - Fixed memory leaks in passhook.dll
186657 - Implemented locking around passhook data file access
Related: 490048
Related: 490048
ticket 47352 - Abandon old password changes prior to syncing
Noriko Hosoi (8):
Ticket #47353 - PassSync fails to open changelog
Ticket #47357 - Update the PassSync build environment
Ticket #47357 - Update the PassSync build environment
Ticket #47351 - Passsync loops when updating password of locked user
Ticket #363 - Passsync/Winsync handles passwords with 8-th bit characters incorrectly
bump verison to 1.1.5
Bug 980432 - Password Synchronization Service cannot be upgraded
Ticket #47987 - Support TLS1.1 and newer SSL versions
Rich Megginson (12):
Resolves: bug 471408
Resolves: bug 482892
Resolves: bug 426421 245630 476095
remove internal paths ; use new improved unzip.vbs
Resolves: Bug 482892
Resolves: bug 482892
Resolves: bug 490048
rename to 389
Add support for Windows 2008, VC 9, 64-bit and 32-bit
Allow install to continue if service fails
Fix install issues on 2008 - bump version to 1.1.3
use nspr 4.8.4 and nss 3.12.6 - bump version to 1.1.4
Thomas Lackey (3):
Add makefile and component information to build the Apache DS for User Sync
Add installer icons.
Modify NTDS and PassSync to build in the 'built' directory.
unknown (4):
handle 32-bit and 64-bit ldapcsdk with different dates
Add VC runtime merge module - Add migration
Remove files on uninstall - allow install to continue if service doesn't start
Allow BRAND with spaces - remove CANDLE.EXE tracing
1
0
passwordsync/build.bat passwordsync/passhook passwordsync/passsync passwordsync/wix usersync/build.bat usersync/wrapper
by Noriko Hosoi 15 Jan '15
by Noriko Hosoi 15 Jan '15
15 Jan '15
passwordsync/build.bat | 6 +++---
passwordsync/passhook/passhook.mak | 2 +-
passwordsync/passsync/passsync.dsp | 2 +-
passwordsync/passsync/passsync.mak | 2 +-
passwordsync/wix/PassSync.wxs | 6 +++---
5 files changed, 9 insertions(+), 9 deletions(-)
New commits:
commit 012c6ecea3f9670217014ad0e83941eaa683042d
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Jan 15 17:20:00 2015 -0800
Ticket #47987 - Support TLS1.1 and newer SSL versions
Description:
Adjusting PassSync to the latest libraries.
. NSPR: nspr-win-4.10.6-1
. NSS: nss-win-3.16.2.3-2
. MOZLDAP: ldap-c-sdk-win-6.0.7-7
By default, PassSync uses TLS1.1 and newer SSL versions supported
by the NSS. To force to enable SSLv3.0, an environment variable
LDAPSSL_ALLOW_OLD_SSL_VERSION has to be set with some non NULL
value in Computer | Properties | Advanced system settings |
Environment Variables | System variables, add
variable: LDAPSSL_ALLOW_OLD_SSL_VERSION
value: 1
It will allow PassSync with this patch to connect to the server
that runs only accept SSLv3.0.
[...] conn=17 SSL3 128-bit AES
Note: bumped the PassSync version to 1.1.6.
https://fedorahosted.org/389/ticket/47987
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/passwordsync/build.bat b/passwordsync/build.bat
old mode 100644
new mode 100755
index daf95b4..7aa861a
--- a/passwordsync/build.bat
+++ b/passwordsync/build.bat
@@ -50,7 +50,7 @@ set DOWNLOAD=%BITSADMIN% /wrap /transfer passsyncbuild /download /priority norma
@rem HACK HACK HACK
@rem unzip.vbs just stopped working - gives File or Folder exists
@rem which is clearly not true
-@ren so, fall back on MozillaTools
+@rem so, fall back on MozillaTools
set UZCMD=C:\mozilla-build\info-zip\unzip.exe -q
@rem set UZCMD=cscript //nologo "%CD%\unzip.vbs"
@rem set DOWNLOAD=wget --no-directories
@@ -170,7 +170,7 @@ if [%BRANDNOSPACE%] == [] (
set BRANDNOSPACE=389
)
if [%VERSION%] == [] (
- set VERSION=1.1.5
+ set VERSION=1.1.6
)
rem ======== Set Various Build Directories ========
@@ -273,7 +273,7 @@ pushd "%CD%"
rem ======== Build ========
rem ------ Set Build Paths ------
-set INCLUDE=%INCLUDE%;%LIBROOT%\ldapsdk\public\ldap;%LIBROOT%\nspr\include;%LIBROOT%\nss\include
+set INCLUDE=%INCLUDE%;%LIBROOT%\ldapsdk\include\ldap;%LIBROOT%\nspr\include\nspr;%LIBROOT%\nss\include
set LIB=%LIB%;%LIBROOT%\ldapsdk\lib;%LIBROOT%\nspr\lib;%LIBROOT%\nss\lib
rem ------ PassSync ------
diff --git a/passwordsync/passhook/passhook.mak b/passwordsync/passhook/passhook.mak
index 46ed160..318746c 100644
--- a/passwordsync/passhook/passhook.mak
+++ b/passwordsync/passhook/passhook.mak
@@ -85,7 +85,7 @@ OPT_CPPFLAGS=/MT /O2 /D "NDEBUG" $(COMMON_CPPFLAGS)
DBG_CPPFLAGS=/MTd /Gm /Zi /D "_DEBUG" /RTC1 $(COMMON_CPPFLAGS)
SYS_LIBS=kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib
-MOZ_LIBS=nss3.lib nssutil3.lib libplc4.lib libnspr4.lib
+MOZ_LIBS=nss3.lib nssutil3.lib plc4.lib nspr4.lib
LIBS=$(SYS_LIBS) $(MOZ_LIBS)
DEF_FILE= \
diff --git a/passwordsync/passsync/passsync.dsp b/passwordsync/passsync/passsync.dsp
index 3219da9..622687c 100644
--- a/passwordsync/passsync/passsync.dsp
+++ b/passwordsync/passsync/passsync.dsp
@@ -73,7 +73,7 @@ BSC32=bscmake.exe
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 nss3.lib libplc4.lib libnspr4.lib nsldappr32v50.lib nsldapssl32v50.lib nsldap32v50.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
+# ADD LINK32 nss3.lib plc4.lib nspr4.lib nsldappr32v50.lib nsldapssl32v50.lib nsldap32v50.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
!ENDIF
diff --git a/passwordsync/passsync/passsync.mak b/passwordsync/passsync/passsync.mak
index 1a44fbd..f54c48f 100644
--- a/passwordsync/passsync/passsync.mak
+++ b/passwordsync/passsync/passsync.mak
@@ -74,7 +74,7 @@ OPT_CPPFLAGS=/MT /O2 /D "NDEBUG" $(COMMON_CPPFLAGS)
DBG_CPPFLAGS=/MTd /Gm /Zi /D "_DEBUG" /RTC1 $(COMMON_CPPFLAGS)
SYS_LIBS=kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib
-MOZ_LIBS=nss3.lib nssutil3.lib libplc4.lib libnspr4.lib nsldappr32v60.lib nsldapssl32v60.lib nsldap32v60.lib
+MOZ_LIBS=nss3.lib nssutil3.lib plc4.lib nspr4.lib nsldappr32v60.lib nsldapssl32v60.lib nsldap32v60.lib
LIBS=$(SYS_LIBS) $(MOZ_LIBS)
COMMON_LDFLAGS=$(MACH) /MANIFEST /nologo /subsystem:console /pdb:"$(OUTDIR)\passsync.pdb" /out:$@ dssynchmsg.res
diff --git a/passwordsync/wix/PassSync.wxs b/passwordsync/wix/PassSync.wxs
index 6200643..55b3c56 100644
--- a/passwordsync/wix/PassSync.wxs
+++ b/passwordsync/wix/PassSync.wxs
@@ -202,15 +202,15 @@
</Component>
<Component Id='NSPRLibrary' Guid='7DFF5449-F38C-4C3B-9876-E32A123F1EA5' Win64='$(var.Property_Win64)'>
- <File Id='NSPR' Name='libnspr4.dll' DiskId='1' Source='libnspr4.dll' Vital='yes' />
+ <File Id='NSPR' Name='nspr4.dll' DiskId='1' Source='nspr4.dll' Vital='yes' />
</Component>
<Component Id='NSPRpldsLibrary' Guid='50C89341-754F-4092-8307-129DB119B42E' Win64='$(var.Property_Win64)'>
- <File Id='NSPRPLDS' Name='libplds4.dll' DiskId='1' Source='libplds4.dll' Vital='yes' />
+ <File Id='NSPRPLDS' Name='plds4.dll' DiskId='1' Source='plds4.dll' Vital='yes' />
</Component>
<Component Id='NSPRplcLibrary' Guid='1B8B1D78-E2C1-4F3A-A841-C79FFE26E6E0' Win64='$(var.Property_Win64)'>
- <File Id='NSPRPLC' Name='libplc4.dll' DiskId='1' Source='libplc4.dll' Vital='yes' />
+ <File Id='NSPRPLC' Name='plc4.dll' DiskId='1' Source='plc4.dll' Vital='yes' />
</Component>
<Component Id='NSSLibrary' Guid='5E122346-6B77-456D-BCC5-76D7FA8AF258' Win64='$(var.Property_Win64)'>
diff --git a/usersync/build.bat b/usersync/build.bat
old mode 100644
new mode 100755
diff --git a/usersync/wrapper/usersync.bat b/usersync/wrapper/usersync.bat
old mode 100644
new mode 100755
1
0
ldap/servers/slapd/back-ldbm/dblayer.c | 33 +++++++++++++++++++++--------
ldap/servers/slapd/back-ldbm/dblayer.h | 2 +
ldap/servers/slapd/back-ldbm/ldbm_config.c | 4 +--
3 files changed, 29 insertions(+), 10 deletions(-)
New commits:
commit 295cf31602797b09a3b7a7c7e8d2feb71017522b
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 16:50:12 2015 -0800
Ticket #47934 - nsslapd-db-locks modify not taking into account.
Description: Updating the value of nsslapd-db-locks was not detected
at the server's startup time. As suggested in
https://fedorahosted.org/389/ticket/47934#comment:1
the value is stored in the guardian file as "locks:20000" at the shut-
down time. When restarting the server, the nsslapd-db-locks value in
cn=config,cn=ldbm database,cn=plugins,cn=config is compared with the
stored value (20000, in this example) and if they don't match, the
lock table is recreated. The change is logged in the error log:
[...] - resizing max db lock count: 20000 -> 30000
https://fedorahosted.org/389/ticket/47934
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit f4437defacf8812c5f95869147a99f8412dc4a07)
(cherry picked from commit dc4185ea40e1f1b8527a67a0c854fcc29b8bafe7)
(cherry picked from commit d1e4698530868532bd472c70ca8ccc4a317b4199)
(cherry picked from commit 86b728f88fe0d35f403c012166f98c3a0e69ad32)
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index fe7a617..9186adf 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -1069,6 +1069,8 @@ static void dblayer_dump_config_tracing(dblayer_private *priv)
LDAPDebug(LDAP_DEBUG_TRACE,"private import mem=%d\n",priv->dblayer_private_import_mem,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"shm_key=%ld\n",priv->dblayer_shm_key,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"lockdown=%d\n",priv->dblayer_lockdown,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"locks=%d\n",priv->dblayer_lock_config,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"previous_locks=%d\n",priv->dblayer_previous_lock_config,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"tx_max=%d\n",priv->dblayer_tx_max,0,0);
}
@@ -1597,13 +1599,24 @@ dblayer_start(struct ldbminfo *li, int dbmode)
/* Is the cache being re-sized ? (If we're just doing an archive or export,
* we don't care if the cache is being re-sized) */
- if ( (priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
- ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
- (priv->dblayer_ncache != priv->dblayer_previous_ncache)) &&
- !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "I'm resizing my cache now...cache was %lu and is now %lu\n",
+ if ((priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
+ (priv->dblayer_previous_lock_config) &&
+ ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
+ (priv->dblayer_ncache != priv->dblayer_previous_ncache) ||
+ (priv->dblayer_lock_config != priv->dblayer_previous_lock_config)) &&
+ !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
+ if (priv->dblayer_cachesize != priv->dblayer_previous_cachesize) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache size: %lu -> %lu\n",
priv->dblayer_previous_cachesize, priv->dblayer_cachesize, 0);
+ }
+ if (priv->dblayer_ncache != priv->dblayer_previous_ncache) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache count: %d -> %d\n",
+ priv->dblayer_previous_ncache, priv->dblayer_ncache, 0);
+ }
+ if (priv->dblayer_lock_config != priv->dblayer_previous_lock_config) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing max db lock count: %d -> %d\n",
+ priv->dblayer_previous_lock_config, priv->dblayer_lock_config, 0);
+ }
dblayer_reset_env(li);
/*
* Once pEnv->remove (via dblayer_reset_env) has been called,
@@ -4786,8 +4799,8 @@ static int commit_good_database(dblayer_private *priv)
filename, PR_GetError(), slapd_pr_strerror(PR_GetError()) );
return -1;
}
- PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\n",
- priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR);
+ PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\nlocks:%d\n",
+ (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR, priv->dblayer_lock_config);
num_bytes = strlen(line);
return_value = slapi_write_buffer(prfd, line, num_bytes);
if (return_value != num_bytes)
@@ -4833,6 +4846,7 @@ static int read_metadata(struct ldbminfo *li)
* priv->dblayer_recovery_required = 0; */
priv->dblayer_previous_cachesize = 0;
priv->dblayer_previous_ncache = 0;
+ priv->dblayer_previous_lock_config = 0;
/* Open the guard file and read stuff, then delete it */
PR_snprintf(filename,sizeof(filename),"%s/guardian",priv->dblayer_home_directory);
@@ -4902,6 +4916,9 @@ static int read_metadata(struct ldbminfo *li)
number = atoi(value);
priv->dblayer_previous_ncache = number;
} else if (0 == strcmp("version",attribute)) {
+ } else if (0 == strcmp("locks",attribute)) {
+ number = atoi(value);
+ priv->dblayer_previous_lock_config = number;
}
if (NULL == nextline || '\0' == *nextline) {
/* Nothing more to read */
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.h b/ldap/servers/slapd/back-ldbm/dblayer.h
index 4ff9d53..3e4f4d8 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.h
+++ b/ldap/servers/slapd/back-ldbm/dblayer.h
@@ -178,6 +178,8 @@ struct dblayer_private
PRCondVar *thread_count_cv; /* condition variable for housekeeping thread shutdown */
int dblayer_lockdown; /* use DB_LOCKDOWN */
int dblayer_lock_config;
+ int dblayer_previous_lock_config;/* Max lock count when we last shut down--
+ * used to determine if we delete the mpool */
u_int32_t dblayer_deadlock_policy; /* i.e. the atype to DB_ENV->lock_detect in deadlock_threadmain */
};
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index 11aa42d..462b0a1 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -948,7 +948,7 @@ static int ldbm_config_db_lock_set(void *arg, void *value, char *errorbuf, int p
if (apply) {
if (CONFIG_PHASE_RUNNING == phase) {
li->li_dblayer_private->dblayer_lock_config = val;
- LDAPDebug(LDAP_DEBUG_ANY, "New db cache size will not take affect until the server is restarted\n", 0, 0, 0);
+ LDAPDebug(LDAP_DEBUG_ANY, "New db max lock count will not take affect until the server is restarted\n", 0, 0, 0);
} else {
li->li_dblayer_private->dblayer_lock_config = val;
}
@@ -1390,7 +1390,7 @@ static config_info ldbm_config[] = {
{CONFIG_DB_VERBOSE, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_verbose_get, &ldbm_config_db_verbose_set, 0},
{CONFIG_DB_DEBUG, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_debug_get, &ldbm_config_db_debug_set, 0},
{CONFIG_DB_NAMED_REGIONS, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_named_regions_get, &ldbm_config_db_named_regions_set, 0},
- {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, 0},
+ {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, CONFIG_FLAG_ALWAYS_SHOW},
{CONFIG_DB_PRIVATE_MEM, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_private_mem_get, &ldbm_config_db_private_mem_set, 0},
{CONFIG_DB_PRIVATE_IMPORT_MEM, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_private_import_mem_get, &ldbm_config_db_private_import_mem_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONDIF_DB_ONLINE_IMPORT_ENCRYPT, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_online_import_encrypt_get, &ldbm_config_db_online_import_encrypt_set, 0},
1
0
ldap/servers/slapd/back-ldbm/dblayer.c | 33 +++++++++++++++++++++--------
ldap/servers/slapd/back-ldbm/dblayer.h | 2 +
ldap/servers/slapd/back-ldbm/ldbm_config.c | 4 +--
3 files changed, 29 insertions(+), 10 deletions(-)
New commits:
commit 86b728f88fe0d35f403c012166f98c3a0e69ad32
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 16:50:12 2015 -0800
Ticket #47934 - nsslapd-db-locks modify not taking into account.
Description: Updating the value of nsslapd-db-locks was not detected
at the server's startup time. As suggested in
https://fedorahosted.org/389/ticket/47934#comment:1
the value is stored in the guardian file as "locks:20000" at the shut-
down time. When restarting the server, the nsslapd-db-locks value in
cn=config,cn=ldbm database,cn=plugins,cn=config is compared with the
stored value (20000, in this example) and if they don't match, the
lock table is recreated. The change is logged in the error log:
[...] - resizing max db lock count: 20000 -> 30000
https://fedorahosted.org/389/ticket/47934
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit f4437defacf8812c5f95869147a99f8412dc4a07)
(cherry picked from commit dc4185ea40e1f1b8527a67a0c854fcc29b8bafe7)
(cherry picked from commit d1e4698530868532bd472c70ca8ccc4a317b4199)
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 89effd4..b4803ad 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -1070,6 +1070,8 @@ static void dblayer_dump_config_tracing(dblayer_private *priv)
LDAPDebug(LDAP_DEBUG_TRACE,"private import mem=%d\n",priv->dblayer_private_import_mem,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"shm_key=%ld\n",priv->dblayer_shm_key,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"lockdown=%d\n",priv->dblayer_lockdown,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"locks=%d\n",priv->dblayer_lock_config,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"previous_locks=%d\n",priv->dblayer_previous_lock_config,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"tx_max=%d\n",priv->dblayer_tx_max,0,0);
}
@@ -1624,13 +1626,24 @@ dblayer_start(struct ldbminfo *li, int dbmode)
/* Is the cache being re-sized ? (If we're just doing an archive or export,
* we don't care if the cache is being re-sized) */
- if ( (priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
- ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
- (priv->dblayer_ncache != priv->dblayer_previous_ncache)) &&
- !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "I'm resizing my cache now...cache was %lu and is now %lu\n",
+ if ((priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
+ (priv->dblayer_previous_lock_config) &&
+ ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
+ (priv->dblayer_ncache != priv->dblayer_previous_ncache) ||
+ (priv->dblayer_lock_config != priv->dblayer_previous_lock_config)) &&
+ !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
+ if (priv->dblayer_cachesize != priv->dblayer_previous_cachesize) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache size: %lu -> %lu\n",
priv->dblayer_previous_cachesize, priv->dblayer_cachesize, 0);
+ }
+ if (priv->dblayer_ncache != priv->dblayer_previous_ncache) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache count: %d -> %d\n",
+ priv->dblayer_previous_ncache, priv->dblayer_ncache, 0);
+ }
+ if (priv->dblayer_lock_config != priv->dblayer_previous_lock_config) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing max db lock count: %d -> %d\n",
+ priv->dblayer_previous_lock_config, priv->dblayer_lock_config, 0);
+ }
dblayer_reset_env(li);
/*
* Once pEnv->remove (via dblayer_reset_env) has been called,
@@ -4897,8 +4910,8 @@ static int commit_good_database(dblayer_private *priv)
filename, PR_GetError(), slapd_pr_strerror(PR_GetError()) );
return -1;
}
- PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\n",
- (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR);
+ PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\nlocks:%d\n",
+ (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR, priv->dblayer_lock_config);
num_bytes = strlen(line);
return_value = slapi_write_buffer(prfd, line, num_bytes);
if (return_value != num_bytes)
@@ -4944,6 +4957,7 @@ static int read_metadata(struct ldbminfo *li)
* priv->dblayer_recovery_required = 0; */
priv->dblayer_previous_cachesize = 0;
priv->dblayer_previous_ncache = 0;
+ priv->dblayer_previous_lock_config = 0;
/* Open the guard file and read stuff, then delete it */
PR_snprintf(filename,sizeof(filename),"%s/guardian",priv->dblayer_home_directory);
@@ -5013,6 +5027,9 @@ static int read_metadata(struct ldbminfo *li)
number = atoi(value);
priv->dblayer_previous_ncache = number;
} else if (0 == strcmp("version",attribute)) {
+ } else if (0 == strcmp("locks",attribute)) {
+ number = atoi(value);
+ priv->dblayer_previous_lock_config = number;
}
if (NULL == nextline || '\0' == *nextline) {
/* Nothing more to read */
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.h b/ldap/servers/slapd/back-ldbm/dblayer.h
index 4ff9d53..3e4f4d8 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.h
+++ b/ldap/servers/slapd/back-ldbm/dblayer.h
@@ -178,6 +178,8 @@ struct dblayer_private
PRCondVar *thread_count_cv; /* condition variable for housekeeping thread shutdown */
int dblayer_lockdown; /* use DB_LOCKDOWN */
int dblayer_lock_config;
+ int dblayer_previous_lock_config;/* Max lock count when we last shut down--
+ * used to determine if we delete the mpool */
u_int32_t dblayer_deadlock_policy; /* i.e. the atype to DB_ENV->lock_detect in deadlock_threadmain */
};
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index b5bf1bf..c74fbb7 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -948,7 +948,7 @@ static int ldbm_config_db_lock_set(void *arg, void *value, char *errorbuf, int p
if (apply) {
if (CONFIG_PHASE_RUNNING == phase) {
li->li_dblayer_private->dblayer_lock_config = val;
- LDAPDebug(LDAP_DEBUG_ANY, "New db cache size will not take affect until the server is restarted\n", 0, 0, 0);
+ LDAPDebug(LDAP_DEBUG_ANY, "New db max lock count will not take affect until the server is restarted\n", 0, 0, 0);
} else {
li->li_dblayer_private->dblayer_lock_config = val;
}
@@ -1390,7 +1390,7 @@ static config_info ldbm_config[] = {
{CONFIG_DB_VERBOSE, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_verbose_get, &ldbm_config_db_verbose_set, 0},
{CONFIG_DB_DEBUG, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_debug_get, &ldbm_config_db_debug_set, 0},
{CONFIG_DB_NAMED_REGIONS, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_named_regions_get, &ldbm_config_db_named_regions_set, 0},
- {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, 0},
+ {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, CONFIG_FLAG_ALWAYS_SHOW},
{CONFIG_DB_PRIVATE_MEM, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_private_mem_get, &ldbm_config_db_private_mem_set, 0},
{CONFIG_DB_PRIVATE_IMPORT_MEM, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_private_import_mem_get, &ldbm_config_db_private_import_mem_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONDIF_DB_ONLINE_IMPORT_ENCRYPT, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_online_import_encrypt_get, &ldbm_config_db_online_import_encrypt_set, 0},
1
0
ldap/servers/slapd/back-ldbm/dblayer.c | 33 +++++++++++++++++++++--------
ldap/servers/slapd/back-ldbm/dblayer.h | 2 +
ldap/servers/slapd/back-ldbm/ldbm_config.c | 4 +--
3 files changed, 29 insertions(+), 10 deletions(-)
New commits:
commit d1e4698530868532bd472c70ca8ccc4a317b4199
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 16:50:12 2015 -0800
Ticket #47934 - nsslapd-db-locks modify not taking into account.
Description: Updating the value of nsslapd-db-locks was not detected
at the server's startup time. As suggested in
https://fedorahosted.org/389/ticket/47934#comment:1
the value is stored in the guardian file as "locks:20000" at the shut-
down time. When restarting the server, the nsslapd-db-locks value in
cn=config,cn=ldbm database,cn=plugins,cn=config is compared with the
stored value (20000, in this example) and if they don't match, the
lock table is recreated. The change is logged in the error log:
[...] - resizing max db lock count: 20000 -> 30000
https://fedorahosted.org/389/ticket/47934
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit f4437defacf8812c5f95869147a99f8412dc4a07)
(cherry picked from commit dc4185ea40e1f1b8527a67a0c854fcc29b8bafe7)
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 8e60210..76315a4 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -1163,6 +1163,8 @@ static void dblayer_dump_config_tracing(dblayer_private *priv)
LDAPDebug(LDAP_DEBUG_TRACE,"private import mem=%d\n",priv->dblayer_private_import_mem,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"shm_key=%ld\n",priv->dblayer_shm_key,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"lockdown=%d\n",priv->dblayer_lockdown,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"locks=%d\n",priv->dblayer_lock_config,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"previous_locks=%d\n",priv->dblayer_previous_lock_config,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"tx_max=%d\n",priv->dblayer_tx_max,0,0);
}
@@ -1718,13 +1720,24 @@ dblayer_start(struct ldbminfo *li, int dbmode)
/* Is the cache being re-sized ? (If we're just doing an archive or export,
* we don't care if the cache is being re-sized) */
- if ( (priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
- ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
- (priv->dblayer_ncache != priv->dblayer_previous_ncache)) &&
- !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "I'm resizing my cache now...cache was %lu and is now %lu\n",
+ if ((priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
+ (priv->dblayer_previous_lock_config) &&
+ ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
+ (priv->dblayer_ncache != priv->dblayer_previous_ncache) ||
+ (priv->dblayer_lock_config != priv->dblayer_previous_lock_config)) &&
+ !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
+ if (priv->dblayer_cachesize != priv->dblayer_previous_cachesize) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache size: %lu -> %lu\n",
priv->dblayer_previous_cachesize, priv->dblayer_cachesize, 0);
+ }
+ if (priv->dblayer_ncache != priv->dblayer_previous_ncache) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache count: %d -> %d\n",
+ priv->dblayer_previous_ncache, priv->dblayer_ncache, 0);
+ }
+ if (priv->dblayer_lock_config != priv->dblayer_previous_lock_config) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing max db lock count: %d -> %d\n",
+ priv->dblayer_previous_lock_config, priv->dblayer_lock_config, 0);
+ }
dblayer_reset_env(li);
/*
* Once pEnv->remove (via dblayer_reset_env) has been called,
@@ -5189,8 +5202,8 @@ static int commit_good_database(dblayer_private *priv)
filename, PR_GetError(), slapd_pr_strerror(PR_GetError()) );
return -1;
}
- PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\n",
- (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR);
+ PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\nlocks:%d\n",
+ (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR, priv->dblayer_lock_config);
num_bytes = strlen(line);
return_value = slapi_write_buffer(prfd, line, num_bytes);
if (return_value != num_bytes)
@@ -5236,6 +5249,7 @@ static int read_metadata(struct ldbminfo *li)
* priv->dblayer_recovery_required = 0; */
priv->dblayer_previous_cachesize = 0;
priv->dblayer_previous_ncache = 0;
+ priv->dblayer_previous_lock_config = 0;
/* Open the guard file and read stuff, then delete it */
PR_snprintf(filename,sizeof(filename),"%s/guardian",priv->dblayer_home_directory);
@@ -5305,6 +5319,9 @@ static int read_metadata(struct ldbminfo *li)
number = atoi(value);
priv->dblayer_previous_ncache = number;
} else if (0 == strcmp("version",attribute)) {
+ } else if (0 == strcmp("locks",attribute)) {
+ number = atoi(value);
+ priv->dblayer_previous_lock_config = number;
}
if (NULL == nextline || '\0' == *nextline) {
/* Nothing more to read */
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.h b/ldap/servers/slapd/back-ldbm/dblayer.h
index e1a178e..3094260 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.h
+++ b/ldap/servers/slapd/back-ldbm/dblayer.h
@@ -178,6 +178,8 @@ struct dblayer_private
PRCondVar *thread_count_cv; /* condition variable for housekeeping thread shutdown */
int dblayer_lockdown; /* use DB_LOCKDOWN */
int dblayer_lock_config;
+ int dblayer_previous_lock_config;/* Max lock count when we last shut down--
+ * used to determine if we delete the mpool */
u_int32_t dblayer_deadlock_policy; /* i.e. the atype to DB_ENV->lock_detect in deadlock_threadmain */
int dblayer_compactdb_interval; /* interval to execute compact id2entry dbs */
};
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index 1a8d8a9..db34afa 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -1036,7 +1036,7 @@ static int ldbm_config_db_lock_set(void *arg, void *value, char *errorbuf, int p
if (apply) {
if (CONFIG_PHASE_RUNNING == phase) {
li->li_dblayer_private->dblayer_lock_config = val;
- LDAPDebug(LDAP_DEBUG_ANY, "New db cache size will not take affect until the server is restarted\n", 0, 0, 0);
+ LDAPDebug(LDAP_DEBUG_ANY, "New db max lock count will not take affect until the server is restarted\n", 0, 0, 0);
} else {
li->li_dblayer_private->dblayer_lock_config = val;
}
@@ -1482,7 +1482,7 @@ static config_info ldbm_config[] = {
{CONFIG_DB_VERBOSE, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_verbose_get, &ldbm_config_db_verbose_set, 0},
{CONFIG_DB_DEBUG, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_debug_get, &ldbm_config_db_debug_set, 0},
{CONFIG_DB_NAMED_REGIONS, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_named_regions_get, &ldbm_config_db_named_regions_set, 0},
- {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, 0},
+ {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, CONFIG_FLAG_ALWAYS_SHOW},
{CONFIG_DB_PRIVATE_MEM, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_private_mem_get, &ldbm_config_db_private_mem_set, 0},
{CONFIG_DB_PRIVATE_IMPORT_MEM, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_private_import_mem_get, &ldbm_config_db_private_import_mem_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONDIF_DB_ONLINE_IMPORT_ENCRYPT, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_online_import_encrypt_get, &ldbm_config_db_online_import_encrypt_set, 0},
1
0
ldap/servers/slapd/back-ldbm/dblayer.c | 33 +++++++++++++++++++++--------
ldap/servers/slapd/back-ldbm/dblayer.h | 2 +
ldap/servers/slapd/back-ldbm/ldbm_config.c | 4 +--
3 files changed, 29 insertions(+), 10 deletions(-)
New commits:
commit dc4185ea40e1f1b8527a67a0c854fcc29b8bafe7
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 16:50:12 2015 -0800
Ticket #47934 - nsslapd-db-locks modify not taking into account.
Description: Updating the value of nsslapd-db-locks was not detected
at the server's startup time. As suggested in
https://fedorahosted.org/389/ticket/47934#comment:1
the value is stored in the guardian file as "locks:20000" at the shut-
down time. When restarting the server, the nsslapd-db-locks value in
cn=config,cn=ldbm database,cn=plugins,cn=config is compared with the
stored value (20000, in this example) and if they don't match, the
lock table is recreated. The change is logged in the error log:
[...] - resizing max db lock count: 20000 -> 30000
https://fedorahosted.org/389/ticket/47934
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit f4437defacf8812c5f95869147a99f8412dc4a07)
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 2524355..0fad5ff 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -1163,6 +1163,8 @@ static void dblayer_dump_config_tracing(dblayer_private *priv)
LDAPDebug(LDAP_DEBUG_TRACE,"private import mem=%d\n",priv->dblayer_private_import_mem,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"shm_key=%ld\n",priv->dblayer_shm_key,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"lockdown=%d\n",priv->dblayer_lockdown,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"locks=%d\n",priv->dblayer_lock_config,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"previous_locks=%d\n",priv->dblayer_previous_lock_config,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"tx_max=%d\n",priv->dblayer_tx_max,0,0);
}
@@ -1718,13 +1720,24 @@ dblayer_start(struct ldbminfo *li, int dbmode)
/* Is the cache being re-sized ? (If we're just doing an archive or export,
* we don't care if the cache is being re-sized) */
- if ( (priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
- ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
- (priv->dblayer_ncache != priv->dblayer_previous_ncache)) &&
- !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "I'm resizing my cache now...cache was %lu and is now %lu\n",
+ if ((priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
+ (priv->dblayer_previous_lock_config) &&
+ ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
+ (priv->dblayer_ncache != priv->dblayer_previous_ncache) ||
+ (priv->dblayer_lock_config != priv->dblayer_previous_lock_config)) &&
+ !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
+ if (priv->dblayer_cachesize != priv->dblayer_previous_cachesize) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache size: %lu -> %lu\n",
priv->dblayer_previous_cachesize, priv->dblayer_cachesize, 0);
+ }
+ if (priv->dblayer_ncache != priv->dblayer_previous_ncache) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache count: %d -> %d\n",
+ priv->dblayer_previous_ncache, priv->dblayer_ncache, 0);
+ }
+ if (priv->dblayer_lock_config != priv->dblayer_previous_lock_config) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing max db lock count: %d -> %d\n",
+ priv->dblayer_previous_lock_config, priv->dblayer_lock_config, 0);
+ }
dblayer_reset_env(li);
/*
* Once pEnv->remove (via dblayer_reset_env) has been called,
@@ -5200,8 +5213,8 @@ static int commit_good_database(dblayer_private *priv)
filename, PR_GetError(), slapd_pr_strerror(PR_GetError()) );
return -1;
}
- PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\n",
- (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR);
+ PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\nlocks:%d\n",
+ (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR, priv->dblayer_lock_config);
num_bytes = strlen(line);
return_value = slapi_write_buffer(prfd, line, num_bytes);
if (return_value != num_bytes)
@@ -5247,6 +5260,7 @@ static int read_metadata(struct ldbminfo *li)
* priv->dblayer_recovery_required = 0; */
priv->dblayer_previous_cachesize = 0;
priv->dblayer_previous_ncache = 0;
+ priv->dblayer_previous_lock_config = 0;
/* Open the guard file and read stuff, then delete it */
PR_snprintf(filename,sizeof(filename),"%s/guardian",priv->dblayer_home_directory);
@@ -5316,6 +5330,9 @@ static int read_metadata(struct ldbminfo *li)
number = atoi(value);
priv->dblayer_previous_ncache = number;
} else if (0 == strcmp("version",attribute)) {
+ } else if (0 == strcmp("locks",attribute)) {
+ number = atoi(value);
+ priv->dblayer_previous_lock_config = number;
}
if (NULL == nextline || '\0' == *nextline) {
/* Nothing more to read */
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.h b/ldap/servers/slapd/back-ldbm/dblayer.h
index e1a178e..3094260 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.h
+++ b/ldap/servers/slapd/back-ldbm/dblayer.h
@@ -178,6 +178,8 @@ struct dblayer_private
PRCondVar *thread_count_cv; /* condition variable for housekeeping thread shutdown */
int dblayer_lockdown; /* use DB_LOCKDOWN */
int dblayer_lock_config;
+ int dblayer_previous_lock_config;/* Max lock count when we last shut down--
+ * used to determine if we delete the mpool */
u_int32_t dblayer_deadlock_policy; /* i.e. the atype to DB_ENV->lock_detect in deadlock_threadmain */
int dblayer_compactdb_interval; /* interval to execute compact id2entry dbs */
};
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index 294999c..2092d08 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -1045,7 +1045,7 @@ static int ldbm_config_db_lock_set(void *arg, void *value, char *errorbuf, int p
if (apply) {
if (CONFIG_PHASE_RUNNING == phase) {
li->li_dblayer_private->dblayer_lock_config = val;
- LDAPDebug(LDAP_DEBUG_ANY, "New db cache size will not take affect until the server is restarted\n", 0, 0, 0);
+ LDAPDebug(LDAP_DEBUG_ANY, "New db max lock count will not take affect until the server is restarted\n", 0, 0, 0);
} else {
li->li_dblayer_private->dblayer_lock_config = val;
}
@@ -1506,7 +1506,7 @@ static config_info ldbm_config[] = {
{CONFIG_DB_VERBOSE, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_verbose_get, &ldbm_config_db_verbose_set, 0},
{CONFIG_DB_DEBUG, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_debug_get, &ldbm_config_db_debug_set, 0},
{CONFIG_DB_NAMED_REGIONS, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_named_regions_get, &ldbm_config_db_named_regions_set, 0},
- {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, 0},
+ {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, CONFIG_FLAG_ALWAYS_SHOW},
{CONFIG_DB_PRIVATE_MEM, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_private_mem_get, &ldbm_config_db_private_mem_set, 0},
{CONFIG_DB_PRIVATE_IMPORT_MEM, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_private_import_mem_get, &ldbm_config_db_private_import_mem_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONDIF_DB_ONLINE_IMPORT_ENCRYPT, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_online_import_encrypt_get, &ldbm_config_db_online_import_encrypt_set, 0},
1
0
ldap/servers/slapd/back-ldbm/dblayer.c | 33 +++++++++++++++++++++--------
ldap/servers/slapd/back-ldbm/dblayer.h | 2 +
ldap/servers/slapd/back-ldbm/ldbm_config.c | 4 +--
3 files changed, 29 insertions(+), 10 deletions(-)
New commits:
commit f4437defacf8812c5f95869147a99f8412dc4a07
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 16:50:12 2015 -0800
Ticket #47934 - nsslapd-db-locks modify not taking into account.
Description: Updating the value of nsslapd-db-locks was not detected
at the server's startup time. As suggested in
https://fedorahosted.org/389/ticket/47934#comment:1
the value is stored in the guardian file as "locks:20000" at the shut-
down time. When restarting the server, the nsslapd-db-locks value in
cn=config,cn=ldbm database,cn=plugins,cn=config is compared with the
stored value (20000, in this example) and if they don't match, the
lock table is recreated. The change is logged in the error log:
[...] - resizing max db lock count: 20000 -> 30000
https://fedorahosted.org/389/ticket/47934
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index e7339fb..ddf6bb0 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -1163,6 +1163,8 @@ static void dblayer_dump_config_tracing(dblayer_private *priv)
LDAPDebug(LDAP_DEBUG_TRACE,"private import mem=%d\n",priv->dblayer_private_import_mem,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"shm_key=%ld\n",priv->dblayer_shm_key,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"lockdown=%d\n",priv->dblayer_lockdown,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"locks=%d\n",priv->dblayer_lock_config,0,0);
+ LDAPDebug(LDAP_DEBUG_TRACE,"previous_locks=%d\n",priv->dblayer_previous_lock_config,0,0);
LDAPDebug(LDAP_DEBUG_TRACE,"tx_max=%d\n",priv->dblayer_tx_max,0,0);
}
@@ -1718,13 +1720,24 @@ dblayer_start(struct ldbminfo *li, int dbmode)
/* Is the cache being re-sized ? (If we're just doing an archive or export,
* we don't care if the cache is being re-sized) */
- if ( (priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
- ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
- (priv->dblayer_ncache != priv->dblayer_previous_ncache)) &&
- !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "I'm resizing my cache now...cache was %lu and is now %lu\n",
+ if ((priv->dblayer_previous_cachesize || priv->dblayer_previous_ncache) &&
+ (priv->dblayer_previous_lock_config) &&
+ ((priv->dblayer_cachesize != priv->dblayer_previous_cachesize) ||
+ (priv->dblayer_ncache != priv->dblayer_previous_ncache) ||
+ (priv->dblayer_lock_config != priv->dblayer_previous_lock_config)) &&
+ !(dbmode & (DBLAYER_ARCHIVE_MODE|DBLAYER_EXPORT_MODE)) ) {
+ if (priv->dblayer_cachesize != priv->dblayer_previous_cachesize) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache size: %lu -> %lu\n",
priv->dblayer_previous_cachesize, priv->dblayer_cachesize, 0);
+ }
+ if (priv->dblayer_ncache != priv->dblayer_previous_ncache) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing db cache count: %d -> %d\n",
+ priv->dblayer_previous_ncache, priv->dblayer_ncache, 0);
+ }
+ if (priv->dblayer_lock_config != priv->dblayer_previous_lock_config) {
+ LDAPDebug(LDAP_DEBUG_ANY, "resizing max db lock count: %d -> %d\n",
+ priv->dblayer_previous_lock_config, priv->dblayer_lock_config, 0);
+ }
dblayer_reset_env(li);
/*
* Once pEnv->remove (via dblayer_reset_env) has been called,
@@ -5209,8 +5222,8 @@ static int commit_good_database(dblayer_private *priv)
filename, PR_GetError(), slapd_pr_strerror(PR_GetError()) );
return -1;
}
- PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\n",
- (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR);
+ PR_snprintf(line,sizeof(line),"cachesize:%lu\nncache:%d\nversion:%d\nlocks:%d\n",
+ (long unsigned int)priv->dblayer_cachesize, priv->dblayer_ncache, DB_VERSION_MAJOR, priv->dblayer_lock_config);
num_bytes = strlen(line);
return_value = slapi_write_buffer(prfd, line, num_bytes);
if (return_value != num_bytes)
@@ -5256,6 +5269,7 @@ static int read_metadata(struct ldbminfo *li)
* priv->dblayer_recovery_required = 0; */
priv->dblayer_previous_cachesize = 0;
priv->dblayer_previous_ncache = 0;
+ priv->dblayer_previous_lock_config = 0;
/* Open the guard file and read stuff, then delete it */
PR_snprintf(filename,sizeof(filename),"%s/guardian",priv->dblayer_home_directory);
@@ -5325,6 +5339,9 @@ static int read_metadata(struct ldbminfo *li)
number = atoi(value);
priv->dblayer_previous_ncache = number;
} else if (0 == strcmp("version",attribute)) {
+ } else if (0 == strcmp("locks",attribute)) {
+ number = atoi(value);
+ priv->dblayer_previous_lock_config = number;
}
if (NULL == nextline || '\0' == *nextline) {
/* Nothing more to read */
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.h b/ldap/servers/slapd/back-ldbm/dblayer.h
index e1a178e..3094260 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.h
+++ b/ldap/servers/slapd/back-ldbm/dblayer.h
@@ -178,6 +178,8 @@ struct dblayer_private
PRCondVar *thread_count_cv; /* condition variable for housekeeping thread shutdown */
int dblayer_lockdown; /* use DB_LOCKDOWN */
int dblayer_lock_config;
+ int dblayer_previous_lock_config;/* Max lock count when we last shut down--
+ * used to determine if we delete the mpool */
u_int32_t dblayer_deadlock_policy; /* i.e. the atype to DB_ENV->lock_detect in deadlock_threadmain */
int dblayer_compactdb_interval; /* interval to execute compact id2entry dbs */
};
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_config.c b/ldap/servers/slapd/back-ldbm/ldbm_config.c
index 294999c..2092d08 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_config.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_config.c
@@ -1045,7 +1045,7 @@ static int ldbm_config_db_lock_set(void *arg, void *value, char *errorbuf, int p
if (apply) {
if (CONFIG_PHASE_RUNNING == phase) {
li->li_dblayer_private->dblayer_lock_config = val;
- LDAPDebug(LDAP_DEBUG_ANY, "New db cache size will not take affect until the server is restarted\n", 0, 0, 0);
+ LDAPDebug(LDAP_DEBUG_ANY, "New db max lock count will not take affect until the server is restarted\n", 0, 0, 0);
} else {
li->li_dblayer_private->dblayer_lock_config = val;
}
@@ -1506,7 +1506,7 @@ static config_info ldbm_config[] = {
{CONFIG_DB_VERBOSE, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_verbose_get, &ldbm_config_db_verbose_set, 0},
{CONFIG_DB_DEBUG, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_debug_get, &ldbm_config_db_debug_set, 0},
{CONFIG_DB_NAMED_REGIONS, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_named_regions_get, &ldbm_config_db_named_regions_set, 0},
- {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, 0},
+ {CONFIG_DB_LOCK, CONFIG_TYPE_INT, "10000", &ldbm_config_db_lock_get, &ldbm_config_db_lock_set, CONFIG_FLAG_ALWAYS_SHOW},
{CONFIG_DB_PRIVATE_MEM, CONFIG_TYPE_ONOFF, "off", &ldbm_config_db_private_mem_get, &ldbm_config_db_private_mem_set, 0},
{CONFIG_DB_PRIVATE_IMPORT_MEM, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_private_import_mem_get, &ldbm_config_db_private_import_mem_set, CONFIG_FLAG_ALWAYS_SHOW|CONFIG_FLAG_ALLOW_RUNNING_CHANGE},
{CONDIF_DB_ONLINE_IMPORT_ENCRYPT, CONFIG_TYPE_ONOFF, "on", &ldbm_config_db_online_import_encrypt_get, &ldbm_config_db_online_import_encrypt_set, 0},
1
0
ldap/schema/01core389.ldif | 2
ldap/servers/plugins/replication/cl5.h | 4 -
ldap/servers/plugins/replication/cl5_api.c | 5 +
ldap/servers/plugins/replication/cl5_api.h | 1
ldap/servers/plugins/replication/cl5_config.c | 94 ++++++++++++++++++++++----
5 files changed, 93 insertions(+), 13 deletions(-)
New commits:
commit 20cb0c07d266923b03a6b1decc84c6ca166dd09a
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 12 14:58:56 2015 -0500
Ticket 47617 - replication changelog trimming setting validation
Bug Description: The changelog trimming interval setting is not validated.
Multiple and invalid values were allowed. The new interval
was also not taking effect until the old timeout completed.
Fix Description: Add the config attribute to the core schema to addreess
the multivalue issue. Added the setting validation checks,
and notify the trimming thread when the interval is changed.
Also applied these validatations to the changelog compact interval.
https://fedorahosted.org/389/ticket/47617
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit f724b34b6c7ade56d3a66a58257b6b862c8fb221)
diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif
index a91efd8..223493d 100644
--- a/ldap/schema/01core389.ldif
+++ b/ldap/schema/01core389.ldif
@@ -161,6 +161,8 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2168 NAME 'schemaUpdateAttributeReject'
attributeTypes: ( 2.16.840.1.113730.3.1.2307 NAME 'nsslapd-allow-hashed-passwords' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2310 NAME 'nsds5ReplicaFlowControlWindow' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2311 NAME 'nsds5ReplicaFlowControlPause' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2313 NAME 'nsslapd-changelogtrim-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2314 NAME 'nsslapd-changelogcompactdb-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
#
# objectclasses
#
diff --git a/ldap/servers/plugins/replication/cl5.h b/ldap/servers/plugins/replication/cl5.h
index 9666e9a..3c92193 100644
--- a/ldap/servers/plugins/replication/cl5.h
+++ b/ldap/servers/plugins/replication/cl5.h
@@ -56,8 +56,8 @@ typedef struct changelog5Config
/* the changelog DB configuration parameters are defined as CL5DBConfig in cl5_api.h */
CL5DBConfig dbconfig;
char *symmetricKey;
- int compactInterval;
- int trimInterval;
+ long compactInterval;
+ long trimInterval;
}changelog5Config;
/* initializes changelog*/
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 42e52ae..2d9a0bd 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -1232,6 +1232,11 @@ cl5ConfigTrimming (int maxEntries, const char *maxAge, int compactInterval, int
s_cl5Desc.dbTrim.trimInterval = trimInterval;
}
+ /* The config was updated, notify the changelog trimming thread */
+ PR_Lock(s_cl5Desc.clLock);
+ PR_NotifyCondVar(s_cl5Desc.clCvar);
+ PR_Unlock(s_cl5Desc.clLock);
+
PR_Unlock (s_cl5Desc.dbTrim.lock);
_cl5RemoveThread ();
diff --git a/ldap/servers/plugins/replication/cl5_api.h b/ldap/servers/plugins/replication/cl5_api.h
index ba9eb32..eaf936f 100644
--- a/ldap/servers/plugins/replication/cl5_api.h
+++ b/ldap/servers/plugins/replication/cl5_api.h
@@ -47,6 +47,7 @@
#include "repl5.h"
#include "repl5_prot_private.h"
+#include <errno.h>
#define BDB_IMPL "bdb" /* changelog type */
#define BDB_REPLPLUGIN "libreplication-plugin" /* This backend plugin */
diff --git a/ldap/servers/plugins/replication/cl5_config.c b/ldap/servers/plugins/replication/cl5_config.c
index a3a0fb3..f4da738 100644
--- a/ldap/servers/plugins/replication/cl5_config.c
+++ b/ldap/servers/plugins/replication/cl5_config.c
@@ -398,20 +398,58 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
}
else if ( strcasecmp ( config_attr, CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE ) == 0 )
{
- if (config_attr_value && config_attr_value[0] != '\0')
- {
- config.compactInterval = atoi (config_attr_value);
- }
- else
- {
- config.compactInterval = 0;
- }
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (config_attr_value && config_attr_value[0] != '\0')
+ {
+ value = strtol(config_attr_value, &endp, 10);
+
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ if (returntext)
+ {
+ PR_snprintf ( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+ "%s: invalid value \"%s\", %s must range from 0 to %lld",
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE, config_attr_value,
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE,
+ (long long int)LONG_MAX );
+ *returncode = LDAP_UNWILLING_TO_PERFORM;
+ goto done;
+ }
+ config.compactInterval = value;
+ }
+ }
+ else
+ {
+ config.compactInterval = 0;
+ }
}
else if ( strcasecmp ( config_attr, CONFIG_CHANGELOG_TRIM_ATTRIBUTE ) == 0 )
{
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
if (config_attr_value && config_attr_value[0] != '\0')
{
- config.trimInterval = atoi (config_attr_value);
+ value = strtol(config_attr_value, &endp, 10);
+
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ if (returntext)
+ {
+ PR_snprintf ( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+ "%s: invalid value \"%s\", %s must range from 0 to %lld",
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE, config_attr_value,
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE,
+ (long long int)LONG_MAX );
+ *returncode = LDAP_UNWILLING_TO_PERFORM;
+ goto done;
+ }
+ config.trimInterval = value;
+ }
}
else
{
@@ -761,7 +799,24 @@ static void changelog5_extract_config(Slapi_Entry* entry, changelog5Config *conf
arg = slapi_entry_attr_get_charptr(entry,CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE);
if (arg)
{
- config->compactInterval = atoi (arg);
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (arg)
+ {
+ value = strtol(arg, &endp, 10);
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "changelog5_extract_config: %s: invalid value \"%s\", using default value (%d)\n",
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE, arg,
+ CHANGELOGDB_COMPACT_INTERVAL );
+ config->compactInterval = CHANGELOGDB_COMPACT_INTERVAL;
+ } else {
+ config->compactInterval = value;
+ }
+ }
slapi_ch_free_string(&arg);
}
else
@@ -771,7 +826,24 @@ static void changelog5_extract_config(Slapi_Entry* entry, changelog5Config *conf
arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_TRIM_ATTRIBUTE);
if (arg)
{
- config->trimInterval = atoi (arg);
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (arg)
+ {
+ value = strtol(arg, &endp, 10);
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "changelog5_extract_config: %s: invalid value \"%s\", using default value (%d)\n",
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE, arg,
+ CHANGELOGDB_TRIM_INTERVAL );
+ config->trimInterval = CHANGELOGDB_TRIM_INTERVAL;
+ } else {
+ config->trimInterval = value;
+ }
+ }
slapi_ch_free_string(&arg);
}
else
1
0
ldap/schema/01core389.ldif | 2
ldap/servers/plugins/replication/cl5.h | 4 -
ldap/servers/plugins/replication/cl5_api.c | 5 +
ldap/servers/plugins/replication/cl5_api.h | 1
ldap/servers/plugins/replication/cl5_config.c | 94 ++++++++++++++++++++++----
5 files changed, 93 insertions(+), 13 deletions(-)
New commits:
commit 87c7b15c5a1a4469e758f466ffae10b328a61284
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 12 14:58:56 2015 -0500
Ticket 47617 - replication changelog trimming setting validation
Bug Description: The changelog trimming interval setting is not validated.
Multiple and invalid values were allowed. The new interval
was also not taking effect until the old timeout completed.
Fix Description: Add the config attribute to the core schema to addreess
the multivalue issue. Added the setting validation checks,
and notify the trimming thread when the interval is changed.
Also applied these validatations to the changelog compact interval.
https://fedorahosted.org/389/ticket/47617
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit f724b34b6c7ade56d3a66a58257b6b862c8fb221)
diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif
index c59d762..9b7ec1d 100644
--- a/ldap/schema/01core389.ldif
+++ b/ldap/schema/01core389.ldif
@@ -304,6 +304,8 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2308 NAME 'nstombstonecsn' DESC 'Netscap
attributeTypes: ( 2.16.840.1.113730.3.1.2309 NAME 'nsds5ReplicaPreciseTombstonePurging' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2310 NAME 'nsds5ReplicaFlowControlWindow' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2311 NAME 'nsds5ReplicaFlowControlPause' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2313 NAME 'nsslapd-changelogtrim-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2314 NAME 'nsslapd-changelogcompactdb-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
#
# objectclasses
#
diff --git a/ldap/servers/plugins/replication/cl5.h b/ldap/servers/plugins/replication/cl5.h
index 9666e9a..3c92193 100644
--- a/ldap/servers/plugins/replication/cl5.h
+++ b/ldap/servers/plugins/replication/cl5.h
@@ -56,8 +56,8 @@ typedef struct changelog5Config
/* the changelog DB configuration parameters are defined as CL5DBConfig in cl5_api.h */
CL5DBConfig dbconfig;
char *symmetricKey;
- int compactInterval;
- int trimInterval;
+ long compactInterval;
+ long trimInterval;
}changelog5Config;
/* initializes changelog*/
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 42e52ae..2d9a0bd 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -1232,6 +1232,11 @@ cl5ConfigTrimming (int maxEntries, const char *maxAge, int compactInterval, int
s_cl5Desc.dbTrim.trimInterval = trimInterval;
}
+ /* The config was updated, notify the changelog trimming thread */
+ PR_Lock(s_cl5Desc.clLock);
+ PR_NotifyCondVar(s_cl5Desc.clCvar);
+ PR_Unlock(s_cl5Desc.clLock);
+
PR_Unlock (s_cl5Desc.dbTrim.lock);
_cl5RemoveThread ();
diff --git a/ldap/servers/plugins/replication/cl5_api.h b/ldap/servers/plugins/replication/cl5_api.h
index ba9eb32..eaf936f 100644
--- a/ldap/servers/plugins/replication/cl5_api.h
+++ b/ldap/servers/plugins/replication/cl5_api.h
@@ -47,6 +47,7 @@
#include "repl5.h"
#include "repl5_prot_private.h"
+#include <errno.h>
#define BDB_IMPL "bdb" /* changelog type */
#define BDB_REPLPLUGIN "libreplication-plugin" /* This backend plugin */
diff --git a/ldap/servers/plugins/replication/cl5_config.c b/ldap/servers/plugins/replication/cl5_config.c
index a3a0fb3..f4da738 100644
--- a/ldap/servers/plugins/replication/cl5_config.c
+++ b/ldap/servers/plugins/replication/cl5_config.c
@@ -398,20 +398,58 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
}
else if ( strcasecmp ( config_attr, CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE ) == 0 )
{
- if (config_attr_value && config_attr_value[0] != '\0')
- {
- config.compactInterval = atoi (config_attr_value);
- }
- else
- {
- config.compactInterval = 0;
- }
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (config_attr_value && config_attr_value[0] != '\0')
+ {
+ value = strtol(config_attr_value, &endp, 10);
+
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ if (returntext)
+ {
+ PR_snprintf ( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+ "%s: invalid value \"%s\", %s must range from 0 to %lld",
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE, config_attr_value,
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE,
+ (long long int)LONG_MAX );
+ *returncode = LDAP_UNWILLING_TO_PERFORM;
+ goto done;
+ }
+ config.compactInterval = value;
+ }
+ }
+ else
+ {
+ config.compactInterval = 0;
+ }
}
else if ( strcasecmp ( config_attr, CONFIG_CHANGELOG_TRIM_ATTRIBUTE ) == 0 )
{
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
if (config_attr_value && config_attr_value[0] != '\0')
{
- config.trimInterval = atoi (config_attr_value);
+ value = strtol(config_attr_value, &endp, 10);
+
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ if (returntext)
+ {
+ PR_snprintf ( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+ "%s: invalid value \"%s\", %s must range from 0 to %lld",
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE, config_attr_value,
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE,
+ (long long int)LONG_MAX );
+ *returncode = LDAP_UNWILLING_TO_PERFORM;
+ goto done;
+ }
+ config.trimInterval = value;
+ }
}
else
{
@@ -761,7 +799,24 @@ static void changelog5_extract_config(Slapi_Entry* entry, changelog5Config *conf
arg = slapi_entry_attr_get_charptr(entry,CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE);
if (arg)
{
- config->compactInterval = atoi (arg);
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (arg)
+ {
+ value = strtol(arg, &endp, 10);
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "changelog5_extract_config: %s: invalid value \"%s\", using default value (%d)\n",
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE, arg,
+ CHANGELOGDB_COMPACT_INTERVAL );
+ config->compactInterval = CHANGELOGDB_COMPACT_INTERVAL;
+ } else {
+ config->compactInterval = value;
+ }
+ }
slapi_ch_free_string(&arg);
}
else
@@ -771,7 +826,24 @@ static void changelog5_extract_config(Slapi_Entry* entry, changelog5Config *conf
arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_TRIM_ATTRIBUTE);
if (arg)
{
- config->trimInterval = atoi (arg);
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (arg)
+ {
+ value = strtol(arg, &endp, 10);
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "changelog5_extract_config: %s: invalid value \"%s\", using default value (%d)\n",
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE, arg,
+ CHANGELOGDB_TRIM_INTERVAL );
+ config->trimInterval = CHANGELOGDB_TRIM_INTERVAL;
+ } else {
+ config->trimInterval = value;
+ }
+ }
slapi_ch_free_string(&arg);
}
else
1
0
ldap/schema/01core389.ldif | 2
ldap/servers/plugins/replication/cl5.h | 4 -
ldap/servers/plugins/replication/cl5_api.c | 5 +
ldap/servers/plugins/replication/cl5_api.h | 1
ldap/servers/plugins/replication/cl5_config.c | 94 ++++++++++++++++++++++----
5 files changed, 93 insertions(+), 13 deletions(-)
New commits:
commit f724b34b6c7ade56d3a66a58257b6b862c8fb221
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 12 14:58:56 2015 -0500
Ticket 47617 - replication changelog trimming setting validation
Bug Description: The changelog trimming interval setting is not validated.
Multiple and invalid values were allowed. The new interval
was also not taking effect until the old timeout completed.
Fix Description: Add the config attribute to the core schema to addreess
the multivalue issue. Added the setting validation checks,
and notify the trimming thread when the interval is changed.
Also applied these validatations to the changelog compact interval.
https://fedorahosted.org/389/ticket/47617
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif
index c59d762..9b7ec1d 100644
--- a/ldap/schema/01core389.ldif
+++ b/ldap/schema/01core389.ldif
@@ -304,6 +304,8 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2308 NAME 'nstombstonecsn' DESC 'Netscap
attributeTypes: ( 2.16.840.1.113730.3.1.2309 NAME 'nsds5ReplicaPreciseTombstonePurging' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2310 NAME 'nsds5ReplicaFlowControlWindow' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
attributeTypes: ( 2.16.840.1.113730.3.1.2311 NAME 'nsds5ReplicaFlowControlPause' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2313 NAME 'nsslapd-changelogtrim-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2314 NAME 'nsslapd-changelogcompactdb-interval' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
#
# objectclasses
#
diff --git a/ldap/servers/plugins/replication/cl5.h b/ldap/servers/plugins/replication/cl5.h
index 9666e9a..3c92193 100644
--- a/ldap/servers/plugins/replication/cl5.h
+++ b/ldap/servers/plugins/replication/cl5.h
@@ -56,8 +56,8 @@ typedef struct changelog5Config
/* the changelog DB configuration parameters are defined as CL5DBConfig in cl5_api.h */
CL5DBConfig dbconfig;
char *symmetricKey;
- int compactInterval;
- int trimInterval;
+ long compactInterval;
+ long trimInterval;
}changelog5Config;
/* initializes changelog*/
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 42e52ae..2d9a0bd 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -1232,6 +1232,11 @@ cl5ConfigTrimming (int maxEntries, const char *maxAge, int compactInterval, int
s_cl5Desc.dbTrim.trimInterval = trimInterval;
}
+ /* The config was updated, notify the changelog trimming thread */
+ PR_Lock(s_cl5Desc.clLock);
+ PR_NotifyCondVar(s_cl5Desc.clCvar);
+ PR_Unlock(s_cl5Desc.clLock);
+
PR_Unlock (s_cl5Desc.dbTrim.lock);
_cl5RemoveThread ();
diff --git a/ldap/servers/plugins/replication/cl5_api.h b/ldap/servers/plugins/replication/cl5_api.h
index ba9eb32..eaf936f 100644
--- a/ldap/servers/plugins/replication/cl5_api.h
+++ b/ldap/servers/plugins/replication/cl5_api.h
@@ -47,6 +47,7 @@
#include "repl5.h"
#include "repl5_prot_private.h"
+#include <errno.h>
#define BDB_IMPL "bdb" /* changelog type */
#define BDB_REPLPLUGIN "libreplication-plugin" /* This backend plugin */
diff --git a/ldap/servers/plugins/replication/cl5_config.c b/ldap/servers/plugins/replication/cl5_config.c
index a3a0fb3..f4da738 100644
--- a/ldap/servers/plugins/replication/cl5_config.c
+++ b/ldap/servers/plugins/replication/cl5_config.c
@@ -398,20 +398,58 @@ changelog5_config_modify (Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entr
}
else if ( strcasecmp ( config_attr, CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE ) == 0 )
{
- if (config_attr_value && config_attr_value[0] != '\0')
- {
- config.compactInterval = atoi (config_attr_value);
- }
- else
- {
- config.compactInterval = 0;
- }
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (config_attr_value && config_attr_value[0] != '\0')
+ {
+ value = strtol(config_attr_value, &endp, 10);
+
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ if (returntext)
+ {
+ PR_snprintf ( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+ "%s: invalid value \"%s\", %s must range from 0 to %lld",
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE, config_attr_value,
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE,
+ (long long int)LONG_MAX );
+ *returncode = LDAP_UNWILLING_TO_PERFORM;
+ goto done;
+ }
+ config.compactInterval = value;
+ }
+ }
+ else
+ {
+ config.compactInterval = 0;
+ }
}
else if ( strcasecmp ( config_attr, CONFIG_CHANGELOG_TRIM_ATTRIBUTE ) == 0 )
{
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
if (config_attr_value && config_attr_value[0] != '\0')
{
- config.trimInterval = atoi (config_attr_value);
+ value = strtol(config_attr_value, &endp, 10);
+
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ if (returntext)
+ {
+ PR_snprintf ( returntext, SLAPI_DSE_RETURNTEXT_SIZE,
+ "%s: invalid value \"%s\", %s must range from 0 to %lld",
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE, config_attr_value,
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE,
+ (long long int)LONG_MAX );
+ *returncode = LDAP_UNWILLING_TO_PERFORM;
+ goto done;
+ }
+ config.trimInterval = value;
+ }
}
else
{
@@ -761,7 +799,24 @@ static void changelog5_extract_config(Slapi_Entry* entry, changelog5Config *conf
arg = slapi_entry_attr_get_charptr(entry,CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE);
if (arg)
{
- config->compactInterval = atoi (arg);
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (arg)
+ {
+ value = strtol(arg, &endp, 10);
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "changelog5_extract_config: %s: invalid value \"%s\", using default value (%d)\n",
+ CONFIG_CHANGELOG_COMPACTDB_ATTRIBUTE, arg,
+ CHANGELOGDB_COMPACT_INTERVAL );
+ config->compactInterval = CHANGELOGDB_COMPACT_INTERVAL;
+ } else {
+ config->compactInterval = value;
+ }
+ }
slapi_ch_free_string(&arg);
}
else
@@ -771,7 +826,24 @@ static void changelog5_extract_config(Slapi_Entry* entry, changelog5Config *conf
arg = slapi_entry_attr_get_charptr(entry, CONFIG_CHANGELOG_TRIM_ATTRIBUTE);
if (arg)
{
- config->trimInterval = atoi (arg);
+ char *endp = NULL;
+ long value;
+
+ errno = 0;
+
+ if (arg)
+ {
+ value = strtol(arg, &endp, 10);
+ if (*endp != '\0' || errno == ERANGE || value < 0 ) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "changelog5_extract_config: %s: invalid value \"%s\", using default value (%d)\n",
+ CONFIG_CHANGELOG_TRIM_ATTRIBUTE, arg,
+ CHANGELOGDB_TRIM_INTERVAL );
+ config->trimInterval = CHANGELOGDB_TRIM_INTERVAL;
+ } else {
+ config->trimInterval = value;
+ }
+ }
slapi_ch_free_string(&arg);
}
else
1
0
ldap/servers/slapd/pw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
New commits:
commit 6b85c3a655896363826fe5aacee9e7493fcb9ca9
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 14:22:50 2015 -0800
Ticket #47905 - Bad manipulation of passwordhistory
Description: The patch was provided by German Parente (gparente(a)redhat.com)
https://fedorahosted.org/389/ticket/47905#comment:6
If a value of password policy attribute (e.g., passwordhistory) is
accidentally deleted, it causes a null reference in pw_val2scheme.
This patch checks whether val is NULL or not. If the given val is
NULL, pw_val2scheme returns NULL.
https://fedorahosted.org/389/ticket/47905
Reviewed by nhosoi(a)redhat.com.
(cherry picked from commit 2c6e74adbea3c4799f30b0e3d679da9dd060ff58)
(cherry picked from commit baa26c96e873916d4c02651b04de7ca2a578863d)
(cherry picked from commit a9dee00b79016a51ebfed01c92267b751c5986de)
(cherry picked from commit bf274554956196b4fc3f80f60c1b61de28a1b9d2)
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index c753133..4df24b7 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -145,7 +145,7 @@ slapi_pw_find_sv(
LDAPDebug( LDAP_DEBUG_TRACE, "=> slapi_pw_find value: \"%s\"\n", slapi_value_get_string(v), 0, 0 ); /* JCM Innards */
- for ( i = 0; vals[i] != NULL; i++ )
+ for ( i = 0; vals && vals[i]; i++ )
{
pwsp = pw_val2scheme( (char*)slapi_value_get_string(vals[i]), &valpwd, 1 ); /* JCM Innards*/
if ( pwsp != NULL &&
@@ -287,9 +287,12 @@ struct pw_scheme *
pw_val2scheme( char *val, char **valpwdp, int first_is_default )
{
struct pw_scheme *pwsp;
- int namelen, prefixlen;
+ int namelen, prefixlen;
char *end, buf[ PWD_MAX_NAME_LEN + 1 ];
+ if (NULL == val) {
+ return( NULL );
+ }
if ( *val != PWD_HASH_PREFIX_START ||
( end = strchr( val, PWD_HASH_PREFIX_END )) == NULL ||
( namelen = end - val - 1 ) > PWD_MAX_NAME_LEN ) {
1
0
ldap/servers/slapd/pw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
New commits:
commit bf274554956196b4fc3f80f60c1b61de28a1b9d2
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 14:22:50 2015 -0800
Ticket #47905 - Bad manipulation of passwordhistory
Description: The patch was provided by German Parente (gparente(a)redhat.com)
https://fedorahosted.org/389/ticket/47905#comment:6
If a value of password policy attribute (e.g., passwordhistory) is
accidentally deleted, it causes a null reference in pw_val2scheme.
This patch checks whether val is NULL or not. If the given val is
NULL, pw_val2scheme returns NULL.
https://fedorahosted.org/389/ticket/47905
Reviewed by nhosoi(a)redhat.com.
(cherry picked from commit 2c6e74adbea3c4799f30b0e3d679da9dd060ff58)
(cherry picked from commit baa26c96e873916d4c02651b04de7ca2a578863d)
(cherry picked from commit a9dee00b79016a51ebfed01c92267b751c5986de)
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 58b1f11..7d33d65 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -146,7 +146,7 @@ slapi_pw_find_sv(
LDAPDebug( LDAP_DEBUG_TRACE, "=> slapi_pw_find value: \"%s\"\n", slapi_value_get_string(v), 0, 0 ); /* JCM Innards */
- for ( i = 0; vals[i] != NULL; i++ )
+ for ( i = 0; vals && vals[i]; i++ )
{
pwsp = pw_val2scheme( (char*)slapi_value_get_string(vals[i]), &valpwd, 1 ); /* JCM Innards*/
if ( pwsp != NULL &&
@@ -287,9 +287,12 @@ struct pw_scheme *
pw_val2scheme( char *val, char **valpwdp, int first_is_default )
{
struct pw_scheme *pwsp;
- int namelen, prefixlen;
+ int namelen, prefixlen;
char *end, buf[ PWD_MAX_NAME_LEN + 1 ];
+ if (NULL == val) {
+ return( NULL );
+ }
if ( *val != PWD_HASH_PREFIX_START ||
( end = strchr( val, PWD_HASH_PREFIX_END )) == NULL ||
( namelen = end - val - 1 ) > PWD_MAX_NAME_LEN ) {
1
0
ldap/servers/slapd/pw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
New commits:
commit a9dee00b79016a51ebfed01c92267b751c5986de
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 14:22:50 2015 -0800
Ticket #47905 - Bad manipulation of passwordhistory
Description: The patch was provided by German Parente (gparente(a)redhat.com)
https://fedorahosted.org/389/ticket/47905#comment:6
If a value of password policy attribute (e.g., passwordhistory) is
accidentally deleted, it causes a null reference in pw_val2scheme.
This patch checks whether val is NULL or not. If the given val is
NULL, pw_val2scheme returns NULL.
https://fedorahosted.org/389/ticket/47905
Reviewed by nhosoi(a)redhat.com.
(cherry picked from commit 2c6e74adbea3c4799f30b0e3d679da9dd060ff58)
(cherry picked from commit baa26c96e873916d4c02651b04de7ca2a578863d)
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 3cb40fc..082f69a 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -146,7 +146,7 @@ slapi_pw_find_sv(
LDAPDebug( LDAP_DEBUG_TRACE, "=> slapi_pw_find value: \"%s\"\n", slapi_value_get_string(v), 0, 0 ); /* JCM Innards */
- for ( i = 0; vals[i] != NULL; i++ )
+ for ( i = 0; vals && vals[i]; i++ )
{
pwsp = pw_val2scheme( (char*)slapi_value_get_string(vals[i]), &valpwd, 1 ); /* JCM Innards*/
if ( pwsp != NULL &&
@@ -287,9 +287,12 @@ struct pw_scheme *
pw_val2scheme( char *val, char **valpwdp, int first_is_default )
{
struct pw_scheme *pwsp;
- int namelen, prefixlen;
+ int namelen, prefixlen;
char *end, buf[ PWD_MAX_NAME_LEN + 1 ];
+ if (NULL == val) {
+ return( NULL );
+ }
if ( *val != PWD_HASH_PREFIX_START ||
( end = strchr( val, PWD_HASH_PREFIX_END )) == NULL ||
( namelen = end - val - 1 ) > PWD_MAX_NAME_LEN ) {
1
0
ldap/servers/slapd/pw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
New commits:
commit baa26c96e873916d4c02651b04de7ca2a578863d
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 14:22:50 2015 -0800
Ticket #47905 - Bad manipulation of passwordhistory
Description: The patch was provided by German Parente (gparente(a)redhat.com)
https://fedorahosted.org/389/ticket/47905#comment:6
If a value of password policy attribute (e.g., passwordhistory) is
accidentally deleted, it causes a null reference in pw_val2scheme.
This patch checks whether val is NULL or not. If the given val is
NULL, pw_val2scheme returns NULL.
https://fedorahosted.org/389/ticket/47905
Reviewed by nhosoi(a)redhat.com.
(cherry picked from commit 2c6e74adbea3c4799f30b0e3d679da9dd060ff58)
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 3cb40fc..082f69a 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -146,7 +146,7 @@ slapi_pw_find_sv(
LDAPDebug( LDAP_DEBUG_TRACE, "=> slapi_pw_find value: \"%s\"\n", slapi_value_get_string(v), 0, 0 ); /* JCM Innards */
- for ( i = 0; vals[i] != NULL; i++ )
+ for ( i = 0; vals && vals[i]; i++ )
{
pwsp = pw_val2scheme( (char*)slapi_value_get_string(vals[i]), &valpwd, 1 ); /* JCM Innards*/
if ( pwsp != NULL &&
@@ -287,9 +287,12 @@ struct pw_scheme *
pw_val2scheme( char *val, char **valpwdp, int first_is_default )
{
struct pw_scheme *pwsp;
- int namelen, prefixlen;
+ int namelen, prefixlen;
char *end, buf[ PWD_MAX_NAME_LEN + 1 ];
+ if (NULL == val) {
+ return( NULL );
+ }
if ( *val != PWD_HASH_PREFIX_START ||
( end = strchr( val, PWD_HASH_PREFIX_END )) == NULL ||
( namelen = end - val - 1 ) > PWD_MAX_NAME_LEN ) {
1
0
ldap/servers/slapd/pw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
New commits:
commit 2c6e74adbea3c4799f30b0e3d679da9dd060ff58
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Jan 9 14:22:50 2015 -0800
Ticket #47905 - Bad manipulation of passwordhistory
Description: The patch was provided by German Parente (gparente(a)redhat.com)
https://fedorahosted.org/389/ticket/47905#comment:6
If a value of password policy attribute (e.g., passwordhistory) is
accidentally deleted, it causes a null reference in pw_val2scheme.
This patch checks whether val is NULL or not. If the given val is
NULL, pw_val2scheme returns NULL.
https://fedorahosted.org/389/ticket/47905
Reviewed by nhosoi(a)redhat.com.
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 3cb40fc..082f69a 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -146,7 +146,7 @@ slapi_pw_find_sv(
LDAPDebug( LDAP_DEBUG_TRACE, "=> slapi_pw_find value: \"%s\"\n", slapi_value_get_string(v), 0, 0 ); /* JCM Innards */
- for ( i = 0; vals[i] != NULL; i++ )
+ for ( i = 0; vals && vals[i]; i++ )
{
pwsp = pw_val2scheme( (char*)slapi_value_get_string(vals[i]), &valpwd, 1 ); /* JCM Innards*/
if ( pwsp != NULL &&
@@ -287,9 +287,12 @@ struct pw_scheme *
pw_val2scheme( char *val, char **valpwdp, int first_is_default )
{
struct pw_scheme *pwsp;
- int namelen, prefixlen;
+ int namelen, prefixlen;
char *end, buf[ PWD_MAX_NAME_LEN + 1 ];
+ if (NULL == val) {
+ return( NULL );
+ }
if ( *val != PWD_HASH_PREFIX_START ||
( end = strchr( val, PWD_HASH_PREFIX_END )) == NULL ||
( namelen = end - val - 1 ) > PWD_MAX_NAME_LEN ) {
1
0
ldap/servers/plugins/schema_reload/schema_reload.c | 7
ldap/servers/slapd/attr.c | 8
ldap/servers/slapd/attrsyntax.c | 230 +++++++++++++++------
ldap/servers/slapd/opshared.c | 2
ldap/servers/slapd/proto-slap.h | 12 -
ldap/servers/slapd/schema.c | 116 +++++-----
6 files changed, 243 insertions(+), 132 deletions(-)
New commits:
commit 457252f5c97aa8b72d94376e328e63c5d47a825b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Jan 9 13:53:20 2015 -0500
Ticket 47973 - During schema reload sometimes the search
returns no results
Bug Description: During a schema reload operation the search of an existing
entry may randomly report no results. This is because during
the schema reload all existing attribute syntaxes are removed,
and there is a small window where ldap operations can be performed
before the new schema is loaded. During this window, attribute
values are normalized to NULL which causes operation to unexpectedly
fail.
Fix Description: Instead of wiping out the existing attribute syntax hastables
in the middle of the task, instead load the new schema into
temporary hash tables. Once the reload is complete, then take
the asi write lock, remove the old hash tables, and swap in the
new ones.
https://fedorahosted.org/389/ticket/47973
valgrind: PASSED
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 3fafcbe0a2ada038f02efdfdce77c1768f0e1819)
Conflicts:
ldap/servers/slapd/attrsyntax.c
ldap/servers/slapd/proto-slap.h
diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c
index efc0de2..4e5c7f0 100644
--- a/ldap/servers/plugins/schema_reload/schema_reload.c
+++ b/ldap/servers/plugins/schema_reload/schema_reload.c
@@ -170,13 +170,6 @@ schemareload_thread(void *arg)
slapi_task_log_notice(task, "Schema reload task finished.");
slapi_task_log_status(task, "Schema reload task finished.");
slapi_log_error(SLAPI_LOG_FATAL, "schemareload", "Schema reload task finished.\n");
-
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema.\n");
- rv = slapi_reload_internal_attr_syntax();
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema finished.\n");
-
} else {
slapi_task_log_notice(task, "Schema reload task failed.");
slapi_task_log_status(task, "Schema reload task failed.");
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index 983e286..a4d8a96 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -175,8 +175,8 @@ slapi_attr_types_equivalent(const char *t1, const char *t2)
return 0;
}
- asi1 = attr_syntax_get_by_name(t1);
- asi2 = attr_syntax_get_by_name(t2);
+ asi1 = attr_syntax_get_by_name(t1, 0);
+ asi2 = attr_syntax_get_by_name(t2, 0);
if (NULL != asi1) {
if (NULL != asi2) {
/* Both found - compare normalized names */
@@ -277,7 +277,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
{
basetype = tmp; /* basetype was malloc'd */
}
- asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock);
+ asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock, 0);
}
if(NULL == asi)
{
@@ -288,7 +288,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
* attribute type that has that syntax.
*/
asi = attr_syntax_get_by_name_locking_optional(
- ATTR_WITH_OCTETSTRING_SYNTAX, use_lock);
+ ATTR_WITH_OCTETSTRING_SYNTAX, use_lock, 0);
}
else
{
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index 75114e0..d92728a 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -73,14 +73,19 @@ static Slapi_RWLock *name2asi_lock = NULL;
#define AS_UNLOCK_READ(l) slapi_rwlock_unlock(l)
#define AS_UNLOCK_WRITE(l) slapi_rwlock_unlock(l)
+/*
+ * For the schema reload task, we need to use separate temporary hashtables & linked lists
+ */
+static PLHashTable *oid2asi_tmp = NULL;
+static PLHashTable *name2asi_tmp = NULL;
static struct asyntaxinfo *default_asi = NULL;
static void *attr_syntax_get_plugin_by_name_with_default( const char *type );
static void attr_syntax_delete_no_lock( struct asyntaxinfo *asip,
- PRBool remove_from_oid_table );
+ PRBool remove_from_oid_table, PRUint32 schema_flags );
static struct asyntaxinfo *attr_syntax_get_by_oid_locking_optional( const
- char *oid, PRBool use_lock);
+ char *oid, PRBool use_lock, PRUint32 schema_flags);
#ifdef ATTR_LDAP_DEBUG
static void attr_syntax_print();
@@ -198,8 +203,6 @@ attr_syntax_check_oids()
void
attr_syntax_free( struct asyntaxinfo *a )
{
- PR_ASSERT( a->asi_refcnt == 0 );
-
cool_charray_free( a->asi_aliases );
slapi_ch_free( (void**)&a->asi_name );
slapi_ch_free( (void **)&a->asi_desc );
@@ -228,9 +231,9 @@ attr_syntax_new()
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_oid(const char *oid)
+attr_syntax_get_by_oid(const char *oid, PRUint32 schema_flags)
{
- return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE);
+ return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE, schema_flags);
}
@@ -243,15 +246,30 @@ attr_syntax_get_by_oid(const char *oid)
* same use_lock parameter.
*/
static struct asyntaxinfo *
-attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
+attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock, PRUint32 schema_flags )
{
struct asyntaxinfo *asi = 0;
- if (oid2asi)
+ PLHashTable *ht = oid2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = oid2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(oid2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(oid2asi, oid);
+ if (!using_tmp_ht){
+ /*
+ * The oid2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = oid2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, oid);
if (asi)
{
PR_AtomicIncrement( &asi->asi_refcnt );
@@ -272,18 +290,22 @@ attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(oid2asi_lock);
- }
+ if(schema_flags & DSE_SCHEMA_LOCKED){
+ PL_HashTableAdd(oid2asi_tmp, oid, a);
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(oid2asi_lock);
+ }
- PL_HashTableAdd(oid2asi, oid, a);
+ PL_HashTableAdd(oid2asi, oid, a);
- if (lock) {
- AS_UNLOCK_WRITE(oid2asi_lock);
+ if (lock) {
+ AS_UNLOCK_WRITE(oid2asi_lock);
+ }
}
}
@@ -296,18 +318,19 @@ attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_name(const char *name)
+attr_syntax_get_by_name(const char *name, PRUint32 schema_flags)
{
- return attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ return attr_syntax_get_by_name_locking_optional(name, PR_TRUE, schema_flags);
}
struct asyntaxinfo *
attr_syntax_get_by_name_with_default(const char *name)
{
struct asyntaxinfo *asi = NULL;
- asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+
+ asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE, 0);
if (asi == NULL)
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if ( asi == NULL )
asi = default_asi;
return asi;
@@ -322,15 +345,30 @@ attr_syntax_get_by_name_with_default(const char *name)
* same use_lock parameter.
*/
struct asyntaxinfo *
-attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
+attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock, PRUint32 schema_flags)
{
struct asyntaxinfo *asi = 0;
- if (name2asi)
+ PLHashTable *ht = name2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = name2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(name2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(name2asi, name);
+ if(!using_tmp_ht){
+ /*
+ * The name2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = name2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, name);
if ( NULL != asi ) {
PR_AtomicIncrement( &asi->asi_refcnt );
}
@@ -339,7 +377,7 @@ attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
}
}
if (!asi) /* given name may be an OID */
- asi = attr_syntax_get_by_oid_locking_optional(name, use_lock);
+ asi = attr_syntax_get_by_oid_locking_optional(name, use_lock, schema_flags);
return asi;
}
@@ -402,26 +440,37 @@ attr_syntax_return_locking_optional(struct asyntaxinfo *asi, PRBool use_lock)
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_name(struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(name2asi_lock);
- }
+ if (schema_flags & DSE_SCHEMA_LOCKED ){
+ PL_HashTableAdd(name2asi_tmp, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
+
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi_tmp, a->asi_aliases[i], a);
+ }
+ }
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(name2asi_lock);
+ }
- PL_HashTableAdd(name2asi, a->asi_name, a);
- if ( a->asi_aliases != NULL ) {
- int i;
+ PL_HashTableAdd(name2asi, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
- for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ }
+ }
+ if (lock) {
+ AS_UNLOCK_WRITE(name2asi_lock);
}
}
- if (lock) {
- AS_UNLOCK_WRITE(name2asi_lock);
- }
}
@@ -430,7 +479,7 @@ attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
* and oids.
*/
void
-attr_syntax_delete( struct asyntaxinfo *asi )
+attr_syntax_delete( struct asyntaxinfo *asi, PRUint32 schema_flags )
{
PR_ASSERT( asi );
@@ -438,7 +487,7 @@ attr_syntax_delete( struct asyntaxinfo *asi )
AS_LOCK_WRITE(oid2asi_lock);
AS_LOCK_WRITE(name2asi_lock);
- attr_syntax_delete_no_lock( asi, PR_TRUE );
+ attr_syntax_delete_no_lock( asi, PR_TRUE, schema_flags );
AS_UNLOCK_WRITE(name2asi_lock);
AS_UNLOCK_WRITE(oid2asi_lock);
@@ -452,19 +501,34 @@ attr_syntax_delete( struct asyntaxinfo *asi )
*/
static void
attr_syntax_delete_no_lock( struct asyntaxinfo *asi,
- PRBool remove_from_oidtable )
+ PRBool remove_from_oidtable, PRUint32 schema_flags )
{
- int i;
+ PLHashTable *ht = NULL;
+ int using_tmp_ht = 0;
+ int i;
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ using_tmp_ht = 1;
+ }
if (oid2asi && remove_from_oidtable ) {
- PL_HashTableRemove(oid2asi, asi->asi_oid);
+ if (using_tmp_ht){
+ ht = oid2asi_tmp;
+ } else {
+ ht = oid2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_oid);
}
if(name2asi) {
- PL_HashTableRemove(name2asi, asi->asi_name);
+ if (using_tmp_ht){
+ ht = name2asi_tmp;
+ } else {
+ ht = name2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_name);
if ( asi->asi_aliases != NULL ) {
for ( i = 0; asi->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableRemove(name2asi, asi->asi_aliases[i]);
+ PL_HashTableRemove(ht, asi->asi_aliases[i]);
}
}
if ( asi->asi_refcnt > 0 ) {
@@ -496,7 +560,7 @@ slapi_attr_syntax_normalize( const char *s )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, 0)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -507,7 +571,6 @@ slapi_attr_syntax_normalize( const char *s )
return r;
}
-
/*
* attr_syntax_exists: return 1 if attr_name exists, 0 otherwise
*
@@ -517,7 +580,8 @@ attr_syntax_exists(const char *attr_name)
{
struct asyntaxinfo *asi;
- asi = attr_syntax_get_by_name(attr_name);
+
+ asi = attr_syntax_get_by_name(attr_name, 0);
attr_syntax_return( asi );
if ( asi != NULL )
@@ -686,13 +750,13 @@ attr_syntax_get_plugin_by_name_with_default( const char *type )
/*
* first we look for this attribute type explictly
*/
- if ( (asi = attr_syntax_get_by_name(type)) == NULL ) {
+ if ( (asi = attr_syntax_get_by_name(type, 0)) == NULL ) {
/*
* no syntax for this type... return Octet String
* syntax. we accomplish this by looking up a well known
* attribute type that has that syntax.
*/
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if (asi == NULL)
asi = default_asi;
}
@@ -729,14 +793,13 @@ attr_syntax_dup( struct asyntaxinfo *a )
return( newas );
}
-
/*
* Add a new attribute type to the schema.
*
* Returns an LDAP error code (LDAP_SUCCESS if all goes well).
*/
int
-attr_syntax_add( struct asyntaxinfo *asip )
+attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags )
{
int i, rc = LDAP_SUCCESS;
int nolock = asip->asi_flags & SLAPI_ATTR_FLAG_NOLOCKING;
@@ -748,7 +811,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* make sure the oid is unique */
if ( NULL != ( oldas_from_oid = attr_syntax_get_by_oid_locking_optional(
- asip->asi_oid, !nolock))) {
+ asip->asi_oid, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)) {
/* failure - OID is in use; no override flag */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -760,7 +823,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
* the primary name and OID point to the same schema definition.
*/
if ( NULL != ( oldas_from_name = attr_syntax_get_by_name_locking_optional(
- asip->asi_name, !nolock))) {
+ asip->asi_name, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)
|| ( oldas_from_oid != oldas_from_name )) {
/* failure; no override flag OR OID and name don't match */
@@ -768,7 +831,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
goto cleanup_and_return;
}
/* Flag for deletion. We are going to override this attr */
- attr_syntax_delete(oldas_from_name);
+ attr_syntax_delete(oldas_from_name, schema_flags);
} else if ( NULL != oldas_from_oid ) {
/* failure - OID is in use but name does not exist */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -782,11 +845,11 @@ attr_syntax_add( struct asyntaxinfo *asip )
if ( NULL != ( tmpasi =
attr_syntax_get_by_name_locking_optional(
- asip->asi_aliases[i], !nolock))) {
+ asip->asi_aliases[i], !nolock, schema_flags))) {
if (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE) {
/* Flag for tmpasi for deletion. It will be free'd
* when attr_syntax_return is called. */
- attr_syntax_delete(tmpasi);
+ attr_syntax_delete(tmpasi, schema_flags);
} else {
/* failure - one of the aliases is already in use */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -805,8 +868,8 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* ditto for the override one */
asip->asi_flags &= ~SLAPI_ATTR_FLAG_OVERRIDE;
- attr_syntax_add_by_oid( asip->asi_oid, asip, !nolock);
- attr_syntax_add_by_name( asip, !nolock);
+ attr_syntax_add_by_oid( asip->asi_oid, asip, schema_flags, !nolock);
+ attr_syntax_add_by_name( asip, schema_flags, !nolock);
cleanup_and_return:
attr_syntax_return_locking_optional( oldas_from_oid, !nolock );
@@ -979,7 +1042,7 @@ slapi_attr_type2plugin( const char *type, void **pi )
int
slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oid = asi->asi_oid;
attr_syntax_return(asi);
@@ -995,7 +1058,7 @@ slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
int
slapi_attr_get_oid_copy( const Slapi_Attr *a, char **oidp )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oidp = slapi_ch_strdup( asi->asi_oid );
attr_syntax_return(asi);
@@ -1191,7 +1254,7 @@ attr_syntax_delete_if_not_flagged(struct asyntaxinfo *asip, void *arg)
PR_ASSERT( fi != NULL );
if ( 0 == ( asip->asi_flags & fi->asef_flag )) {
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
} else {
return ATTR_SYNTAX_ENUM_NEXT;
@@ -1207,7 +1270,7 @@ attr_syntax_force_to_delete(struct asyntaxinfo *asip, void *arg)
fi = (struct attr_syntax_enum_flaginfo *)arg;
PR_ASSERT( fi != NULL );
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
}
@@ -1272,6 +1335,7 @@ attr_syntax_delete_all_for_schemareload(unsigned long flag)
#define ATTR_DEFAULT_SYNTAX_OID "1.1"
#define ATTR_DEFAULT_SYNTAX "defaultdirstringsyntax"
+
static int
attr_syntax_init(void)
{
@@ -1290,6 +1354,14 @@ attr_syntax_init(void)
}
}
+ if (!oid2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ oid2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
if (!name2asi)
{
name2asi = PL_NewHashTable(2047, hashNocaseString,
@@ -1310,6 +1382,14 @@ attr_syntax_init(void)
DIRSTRING_SYNTAX_OID,
SLAPI_ATTR_FLAG_NOUSERMOD );
}
+ if (!name2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ name2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
return 0;
}
@@ -1379,7 +1459,7 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
&asip );
if ( rc == LDAP_SUCCESS ) {
- rc = attr_syntax_add( asip );
+ rc = attr_syntax_add( asip, 0 );
if ( rc == LDAP_SUCCESS ) {
if (attr_syntax_internal_asi_add_ht(asip)) {
slapi_log_error(SLAPI_LOG_FATAL,
@@ -1387,6 +1467,8 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
"Failed to stash internal asyntaxinfo: %s.\n",
asip->asi_name);
}
+ } else {
+ attr_syntax_free(asip);
}
}
@@ -1406,7 +1488,7 @@ attr_syntax_internal_asi_add(struct asyntaxinfo *asip, void *arg)
/* Copy is needed since when reloading the schema,
* existing syntax info is cleaned up. */
asip_copy = attr_syntax_dup(asip);
- rc = attr_syntax_add(asip_copy);
+ rc = attr_syntax_add(asip_copy, 0);
if (LDAP_SUCCESS != rc) {
attr_syntax_free(asip_copy);
}
@@ -1426,3 +1508,25 @@ slapi_reload_internal_attr_syntax()
attr_syntax_enumerate_attrs_ext(internalasi, attr_syntax_internal_asi_add, NULL);
return rc;
}
+
+/*
+ * schema reload - now that we have loaded the schema into temporary
+ * hash tables, swap out the old for the new.
+ */
+void
+attr_syntax_swap_ht()
+{
+ /* Remove the old hash tables */
+ PL_HashTableDestroy(name2asi);
+ PL_HashTableDestroy(oid2asi);
+
+ /*
+ * Swap the hash table/linked list pointers, and set the
+ * temporary pointers to NULL
+ */
+ name2asi = name2asi_tmp;
+ name2asi_tmp = NULL;
+ oid2asi = oid2asi_tmp;
+ oid2asi_tmp = NULL;
+}
+
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 7a0b544..a7367a7 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -91,7 +91,7 @@ int op_shared_is_allowed_attr (const char *attr_name, int replicated_op)
struct asyntaxinfo *asi;
int no_user_mod = 0;
- asi = attr_syntax_get_by_name( attr_name );
+ asi = attr_syntax_get_by_name( attr_name, 0 );
if ( NULL != asi &&
0 != ( asi->asi_flags & SLAPI_ATTR_FLAG_NOUSERMOD ))
{
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 0891608..da9c925 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -117,7 +117,7 @@ void attr_syntax_write_lock(void);
void attr_syntax_unlock_read(void);
void attr_syntax_unlock_write(void);
int attr_syntax_exists (const char *attr_name);
-void attr_syntax_delete ( struct asyntaxinfo *asip );
+void attr_syntax_delete ( struct asyntaxinfo *asip, PRUint32 schema_flags );
#define SLAPI_SYNTAXLENGTH_NONE (-1) /* for syntaxlength parameter */
int attr_syntax_create( const char *attr_oid, char *const*attr_names,
int num_names, const char *attr_desc, const char *attr_superior,
@@ -126,15 +126,17 @@ int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *attr_syntax, int syntaxlength, unsigned long flags,
struct asyntaxinfo **asip );
void attr_syntax_free( struct asyntaxinfo *a );
-int attr_syntax_add( struct asyntaxinfo *asip );
+int attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags );
char *attr_syntax_normalize_no_lookup( const char *s );
void attr_syntax_enumerate_attrs(AttrEnumFunc aef, void *arg, PRBool writelock);
void attr_syntax_all_clear_flag( unsigned long flag );
void attr_syntax_delete_all_not_flagged( unsigned long flag );
-struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid );
-struct asyntaxinfo *attr_syntax_get_by_name ( const char *name );
-struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock );
+struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid, PRUint32 schema_flags );
+struct asyntaxinfo *attr_syntax_get_by_name ( const char *name, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_by_name_with_default ( const char *name );
+struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock, PRUint32 schema_flags );
+struct asyntaxinfo *attr_syntax_get_global_at();
+void attr_syntax_swap_ht(void);
/*
* Call attr_syntax_return() when you are done using a value returned
* by attr_syntax_get_by_oid() or attr_syntax_get_by_name().
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 18ae152..798d905 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -154,6 +154,8 @@ static int schema_strcmp( const char *s1, const char *s2 );
static int schema_strcmp_array( char **sa1, char **sa2,
const char *ignorestr );
static PRBool schema_type_is_interesting( const char *type );
+static void reload_schemafile_lock(void);
+static void reload_schemafile_unlock(void);
static void schema_create_errormsg( char *errorbuf, size_t errorbufsize,
const char *prefix, const char *name, const char *fmt, ... )
#ifdef __GNUC__
@@ -2125,7 +2127,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
sscanf (attr_ldif, "%s name %s syntax %s",
psbAttrOid->buffer, psbAttrName->buffer, psbAttrSyntax->buffer);
- if ((a = attr_syntax_get_by_name ( psbAttrName->buffer)) != NULL ) {
+ if ((a = attr_syntax_get_by_name ( psbAttrName->buffer, 0 )) != NULL ) {
/* only modify attrs which were user defined */
if (a->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
@@ -2177,7 +2179,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
/* Delete it. */
- attr_syntax_delete( a );
+ attr_syntax_delete( a, 0 );
attr_syntax_return( a );
}
else {
@@ -2300,7 +2302,7 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
}
/* check to see if the oid is already in use by an attribute */
- if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid))) {
+ if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid, flags))) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
pnew_oc->oc_name,
"The OID \"%s\" is also used by the attribute type \"%s\"",
@@ -2419,7 +2421,7 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
* handle the various cases.
*/
if ( NULL == ( oldasip =
- attr_syntax_get_by_oid( newasip->asi_oid ))) {
+ attr_syntax_get_by_oid( newasip->asi_oid, 0 ))) {
/* new attribute type */
LDAPDebug( LDAP_DEBUG_TRACE, "schema_replace_attributes:"
" new type %s (OID %s)\n",
@@ -2437,14 +2439,14 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
" replacing type %s (OID %s)\n",
newasip->asi_name, newasip->asi_oid, 0 );
/* flag for deletion */
- attr_syntax_delete( oldasip );
+ attr_syntax_delete( oldasip, 0 );
}
attr_syntax_return( oldasip );
}
if ( NULL != newasip ) { /* add new or replacement definition */
- rc = attr_syntax_add( newasip );
+ rc = attr_syntax_add( newasip, 0 );
if ( LDAP_SUCCESS != rc ) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, newasip->asi_name,
@@ -3355,7 +3357,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (!status && (NULL != pSuperior)) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(pSuperior);
+ asi_parent = attr_syntax_get_by_name(pSuperior, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
LDAPDebug (LDAP_DEBUG_PARSE,
@@ -3467,7 +3469,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
struct asyntaxinfo *tmpasi;
if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
- ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid)))) {
+ ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use",
@@ -3490,7 +3492,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if ( NULL != asipp ) {
*asipp = tmpasip; /* just return it */
} else { /* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -4307,6 +4309,59 @@ get_tagged_oid( const char *tag, const char **inputp,
return( oid );
}
+/*
+ * Reload the schema files
+ *
+ * This is only called from the schema_reload task. The flag DSE_SCHEMA_LOCKED
+ * is also only set been called from this function. To not interrupt clients
+ * we will rebuild the schema in separate hash tables, and then swap the
+ * hash tables once the schema is completely reloaded. We use the DSE_SCHEMA_LOCKED
+ * flag to tell the attribute syntax functions to use the temporary hashtables.
+ */
+int
+slapi_reload_schema_files(char *schemadir)
+{
+ int rc = LDAP_SUCCESS;
+ struct dse *my_pschemadse = NULL;
+ /* get be to lock */
+ Slapi_Backend *be = slapi_be_select_by_instance_name( DSE_SCHEMA );
+
+ if (NULL == be)
+ {
+ slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
+ "schema file reload failed\n" );
+ return LDAP_LOCAL_ERROR;
+ }
+ slapi_be_Wlock(be); /* be lock must be outer of schemafile lock */
+ reload_schemafile_lock();
+ oc_delete_all_nolock();
+ rc = init_schema_dse_ext(schemadir, be, &my_pschemadse,
+ DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_LOCKED);
+ if (rc) {
+ /*
+ * The schema has been reloaded into the temporary hash tables.
+ * Take the write lock, wipe out the existing hash tables, and
+ * swap in the new ones.
+ */
+ attr_syntax_write_lock();
+ attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
+ attr_syntax_swap_ht();
+ attr_syntax_unlock_write();
+ slapi_reload_internal_attr_syntax();
+
+ dse_destroy(pschemadse);
+ pschemadse = my_pschemadse;
+ reload_schemafile_unlock();
+ slapi_be_Unlock(be);
+ return LDAP_SUCCESS;
+ } else {
+ reload_schemafile_unlock();
+ slapi_be_Unlock(be);
+ slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
+ "schema file reload failed\n" );
+ return LDAP_LOCAL_ERROR;
+ }
+}
/*
* sprintf to `outp' the contents of `tag' followed by `oid' followed by a
@@ -4818,49 +4873,6 @@ slapi_validate_schema_files(char *schemadir)
}
/*
- * API to reload the schema files.
- * Rule: this function is called when slapi_validate_schema_files is passed.
- * Schema checking is skipped in this function.
- */
-int
-slapi_reload_schema_files(char *schemadir)
-{
- int rc = LDAP_SUCCESS;
- struct dse *my_pschemadse = NULL;
- /* get be to lock */
- Slapi_Backend *be = slapi_be_select_by_instance_name( DSE_SCHEMA );
-
- if (NULL == be)
- {
- slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
- "schema file reload failed\n" );
- return LDAP_LOCAL_ERROR;
- }
- slapi_be_Wlock(be); /* be lock must be outer of schemafile lock */
- reload_schemafile_lock();
- /* Exclude attr_syntax not to grab from the hash table while cleaning up */
- attr_syntax_write_lock();
- attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
- oc_delete_all_nolock();
- attr_syntax_unlock_write();
- rc = init_schema_dse_ext(schemadir, be, &my_pschemadse,
- DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_LOCKED);
- if (rc) {
- dse_destroy(pschemadse);
- pschemadse = my_pschemadse;
- reload_schemafile_unlock();
- slapi_be_Unlock(be);
- return LDAP_SUCCESS;
- } else {
- reload_schemafile_unlock();
- slapi_be_Unlock(be);
- slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
- "schema file reload failed\n" );
- return LDAP_LOCAL_ERROR;
- }
-}
-
-/*
* slapi_schema_list_objectclass_attributes:
* Return the list of attributes belonging to the objectclass
*
1
0
ldap/servers/plugins/schema_reload/schema_reload.c | 7
ldap/servers/slapd/attr.c | 8
ldap/servers/slapd/attrsyntax.c | 249 ++++++++++++++-------
ldap/servers/slapd/opshared.c | 2
ldap/servers/slapd/proto-slap.h | 13 -
ldap/servers/slapd/schema.c | 116 +++++----
6 files changed, 254 insertions(+), 141 deletions(-)
New commits:
commit 3fafcbe0a2ada038f02efdfdce77c1768f0e1819
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Jan 9 13:53:20 2015 -0500
Ticket 47973 - During schema reload sometimes the search
returns no results
Bug Description: During a schema reload operation the search of an existing
entry may randomly report no results. This is because during
the schema reload all existing attribute syntaxes are removed,
and there is a small window where ldap operations can be performed
before the new schema is loaded. During this window, attribute
values are normalized to NULL which causes operation to unexpectedly
fail.
Fix Description: Instead of wiping out the existing attribute syntax hastables
in the middle of the task, instead load the new schema into
temporary hash tables. Once the reload is complete, then take
the asi write lock, remove the old hash tables, and swap in the
new ones.
https://fedorahosted.org/389/ticket/47973
valgrind: PASSED
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c
index efc0de2..4e5c7f0 100644
--- a/ldap/servers/plugins/schema_reload/schema_reload.c
+++ b/ldap/servers/plugins/schema_reload/schema_reload.c
@@ -170,13 +170,6 @@ schemareload_thread(void *arg)
slapi_task_log_notice(task, "Schema reload task finished.");
slapi_task_log_status(task, "Schema reload task finished.");
slapi_log_error(SLAPI_LOG_FATAL, "schemareload", "Schema reload task finished.\n");
-
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema.\n");
- rv = slapi_reload_internal_attr_syntax();
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema finished.\n");
-
} else {
slapi_task_log_notice(task, "Schema reload task failed.");
slapi_task_log_status(task, "Schema reload task failed.");
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index 9fa07be..28a4247 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -175,8 +175,8 @@ slapi_attr_types_equivalent(const char *t1, const char *t2)
return 0;
}
- asi1 = attr_syntax_get_by_name(t1);
- asi2 = attr_syntax_get_by_name(t2);
+ asi1 = attr_syntax_get_by_name(t1, 0);
+ asi2 = attr_syntax_get_by_name(t2, 0);
if (NULL != asi1) {
if (NULL != asi2) {
/* Both found - compare normalized names */
@@ -277,7 +277,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
{
basetype = tmp; /* basetype was malloc'd */
}
- asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock);
+ asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock, 0);
}
if(NULL == asi)
{
@@ -288,7 +288,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
* attribute type that has that syntax.
*/
asi = attr_syntax_get_by_name_locking_optional(
- ATTR_WITH_OCTETSTRING_SYNTAX, use_lock);
+ ATTR_WITH_OCTETSTRING_SYNTAX, use_lock, 0);
}
else
{
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index 18d0c52..673a903 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -67,8 +67,14 @@ static PLHashTable *internalasi = NULL;
static PLHashTable *name2asi = NULL;
/* read/write lock to protect table */
static Slapi_RWLock *name2asi_lock = NULL;
-static int asi_locking = 1;
+/*
+ * For the schema reload task, we need to use separate temporary hashtables & linked lists
+ */
+static PLHashTable *oid2asi_tmp = NULL;
+static PLHashTable *name2asi_tmp = NULL;
+
+static int asi_locking = 1;
#define AS_LOCK_READ(l) if (asi_locking) { slapi_rwlock_rdlock(l); }
#define AS_LOCK_WRITE(l) if (asi_locking) { slapi_rwlock_wrlock(l); }
#define AS_UNLOCK_READ(l) if (asi_locking) { slapi_rwlock_unlock(l); }
@@ -79,9 +85,9 @@ static struct asyntaxinfo *default_asi = NULL;
static void *attr_syntax_get_plugin_by_name_with_default( const char *type );
static void attr_syntax_delete_no_lock( struct asyntaxinfo *asip,
- PRBool remove_from_oid_table );
+ PRBool remove_from_oid_table, PRUint32 schema_flags );
static struct asyntaxinfo *attr_syntax_get_by_oid_locking_optional( const
- char *oid, PRBool use_lock);
+ char *oid, PRBool use_lock, PRUint32 schema_flags);
#ifdef ATTR_LDAP_DEBUG
static void attr_syntax_print();
@@ -199,8 +205,6 @@ attr_syntax_check_oids()
void
attr_syntax_free( struct asyntaxinfo *a )
{
- PR_ASSERT( a->asi_refcnt == 0 );
-
cool_charray_free( a->asi_aliases );
slapi_ch_free( (void**)&a->asi_name );
slapi_ch_free( (void **)&a->asi_desc );
@@ -229,9 +233,9 @@ attr_syntax_new()
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_oid(const char *oid)
+attr_syntax_get_by_oid(const char *oid, PRUint32 schema_flags)
{
- return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE);
+ return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE, schema_flags);
}
@@ -244,15 +248,30 @@ attr_syntax_get_by_oid(const char *oid)
* same use_lock parameter.
*/
static struct asyntaxinfo *
-attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
+attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock, PRUint32 schema_flags )
{
struct asyntaxinfo *asi = 0;
- if (oid2asi)
+ PLHashTable *ht = oid2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = oid2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(oid2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(oid2asi, oid);
+ if (!using_tmp_ht){
+ /*
+ * The oid2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = oid2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, oid);
if (asi)
{
PR_AtomicIncrement( &asi->asi_refcnt );
@@ -273,18 +292,22 @@ attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(oid2asi_lock);
- }
+ if(schema_flags & DSE_SCHEMA_LOCKED){
+ PL_HashTableAdd(oid2asi_tmp, oid, a);
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(oid2asi_lock);
+ }
- PL_HashTableAdd(oid2asi, oid, a);
+ PL_HashTableAdd(oid2asi, oid, a);
- if (lock) {
- AS_UNLOCK_WRITE(oid2asi_lock);
+ if (lock) {
+ AS_UNLOCK_WRITE(oid2asi_lock);
+ }
}
}
@@ -297,18 +320,18 @@ attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_name(const char *name)
+attr_syntax_get_by_name(const char *name, PRUint32 schema_flags)
{
- return attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ return attr_syntax_get_by_name_locking_optional(name, PR_TRUE, schema_flags);
}
struct asyntaxinfo *
attr_syntax_get_by_name_with_default(const char *name)
{
struct asyntaxinfo *asi = NULL;
- asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE, 0);
if (asi == NULL)
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if ( asi == NULL )
asi = default_asi;
return asi;
@@ -323,15 +346,30 @@ struct asyntaxinfo *asi = NULL;
* same use_lock parameter.
*/
struct asyntaxinfo *
-attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
+attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock, PRUint32 schema_flags)
{
struct asyntaxinfo *asi = 0;
- if (name2asi)
+ PLHashTable *ht = name2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = name2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(name2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(name2asi, name);
+ if(!using_tmp_ht){
+ /*
+ * The name2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = name2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, name);
if ( NULL != asi ) {
PR_AtomicIncrement( &asi->asi_refcnt );
}
@@ -340,7 +378,7 @@ attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
}
}
if (!asi) /* given name may be an OID */
- asi = attr_syntax_get_by_oid_locking_optional(name, use_lock);
+ asi = attr_syntax_get_by_oid_locking_optional(name, use_lock, schema_flags);
return asi;
}
@@ -403,26 +441,37 @@ attr_syntax_return_locking_optional(struct asyntaxinfo *asi, PRBool use_lock)
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_name(struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(name2asi_lock);
- }
+ if (schema_flags & DSE_SCHEMA_LOCKED ){
+ PL_HashTableAdd(name2asi_tmp, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
+
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi_tmp, a->asi_aliases[i], a);
+ }
+ }
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(name2asi_lock);
+ }
- PL_HashTableAdd(name2asi, a->asi_name, a);
- if ( a->asi_aliases != NULL ) {
- int i;
+ PL_HashTableAdd(name2asi, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
- for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ }
+ }
+ if (lock) {
+ AS_UNLOCK_WRITE(name2asi_lock);
}
}
- if (lock) {
- AS_UNLOCK_WRITE(name2asi_lock);
- }
}
@@ -431,7 +480,7 @@ attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
* and oids.
*/
void
-attr_syntax_delete( struct asyntaxinfo *asi )
+attr_syntax_delete( struct asyntaxinfo *asi, PRUint32 schema_flags )
{
PR_ASSERT( asi );
@@ -439,7 +488,7 @@ attr_syntax_delete( struct asyntaxinfo *asi )
AS_LOCK_WRITE(oid2asi_lock);
AS_LOCK_WRITE(name2asi_lock);
- attr_syntax_delete_no_lock( asi, PR_TRUE );
+ attr_syntax_delete_no_lock( asi, PR_TRUE, schema_flags );
AS_UNLOCK_WRITE(name2asi_lock);
AS_UNLOCK_WRITE(oid2asi_lock);
@@ -453,19 +502,34 @@ attr_syntax_delete( struct asyntaxinfo *asi )
*/
static void
attr_syntax_delete_no_lock( struct asyntaxinfo *asi,
- PRBool remove_from_oidtable )
+ PRBool remove_from_oidtable, PRUint32 schema_flags )
{
- int i;
+ PLHashTable *ht = NULL;
+ int using_tmp_ht = 0;
+ int i;
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ using_tmp_ht = 1;
+ }
if (oid2asi && remove_from_oidtable ) {
- PL_HashTableRemove(oid2asi, asi->asi_oid);
+ if (using_tmp_ht){
+ ht = oid2asi_tmp;
+ } else {
+ ht = oid2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_oid);
}
if(name2asi) {
- PL_HashTableRemove(name2asi, asi->asi_name);
+ if (using_tmp_ht){
+ ht = name2asi_tmp;
+ } else {
+ ht = name2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_name);
if ( asi->asi_aliases != NULL ) {
for ( i = 0; asi->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableRemove(name2asi, asi->asi_aliases[i]);
+ PL_HashTableRemove(ht, asi->asi_aliases[i]);
}
}
if ( asi->asi_refcnt > 0 ) {
@@ -494,7 +558,7 @@ slapi_attr_syntax_normalize( const char *s )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, 0)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -518,7 +582,7 @@ slapi_attr_syntax_normalize_ext( char *s, int flags )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, flags)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -538,7 +602,8 @@ attr_syntax_exists(const char *attr_name)
{
struct asyntaxinfo *asi;
- asi = attr_syntax_get_by_name(attr_name);
+
+ asi = attr_syntax_get_by_name(attr_name, 0);
attr_syntax_return( asi );
if ( asi != NULL )
@@ -707,13 +772,13 @@ attr_syntax_get_plugin_by_name_with_default( const char *type )
/*
* first we look for this attribute type explictly
*/
- if ( (asi = attr_syntax_get_by_name(type)) == NULL ) {
+ if ( (asi = attr_syntax_get_by_name(type, 0)) == NULL ) {
/*
* no syntax for this type... return Octet String
* syntax. we accomplish this by looking up a well known
* attribute type that has that syntax.
*/
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if (asi == NULL)
asi = default_asi;
}
@@ -750,14 +815,13 @@ attr_syntax_dup( struct asyntaxinfo *a )
return( newas );
}
-
/*
* Add a new attribute type to the schema.
*
* Returns an LDAP error code (LDAP_SUCCESS if all goes well).
*/
int
-attr_syntax_add( struct asyntaxinfo *asip )
+attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags )
{
int i, rc = LDAP_SUCCESS;
int nolock = asip->asi_flags & SLAPI_ATTR_FLAG_NOLOCKING;
@@ -769,7 +833,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* make sure the oid is unique */
if ( NULL != ( oldas_from_oid = attr_syntax_get_by_oid_locking_optional(
- asip->asi_oid, !nolock))) {
+ asip->asi_oid, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)) {
/* failure - OID is in use; no override flag */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -781,7 +845,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
* the primary name and OID point to the same schema definition.
*/
if ( NULL != ( oldas_from_name = attr_syntax_get_by_name_locking_optional(
- asip->asi_name, !nolock))) {
+ asip->asi_name, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)
|| ( oldas_from_oid != oldas_from_name )) {
/* failure; no override flag OR OID and name don't match */
@@ -789,7 +853,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
goto cleanup_and_return;
}
/* Flag for deletion. We are going to override this attr */
- attr_syntax_delete(oldas_from_name);
+ attr_syntax_delete(oldas_from_name, schema_flags);
} else if ( NULL != oldas_from_oid ) {
/* failure - OID is in use but name does not exist */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -803,11 +867,11 @@ attr_syntax_add( struct asyntaxinfo *asip )
if ( NULL != ( tmpasi =
attr_syntax_get_by_name_locking_optional(
- asip->asi_aliases[i], !nolock))) {
+ asip->asi_aliases[i], !nolock, schema_flags))) {
if (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE) {
/* Flag for tmpasi for deletion. It will be free'd
* when attr_syntax_return is called. */
- attr_syntax_delete(tmpasi);
+ attr_syntax_delete(tmpasi, schema_flags);
} else {
/* failure - one of the aliases is already in use */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -826,8 +890,8 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* ditto for the override one */
asip->asi_flags &= ~SLAPI_ATTR_FLAG_OVERRIDE;
- attr_syntax_add_by_oid( asip->asi_oid, asip, !nolock);
- attr_syntax_add_by_name( asip, !nolock);
+ attr_syntax_add_by_oid( asip->asi_oid, asip, schema_flags, !nolock);
+ attr_syntax_add_by_name( asip, schema_flags, !nolock);
cleanup_and_return:
attr_syntax_return_locking_optional( oldas_from_oid, !nolock );
@@ -1000,7 +1064,7 @@ slapi_attr_type2plugin( const char *type, void **pi )
int
slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oid = asi->asi_oid;
attr_syntax_return(asi);
@@ -1016,7 +1080,7 @@ slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
int
slapi_attr_get_oid_copy( const Slapi_Attr *a, char **oidp )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oidp = slapi_ch_strdup( asi->asi_oid );
attr_syntax_return(asi);
@@ -1073,7 +1137,7 @@ slapi_attr_is_dn_syntax_type(char *type)
int dn_syntax = 0; /* not DN, by default */
struct asyntaxinfo * asi;
- asi = attr_syntax_get_by_name(type);
+ asi = attr_syntax_get_by_name(type, 0);
if (asi && asi->asi_plugin) { /* If not set, there is no way to get the info */
if ((syntaxoid = asi->asi_plugin->plg_syntax_oid)) {
@@ -1249,7 +1313,7 @@ attr_syntax_delete_if_not_flagged(struct asyntaxinfo *asip, void *arg)
PR_ASSERT( fi != NULL );
if ( 0 == ( asip->asi_flags & fi->asef_flag )) {
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
} else {
return ATTR_SYNTAX_ENUM_NEXT;
@@ -1265,7 +1329,7 @@ attr_syntax_force_to_delete(struct asyntaxinfo *asip, void *arg)
fi = (struct attr_syntax_enum_flaginfo *)arg;
PR_ASSERT( fi != NULL );
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
}
@@ -1330,6 +1394,7 @@ attr_syntax_delete_all_for_schemareload(unsigned long flag)
#define ATTR_DEFAULT_SYNTAX_OID "1.1"
#define ATTR_DEFAULT_SYNTAX "defaultdirstringsyntax"
+
static int
attr_syntax_init(void)
{
@@ -1339,8 +1404,8 @@ attr_syntax_init(void)
if (!oid2asi)
{
oid2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( oid2asi_lock = slapi_new_rwlock())) {
if(oid2asi) PL_HashTableDestroy(oid2asi);
oid2asi = NULL;
@@ -1351,11 +1416,19 @@ attr_syntax_init(void)
}
}
+ if (!oid2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ oid2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
if (!name2asi)
{
name2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( name2asi_lock = slapi_new_rwlock())) {
if(name2asi) PL_HashTableDestroy(name2asi);
name2asi = NULL;
@@ -1367,10 +1440,18 @@ attr_syntax_init(void)
/* add a default syntax plugin as fallback, required during startup
*/
attr_syntax_create_default( ATTR_DEFAULT_SYNTAX,
- ATTR_DEFAULT_SYNTAX_OID,
- DIRSTRING_SYNTAX_OID,
- SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
+ ATTR_DEFAULT_SYNTAX_OID,
+ DIRSTRING_SYNTAX_OID,
+ SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
}
+ if (!name2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ name2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
return 0;
}
@@ -1440,7 +1521,7 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
&asip );
if ( rc == LDAP_SUCCESS ) {
- rc = attr_syntax_add( asip );
+ rc = attr_syntax_add( asip, 0 );
if ( rc == LDAP_SUCCESS ) {
if (attr_syntax_internal_asi_add_ht(asip)) {
slapi_log_error(SLAPI_LOG_FATAL,
@@ -1448,6 +1529,8 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
"Failed to stash internal asyntaxinfo: %s.\n",
asip->asi_name);
}
+ } else {
+ attr_syntax_free(asip);
}
}
@@ -1467,7 +1550,7 @@ attr_syntax_internal_asi_add(struct asyntaxinfo *asip, void *arg)
/* Copy is needed since when reloading the schema,
* existing syntax info is cleaned up. */
asip_copy = attr_syntax_dup(asip);
- rc = attr_syntax_add(asip_copy);
+ rc = attr_syntax_add(asip_copy, 0);
if (LDAP_SUCCESS != rc) {
attr_syntax_free(asip_copy);
}
@@ -1487,3 +1570,25 @@ slapi_reload_internal_attr_syntax()
attr_syntax_enumerate_attrs_ext(internalasi, attr_syntax_internal_asi_add, NULL);
return rc;
}
+
+/*
+ * schema reload - now that we have loaded the schema into temporary
+ * hash tables, swap out the old for the new.
+ */
+void
+attr_syntax_swap_ht()
+{
+ /* Remove the old hash tables */
+ PL_HashTableDestroy(name2asi);
+ PL_HashTableDestroy(oid2asi);
+
+ /*
+ * Swap the hash table/linked list pointers, and set the
+ * temporary pointers to NULL
+ */
+ name2asi = name2asi_tmp;
+ name2asi_tmp = NULL;
+ oid2asi = oid2asi_tmp;
+ oid2asi_tmp = NULL;
+}
+
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index eb890b0..9e13d86 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -86,7 +86,7 @@ int op_shared_is_allowed_attr (const char *attr_name, int replicated_op)
* check to see if attribute is marked as one clients can't modify
*/
- asi = attr_syntax_get_by_name( attr_name );
+ asi = attr_syntax_get_by_name( attr_name, 0 );
if ( NULL != asi &&
0 != ( asi->asi_flags & SLAPI_ATTR_FLAG_NOUSERMOD )) {
/* this attribute is not allowed */
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index d854d0a..7fde382 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -118,7 +118,7 @@ void attr_syntax_write_lock(void);
void attr_syntax_unlock_read(void);
void attr_syntax_unlock_write(void);
int attr_syntax_exists (const char *attr_name);
-void attr_syntax_delete ( struct asyntaxinfo *asip );
+void attr_syntax_delete ( struct asyntaxinfo *asip, PRUint32 schema_flags );
#define SLAPI_SYNTAXLENGTH_NONE (-1) /* for syntaxlength parameter */
int attr_syntax_create( const char *attr_oid, char *const*attr_names,
int num_names, const char *attr_desc, const char *attr_superior,
@@ -127,16 +127,19 @@ int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *attr_syntax, int syntaxlength, unsigned long flags,
struct asyntaxinfo **asip );
void attr_syntax_free( struct asyntaxinfo *a );
-int attr_syntax_add( struct asyntaxinfo *asip );
+int attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags );
char *attr_syntax_normalize_no_lookup( const char *s );
char *attr_syntax_normalize_no_lookup_ext( char *s, int flags );
void attr_syntax_enumerate_attrs(AttrEnumFunc aef, void *arg, PRBool writelock);
void attr_syntax_all_clear_flag( unsigned long flag );
void attr_syntax_delete_all_not_flagged( unsigned long flag );
-struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid );
-struct asyntaxinfo *attr_syntax_get_by_name ( const char *name );
+struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid, PRUint32 schema_flags );
+struct asyntaxinfo *attr_syntax_get_by_name ( const char *name, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_by_name_with_default ( const char *name );
-struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock );
+struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock, PRUint32 schema_flags );
+struct asyntaxinfo *attr_syntax_get_global_at();
+struct asyntaxinfo *attr_syntax_find(struct asyntaxinfo *at1, struct asyntaxinfo *at2);
+void attr_syntax_swap_ht(void);
/*
* Call attr_syntax_return() when you are done using a value returned
* by attr_syntax_get_by_oid() or attr_syntax_get_by_name().
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 98d5e17..5399d00 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -154,6 +154,8 @@ static int schema_strcmp( const char *s1, const char *s2 );
static int schema_strcmp_array( char **sa1, char **sa2,
const char *ignorestr );
static PRBool schema_type_is_interesting( const char *type );
+static void reload_schemafile_lock(void);
+static void reload_schemafile_unlock(void);
static void schema_create_errormsg( char *errorbuf, size_t errorbufsize,
const char *prefix, const char *name, const char *fmt, ... )
#ifdef __GNUC__
@@ -2138,7 +2140,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
sscanf (attr_ldif, "%s name %s syntax %s",
psbAttrOid->buffer, psbAttrName->buffer, psbAttrSyntax->buffer);
- if ((a = attr_syntax_get_by_name ( psbAttrName->buffer)) != NULL ) {
+ if ((a = attr_syntax_get_by_name ( psbAttrName->buffer, 0 )) != NULL ) {
/* only modify attrs which were user defined */
if (a->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
@@ -2190,7 +2192,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
/* Delete it. */
- attr_syntax_delete( a );
+ attr_syntax_delete( a, 0 );
attr_syntax_return( a );
}
else {
@@ -2313,7 +2315,7 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
}
/* check to see if the oid is already in use by an attribute */
- if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid))) {
+ if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid, flags))) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
pnew_oc->oc_name,
"The OID \"%s\" is also used by the attribute type \"%s\"",
@@ -2432,7 +2434,7 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
* handle the various cases.
*/
if ( NULL == ( oldasip =
- attr_syntax_get_by_oid( newasip->asi_oid ))) {
+ attr_syntax_get_by_oid( newasip->asi_oid, 0 ))) {
/* new attribute type */
LDAPDebug( LDAP_DEBUG_TRACE, "schema_replace_attributes:"
" new type %s (OID %s)\n",
@@ -2450,14 +2452,14 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
" replacing type %s (OID %s)\n",
newasip->asi_name, newasip->asi_oid, 0 );
/* flag for deletion */
- attr_syntax_delete( oldasip );
+ attr_syntax_delete( oldasip, 0 );
}
attr_syntax_return( oldasip );
}
if ( NULL != newasip ) { /* add new or replacement definition */
- rc = attr_syntax_add( newasip );
+ rc = attr_syntax_add( newasip, 0 );
if ( LDAP_SUCCESS != rc ) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, newasip->asi_name,
@@ -3368,7 +3370,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (!status && (NULL != pSuperior)) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(pSuperior);
+ asi_parent = attr_syntax_get_by_name(pSuperior, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
LDAPDebug (LDAP_DEBUG_PARSE,
@@ -3480,7 +3482,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
struct asyntaxinfo *tmpasi;
if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
- ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid)))) {
+ ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use",
@@ -3503,7 +3505,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if ( NULL != asipp ) {
*asipp = tmpasip; /* just return it */
} else { /* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -4320,6 +4322,59 @@ get_tagged_oid( const char *tag, const char **inputp,
return( oid );
}
+/*
+ * Reload the schema files
+ *
+ * This is only called from the schema_reload task. The flag DSE_SCHEMA_LOCKED
+ * is also only set been called from this function. To not interrupt clients
+ * we will rebuild the schema in separate hash tables, and then swap the
+ * hash tables once the schema is completely reloaded. We use the DSE_SCHEMA_LOCKED
+ * flag to tell the attribute syntax functions to use the temporary hashtables.
+ */
+int
+slapi_reload_schema_files(char *schemadir)
+{
+ int rc = LDAP_SUCCESS;
+ struct dse *my_pschemadse = NULL;
+ /* get be to lock */
+ Slapi_Backend *be = slapi_be_select_by_instance_name( DSE_SCHEMA );
+
+ if (NULL == be)
+ {
+ slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
+ "schema file reload failed\n" );
+ return LDAP_LOCAL_ERROR;
+ }
+ slapi_be_Wlock(be); /* be lock must be outer of schemafile lock */
+ reload_schemafile_lock();
+ oc_delete_all_nolock();
+ rc = init_schema_dse_ext(schemadir, be, &my_pschemadse,
+ DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_LOCKED);
+ if (rc) {
+ /*
+ * The schema has been reloaded into the temporary hash tables.
+ * Take the write lock, wipe out the existing hash tables, and
+ * swap in the new ones.
+ */
+ attr_syntax_write_lock();
+ attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
+ attr_syntax_swap_ht();
+ attr_syntax_unlock_write();
+ slapi_reload_internal_attr_syntax();
+
+ dse_destroy(pschemadse);
+ pschemadse = my_pschemadse;
+ reload_schemafile_unlock();
+ slapi_be_Unlock(be);
+ return LDAP_SUCCESS;
+ } else {
+ reload_schemafile_unlock();
+ slapi_be_Unlock(be);
+ slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
+ "schema file reload failed\n" );
+ return LDAP_LOCAL_ERROR;
+ }
+}
/*
* sprintf to `outp' the contents of `tag' followed by `oid' followed by a
@@ -4833,49 +4888,6 @@ slapi_validate_schema_files(char *schemadir)
}
/*
- * API to reload the schema files.
- * Rule: this function is called when slapi_validate_schema_files is passed.
- * Schema checking is skipped in this function.
- */
-int
-slapi_reload_schema_files(char *schemadir)
-{
- int rc = LDAP_SUCCESS;
- struct dse *my_pschemadse = NULL;
- /* get be to lock */
- Slapi_Backend *be = slapi_be_select_by_instance_name( DSE_SCHEMA );
-
- if (NULL == be)
- {
- slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
- "schema file reload failed\n" );
- return LDAP_LOCAL_ERROR;
- }
- slapi_be_Wlock(be); /* be lock must be outer of schemafile lock */
- reload_schemafile_lock();
- /* Exclude attr_syntax not to grab from the hash table while cleaning up */
- attr_syntax_write_lock();
- attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
- oc_delete_all_nolock();
- attr_syntax_unlock_write();
- rc = init_schema_dse_ext(schemadir, be, &my_pschemadse,
- DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_LOCKED);
- if (rc) {
- dse_destroy(pschemadse);
- pschemadse = my_pschemadse;
- reload_schemafile_unlock();
- slapi_be_Unlock(be);
- return LDAP_SUCCESS;
- } else {
- reload_schemafile_unlock();
- slapi_be_Unlock(be);
- slapi_log_error( SLAPI_LOG_FATAL, "schema_reload",
- "schema file reload failed\n" );
- return LDAP_LOCAL_ERROR;
- }
-}
-
-/*
* slapi_schema_list_objectclass_attributes:
* Return the list of attributes belonging to the objectclass
*
1
0
ldap/servers/plugins/replication/windows_protocol_util.c | 30 ++++++++++-----
1 file changed, 21 insertions(+), 9 deletions(-)
New commits:
commit b0cf44582707f20cebbae57ce14a6c103b4e217a
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Jan 8 17:52:03 2015 -0800
Ticket #47884 - WinSync - manual replica refresh removes AD-only member values from DS and AD in groups
Description: windows_generate_update_mods had a bug which confused to
handle local and remote entry in the logic. The bug was fixed with
Ticket #460 in 1.3.2 and newer. Back-porting the function windows_
generate_update_mods to 1.3.1 and 1.2.11, as well.
https://fedorahosted.org/389/ticket/47884
(cherry picked from commit 8e79befefef3f9fae94c0d61169d6d1b182bc872)
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 88b0e70..252694d 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -4383,9 +4383,16 @@ windows_generate_dn_value_mods(char *local_type, const Slapi_Attr *attr, Slapi_M
return ret;
}
-/* Generate the mods for an update in either direction. Be careful... the "remote" entry is the DS entry in the to_windows case, but the AD entry in the other case. */
+/*
+ * Generate the mods for an update in either direction.
+ */
static int
-windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,Slapi_Entry *local_entry, int to_windows, Slapi_Mods *smods, int *do_modify)
+windows_generate_update_mods(Private_Repl_Protocol *prp,
+ Slapi_Entry *remote_entry,
+ Slapi_Entry *local_entry,
+ int to_windows,
+ Slapi_Mods *smods,
+ int *do_modify)
{
int retval = 0;
Slapi_Attr *attr = NULL;
@@ -4395,6 +4402,8 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
int rc = 0;
int is_nt4 = windows_private_get_isnt4(prp->agmt);
const Slapi_DN *local_subtree = NULL;
+ Slapi_Entry *target_entry = NULL;
+
/* Iterate over the attributes on the remote entry, updating the local entry where appropriate */
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_generate_update_mods\n", 0, 0, 0 );
@@ -4411,14 +4420,16 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
if (to_windows)
{
- windows_is_local_entry_user_or_group(remote_entry,&is_user,&is_group);
+ windows_is_local_entry_user_or_group(local_entry,&is_user,&is_group);
+ target_entry = local_entry;
} else
{
windows_is_remote_entry_user_or_group(remote_entry,&is_user,&is_group);
+ target_entry = remote_entry;
}
- for (rc = slapi_entry_first_attr(remote_entry, &attr); rc == 0;
- rc = slapi_entry_next_attr(remote_entry, attr, &attr))
+ for (rc = slapi_entry_first_attr(target_entry, &attr); rc == 0;
+ rc = slapi_entry_next_attr(target_entry, attr, &attr))
{
int is_present_local = 0;
char *type = NULL;
@@ -4458,7 +4469,7 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
}
if (to_windows && (0 == slapi_attr_type_cmp(local_type, "streetAddress", SLAPI_TYPE_CMP_SUBTYPE))) {
- slapi_entry_attr_find(local_entry,FAKE_STREET_ATTR_NAME,&local_attr);
+ slapi_entry_attr_find(remote_entry,FAKE_STREET_ATTR_NAME,&local_attr);
} else {
slapi_entry_attr_find(local_entry,local_type,&local_attr);
}
@@ -4500,8 +4511,8 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
if (!values_equal)
{
slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "windows_generate_update_mods: %s, %s : values are different\n",
- slapi_sdn_get_dn(slapi_entry_get_sdn_const(local_entry)), local_type);
+ "windows_generate_update_mods: %s, %s : values are different\n",
+ slapi_entry_get_dn_const(local_entry), local_type);
if (to_windows && ((0 == slapi_attr_type_cmp(local_type, "streetAddress", SLAPI_TYPE_CMP_SUBTYPE)) ||
(0 == slapi_attr_type_cmp(local_type, "telephoneNumber", SLAPI_TYPE_CMP_SUBTYPE)) ||
@@ -4557,7 +4568,8 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
} else
{
slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "windows_generate_update_mods: %s, %s : values are equal\n", slapi_sdn_get_dn(slapi_entry_get_sdn_const(local_entry)), local_type);
+ "windows_generate_update_mods: %s, %s : values are equal\n",
+ slapi_entry_get_dn_const(local_entry), local_type);
}
} else {
/* A dn-valued attribute : need to take special steps */
1
0
ldap/servers/plugins/replication/windows_protocol_util.c | 30 ++++++++++-----
1 file changed, 21 insertions(+), 9 deletions(-)
New commits:
commit 8e79befefef3f9fae94c0d61169d6d1b182bc872
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Jan 8 17:52:03 2015 -0800
Ticket #47884 - WinSync - manual replica refresh removes AD-only member values from DS and AD in groups
Description: windows_generate_update_mods had a bug which confused to
handle local and remote entry in the logic. The bug was fixed with
Ticket #460 in 1.3.2 and newer. Back-porting the function windows_
generate_update_mods to 1.3.1 and 1.2.11, as well.
https://fedorahosted.org/389/ticket/47884
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 627e8ad..c95bdbb 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -4324,9 +4324,16 @@ windows_generate_dn_value_mods(char *local_type, const Slapi_Attr *attr, Slapi_M
return ret;
}
-/* Generate the mods for an update in either direction. Be careful... the "remote" entry is the DS entry in the to_windows case, but the AD entry in the other case. */
+/*
+ * Generate the mods for an update in either direction.
+ */
static int
-windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,Slapi_Entry *local_entry, int to_windows, Slapi_Mods *smods, int *do_modify)
+windows_generate_update_mods(Private_Repl_Protocol *prp,
+ Slapi_Entry *remote_entry,
+ Slapi_Entry *local_entry,
+ int to_windows,
+ Slapi_Mods *smods,
+ int *do_modify)
{
int retval = 0;
Slapi_Attr *attr = NULL;
@@ -4336,6 +4343,8 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
int rc = 0;
int is_nt4 = windows_private_get_isnt4(prp->agmt);
const Slapi_DN *local_subtree = NULL;
+ Slapi_Entry *target_entry = NULL;
+
/* Iterate over the attributes on the remote entry, updating the local entry where appropriate */
LDAPDebug( LDAP_DEBUG_TRACE, "=> windows_generate_update_mods\n", 0, 0, 0 );
@@ -4352,14 +4361,16 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
if (to_windows)
{
- windows_is_local_entry_user_or_group(remote_entry,&is_user,&is_group);
+ windows_is_local_entry_user_or_group(local_entry,&is_user,&is_group);
+ target_entry = local_entry;
} else
{
windows_is_remote_entry_user_or_group(remote_entry,&is_user,&is_group);
+ target_entry = remote_entry;
}
- for (rc = slapi_entry_first_attr(remote_entry, &attr); rc == 0;
- rc = slapi_entry_next_attr(remote_entry, attr, &attr))
+ for (rc = slapi_entry_first_attr(target_entry, &attr); rc == 0;
+ rc = slapi_entry_next_attr(target_entry, attr, &attr))
{
int is_present_local = 0;
char *type = NULL;
@@ -4399,7 +4410,7 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
}
if (to_windows && (0 == slapi_attr_type_cmp(local_type, "streetAddress", SLAPI_TYPE_CMP_SUBTYPE))) {
- slapi_entry_attr_find(local_entry,FAKE_STREET_ATTR_NAME,&local_attr);
+ slapi_entry_attr_find(remote_entry,FAKE_STREET_ATTR_NAME,&local_attr);
} else {
slapi_entry_attr_find(local_entry,local_type,&local_attr);
}
@@ -4441,8 +4452,8 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
if (!values_equal)
{
slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "windows_generate_update_mods: %s, %s : values are different\n",
- slapi_sdn_get_dn(slapi_entry_get_sdn_const(local_entry)), local_type);
+ "windows_generate_update_mods: %s, %s : values are different\n",
+ slapi_entry_get_dn_const(local_entry), local_type);
if (to_windows && ((0 == slapi_attr_type_cmp(local_type, "streetAddress", SLAPI_TYPE_CMP_SUBTYPE)) ||
(0 == slapi_attr_type_cmp(local_type, "telephoneNumber", SLAPI_TYPE_CMP_SUBTYPE)) ||
@@ -4498,7 +4509,8 @@ windows_generate_update_mods(Private_Repl_Protocol *prp,Slapi_Entry *remote_entr
} else
{
slapi_log_error(SLAPI_LOG_REPL, windows_repl_plugin_name,
- "windows_generate_update_mods: %s, %s : values are equal\n", slapi_sdn_get_dn(slapi_entry_get_sdn_const(local_entry)), local_type);
+ "windows_generate_update_mods: %s, %s : values are equal\n",
+ slapi_entry_get_dn_const(local_entry), local_type);
}
} else {
/* A dn-valued attribute : need to take special steps */
1
0
08 Jan '15
dirsrvtests/tickets/ticket47973_test.py | 235 +++++++++++++++++
ldap/servers/plugins/schema_reload/schema_reload.c | 7
ldap/servers/slapd/attr.c | 8
ldap/servers/slapd/attrsyntax.c | 282 +++++++++++++++------
ldap/servers/slapd/opshared.c | 2
ldap/servers/slapd/proto-slap.h | 11
ldap/servers/slapd/schema.c | 51 ++-
7 files changed, 486 insertions(+), 110 deletions(-)
New commits:
commit 143550aa7af000106c34d3cc705fba7b2be6443d
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Thu Jan 8 15:43:43 2015 -0500
Ticket 47973 - During schema reload sometimes the search returns no results
Bug Description: During a schema reload operation the search of an existing
entry may randomly report no results. This is because during
the schema reload all existing attribute syntaxes are removed,
and there is a small window where ldap operations can be performed
before the new schema is loaded. During this window, attribute
values are normalized to NULL which causes operation to unexpectedly
fail.
Fix Description: Instead of wiping out the existing attribute syntax hastables
in the middle of the task, instead load the new schema into
temporary hash tables. Once the reload is complete, then take
the asi write lock, remove the old hash tables, and swap in the
new ones.
https://fedorahosted.org/389/ticket/47973
valgrind: PASSED
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit e0c78e1c1db351ea5cf835cdb55437b1ea26a3a6)
diff --git a/dirsrvtests/tickets/ticket47973_test.py b/dirsrvtests/tickets/ticket47973_test.py
new file mode 100644
index 0000000..11b1ac8
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47973_test.py
@@ -0,0 +1,235 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+USER_DN = 'uid=user1,%s' % (DEFAULT_SUFFIX)
+SCHEMA_RELOAD_COUNT = 10
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def task_complete(conn, task_dn):
+ finished = False
+
+ try:
+ task_entry = conn.search_s(task_dn, ldap.SCOPE_BASE, 'objectclass=*')
+ if not task_entry:
+ log.fatal('wait_for_task: Search failed to find task: ' + task_dn)
+ assert False
+ if task_entry[0].hasAttr('nstaskexitcode'):
+ # task is done
+ finished = True
+ except ldap.LDAPError, e:
+ log.fatal('wait_for_task: Search failed: ' + e.message['desc'])
+ assert False
+
+ return finished
+
+
+def test_ticket47973(topology):
+ """
+ During the schema reload task there is a small window where the new schema is not loaded
+ into the asi hashtables - this results in searches not returning entries.
+ """
+
+ log.info('Testing Ticket 47973 - Test the searches still work as expected during schema reload tasks')
+
+ #
+ # Add a user
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Run a series of schema_reload tasks while searching for our user. Since
+ # this is a race condition, run it several times.
+ #
+ task_count = 0
+ while task_count < SCHEMA_RELOAD_COUNT:
+ #
+ # Add a schema reload task
+ #
+
+ TASK_DN = 'cn=task-' + str(task_count) + ',cn=schema reload task, cn=tasks, cn=config'
+ try:
+ topology.standalone.add_s(Entry((TASK_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'cn': 'task-' + str(task_count)
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add task entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # While we wait for the task to complete keep searching for our user
+ #
+ search_count = 0
+ while search_count < 100:
+ #
+ # Now check the user is still being returned
+ #
+ try:
+ entries = topology.standalone.search_s(DEFAULT_SUFFIX,
+ ldap.SCOPE_SUBTREE,
+ '(uid=user1)')
+ if not entries or not entries[0]:
+ log.fatal('User was not returned from search!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Check if task is complete
+ #
+ if task_complete(topology.standalone, TASK_DN):
+ break
+
+ search_count += 1
+
+ task_count += 1
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47973_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47973(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c
index efc0de2..4e5c7f0 100644
--- a/ldap/servers/plugins/schema_reload/schema_reload.c
+++ b/ldap/servers/plugins/schema_reload/schema_reload.c
@@ -170,13 +170,6 @@ schemareload_thread(void *arg)
slapi_task_log_notice(task, "Schema reload task finished.");
slapi_task_log_status(task, "Schema reload task finished.");
slapi_log_error(SLAPI_LOG_FATAL, "schemareload", "Schema reload task finished.\n");
-
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema.\n");
- rv = slapi_reload_internal_attr_syntax();
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema finished.\n");
-
} else {
slapi_task_log_notice(task, "Schema reload task failed.");
slapi_task_log_status(task, "Schema reload task failed.");
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index a4cf6cb..f19e7e6 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -245,8 +245,8 @@ slapi_attr_types_equivalent(const char *t1, const char *t2)
return 0;
}
- asi1 = attr_syntax_get_by_name(t1);
- asi2 = attr_syntax_get_by_name(t2);
+ asi1 = attr_syntax_get_by_name(t1, 0);
+ asi2 = attr_syntax_get_by_name(t2, 0);
if (NULL != asi1) {
if (NULL != asi2) {
/* Both found - compare normalized names */
@@ -347,7 +347,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
{
basetype = tmp; /* basetype was malloc'd */
}
- asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock);
+ asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock, 0);
}
if(NULL == asi)
{
@@ -358,7 +358,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
* attribute type that has that syntax.
*/
asi = attr_syntax_get_by_name_locking_optional(
- ATTR_WITH_OCTETSTRING_SYNTAX, use_lock);
+ ATTR_WITH_OCTETSTRING_SYNTAX, use_lock, 0);
}
else
{
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index 885d02a..d93a807 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -70,8 +70,15 @@ static asyntaxinfo *global_at = NULL;
static PLHashTable *name2asi = NULL;
/* read/write lock to protect table */
static Slapi_RWLock *name2asi_lock = NULL;
-static int asi_locking = 1;
+/*
+ * For the schema reload task, we need to use separate temporary hashtables & linked lists
+ */
+static PLHashTable *oid2asi_tmp = NULL;
+static PLHashTable *name2asi_tmp = NULL;
+static asyntaxinfo *global_at_tmp = NULL;
+
+static int asi_locking = 1;
#define AS_LOCK_READ(l) if (asi_locking) { slapi_rwlock_rdlock(l); }
#define AS_LOCK_WRITE(l) if (asi_locking) { slapi_rwlock_wrlock(l); }
#define AS_UNLOCK_READ(l) if (asi_locking) { slapi_rwlock_unlock(l); }
@@ -82,10 +89,11 @@ static struct asyntaxinfo *default_asi = NULL;
static void *attr_syntax_get_plugin_by_name_with_default( const char *type );
static void attr_syntax_delete_no_lock( struct asyntaxinfo *asip,
- PRBool remove_from_oid_table );
+ PRBool remove_from_oid_table, PRUint32 schema_flags );
static struct asyntaxinfo *attr_syntax_get_by_oid_locking_optional( const
- char *oid, PRBool use_lock);
+ char *oid, PRBool use_lock, PRUint32 schema_flags);
static void attr_syntax_insert( struct asyntaxinfo *asip );
+static void attr_syntax_insert_tmp( struct asyntaxinfo *asip );
static void attr_syntax_remove( struct asyntaxinfo *asip );
#ifdef ATTR_LDAP_DEBUG
@@ -210,8 +218,6 @@ attr_syntax_check_oids()
void
attr_syntax_free( struct asyntaxinfo *a )
{
- PR_ASSERT( a->asi_refcnt == 0 );
-
cool_charray_free( a->asi_aliases );
slapi_ch_free_string(&a->asi_name );
slapi_ch_free_string(&a->asi_desc );
@@ -241,9 +247,9 @@ attr_syntax_new()
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_oid(const char *oid)
+attr_syntax_get_by_oid(const char *oid, PRUint32 schema_flags)
{
- return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE);
+ return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE, schema_flags);
}
@@ -256,15 +262,30 @@ attr_syntax_get_by_oid(const char *oid)
* same use_lock parameter.
*/
static struct asyntaxinfo *
-attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
+attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock, PRUint32 schema_flags )
{
struct asyntaxinfo *asi = 0;
- if (oid2asi)
+ PLHashTable *ht = oid2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = oid2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(oid2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(oid2asi, oid);
+ if (!using_tmp_ht){
+ /*
+ * The oid2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = oid2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, oid);
if (asi)
{
PR_AtomicIncrement( &asi->asi_refcnt );
@@ -285,18 +306,22 @@ attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(oid2asi_lock);
- }
+ if(schema_flags & DSE_SCHEMA_LOCKED){
+ PL_HashTableAdd(oid2asi_tmp, oid, a);
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(oid2asi_lock);
+ }
- PL_HashTableAdd(oid2asi, oid, a);
+ PL_HashTableAdd(oid2asi, oid, a);
- if (lock) {
- AS_UNLOCK_WRITE(oid2asi_lock);
+ if (lock) {
+ AS_UNLOCK_WRITE(oid2asi_lock);
+ }
}
}
@@ -309,18 +334,18 @@ attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_name(const char *name)
+attr_syntax_get_by_name(const char *name, PRUint32 schema_flags)
{
- return attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ return attr_syntax_get_by_name_locking_optional(name, PR_TRUE, schema_flags);
}
struct asyntaxinfo *
attr_syntax_get_by_name_with_default(const char *name)
{
struct asyntaxinfo *asi = NULL;
- asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE, 0);
if (asi == NULL)
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if ( asi == NULL )
asi = default_asi;
return asi;
@@ -335,15 +360,30 @@ struct asyntaxinfo *asi = NULL;
* same use_lock parameter.
*/
struct asyntaxinfo *
-attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
+attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock, PRUint32 schema_flags)
{
struct asyntaxinfo *asi = 0;
- if (name2asi)
+ PLHashTable *ht = name2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = name2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(name2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(name2asi, name);
+ if(!using_tmp_ht){
+ /*
+ * The name2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = name2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, name);
if ( NULL != asi ) {
PR_AtomicIncrement( &asi->asi_refcnt );
}
@@ -352,7 +392,7 @@ attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
}
}
if (!asi) /* given name may be an OID */
- asi = attr_syntax_get_by_oid_locking_optional(name, use_lock);
+ asi = attr_syntax_get_by_oid_locking_optional(name, use_lock, schema_flags);
return asi;
}
@@ -416,29 +456,43 @@ attr_syntax_return_locking_optional(struct asyntaxinfo *asi, PRBool use_lock)
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_name(struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(name2asi_lock);
- }
+ if (schema_flags & DSE_SCHEMA_LOCKED ){
+ /* insert the attr into the temp global linked list */
+ attr_syntax_insert_tmp(a);
+
+ PL_HashTableAdd(name2asi_tmp, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
+
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi_tmp, a->asi_aliases[i], a);
+ }
+ }
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(name2asi_lock);
+ }
+ /* insert the attr into the global linked list */
+ attr_syntax_insert(a);
- /* insert the attr into the global linked list */
- attr_syntax_insert(a);
+ PL_HashTableAdd(name2asi, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
- PL_HashTableAdd(name2asi, a->asi_name, a);
- if ( a->asi_aliases != NULL ) {
- int i;
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ }
+ }
- for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ if (lock) {
+ AS_UNLOCK_WRITE(name2asi_lock);
}
}
- if (lock) {
- AS_UNLOCK_WRITE(name2asi_lock);
- }
}
@@ -447,7 +501,7 @@ attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
* and oids.
*/
void
-attr_syntax_delete( struct asyntaxinfo *asi )
+attr_syntax_delete( struct asyntaxinfo *asi, PRUint32 schema_flags )
{
PR_ASSERT( asi );
@@ -455,7 +509,7 @@ attr_syntax_delete( struct asyntaxinfo *asi )
AS_LOCK_WRITE(oid2asi_lock);
AS_LOCK_WRITE(name2asi_lock);
- attr_syntax_delete_no_lock( asi, PR_TRUE );
+ attr_syntax_delete_no_lock( asi, PR_TRUE, schema_flags );
AS_UNLOCK_WRITE(name2asi_lock);
AS_UNLOCK_WRITE(oid2asi_lock);
@@ -469,19 +523,34 @@ attr_syntax_delete( struct asyntaxinfo *asi )
*/
static void
attr_syntax_delete_no_lock( struct asyntaxinfo *asi,
- PRBool remove_from_oidtable )
+ PRBool remove_from_oidtable, PRUint32 schema_flags )
{
- int i;
+ PLHashTable *ht = NULL;
+ int using_tmp_ht = 0;
+ int i;
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ using_tmp_ht = 1;
+ }
if (oid2asi && remove_from_oidtable ) {
- PL_HashTableRemove(oid2asi, asi->asi_oid);
+ if (using_tmp_ht){
+ ht = oid2asi_tmp;
+ } else {
+ ht = oid2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_oid);
}
if(name2asi) {
- PL_HashTableRemove(name2asi, asi->asi_name);
+ if (using_tmp_ht){
+ ht = name2asi_tmp;
+ } else {
+ ht = name2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_name);
if ( asi->asi_aliases != NULL ) {
for ( i = 0; asi->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableRemove(name2asi, asi->asi_aliases[i]);
+ PL_HashTableRemove(ht, asi->asi_aliases[i]);
}
}
if ( asi->asi_refcnt > 0 ) {
@@ -511,7 +580,7 @@ slapi_attr_syntax_normalize( const char *s )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, 0)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -535,7 +604,7 @@ slapi_attr_syntax_normalize_ext( char *s, int flags )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, flags)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -569,7 +638,7 @@ attr_syntax_exists(const char *attr_name)
check_attr_name = (char *)attr_name;
}
- asi = attr_syntax_get_by_name(check_attr_name);
+ asi = attr_syntax_get_by_name(check_attr_name, 0);
attr_syntax_return( asi );
if (free_attr) {
@@ -742,13 +811,13 @@ attr_syntax_get_plugin_by_name_with_default( const char *type )
/*
* first we look for this attribute type explictly
*/
- if ( (asi = attr_syntax_get_by_name(type)) == NULL ) {
+ if ( (asi = attr_syntax_get_by_name(type, 0)) == NULL ) {
/*
* no syntax for this type... return Octet String
* syntax. we accomplish this by looking up a well known
* attribute type that has that syntax.
*/
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if (asi == NULL)
asi = default_asi;
}
@@ -803,6 +872,20 @@ attr_syntax_insert(struct asyntaxinfo *asip )
}
static void
+attr_syntax_insert_tmp(struct asyntaxinfo *asip )
+{
+ /* Insert at top of list */
+ asip->asi_prev = NULL;
+ asip->asi_next = global_at_tmp;
+ if(global_at_tmp){
+ global_at_tmp->asi_prev = asip;
+ global_at_tmp = asip;
+ } else {
+ global_at_tmp = asip;
+ }
+}
+
+static void
attr_syntax_remove(struct asyntaxinfo *asip )
{
struct asyntaxinfo *prev, *next;
@@ -828,7 +911,7 @@ attr_syntax_remove(struct asyntaxinfo *asip )
* Returns an LDAP error code (LDAP_SUCCESS if all goes well).
*/
int
-attr_syntax_add( struct asyntaxinfo *asip )
+attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags )
{
int i, rc = LDAP_SUCCESS;
int nolock = asip->asi_flags & SLAPI_ATTR_FLAG_NOLOCKING;
@@ -840,7 +923,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* make sure the oid is unique */
if ( NULL != ( oldas_from_oid = attr_syntax_get_by_oid_locking_optional(
- asip->asi_oid, !nolock))) {
+ asip->asi_oid, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)) {
/* failure - OID is in use; no override flag */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -852,7 +935,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
* the primary name and OID point to the same schema definition.
*/
if ( NULL != ( oldas_from_name = attr_syntax_get_by_name_locking_optional(
- asip->asi_name, !nolock))) {
+ asip->asi_name, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)
|| ( oldas_from_oid != oldas_from_name )) {
/* failure; no override flag OR OID and name don't match */
@@ -860,7 +943,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
goto cleanup_and_return;
}
/* Flag for deletion. We are going to override this attr */
- attr_syntax_delete(oldas_from_name);
+ attr_syntax_delete(oldas_from_name, schema_flags);
} else if ( NULL != oldas_from_oid ) {
/* failure - OID is in use but name does not exist */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -874,11 +957,11 @@ attr_syntax_add( struct asyntaxinfo *asip )
if ( NULL != ( tmpasi =
attr_syntax_get_by_name_locking_optional(
- asip->asi_aliases[i], !nolock))) {
+ asip->asi_aliases[i], !nolock, schema_flags))) {
if (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE) {
/* Flag for tmpasi for deletion. It will be free'd
* when attr_syntax_return is called. */
- attr_syntax_delete(tmpasi);
+ attr_syntax_delete(tmpasi, schema_flags);
} else {
/* failure - one of the aliases is already in use */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -897,8 +980,8 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* ditto for the override one */
asip->asi_flags &= ~SLAPI_ATTR_FLAG_OVERRIDE;
- attr_syntax_add_by_oid( asip->asi_oid, asip, !nolock);
- attr_syntax_add_by_name( asip, !nolock);
+ attr_syntax_add_by_oid( asip->asi_oid, asip, schema_flags, !nolock);
+ attr_syntax_add_by_name( asip, schema_flags, !nolock);
cleanup_and_return:
attr_syntax_return_locking_optional( oldas_from_oid, !nolock );
@@ -1071,7 +1154,7 @@ slapi_attr_type2plugin( const char *type, void **pi )
int
slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oid = asi->asi_oid;
attr_syntax_return(asi);
@@ -1087,7 +1170,7 @@ slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
int
slapi_attr_get_oid_copy( const Slapi_Attr *a, char **oidp )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oidp = slapi_ch_strdup( asi->asi_oid );
attr_syntax_return(asi);
@@ -1144,7 +1227,7 @@ slapi_attr_is_dn_syntax_type(char *type)
int dn_syntax = 0; /* not DN, by default */
struct asyntaxinfo * asi;
- asi = attr_syntax_get_by_name(type);
+ asi = attr_syntax_get_by_name(type, 0);
if (asi && asi->asi_plugin) { /* If not set, there is no way to get the info */
if ((syntaxoid = asi->asi_plugin->plg_syntax_oid)) {
@@ -1323,7 +1406,7 @@ attr_syntax_delete_if_not_flagged(struct asyntaxinfo *asip, void *arg)
PR_ASSERT( fi != NULL );
if ( 0 == ( asip->asi_flags & fi->asef_flag )) {
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
} else {
return ATTR_SYNTAX_ENUM_NEXT;
@@ -1339,7 +1422,7 @@ attr_syntax_force_to_delete(struct asyntaxinfo *asip, void *arg)
fi = (struct attr_syntax_enum_flaginfo *)arg;
PR_ASSERT( fi != NULL );
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
}
@@ -1404,6 +1487,7 @@ attr_syntax_delete_all_for_schemareload(unsigned long flag)
#define ATTR_DEFAULT_SYNTAX_OID "1.1"
#define ATTR_DEFAULT_SYNTAX "defaultdirstringsyntax"
+
static int
attr_syntax_init(void)
{
@@ -1413,8 +1497,8 @@ attr_syntax_init(void)
if (!oid2asi)
{
oid2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( oid2asi_lock = slapi_new_rwlock())) {
if(oid2asi) PL_HashTableDestroy(oid2asi);
oid2asi = NULL;
@@ -1425,11 +1509,19 @@ attr_syntax_init(void)
}
}
+ if (!oid2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ oid2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
if (!name2asi)
{
name2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( name2asi_lock = slapi_new_rwlock())) {
if(name2asi) PL_HashTableDestroy(name2asi);
name2asi = NULL;
@@ -1441,10 +1533,18 @@ attr_syntax_init(void)
/* add a default syntax plugin as fallback, required during startup
*/
attr_syntax_create_default( ATTR_DEFAULT_SYNTAX,
- ATTR_DEFAULT_SYNTAX_OID,
- DIRSTRING_SYNTAX_OID,
- SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
+ ATTR_DEFAULT_SYNTAX_OID,
+ DIRSTRING_SYNTAX_OID,
+ SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
}
+ if (!name2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ name2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
return 0;
}
@@ -1510,7 +1610,7 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
&asip );
if ( rc == LDAP_SUCCESS ) {
- rc = attr_syntax_add( asip );
+ rc = attr_syntax_add( asip, 0 );
if ( rc == LDAP_SUCCESS ) {
if (attr_syntax_internal_asi_add_ht(asip)) {
slapi_log_error(SLAPI_LOG_FATAL,
@@ -1518,6 +1618,8 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
"Failed to stash internal asyntaxinfo: %s.\n",
asip->asi_name);
}
+ } else {
+ attr_syntax_free(asip);
}
}
@@ -1537,7 +1639,7 @@ attr_syntax_internal_asi_add(struct asyntaxinfo *asip, void *arg)
/* Copy is needed since when reloading the schema,
* existing syntax info is cleaned up. */
asip_copy = attr_syntax_dup(asip);
- rc = attr_syntax_add(asip_copy);
+ rc = attr_syntax_add(asip_copy, 0);
if (LDAP_SUCCESS != rc) {
attr_syntax_free(asip_copy);
}
@@ -1575,3 +1677,37 @@ attr_syntax_find(struct asyntaxinfo *at1, struct asyntaxinfo *at2)
return NULL;
}
+
+/*
+ * schema reload - now that we have loaded the schema into temporary
+ * hash tables and linked lists, swap out the old for the new. Then
+ * reload the internal attr syntaxes
+ */
+void
+attr_syntax_swap_ht()
+{
+ struct asyntaxinfo *next;
+
+ /* Remove the old hash tables */
+ PL_HashTableDestroy(name2asi);
+ PL_HashTableDestroy(oid2asi);
+
+ /* Free the global attr linked list */
+ while(global_at){
+ next = global_at->asi_next;
+ attr_syntax_free(global_at);
+ global_at = next;
+ }
+
+ /*
+ * Swap the hash table/linked list pointers, and set the
+ * temporary pointers to NULL
+ */
+ name2asi = name2asi_tmp;
+ name2asi_tmp = NULL;
+ oid2asi = oid2asi_tmp;
+ oid2asi_tmp = NULL;
+ global_at = global_at_tmp;
+ global_at_tmp = NULL;
+}
+
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index 2e4bbda..b9a5f04 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -86,7 +86,7 @@ int op_shared_is_allowed_attr (const char *attr_name, int replicated_op)
* check to see if attribute is marked as one clients can't modify
*/
- asi = attr_syntax_get_by_name( attr_name );
+ asi = attr_syntax_get_by_name( attr_name, 0 );
if ( NULL != asi &&
0 != ( asi->asi_flags & SLAPI_ATTR_FLAG_NOUSERMOD )) {
/* this attribute is not allowed */
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 6328a74..c79a85d 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -118,7 +118,7 @@ void attr_syntax_write_lock(void);
void attr_syntax_unlock_read(void);
void attr_syntax_unlock_write(void);
int attr_syntax_exists (const char *attr_name);
-void attr_syntax_delete ( struct asyntaxinfo *asip );
+void attr_syntax_delete ( struct asyntaxinfo *asip, PRUint32 schema_flags );
#define SLAPI_SYNTAXLENGTH_NONE (-1) /* for syntaxlength parameter */
int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *attr_desc, const char *attr_superior,
@@ -126,18 +126,19 @@ int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *mr_substring, schemaext *extensions, const char *attr_syntax,
int syntaxlength, unsigned long flags, struct asyntaxinfo **asip );
void attr_syntax_free( struct asyntaxinfo *a );
-int attr_syntax_add( struct asyntaxinfo *asip );
+int attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags );
char *attr_syntax_normalize_no_lookup( const char *s );
char *attr_syntax_normalize_no_lookup_ext( char *s, int flags );
void attr_syntax_enumerate_attrs(AttrEnumFunc aef, void *arg, PRBool writelock);
void attr_syntax_all_clear_flag( unsigned long flag );
void attr_syntax_delete_all_not_flagged( unsigned long flag );
-struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid );
-struct asyntaxinfo *attr_syntax_get_by_name ( const char *name );
+struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid, PRUint32 schema_flags );
+struct asyntaxinfo *attr_syntax_get_by_name ( const char *name, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_by_name_with_default ( const char *name );
-struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock );
+struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_global_at();
struct asyntaxinfo *attr_syntax_find(struct asyntaxinfo *at1, struct asyntaxinfo *at2);
+void attr_syntax_swap_ht(void);
/*
* Call attr_syntax_return() when you are done using a value returned
* by attr_syntax_get_by_oid() or attr_syntax_get_by_name().
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 65bb6f4..46ce4cc 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2580,7 +2580,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
sscanf (attr_ldif, "%s name %s syntax %s",
psbAttrOid->buffer, psbAttrName->buffer, psbAttrSyntax->buffer);
- if ((a = attr_syntax_get_by_name ( psbAttrName->buffer)) != NULL ) {
+ if ((a = attr_syntax_get_by_name ( psbAttrName->buffer, 0 )) != NULL ) {
/* only modify attrs which were user defined */
if (a->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
@@ -2632,7 +2632,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
/* Delete it. */
- attr_syntax_delete( a );
+ attr_syntax_delete( a, 0 );
attr_syntax_return( a );
}
else {
@@ -2755,7 +2755,7 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
}
/* check to see if the oid is already in use by an attribute */
- if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid))) {
+ if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid, flags))) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
pnew_oc->oc_name,
"The OID \"%s\" is also used by the attribute type \"%s\"",
@@ -2874,7 +2874,7 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
* handle the various cases.
*/
if ( NULL == ( oldasip =
- attr_syntax_get_by_oid( newasip->asi_oid ))) {
+ attr_syntax_get_by_oid( newasip->asi_oid, 0 ))) {
/* new attribute type */
LDAPDebug( LDAP_DEBUG_TRACE, "schema_replace_attributes:"
" new type %s (OID %s)\n",
@@ -2892,14 +2892,14 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
" replacing type %s (OID %s)\n",
newasip->asi_name, newasip->asi_oid, 0 );
/* flag for deletion */
- attr_syntax_delete( oldasip );
+ attr_syntax_delete( oldasip, 0 );
}
attr_syntax_return( oldasip );
}
if ( NULL != newasip ) { /* add new or replacement definition */
- rc = attr_syntax_add( newasip );
+ rc = attr_syntax_add( newasip, 0 );
if ( LDAP_SUCCESS != rc ) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, newasip->asi_name,
@@ -3853,7 +3853,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (!status && (NULL != pSuperior)) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(pSuperior);
+ asi_parent = attr_syntax_get_by_name(pSuperior, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
LDAPDebug (LDAP_DEBUG_PARSE,
@@ -3954,7 +3954,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
struct asyntaxinfo *tmpasi;
if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
- ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid)))) {
+ ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use",
@@ -3976,7 +3976,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if ( NULL != asipp ) {
*asipp = tmpasip; /* just return it */
} else { /* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -4164,10 +4164,10 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (NULL != atype->at_sup_oid) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(atype->at_sup_oid);
+ asi_parent = attr_syntax_get_by_name(atype->at_sup_oid, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
- LDAPDebug (LDAP_DEBUG_PARSE, "Cannot find parent attribute type \"%s\"\n",
+ LDAPDebug (LDAP_DEBUG_ANY, "Cannot find parent attribute type \"%s\"\n",
atype->at_sup_oid, NULL, NULL);
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at, first_attr_name,
"Missing parent attribute syntax OID");
@@ -4333,7 +4333,7 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
/*
* Check if the OID is already being used
*/
- if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) && ( NULL != (tmpasi = attr_syntax_get_by_oid(atype->at_oid)))) {
+ if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) && ( NULL != (tmpasi = attr_syntax_get_by_oid(atype->at_oid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use", atype->at_oid);
@@ -4352,7 +4352,7 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
*asipp = tmpasip; /* just return it */
} else {
/* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -6045,9 +6045,13 @@ slapi_validate_schema_files(char *schemadir)
}
/*
- * API to reload the schema files.
- * Rule: this function is called when slapi_validate_schema_files is passed.
- * Schema checking is skipped in this function.
+ * Reload the schema files
+ *
+ * This is only called from the schema_reload task. The flag DSE_SCHEMA_LOCKED
+ * is also only set been called from this function. To not interrupt clients
+ * we will rebuild the schema in separate hash tables, and then swap the
+ * hash tables once the schema is completely reloaded. We use the DSE_SCHEMA_LOCKED
+ * flag to tell the attribute syntax functions to use the temporary hashtables.
*/
int
slapi_reload_schema_files(char *schemadir)
@@ -6065,14 +6069,21 @@ slapi_reload_schema_files(char *schemadir)
}
slapi_be_Wlock(be); /* be lock must be outer of schemafile lock */
reload_schemafile_lock();
- /* Exclude attr_syntax not to grab from the hash table while cleaning up */
- attr_syntax_write_lock();
- attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
oc_delete_all_nolock();
- attr_syntax_unlock_write();
rc = init_schema_dse_ext(schemadir, be, &my_pschemadse,
DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_LOCKED);
if (rc) {
+ /*
+ * The schema has been reloaded into the temporary hash tables.
+ * Take the write lock, wipe out the existing hash tables, and
+ * swap in the new ones.
+ */
+ attr_syntax_write_lock();
+ attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
+ attr_syntax_swap_ht();
+ attr_syntax_unlock_write();
+ slapi_reload_internal_attr_syntax();
+
dse_destroy(pschemadse);
pschemadse = my_pschemadse;
reload_schemafile_unlock();
1
0
08 Jan '15
dirsrvtests/tickets/ticket47973_test.py | 235 +++++++++++++++++
ldap/servers/plugins/schema_reload/schema_reload.c | 7
ldap/servers/slapd/attr.c | 8
ldap/servers/slapd/attrsyntax.c | 282 +++++++++++++++------
ldap/servers/slapd/opshared.c | 2
ldap/servers/slapd/proto-slap.h | 11
ldap/servers/slapd/schema.c | 51 ++-
7 files changed, 486 insertions(+), 110 deletions(-)
New commits:
commit 2da0bd62830b5240d110cc4a52a93da07371511e
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Thu Jan 8 15:43:43 2015 -0500
Ticket 47973 - During schema reload sometimes the search returns no results
Bug Description: During a schema reload operation the search of an existing
entry may randomly report no results. This is because during
the schema reload all existing attribute syntaxes are removed,
and there is a small window where ldap operations can be performed
before the new schema is loaded. During this window, attribute
values are normalized to NULL which causes operation to unexpectedly
fail.
Fix Description: Instead of wiping out the existing attribute syntax hastables
in the middle of the task, instead load the new schema into
temporary hash tables. Once the reload is complete, then take
the asi write lock, remove the old hash tables, and swap in the
new ones.
https://fedorahosted.org/389/ticket/47973
valgrind: PASSED
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit e0c78e1c1db351ea5cf835cdb55437b1ea26a3a6)
diff --git a/dirsrvtests/tickets/ticket47973_test.py b/dirsrvtests/tickets/ticket47973_test.py
new file mode 100644
index 0000000..11b1ac8
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47973_test.py
@@ -0,0 +1,235 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+USER_DN = 'uid=user1,%s' % (DEFAULT_SUFFIX)
+SCHEMA_RELOAD_COUNT = 10
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def task_complete(conn, task_dn):
+ finished = False
+
+ try:
+ task_entry = conn.search_s(task_dn, ldap.SCOPE_BASE, 'objectclass=*')
+ if not task_entry:
+ log.fatal('wait_for_task: Search failed to find task: ' + task_dn)
+ assert False
+ if task_entry[0].hasAttr('nstaskexitcode'):
+ # task is done
+ finished = True
+ except ldap.LDAPError, e:
+ log.fatal('wait_for_task: Search failed: ' + e.message['desc'])
+ assert False
+
+ return finished
+
+
+def test_ticket47973(topology):
+ """
+ During the schema reload task there is a small window where the new schema is not loaded
+ into the asi hashtables - this results in searches not returning entries.
+ """
+
+ log.info('Testing Ticket 47973 - Test the searches still work as expected during schema reload tasks')
+
+ #
+ # Add a user
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Run a series of schema_reload tasks while searching for our user. Since
+ # this is a race condition, run it several times.
+ #
+ task_count = 0
+ while task_count < SCHEMA_RELOAD_COUNT:
+ #
+ # Add a schema reload task
+ #
+
+ TASK_DN = 'cn=task-' + str(task_count) + ',cn=schema reload task, cn=tasks, cn=config'
+ try:
+ topology.standalone.add_s(Entry((TASK_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'cn': 'task-' + str(task_count)
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add task entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # While we wait for the task to complete keep searching for our user
+ #
+ search_count = 0
+ while search_count < 100:
+ #
+ # Now check the user is still being returned
+ #
+ try:
+ entries = topology.standalone.search_s(DEFAULT_SUFFIX,
+ ldap.SCOPE_SUBTREE,
+ '(uid=user1)')
+ if not entries or not entries[0]:
+ log.fatal('User was not returned from search!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Check if task is complete
+ #
+ if task_complete(topology.standalone, TASK_DN):
+ break
+
+ search_count += 1
+
+ task_count += 1
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47973_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47973(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c
index b1a5bb8..bb16d08 100644
--- a/ldap/servers/plugins/schema_reload/schema_reload.c
+++ b/ldap/servers/plugins/schema_reload/schema_reload.c
@@ -187,13 +187,6 @@ schemareload_thread(void *arg)
slapi_task_log_notice(task, "Schema reload task finished.");
slapi_task_log_status(task, "Schema reload task finished.");
slapi_log_error(SLAPI_LOG_FATAL, "schemareload", "Schema reload task finished.\n");
-
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema.\n");
- rv = slapi_reload_internal_attr_syntax();
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema finished.\n");
-
} else {
slapi_task_log_notice(task, "Schema reload task failed.");
slapi_task_log_status(task, "Schema reload task failed.");
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index a4cf6cb..f19e7e6 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -245,8 +245,8 @@ slapi_attr_types_equivalent(const char *t1, const char *t2)
return 0;
}
- asi1 = attr_syntax_get_by_name(t1);
- asi2 = attr_syntax_get_by_name(t2);
+ asi1 = attr_syntax_get_by_name(t1, 0);
+ asi2 = attr_syntax_get_by_name(t2, 0);
if (NULL != asi1) {
if (NULL != asi2) {
/* Both found - compare normalized names */
@@ -347,7 +347,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
{
basetype = tmp; /* basetype was malloc'd */
}
- asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock);
+ asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock, 0);
}
if(NULL == asi)
{
@@ -358,7 +358,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
* attribute type that has that syntax.
*/
asi = attr_syntax_get_by_name_locking_optional(
- ATTR_WITH_OCTETSTRING_SYNTAX, use_lock);
+ ATTR_WITH_OCTETSTRING_SYNTAX, use_lock, 0);
}
else
{
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index 885d02a..d93a807 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -70,8 +70,15 @@ static asyntaxinfo *global_at = NULL;
static PLHashTable *name2asi = NULL;
/* read/write lock to protect table */
static Slapi_RWLock *name2asi_lock = NULL;
-static int asi_locking = 1;
+/*
+ * For the schema reload task, we need to use separate temporary hashtables & linked lists
+ */
+static PLHashTable *oid2asi_tmp = NULL;
+static PLHashTable *name2asi_tmp = NULL;
+static asyntaxinfo *global_at_tmp = NULL;
+
+static int asi_locking = 1;
#define AS_LOCK_READ(l) if (asi_locking) { slapi_rwlock_rdlock(l); }
#define AS_LOCK_WRITE(l) if (asi_locking) { slapi_rwlock_wrlock(l); }
#define AS_UNLOCK_READ(l) if (asi_locking) { slapi_rwlock_unlock(l); }
@@ -82,10 +89,11 @@ static struct asyntaxinfo *default_asi = NULL;
static void *attr_syntax_get_plugin_by_name_with_default( const char *type );
static void attr_syntax_delete_no_lock( struct asyntaxinfo *asip,
- PRBool remove_from_oid_table );
+ PRBool remove_from_oid_table, PRUint32 schema_flags );
static struct asyntaxinfo *attr_syntax_get_by_oid_locking_optional( const
- char *oid, PRBool use_lock);
+ char *oid, PRBool use_lock, PRUint32 schema_flags);
static void attr_syntax_insert( struct asyntaxinfo *asip );
+static void attr_syntax_insert_tmp( struct asyntaxinfo *asip );
static void attr_syntax_remove( struct asyntaxinfo *asip );
#ifdef ATTR_LDAP_DEBUG
@@ -210,8 +218,6 @@ attr_syntax_check_oids()
void
attr_syntax_free( struct asyntaxinfo *a )
{
- PR_ASSERT( a->asi_refcnt == 0 );
-
cool_charray_free( a->asi_aliases );
slapi_ch_free_string(&a->asi_name );
slapi_ch_free_string(&a->asi_desc );
@@ -241,9 +247,9 @@ attr_syntax_new()
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_oid(const char *oid)
+attr_syntax_get_by_oid(const char *oid, PRUint32 schema_flags)
{
- return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE);
+ return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE, schema_flags);
}
@@ -256,15 +262,30 @@ attr_syntax_get_by_oid(const char *oid)
* same use_lock parameter.
*/
static struct asyntaxinfo *
-attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
+attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock, PRUint32 schema_flags )
{
struct asyntaxinfo *asi = 0;
- if (oid2asi)
+ PLHashTable *ht = oid2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = oid2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(oid2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(oid2asi, oid);
+ if (!using_tmp_ht){
+ /*
+ * The oid2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = oid2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, oid);
if (asi)
{
PR_AtomicIncrement( &asi->asi_refcnt );
@@ -285,18 +306,22 @@ attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(oid2asi_lock);
- }
+ if(schema_flags & DSE_SCHEMA_LOCKED){
+ PL_HashTableAdd(oid2asi_tmp, oid, a);
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(oid2asi_lock);
+ }
- PL_HashTableAdd(oid2asi, oid, a);
+ PL_HashTableAdd(oid2asi, oid, a);
- if (lock) {
- AS_UNLOCK_WRITE(oid2asi_lock);
+ if (lock) {
+ AS_UNLOCK_WRITE(oid2asi_lock);
+ }
}
}
@@ -309,18 +334,18 @@ attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_name(const char *name)
+attr_syntax_get_by_name(const char *name, PRUint32 schema_flags)
{
- return attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ return attr_syntax_get_by_name_locking_optional(name, PR_TRUE, schema_flags);
}
struct asyntaxinfo *
attr_syntax_get_by_name_with_default(const char *name)
{
struct asyntaxinfo *asi = NULL;
- asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE, 0);
if (asi == NULL)
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if ( asi == NULL )
asi = default_asi;
return asi;
@@ -335,15 +360,30 @@ struct asyntaxinfo *asi = NULL;
* same use_lock parameter.
*/
struct asyntaxinfo *
-attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
+attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock, PRUint32 schema_flags)
{
struct asyntaxinfo *asi = 0;
- if (name2asi)
+ PLHashTable *ht = name2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = name2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(name2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(name2asi, name);
+ if(!using_tmp_ht){
+ /*
+ * The name2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = name2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, name);
if ( NULL != asi ) {
PR_AtomicIncrement( &asi->asi_refcnt );
}
@@ -352,7 +392,7 @@ attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
}
}
if (!asi) /* given name may be an OID */
- asi = attr_syntax_get_by_oid_locking_optional(name, use_lock);
+ asi = attr_syntax_get_by_oid_locking_optional(name, use_lock, schema_flags);
return asi;
}
@@ -416,29 +456,43 @@ attr_syntax_return_locking_optional(struct asyntaxinfo *asi, PRBool use_lock)
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_name(struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(name2asi_lock);
- }
+ if (schema_flags & DSE_SCHEMA_LOCKED ){
+ /* insert the attr into the temp global linked list */
+ attr_syntax_insert_tmp(a);
+
+ PL_HashTableAdd(name2asi_tmp, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
+
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi_tmp, a->asi_aliases[i], a);
+ }
+ }
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(name2asi_lock);
+ }
+ /* insert the attr into the global linked list */
+ attr_syntax_insert(a);
- /* insert the attr into the global linked list */
- attr_syntax_insert(a);
+ PL_HashTableAdd(name2asi, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
- PL_HashTableAdd(name2asi, a->asi_name, a);
- if ( a->asi_aliases != NULL ) {
- int i;
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ }
+ }
- for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ if (lock) {
+ AS_UNLOCK_WRITE(name2asi_lock);
}
}
- if (lock) {
- AS_UNLOCK_WRITE(name2asi_lock);
- }
}
@@ -447,7 +501,7 @@ attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
* and oids.
*/
void
-attr_syntax_delete( struct asyntaxinfo *asi )
+attr_syntax_delete( struct asyntaxinfo *asi, PRUint32 schema_flags )
{
PR_ASSERT( asi );
@@ -455,7 +509,7 @@ attr_syntax_delete( struct asyntaxinfo *asi )
AS_LOCK_WRITE(oid2asi_lock);
AS_LOCK_WRITE(name2asi_lock);
- attr_syntax_delete_no_lock( asi, PR_TRUE );
+ attr_syntax_delete_no_lock( asi, PR_TRUE, schema_flags );
AS_UNLOCK_WRITE(name2asi_lock);
AS_UNLOCK_WRITE(oid2asi_lock);
@@ -469,19 +523,34 @@ attr_syntax_delete( struct asyntaxinfo *asi )
*/
static void
attr_syntax_delete_no_lock( struct asyntaxinfo *asi,
- PRBool remove_from_oidtable )
+ PRBool remove_from_oidtable, PRUint32 schema_flags )
{
- int i;
+ PLHashTable *ht = NULL;
+ int using_tmp_ht = 0;
+ int i;
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ using_tmp_ht = 1;
+ }
if (oid2asi && remove_from_oidtable ) {
- PL_HashTableRemove(oid2asi, asi->asi_oid);
+ if (using_tmp_ht){
+ ht = oid2asi_tmp;
+ } else {
+ ht = oid2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_oid);
}
if(name2asi) {
- PL_HashTableRemove(name2asi, asi->asi_name);
+ if (using_tmp_ht){
+ ht = name2asi_tmp;
+ } else {
+ ht = name2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_name);
if ( asi->asi_aliases != NULL ) {
for ( i = 0; asi->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableRemove(name2asi, asi->asi_aliases[i]);
+ PL_HashTableRemove(ht, asi->asi_aliases[i]);
}
}
if ( asi->asi_refcnt > 0 ) {
@@ -511,7 +580,7 @@ slapi_attr_syntax_normalize( const char *s )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, 0)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -535,7 +604,7 @@ slapi_attr_syntax_normalize_ext( char *s, int flags )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, flags)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -569,7 +638,7 @@ attr_syntax_exists(const char *attr_name)
check_attr_name = (char *)attr_name;
}
- asi = attr_syntax_get_by_name(check_attr_name);
+ asi = attr_syntax_get_by_name(check_attr_name, 0);
attr_syntax_return( asi );
if (free_attr) {
@@ -742,13 +811,13 @@ attr_syntax_get_plugin_by_name_with_default( const char *type )
/*
* first we look for this attribute type explictly
*/
- if ( (asi = attr_syntax_get_by_name(type)) == NULL ) {
+ if ( (asi = attr_syntax_get_by_name(type, 0)) == NULL ) {
/*
* no syntax for this type... return Octet String
* syntax. we accomplish this by looking up a well known
* attribute type that has that syntax.
*/
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if (asi == NULL)
asi = default_asi;
}
@@ -803,6 +872,20 @@ attr_syntax_insert(struct asyntaxinfo *asip )
}
static void
+attr_syntax_insert_tmp(struct asyntaxinfo *asip )
+{
+ /* Insert at top of list */
+ asip->asi_prev = NULL;
+ asip->asi_next = global_at_tmp;
+ if(global_at_tmp){
+ global_at_tmp->asi_prev = asip;
+ global_at_tmp = asip;
+ } else {
+ global_at_tmp = asip;
+ }
+}
+
+static void
attr_syntax_remove(struct asyntaxinfo *asip )
{
struct asyntaxinfo *prev, *next;
@@ -828,7 +911,7 @@ attr_syntax_remove(struct asyntaxinfo *asip )
* Returns an LDAP error code (LDAP_SUCCESS if all goes well).
*/
int
-attr_syntax_add( struct asyntaxinfo *asip )
+attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags )
{
int i, rc = LDAP_SUCCESS;
int nolock = asip->asi_flags & SLAPI_ATTR_FLAG_NOLOCKING;
@@ -840,7 +923,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* make sure the oid is unique */
if ( NULL != ( oldas_from_oid = attr_syntax_get_by_oid_locking_optional(
- asip->asi_oid, !nolock))) {
+ asip->asi_oid, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)) {
/* failure - OID is in use; no override flag */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -852,7 +935,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
* the primary name and OID point to the same schema definition.
*/
if ( NULL != ( oldas_from_name = attr_syntax_get_by_name_locking_optional(
- asip->asi_name, !nolock))) {
+ asip->asi_name, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)
|| ( oldas_from_oid != oldas_from_name )) {
/* failure; no override flag OR OID and name don't match */
@@ -860,7 +943,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
goto cleanup_and_return;
}
/* Flag for deletion. We are going to override this attr */
- attr_syntax_delete(oldas_from_name);
+ attr_syntax_delete(oldas_from_name, schema_flags);
} else if ( NULL != oldas_from_oid ) {
/* failure - OID is in use but name does not exist */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -874,11 +957,11 @@ attr_syntax_add( struct asyntaxinfo *asip )
if ( NULL != ( tmpasi =
attr_syntax_get_by_name_locking_optional(
- asip->asi_aliases[i], !nolock))) {
+ asip->asi_aliases[i], !nolock, schema_flags))) {
if (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE) {
/* Flag for tmpasi for deletion. It will be free'd
* when attr_syntax_return is called. */
- attr_syntax_delete(tmpasi);
+ attr_syntax_delete(tmpasi, schema_flags);
} else {
/* failure - one of the aliases is already in use */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -897,8 +980,8 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* ditto for the override one */
asip->asi_flags &= ~SLAPI_ATTR_FLAG_OVERRIDE;
- attr_syntax_add_by_oid( asip->asi_oid, asip, !nolock);
- attr_syntax_add_by_name( asip, !nolock);
+ attr_syntax_add_by_oid( asip->asi_oid, asip, schema_flags, !nolock);
+ attr_syntax_add_by_name( asip, schema_flags, !nolock);
cleanup_and_return:
attr_syntax_return_locking_optional( oldas_from_oid, !nolock );
@@ -1071,7 +1154,7 @@ slapi_attr_type2plugin( const char *type, void **pi )
int
slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oid = asi->asi_oid;
attr_syntax_return(asi);
@@ -1087,7 +1170,7 @@ slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
int
slapi_attr_get_oid_copy( const Slapi_Attr *a, char **oidp )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oidp = slapi_ch_strdup( asi->asi_oid );
attr_syntax_return(asi);
@@ -1144,7 +1227,7 @@ slapi_attr_is_dn_syntax_type(char *type)
int dn_syntax = 0; /* not DN, by default */
struct asyntaxinfo * asi;
- asi = attr_syntax_get_by_name(type);
+ asi = attr_syntax_get_by_name(type, 0);
if (asi && asi->asi_plugin) { /* If not set, there is no way to get the info */
if ((syntaxoid = asi->asi_plugin->plg_syntax_oid)) {
@@ -1323,7 +1406,7 @@ attr_syntax_delete_if_not_flagged(struct asyntaxinfo *asip, void *arg)
PR_ASSERT( fi != NULL );
if ( 0 == ( asip->asi_flags & fi->asef_flag )) {
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
} else {
return ATTR_SYNTAX_ENUM_NEXT;
@@ -1339,7 +1422,7 @@ attr_syntax_force_to_delete(struct asyntaxinfo *asip, void *arg)
fi = (struct attr_syntax_enum_flaginfo *)arg;
PR_ASSERT( fi != NULL );
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
}
@@ -1404,6 +1487,7 @@ attr_syntax_delete_all_for_schemareload(unsigned long flag)
#define ATTR_DEFAULT_SYNTAX_OID "1.1"
#define ATTR_DEFAULT_SYNTAX "defaultdirstringsyntax"
+
static int
attr_syntax_init(void)
{
@@ -1413,8 +1497,8 @@ attr_syntax_init(void)
if (!oid2asi)
{
oid2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( oid2asi_lock = slapi_new_rwlock())) {
if(oid2asi) PL_HashTableDestroy(oid2asi);
oid2asi = NULL;
@@ -1425,11 +1509,19 @@ attr_syntax_init(void)
}
}
+ if (!oid2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ oid2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
if (!name2asi)
{
name2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( name2asi_lock = slapi_new_rwlock())) {
if(name2asi) PL_HashTableDestroy(name2asi);
name2asi = NULL;
@@ -1441,10 +1533,18 @@ attr_syntax_init(void)
/* add a default syntax plugin as fallback, required during startup
*/
attr_syntax_create_default( ATTR_DEFAULT_SYNTAX,
- ATTR_DEFAULT_SYNTAX_OID,
- DIRSTRING_SYNTAX_OID,
- SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
+ ATTR_DEFAULT_SYNTAX_OID,
+ DIRSTRING_SYNTAX_OID,
+ SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
}
+ if (!name2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ name2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
return 0;
}
@@ -1510,7 +1610,7 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
&asip );
if ( rc == LDAP_SUCCESS ) {
- rc = attr_syntax_add( asip );
+ rc = attr_syntax_add( asip, 0 );
if ( rc == LDAP_SUCCESS ) {
if (attr_syntax_internal_asi_add_ht(asip)) {
slapi_log_error(SLAPI_LOG_FATAL,
@@ -1518,6 +1618,8 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
"Failed to stash internal asyntaxinfo: %s.\n",
asip->asi_name);
}
+ } else {
+ attr_syntax_free(asip);
}
}
@@ -1537,7 +1639,7 @@ attr_syntax_internal_asi_add(struct asyntaxinfo *asip, void *arg)
/* Copy is needed since when reloading the schema,
* existing syntax info is cleaned up. */
asip_copy = attr_syntax_dup(asip);
- rc = attr_syntax_add(asip_copy);
+ rc = attr_syntax_add(asip_copy, 0);
if (LDAP_SUCCESS != rc) {
attr_syntax_free(asip_copy);
}
@@ -1575,3 +1677,37 @@ attr_syntax_find(struct asyntaxinfo *at1, struct asyntaxinfo *at2)
return NULL;
}
+
+/*
+ * schema reload - now that we have loaded the schema into temporary
+ * hash tables and linked lists, swap out the old for the new. Then
+ * reload the internal attr syntaxes
+ */
+void
+attr_syntax_swap_ht()
+{
+ struct asyntaxinfo *next;
+
+ /* Remove the old hash tables */
+ PL_HashTableDestroy(name2asi);
+ PL_HashTableDestroy(oid2asi);
+
+ /* Free the global attr linked list */
+ while(global_at){
+ next = global_at->asi_next;
+ attr_syntax_free(global_at);
+ global_at = next;
+ }
+
+ /*
+ * Swap the hash table/linked list pointers, and set the
+ * temporary pointers to NULL
+ */
+ name2asi = name2asi_tmp;
+ name2asi_tmp = NULL;
+ oid2asi = oid2asi_tmp;
+ oid2asi_tmp = NULL;
+ global_at = global_at_tmp;
+ global_at_tmp = NULL;
+}
+
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index ebd4fdf..c8a5f8c 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -86,7 +86,7 @@ int op_shared_is_allowed_attr (const char *attr_name, int replicated_op)
* check to see if attribute is marked as one clients can't modify
*/
- asi = attr_syntax_get_by_name( attr_name );
+ asi = attr_syntax_get_by_name( attr_name, 0 );
if ( NULL != asi &&
0 != ( asi->asi_flags & SLAPI_ATTR_FLAG_NOUSERMOD )) {
/* this attribute is not allowed */
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index eb926c5..48188ed 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -118,7 +118,7 @@ void attr_syntax_write_lock(void);
void attr_syntax_unlock_read(void);
void attr_syntax_unlock_write(void);
int attr_syntax_exists (const char *attr_name);
-void attr_syntax_delete ( struct asyntaxinfo *asip );
+void attr_syntax_delete ( struct asyntaxinfo *asip, PRUint32 schema_flags );
#define SLAPI_SYNTAXLENGTH_NONE (-1) /* for syntaxlength parameter */
int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *attr_desc, const char *attr_superior,
@@ -126,18 +126,19 @@ int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *mr_substring, schemaext *extensions, const char *attr_syntax,
int syntaxlength, unsigned long flags, struct asyntaxinfo **asip );
void attr_syntax_free( struct asyntaxinfo *a );
-int attr_syntax_add( struct asyntaxinfo *asip );
+int attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags );
char *attr_syntax_normalize_no_lookup( const char *s );
char *attr_syntax_normalize_no_lookup_ext( char *s, int flags );
void attr_syntax_enumerate_attrs(AttrEnumFunc aef, void *arg, PRBool writelock);
void attr_syntax_all_clear_flag( unsigned long flag );
void attr_syntax_delete_all_not_flagged( unsigned long flag );
-struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid );
-struct asyntaxinfo *attr_syntax_get_by_name ( const char *name );
+struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid, PRUint32 schema_flags );
+struct asyntaxinfo *attr_syntax_get_by_name ( const char *name, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_by_name_with_default ( const char *name );
-struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock );
+struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_global_at();
struct asyntaxinfo *attr_syntax_find(struct asyntaxinfo *at1, struct asyntaxinfo *at2);
+void attr_syntax_swap_ht(void);
/*
* Call attr_syntax_return() when you are done using a value returned
* by attr_syntax_get_by_oid() or attr_syntax_get_by_name().
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 8744a6d..52f29c2 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2589,7 +2589,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
sscanf (attr_ldif, "%s name %s syntax %s",
psbAttrOid->buffer, psbAttrName->buffer, psbAttrSyntax->buffer);
- if ((a = attr_syntax_get_by_name ( psbAttrName->buffer)) != NULL ) {
+ if ((a = attr_syntax_get_by_name ( psbAttrName->buffer, 0 )) != NULL ) {
/* only modify attrs which were user defined */
if (a->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
@@ -2641,7 +2641,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
/* Delete it. */
- attr_syntax_delete( a );
+ attr_syntax_delete( a, 0 );
attr_syntax_return( a );
}
else {
@@ -2764,7 +2764,7 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
}
/* check to see if the oid is already in use by an attribute */
- if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid))) {
+ if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid, flags))) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
pnew_oc->oc_name,
"The OID \"%s\" is also used by the attribute type \"%s\"",
@@ -2883,7 +2883,7 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
* handle the various cases.
*/
if ( NULL == ( oldasip =
- attr_syntax_get_by_oid( newasip->asi_oid ))) {
+ attr_syntax_get_by_oid( newasip->asi_oid, 0 ))) {
/* new attribute type */
LDAPDebug( LDAP_DEBUG_TRACE, "schema_replace_attributes:"
" new type %s (OID %s)\n",
@@ -2901,14 +2901,14 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
" replacing type %s (OID %s)\n",
newasip->asi_name, newasip->asi_oid, 0 );
/* flag for deletion */
- attr_syntax_delete( oldasip );
+ attr_syntax_delete( oldasip, 0 );
}
attr_syntax_return( oldasip );
}
if ( NULL != newasip ) { /* add new or replacement definition */
- rc = attr_syntax_add( newasip );
+ rc = attr_syntax_add( newasip, 0 );
if ( LDAP_SUCCESS != rc ) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, newasip->asi_name,
@@ -3862,7 +3862,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (!status && (NULL != pSuperior)) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(pSuperior);
+ asi_parent = attr_syntax_get_by_name(pSuperior, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
LDAPDebug (LDAP_DEBUG_PARSE,
@@ -3963,7 +3963,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
struct asyntaxinfo *tmpasi;
if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
- ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid)))) {
+ ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use",
@@ -3985,7 +3985,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if ( NULL != asipp ) {
*asipp = tmpasip; /* just return it */
} else { /* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -4173,10 +4173,10 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (NULL != atype->at_sup_oid) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(atype->at_sup_oid);
+ asi_parent = attr_syntax_get_by_name(atype->at_sup_oid, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
- LDAPDebug (LDAP_DEBUG_PARSE, "Cannot find parent attribute type \"%s\"\n",
+ LDAPDebug (LDAP_DEBUG_ANY, "Cannot find parent attribute type \"%s\"\n",
atype->at_sup_oid, NULL, NULL);
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at, first_attr_name,
"Missing parent attribute syntax OID");
@@ -4342,7 +4342,7 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
/*
* Check if the OID is already being used
*/
- if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) && ( NULL != (tmpasi = attr_syntax_get_by_oid(atype->at_oid)))) {
+ if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) && ( NULL != (tmpasi = attr_syntax_get_by_oid(atype->at_oid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use", atype->at_oid);
@@ -4361,7 +4361,7 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
*asipp = tmpasip; /* just return it */
} else {
/* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -6054,9 +6054,13 @@ slapi_validate_schema_files(char *schemadir)
}
/*
- * API to reload the schema files.
- * Rule: this function is called when slapi_validate_schema_files is passed.
- * Schema checking is skipped in this function.
+ * Reload the schema files
+ *
+ * This is only called from the schema_reload task. The flag DSE_SCHEMA_LOCKED
+ * is also only set been called from this function. To not interrupt clients
+ * we will rebuild the schema in separate hash tables, and then swap the
+ * hash tables once the schema is completely reloaded. We use the DSE_SCHEMA_LOCKED
+ * flag to tell the attribute syntax functions to use the temporary hashtables.
*/
int
slapi_reload_schema_files(char *schemadir)
@@ -6074,14 +6078,21 @@ slapi_reload_schema_files(char *schemadir)
}
slapi_be_Wlock(be); /* be lock must be outer of schemafile lock */
reload_schemafile_lock();
- /* Exclude attr_syntax not to grab from the hash table while cleaning up */
- attr_syntax_write_lock();
- attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
oc_delete_all_nolock();
- attr_syntax_unlock_write();
rc = init_schema_dse_ext(schemadir, be, &my_pschemadse,
DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_LOCKED);
if (rc) {
+ /*
+ * The schema has been reloaded into the temporary hash tables.
+ * Take the write lock, wipe out the existing hash tables, and
+ * swap in the new ones.
+ */
+ attr_syntax_write_lock();
+ attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
+ attr_syntax_swap_ht();
+ attr_syntax_unlock_write();
+ slapi_reload_internal_attr_syntax();
+
dse_destroy(pschemadse);
pschemadse = my_pschemadse;
reload_schemafile_unlock();
1
0
dirsrvtests/tickets/ticket47973_test.py | 235 +++++++++++++++++
ldap/servers/plugins/schema_reload/schema_reload.c | 7
ldap/servers/slapd/attr.c | 8
ldap/servers/slapd/attrsyntax.c | 282 +++++++++++++++------
ldap/servers/slapd/opshared.c | 2
ldap/servers/slapd/proto-slap.h | 11
ldap/servers/slapd/schema.c | 51 ++-
7 files changed, 486 insertions(+), 110 deletions(-)
New commits:
commit e0c78e1c1db351ea5cf835cdb55437b1ea26a3a6
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Thu Jan 8 15:43:43 2015 -0500
Ticket 47973 - During schema reload sometimes the search returns no results
Bug Description: During a schema reload operation the search of an existing
entry may randomly report no results. This is because during
the schema reload all existing attribute syntaxes are removed,
and there is a small window where ldap operations can be performed
before the new schema is loaded. During this window, attribute
values are normalized to NULL which causes operation to unexpectedly
fail.
Fix Description: Instead of wiping out the existing attribute syntax hastables
in the middle of the task, instead load the new schema into
temporary hash tables. Once the reload is complete, then take
the asi write lock, remove the old hash tables, and swap in the
new ones.
https://fedorahosted.org/389/ticket/47973
valgrind: PASSED
Reviewed by: nhosoi(Thanks!)
diff --git a/dirsrvtests/tickets/ticket47973_test.py b/dirsrvtests/tickets/ticket47973_test.py
new file mode 100644
index 0000000..11b1ac8
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47973_test.py
@@ -0,0 +1,235 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+USER_DN = 'uid=user1,%s' % (DEFAULT_SUFFIX)
+SCHEMA_RELOAD_COUNT = 10
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def task_complete(conn, task_dn):
+ finished = False
+
+ try:
+ task_entry = conn.search_s(task_dn, ldap.SCOPE_BASE, 'objectclass=*')
+ if not task_entry:
+ log.fatal('wait_for_task: Search failed to find task: ' + task_dn)
+ assert False
+ if task_entry[0].hasAttr('nstaskexitcode'):
+ # task is done
+ finished = True
+ except ldap.LDAPError, e:
+ log.fatal('wait_for_task: Search failed: ' + e.message['desc'])
+ assert False
+
+ return finished
+
+
+def test_ticket47973(topology):
+ """
+ During the schema reload task there is a small window where the new schema is not loaded
+ into the asi hashtables - this results in searches not returning entries.
+ """
+
+ log.info('Testing Ticket 47973 - Test the searches still work as expected during schema reload tasks')
+
+ #
+ # Add a user
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Run a series of schema_reload tasks while searching for our user. Since
+ # this is a race condition, run it several times.
+ #
+ task_count = 0
+ while task_count < SCHEMA_RELOAD_COUNT:
+ #
+ # Add a schema reload task
+ #
+
+ TASK_DN = 'cn=task-' + str(task_count) + ',cn=schema reload task, cn=tasks, cn=config'
+ try:
+ topology.standalone.add_s(Entry((TASK_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'cn': 'task-' + str(task_count)
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add task entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # While we wait for the task to complete keep searching for our user
+ #
+ search_count = 0
+ while search_count < 100:
+ #
+ # Now check the user is still being returned
+ #
+ try:
+ entries = topology.standalone.search_s(DEFAULT_SUFFIX,
+ ldap.SCOPE_SUBTREE,
+ '(uid=user1)')
+ if not entries or not entries[0]:
+ log.fatal('User was not returned from search!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Check if task is complete
+ #
+ if task_complete(topology.standalone, TASK_DN):
+ break
+
+ search_count += 1
+
+ task_count += 1
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47973_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47973(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/schema_reload/schema_reload.c b/ldap/servers/plugins/schema_reload/schema_reload.c
index b1a5bb8..bb16d08 100644
--- a/ldap/servers/plugins/schema_reload/schema_reload.c
+++ b/ldap/servers/plugins/schema_reload/schema_reload.c
@@ -187,13 +187,6 @@ schemareload_thread(void *arg)
slapi_task_log_notice(task, "Schema reload task finished.");
slapi_task_log_status(task, "Schema reload task finished.");
slapi_log_error(SLAPI_LOG_FATAL, "schemareload", "Schema reload task finished.\n");
-
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema.\n");
- rv = slapi_reload_internal_attr_syntax();
- slapi_log_error(SLAPI_LOG_FATAL, "schemareload",
- "Register internal schema finished.\n");
-
} else {
slapi_task_log_notice(task, "Schema reload task failed.");
slapi_task_log_status(task, "Schema reload task failed.");
diff --git a/ldap/servers/slapd/attr.c b/ldap/servers/slapd/attr.c
index a4cf6cb..f19e7e6 100644
--- a/ldap/servers/slapd/attr.c
+++ b/ldap/servers/slapd/attr.c
@@ -245,8 +245,8 @@ slapi_attr_types_equivalent(const char *t1, const char *t2)
return 0;
}
- asi1 = attr_syntax_get_by_name(t1);
- asi2 = attr_syntax_get_by_name(t2);
+ asi1 = attr_syntax_get_by_name(t1, 0);
+ asi2 = attr_syntax_get_by_name(t2, 0);
if (NULL != asi1) {
if (NULL != asi2) {
/* Both found - compare normalized names */
@@ -347,7 +347,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
{
basetype = tmp; /* basetype was malloc'd */
}
- asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock);
+ asi = attr_syntax_get_by_name_locking_optional(basetype, use_lock, 0);
}
if(NULL == asi)
{
@@ -358,7 +358,7 @@ slapi_attr_init_locking_optional(Slapi_Attr *a, const char *type, PRBool use_loc
* attribute type that has that syntax.
*/
asi = attr_syntax_get_by_name_locking_optional(
- ATTR_WITH_OCTETSTRING_SYNTAX, use_lock);
+ ATTR_WITH_OCTETSTRING_SYNTAX, use_lock, 0);
}
else
{
diff --git a/ldap/servers/slapd/attrsyntax.c b/ldap/servers/slapd/attrsyntax.c
index 885d02a..d93a807 100644
--- a/ldap/servers/slapd/attrsyntax.c
+++ b/ldap/servers/slapd/attrsyntax.c
@@ -70,8 +70,15 @@ static asyntaxinfo *global_at = NULL;
static PLHashTable *name2asi = NULL;
/* read/write lock to protect table */
static Slapi_RWLock *name2asi_lock = NULL;
-static int asi_locking = 1;
+/*
+ * For the schema reload task, we need to use separate temporary hashtables & linked lists
+ */
+static PLHashTable *oid2asi_tmp = NULL;
+static PLHashTable *name2asi_tmp = NULL;
+static asyntaxinfo *global_at_tmp = NULL;
+
+static int asi_locking = 1;
#define AS_LOCK_READ(l) if (asi_locking) { slapi_rwlock_rdlock(l); }
#define AS_LOCK_WRITE(l) if (asi_locking) { slapi_rwlock_wrlock(l); }
#define AS_UNLOCK_READ(l) if (asi_locking) { slapi_rwlock_unlock(l); }
@@ -82,10 +89,11 @@ static struct asyntaxinfo *default_asi = NULL;
static void *attr_syntax_get_plugin_by_name_with_default( const char *type );
static void attr_syntax_delete_no_lock( struct asyntaxinfo *asip,
- PRBool remove_from_oid_table );
+ PRBool remove_from_oid_table, PRUint32 schema_flags );
static struct asyntaxinfo *attr_syntax_get_by_oid_locking_optional( const
- char *oid, PRBool use_lock);
+ char *oid, PRBool use_lock, PRUint32 schema_flags);
static void attr_syntax_insert( struct asyntaxinfo *asip );
+static void attr_syntax_insert_tmp( struct asyntaxinfo *asip );
static void attr_syntax_remove( struct asyntaxinfo *asip );
#ifdef ATTR_LDAP_DEBUG
@@ -210,8 +218,6 @@ attr_syntax_check_oids()
void
attr_syntax_free( struct asyntaxinfo *a )
{
- PR_ASSERT( a->asi_refcnt == 0 );
-
cool_charray_free( a->asi_aliases );
slapi_ch_free_string(&a->asi_name );
slapi_ch_free_string(&a->asi_desc );
@@ -241,9 +247,9 @@ attr_syntax_new()
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_oid(const char *oid)
+attr_syntax_get_by_oid(const char *oid, PRUint32 schema_flags)
{
- return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE);
+ return attr_syntax_get_by_oid_locking_optional( oid, PR_TRUE, schema_flags);
}
@@ -256,15 +262,30 @@ attr_syntax_get_by_oid(const char *oid)
* same use_lock parameter.
*/
static struct asyntaxinfo *
-attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
+attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock, PRUint32 schema_flags )
{
struct asyntaxinfo *asi = 0;
- if (oid2asi)
+ PLHashTable *ht = oid2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = oid2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(oid2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(oid2asi, oid);
+ if (!using_tmp_ht){
+ /*
+ * The oid2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = oid2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, oid);
if (asi)
{
PR_AtomicIncrement( &asi->asi_refcnt );
@@ -285,18 +306,22 @@ attr_syntax_get_by_oid_locking_optional( const char *oid, PRBool use_lock )
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(oid2asi_lock);
- }
+ if(schema_flags & DSE_SCHEMA_LOCKED){
+ PL_HashTableAdd(oid2asi_tmp, oid, a);
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(oid2asi_lock);
+ }
- PL_HashTableAdd(oid2asi, oid, a);
+ PL_HashTableAdd(oid2asi, oid, a);
- if (lock) {
- AS_UNLOCK_WRITE(oid2asi_lock);
+ if (lock) {
+ AS_UNLOCK_WRITE(oid2asi_lock);
+ }
}
}
@@ -309,18 +334,18 @@ attr_syntax_add_by_oid(const char *oid, struct asyntaxinfo *a, int lock)
* be returned by calling to attr_syntax_return().
*/
struct asyntaxinfo *
-attr_syntax_get_by_name(const char *name)
+attr_syntax_get_by_name(const char *name, PRUint32 schema_flags)
{
- return attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ return attr_syntax_get_by_name_locking_optional(name, PR_TRUE, schema_flags);
}
struct asyntaxinfo *
attr_syntax_get_by_name_with_default(const char *name)
{
struct asyntaxinfo *asi = NULL;
- asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE);
+ asi = attr_syntax_get_by_name_locking_optional(name, PR_TRUE, 0);
if (asi == NULL)
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if ( asi == NULL )
asi = default_asi;
return asi;
@@ -335,15 +360,30 @@ struct asyntaxinfo *asi = NULL;
* same use_lock parameter.
*/
struct asyntaxinfo *
-attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
+attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock, PRUint32 schema_flags)
{
struct asyntaxinfo *asi = 0;
- if (name2asi)
+ PLHashTable *ht = name2asi;
+ int using_tmp_ht = 0;
+
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ ht = name2asi_tmp;
+ using_tmp_ht = 1;
+ use_lock = 0;
+ }
+ if (ht)
{
if ( use_lock ) {
AS_LOCK_READ(name2asi_lock);
}
- asi = (struct asyntaxinfo *)PL_HashTableLookup_const(name2asi, name);
+ if(!using_tmp_ht){
+ /*
+ * The name2asi pointer could have been rewritten by the schema_reload task
+ * while waiting on the lock, so grab it again.
+ */
+ ht = name2asi;
+ }
+ asi = (struct asyntaxinfo *)PL_HashTableLookup_const(ht, name);
if ( NULL != asi ) {
PR_AtomicIncrement( &asi->asi_refcnt );
}
@@ -352,7 +392,7 @@ attr_syntax_get_by_name_locking_optional(const char *name, PRBool use_lock)
}
}
if (!asi) /* given name may be an OID */
- asi = attr_syntax_get_by_oid_locking_optional(name, use_lock);
+ asi = attr_syntax_get_by_oid_locking_optional(name, use_lock, schema_flags);
return asi;
}
@@ -416,29 +456,43 @@ attr_syntax_return_locking_optional(struct asyntaxinfo *asi, PRBool use_lock)
* to worry about resource contention.
*/
static void
-attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
+attr_syntax_add_by_name(struct asyntaxinfo *a, PRUint32 schema_flags, int lock)
{
if (0 != attr_syntax_init()) return;
- if (lock) {
- AS_LOCK_WRITE(name2asi_lock);
- }
+ if (schema_flags & DSE_SCHEMA_LOCKED ){
+ /* insert the attr into the temp global linked list */
+ attr_syntax_insert_tmp(a);
+
+ PL_HashTableAdd(name2asi_tmp, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
+
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi_tmp, a->asi_aliases[i], a);
+ }
+ }
+ } else {
+ if (lock) {
+ AS_LOCK_WRITE(name2asi_lock);
+ }
+ /* insert the attr into the global linked list */
+ attr_syntax_insert(a);
- /* insert the attr into the global linked list */
- attr_syntax_insert(a);
+ PL_HashTableAdd(name2asi, a->asi_name, a);
+ if ( a->asi_aliases != NULL ) {
+ int i;
- PL_HashTableAdd(name2asi, a->asi_name, a);
- if ( a->asi_aliases != NULL ) {
- int i;
+ for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
+ PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ }
+ }
- for ( i = 0; a->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableAdd(name2asi, a->asi_aliases[i], a);
+ if (lock) {
+ AS_UNLOCK_WRITE(name2asi_lock);
}
}
- if (lock) {
- AS_UNLOCK_WRITE(name2asi_lock);
- }
}
@@ -447,7 +501,7 @@ attr_syntax_add_by_name(struct asyntaxinfo *a, int lock)
* and oids.
*/
void
-attr_syntax_delete( struct asyntaxinfo *asi )
+attr_syntax_delete( struct asyntaxinfo *asi, PRUint32 schema_flags )
{
PR_ASSERT( asi );
@@ -455,7 +509,7 @@ attr_syntax_delete( struct asyntaxinfo *asi )
AS_LOCK_WRITE(oid2asi_lock);
AS_LOCK_WRITE(name2asi_lock);
- attr_syntax_delete_no_lock( asi, PR_TRUE );
+ attr_syntax_delete_no_lock( asi, PR_TRUE, schema_flags );
AS_UNLOCK_WRITE(name2asi_lock);
AS_UNLOCK_WRITE(oid2asi_lock);
@@ -469,19 +523,34 @@ attr_syntax_delete( struct asyntaxinfo *asi )
*/
static void
attr_syntax_delete_no_lock( struct asyntaxinfo *asi,
- PRBool remove_from_oidtable )
+ PRBool remove_from_oidtable, PRUint32 schema_flags )
{
- int i;
+ PLHashTable *ht = NULL;
+ int using_tmp_ht = 0;
+ int i;
+ if (schema_flags & DSE_SCHEMA_LOCKED){
+ using_tmp_ht = 1;
+ }
if (oid2asi && remove_from_oidtable ) {
- PL_HashTableRemove(oid2asi, asi->asi_oid);
+ if (using_tmp_ht){
+ ht = oid2asi_tmp;
+ } else {
+ ht = oid2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_oid);
}
if(name2asi) {
- PL_HashTableRemove(name2asi, asi->asi_name);
+ if (using_tmp_ht){
+ ht = name2asi_tmp;
+ } else {
+ ht = name2asi;
+ }
+ PL_HashTableRemove(ht, asi->asi_name);
if ( asi->asi_aliases != NULL ) {
for ( i = 0; asi->asi_aliases[i] != NULL; ++i ) {
- PL_HashTableRemove(name2asi, asi->asi_aliases[i]);
+ PL_HashTableRemove(ht, asi->asi_aliases[i]);
}
}
if ( asi->asi_refcnt > 0 ) {
@@ -511,7 +580,7 @@ slapi_attr_syntax_normalize( const char *s )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, 0)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -535,7 +604,7 @@ slapi_attr_syntax_normalize_ext( char *s, int flags )
struct asyntaxinfo *asi = NULL;
char *r = NULL;
- if((asi=attr_syntax_get_by_name(s)) != NULL ) {
+ if((asi=attr_syntax_get_by_name(s, flags)) != NULL ) {
r = slapi_ch_strdup(asi->asi_name);
attr_syntax_return( asi );
}
@@ -569,7 +638,7 @@ attr_syntax_exists(const char *attr_name)
check_attr_name = (char *)attr_name;
}
- asi = attr_syntax_get_by_name(check_attr_name);
+ asi = attr_syntax_get_by_name(check_attr_name, 0);
attr_syntax_return( asi );
if (free_attr) {
@@ -742,13 +811,13 @@ attr_syntax_get_plugin_by_name_with_default( const char *type )
/*
* first we look for this attribute type explictly
*/
- if ( (asi = attr_syntax_get_by_name(type)) == NULL ) {
+ if ( (asi = attr_syntax_get_by_name(type, 0)) == NULL ) {
/*
* no syntax for this type... return Octet String
* syntax. we accomplish this by looking up a well known
* attribute type that has that syntax.
*/
- asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX);
+ asi = attr_syntax_get_by_name(ATTR_WITH_OCTETSTRING_SYNTAX, 0);
if (asi == NULL)
asi = default_asi;
}
@@ -803,6 +872,20 @@ attr_syntax_insert(struct asyntaxinfo *asip )
}
static void
+attr_syntax_insert_tmp(struct asyntaxinfo *asip )
+{
+ /* Insert at top of list */
+ asip->asi_prev = NULL;
+ asip->asi_next = global_at_tmp;
+ if(global_at_tmp){
+ global_at_tmp->asi_prev = asip;
+ global_at_tmp = asip;
+ } else {
+ global_at_tmp = asip;
+ }
+}
+
+static void
attr_syntax_remove(struct asyntaxinfo *asip )
{
struct asyntaxinfo *prev, *next;
@@ -828,7 +911,7 @@ attr_syntax_remove(struct asyntaxinfo *asip )
* Returns an LDAP error code (LDAP_SUCCESS if all goes well).
*/
int
-attr_syntax_add( struct asyntaxinfo *asip )
+attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags )
{
int i, rc = LDAP_SUCCESS;
int nolock = asip->asi_flags & SLAPI_ATTR_FLAG_NOLOCKING;
@@ -840,7 +923,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* make sure the oid is unique */
if ( NULL != ( oldas_from_oid = attr_syntax_get_by_oid_locking_optional(
- asip->asi_oid, !nolock))) {
+ asip->asi_oid, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)) {
/* failure - OID is in use; no override flag */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -852,7 +935,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
* the primary name and OID point to the same schema definition.
*/
if ( NULL != ( oldas_from_name = attr_syntax_get_by_name_locking_optional(
- asip->asi_name, !nolock))) {
+ asip->asi_name, !nolock, schema_flags))) {
if ( 0 == (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE)
|| ( oldas_from_oid != oldas_from_name )) {
/* failure; no override flag OR OID and name don't match */
@@ -860,7 +943,7 @@ attr_syntax_add( struct asyntaxinfo *asip )
goto cleanup_and_return;
}
/* Flag for deletion. We are going to override this attr */
- attr_syntax_delete(oldas_from_name);
+ attr_syntax_delete(oldas_from_name, schema_flags);
} else if ( NULL != oldas_from_oid ) {
/* failure - OID is in use but name does not exist */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -874,11 +957,11 @@ attr_syntax_add( struct asyntaxinfo *asip )
if ( NULL != ( tmpasi =
attr_syntax_get_by_name_locking_optional(
- asip->asi_aliases[i], !nolock))) {
+ asip->asi_aliases[i], !nolock, schema_flags))) {
if (asip->asi_flags & SLAPI_ATTR_FLAG_OVERRIDE) {
/* Flag for tmpasi for deletion. It will be free'd
* when attr_syntax_return is called. */
- attr_syntax_delete(tmpasi);
+ attr_syntax_delete(tmpasi, schema_flags);
} else {
/* failure - one of the aliases is already in use */
rc = LDAP_TYPE_OR_VALUE_EXISTS;
@@ -897,8 +980,8 @@ attr_syntax_add( struct asyntaxinfo *asip )
/* ditto for the override one */
asip->asi_flags &= ~SLAPI_ATTR_FLAG_OVERRIDE;
- attr_syntax_add_by_oid( asip->asi_oid, asip, !nolock);
- attr_syntax_add_by_name( asip, !nolock);
+ attr_syntax_add_by_oid( asip->asi_oid, asip, schema_flags, !nolock);
+ attr_syntax_add_by_name( asip, schema_flags, !nolock);
cleanup_and_return:
attr_syntax_return_locking_optional( oldas_from_oid, !nolock );
@@ -1071,7 +1154,7 @@ slapi_attr_type2plugin( const char *type, void **pi )
int
slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oid = asi->asi_oid;
attr_syntax_return(asi);
@@ -1087,7 +1170,7 @@ slapi_attr_get_oid( const Slapi_Attr *a, char **oid )
int
slapi_attr_get_oid_copy( const Slapi_Attr *a, char **oidp )
{
- struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type);
+ struct asyntaxinfo *asi = attr_syntax_get_by_name(a->a_type, 0);
if (asi) {
*oidp = slapi_ch_strdup( asi->asi_oid );
attr_syntax_return(asi);
@@ -1144,7 +1227,7 @@ slapi_attr_is_dn_syntax_type(char *type)
int dn_syntax = 0; /* not DN, by default */
struct asyntaxinfo * asi;
- asi = attr_syntax_get_by_name(type);
+ asi = attr_syntax_get_by_name(type, 0);
if (asi && asi->asi_plugin) { /* If not set, there is no way to get the info */
if ((syntaxoid = asi->asi_plugin->plg_syntax_oid)) {
@@ -1323,7 +1406,7 @@ attr_syntax_delete_if_not_flagged(struct asyntaxinfo *asip, void *arg)
PR_ASSERT( fi != NULL );
if ( 0 == ( asip->asi_flags & fi->asef_flag )) {
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
} else {
return ATTR_SYNTAX_ENUM_NEXT;
@@ -1339,7 +1422,7 @@ attr_syntax_force_to_delete(struct asyntaxinfo *asip, void *arg)
fi = (struct attr_syntax_enum_flaginfo *)arg;
PR_ASSERT( fi != NULL );
- attr_syntax_delete_no_lock( asip, PR_FALSE );
+ attr_syntax_delete_no_lock( asip, PR_FALSE, 0 );
return ATTR_SYNTAX_ENUM_REMOVE;
}
@@ -1404,6 +1487,7 @@ attr_syntax_delete_all_for_schemareload(unsigned long flag)
#define ATTR_DEFAULT_SYNTAX_OID "1.1"
#define ATTR_DEFAULT_SYNTAX "defaultdirstringsyntax"
+
static int
attr_syntax_init(void)
{
@@ -1413,8 +1497,8 @@ attr_syntax_init(void)
if (!oid2asi)
{
oid2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( oid2asi_lock = slapi_new_rwlock())) {
if(oid2asi) PL_HashTableDestroy(oid2asi);
oid2asi = NULL;
@@ -1425,11 +1509,19 @@ attr_syntax_init(void)
}
}
+ if (!oid2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ oid2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
if (!name2asi)
{
name2asi = PL_NewHashTable(2047, hashNocaseString,
- hashNocaseCompare,
- PL_CompareValues, 0, 0);
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
if ( asi_locking && NULL == ( name2asi_lock = slapi_new_rwlock())) {
if(name2asi) PL_HashTableDestroy(name2asi);
name2asi = NULL;
@@ -1441,10 +1533,18 @@ attr_syntax_init(void)
/* add a default syntax plugin as fallback, required during startup
*/
attr_syntax_create_default( ATTR_DEFAULT_SYNTAX,
- ATTR_DEFAULT_SYNTAX_OID,
- DIRSTRING_SYNTAX_OID,
- SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
+ ATTR_DEFAULT_SYNTAX_OID,
+ DIRSTRING_SYNTAX_OID,
+ SLAPI_ATTR_FLAG_NOUSERMOD| SLAPI_ATTR_FLAG_NOEXPOSE);
}
+ if (!name2asi_tmp)
+ {
+ /* temporary hash table for schema reload */
+ name2asi_tmp = PL_NewHashTable(2047, hashNocaseString,
+ hashNocaseCompare,
+ PL_CompareValues, 0, 0);
+ }
+
return 0;
}
@@ -1510,7 +1610,7 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
&asip );
if ( rc == LDAP_SUCCESS ) {
- rc = attr_syntax_add( asip );
+ rc = attr_syntax_add( asip, 0 );
if ( rc == LDAP_SUCCESS ) {
if (attr_syntax_internal_asi_add_ht(asip)) {
slapi_log_error(SLAPI_LOG_FATAL,
@@ -1518,6 +1618,8 @@ slapi_add_internal_attr_syntax( const char *name, const char *oid,
"Failed to stash internal asyntaxinfo: %s.\n",
asip->asi_name);
}
+ } else {
+ attr_syntax_free(asip);
}
}
@@ -1537,7 +1639,7 @@ attr_syntax_internal_asi_add(struct asyntaxinfo *asip, void *arg)
/* Copy is needed since when reloading the schema,
* existing syntax info is cleaned up. */
asip_copy = attr_syntax_dup(asip);
- rc = attr_syntax_add(asip_copy);
+ rc = attr_syntax_add(asip_copy, 0);
if (LDAP_SUCCESS != rc) {
attr_syntax_free(asip_copy);
}
@@ -1575,3 +1677,37 @@ attr_syntax_find(struct asyntaxinfo *at1, struct asyntaxinfo *at2)
return NULL;
}
+
+/*
+ * schema reload - now that we have loaded the schema into temporary
+ * hash tables and linked lists, swap out the old for the new. Then
+ * reload the internal attr syntaxes
+ */
+void
+attr_syntax_swap_ht()
+{
+ struct asyntaxinfo *next;
+
+ /* Remove the old hash tables */
+ PL_HashTableDestroy(name2asi);
+ PL_HashTableDestroy(oid2asi);
+
+ /* Free the global attr linked list */
+ while(global_at){
+ next = global_at->asi_next;
+ attr_syntax_free(global_at);
+ global_at = next;
+ }
+
+ /*
+ * Swap the hash table/linked list pointers, and set the
+ * temporary pointers to NULL
+ */
+ name2asi = name2asi_tmp;
+ name2asi_tmp = NULL;
+ oid2asi = oid2asi_tmp;
+ oid2asi_tmp = NULL;
+ global_at = global_at_tmp;
+ global_at_tmp = NULL;
+}
+
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index ebd4fdf..c8a5f8c 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -86,7 +86,7 @@ int op_shared_is_allowed_attr (const char *attr_name, int replicated_op)
* check to see if attribute is marked as one clients can't modify
*/
- asi = attr_syntax_get_by_name( attr_name );
+ asi = attr_syntax_get_by_name( attr_name, 0 );
if ( NULL != asi &&
0 != ( asi->asi_flags & SLAPI_ATTR_FLAG_NOUSERMOD )) {
/* this attribute is not allowed */
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index eb926c5..48188ed 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -118,7 +118,7 @@ void attr_syntax_write_lock(void);
void attr_syntax_unlock_read(void);
void attr_syntax_unlock_write(void);
int attr_syntax_exists (const char *attr_name);
-void attr_syntax_delete ( struct asyntaxinfo *asip );
+void attr_syntax_delete ( struct asyntaxinfo *asip, PRUint32 schema_flags );
#define SLAPI_SYNTAXLENGTH_NONE (-1) /* for syntaxlength parameter */
int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *attr_desc, const char *attr_superior,
@@ -126,18 +126,19 @@ int attr_syntax_create( const char *attr_oid, char *const*attr_names,
const char *mr_substring, schemaext *extensions, const char *attr_syntax,
int syntaxlength, unsigned long flags, struct asyntaxinfo **asip );
void attr_syntax_free( struct asyntaxinfo *a );
-int attr_syntax_add( struct asyntaxinfo *asip );
+int attr_syntax_add( struct asyntaxinfo *asip, PRUint32 schema_flags );
char *attr_syntax_normalize_no_lookup( const char *s );
char *attr_syntax_normalize_no_lookup_ext( char *s, int flags );
void attr_syntax_enumerate_attrs(AttrEnumFunc aef, void *arg, PRBool writelock);
void attr_syntax_all_clear_flag( unsigned long flag );
void attr_syntax_delete_all_not_flagged( unsigned long flag );
-struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid );
-struct asyntaxinfo *attr_syntax_get_by_name ( const char *name );
+struct asyntaxinfo *attr_syntax_get_by_oid ( const char *oid, PRUint32 schema_flags );
+struct asyntaxinfo *attr_syntax_get_by_name ( const char *name, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_by_name_with_default ( const char *name );
-struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock );
+struct asyntaxinfo *attr_syntax_get_by_name_locking_optional ( const char *name, PRBool use_lock, PRUint32 schema_flags );
struct asyntaxinfo *attr_syntax_get_global_at();
struct asyntaxinfo *attr_syntax_find(struct asyntaxinfo *at1, struct asyntaxinfo *at2);
+void attr_syntax_swap_ht(void);
/*
* Call attr_syntax_return() when you are done using a value returned
* by attr_syntax_get_by_oid() or attr_syntax_get_by_name().
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index 8744a6d..52f29c2 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -2589,7 +2589,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
sscanf (attr_ldif, "%s name %s syntax %s",
psbAttrOid->buffer, psbAttrName->buffer, psbAttrSyntax->buffer);
- if ((a = attr_syntax_get_by_name ( psbAttrName->buffer)) != NULL ) {
+ if ((a = attr_syntax_get_by_name ( psbAttrName->buffer, 0 )) != NULL ) {
/* only modify attrs which were user defined */
if (a->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at,
@@ -2641,7 +2641,7 @@ schema_delete_attributes ( Slapi_Entry *entryBefore, LDAPMod *mod,
}
/* Delete it. */
- attr_syntax_delete( a );
+ attr_syntax_delete( a, 0 );
attr_syntax_return( a );
}
else {
@@ -2764,7 +2764,7 @@ add_oc_internal(struct objclass *pnew_oc, char *errorbuf, size_t errorbufsize,
}
/* check to see if the oid is already in use by an attribute */
- if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid))) {
+ if (!rc && (pasyntaxinfo = attr_syntax_get_by_oid(pnew_oc->oc_oid, flags))) {
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_oc,
pnew_oc->oc_name,
"The OID \"%s\" is also used by the attribute type \"%s\"",
@@ -2883,7 +2883,7 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
* handle the various cases.
*/
if ( NULL == ( oldasip =
- attr_syntax_get_by_oid( newasip->asi_oid ))) {
+ attr_syntax_get_by_oid( newasip->asi_oid, 0 ))) {
/* new attribute type */
LDAPDebug( LDAP_DEBUG_TRACE, "schema_replace_attributes:"
" new type %s (OID %s)\n",
@@ -2901,14 +2901,14 @@ schema_replace_attributes ( Slapi_PBlock *pb, LDAPMod *mod, char *errorbuf,
" replacing type %s (OID %s)\n",
newasip->asi_name, newasip->asi_oid, 0 );
/* flag for deletion */
- attr_syntax_delete( oldasip );
+ attr_syntax_delete( oldasip, 0 );
}
attr_syntax_return( oldasip );
}
if ( NULL != newasip ) { /* add new or replacement definition */
- rc = attr_syntax_add( newasip );
+ rc = attr_syntax_add( newasip, 0 );
if ( LDAP_SUCCESS != rc ) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, newasip->asi_name,
@@ -3862,7 +3862,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (!status && (NULL != pSuperior)) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(pSuperior);
+ asi_parent = attr_syntax_get_by_name(pSuperior, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
LDAPDebug (LDAP_DEBUG_PARSE,
@@ -3963,7 +3963,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
struct asyntaxinfo *tmpasi;
if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
- ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid)))) {
+ ( NULL != ( tmpasi = attr_syntax_get_by_oid(pOid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use",
@@ -3985,7 +3985,7 @@ read_at_ldif(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if ( NULL != asipp ) {
*asipp = tmpasip; /* just return it */
} else { /* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -4173,10 +4173,10 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
if (NULL != atype->at_sup_oid) {
struct asyntaxinfo *asi_parent;
- asi_parent = attr_syntax_get_by_name(atype->at_sup_oid);
+ asi_parent = attr_syntax_get_by_name(atype->at_sup_oid, schema_flags);
/* if we find no match then server won't start or add the attribute type */
if (asi_parent == NULL) {
- LDAPDebug (LDAP_DEBUG_PARSE, "Cannot find parent attribute type \"%s\"\n",
+ LDAPDebug (LDAP_DEBUG_ANY, "Cannot find parent attribute type \"%s\"\n",
atype->at_sup_oid, NULL, NULL);
schema_create_errormsg( errorbuf, errorbufsize, schema_errprefix_at, first_attr_name,
"Missing parent attribute syntax OID");
@@ -4342,7 +4342,7 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
/*
* Check if the OID is already being used
*/
- if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) && ( NULL != (tmpasi = attr_syntax_get_by_oid(atype->at_oid)))) {
+ if (!(flags & SLAPI_ATTR_FLAG_OVERRIDE) && ( NULL != (tmpasi = attr_syntax_get_by_oid(atype->at_oid, schema_flags)))) {
schema_create_errormsg( errorbuf, errorbufsize,
schema_errprefix_at, first_attr_name,
"Could not be added because the OID \"%s\" is already in use", atype->at_oid);
@@ -4361,7 +4361,7 @@ parse_attr_str(const char *input, struct asyntaxinfo **asipp, char *errorbuf,
*asipp = tmpasip; /* just return it */
} else {
/* add the new attribute to the global store */
- status = attr_syntax_add( tmpasip );
+ status = attr_syntax_add( tmpasip, schema_flags );
if ( LDAP_SUCCESS != status ) {
if ( 0 != (flags & SLAPI_ATTR_FLAG_OVERRIDE) &&
LDAP_TYPE_OR_VALUE_EXISTS == status ) {
@@ -6054,9 +6054,13 @@ slapi_validate_schema_files(char *schemadir)
}
/*
- * API to reload the schema files.
- * Rule: this function is called when slapi_validate_schema_files is passed.
- * Schema checking is skipped in this function.
+ * Reload the schema files
+ *
+ * This is only called from the schema_reload task. The flag DSE_SCHEMA_LOCKED
+ * is also only set been called from this function. To not interrupt clients
+ * we will rebuild the schema in separate hash tables, and then swap the
+ * hash tables once the schema is completely reloaded. We use the DSE_SCHEMA_LOCKED
+ * flag to tell the attribute syntax functions to use the temporary hashtables.
*/
int
slapi_reload_schema_files(char *schemadir)
@@ -6074,14 +6078,21 @@ slapi_reload_schema_files(char *schemadir)
}
slapi_be_Wlock(be); /* be lock must be outer of schemafile lock */
reload_schemafile_lock();
- /* Exclude attr_syntax not to grab from the hash table while cleaning up */
- attr_syntax_write_lock();
- attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
oc_delete_all_nolock();
- attr_syntax_unlock_write();
rc = init_schema_dse_ext(schemadir, be, &my_pschemadse,
DSE_SCHEMA_NO_CHECK | DSE_SCHEMA_LOCKED);
if (rc) {
+ /*
+ * The schema has been reloaded into the temporary hash tables.
+ * Take the write lock, wipe out the existing hash tables, and
+ * swap in the new ones.
+ */
+ attr_syntax_write_lock();
+ attr_syntax_delete_all_for_schemareload(SLAPI_ATTR_FLAG_KEEP);
+ attr_syntax_swap_ht();
+ attr_syntax_unlock_write();
+ slapi_reload_internal_attr_syntax();
+
dse_destroy(pschemadse);
pschemadse = my_pschemadse;
reload_schemafile_unlock();
1
0
ldap/servers/slapd/back-ldbm/ldbm_usn.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
New commits:
commit 4b7184c823da5117ddb1deb04bf1ef47eb9019e2
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Jan 27 15:15:01 2014 -0800
Ticket #47659 - ldbm_usn_init: Valgrind reports Invalid read / SIGSEGV
Bug description: A suffix mapping tree could exist without the corresponding
backend. The existing code did not properly check the backend returned from
slapi_mapping_tree_find_backend_for_sdn. When NULL backend is returned, it
triggers the NULL pointer dereference.
Fix description: This patch added a NULL backend check to usn_get_last_usn,
and moved a logging to the if clause where the backend is not NULL.
https://fedorahosted.org/389/ticket/47659
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit a6f66e7fcbd5d17d975cc2ac65806d7c64571254)
(cherry picked from commit 6ad2397fa5d1319840d66f9ec47dfdd7bde8f129)
(cherry picked from commit 412ec0e9c8367f2d1c446237cb2bc27791ea8e6c)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_usn.c b/ldap/servers/slapd/back-ldbm/ldbm_usn.c
index 7c11a68..1ca16b1 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_usn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_usn.c
@@ -80,10 +80,11 @@ ldbm_usn_init(struct ldbminfo *li)
for ( sdn = slapi_get_first_suffix( &node, 0 ); sdn != NULL;
sdn = slapi_get_next_suffix_ext( &node, 0 )) {
be = slapi_mapping_tree_find_backend_for_sdn(sdn);
- slapi_log_error(SLAPI_LOG_BACKLDBM, "ldbm_usn_init",
- "backend: %s%s\n", be->be_name, isglobal?" (global mode)":"");
rc = usn_get_last_usn(be, &last_usn);
if (0 == rc) { /* only when the last usn is available */
+ slapi_log_error(SLAPI_LOG_BACKLDBM, "ldbm_usn_init",
+ "backend: %s%s\n", be->be_name,
+ isglobal?" (global mode)":"");
if (isglobal) {
if (isfirst) {
li->li_global_usn_counter = slapi_counter_new();
@@ -126,7 +127,7 @@ usn_get_last_usn(Slapi_Backend *be, PRUint64 *last_usn)
DBT value;
PRInt64 signed_last_usn;
- if (NULL == last_usn) {
+ if ((NULL == be) || (NULL == last_usn)) {
return rc;
}
1
0
ldap/servers/slapd/back-ldbm/ldbm_usn.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
New commits:
commit 412ec0e9c8367f2d1c446237cb2bc27791ea8e6c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Jan 27 15:15:01 2014 -0800
Ticket #47659 - ldbm_usn_init: Valgrind reports Invalid read / SIGSEGV
Bug description: A suffix mapping tree could exist without the corresponding
backend. The existing code did not properly check the backend returned from
slapi_mapping_tree_find_backend_for_sdn. When NULL backend is returned, it
triggers the NULL pointer dereference.
Fix description: This patch added a NULL backend check to usn_get_last_usn,
and moved a logging to the if clause where the backend is not NULL.
https://fedorahosted.org/389/ticket/47659
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit a6f66e7fcbd5d17d975cc2ac65806d7c64571254)
(cherry picked from commit 6ad2397fa5d1319840d66f9ec47dfdd7bde8f129)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_usn.c b/ldap/servers/slapd/back-ldbm/ldbm_usn.c
index 7c11a68..1ca16b1 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_usn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_usn.c
@@ -80,10 +80,11 @@ ldbm_usn_init(struct ldbminfo *li)
for ( sdn = slapi_get_first_suffix( &node, 0 ); sdn != NULL;
sdn = slapi_get_next_suffix_ext( &node, 0 )) {
be = slapi_mapping_tree_find_backend_for_sdn(sdn);
- slapi_log_error(SLAPI_LOG_BACKLDBM, "ldbm_usn_init",
- "backend: %s%s\n", be->be_name, isglobal?" (global mode)":"");
rc = usn_get_last_usn(be, &last_usn);
if (0 == rc) { /* only when the last usn is available */
+ slapi_log_error(SLAPI_LOG_BACKLDBM, "ldbm_usn_init",
+ "backend: %s%s\n", be->be_name,
+ isglobal?" (global mode)":"");
if (isglobal) {
if (isfirst) {
li->li_global_usn_counter = slapi_counter_new();
@@ -126,7 +127,7 @@ usn_get_last_usn(Slapi_Backend *be, PRUint64 *last_usn)
DBT value;
PRInt64 signed_last_usn;
- if (NULL == last_usn) {
+ if ((NULL == be) || (NULL == last_usn)) {
return rc;
}
1
0
ldap/servers/slapd/back-ldbm/ldbm_usn.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
New commits:
commit 6ad2397fa5d1319840d66f9ec47dfdd7bde8f129
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Jan 27 15:15:01 2014 -0800
Ticket #47659 - ldbm_usn_init: Valgrind reports Invalid read / SIGSEGV
Bug description: A suffix mapping tree could exist without the corresponding
backend. The existing code did not properly check the backend returned from
slapi_mapping_tree_find_backend_for_sdn. When NULL backend is returned, it
triggers the NULL pointer dereference.
Fix description: This patch added a NULL backend check to usn_get_last_usn,
and moved a logging to the if clause where the backend is not NULL.
https://fedorahosted.org/389/ticket/47659
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
(cherry picked from commit a6f66e7fcbd5d17d975cc2ac65806d7c64571254)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_usn.c b/ldap/servers/slapd/back-ldbm/ldbm_usn.c
index 7c11a68..1ca16b1 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_usn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_usn.c
@@ -80,10 +80,11 @@ ldbm_usn_init(struct ldbminfo *li)
for ( sdn = slapi_get_first_suffix( &node, 0 ); sdn != NULL;
sdn = slapi_get_next_suffix_ext( &node, 0 )) {
be = slapi_mapping_tree_find_backend_for_sdn(sdn);
- slapi_log_error(SLAPI_LOG_BACKLDBM, "ldbm_usn_init",
- "backend: %s%s\n", be->be_name, isglobal?" (global mode)":"");
rc = usn_get_last_usn(be, &last_usn);
if (0 == rc) { /* only when the last usn is available */
+ slapi_log_error(SLAPI_LOG_BACKLDBM, "ldbm_usn_init",
+ "backend: %s%s\n", be->be_name,
+ isglobal?" (global mode)":"");
if (isglobal) {
if (isfirst) {
li->li_global_usn_counter = slapi_counter_new();
@@ -126,7 +127,7 @@ usn_get_last_usn(Slapi_Backend *be, PRUint64 *last_usn)
DBT value;
PRInt64 signed_last_usn;
- if (NULL == last_usn) {
+ if ((NULL == be) || (NULL == last_usn)) {
return rc;
}
1
0
ldap/servers/slapd/fedse.c | 14 +++++++++++++-
ldap/servers/slapd/ssl.c | 42 +++++++++++++++++++++++++++++++++++++++++-
2 files changed, 54 insertions(+), 2 deletions(-)
New commits:
commit d598ed59179748f9f8a0ddda37ff3d714e063de0
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 7 12:58:32 2015 -0800
Ticket #47880 - provide enabled ciphers as search result
Description: Implemented getEnabledCiphers, with which
ldapsearch -b "cn=encryption,cn=config" nsSSLEnabledCiphers
returns enabled cipher list. Example of returned enabled cipher
dn: cn=encryption,cn=config
nsSSLEnabledCiphers: TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128
nsSSLEnabledCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5::3DES::MD5::192
Back-ported commit c675243e018a89291760161998944c04ea04b12f
https://fedorahosted.org/389/ticket/47880
(cherry picked from commit 8550aaf90870e75b78bb6f393f9fd4aedb68d612)
(cherry picked from commit 51714d8768c335617abbb06d0a6f5023a985c616)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index c23e124..907c604 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -76,6 +76,7 @@
#endif /* _WIN32 */
extern char ** getSupportedCiphers();
+extern char ** getEnabledCiphers();
/* Note: These DNs are no need to be normalized */
static const char *internal_entries[] =
@@ -1696,11 +1697,12 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
struct berval *vals[2];
struct berval val;
char ** cipherList = getSupportedCiphers(); /*Get the string array of supported ciphers here */
+ char ** enabledCipherList = getEnabledCiphers(); /*Get the string array of enabled ciphers here */
vals[0] = &val;
vals[1] = NULL;
attrlist_delete ( &entry->e_attrs, "nsSSLSupportedCiphers");
- while (*cipherList) /* iterarate thru each of them and add to the attr value */
+ while (cipherList && *cipherList) /* iterarate thru each of them and add to the attr value */
{
char *cipher = *cipherList;
val.bv_val = (char* ) cipher;
@@ -1709,6 +1711,16 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
cipherList++;
}
+ attrlist_delete ( &entry->e_attrs, "nsSSLEnabledCiphers");
+ while (enabledCipherList && *enabledCipherList) /* iterarate thru each of them and add to the attr value */
+ {
+ char *cipher = *enabledCipherList;
+ val.bv_val = (char* ) cipher;
+ val.bv_len = strlen ( val.bv_val );
+ attrlist_merge ( &entry->e_attrs, "nsSSLEnabledCiphers", vals);
+ enabledCipherList++;
+ }
+
return SLAPI_DSE_CALLBACK_OK;
}
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 23fa620..c30ebd6 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -128,6 +128,7 @@ static char * configDN = "cn=encryption,cn=config";
static char **cipher_names = NULL;
+static char **enabled_cipher_names = NULL;
typedef struct {
char *version;
char *name;
@@ -220,7 +221,8 @@ slapd_SSL_warn(char *fmt, ...)
va_end(args);
}
-char ** getSupportedCiphers()
+char **
+getSupportedCiphers()
{
SSLCipherSuiteInfo info;
char *sep = "::";
@@ -242,6 +244,44 @@ char ** getSupportedCiphers()
return cipher_names;
}
+char **
+getEnabledCiphers()
+{
+ SSLCipherSuiteInfo info;
+ char *sep = "::";
+ int number_of_ciphers = 0;
+ int x;
+ int idx = 0;
+ PRBool enabled;
+
+ /* We have to wait until the SSL initialization is done. */
+ if (!slapd_ssl_listener_is_initialized()) {
+ return NULL;
+ }
+ if ((enabled_cipher_names == NULL)) {
+ for (x = 0; _conf_ciphers[x].name; x++) {
+ SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
+ if (enabled) {
+ number_of_ciphers++;
+ }
+ }
+ enabled_cipher_names = (char **)slapi_ch_calloc((number_of_ciphers + 1), sizeof(char *));
+ for (x = 0; _conf_ciphers[x].name; x++) {
+ SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
+ if (enabled) {
+ SSL_GetCipherSuiteInfo((PRUint16)_conf_ciphers[x].num,&info,sizeof(info));
+ enabled_cipher_names[idx++] = PR_smprintf("%s%s%s%s%s%s%d",
+ _conf_ciphers[x].name,sep,
+ info.symCipherName,sep,
+ info.macAlgorithmName,sep,
+ info.symKeyBits);
+ }
+ }
+ }
+
+ return enabled_cipher_names;
+}
+
static PRBool
cipher_check_fips(int idx, char ***suplist, char ***unsuplist)
{
1
0
ldap/servers/slapd/fedse.c | 14 +++++++++++++-
ldap/servers/slapd/ssl.c | 42 +++++++++++++++++++++++++++++++++++++++++-
2 files changed, 54 insertions(+), 2 deletions(-)
New commits:
commit 51714d8768c335617abbb06d0a6f5023a985c616
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 7 12:58:32 2015 -0800
Ticket #47880 - provide enabled ciphers as search result
Description: Implemented getEnabledCiphers, with which
ldapsearch -b "cn=encryption,cn=config" nsSSLEnabledCiphers
returns enabled cipher list. Example of returned enabled cipher
dn: cn=encryption,cn=config
nsSSLEnabledCiphers: TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128
nsSSLEnabledCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5::3DES::MD5::192
Back-ported commit c675243e018a89291760161998944c04ea04b12f
https://fedorahosted.org/389/ticket/47880
(cherry picked from commit 8550aaf90870e75b78bb6f393f9fd4aedb68d612)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index c1ba9ca..7c7c9a6 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -75,6 +75,7 @@
#endif /* _WIN32 */
extern char ** getSupportedCiphers();
+extern char ** getEnabledCiphers();
/* Note: These DNs are no need to be normalized */
static const char *internal_entries[] =
@@ -1693,11 +1694,12 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
struct berval *vals[2];
struct berval val;
char ** cipherList = getSupportedCiphers(); /*Get the string array of supported ciphers here */
+ char ** enabledCipherList = getEnabledCiphers(); /*Get the string array of enabled ciphers here */
vals[0] = &val;
vals[1] = NULL;
attrlist_delete ( &entry->e_attrs, "nsSSLSupportedCiphers");
- while (*cipherList) /* iterarate thru each of them and add to the attr value */
+ while (cipherList && *cipherList) /* iterarate thru each of them and add to the attr value */
{
char *cipher = *cipherList;
val.bv_val = (char* ) cipher;
@@ -1706,6 +1708,16 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
cipherList++;
}
+ attrlist_delete ( &entry->e_attrs, "nsSSLEnabledCiphers");
+ while (enabledCipherList && *enabledCipherList) /* iterarate thru each of them and add to the attr value */
+ {
+ char *cipher = *enabledCipherList;
+ val.bv_val = (char* ) cipher;
+ val.bv_len = strlen ( val.bv_val );
+ attrlist_merge ( &entry->e_attrs, "nsSSLEnabledCiphers", vals);
+ enabledCipherList++;
+ }
+
return SLAPI_DSE_CALLBACK_OK;
}
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 23fa620..c30ebd6 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -128,6 +128,7 @@ static char * configDN = "cn=encryption,cn=config";
static char **cipher_names = NULL;
+static char **enabled_cipher_names = NULL;
typedef struct {
char *version;
char *name;
@@ -220,7 +221,8 @@ slapd_SSL_warn(char *fmt, ...)
va_end(args);
}
-char ** getSupportedCiphers()
+char **
+getSupportedCiphers()
{
SSLCipherSuiteInfo info;
char *sep = "::";
@@ -242,6 +244,44 @@ char ** getSupportedCiphers()
return cipher_names;
}
+char **
+getEnabledCiphers()
+{
+ SSLCipherSuiteInfo info;
+ char *sep = "::";
+ int number_of_ciphers = 0;
+ int x;
+ int idx = 0;
+ PRBool enabled;
+
+ /* We have to wait until the SSL initialization is done. */
+ if (!slapd_ssl_listener_is_initialized()) {
+ return NULL;
+ }
+ if ((enabled_cipher_names == NULL)) {
+ for (x = 0; _conf_ciphers[x].name; x++) {
+ SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
+ if (enabled) {
+ number_of_ciphers++;
+ }
+ }
+ enabled_cipher_names = (char **)slapi_ch_calloc((number_of_ciphers + 1), sizeof(char *));
+ for (x = 0; _conf_ciphers[x].name; x++) {
+ SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
+ if (enabled) {
+ SSL_GetCipherSuiteInfo((PRUint16)_conf_ciphers[x].num,&info,sizeof(info));
+ enabled_cipher_names[idx++] = PR_smprintf("%s%s%s%s%s%s%d",
+ _conf_ciphers[x].name,sep,
+ info.symCipherName,sep,
+ info.macAlgorithmName,sep,
+ info.symKeyBits);
+ }
+ }
+ }
+
+ return enabled_cipher_names;
+}
+
static PRBool
cipher_check_fips(int idx, char ***suplist, char ***unsuplist)
{
1
0
ldap/servers/slapd/auth.c | 115 +++++++++++++++++++------------------
ldap/servers/slapd/slapi-private.h | 19 ++++++
2 files changed, 80 insertions(+), 54 deletions(-)
New commits:
commit 712d8eb77a32bde75e63a5d3beb27e62d1e2258c
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 7 11:35:32 2015 -0800
Ticket #47945 - Add SSL/TLS version info to the access log
Description: Added the currently used SSL library version info per
connection to the access log.
Sample output:
SSL
[..] conn=3 fd=64 slot=64 SSL connection from ::1 to ::1
[..] conn=3 TLS1.2 128-bit AES-GCM
startTLS
[..] conn=4 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[..] conn=4 op=0 RESULT err=0 tag=120 nentries=0 etime=0
[..] conn=4 TLS1.2 128-bit AES-GCM
To convert the SSL version number to string (e.g., SSL_LIBRARY_VERSION_
TLS_1_2 --> "TLS1.2"), instead of maintaining a mapping table, this
patch calculates the number and generates the version string.
Back-ported commit a2e0de3aa90f04593427628afeb7fe090dac93fb
https://fedorahosted.org/389/ticket/47945
(cherry picked from commit d62b281480c4c17438a6541c150bdb1e80abf14f)
(cherry picked from commit 0680446be988316e26715a2c3dbeb3163f7f6e85)
diff --git a/ldap/servers/slapd/auth.c b/ldap/servers/slapd/auth.c
index 5b7dc31..6031b90 100644
--- a/ldap/servers/slapd/auth.c
+++ b/ldap/servers/slapd/auth.c
@@ -433,6 +433,7 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
SSLChannelInfo channelInfo;
SSLCipherSuiteInfo cipherInfo;
char* subject = NULL;
+ char sslversion[64];
if ( (slapd_ssl_getChannelInfo (prfd, &channelInfo, sizeof(channelInfo))) != SECSuccess ) {
PRErrorCode errorCode = PR_GetError();
@@ -465,59 +466,63 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
}
}
+ (void) slapi_getSSLVersion_str(channelInfo.protocolVersion, sslversion, sizeof(sslversion));
if (config_get_SSLclientAuth() == SLAPD_SSLCLIENTAUTH_OFF ) {
- slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " SSL %i-bit %s\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL" );
+ slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " %s %i-bit %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL" );
goto done;
- }
+ }
if (clientCert == NULL) {
- slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " SSL %i-bit %s\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL" );
+ slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " %s %i-bit %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL" );
} else {
- subject = subject_of (clientCert);
- if (!subject) {
- slapi_log_access( LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL %i-bit %s; missing subject\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL");
- goto done;
- }
- {
- char* issuer = issuer_of (clientCert);
- char sbuf[ BUFSIZ ], ibuf[ BUFSIZ ];
- slapi_log_access( LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL %i-bit %s; client %s; issuer %s\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL",
- subject ? escape_string( subject, sbuf ) : "NULL",
- issuer ? escape_string( issuer, ibuf ) : "NULL");
- if (issuer) free (issuer);
- }
- slapi_dn_normalize (subject);
- {
- LDAPMessage* chain = NULL;
- char *basedn = config_get_basedn();
- int err;
-
- err = ldapu_cert_to_ldap_entry
- (clientCert, internal_ld, basedn?basedn:""/*baseDN*/, &chain);
- if (err == LDAPU_SUCCESS && chain) {
- LDAPMessage* entry = slapu_first_entry (internal_ld, chain);
- if (entry) {
- /* clientDN is duplicated in slapu_get_dn */
- clientDN = slapu_get_dn (internal_ld, entry);
- } else {
-
- extraErrorMsg = "no entry";
- LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %s\n",
- extraErrorMsg, 0, 0);
- }
- } else {
- extraErrorMsg = ldapu_err2string(err);
- LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %i (%s)%s\n",
- err, extraErrorMsg, chain ? "" : " NULL");
- }
- slapi_ch_free_string(&basedn);
- slapu_msgfree (internal_ld, chain);
- }
+ subject = subject_of (clientCert);
+ if (!subject) {
+ slapi_log_access( LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s %i-bit %s; missing subject\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL");
+ goto done;
+ }
+ {
+ char* issuer = issuer_of (clientCert);
+ char sbuf[ BUFSIZ ], ibuf[ BUFSIZ ];
+ slapi_log_access( LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s %i-bit %s; client %s; issuer %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL",
+ subject ? escape_string( subject, sbuf ) : "NULL",
+ issuer ? escape_string( issuer, ibuf ) : "NULL");
+ if (issuer) free (issuer);
+ }
+ slapi_dn_normalize (subject);
+ {
+ LDAPMessage* chain = NULL;
+ char *basedn = config_get_basedn();
+ int err;
+
+ err = ldapu_cert_to_ldap_entry
+ (clientCert, internal_ld, basedn?basedn:""/*baseDN*/, &chain);
+ if (err == LDAPU_SUCCESS && chain) {
+ LDAPMessage* entry = slapu_first_entry (internal_ld, chain);
+ if (entry) {
+ /* clientDN is duplicated in slapu_get_dn */
+ clientDN = slapu_get_dn (internal_ld, entry);
+ } else {
+ extraErrorMsg = "no entry";
+ LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %s\n",
+ extraErrorMsg, 0, 0);
+ }
+ } else {
+ extraErrorMsg = ldapu_err2string(err);
+ LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %i (%s)%s\n",
+ err, extraErrorMsg, chain ? "" : " NULL");
+ }
+ slapi_ch_free_string(&basedn);
+ slapu_msgfree (internal_ld, chain);
+ }
}
if (clientDN != NULL) {
@@ -525,14 +530,16 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
sdn = slapi_sdn_new_dn_passin(clientDN);
clientDN = slapi_ch_strdup(slapi_sdn_get_dn(sdn));
slapi_sdn_free(&sdn);
- slapi_log_access (LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL client bound as %s\n",
- (long long unsigned int)conn->c_connid, clientDN);
+ slapi_log_access (LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s client bound as %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, clientDN);
} else if (clientCert != NULL) {
slapi_log_access (LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL failed to map client "
+ "conn=%" NSPRIu64 " %s failed to map client "
"certificate to LDAP DN (%s)\n",
- (long long unsigned int)conn->c_connid, extraErrorMsg );
+ (long long unsigned int)conn->c_connid,
+ sslversion, extraErrorMsg);
}
/*
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index f2b4fe8..588c284 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -1326,6 +1326,25 @@ void modify_update_last_modified_attr(Slapi_PBlock *pb, Slapi_Mods *smods);
/* add.c */
void add_internal_modifiersname(Slapi_PBlock *pb, Slapi_Entry *e);
+/* ssl.c */
+/*
+ * If non NULL buf and positive bufsize is given,
+ * the memory is used to store the version string.
+ * Otherwise, the memory for the string is allocated.
+ * The latter case, caller is responsible to free it.
+ */
+/* vnum is supposed to be in one of the following:
+ * nss3/sslproto.h
+ * #define SSL_LIBRARY_VERSION_2 0x0002
+ * #define SSL_LIBRARY_VERSION_3_0 0x0300
+ * #define SSL_LIBRARY_VERSION_TLS_1_0 0x0301
+ * #define SSL_LIBRARY_VERSION_TLS_1_1 0x0302
+ * #define SSL_LIBRARY_VERSION_TLS_1_2 0x0303
+ * #define SSL_LIBRARY_VERSION_TLS_1_3 0x0304
+ * ...
+ */
+char *slapi_getSSLVersion_str(PRUint16 vnum, char *buf, size_t bufsize);
+
#ifdef __cplusplus
}
#endif
1
0
ldap/servers/slapd/auth.c | 115 +++++++++++++++++++------------------
ldap/servers/slapd/slapi-private.h | 19 ++++++
2 files changed, 80 insertions(+), 54 deletions(-)
New commits:
commit 0680446be988316e26715a2c3dbeb3163f7f6e85
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 7 11:35:32 2015 -0800
Ticket #47945 - Add SSL/TLS version info to the access log
Description: Added the currently used SSL library version info per
connection to the access log.
Sample output:
SSL
[..] conn=3 fd=64 slot=64 SSL connection from ::1 to ::1
[..] conn=3 TLS1.2 128-bit AES-GCM
startTLS
[..] conn=4 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[..] conn=4 op=0 RESULT err=0 tag=120 nentries=0 etime=0
[..] conn=4 TLS1.2 128-bit AES-GCM
To convert the SSL version number to string (e.g., SSL_LIBRARY_VERSION_
TLS_1_2 --> "TLS1.2"), instead of maintaining a mapping table, this
patch calculates the number and generates the version string.
Back-ported commit a2e0de3aa90f04593427628afeb7fe090dac93fb
https://fedorahosted.org/389/ticket/47945
(cherry picked from commit d62b281480c4c17438a6541c150bdb1e80abf14f)
diff --git a/ldap/servers/slapd/auth.c b/ldap/servers/slapd/auth.c
index 3a72f79..2b4d173 100644
--- a/ldap/servers/slapd/auth.c
+++ b/ldap/servers/slapd/auth.c
@@ -433,6 +433,7 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
SSLChannelInfo channelInfo;
SSLCipherSuiteInfo cipherInfo;
char* subject = NULL;
+ char sslversion[64];
if ( (slapd_ssl_getChannelInfo (prfd, &channelInfo, sizeof(channelInfo))) != SECSuccess ) {
PRErrorCode errorCode = PR_GetError();
@@ -465,59 +466,63 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
}
}
+ (void) slapi_getSSLVersion_str(channelInfo.protocolVersion, sslversion, sizeof(sslversion));
if (config_get_SSLclientAuth() == SLAPD_SSLCLIENTAUTH_OFF ) {
- slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " SSL %i-bit %s\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL" );
+ slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " %s %i-bit %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL" );
goto done;
- }
+ }
if (clientCert == NULL) {
- slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " SSL %i-bit %s\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL" );
+ slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " %s %i-bit %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL" );
} else {
- subject = subject_of (clientCert);
- if (!subject) {
- slapi_log_access( LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL %i-bit %s; missing subject\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL");
- goto done;
- }
- {
- char* issuer = issuer_of (clientCert);
- char sbuf[ BUFSIZ ], ibuf[ BUFSIZ ];
- slapi_log_access( LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL %i-bit %s; client %s; issuer %s\n",
- (long long unsigned int)conn->c_connid, keySize, cipher ? cipher : "NULL",
- subject ? escape_string( subject, sbuf ) : "NULL",
- issuer ? escape_string( issuer, ibuf ) : "NULL");
- if (issuer) free (issuer);
- }
- slapi_dn_normalize (subject);
- {
- LDAPMessage* chain = NULL;
- char *basedn = config_get_basedn();
- int err;
-
- err = ldapu_cert_to_ldap_entry
- (clientCert, internal_ld, basedn?basedn:""/*baseDN*/, &chain);
- if (err == LDAPU_SUCCESS && chain) {
- LDAPMessage* entry = slapu_first_entry (internal_ld, chain);
- if (entry) {
- /* clientDN is duplicated in slapu_get_dn */
- clientDN = slapu_get_dn (internal_ld, entry);
- } else {
-
- extraErrorMsg = "no entry";
- LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %s\n",
- extraErrorMsg, 0, 0);
- }
- } else {
- extraErrorMsg = ldapu_err2string(err);
- LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %i (%s)%s\n",
- err, extraErrorMsg, chain ? "" : " NULL");
- }
- slapi_ch_free_string(&basedn);
- slapu_msgfree (internal_ld, chain);
- }
+ subject = subject_of (clientCert);
+ if (!subject) {
+ slapi_log_access( LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s %i-bit %s; missing subject\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL");
+ goto done;
+ }
+ {
+ char* issuer = issuer_of (clientCert);
+ char sbuf[ BUFSIZ ], ibuf[ BUFSIZ ];
+ slapi_log_access( LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s %i-bit %s; client %s; issuer %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL",
+ subject ? escape_string( subject, sbuf ) : "NULL",
+ issuer ? escape_string( issuer, ibuf ) : "NULL");
+ if (issuer) free (issuer);
+ }
+ slapi_dn_normalize (subject);
+ {
+ LDAPMessage* chain = NULL;
+ char *basedn = config_get_basedn();
+ int err;
+
+ err = ldapu_cert_to_ldap_entry
+ (clientCert, internal_ld, basedn?basedn:""/*baseDN*/, &chain);
+ if (err == LDAPU_SUCCESS && chain) {
+ LDAPMessage* entry = slapu_first_entry (internal_ld, chain);
+ if (entry) {
+ /* clientDN is duplicated in slapu_get_dn */
+ clientDN = slapu_get_dn (internal_ld, entry);
+ } else {
+ extraErrorMsg = "no entry";
+ LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %s\n",
+ extraErrorMsg, 0, 0);
+ }
+ } else {
+ extraErrorMsg = ldapu_err2string(err);
+ LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %i (%s)%s\n",
+ err, extraErrorMsg, chain ? "" : " NULL");
+ }
+ slapi_ch_free_string(&basedn);
+ slapu_msgfree (internal_ld, chain);
+ }
}
if (clientDN != NULL) {
@@ -525,14 +530,16 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
sdn = slapi_sdn_new_dn_passin(clientDN);
clientDN = slapi_ch_strdup(slapi_sdn_get_dn(sdn));
slapi_sdn_free(&sdn);
- slapi_log_access (LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL client bound as %s\n",
- (long long unsigned int)conn->c_connid, clientDN);
+ slapi_log_access (LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s client bound as %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, clientDN);
} else if (clientCert != NULL) {
slapi_log_access (LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL failed to map client "
+ "conn=%" NSPRIu64 " %s failed to map client "
"certificate to LDAP DN (%s)\n",
- (long long unsigned int)conn->c_connid, extraErrorMsg );
+ (long long unsigned int)conn->c_connid,
+ sslversion, extraErrorMsg);
}
/*
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index 3712e65..914b85a 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -1323,6 +1323,25 @@ void modify_update_last_modified_attr(Slapi_PBlock *pb, Slapi_Mods *smods);
/* add.c */
void add_internal_modifiersname(Slapi_PBlock *pb, Slapi_Entry *e);
+/* ssl.c */
+/*
+ * If non NULL buf and positive bufsize is given,
+ * the memory is used to store the version string.
+ * Otherwise, the memory for the string is allocated.
+ * The latter case, caller is responsible to free it.
+ */
+/* vnum is supposed to be in one of the following:
+ * nss3/sslproto.h
+ * #define SSL_LIBRARY_VERSION_2 0x0002
+ * #define SSL_LIBRARY_VERSION_3_0 0x0300
+ * #define SSL_LIBRARY_VERSION_TLS_1_0 0x0301
+ * #define SSL_LIBRARY_VERSION_TLS_1_1 0x0302
+ * #define SSL_LIBRARY_VERSION_TLS_1_2 0x0303
+ * #define SSL_LIBRARY_VERSION_TLS_1_3 0x0304
+ * ...
+ */
+char *slapi_getSSLVersion_str(PRUint16 vnum, char *buf, size_t bufsize);
+
#ifdef __cplusplus
}
#endif
1
0
ldap/servers/slapd/fedse.c | 3
ldap/servers/slapd/ssl.c | 150 ++++++++++++++++++++++++++++++++++++++++-----
2 files changed, 136 insertions(+), 17 deletions(-)
New commits:
commit f7ae1e80d871b64ffbe0f18e9999855ea73bb253
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 6 16:23:35 2015 -0800
Ticket #47928 - Disable SSL v3, by default [389-ds-base-1.2.11 only]
Description:
[fedse.c]
By default, nsSSL3 is set to off and nsTLS1 is on in cn=encryption,cn=config.
[ssl.c]
Back-ported SSLVersionRange from the master branch, but no new range
parameter support in the config. If nsSSL3 is explicitely set to
on, SSL_LIBRARY_VERSION_3_0 is set to the minimum ssl version.
Otherwise, SSL_LIBRARY_VERSION_TLS_1_0 becomes the minimum version.
The max available version is set to the maximum ssl version.
On this version, there is no way to disable TLS1.0 and enable TLS1.1
and newer. If nsTLS1 is on, all TLS1.X are enabled.
Note: This patch covers Ticket #605 - support TLS 1.1, as well.
https://fedorahosted.org/389/ticket/47928
(cherry picked from commit 17fc03cf1101135b99234f17efd3eb746626be1a)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 0b537bb..c23e124 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -108,7 +108,8 @@ static const char *internal_entries[] =
"nsSSLSessionTimeout:0\n"
"nsSSLClientAuth:allowed\n"
"nsSSL2:off\n"
- "nsSSL3:off\n",
+ "nsSSL3:off\n"
+ "nsTLS1:on\n",
"dn:cn=monitor\n"
"objectclass:top\n"
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index bbadf93..23fa620 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -79,6 +79,24 @@
#define MAXPATHLEN 1024
#endif
+#if NSS_VMAJOR * 100 + NSS_VMINOR >= 315
+/* TLS1.2 is defined in RFC5246. */
+#define NSS_TLS12 1
+#elif NSS_VMAJOR * 100 + NSS_VMINOR >= 314
+/* TLS1.1 is defined in RFC4346. */
+#define NSS_TLS11 1
+#else
+#define NSS_TLS10 1
+#endif
+
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+static SSLVersionRange enabledNSSVersions;
+static SSLVersionRange slapdNSSVersions;
+#endif
+
+/* E.g., "SSL3", "TLS1.2", "Unknown SSL version: 0x0" */
+#define VERSION_STR_LENGTH 64
+
extern char* slapd_SSL3ciphers;
extern symbol_t supported_ciphers[];
@@ -165,6 +183,12 @@ static cipherstruct _conf_ciphers[] = {
/*{"TLS","tls_dhe_dss_1024_des_sha", TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA}, */
{"TLS","tls_dhe_dss_1024_rc4_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA},
{"TLS","tls_dhe_dss_rc4_128_sha", TLS_DHE_DSS_WITH_RC4_128_SHA},
+#if defined(NSS_TLS12)
+ /* New in NSS 3.15 */
+ {"tls_rsa_aes_128_gcm_sha", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
+ {"tls_dhe_rsa_aes_128_gcm_sha", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"},
+ {"tls_dhe_dss_aes_128_gcm_sha", NULL}, /* not available */
+#endif
{NULL, NULL, 0}
};
@@ -524,6 +548,54 @@ warn_if_no_key_file(const char *dir, int no_log)
return ret;
}
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+/*
+ * If non NULL buf and positive bufsize is given,
+ * the memory is used to store the version string.
+ * Otherwise, the memory for the string is allocated.
+ * The latter case, caller is responsible to free it.
+ */
+char *
+slapi_getSSLVersion_str(PRUint16 vnum, char *buf, size_t bufsize)
+{
+ char *vstr = buf;
+ if (vnum >= SSL_LIBRARY_VERSION_3_0) {
+ if (vnum == SSL_LIBRARY_VERSION_3_0) { /* SSL3 */
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "SSL3");
+ } else {
+ vstr = slapi_ch_smprintf("SSL3");
+ }
+ } else { /* TLS v X.Y */
+ const char *TLSFMT = "TLS%d.%d";
+ int minor_offset = 0; /* e.g. 0x0401 -> TLS v 2.1, not 2.0 */
+
+ if ((vnum & SSL_LIBRARY_VERSION_3_0) == SSL_LIBRARY_VERSION_3_0) {
+ minor_offset = 1; /* e.g. 0x0301 -> TLS v 1.0, not 1.1 */
+ }
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, TLSFMT, (vnum >> 8) - 2, (vnum & 0xff) - minor_offset);
+ } else {
+ vstr = slapi_ch_smprintf(TLSFMT, (vnum >> 8) - 2, (vnum & 0xff) - minor_offset);
+ }
+ }
+ } else if (vnum == SSL_LIBRARY_VERSION_2) { /* SSL2 */
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "SSL2");
+ } else {
+ vstr = slapi_ch_smprintf("SSL2");
+ }
+ } else {
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "Unknown SSL version: 0x%x", vnum);
+ } else {
+ vstr = slapi_ch_smprintf("Unknown SSL version: 0x%x", vnum);
+ }
+ }
+ return vstr;
+}
+#endif
+
/*
* slapd_nss_init() is always called from main(), even if we do not
* plan to listen on a secure port. If config_available is 0, the
@@ -548,6 +620,17 @@ slapd_nss_init(int init_ssl, int config_available)
char *certdb_file_name = NULL;
char *keydb_file_name = NULL;
char *secmoddb_file_name = NULL;
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ char emin[VERSION_STR_LENGTH], emax[VERSION_STR_LENGTH];
+ /* Get the range of the supported SSL version */
+ SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
+
+ (void) slapi_getSSLVersion_str(enabledNSSVersions.min, emin, sizeof(emin));
+ (void) slapi_getSSLVersion_str(enabledNSSVersions.max, emax, sizeof(emax));
+ slapi_log_error(SLAPI_LOG_CONFIG, "SSL Initialization",
+ "supported range by NSS: min: %s, max: %s\n",
+ emin, emax);
+#endif
/* set in slapd_bootstrap_config,
thus certdir is available even if config_available is false */
@@ -879,9 +962,13 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
char* tmpDir;
Slapi_Entry *e = NULL;
PRBool enableSSL2 = PR_FALSE;
- PRBool enableSSL3 = PR_TRUE;
+ PRBool enableSSL3 = PR_FALSE;
PRBool enableTLS1 = PR_TRUE;
PRBool fipsMode = PR_FALSE;
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ PRUint16 NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
+ PRUint16 NSSVersionMax = enabledNSSVersions.max;
+#endif
/* turn off the PKCS11 pin interactive mode */
#ifndef _WIN32
@@ -1226,23 +1313,54 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
}
slapi_ch_free_string( &val );
}
- sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_SSL3, enableSSL3);
- if (sslStatus != SECSuccess) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to %s SSLv3 "
- "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- enableSSL3 ? "enable" : "disable",
- errorCode, slapd_pr_strerror(errorCode));
- }
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ if (NSSVersionMin > 0) {
+ char mymin[VERSION_STR_LENGTH], mymax[VERSION_STR_LENGTH];
+ /* Use new NSS API SSL_VersionRangeSet (NSS3.14 or newer) */
+ if (enableTLS1) {
+ NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
+ }
+ if (enableSSL3) {
+ NSSVersionMin = SSL_LIBRARY_VERSION_3_0;
+ }
+ slapdNSSVersions.min = NSSVersionMin;
+ slapdNSSVersions.max = NSSVersionMax;
+ (void) slapi_getSSLVersion_str(slapdNSSVersions.min, mymin, sizeof(mymin));
+ (void) slapi_getSSLVersion_str(slapdNSSVersions.max, mymax, sizeof(mymax));
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Configured SSL version range: min: %s, max: %s\n",
+ mymin, mymax);
+ sslStatus = SSL_VersionRangeSet(pr_sock, &slapdNSSVersions);
+ if (sslStatus == SECSuccess) {
+ /* Set the restricted value to the cn=encryption entry */
+ } else {
+ slapd_SSL_error("SSL Initialization 2: "
+ "Failed to set SSL range: min: %s, max: %s\n",
+ mymin, mymax);
+ }
+ } else {
+#endif
+ /* deprecated code */
+ sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_SSL3, enableSSL3);
+ if (sslStatus != SECSuccess) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to %s SSLv3 "
+ "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ enableSSL3 ? "enable" : "disable",
+ errorCode, slapd_pr_strerror(errorCode));
+ }
- sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_TLS, enableTLS1);
- if (sslStatus != SECSuccess) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to %s TLSv1 "
- "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- enableTLS1 ? "enable" : "disable",
- errorCode, slapd_pr_strerror(errorCode));
+ sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_TLS, enableTLS1);
+ if (sslStatus != SECSuccess) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to %s TLSv1 "
+ "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ enableTLS1 ? "enable" : "disable",
+ errorCode, slapd_pr_strerror(errorCode));
+ }
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
}
+#endif
freeConfigEntry( &e );
if(( slapd_SSLclientAuth = config_get_SSLclientAuth()) != SLAPD_SSLCLIENTAUTH_OFF ) {
1
0
ldap/servers/slapd/fedse.c | 3
ldap/servers/slapd/ssl.c | 150 ++++++++++++++++++++++++++++++++++++++++-----
2 files changed, 136 insertions(+), 17 deletions(-)
New commits:
commit d4d34b245905886742f18d63da83c4edddf973ea
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 6 16:23:35 2015 -0800
Ticket #47928 - Disable SSL v3, by default [389-ds-base-1.2.11 only]
Description:
[fedse.c]
By default, nsSSL3 is set to off and nsTLS1 is on in cn=encryption,cn=config.
[ssl.c]
Back-ported SSLVersionRange from the master branch, but no new range
parameter support in the config. If nsSSL3 is explicitely set to
on, SSL_LIBRARY_VERSION_3_0 is set to the minimum ssl version.
Otherwise, SSL_LIBRARY_VERSION_TLS_1_0 becomes the minimum version.
The max available version is set to the maximum ssl version.
On this version, there is no way to disable TLS1.0 and enable TLS1.1
and newer. If nsTLS1 is on, all TLS1.X are enabled.
Note: This patch covers Ticket #605 - support TLS 1.1, as well.
https://fedorahosted.org/389/ticket/47928
(cherry picked from commit 17fc03cf1101135b99234f17efd3eb746626be1a)
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index 5434c75..c1ba9ca 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -107,7 +107,8 @@ static const char *internal_entries[] =
"nsSSLSessionTimeout:0\n"
"nsSSLClientAuth:allowed\n"
"nsSSL2:off\n"
- "nsSSL3:off\n",
+ "nsSSL3:off\n"
+ "nsTLS1:on\n",
"dn:cn=monitor\n"
"objectclass:top\n"
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index bbadf93..23fa620 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -79,6 +79,24 @@
#define MAXPATHLEN 1024
#endif
+#if NSS_VMAJOR * 100 + NSS_VMINOR >= 315
+/* TLS1.2 is defined in RFC5246. */
+#define NSS_TLS12 1
+#elif NSS_VMAJOR * 100 + NSS_VMINOR >= 314
+/* TLS1.1 is defined in RFC4346. */
+#define NSS_TLS11 1
+#else
+#define NSS_TLS10 1
+#endif
+
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+static SSLVersionRange enabledNSSVersions;
+static SSLVersionRange slapdNSSVersions;
+#endif
+
+/* E.g., "SSL3", "TLS1.2", "Unknown SSL version: 0x0" */
+#define VERSION_STR_LENGTH 64
+
extern char* slapd_SSL3ciphers;
extern symbol_t supported_ciphers[];
@@ -165,6 +183,12 @@ static cipherstruct _conf_ciphers[] = {
/*{"TLS","tls_dhe_dss_1024_des_sha", TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA}, */
{"TLS","tls_dhe_dss_1024_rc4_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA},
{"TLS","tls_dhe_dss_rc4_128_sha", TLS_DHE_DSS_WITH_RC4_128_SHA},
+#if defined(NSS_TLS12)
+ /* New in NSS 3.15 */
+ {"tls_rsa_aes_128_gcm_sha", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
+ {"tls_dhe_rsa_aes_128_gcm_sha", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"},
+ {"tls_dhe_dss_aes_128_gcm_sha", NULL}, /* not available */
+#endif
{NULL, NULL, 0}
};
@@ -524,6 +548,54 @@ warn_if_no_key_file(const char *dir, int no_log)
return ret;
}
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+/*
+ * If non NULL buf and positive bufsize is given,
+ * the memory is used to store the version string.
+ * Otherwise, the memory for the string is allocated.
+ * The latter case, caller is responsible to free it.
+ */
+char *
+slapi_getSSLVersion_str(PRUint16 vnum, char *buf, size_t bufsize)
+{
+ char *vstr = buf;
+ if (vnum >= SSL_LIBRARY_VERSION_3_0) {
+ if (vnum == SSL_LIBRARY_VERSION_3_0) { /* SSL3 */
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "SSL3");
+ } else {
+ vstr = slapi_ch_smprintf("SSL3");
+ }
+ } else { /* TLS v X.Y */
+ const char *TLSFMT = "TLS%d.%d";
+ int minor_offset = 0; /* e.g. 0x0401 -> TLS v 2.1, not 2.0 */
+
+ if ((vnum & SSL_LIBRARY_VERSION_3_0) == SSL_LIBRARY_VERSION_3_0) {
+ minor_offset = 1; /* e.g. 0x0301 -> TLS v 1.0, not 1.1 */
+ }
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, TLSFMT, (vnum >> 8) - 2, (vnum & 0xff) - minor_offset);
+ } else {
+ vstr = slapi_ch_smprintf(TLSFMT, (vnum >> 8) - 2, (vnum & 0xff) - minor_offset);
+ }
+ }
+ } else if (vnum == SSL_LIBRARY_VERSION_2) { /* SSL2 */
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "SSL2");
+ } else {
+ vstr = slapi_ch_smprintf("SSL2");
+ }
+ } else {
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "Unknown SSL version: 0x%x", vnum);
+ } else {
+ vstr = slapi_ch_smprintf("Unknown SSL version: 0x%x", vnum);
+ }
+ }
+ return vstr;
+}
+#endif
+
/*
* slapd_nss_init() is always called from main(), even if we do not
* plan to listen on a secure port. If config_available is 0, the
@@ -548,6 +620,17 @@ slapd_nss_init(int init_ssl, int config_available)
char *certdb_file_name = NULL;
char *keydb_file_name = NULL;
char *secmoddb_file_name = NULL;
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ char emin[VERSION_STR_LENGTH], emax[VERSION_STR_LENGTH];
+ /* Get the range of the supported SSL version */
+ SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
+
+ (void) slapi_getSSLVersion_str(enabledNSSVersions.min, emin, sizeof(emin));
+ (void) slapi_getSSLVersion_str(enabledNSSVersions.max, emax, sizeof(emax));
+ slapi_log_error(SLAPI_LOG_CONFIG, "SSL Initialization",
+ "supported range by NSS: min: %s, max: %s\n",
+ emin, emax);
+#endif
/* set in slapd_bootstrap_config,
thus certdir is available even if config_available is false */
@@ -879,9 +962,13 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
char* tmpDir;
Slapi_Entry *e = NULL;
PRBool enableSSL2 = PR_FALSE;
- PRBool enableSSL3 = PR_TRUE;
+ PRBool enableSSL3 = PR_FALSE;
PRBool enableTLS1 = PR_TRUE;
PRBool fipsMode = PR_FALSE;
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ PRUint16 NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
+ PRUint16 NSSVersionMax = enabledNSSVersions.max;
+#endif
/* turn off the PKCS11 pin interactive mode */
#ifndef _WIN32
@@ -1226,23 +1313,54 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
}
slapi_ch_free_string( &val );
}
- sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_SSL3, enableSSL3);
- if (sslStatus != SECSuccess) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to %s SSLv3 "
- "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- enableSSL3 ? "enable" : "disable",
- errorCode, slapd_pr_strerror(errorCode));
- }
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ if (NSSVersionMin > 0) {
+ char mymin[VERSION_STR_LENGTH], mymax[VERSION_STR_LENGTH];
+ /* Use new NSS API SSL_VersionRangeSet (NSS3.14 or newer) */
+ if (enableTLS1) {
+ NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
+ }
+ if (enableSSL3) {
+ NSSVersionMin = SSL_LIBRARY_VERSION_3_0;
+ }
+ slapdNSSVersions.min = NSSVersionMin;
+ slapdNSSVersions.max = NSSVersionMax;
+ (void) slapi_getSSLVersion_str(slapdNSSVersions.min, mymin, sizeof(mymin));
+ (void) slapi_getSSLVersion_str(slapdNSSVersions.max, mymax, sizeof(mymax));
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Configured SSL version range: min: %s, max: %s\n",
+ mymin, mymax);
+ sslStatus = SSL_VersionRangeSet(pr_sock, &slapdNSSVersions);
+ if (sslStatus == SECSuccess) {
+ /* Set the restricted value to the cn=encryption entry */
+ } else {
+ slapd_SSL_error("SSL Initialization 2: "
+ "Failed to set SSL range: min: %s, max: %s\n",
+ mymin, mymax);
+ }
+ } else {
+#endif
+ /* deprecated code */
+ sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_SSL3, enableSSL3);
+ if (sslStatus != SECSuccess) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to %s SSLv3 "
+ "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ enableSSL3 ? "enable" : "disable",
+ errorCode, slapd_pr_strerror(errorCode));
+ }
- sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_TLS, enableTLS1);
- if (sslStatus != SECSuccess) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to %s TLSv1 "
- "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- enableTLS1 ? "enable" : "disable",
- errorCode, slapd_pr_strerror(errorCode));
+ sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_TLS, enableTLS1);
+ if (sslStatus != SECSuccess) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to %s TLSv1 "
+ "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ enableTLS1 ? "enable" : "disable",
+ errorCode, slapd_pr_strerror(errorCode));
+ }
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
}
+#endif
freeConfigEntry( &e );
if(( slapd_SSLclientAuth = config_get_SSLclientAuth()) != SLAPD_SSLCLIENTAUTH_OFF ) {
1
0
ldap/servers/slapd/auth.c | 115 +++++++++++-----------
ldap/servers/slapd/fedse.c | 17 ++-
ldap/servers/slapd/slapi-private.h | 19 +++
ldap/servers/slapd/ssl.c | 192 +++++++++++++++++++++++++++++++++----
4 files changed, 270 insertions(+), 73 deletions(-)
New commits:
commit 8550aaf90870e75b78bb6f393f9fd4aedb68d612
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 7 12:58:32 2015 -0800
Ticket #47880 - provide enabled ciphers as search result
Description: Implemented getEnabledCiphers, with which
ldapsearch -b "cn=encryption,cn=config" nsSSLEnabledCiphers
returns enabled cipher list. Example of returned enabled cipher
dn: cn=encryption,cn=config
nsSSLEnabledCiphers: TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128
nsSSLEnabledCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5::3DES::MD5::192
Back-ported commit c675243e018a89291760161998944c04ea04b12f
https://fedorahosted.org/389/ticket/47880
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index f8c95ce..6a8b6e6 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -75,6 +75,7 @@
#endif /* _WIN32 */
extern char ** getSupportedCiphers();
+extern char ** getEnabledCiphers();
/* Note: These DNs are no need to be normalized */
static const char *internal_entries[] =
@@ -1693,11 +1694,12 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
struct berval *vals[2];
struct berval val;
char ** cipherList = getSupportedCiphers(); /*Get the string array of supported ciphers here */
+ char ** enabledCipherList = getEnabledCiphers(); /*Get the string array of enabled ciphers here */
vals[0] = &val;
vals[1] = NULL;
attrlist_delete ( &entry->e_attrs, "nsSSLSupportedCiphers");
- while (*cipherList) /* iterarate thru each of them and add to the attr value */
+ while (cipherList && *cipherList) /* iterarate thru each of them and add to the attr value */
{
char *cipher = *cipherList;
val.bv_val = (char* ) cipher;
@@ -1706,6 +1708,16 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter
cipherList++;
}
+ attrlist_delete ( &entry->e_attrs, "nsSSLEnabledCiphers");
+ while (enabledCipherList && *enabledCipherList) /* iterarate thru each of them and add to the attr value */
+ {
+ char *cipher = *enabledCipherList;
+ val.bv_val = (char* ) cipher;
+ val.bv_len = strlen ( val.bv_val );
+ attrlist_merge ( &entry->e_attrs, "nsSSLEnabledCiphers", vals);
+ enabledCipherList++;
+ }
+
return SLAPI_DSE_CALLBACK_OK;
}
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index 23fa620..c30ebd6 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -128,6 +128,7 @@ static char * configDN = "cn=encryption,cn=config";
static char **cipher_names = NULL;
+static char **enabled_cipher_names = NULL;
typedef struct {
char *version;
char *name;
@@ -220,7 +221,8 @@ slapd_SSL_warn(char *fmt, ...)
va_end(args);
}
-char ** getSupportedCiphers()
+char **
+getSupportedCiphers()
{
SSLCipherSuiteInfo info;
char *sep = "::";
@@ -242,6 +244,44 @@ char ** getSupportedCiphers()
return cipher_names;
}
+char **
+getEnabledCiphers()
+{
+ SSLCipherSuiteInfo info;
+ char *sep = "::";
+ int number_of_ciphers = 0;
+ int x;
+ int idx = 0;
+ PRBool enabled;
+
+ /* We have to wait until the SSL initialization is done. */
+ if (!slapd_ssl_listener_is_initialized()) {
+ return NULL;
+ }
+ if ((enabled_cipher_names == NULL)) {
+ for (x = 0; _conf_ciphers[x].name; x++) {
+ SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
+ if (enabled) {
+ number_of_ciphers++;
+ }
+ }
+ enabled_cipher_names = (char **)slapi_ch_calloc((number_of_ciphers + 1), sizeof(char *));
+ for (x = 0; _conf_ciphers[x].name; x++) {
+ SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
+ if (enabled) {
+ SSL_GetCipherSuiteInfo((PRUint16)_conf_ciphers[x].num,&info,sizeof(info));
+ enabled_cipher_names[idx++] = PR_smprintf("%s%s%s%s%s%s%d",
+ _conf_ciphers[x].name,sep,
+ info.symCipherName,sep,
+ info.macAlgorithmName,sep,
+ info.symKeyBits);
+ }
+ }
+ }
+
+ return enabled_cipher_names;
+}
+
static PRBool
cipher_check_fips(int idx, char ***suplist, char ***unsuplist)
{
commit d62b281480c4c17438a6541c150bdb1e80abf14f
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Jan 7 11:35:32 2015 -0800
Ticket #47945 - Add SSL/TLS version info to the access log
Description: Added the currently used SSL library version info per
connection to the access log.
Sample output:
SSL
[..] conn=3 fd=64 slot=64 SSL connection from ::1 to ::1
[..] conn=3 TLS1.2 128-bit AES-GCM
startTLS
[..] conn=4 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[..] conn=4 op=0 RESULT err=0 tag=120 nentries=0 etime=0
[..] conn=4 TLS1.2 128-bit AES-GCM
To convert the SSL version number to string (e.g., SSL_LIBRARY_VERSION_
TLS_1_2 --> "TLS1.2"), instead of maintaining a mapping table, this
patch calculates the number and generates the version string.
Back-ported commit a2e0de3aa90f04593427628afeb7fe090dac93fb
https://fedorahosted.org/389/ticket/47945
diff --git a/ldap/servers/slapd/auth.c b/ldap/servers/slapd/auth.c
index 4976406..73f6c0e 100644
--- a/ldap/servers/slapd/auth.c
+++ b/ldap/servers/slapd/auth.c
@@ -433,6 +433,7 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
SSLChannelInfo channelInfo;
SSLCipherSuiteInfo cipherInfo;
char* subject = NULL;
+ char sslversion[64];
if ( (slapd_ssl_getChannelInfo (prfd, &channelInfo, sizeof(channelInfo))) != SECSuccess ) {
PRErrorCode errorCode = PR_GetError();
@@ -465,59 +466,63 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
}
}
+ (void) slapi_getSSLVersion_str(channelInfo.protocolVersion, sslversion, sizeof(sslversion));
if (config_get_SSLclientAuth() == SLAPD_SSLCLIENTAUTH_OFF ) {
- slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " SSL %i-bit %s\n",
- conn->c_connid, keySize, cipher ? cipher : "NULL" );
+ slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " %s %i-bit %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL" );
goto done;
- }
+ }
if (clientCert == NULL) {
- slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " SSL %i-bit %s\n",
- conn->c_connid, keySize, cipher ? cipher : "NULL" );
+ slapi_log_access (LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " %s %i-bit %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL" );
} else {
- subject = subject_of (clientCert);
- if (!subject) {
- slapi_log_access( LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL %i-bit %s; missing subject\n",
- conn->c_connid, keySize, cipher ? cipher : "NULL");
- goto done;
- }
- {
- char* issuer = issuer_of (clientCert);
- char sbuf[ BUFSIZ ], ibuf[ BUFSIZ ];
- slapi_log_access( LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL %i-bit %s; client %s; issuer %s\n",
- conn->c_connid, keySize, cipher ? cipher : "NULL",
- subject ? escape_string( subject, sbuf ) : "NULL",
- issuer ? escape_string( issuer, ibuf ) : "NULL");
- if (issuer) free (issuer);
- }
- slapi_dn_normalize (subject);
- {
- LDAPMessage* chain = NULL;
- char *basedn = config_get_basedn();
- int err;
-
- err = ldapu_cert_to_ldap_entry
- (clientCert, internal_ld, basedn?basedn:""/*baseDN*/, &chain);
- if (err == LDAPU_SUCCESS && chain) {
- LDAPMessage* entry = slapu_first_entry (internal_ld, chain);
- if (entry) {
- /* clientDN is duplicated in slapu_get_dn */
- clientDN = slapu_get_dn (internal_ld, entry);
- } else {
-
- extraErrorMsg = "no entry";
- LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %s\n",
- extraErrorMsg, 0, 0);
- }
- } else {
- extraErrorMsg = ldapu_err2string(err);
- LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %i (%s)%s\n",
- err, extraErrorMsg, chain ? "" : " NULL");
- }
- slapi_ch_free_string(&basedn);
- slapu_msgfree (internal_ld, chain);
- }
+ subject = subject_of (clientCert);
+ if (!subject) {
+ slapi_log_access( LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s %i-bit %s; missing subject\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL");
+ goto done;
+ }
+ {
+ char* issuer = issuer_of (clientCert);
+ char sbuf[ BUFSIZ ], ibuf[ BUFSIZ ];
+ slapi_log_access( LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s %i-bit %s; client %s; issuer %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, keySize, cipher ? cipher : "NULL",
+ subject ? escape_string( subject, sbuf ) : "NULL",
+ issuer ? escape_string( issuer, ibuf ) : "NULL");
+ if (issuer) free (issuer);
+ }
+ slapi_dn_normalize (subject);
+ {
+ LDAPMessage* chain = NULL;
+ char *basedn = config_get_basedn();
+ int err;
+
+ err = ldapu_cert_to_ldap_entry
+ (clientCert, internal_ld, basedn?basedn:""/*baseDN*/, &chain);
+ if (err == LDAPU_SUCCESS && chain) {
+ LDAPMessage* entry = slapu_first_entry (internal_ld, chain);
+ if (entry) {
+ /* clientDN is duplicated in slapu_get_dn */
+ clientDN = slapu_get_dn (internal_ld, entry);
+ } else {
+ extraErrorMsg = "no entry";
+ LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %s\n",
+ extraErrorMsg, 0, 0);
+ }
+ } else {
+ extraErrorMsg = ldapu_err2string(err);
+ LDAPDebug (LDAP_DEBUG_TRACE, "<= ldapu_cert_to_ldap_entry() %i (%s)%s\n",
+ err, extraErrorMsg, chain ? "" : " NULL");
+ }
+ slapi_ch_free_string(&basedn);
+ slapu_msgfree (internal_ld, chain);
+ }
}
if (clientDN != NULL) {
@@ -525,14 +530,16 @@ handle_handshake_done (PRFileDesc *prfd, void* clientData)
sdn = slapi_sdn_new_dn_passin(clientDN);
clientDN = slapi_ch_strdup(slapi_sdn_get_dn(sdn));
slapi_sdn_free(&sdn);
- slapi_log_access (LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL client bound as %s\n",
- conn->c_connid, clientDN);
+ slapi_log_access (LDAP_DEBUG_STATS,
+ "conn=%" NSPRIu64 " %s client bound as %s\n",
+ (long long unsigned int)conn->c_connid,
+ sslversion, clientDN);
} else if (clientCert != NULL) {
slapi_log_access (LDAP_DEBUG_STATS,
- "conn=%" NSPRIu64 " SSL failed to map client "
+ "conn=%" NSPRIu64 " %s failed to map client "
"certificate to LDAP DN (%s)\n",
- conn->c_connid, extraErrorMsg );
+ (long long unsigned int)conn->c_connid,
+ sslversion, extraErrorMsg);
}
/*
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index 8507f47..18f0e94 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -1278,6 +1278,25 @@ void modify_update_last_modified_attr(Slapi_PBlock *pb, Slapi_Mods *smods);
/* add.c */
void add_internal_modifiersname(Slapi_PBlock *pb, Slapi_Entry *e);
+/* ssl.c */
+/*
+ * If non NULL buf and positive bufsize is given,
+ * the memory is used to store the version string.
+ * Otherwise, the memory for the string is allocated.
+ * The latter case, caller is responsible to free it.
+ */
+/* vnum is supposed to be in one of the following:
+ * nss3/sslproto.h
+ * #define SSL_LIBRARY_VERSION_2 0x0002
+ * #define SSL_LIBRARY_VERSION_3_0 0x0300
+ * #define SSL_LIBRARY_VERSION_TLS_1_0 0x0301
+ * #define SSL_LIBRARY_VERSION_TLS_1_1 0x0302
+ * #define SSL_LIBRARY_VERSION_TLS_1_2 0x0303
+ * #define SSL_LIBRARY_VERSION_TLS_1_3 0x0304
+ * ...
+ */
+char *slapi_getSSLVersion_str(PRUint16 vnum, char *buf, size_t bufsize);
+
#ifdef __cplusplus
}
#endif
commit 17fc03cf1101135b99234f17efd3eb746626be1a
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Jan 6 16:23:35 2015 -0800
Ticket #47928 - Disable SSL v3, by default [389-ds-base-1.2.11 only]
Description:
[fedse.c]
By default, nsSSL3 is set to off and nsTLS1 is on in cn=encryption,cn=config.
[ssl.c]
Back-ported SSLVersionRange from the master branch, but no new range
parameter support in the config. If nsSSL3 is explicitely set to
on, SSL_LIBRARY_VERSION_3_0 is set to the minimum ssl version.
Otherwise, SSL_LIBRARY_VERSION_TLS_1_0 becomes the minimum version.
The max available version is set to the maximum ssl version.
On this version, there is no way to disable TLS1.0 and enable TLS1.1
and newer. If nsTLS1 is on, all TLS1.X are enabled.
Note: This patch covers Ticket #605 - support TLS 1.1, as well.
https://fedorahosted.org/389/ticket/47928
diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c
index dbfba16..f8c95ce 100644
--- a/ldap/servers/slapd/fedse.c
+++ b/ldap/servers/slapd/fedse.c
@@ -107,7 +107,8 @@ static const char *internal_entries[] =
"nsSSLSessionTimeout:0\n"
"nsSSLClientAuth:allowed\n"
"nsSSL2:off\n"
- "nsSSL3:off\n",
+ "nsSSL3:off\n"
+ "nsTLS1:on\n",
"dn:cn=monitor\n"
"objectclass:top\n"
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index bbadf93..23fa620 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -79,6 +79,24 @@
#define MAXPATHLEN 1024
#endif
+#if NSS_VMAJOR * 100 + NSS_VMINOR >= 315
+/* TLS1.2 is defined in RFC5246. */
+#define NSS_TLS12 1
+#elif NSS_VMAJOR * 100 + NSS_VMINOR >= 314
+/* TLS1.1 is defined in RFC4346. */
+#define NSS_TLS11 1
+#else
+#define NSS_TLS10 1
+#endif
+
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+static SSLVersionRange enabledNSSVersions;
+static SSLVersionRange slapdNSSVersions;
+#endif
+
+/* E.g., "SSL3", "TLS1.2", "Unknown SSL version: 0x0" */
+#define VERSION_STR_LENGTH 64
+
extern char* slapd_SSL3ciphers;
extern symbol_t supported_ciphers[];
@@ -165,6 +183,12 @@ static cipherstruct _conf_ciphers[] = {
/*{"TLS","tls_dhe_dss_1024_des_sha", TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA}, */
{"TLS","tls_dhe_dss_1024_rc4_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA},
{"TLS","tls_dhe_dss_rc4_128_sha", TLS_DHE_DSS_WITH_RC4_128_SHA},
+#if defined(NSS_TLS12)
+ /* New in NSS 3.15 */
+ {"tls_rsa_aes_128_gcm_sha", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
+ {"tls_dhe_rsa_aes_128_gcm_sha", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"},
+ {"tls_dhe_dss_aes_128_gcm_sha", NULL}, /* not available */
+#endif
{NULL, NULL, 0}
};
@@ -524,6 +548,54 @@ warn_if_no_key_file(const char *dir, int no_log)
return ret;
}
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+/*
+ * If non NULL buf and positive bufsize is given,
+ * the memory is used to store the version string.
+ * Otherwise, the memory for the string is allocated.
+ * The latter case, caller is responsible to free it.
+ */
+char *
+slapi_getSSLVersion_str(PRUint16 vnum, char *buf, size_t bufsize)
+{
+ char *vstr = buf;
+ if (vnum >= SSL_LIBRARY_VERSION_3_0) {
+ if (vnum == SSL_LIBRARY_VERSION_3_0) { /* SSL3 */
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "SSL3");
+ } else {
+ vstr = slapi_ch_smprintf("SSL3");
+ }
+ } else { /* TLS v X.Y */
+ const char *TLSFMT = "TLS%d.%d";
+ int minor_offset = 0; /* e.g. 0x0401 -> TLS v 2.1, not 2.0 */
+
+ if ((vnum & SSL_LIBRARY_VERSION_3_0) == SSL_LIBRARY_VERSION_3_0) {
+ minor_offset = 1; /* e.g. 0x0301 -> TLS v 1.0, not 1.1 */
+ }
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, TLSFMT, (vnum >> 8) - 2, (vnum & 0xff) - minor_offset);
+ } else {
+ vstr = slapi_ch_smprintf(TLSFMT, (vnum >> 8) - 2, (vnum & 0xff) - minor_offset);
+ }
+ }
+ } else if (vnum == SSL_LIBRARY_VERSION_2) { /* SSL2 */
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "SSL2");
+ } else {
+ vstr = slapi_ch_smprintf("SSL2");
+ }
+ } else {
+ if (buf && bufsize) {
+ PR_snprintf(buf, bufsize, "Unknown SSL version: 0x%x", vnum);
+ } else {
+ vstr = slapi_ch_smprintf("Unknown SSL version: 0x%x", vnum);
+ }
+ }
+ return vstr;
+}
+#endif
+
/*
* slapd_nss_init() is always called from main(), even if we do not
* plan to listen on a secure port. If config_available is 0, the
@@ -548,6 +620,17 @@ slapd_nss_init(int init_ssl, int config_available)
char *certdb_file_name = NULL;
char *keydb_file_name = NULL;
char *secmoddb_file_name = NULL;
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ char emin[VERSION_STR_LENGTH], emax[VERSION_STR_LENGTH];
+ /* Get the range of the supported SSL version */
+ SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
+
+ (void) slapi_getSSLVersion_str(enabledNSSVersions.min, emin, sizeof(emin));
+ (void) slapi_getSSLVersion_str(enabledNSSVersions.max, emax, sizeof(emax));
+ slapi_log_error(SLAPI_LOG_CONFIG, "SSL Initialization",
+ "supported range by NSS: min: %s, max: %s\n",
+ emin, emax);
+#endif
/* set in slapd_bootstrap_config,
thus certdir is available even if config_available is false */
@@ -879,9 +962,13 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
char* tmpDir;
Slapi_Entry *e = NULL;
PRBool enableSSL2 = PR_FALSE;
- PRBool enableSSL3 = PR_TRUE;
+ PRBool enableSSL3 = PR_FALSE;
PRBool enableTLS1 = PR_TRUE;
PRBool fipsMode = PR_FALSE;
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ PRUint16 NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
+ PRUint16 NSSVersionMax = enabledNSSVersions.max;
+#endif
/* turn off the PKCS11 pin interactive mode */
#ifndef _WIN32
@@ -1226,23 +1313,54 @@ int slapd_ssl_init2(PRFileDesc **fd, int startTLS)
}
slapi_ch_free_string( &val );
}
- sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_SSL3, enableSSL3);
- if (sslStatus != SECSuccess) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to %s SSLv3 "
- "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- enableSSL3 ? "enable" : "disable",
- errorCode, slapd_pr_strerror(errorCode));
- }
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
+ if (NSSVersionMin > 0) {
+ char mymin[VERSION_STR_LENGTH], mymax[VERSION_STR_LENGTH];
+ /* Use new NSS API SSL_VersionRangeSet (NSS3.14 or newer) */
+ if (enableTLS1) {
+ NSSVersionMin = SSL_LIBRARY_VERSION_TLS_1_0;
+ }
+ if (enableSSL3) {
+ NSSVersionMin = SSL_LIBRARY_VERSION_3_0;
+ }
+ slapdNSSVersions.min = NSSVersionMin;
+ slapdNSSVersions.max = NSSVersionMax;
+ (void) slapi_getSSLVersion_str(slapdNSSVersions.min, mymin, sizeof(mymin));
+ (void) slapi_getSSLVersion_str(slapdNSSVersions.max, mymax, sizeof(mymax));
+ slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization",
+ "Configured SSL version range: min: %s, max: %s\n",
+ mymin, mymax);
+ sslStatus = SSL_VersionRangeSet(pr_sock, &slapdNSSVersions);
+ if (sslStatus == SECSuccess) {
+ /* Set the restricted value to the cn=encryption entry */
+ } else {
+ slapd_SSL_error("SSL Initialization 2: "
+ "Failed to set SSL range: min: %s, max: %s\n",
+ mymin, mymax);
+ }
+ } else {
+#endif
+ /* deprecated code */
+ sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_SSL3, enableSSL3);
+ if (sslStatus != SECSuccess) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to %s SSLv3 "
+ "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ enableSSL3 ? "enable" : "disable",
+ errorCode, slapd_pr_strerror(errorCode));
+ }
- sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_TLS, enableTLS1);
- if (sslStatus != SECSuccess) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Failed to %s TLSv1 "
- "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- enableTLS1 ? "enable" : "disable",
- errorCode, slapd_pr_strerror(errorCode));
+ sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_TLS, enableTLS1);
+ if (sslStatus != SECSuccess) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Failed to %s TLSv1 "
+ "on the imported socket (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ enableTLS1 ? "enable" : "disable",
+ errorCode, slapd_pr_strerror(errorCode));
+ }
+#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
}
+#endif
freeConfigEntry( &e );
if(( slapd_SSLclientAuth = config_get_SSLclientAuth()) != SLAPD_SSLCLIENTAUTH_OFF ) {
1
0
ldap/admin/src/logconv.pl | 69 +++++++++++++++++++++++++++++++++++-----------
1 file changed, 53 insertions(+), 16 deletions(-)
New commits:
commit 099d1ce8c8e230bc41e5d77cb042c65b99f60d60
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Dec 5 15:42:45 2014 -0500
Ticket 47949 - logconv.pl -- support parsing/showing/reporting different protocol versions
Description: Update script to report on the secure protocol versions that are now available
in the access log.
Also, revised the connection section output, cleaned up the SASL bind report,
and handled issue with log(s) that only span 1 second(0 elapsed time)
https://fedorahosted.org/389/ticket/47949
Reviewed by: nhosoi & rmeggins(Thanks!!)
(cherry picked from commit 7aeeb7c968a03f4a75c8338ffbd7cbbaa73e102d)
(cherry picked from commit 8b7ae6d930927171c7976fe9093f2f765714c8ac)
diff --git a/ldap/admin/src/logconv.pl b/ldap/admin/src/logconv.pl
index cd45a8b..11dc335 100755
--- a/ldap/admin/src/logconv.pl
+++ b/ldap/admin/src/logconv.pl
@@ -67,7 +67,7 @@ if ($#ARGV < 0){;
my $file_count = 0;
my $arg_count = 0;
-my $logversion = "8.0";
+my $logversion = "8.1";
my $sizeCount = "20";
my $startFlag = 0;
my $startTime = 0;
@@ -258,7 +258,14 @@ my $startTLSCount = 0;
my $ldapiCount = 0;
my $autobindCount = 0;
my $limit = 25000; # number of lines processed to trigger output
-
+my $searchStat;
+my $modStat;
+my $addStat;
+my $deleteStat;
+my $modrdnStat;
+my $compareStat;
+my $bindCountStat;
+my %cipher = ();
my @removefiles = ();
my @conncodes = qw(A1 B1 B4 T1 T2 B2 B3 R1 P1 P2 U1);
@@ -623,27 +630,45 @@ if($reportStats ne ""){
print "Restarts: $serverRestartCount\n";
print "Total Connections: $connectionCount\n";
-print " - StartTLS Connections: $startTLSCount\n";
-print " - LDAPS Connections: $sslCount\n";
+print " - LDAP Connections: " . ($connectionCount - $sslCount - $ldapiCount) . "\n";
print " - LDAPI Connections: $ldapiCount\n";
+print " - LDAPS Connections: $sslCount\n";
+print " - StartTLS Extended Ops: $startTLSCount\n";
+if(%cipher){
+ print " Secure Protocol Versions:\n";
+ foreach my $key (sort { $b cmp $a } keys %cipher) {
+ print " - $key - $cipher{$key}\n";
+ }
+ print "\n";
+}
+
print "Peak Concurrent Connections: $maxsimConnection\n";
print "Total Operations: $allOps\n";
print "Total Results: $allResults\n";
my ($perf, $tmp);
if ($allOps ne "0"){
- print sprintf "Overall Performance: %.1f%%\n\n" , ($perf = ($tmp = ($allResults / $allOps)*100) > 100 ? 100.0 : $tmp) ;
- }
-else {
- print "Overall Performance: No Operations to evaluate\n\n";
+ print sprintf "Overall Performance: %.1f%%\n\n" , ($perf = ($tmp = ($allResults / $allOps)*100) > 100 ? 100.0 : $tmp) ;
+} else {
+ print "Overall Performance: No Operations to evaluate\n\n";
}
-my $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n",($srchCount / $totalTimeInSecs), $srchCount / ($totalTimeInSecs/60);
-my $modStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modCount / $totalTimeInSecs, $modCount/($totalTimeInSecs/60);
-my $addStat = sprintf "(%.2f/sec) (%.2f/min)\n",$addCount/$totalTimeInSecs, $addCount/($totalTimeInSecs/60);
-my $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n",$delCount/$totalTimeInSecs, $delCount/($totalTimeInSecs/60);
-my $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modrdnCount/$totalTimeInSecs, $modrdnCount/($totalTimeInSecs/60);
-my $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs, $cmpCount/($totalTimeInSecs/60);
-my $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
+if ($totalTimeInSecs == 0){
+ $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $modStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $addStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+} else {
+ $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n",($srchCount / $totalTimeInSecs), $srchCount / ($totalTimeInSecs/60);
+ $modStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modCount / $totalTimeInSecs, $modCount/($totalTimeInSecs/60);
+ $addStat = sprintf "(%.2f/sec) (%.2f/min)\n",$addCount/$totalTimeInSecs, $addCount/($totalTimeInSecs/60);
+ $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n",$delCount/$totalTimeInSecs, $delCount/($totalTimeInSecs/60);
+ $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modrdnCount/$totalTimeInSecs, $modrdnCount/($totalTimeInSecs/60);
+ $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs, $cmpCount/($totalTimeInSecs/60);
+ $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
+}
format STDOUT =
Searches: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
@@ -844,7 +869,7 @@ print " - SASL Binds: $saslBindCount\n";
if ($saslBindCount > 0){
my $saslmech = $hashes->{saslmech};
foreach my $saslb ( sort {$saslmech->{$b} <=> $saslmech->{$a} } (keys %{$saslmech}) ){
- printf " %-4s %-12s\n",$saslmech->{$saslb}, $saslb;
+ printf " %-4s - %s\n",$saslb, $saslmech->{$saslb};
}
}
@@ -1776,6 +1801,18 @@ sub parseLineNormal
handleRestart();
}
if (m/ SSL connection from/){$sslCount++; if($reportStats){ inc_stats('sslconns',$s_stats,$m_stats); }}
+ # Gather TLS and SSL version info
+ if ($_ =~ /conn= *([0-9A-Z]+) TLS *(.*)/){
+ $cipher{"TLS" . $2}++;
+ }
+ if ($_ =~ /conn= *([0-9A-Z]+) SSL *(.*)/){
+ my $sslversion = $2;
+ if(/SSL /){
+ $cipher{"SSL " . $sslversion}++;
+ } else {
+ $cipher{"SSL" . $sslversion}++;
+ }
+ }
if (m/ connection from local to /){$ldapiCount++;}
if($_ =~ /AUTOBIND dn=\"(.*)\"/){
$autobindCount++;
1
0
ldap/admin/src/logconv.pl | 69 +++++++++++++++++++++++++++++++++++-----------
1 file changed, 53 insertions(+), 16 deletions(-)
New commits:
commit d1b5c7a63d12d1700db83ca5db95d2d2e6da87cd
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Dec 5 15:42:45 2014 -0500
Ticket 47949 - logconv.pl -- support parsing/showing/reporting different protocol versions
Description: Update script to report on the secure protocol versions that are now available
in the access log.
Also, revised the connection section output, cleaned up the SASL bind report,
and handled issue with log(s) that only span 1 second(0 elapsed time)
https://fedorahosted.org/389/ticket/47949
Reviewed by: nhosoi & rmeggins(Thanks!!)
(cherry picked from commit 7aeeb7c968a03f4a75c8338ffbd7cbbaa73e102d)
(cherry picked from commit 8b7ae6d930927171c7976fe9093f2f765714c8ac)
diff --git a/ldap/admin/src/logconv.pl b/ldap/admin/src/logconv.pl
index cd45a8b..11dc335 100755
--- a/ldap/admin/src/logconv.pl
+++ b/ldap/admin/src/logconv.pl
@@ -67,7 +67,7 @@ if ($#ARGV < 0){;
my $file_count = 0;
my $arg_count = 0;
-my $logversion = "8.0";
+my $logversion = "8.1";
my $sizeCount = "20";
my $startFlag = 0;
my $startTime = 0;
@@ -258,7 +258,14 @@ my $startTLSCount = 0;
my $ldapiCount = 0;
my $autobindCount = 0;
my $limit = 25000; # number of lines processed to trigger output
-
+my $searchStat;
+my $modStat;
+my $addStat;
+my $deleteStat;
+my $modrdnStat;
+my $compareStat;
+my $bindCountStat;
+my %cipher = ();
my @removefiles = ();
my @conncodes = qw(A1 B1 B4 T1 T2 B2 B3 R1 P1 P2 U1);
@@ -623,27 +630,45 @@ if($reportStats ne ""){
print "Restarts: $serverRestartCount\n";
print "Total Connections: $connectionCount\n";
-print " - StartTLS Connections: $startTLSCount\n";
-print " - LDAPS Connections: $sslCount\n";
+print " - LDAP Connections: " . ($connectionCount - $sslCount - $ldapiCount) . "\n";
print " - LDAPI Connections: $ldapiCount\n";
+print " - LDAPS Connections: $sslCount\n";
+print " - StartTLS Extended Ops: $startTLSCount\n";
+if(%cipher){
+ print " Secure Protocol Versions:\n";
+ foreach my $key (sort { $b cmp $a } keys %cipher) {
+ print " - $key - $cipher{$key}\n";
+ }
+ print "\n";
+}
+
print "Peak Concurrent Connections: $maxsimConnection\n";
print "Total Operations: $allOps\n";
print "Total Results: $allResults\n";
my ($perf, $tmp);
if ($allOps ne "0"){
- print sprintf "Overall Performance: %.1f%%\n\n" , ($perf = ($tmp = ($allResults / $allOps)*100) > 100 ? 100.0 : $tmp) ;
- }
-else {
- print "Overall Performance: No Operations to evaluate\n\n";
+ print sprintf "Overall Performance: %.1f%%\n\n" , ($perf = ($tmp = ($allResults / $allOps)*100) > 100 ? 100.0 : $tmp) ;
+} else {
+ print "Overall Performance: No Operations to evaluate\n\n";
}
-my $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n",($srchCount / $totalTimeInSecs), $srchCount / ($totalTimeInSecs/60);
-my $modStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modCount / $totalTimeInSecs, $modCount/($totalTimeInSecs/60);
-my $addStat = sprintf "(%.2f/sec) (%.2f/min)\n",$addCount/$totalTimeInSecs, $addCount/($totalTimeInSecs/60);
-my $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n",$delCount/$totalTimeInSecs, $delCount/($totalTimeInSecs/60);
-my $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modrdnCount/$totalTimeInSecs, $modrdnCount/($totalTimeInSecs/60);
-my $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs, $cmpCount/($totalTimeInSecs/60);
-my $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
+if ($totalTimeInSecs == 0){
+ $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $modStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $addStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+} else {
+ $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n",($srchCount / $totalTimeInSecs), $srchCount / ($totalTimeInSecs/60);
+ $modStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modCount / $totalTimeInSecs, $modCount/($totalTimeInSecs/60);
+ $addStat = sprintf "(%.2f/sec) (%.2f/min)\n",$addCount/$totalTimeInSecs, $addCount/($totalTimeInSecs/60);
+ $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n",$delCount/$totalTimeInSecs, $delCount/($totalTimeInSecs/60);
+ $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modrdnCount/$totalTimeInSecs, $modrdnCount/($totalTimeInSecs/60);
+ $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs, $cmpCount/($totalTimeInSecs/60);
+ $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
+}
format STDOUT =
Searches: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
@@ -844,7 +869,7 @@ print " - SASL Binds: $saslBindCount\n";
if ($saslBindCount > 0){
my $saslmech = $hashes->{saslmech};
foreach my $saslb ( sort {$saslmech->{$b} <=> $saslmech->{$a} } (keys %{$saslmech}) ){
- printf " %-4s %-12s\n",$saslmech->{$saslb}, $saslb;
+ printf " %-4s - %s\n",$saslb, $saslmech->{$saslb};
}
}
@@ -1776,6 +1801,18 @@ sub parseLineNormal
handleRestart();
}
if (m/ SSL connection from/){$sslCount++; if($reportStats){ inc_stats('sslconns',$s_stats,$m_stats); }}
+ # Gather TLS and SSL version info
+ if ($_ =~ /conn= *([0-9A-Z]+) TLS *(.*)/){
+ $cipher{"TLS" . $2}++;
+ }
+ if ($_ =~ /conn= *([0-9A-Z]+) SSL *(.*)/){
+ my $sslversion = $2;
+ if(/SSL /){
+ $cipher{"SSL " . $sslversion}++;
+ } else {
+ $cipher{"SSL" . $sslversion}++;
+ }
+ }
if (m/ connection from local to /){$ldapiCount++;}
if($_ =~ /AUTOBIND dn=\"(.*)\"/){
$autobindCount++;
1
0
ldap/admin/src/logconv.pl | 69 +++++++++++++++++++++++++++++++++++-----------
1 file changed, 53 insertions(+), 16 deletions(-)
New commits:
commit a31bd5c2d65a715dc3e03586e86dad665c44e06a
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Dec 5 15:42:45 2014 -0500
Ticket 47949 - logconv.pl -- support parsing/showing/reporting different protocol versions
Description: Update script to report on the secure protocol versions that are now available
in the access log.
Also, revised the connection section output, cleaned up the SASL bind report,
and handled issue with log(s) that only span 1 second(0 elapsed time)
https://fedorahosted.org/389/ticket/47949
Reviewed by: nhosoi & rmeggins(Thanks!!)
(cherry picked from commit 7aeeb7c968a03f4a75c8338ffbd7cbbaa73e102d)
(cherry picked from commit 8b7ae6d930927171c7976fe9093f2f765714c8ac)
diff --git a/ldap/admin/src/logconv.pl b/ldap/admin/src/logconv.pl
index cd45a8b..11dc335 100755
--- a/ldap/admin/src/logconv.pl
+++ b/ldap/admin/src/logconv.pl
@@ -67,7 +67,7 @@ if ($#ARGV < 0){;
my $file_count = 0;
my $arg_count = 0;
-my $logversion = "8.0";
+my $logversion = "8.1";
my $sizeCount = "20";
my $startFlag = 0;
my $startTime = 0;
@@ -258,7 +258,14 @@ my $startTLSCount = 0;
my $ldapiCount = 0;
my $autobindCount = 0;
my $limit = 25000; # number of lines processed to trigger output
-
+my $searchStat;
+my $modStat;
+my $addStat;
+my $deleteStat;
+my $modrdnStat;
+my $compareStat;
+my $bindCountStat;
+my %cipher = ();
my @removefiles = ();
my @conncodes = qw(A1 B1 B4 T1 T2 B2 B3 R1 P1 P2 U1);
@@ -623,27 +630,45 @@ if($reportStats ne ""){
print "Restarts: $serverRestartCount\n";
print "Total Connections: $connectionCount\n";
-print " - StartTLS Connections: $startTLSCount\n";
-print " - LDAPS Connections: $sslCount\n";
+print " - LDAP Connections: " . ($connectionCount - $sslCount - $ldapiCount) . "\n";
print " - LDAPI Connections: $ldapiCount\n";
+print " - LDAPS Connections: $sslCount\n";
+print " - StartTLS Extended Ops: $startTLSCount\n";
+if(%cipher){
+ print " Secure Protocol Versions:\n";
+ foreach my $key (sort { $b cmp $a } keys %cipher) {
+ print " - $key - $cipher{$key}\n";
+ }
+ print "\n";
+}
+
print "Peak Concurrent Connections: $maxsimConnection\n";
print "Total Operations: $allOps\n";
print "Total Results: $allResults\n";
my ($perf, $tmp);
if ($allOps ne "0"){
- print sprintf "Overall Performance: %.1f%%\n\n" , ($perf = ($tmp = ($allResults / $allOps)*100) > 100 ? 100.0 : $tmp) ;
- }
-else {
- print "Overall Performance: No Operations to evaluate\n\n";
+ print sprintf "Overall Performance: %.1f%%\n\n" , ($perf = ($tmp = ($allResults / $allOps)*100) > 100 ? 100.0 : $tmp) ;
+} else {
+ print "Overall Performance: No Operations to evaluate\n\n";
}
-my $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n",($srchCount / $totalTimeInSecs), $srchCount / ($totalTimeInSecs/60);
-my $modStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modCount / $totalTimeInSecs, $modCount/($totalTimeInSecs/60);
-my $addStat = sprintf "(%.2f/sec) (%.2f/min)\n",$addCount/$totalTimeInSecs, $addCount/($totalTimeInSecs/60);
-my $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n",$delCount/$totalTimeInSecs, $delCount/($totalTimeInSecs/60);
-my $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modrdnCount/$totalTimeInSecs, $modrdnCount/($totalTimeInSecs/60);
-my $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs, $cmpCount/($totalTimeInSecs/60);
-my $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
+if ($totalTimeInSecs == 0){
+ $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $modStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $addStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+ $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n","0", "0";
+} else {
+ $searchStat = sprintf "(%.2f/sec) (%.2f/min)\n",($srchCount / $totalTimeInSecs), $srchCount / ($totalTimeInSecs/60);
+ $modStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modCount / $totalTimeInSecs, $modCount/($totalTimeInSecs/60);
+ $addStat = sprintf "(%.2f/sec) (%.2f/min)\n",$addCount/$totalTimeInSecs, $addCount/($totalTimeInSecs/60);
+ $deleteStat = sprintf "(%.2f/sec) (%.2f/min)\n",$delCount/$totalTimeInSecs, $delCount/($totalTimeInSecs/60);
+ $modrdnStat = sprintf "(%.2f/sec) (%.2f/min)\n",$modrdnCount/$totalTimeInSecs, $modrdnCount/($totalTimeInSecs/60);
+ $compareStat = sprintf "(%.2f/sec) (%.2f/min)\n",$cmpCount/$totalTimeInSecs, $cmpCount/($totalTimeInSecs/60);
+ $bindCountStat = sprintf "(%.2f/sec) (%.2f/min)\n",$bindCount/$totalTimeInSecs, $bindCount/($totalTimeInSecs/60);
+}
format STDOUT =
Searches: @<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
@@ -844,7 +869,7 @@ print " - SASL Binds: $saslBindCount\n";
if ($saslBindCount > 0){
my $saslmech = $hashes->{saslmech};
foreach my $saslb ( sort {$saslmech->{$b} <=> $saslmech->{$a} } (keys %{$saslmech}) ){
- printf " %-4s %-12s\n",$saslmech->{$saslb}, $saslb;
+ printf " %-4s - %s\n",$saslb, $saslmech->{$saslb};
}
}
@@ -1776,6 +1801,18 @@ sub parseLineNormal
handleRestart();
}
if (m/ SSL connection from/){$sslCount++; if($reportStats){ inc_stats('sslconns',$s_stats,$m_stats); }}
+ # Gather TLS and SSL version info
+ if ($_ =~ /conn= *([0-9A-Z]+) TLS *(.*)/){
+ $cipher{"TLS" . $2}++;
+ }
+ if ($_ =~ /conn= *([0-9A-Z]+) SSL *(.*)/){
+ my $sslversion = $2;
+ if(/SSL /){
+ $cipher{"SSL " . $sslversion}++;
+ } else {
+ $cipher{"SSL" . $sslversion}++;
+ }
+ }
if (m/ connection from local to /){$ldapiCount++;}
if($_ =~ /AUTOBIND dn=\"(.*)\"/){
$autobindCount++;
1
0
07 Jan '15
dirsrvtests/tickets/ticket47981_test.py | 345 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 34 +--
2 files changed, 359 insertions(+), 20 deletions(-)
New commits:
commit c1ba7eb8c41c44bd7689bfc2526a2aa7fff47284
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 7 08:59:06 2015 -0500
Ticket 47981 - COS cache doesn't properly mark vattr cache as
invalid when there are multiple suffixes
Bug Description: When rebuilding the COS cache, we check each suffix for COS entries.
If the last suffix checked does not contain any COS entries, then the
virtual attribute cache is incorrectly not invalidated. This allows
for already cached entries to hold onto the old COS attributes/values.
Fix Description: Only set the vattr_cacheable flag if a suffix contains COS entries, not
if it does not - by default the flag is not set.
https://fedorahosted.org/389/ticket/47981
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 42e2df3858a4e14706d57b5c907d1d3768f4d970)
diff --git a/dirsrvtests/tickets/ticket47981_test.py b/dirsrvtests/tickets/ticket47981_test.py
new file mode 100644
index 0000000..2a16ce6
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47981_test.py
@@ -0,0 +1,345 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH = 'ou=people,' + DEFAULT_SUFFIX
+USER_DN = 'uid=user1,%s' % (BRANCH)
+BRANCH_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+BRANCH_PWP = 'cn=cn\\3DnsPwPolicyEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH_COS_TMPL = 'cn=cn\\3DnsPwTemplateEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+SECOND_SUFFIX = 'o=netscaperoot'
+BE_NAME = 'netscaperoot'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def addSubtreePwPolicy(inst):
+ #
+ # Add subtree policy to the people branch
+ #
+ try:
+ inst.add_s(Entry((BRANCH_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for ou=people: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ inst.add_s(Entry((BRANCH_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ inst.add_s(Entry((BRANCH_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ inst.add_s(Entry((BRANCH_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def delSubtreePwPolicy(inst):
+ try:
+ inst.delete_s(BRANCH_COS_DEF)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS def: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_COS_TMPL)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS template: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_PWP)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS password policy: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_CONTAINER)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS container: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def test_ticket47981(topology):
+ """
+ If there are multiple suffixes, and the last suffix checked does not contain any COS entries,
+ while other suffixes do, then the vattr cache is not invalidated as it should be. Then any
+ cached entries will still contain the old COS attributes/values.
+ """
+
+ log.info('Testing Ticket 47981 - Test that COS def changes are correctly reflected in affected users')
+
+ #
+ # Create a second backend that does not have any COS entries
+ #
+ log.info('Adding second suffix that will not contain any COS entries...\n')
+
+ topology.standalone.backend.create(SECOND_SUFFIX, {BACKEND_NAME: BE_NAME})
+ topology.standalone.mappingtree.create(SECOND_SUFFIX, bename=BE_NAME)
+ try:
+ topology.standalone.add_s(Entry((SECOND_SUFFIX, {
+ 'objectclass': 'top organization'.split(),
+ 'o': BE_NAME})))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to create suffix entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add People branch, it might already exist
+ #
+ log.info('Add our test entries to the default suffix, and proceed with the test...')
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add a user to the branch
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Enable password policy and add the subtree policy
+ #
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ addSubtreePwPolicy(topology.standalone)
+
+ #
+ # Now check the user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER_DN,
+ ldap.SCOPE_BASE,
+ '(objectclass=top)',
+ ['pwdpolicysubentry', 'dn'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Delete the password policy and make sure it is removed from the same user
+ #
+ delSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User unexpectedly does have the pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Add the subtree policvy back and see if the user now has it
+ #
+ addSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47981_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47981(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index 76cc8fd..f41c3de 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -300,7 +300,7 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
/* cosDefinitions manipulation */
static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_cacheable);
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable);
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs);
static int cos_cache_add_defn(cosDefinitions **pDefs, cosAttrValue **dn, int cosType, cosAttrValue **tree, cosAttrValue **tmpDn, cosAttrValue **spec, cosAttrValue **pAttrs, cosAttrValue **pOverrides, cosAttrValue **pOperational, cosAttrValue **pCosMerge, cosAttrValue **pCosOpDefault);
static int cos_cache_entry_is_cos_related( Slapi_Entry *e);
@@ -659,9 +659,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_TRACE, "--> cos_cache_build_definition_list\n",0,0,0);
/*
- the class of service definitions may be anywhere in the DIT,
- so our first task is to find them.
- */
+ * The class of service definitions may be anywhere in the DIT,
+ * so our first task is to find them.
+ */
attrs[0] = "namingcontexts";
attrs[1] = 0;
@@ -669,9 +669,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_PLUGIN, "cos: Building class of service cache after status change.\n",0,0,0);
/*
- * XXXrbyrne: this looks really ineficient--should be using
+ * XXXrbyrne: this looks really inefficient--should be using
* slapi_get_next_suffix(), rather than searching for namingcontexts.
- */
+ */
pSuffixSearch = slapi_search_internal("",LDAP_SCOPE_BASE,"(objectclass=*)",NULL,attrs,0);
if(pSuffixSearch)
@@ -711,19 +711,21 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
{
/* here's a suffix, lets search it... */
if(suffixVals[valIndex]->bv_val)
- if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs, vattr_cacheable))
+ {
+ if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs))
+ {
+ *vattr_cacheable = -1;
cos_def_available = 1;
-
+ break;
+ }
+ }
valIndex++;
}
-
-
ber_bvecfree( suffixVals );
suffixVals = NULL;
}
}
}
-
} while(!slapi_entry_next_attr(pSuffixList[suffixIndex], suffixAttr, &suffixAttr));
}
suffixIndex++;
@@ -749,7 +751,6 @@ next:
slapi_pblock_destroy(pSuffixSearch);
}
-
LDAPDebug( LDAP_DEBUG_TRACE, "<-- cos_cache_build_definition_list\n",0,0,0);
return ret;
}
@@ -790,10 +791,6 @@ cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
char *norm_dn = NULL;
info=(struct dn_defs_info *)callback_data;
-
- /* assume cacheable */
- info->vattr_cacheable = -1;
-
cos_cache_add_attrval(&pDn, slapi_entry_get_dn(e));
if(slapi_entry_first_attr(e, &dnAttr)) {
goto bail;
@@ -1119,7 +1116,7 @@ bail:
#define DN_DEF_FILTER "(&(|(objectclass=cosSuperDefinition)(objectclass=cosDefinition))(objectclass=ldapsubentry))"
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable)
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs)
{
Slapi_PBlock *pDnSearch = 0;
struct dn_defs_info info = {NULL, 0, 0};
@@ -1127,7 +1124,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
if (pDnSearch) {
info.ret=-1; /* assume no good defs */
info.pDefs=pDefs;
- info.vattr_cacheable = 0; /* assume not cacheable */
slapi_search_internal_set_pb(pDnSearch, dn, LDAP_SCOPE_SUBTREE,
DN_DEF_FILTER,NULL,0,
NULL,NULL,cos_get_plugin_identity(),0);
@@ -1139,8 +1135,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
slapi_pblock_destroy (pDnSearch);
}
- *vattr_cacheable = info.vattr_cacheable;
-
return info.ret;
}
1
0
07 Jan '15
dirsrvtests/tickets/ticket47981_test.py | 345 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 34 +--
2 files changed, 359 insertions(+), 20 deletions(-)
New commits:
commit c7c0e753d03349efc7f36654529a3be907d3187c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 7 08:59:06 2015 -0500
Ticket 47981 - COS cache doesn't properly mark vattr cache as
invalid when there are multiple suffixes
Bug Description: When rebuilding the COS cache, we check each suffix for COS entries.
If the last suffix checked does not contain any COS entries, then the
virtual attribute cache is incorrectly not invalidated. This allows
for already cached entries to hold onto the old COS attributes/values.
Fix Description: Only set the vattr_cacheable flag if a suffix contains COS entries, not
if it does not - by default the flag is not set.
https://fedorahosted.org/389/ticket/47981
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 42e2df3858a4e14706d57b5c907d1d3768f4d970)
diff --git a/dirsrvtests/tickets/ticket47981_test.py b/dirsrvtests/tickets/ticket47981_test.py
new file mode 100644
index 0000000..2a16ce6
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47981_test.py
@@ -0,0 +1,345 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH = 'ou=people,' + DEFAULT_SUFFIX
+USER_DN = 'uid=user1,%s' % (BRANCH)
+BRANCH_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+BRANCH_PWP = 'cn=cn\\3DnsPwPolicyEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH_COS_TMPL = 'cn=cn\\3DnsPwTemplateEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+SECOND_SUFFIX = 'o=netscaperoot'
+BE_NAME = 'netscaperoot'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def addSubtreePwPolicy(inst):
+ #
+ # Add subtree policy to the people branch
+ #
+ try:
+ inst.add_s(Entry((BRANCH_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for ou=people: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ inst.add_s(Entry((BRANCH_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ inst.add_s(Entry((BRANCH_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ inst.add_s(Entry((BRANCH_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def delSubtreePwPolicy(inst):
+ try:
+ inst.delete_s(BRANCH_COS_DEF)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS def: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_COS_TMPL)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS template: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_PWP)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS password policy: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_CONTAINER)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS container: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def test_ticket47981(topology):
+ """
+ If there are multiple suffixes, and the last suffix checked does not contain any COS entries,
+ while other suffixes do, then the vattr cache is not invalidated as it should be. Then any
+ cached entries will still contain the old COS attributes/values.
+ """
+
+ log.info('Testing Ticket 47981 - Test that COS def changes are correctly reflected in affected users')
+
+ #
+ # Create a second backend that does not have any COS entries
+ #
+ log.info('Adding second suffix that will not contain any COS entries...\n')
+
+ topology.standalone.backend.create(SECOND_SUFFIX, {BACKEND_NAME: BE_NAME})
+ topology.standalone.mappingtree.create(SECOND_SUFFIX, bename=BE_NAME)
+ try:
+ topology.standalone.add_s(Entry((SECOND_SUFFIX, {
+ 'objectclass': 'top organization'.split(),
+ 'o': BE_NAME})))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to create suffix entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add People branch, it might already exist
+ #
+ log.info('Add our test entries to the default suffix, and proceed with the test...')
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add a user to the branch
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Enable password policy and add the subtree policy
+ #
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ addSubtreePwPolicy(topology.standalone)
+
+ #
+ # Now check the user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER_DN,
+ ldap.SCOPE_BASE,
+ '(objectclass=top)',
+ ['pwdpolicysubentry', 'dn'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Delete the password policy and make sure it is removed from the same user
+ #
+ delSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User unexpectedly does have the pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Add the subtree policvy back and see if the user now has it
+ #
+ addSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47981_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47981(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index bc1132f..f98d1c8 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -260,7 +260,7 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
/* cosDefinitions manipulation */
static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_cacheable);
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable);
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs);
static int cos_cache_add_defn(cosDefinitions **pDefs, cosAttrValue **dn, int cosType, cosAttrValue **tree, cosAttrValue **tmpDn, cosAttrValue **spec, cosAttrValue **pAttrs, cosAttrValue **pOverrides, cosAttrValue **pOperational, cosAttrValue **pCosMerge, cosAttrValue **pCosOpDefault);
static int cos_cache_entry_is_cos_related( Slapi_Entry *e);
@@ -619,9 +619,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_TRACE, "--> cos_cache_build_definition_list\n",0,0,0);
/*
- the class of service definitions may be anywhere in the DIT,
- so our first task is to find them.
- */
+ * The class of service definitions may be anywhere in the DIT,
+ * so our first task is to find them.
+ */
attrs[0] = "namingcontexts";
attrs[1] = 0;
@@ -629,9 +629,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_PLUGIN, "cos: Building class of service cache after status change.\n",0,0,0);
/*
- * XXXrbyrne: this looks really ineficient--should be using
+ * XXXrbyrne: this looks really inefficient--should be using
* slapi_get_next_suffix(), rather than searching for namingcontexts.
- */
+ */
pSuffixSearch = slapi_search_internal("",LDAP_SCOPE_BASE,"(objectclass=*)",NULL,attrs,0);
if(pSuffixSearch)
@@ -671,19 +671,21 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
{
/* here's a suffix, lets search it... */
if(suffixVals[valIndex]->bv_val)
- if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs, vattr_cacheable))
+ {
+ if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs))
+ {
+ *vattr_cacheable = -1;
cos_def_available = 1;
-
+ break;
+ }
+ }
valIndex++;
}
-
-
ber_bvecfree( suffixVals );
suffixVals = NULL;
}
}
}
-
} while(!slapi_entry_next_attr(pSuffixList[suffixIndex], suffixAttr, &suffixAttr));
}
suffixIndex++;
@@ -709,7 +711,6 @@ next:
slapi_pblock_destroy(pSuffixSearch);
}
-
LDAPDebug( LDAP_DEBUG_TRACE, "<-- cos_cache_build_definition_list\n",0,0,0);
return ret;
}
@@ -750,10 +751,6 @@ cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
char *norm_dn = NULL;
info=(struct dn_defs_info *)callback_data;
-
- /* assume cacheable */
- info->vattr_cacheable = -1;
-
cos_cache_add_attrval(&pDn, slapi_entry_get_dn(e));
if(slapi_entry_first_attr(e, &dnAttr)) {
goto bail;
@@ -1076,7 +1073,7 @@ bail:
#define DN_DEF_FILTER "(&(|(objectclass=cosSuperDefinition)(objectclass=cosDefinition))(objectclass=ldapsubentry))"
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable)
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs)
{
Slapi_PBlock *pDnSearch = 0;
struct dn_defs_info info = {NULL, 0, 0};
@@ -1084,7 +1081,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
if (pDnSearch) {
info.ret=-1; /* assume no good defs */
info.pDefs=pDefs;
- info.vattr_cacheable = 0; /* assume not cacheable */
slapi_search_internal_set_pb(pDnSearch, dn, LDAP_SCOPE_SUBTREE,
DN_DEF_FILTER,NULL,0,
NULL,NULL,cos_get_plugin_identity(),0);
@@ -1096,8 +1092,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
slapi_pblock_destroy (pDnSearch);
}
- *vattr_cacheable = info.vattr_cacheable;
-
return info.ret;
}
1
0
07 Jan '15
dirsrvtests/tickets/ticket47981_test.py | 345 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 34 +--
2 files changed, 359 insertions(+), 20 deletions(-)
New commits:
commit df7bafae3c069ecf90d951d0c0f1ede26ab521fd
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 7 08:59:06 2015 -0500
Ticket 47981 - COS cache doesn't properly mark vattr cache as
invalid when there are multiple suffixes
Bug Description: When rebuilding the COS cache, we check each suffix for COS entries.
If the last suffix checked does not contain any COS entries, then the
virtual attribute cache is incorrectly not invalidated. This allows
for already cached entries to hold onto the old COS attributes/values.
Fix Description: Only set the vattr_cacheable flag if a suffix contains COS entries, not
if it does not - by default the flag is not set.
https://fedorahosted.org/389/ticket/47981
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 42e2df3858a4e14706d57b5c907d1d3768f4d970)
diff --git a/dirsrvtests/tickets/ticket47981_test.py b/dirsrvtests/tickets/ticket47981_test.py
new file mode 100644
index 0000000..2a16ce6
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47981_test.py
@@ -0,0 +1,345 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH = 'ou=people,' + DEFAULT_SUFFIX
+USER_DN = 'uid=user1,%s' % (BRANCH)
+BRANCH_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+BRANCH_PWP = 'cn=cn\\3DnsPwPolicyEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH_COS_TMPL = 'cn=cn\\3DnsPwTemplateEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+SECOND_SUFFIX = 'o=netscaperoot'
+BE_NAME = 'netscaperoot'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def addSubtreePwPolicy(inst):
+ #
+ # Add subtree policy to the people branch
+ #
+ try:
+ inst.add_s(Entry((BRANCH_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for ou=people: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ inst.add_s(Entry((BRANCH_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ inst.add_s(Entry((BRANCH_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ inst.add_s(Entry((BRANCH_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def delSubtreePwPolicy(inst):
+ try:
+ inst.delete_s(BRANCH_COS_DEF)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS def: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_COS_TMPL)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS template: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_PWP)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS password policy: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_CONTAINER)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS container: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def test_ticket47981(topology):
+ """
+ If there are multiple suffixes, and the last suffix checked does not contain any COS entries,
+ while other suffixes do, then the vattr cache is not invalidated as it should be. Then any
+ cached entries will still contain the old COS attributes/values.
+ """
+
+ log.info('Testing Ticket 47981 - Test that COS def changes are correctly reflected in affected users')
+
+ #
+ # Create a second backend that does not have any COS entries
+ #
+ log.info('Adding second suffix that will not contain any COS entries...\n')
+
+ topology.standalone.backend.create(SECOND_SUFFIX, {BACKEND_NAME: BE_NAME})
+ topology.standalone.mappingtree.create(SECOND_SUFFIX, bename=BE_NAME)
+ try:
+ topology.standalone.add_s(Entry((SECOND_SUFFIX, {
+ 'objectclass': 'top organization'.split(),
+ 'o': BE_NAME})))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to create suffix entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add People branch, it might already exist
+ #
+ log.info('Add our test entries to the default suffix, and proceed with the test...')
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add a user to the branch
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Enable password policy and add the subtree policy
+ #
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ addSubtreePwPolicy(topology.standalone)
+
+ #
+ # Now check the user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER_DN,
+ ldap.SCOPE_BASE,
+ '(objectclass=top)',
+ ['pwdpolicysubentry', 'dn'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Delete the password policy and make sure it is removed from the same user
+ #
+ delSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User unexpectedly does have the pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Add the subtree policvy back and see if the user now has it
+ #
+ addSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47981_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47981(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index 3214f82..d3d97f4 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -260,7 +260,7 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
/* cosDefinitions manipulation */
static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_cacheable);
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable);
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs);
static int cos_cache_add_defn(cosDefinitions **pDefs, cosAttrValue **dn, int cosType, cosAttrValue **tree, cosAttrValue **tmpDn, cosAttrValue **spec, cosAttrValue **pAttrs, cosAttrValue **pOverrides, cosAttrValue **pOperational, cosAttrValue **pCosMerge, cosAttrValue **pCosOpDefault);
static int cos_cache_entry_is_cos_related( Slapi_Entry *e);
@@ -619,9 +619,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_TRACE, "--> cos_cache_build_definition_list\n",0,0,0);
/*
- the class of service definitions may be anywhere in the DIT,
- so our first task is to find them.
- */
+ * The class of service definitions may be anywhere in the DIT,
+ * so our first task is to find them.
+ */
attrs[0] = "namingcontexts";
attrs[1] = 0;
@@ -629,9 +629,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_PLUGIN, "cos: Building class of service cache after status change.\n",0,0,0);
/*
- * XXXrbyrne: this looks really ineficient--should be using
+ * XXXrbyrne: this looks really inefficient--should be using
* slapi_get_next_suffix(), rather than searching for namingcontexts.
- */
+ */
pSuffixSearch = slapi_search_internal("",LDAP_SCOPE_BASE,"(objectclass=*)",NULL,attrs,0);
if(pSuffixSearch)
@@ -671,19 +671,21 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
{
/* here's a suffix, lets search it... */
if(suffixVals[valIndex]->bv_val)
- if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs, vattr_cacheable))
+ {
+ if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs))
+ {
+ *vattr_cacheable = -1;
cos_def_available = 1;
-
+ break;
+ }
+ }
valIndex++;
}
-
-
ber_bvecfree( suffixVals );
suffixVals = NULL;
}
}
}
-
} while(!slapi_entry_next_attr(pSuffixList[suffixIndex], suffixAttr, &suffixAttr));
}
suffixIndex++;
@@ -709,7 +711,6 @@ next:
slapi_pblock_destroy(pSuffixSearch);
}
-
LDAPDebug( LDAP_DEBUG_TRACE, "<-- cos_cache_build_definition_list\n",0,0,0);
return ret;
}
@@ -750,10 +751,6 @@ cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
char *norm_dn = NULL;
info=(struct dn_defs_info *)callback_data;
-
- /* assume cacheable */
- info->vattr_cacheable = -1;
-
cos_cache_add_attrval(&pDn, slapi_entry_get_dn(e));
if(slapi_entry_first_attr(e, &dnAttr)) {
goto bail;
@@ -1076,7 +1073,7 @@ bail:
#define DN_DEF_FILTER "(&(|(objectclass=cosSuperDefinition)(objectclass=cosDefinition))(objectclass=ldapsubentry))"
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable)
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs)
{
Slapi_PBlock *pDnSearch = 0;
struct dn_defs_info info = {NULL, 0, 0};
@@ -1084,7 +1081,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
if (pDnSearch) {
info.ret=-1; /* assume no good defs */
info.pDefs=pDefs;
- info.vattr_cacheable = 0; /* assume not cacheable */
slapi_search_internal_set_pb(pDnSearch, dn, LDAP_SCOPE_SUBTREE,
DN_DEF_FILTER,NULL,0,
NULL,NULL,cos_get_plugin_identity(),0);
@@ -1096,8 +1092,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
slapi_pblock_destroy (pDnSearch);
}
- *vattr_cacheable = info.vattr_cacheable;
-
return info.ret;
}
1
0
07 Jan '15
dirsrvtests/tickets/ticket47981_test.py | 345 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 34 +--
2 files changed, 359 insertions(+), 20 deletions(-)
New commits:
commit 6229ad9a3d78cf6d83f09f2893c39dce5bbc71ca
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 7 08:59:06 2015 -0500
Ticket 47981 - COS cache doesn't properly mark vattr cache as
invalid when there are multiple suffixes
Bug Description: When rebuilding the COS cache, we check each suffix for COS entries.
If the last suffix checked does not contain any COS entries, then the
virtual attribute cache is incorrectly not invalidated. This allows
for already cached entries to hold onto the old COS attributes/values.
Fix Description: Only set the vattr_cacheable flag if a suffix contains COS entries, not
if it does not - by default the flag is not set.
https://fedorahosted.org/389/ticket/47981
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 42e2df3858a4e14706d57b5c907d1d3768f4d970)
diff --git a/dirsrvtests/tickets/ticket47981_test.py b/dirsrvtests/tickets/ticket47981_test.py
new file mode 100644
index 0000000..2a16ce6
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47981_test.py
@@ -0,0 +1,345 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH = 'ou=people,' + DEFAULT_SUFFIX
+USER_DN = 'uid=user1,%s' % (BRANCH)
+BRANCH_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+BRANCH_PWP = 'cn=cn\\3DnsPwPolicyEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH_COS_TMPL = 'cn=cn\\3DnsPwTemplateEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+SECOND_SUFFIX = 'o=netscaperoot'
+BE_NAME = 'netscaperoot'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def addSubtreePwPolicy(inst):
+ #
+ # Add subtree policy to the people branch
+ #
+ try:
+ inst.add_s(Entry((BRANCH_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for ou=people: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ inst.add_s(Entry((BRANCH_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ inst.add_s(Entry((BRANCH_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ inst.add_s(Entry((BRANCH_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def delSubtreePwPolicy(inst):
+ try:
+ inst.delete_s(BRANCH_COS_DEF)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS def: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_COS_TMPL)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS template: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_PWP)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS password policy: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_CONTAINER)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS container: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def test_ticket47981(topology):
+ """
+ If there are multiple suffixes, and the last suffix checked does not contain any COS entries,
+ while other suffixes do, then the vattr cache is not invalidated as it should be. Then any
+ cached entries will still contain the old COS attributes/values.
+ """
+
+ log.info('Testing Ticket 47981 - Test that COS def changes are correctly reflected in affected users')
+
+ #
+ # Create a second backend that does not have any COS entries
+ #
+ log.info('Adding second suffix that will not contain any COS entries...\n')
+
+ topology.standalone.backend.create(SECOND_SUFFIX, {BACKEND_NAME: BE_NAME})
+ topology.standalone.mappingtree.create(SECOND_SUFFIX, bename=BE_NAME)
+ try:
+ topology.standalone.add_s(Entry((SECOND_SUFFIX, {
+ 'objectclass': 'top organization'.split(),
+ 'o': BE_NAME})))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to create suffix entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add People branch, it might already exist
+ #
+ log.info('Add our test entries to the default suffix, and proceed with the test...')
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add a user to the branch
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Enable password policy and add the subtree policy
+ #
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ addSubtreePwPolicy(topology.standalone)
+
+ #
+ # Now check the user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER_DN,
+ ldap.SCOPE_BASE,
+ '(objectclass=top)',
+ ['pwdpolicysubentry', 'dn'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Delete the password policy and make sure it is removed from the same user
+ #
+ delSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User unexpectedly does have the pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Add the subtree policvy back and see if the user now has it
+ #
+ addSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47981_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47981(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index 0d9a61e..7d8e877 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -260,7 +260,7 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
/* cosDefinitions manipulation */
static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_cacheable);
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable);
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs);
static int cos_cache_add_defn(cosDefinitions **pDefs, cosAttrValue **dn, int cosType, cosAttrValue **tree, cosAttrValue **tmpDn, cosAttrValue **spec, cosAttrValue **pAttrs, cosAttrValue **pOverrides, cosAttrValue **pOperational, cosAttrValue **pCosMerge, cosAttrValue **pCosOpDefault);
static int cos_cache_entry_is_cos_related( Slapi_Entry *e);
@@ -619,9 +619,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_TRACE, "--> cos_cache_build_definition_list\n",0,0,0);
/*
- the class of service definitions may be anywhere in the DIT,
- so our first task is to find them.
- */
+ * The class of service definitions may be anywhere in the DIT,
+ * so our first task is to find them.
+ */
attrs[0] = "namingcontexts";
attrs[1] = 0;
@@ -629,9 +629,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_PLUGIN, "cos: Building class of service cache after status change.\n",0,0,0);
/*
- * XXXrbyrne: this looks really ineficient--should be using
+ * XXXrbyrne: this looks really inefficient--should be using
* slapi_get_next_suffix(), rather than searching for namingcontexts.
- */
+ */
pSuffixSearch = slapi_search_internal("",LDAP_SCOPE_BASE,"(objectclass=*)",NULL,attrs,0);
if(pSuffixSearch)
@@ -671,19 +671,21 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
{
/* here's a suffix, lets search it... */
if(suffixVals[valIndex]->bv_val)
- if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs, vattr_cacheable))
+ {
+ if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs))
+ {
+ *vattr_cacheable = -1;
cos_def_available = 1;
-
+ break;
+ }
+ }
valIndex++;
}
-
-
ber_bvecfree( suffixVals );
suffixVals = NULL;
}
}
}
-
} while(!slapi_entry_next_attr(pSuffixList[suffixIndex], suffixAttr, &suffixAttr));
}
suffixIndex++;
@@ -709,7 +711,6 @@ next:
slapi_pblock_destroy(pSuffixSearch);
}
-
LDAPDebug( LDAP_DEBUG_TRACE, "<-- cos_cache_build_definition_list\n",0,0,0);
return ret;
}
@@ -750,10 +751,6 @@ cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
char *norm_dn = NULL;
info=(struct dn_defs_info *)callback_data;
-
- /* assume cacheable */
- info->vattr_cacheable = -1;
-
cos_cache_add_attrval(&pDn, slapi_entry_get_dn(e));
if(slapi_entry_first_attr(e, &dnAttr)) {
goto bail;
@@ -1076,7 +1073,7 @@ bail:
#define DN_DEF_FILTER "(&(|(objectclass=cosSuperDefinition)(objectclass=cosDefinition))(objectclass=ldapsubentry))"
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable)
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs)
{
Slapi_PBlock *pDnSearch = 0;
struct dn_defs_info info = {NULL, 0, 0};
@@ -1084,7 +1081,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
if (pDnSearch) {
info.ret=-1; /* assume no good defs */
info.pDefs=pDefs;
- info.vattr_cacheable = 0; /* assume not cacheable */
slapi_search_internal_set_pb(pDnSearch, dn, LDAP_SCOPE_SUBTREE,
DN_DEF_FILTER,NULL,0,
NULL,NULL,cos_get_plugin_identity(),0);
@@ -1096,8 +1092,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
slapi_pblock_destroy (pDnSearch);
}
- *vattr_cacheable = info.vattr_cacheable;
-
return info.ret;
}
1
0
dirsrvtests/tickets/ticket47981_test.py | 345 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 34 +--
2 files changed, 359 insertions(+), 20 deletions(-)
New commits:
commit 42e2df3858a4e14706d57b5c907d1d3768f4d970
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jan 7 08:59:06 2015 -0500
Ticket 47981 - COS cache doesn't properly mark vattr cache as
invalid when there are multiple suffixes
Bug Description: When rebuilding the COS cache, we check each suffix for COS entries.
If the last suffix checked does not contain any COS entries, then the
virtual attribute cache is incorrectly not invalidated. This allows
for already cached entries to hold onto the old COS attributes/values.
Fix Description: Only set the vattr_cacheable flag if a suffix contains COS entries, not
if it does not - by default the flag is not set.
https://fedorahosted.org/389/ticket/47981
Reviewed by: nhosoi(Thanks!)
diff --git a/dirsrvtests/tickets/ticket47981_test.py b/dirsrvtests/tickets/ticket47981_test.py
new file mode 100644
index 0000000..2a16ce6
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47981_test.py
@@ -0,0 +1,345 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH = 'ou=people,' + DEFAULT_SUFFIX
+USER_DN = 'uid=user1,%s' % (BRANCH)
+BRANCH_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+BRANCH_PWP = 'cn=cn\\3DnsPwPolicyEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH_COS_TMPL = 'cn=cn\\3DnsPwTemplateEntry\\2Cou\\3DPeople\\2Cdc\\3Dexample\\2Cdc\\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+SECOND_SUFFIX = 'o=netscaperoot'
+BE_NAME = 'netscaperoot'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def addSubtreePwPolicy(inst):
+ #
+ # Add subtree policy to the people branch
+ #
+ try:
+ inst.add_s(Entry((BRANCH_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for ou=people: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ inst.add_s(Entry((BRANCH_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ inst.add_s(Entry((BRANCH_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ inst.add_s(Entry((BRANCH_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def delSubtreePwPolicy(inst):
+ try:
+ inst.delete_s(BRANCH_COS_DEF)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS def: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_COS_TMPL)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS template: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_PWP)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS password policy: error ' + e.message['desc'])
+ assert False
+
+ try:
+ inst.delete_s(BRANCH_CONTAINER)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete COS container: error ' + e.message['desc'])
+ assert False
+ time.sleep(0.5)
+
+
+def test_ticket47981(topology):
+ """
+ If there are multiple suffixes, and the last suffix checked does not contain any COS entries,
+ while other suffixes do, then the vattr cache is not invalidated as it should be. Then any
+ cached entries will still contain the old COS attributes/values.
+ """
+
+ log.info('Testing Ticket 47981 - Test that COS def changes are correctly reflected in affected users')
+
+ #
+ # Create a second backend that does not have any COS entries
+ #
+ log.info('Adding second suffix that will not contain any COS entries...\n')
+
+ topology.standalone.backend.create(SECOND_SUFFIX, {BACKEND_NAME: BE_NAME})
+ topology.standalone.mappingtree.create(SECOND_SUFFIX, bename=BE_NAME)
+ try:
+ topology.standalone.add_s(Entry((SECOND_SUFFIX, {
+ 'objectclass': 'top organization'.split(),
+ 'o': BE_NAME})))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to create suffix entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add People branch, it might already exist
+ #
+ log.info('Add our test entries to the default suffix, and proceed with the test...')
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add ou=people: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add a user to the branch
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Enable password policy and add the subtree policy
+ #
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ addSubtreePwPolicy(topology.standalone)
+
+ #
+ # Now check the user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER_DN,
+ ldap.SCOPE_BASE,
+ '(objectclass=top)',
+ ['pwdpolicysubentry', 'dn'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Delete the password policy and make sure it is removed from the same user
+ #
+ delSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User unexpectedly does have the pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ #
+ # Add the subtree policvy back and see if the user now has it
+ #
+ addSubtreePwPolicy(topology.standalone)
+ try:
+ entries = topology.standalone.search_s(USER_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasAttr('pwdpolicysubentry'):
+ log.fatal('User does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47981_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47981(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index 0d9a61e..7d8e877 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -260,7 +260,7 @@ static int cos_cache_add_tmpl(cosTemplates **pTemplates, cosAttrValue *dn, cosAt
/* cosDefinitions manipulation */
static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_cacheable);
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable);
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs);
static int cos_cache_add_defn(cosDefinitions **pDefs, cosAttrValue **dn, int cosType, cosAttrValue **tree, cosAttrValue **tmpDn, cosAttrValue **spec, cosAttrValue **pAttrs, cosAttrValue **pOverrides, cosAttrValue **pOperational, cosAttrValue **pCosMerge, cosAttrValue **pCosOpDefault);
static int cos_cache_entry_is_cos_related( Slapi_Entry *e);
@@ -619,9 +619,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_TRACE, "--> cos_cache_build_definition_list\n",0,0,0);
/*
- the class of service definitions may be anywhere in the DIT,
- so our first task is to find them.
- */
+ * The class of service definitions may be anywhere in the DIT,
+ * so our first task is to find them.
+ */
attrs[0] = "namingcontexts";
attrs[1] = 0;
@@ -629,9 +629,9 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
LDAPDebug( LDAP_DEBUG_PLUGIN, "cos: Building class of service cache after status change.\n",0,0,0);
/*
- * XXXrbyrne: this looks really ineficient--should be using
+ * XXXrbyrne: this looks really inefficient--should be using
* slapi_get_next_suffix(), rather than searching for namingcontexts.
- */
+ */
pSuffixSearch = slapi_search_internal("",LDAP_SCOPE_BASE,"(objectclass=*)",NULL,attrs,0);
if(pSuffixSearch)
@@ -671,19 +671,21 @@ static int cos_cache_build_definition_list(cosDefinitions **pDefs, int *vattr_ca
{
/* here's a suffix, lets search it... */
if(suffixVals[valIndex]->bv_val)
- if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs, vattr_cacheable))
+ {
+ if(!cos_cache_add_dn_defs(suffixVals[valIndex]->bv_val ,pDefs))
+ {
+ *vattr_cacheable = -1;
cos_def_available = 1;
-
+ break;
+ }
+ }
valIndex++;
}
-
-
ber_bvecfree( suffixVals );
suffixVals = NULL;
}
}
}
-
} while(!slapi_entry_next_attr(pSuffixList[suffixIndex], suffixAttr, &suffixAttr));
}
suffixIndex++;
@@ -709,7 +711,6 @@ next:
slapi_pblock_destroy(pSuffixSearch);
}
-
LDAPDebug( LDAP_DEBUG_TRACE, "<-- cos_cache_build_definition_list\n",0,0,0);
return ret;
}
@@ -750,10 +751,6 @@ cos_dn_defs_cb (Slapi_Entry* e, void *callback_data)
char *norm_dn = NULL;
info=(struct dn_defs_info *)callback_data;
-
- /* assume cacheable */
- info->vattr_cacheable = -1;
-
cos_cache_add_attrval(&pDn, slapi_entry_get_dn(e));
if(slapi_entry_first_attr(e, &dnAttr)) {
goto bail;
@@ -1076,7 +1073,7 @@ bail:
#define DN_DEF_FILTER "(&(|(objectclass=cosSuperDefinition)(objectclass=cosDefinition))(objectclass=ldapsubentry))"
-static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_cacheable)
+static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs)
{
Slapi_PBlock *pDnSearch = 0;
struct dn_defs_info info = {NULL, 0, 0};
@@ -1084,7 +1081,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
if (pDnSearch) {
info.ret=-1; /* assume no good defs */
info.pDefs=pDefs;
- info.vattr_cacheable = 0; /* assume not cacheable */
slapi_search_internal_set_pb(pDnSearch, dn, LDAP_SCOPE_SUBTREE,
DN_DEF_FILTER,NULL,0,
NULL,NULL,cos_get_plugin_identity(),0);
@@ -1096,8 +1092,6 @@ static int cos_cache_add_dn_defs(char *dn, cosDefinitions **pDefs, int *vattr_ca
slapi_pblock_destroy (pDnSearch);
}
- *vattr_cacheable = info.vattr_cacheable;
-
return info.ret;
}
1
0
ldap/servers/slapd/dn.c | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
New commits:
commit c49b03070c275575ba879e4e9cee98fc038ce7e6
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Wed Sep 26 16:55:39 2012 -0700
Coverity defects
13093: Resource leak
Fix description: If udn is allocated in ndn_cache_lookup and it
has no chance to be consumed in ndn_cache_add, udn is released.
(cherry picked from commit 4754fb7da3066119576a115a04470b91c4184257)
Conflicts:
ldap/servers/slapd/dn.c
diff --git a/ldap/servers/slapd/dn.c b/ldap/servers/slapd/dn.c
index 53c378a..9c1084f 100644
--- a/ldap/servers/slapd/dn.c
+++ b/ldap/servers/slapd/dn.c
@@ -535,7 +535,7 @@ slapi_dn_normalize_ext(char *src, size_t src_len, char **dest, size_t *dest_len)
char *ends = NULL;
char *endd = NULL;
char *lastesc = NULL;
- char *udn;
+ char *udn = NULL;
/* rdn avs for the main DN */
char *typestart = NULL;
int rdn_av_count = 0;
@@ -1130,8 +1130,13 @@ bail:
*d = '\0';
}
/* add this dn to the normalized dn cache */
- if(*dest)
- ndn_cache_add(udn, src_len, *dest, *dest_len);
+ if (udn) {
+ if(dest && *dest && dest_len && *dest_len) {
+ ndn_cache_add(udn, src_len, *dest, *dest_len);
+ } else {
+ slapi_ch_free_string(&udn);
+ }
+ }
return rc;
}
@@ -2774,6 +2779,10 @@ ndn_cache_lookup(char *dn, size_t dn_len, char **result, char **udn, int *rc)
char *ndn, *key;
int rv = 0;
+ if(NULL == udn){
+ return rv;
+ }
+ *udn = NULL;
if(ndn_started == 0){
return rv;
}
commit 10ddfbc793a77f5c1a19302034239a53c07e3ab2
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Mon Jan 7 17:07:52 2013 -0800
Ticket #547 - Incorrect assumption in ndn cache
Bug Description: In ndn_cache_lookup, to determine the given dn
is already normalized or not, the length is compared with the
normalized dn length. If they match, it considers the given dn
is already normalized. But there are cases even if the lengths
are equal, the given dn may not be normalized yet.
(e.g., 'cn="o=ABC",o=XYZ' vs. 'cn=o\3DABC,o=XYZ')
Fix Description: This patch adds another check: if the dn and
normalized dn length match, call memcmp to compare the 2 dn's.
When memcmp returns 0, ndn_cache_lookup returns the passed dn.
https://fedorahosted.org/389/ticket/547
Reviewed by mreynolds (Thanks, Mark!).
(cherry picked from commit 0c44a46448595fdb1e079b5f4c91d4d8bfa2e0f2)
Conflicts:
ldap/servers/slapd/dn.c
diff --git a/ldap/servers/slapd/dn.c b/ldap/servers/slapd/dn.c
index 283f265..53c378a 100644
--- a/ldap/servers/slapd/dn.c
+++ b/ldap/servers/slapd/dn.c
@@ -2788,16 +2788,19 @@ ndn_cache_lookup(char *dn, size_t dn_len, char **result, char **udn, int *rc)
if(ndn_ht_val){
ndn_cache_update_lru(&ndn_ht_val->lru_node);
slapi_counter_increment(ndn_cache->cache_hits);
- if(ndn_ht_val->len == dn_len ){
- /* the dn was already normalized, just return the dn as the result */
- *result = dn;
- *rc = 0;
- } else {
+ if ((ndn_ht_val->len != dn_len) ||
+ /* even if the lengths match, dn may not be normalized yet.
+ * (e.g., 'cn="o=ABC",o=XYZ' vs. 'cn=o\3DABC,o=XYZ') */
+ (memcmp(dn, ndn_ht_val->ndn, dn_len))){
*rc = 1; /* free result */
ndn = slapi_ch_malloc(ndn_ht_val->len + 1);
memcpy(ndn, ndn_ht_val->ndn, ndn_ht_val->len);
ndn[ndn_ht_val->len] = '\0';
*result = ndn;
+ } else {
+ /* the dn was already normalized, just return the dn as the result */
+ *result = dn;
+ *rc = 0;
}
rv = 1;
} else {
1
0
ldap/admin/src/scripts/template-bak2db.pl.in | 2 +
ldap/admin/src/scripts/template-cleanallruv.pl.in | 2 +
ldap/admin/src/scripts/template-db2bak.pl.in | 2 +
ldap/admin/src/scripts/template-db2index.pl.in | 2 +
ldap/admin/src/scripts/template-db2ldif.pl.in | 2 +
ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in | 2 +
ldap/admin/src/scripts/template-fixup-memberof.pl.in | 2 +
ldap/admin/src/scripts/template-ldif2db.pl.in | 2 +
ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in | 13 ++++++------
ldap/admin/src/scripts/template-schema-reload.pl.in | 2 +
ldap/admin/src/scripts/template-syntax-validate.pl.in | 2 +
ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in | 2 +
12 files changed, 29 insertions(+), 6 deletions(-)
New commits:
commit d8e79122c33e619f0950503a3a3b9a4b38f20e54
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Dec 17 11:56:42 2014 -0500
Ticket 47962 - perl scripts not returning expected error code
Bug Description: WHne one o the instance perl scripts fails, it either
returns sucess, or the wrong the error code.
Fix Description: The perl scripts need to bit shift the result code by 8,
and return the result.
https://fedorahosted.org/389/ticket/47962
Reviewed by: rmeggins(Thanks!)
diff --git a/ldap/admin/src/scripts/template-bak2db.pl.in b/ldap/admin/src/scripts/template-bak2db.pl.in
index 4ab79cc..2f243ba 100644
--- a/ldap/admin/src/scripts/template-bak2db.pl.in
+++ b/ldap/admin/src/scripts/template-bak2db.pl.in
@@ -135,6 +135,8 @@ $ENV{'SHLIB_PATH'} = "$ENV{'LD_LIBRARY_PATH'}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-cleanallruv.pl.in b/ldap/admin/src/scripts/template-cleanallruv.pl.in
index be95a6d..437a3c0 100644
--- a/ldap/admin/src/scripts/template-cleanallruv.pl.in
+++ b/ldap/admin/src/scripts/template-cleanallruv.pl.in
@@ -171,6 +171,8 @@ $entry = "${dn}${misc}${cn}${basedn}${rid}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-db2bak.pl.in b/ldap/admin/src/scripts/template-db2bak.pl.in
index 8a0cb1c..329664f 100644
--- a/ldap/admin/src/scripts/template-db2bak.pl.in
+++ b/ldap/admin/src/scripts/template-db2bak.pl.in
@@ -125,6 +125,8 @@ print("Back up directory: $archivedir\n");
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-db2index.pl.in b/ldap/admin/src/scripts/template-db2index.pl.in
index e598b05..39454c5 100644
--- a/ldap/admin/src/scripts/template-db2index.pl.in
+++ b/ldap/admin/src/scripts/template-db2index.pl.in
@@ -229,6 +229,8 @@ $entry = "${dn}${misc}${cn}${nsinstance}${attribute}${vlvattribute}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-db2ldif.pl.in b/ldap/admin/src/scripts/template-db2ldif.pl.in
index a4929ba..febedd4 100644
--- a/ldap/admin/src/scripts/template-db2ldif.pl.in
+++ b/ldap/admin/src/scripts/template-db2ldif.pl.in
@@ -269,6 +269,8 @@ print("Exporting to ldif file: ${ldiffile}\n");
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in b/ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in
index f181a7a..67f0b31 100644
--- a/ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in
+++ b/ldap/admin/src/scripts/template-fixup-linkedattrs.pl.in
@@ -155,6 +155,8 @@ $entry = "${dn}${misc}${cn}${basedn}${linkdn}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-fixup-memberof.pl.in b/ldap/admin/src/scripts/template-fixup-memberof.pl.in
index b43c21a..77a1528 100644
--- a/ldap/admin/src/scripts/template-fixup-memberof.pl.in
+++ b/ldap/admin/src/scripts/template-fixup-memberof.pl.in
@@ -166,6 +166,8 @@ $entry = "${dn}${misc}${cn}${basedn}${filter}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-ldif2db.pl.in b/ldap/admin/src/scripts/template-ldif2db.pl.in
index 089c95d..1cf83b4 100644
--- a/ldap/admin/src/scripts/template-ldif2db.pl.in
+++ b/ldap/admin/src/scripts/template-ldif2db.pl.in
@@ -227,6 +227,8 @@ $ENV{'SHLIB_PATH'} = "$ENV{'LD_LIBRARY_PATH'}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in b/ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in
index 50ce047..bd9b238 100755
--- a/ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in
+++ b/ldap/admin/src/scripts/template-ns-newpwpolicy.pl.in
@@ -186,9 +186,9 @@ sub usage {
open(FD,"| $modifyCfg ");
print(FD $modConfig);
close(FD);
- $retcode = $?;
+ $retcode = $?>>8;
if ( $retcode != 0 ) {
- print( STDERR "Error $retcode while modifing \"cn=config\". Exiting.\n" );
+ print( STDERR "Error $retcode while modifying \"cn=config\". Exiting.\n" );
exit ($retcode);
}
else {
@@ -203,6 +203,7 @@ sub usage {
$esc_opt_U =~ s/=/\\=/g;
print (STDERR "host = $opt_h, port = $opt_p, userDN = \"$norm_opt_U\"\n\n") if $opt_v;
$retcode = `$ldapsearch -h $opt_h -p $opt_p -b \"$norm_opt_U\" -s base \"\"`;
+ $retcode = $retcode>>8;
if ($retcode != 0 ) {
print( STDERR "the user entry $norm_opt_U does not exist. Exiting.\n");
exit ($retcode);
@@ -267,9 +268,9 @@ sub usage {
open(FD,"| $modifyCfg ");
print(FD $modConfig);
close(FD);
- $retcode = $?;
+ $retcode = $?>>8;
if ( $retcode != 0 ) {
- print( STDERR "Error $retcode while modifing $norm_opt_U. Exiting.\n" );
+ print( STDERR "Error $retcode while modifying $norm_opt_U. Exiting.\n" );
exit ($retcode);
}
else {
@@ -280,9 +281,9 @@ sub usage {
open(FD,"| $modifyCfg ");
print(FD $modConfig);
close(FD);
- $retcode = $?;
+ $retcode = $?>>8;
if ( $retcode != 0 ) {
- print( STDERR "Error $retcode while modifing \"cn=config\". Exiting.\n" );
+ print( STDERR "Error $retcode while modifying \"cn=config\". Exiting.\n" );
exit ($retcode);
}
else {
diff --git a/ldap/admin/src/scripts/template-schema-reload.pl.in b/ldap/admin/src/scripts/template-schema-reload.pl.in
index f7a1dbb..6b64b5e 100644
--- a/ldap/admin/src/scripts/template-schema-reload.pl.in
+++ b/ldap/admin/src/scripts/template-schema-reload.pl.in
@@ -155,6 +155,8 @@ $entry = "${dn}${misc}${cn}${basedn}${schemadir}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-syntax-validate.pl.in b/ldap/admin/src/scripts/template-syntax-validate.pl.in
index b87e12d..b40ef69 100644
--- a/ldap/admin/src/scripts/template-syntax-validate.pl.in
+++ b/ldap/admin/src/scripts/template-syntax-validate.pl.in
@@ -166,6 +166,8 @@ $entry = "${dn}${misc}${cn}${basedn}${filter}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
diff --git a/ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in b/ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in
index 3e17be0..92c106d 100644
--- a/ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in
+++ b/ldap/admin/src/scripts/template-usn-tombstone-cleanup.pl.in
@@ -183,6 +183,8 @@ $entry = "${dn}${misc}${cn}${basedn}${args}";
open(FOO, "| ldapmodify @ldaptool_opts@ $vstr -h {{SERVER-NAME}} -p {{SERVER-PORT}} -D \"$rootdn\" -w \"$passwd\" -a" );
print(FOO "$entry");
close(FOO);
+$retcode = $?>>8;
+exit ($retcode);
sub libpath_add {
my $libpath = shift;
1
0
ldap/servers/slapd/back-ldbm/back-ldbm.h | 4 -
ldap/servers/slapd/back-ldbm/dblayer.c | 71 +++++++++++++++++--------------
ldap/servers/slapd/back-ldbm/vlv.c | 24 ++++++++--
ldap/servers/slapd/back-ldbm/vlv_srch.c | 17 +++----
4 files changed, 70 insertions(+), 46 deletions(-)
New commits:
commit ebf24ffd5ac79adcb288960377605feb60c52d7f
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Jan 5 13:07:07 2015 -0800
Ticket #47966 - slapd crashes during Dogtag clone reinstallation
Bug description: There were 2 VLV index issues.
1) When a VLV index is removed, it did not call dblayer_erase_index_file_
nolock, which removes the physical index file as well as a back pointer
set to the dblayer handle. The back pointer is scanned at the backend
close time where the garbage address is used to close the already removed
vlv index.
2) VLV plugin callbacks are registered in vlv_init. The function could be
called multiple times without unregster the VLV plugin callbacks, e.g.,
from bulk import, which reopens the backend instance. If create an
instance and a vlv index, then initialize the database with bulk import,
2 VLV index callbacks are registered. The first set points the old instance
address, which is already freed.
Note: the unregister callback functions are called only when the instance
is deleted in vlv_remove_callbacks via ldbm_instance_unregister_callbacks.
The callback is set as the post delete plugin with "(objectclass=nsBackendInstance)".
Fix description:
1) When a VLV index is removed, it calls dblayer_erase_index_file_nolock.
2) Before registering VLV plugin callbacks, calling unregister callbacks to
make sure cleaning up the existing callbacks.
https://fedorahosted.org/389/ticket/47966
Reviewed by rmeggins(a)redhat.com and mreynolds(a)redhat.com (Thank you, Rich and Mark!!)
diff --git a/ldap/servers/slapd/back-ldbm/back-ldbm.h b/ldap/servers/slapd/back-ldbm/back-ldbm.h
index fd17453..b3badbc 100644
--- a/ldap/servers/slapd/back-ldbm/back-ldbm.h
+++ b/ldap/servers/slapd/back-ldbm/back-ldbm.h
@@ -718,15 +718,15 @@ typedef struct _modify_context modify_context;
/* This structure was moved here from dblayer.c because the ldbm_instance
* structure uses the dblayer_handle structure. */
-struct tag_dblayer_handle; typedef struct tag_dblayer_handle dblayer_handle;
struct tag_dblayer_handle
{
DB* dblayer_dbp;
PRLock *dblayer_lock; /* used when anyone wants exclusive access to a file */
- dblayer_handle *dblayer_handle_next;
+ struct tag_dblayer_handle *dblayer_handle_next;
void **dblayer_handle_ai_backpointer; /* Voodo magic pointer to the place where we store a
pointer to this handle in the attrinfo structure */
};
+typedef struct tag_dblayer_handle dblayer_handle;
/* This structure was moved here from perfctrs.c so the ldbm_instance structure
* could use it. */
diff --git a/ldap/servers/slapd/back-ldbm/dblayer.c b/ldap/servers/slapd/back-ldbm/dblayer.c
index 2524355..e7339fb 100644
--- a/ldap/servers/slapd/back-ldbm/dblayer.c
+++ b/ldap/servers/slapd/back-ldbm/dblayer.c
@@ -2740,7 +2740,7 @@ int dblayer_close_indexes(backend *be)
pDB = handle->dblayer_dbp;
return_value |= pDB->close(pDB,0);
next = handle->dblayer_handle_next;
- *(handle->dblayer_handle_ai_backpointer) = NULL;
+ *((dblayer_handle **)handle->dblayer_handle_ai_backpointer) = NULL;
slapi_ch_free((void**)&handle);
}
@@ -3341,39 +3341,32 @@ int dblayer_get_index_file(backend *be, struct attrinfo *a, DB** ppDB, int open_
a, &pDB);
if (0 == return_value) {
/* Opened it OK */
- dblayer_handle *handle = (dblayer_handle *)
- slapi_ch_calloc(1, sizeof(dblayer_handle));
-
- if (NULL == handle) {
- /* Memory allocation failed */
- return_value = -1;
- } else {
- dblayer_handle *prev_handle = inst->inst_handle_tail;
+ dblayer_handle *handle = (dblayer_handle *)slapi_ch_calloc(1, sizeof(dblayer_handle));
+ dblayer_handle *prev_handle = inst->inst_handle_tail;
- PR_ASSERT(NULL != pDB);
- /* Store the returned DB* in our own private list of
- * open files */
- if (NULL == prev_handle) {
+ PR_ASSERT(NULL != pDB);
+ /* Store the returned DB* in our own private list of
+ * open files */
+ if (NULL == prev_handle) {
/* List was empty */
inst->inst_handle_tail = handle;
inst->inst_handle_head = handle;
- } else {
+ } else {
/* Chain the handle onto the last structure in the
* list */
inst->inst_handle_tail = handle;
prev_handle->dblayer_handle_next = handle;
- }
- /* Stash a pointer to our wrapper structure in the
- * attrinfo structure */
- handle->dblayer_dbp = pDB;
- /* And, most importantly, return something to the caller!*/
- *ppDB = pDB;
- /* and save the hande in the attrinfo structure for
- * next time */
- a->ai_dblayer = handle;
- /* don't need to update count -- we incr'd it already */
- handle->dblayer_handle_ai_backpointer = &(a->ai_dblayer);
}
+ /* Stash a pointer to our wrapper structure in the
+ * attrinfo structure */
+ handle->dblayer_dbp = pDB;
+ /* And, most importantly, return something to the caller!*/
+ *ppDB = pDB;
+ /* and save the hande in the attrinfo structure for
+ * next time */
+ a->ai_dblayer = handle;
+ /* don't need to update count -- we incr'd it already */
+ handle->dblayer_handle_ai_backpointer = &(a->ai_dblayer);
} else {
/* Did not open it OK ! */
/* Do nothing, because return value and fact that we didn't
@@ -3445,10 +3438,10 @@ dblayer_db_remove(dblayer_private_env * env, char const path[], char const dbNam
int dblayer_erase_index_file_ex(backend *be, struct attrinfo *a,
PRBool use_lock, int no_force_checkpoint)
{
- struct ldbminfo *li = (struct ldbminfo *) be->be_database->plg_private;
- dblayer_private *priv = (dblayer_private*) li->li_dblayer_private;
- struct dblayer_private_env *pEnv = priv->dblayer_env;
- ldbm_instance *inst = (ldbm_instance *) be->be_instance_info;
+ struct ldbminfo *li = NULL;
+ dblayer_private *priv = NULL;
+ struct dblayer_private_env *pEnv = NULL;
+ ldbm_instance *inst = NULL;
dblayer_handle *handle = NULL;
char dbName[MAXPATHLEN];
char *dbNamep;
@@ -3457,9 +3450,25 @@ int dblayer_erase_index_file_ex(backend *be, struct attrinfo *a,
int rc = 0;
DB *db = 0;
- if (NULL == pEnv) /* db does not exist */
+ if ((NULL == be) || (NULL == be->be_database)) {
return rc;
-
+ }
+ inst = (ldbm_instance *)be->be_instance_info;
+ if (NULL == inst) {
+ return rc;
+ }
+ li = (struct ldbminfo *)be->be_database->plg_private;
+ if (NULL == li) {
+ return rc;
+ }
+ priv = (dblayer_private*)li->li_dblayer_private;
+ if (NULL == priv) {
+ return rc;
+ }
+ pEnv = priv->dblayer_env;
+ if (NULL == pEnv) { /* db does not exist */
+ return rc;
+ }
/* Added for bug 600401. Somehow the checkpoint thread deadlocked on
index file with this function, index file couldn't be removed on win2k.
Force a checkpoint here to break deadlock.
diff --git a/ldap/servers/slapd/back-ldbm/vlv.c b/ldap/servers/slapd/back-ldbm/vlv.c
index d061bf2..384fd46 100644
--- a/ldap/servers/slapd/back-ldbm/vlv.c
+++ b/ldap/servers/slapd/back-ldbm/vlv.c
@@ -74,7 +74,10 @@ int vlv_AddSearchEntry(Slapi_PBlock *pb, Slapi_Entry* entryBefore, Slapi_Entry*
{
ldbm_instance *inst = (ldbm_instance *)arg;
struct vlvSearch* newVlvSearch= vlvSearch_new();
- backend *be = inst->inst_be;
+ backend *be = NULL;
+ if (inst) {
+ be = inst->inst_be;
+ }
if (NULL == be) { /* backend is not associated */
vlvSearch_delete(&newVlvSearch);
@@ -427,8 +430,19 @@ vlv_init(ldbm_instance *inst)
}
/* Only need to register these callbacks for SLAPD mode... */
- if(basedn!=NULL)
+ if(basedn)
{
+ /* In case the vlv indexes are already registered, clean them up before register them. */
+ slapi_config_remove_callback(SLAPI_OPERATION_SEARCH,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_SearchIndexEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_ADD,DSE_FLAG_PREOP,basedn,scope,searchfilter,vlv_AddSearchEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_ADD,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_AddIndexEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_MODIFY,DSE_FLAG_PREOP,basedn,scope,searchfilter,vlv_ModifySearchEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_MODIFY,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_ModifyIndexEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_DELETE,DSE_FLAG_PREOP,basedn,scope,searchfilter,vlv_DeleteSearchEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_DELETE,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_DeleteIndexEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_MODRDN,DSE_FLAG_PREOP,basedn,scope,searchfilter,vlv_ModifyRDNSearchEntry);
+ slapi_config_remove_callback(SLAPI_OPERATION_MODRDN,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_ModifyRDNIndexEntry);
+
slapi_config_register_callback(SLAPI_OPERATION_SEARCH,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_SearchIndexEntry,(void*)inst);
slapi_config_register_callback(SLAPI_OPERATION_ADD,DSE_FLAG_PREOP,basedn,scope,searchfilter,vlv_AddSearchEntry,(void*)inst);
slapi_config_register_callback(SLAPI_OPERATION_ADD,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_AddIndexEntry,(void*)inst);
@@ -438,7 +452,7 @@ vlv_init(ldbm_instance *inst)
slapi_config_register_callback(SLAPI_OPERATION_DELETE,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_DeleteIndexEntry,(void*)inst);
slapi_config_register_callback(SLAPI_OPERATION_MODRDN,DSE_FLAG_PREOP,basedn,scope,searchfilter,vlv_ModifyRDNSearchEntry,(void*)inst);
slapi_config_register_callback(SLAPI_OPERATION_MODRDN,DSE_FLAG_PREOP,basedn,scope,indexfilter,vlv_ModifyRDNIndexEntry,(void*)inst);
- slapi_ch_free_string(&basedn);
+ slapi_ch_free_string(&basedn);
}
out:
@@ -448,8 +462,8 @@ out:
/* Removes callbacks from above when instance is removed. */
int
-vlv_remove_callbacks(ldbm_instance *inst) {
-
+vlv_remove_callbacks(ldbm_instance *inst)
+{
int return_value= LDAP_SUCCESS;
int scope= LDAP_SCOPE_SUBTREE;
char *basedn = NULL;
diff --git a/ldap/servers/slapd/back-ldbm/vlv_srch.c b/ldap/servers/slapd/back-ldbm/vlv_srch.c
index d7e28c1..bd94865 100644
--- a/ldap/servers/slapd/back-ldbm/vlv_srch.c
+++ b/ldap/servers/slapd/back-ldbm/vlv_srch.c
@@ -572,6 +572,7 @@ vlvIndex_delete(struct vlvIndex** ppvs)
}
}
internal_ldap_free_sort_keylist((*ppvs)->vlv_sortkey);
+ dblayer_erase_index_file_nolock((*ppvs)->vlv_be, (*ppvs)->vlv_attrinfo, 1 /* chkpt if not busy */);
attrinfo_delete(&((*ppvs)->vlv_attrinfo));
slapi_ch_free((void**)&((*ppvs)->vlv_name));
slapi_ch_free((void**)&((*ppvs)->vlv_filename));
@@ -618,7 +619,7 @@ vlvIndex_init(struct vlvIndex* p, backend *be, struct vlvSearch* pSearch, const
{
if(p->vlv_sortkey[n]->sk_matchruleoid!=NULL)
{
- create_matchrule_indexer(&p->vlv_mrpb[n],p->vlv_sortkey[n]->sk_matchruleoid,p->vlv_sortkey[n]->sk_attrtype);
+ create_matchrule_indexer(&p->vlv_mrpb[n],p->vlv_sortkey[n]->sk_matchruleoid,p->vlv_sortkey[n]->sk_attrtype);
}
}
@@ -632,7 +633,7 @@ vlvIndex_init(struct vlvIndex* p, backend *be, struct vlvSearch* pSearch, const
/* Create an attrinfo structure */
p->vlv_attrinfo->ai_type= slapi_ch_smprintf("%s%s",file_prefix,filename);
- p->vlv_attrinfo->ai_indexmask= INDEX_VLV;
+ p->vlv_attrinfo->ai_indexmask= INDEX_VLV;
/* Check if the index file actually exists */
if(li!=NULL)
@@ -657,14 +658,14 @@ vlvIndex_get_indexlength(struct vlvIndex* p, DB *db, back_txn *txn)
if(!p->vlv_indexlength_cached)
{
- DBC *dbc = NULL;
- DB_TXN *db_txn = NULL;
+ DBC *dbc = NULL;
+ DB_TXN *db_txn = NULL;
int err= 0;
- if (NULL != txn)
+ if (NULL != txn)
{
- db_txn = txn->back_txn_txn;
+ db_txn = txn->back_txn_txn;
}
- err = db->cursor(db, db_txn, &dbc, 0);
+ err = db->cursor(db, db_txn, &dbc, 0);
if(err==0)
{
DBT key= {0};
@@ -924,7 +925,7 @@ vlvIndex_createfilename(struct vlvIndex* pIndex, char **ppc)
*p= '\0';
if(strlen(filename)==0)
{
- LDAPDebug( LDAP_DEBUG_ANY, "Couldn't generate valid filename from Virtual List View Index Name (%s). Need some alphabetical characters.\n", pIndex->vlv_name, 0, 0);
+ LDAPDebug( LDAP_DEBUG_ANY, "Couldn't generate valid filename from Virtual List View Index Name (%s). Need some alphabetical characters.\n", pIndex->vlv_name, 0, 0);
filenameValid= 0;
}
/* JCM: Check if this file clashes with another VLV Index filename */
1
0
05 Jan '15
dirsrvtests/tickets/ticket47980_test.py | 710 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 20
2 files changed, 717 insertions(+), 13 deletions(-)
New commits:
commit 322d7d0dabb0b3cf52a0c544f0e4fb09e9af9080
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 5 16:56:09 2015 -0500
Ticket 47980 - Nested COS definitions can be incorrectly
processed
Bug Description: The COS cache attribute index gets incorrectly sorted
and results in unexpected COS values being applied to
an entry.
Fix Description: The sorting method for comparing the target tree does
not work as indended, but we don't need to sort by the
target tree if the cos attributes are the same, as the
list is already in the proper tree order as returned by
the internal search. The fix was just to remove the
target tree comparison from the qsort compare function.
https://fedorahosted.org/389/ticket/47980
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 987580d6fb42e358d84539a78879ae9a00393bd1)
diff --git a/dirsrvtests/tickets/ticket47980_test.py b/dirsrvtests/tickets/ticket47980_test.py
new file mode 100644
index 0000000..406d72d
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47980_test.py
@@ -0,0 +1,710 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH1 = 'ou=level1,' + DEFAULT_SUFFIX
+BRANCH2 = 'ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH3 = 'ou=level3,ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH4 = 'ou=people,' + DEFAULT_SUFFIX
+BRANCH5 = 'ou=lower,ou=people,' + DEFAULT_SUFFIX
+BRANCH6 = 'ou=lower,ou=lower,ou=people,' + DEFAULT_SUFFIX
+USER1_DN = 'uid=user1,%s' % (BRANCH1)
+USER2_DN = 'uid=user2,%s' % (BRANCH2)
+USER3_DN = 'uid=user3,%s' % (BRANCH3)
+USER4_DN = 'uid=user4,%s' % (BRANCH4)
+USER5_DN = 'uid=user5,%s' % (BRANCH5)
+USER6_DN = 'uid=user6,%s' % (BRANCH6)
+
+BRANCH1_CONTAINER = 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level1,dc=example,dc=com'
+
+BRANCH2_CONTAINER = 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH3_CONTAINER = 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH4_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH4_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+
+BRANCH5_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=people,dc=example,dc=com'
+BRANCH5_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=People,dc=example,dc=com'
+
+BRANCH6_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47980(topology):
+ """
+ Multiple COS pointer definitions that use the same attribute are not correctly ordered.
+ The cos plugin was incorrectly sorting the attribute indexes based on subtree, which lead
+ to the wrong cos attribute value being applied to the entry.
+ """
+
+ log.info('Testing Ticket 47980 - Testing multiple nested COS pointer definitions are processed correctly')
+
+ # Add our nested branches
+ try:
+ topology.standalone.add_s(Entry((BRANCH1, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH2, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH3, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level3: error ' + e.message['desc'])
+ assert False
+
+ # People branch, might already exist
+ try:
+ topology.standalone.add_s(Entry((BRANCH4, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add level4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH5, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH6, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level6: error ' + e.message['desc'])
+ assert False
+
+ # Add users to each branch
+ try:
+ topology.standalone.add_s(Entry((USER1_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER2_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER3_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user3: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER4_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user4'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER5_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER6_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user6: error ' + e.message['desc'])
+ assert False
+
+ # Enable password policy
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 1
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level1,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH1_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'costemplatedn': BRANCH1_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 2
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level2,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH2_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'costemplatedn': BRANCH2_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level2: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 3
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level3,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH3_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'costemplatedn': BRANCH3_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 4
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch4: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH4_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH4_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch4: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 5
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH5_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH5_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 6
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH6_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH6_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch6: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Now check that each user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER1_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH1_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER1_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER2_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH2_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER2_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER2_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER3_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH3_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER3_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER3_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER4_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH4_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER4_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER4_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER5_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH5_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER5_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER5_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER6_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH6_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER6_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER6_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47980_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47980(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index 10f475e..76cc8fd 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -3097,25 +3097,19 @@ static int cos_cache_attr_compare(const void *e1, const void *e2)
int com_Result;
cosAttributes *pAttr = (*(cosAttributes**)e1);
cosTemplates *pTemplate = (cosTemplates*)pAttr->pParent;
- cosDefinitions *pDef = (cosDefinitions*)pTemplate->pParent;
- cosAttrValue *pcostt = pDef->pCosTargetTree;
cosAttributes *pAttr1 = (*(cosAttributes**)e2);
cosTemplates *pTemplate1 = (cosTemplates*)pAttr1->pParent;
- cosDefinitions *pDef1 = (cosDefinitions*)pTemplate1->pParent;
- cosAttrValue *pcostt1 = pDef1->pCosTargetTree;
/* Now compare the names of the attributes */
com_Result = slapi_utf8casecmp((unsigned char*)(*(cosAttributes**)e1)->pAttrName,(unsigned char*)(*(cosAttributes**)e2)->pAttrName);
+ if(0 == com_Result){
+ /* Now compare the cosPriorities */
+ com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
+ }
if(0 == com_Result)
- /* Now compare the definition Dn parents */
- com_Result = slapi_utf8casecmp((unsigned char*)pcostt1->val,(unsigned char*)pcostt->val);
- if(0 == com_Result)
- /* Now compare the cosPririoties */
- com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
- /* Now compare the prirority */
- if(0 == com_Result)
- return -1;
- return com_Result;
+ return -1;
+
+ return com_Result;
}
static int cos_cache_string_compare(const void *e1, const void *e2)
1
0
05 Jan '15
dirsrvtests/tickets/ticket47980_test.py | 710 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 20
2 files changed, 717 insertions(+), 13 deletions(-)
New commits:
commit 864b67740555b72fb31d084cec884e321704968c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 5 16:56:09 2015 -0500
Ticket 47980 - Nested COS definitions can be incorrectly
processed
Bug Description: The COS cache attribute index gets incorrectly sorted
and results in unexpected COS values being applied to
an entry.
Fix Description: The sorting method for comparing the target tree does
not work as indended, but we don't need to sort by the
target tree if the cos attributes are the same, as the
list is already in the proper tree order as returned by
the internal search. The fix was just to remove the
target tree comparison from the qsort compare function.
https://fedorahosted.org/389/ticket/47980
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 987580d6fb42e358d84539a78879ae9a00393bd1)
diff --git a/dirsrvtests/tickets/ticket47980_test.py b/dirsrvtests/tickets/ticket47980_test.py
new file mode 100644
index 0000000..406d72d
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47980_test.py
@@ -0,0 +1,710 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH1 = 'ou=level1,' + DEFAULT_SUFFIX
+BRANCH2 = 'ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH3 = 'ou=level3,ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH4 = 'ou=people,' + DEFAULT_SUFFIX
+BRANCH5 = 'ou=lower,ou=people,' + DEFAULT_SUFFIX
+BRANCH6 = 'ou=lower,ou=lower,ou=people,' + DEFAULT_SUFFIX
+USER1_DN = 'uid=user1,%s' % (BRANCH1)
+USER2_DN = 'uid=user2,%s' % (BRANCH2)
+USER3_DN = 'uid=user3,%s' % (BRANCH3)
+USER4_DN = 'uid=user4,%s' % (BRANCH4)
+USER5_DN = 'uid=user5,%s' % (BRANCH5)
+USER6_DN = 'uid=user6,%s' % (BRANCH6)
+
+BRANCH1_CONTAINER = 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level1,dc=example,dc=com'
+
+BRANCH2_CONTAINER = 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH3_CONTAINER = 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH4_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH4_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+
+BRANCH5_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=people,dc=example,dc=com'
+BRANCH5_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=People,dc=example,dc=com'
+
+BRANCH6_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47980(topology):
+ """
+ Multiple COS pointer definitions that use the same attribute are not correctly ordered.
+ The cos plugin was incorrectly sorting the attribute indexes based on subtree, which lead
+ to the wrong cos attribute value being applied to the entry.
+ """
+
+ log.info('Testing Ticket 47980 - Testing multiple nested COS pointer definitions are processed correctly')
+
+ # Add our nested branches
+ try:
+ topology.standalone.add_s(Entry((BRANCH1, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH2, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH3, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level3: error ' + e.message['desc'])
+ assert False
+
+ # People branch, might already exist
+ try:
+ topology.standalone.add_s(Entry((BRANCH4, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add level4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH5, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH6, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level6: error ' + e.message['desc'])
+ assert False
+
+ # Add users to each branch
+ try:
+ topology.standalone.add_s(Entry((USER1_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER2_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER3_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user3: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER4_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user4'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER5_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER6_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user6: error ' + e.message['desc'])
+ assert False
+
+ # Enable password policy
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 1
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level1,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH1_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'costemplatedn': BRANCH1_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 2
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level2,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH2_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'costemplatedn': BRANCH2_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level2: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 3
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level3,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH3_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'costemplatedn': BRANCH3_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 4
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch4: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH4_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH4_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch4: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 5
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH5_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH5_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 6
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH6_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH6_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch6: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Now check that each user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER1_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH1_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER1_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER2_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH2_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER2_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER2_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER3_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH3_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER3_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER3_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER4_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH4_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER4_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER4_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER5_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH5_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER5_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER5_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER6_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH6_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER6_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER6_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47980_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47980(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index 9175a39..bc1132f 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -3054,25 +3054,19 @@ static int cos_cache_attr_compare(const void *e1, const void *e2)
int com_Result;
cosAttributes *pAttr = (*(cosAttributes**)e1);
cosTemplates *pTemplate = (cosTemplates*)pAttr->pParent;
- cosDefinitions *pDef = (cosDefinitions*)pTemplate->pParent;
- cosAttrValue *pcostt = pDef->pCosTargetTree;
cosAttributes *pAttr1 = (*(cosAttributes**)e2);
cosTemplates *pTemplate1 = (cosTemplates*)pAttr1->pParent;
- cosDefinitions *pDef1 = (cosDefinitions*)pTemplate1->pParent;
- cosAttrValue *pcostt1 = pDef1->pCosTargetTree;
/* Now compare the names of the attributes */
com_Result = slapi_utf8casecmp((unsigned char*)(*(cosAttributes**)e1)->pAttrName,(unsigned char*)(*(cosAttributes**)e2)->pAttrName);
+ if(0 == com_Result){
+ /* Now compare the cosPriorities */
+ com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
+ }
if(0 == com_Result)
- /* Now compare the definition Dn parents */
- com_Result = slapi_utf8casecmp((unsigned char*)pcostt1->val,(unsigned char*)pcostt->val);
- if(0 == com_Result)
- /* Now compare the cosPririoties */
- com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
- /* Now compare the prirority */
- if(0 == com_Result)
- return -1;
- return com_Result;
+ return -1;
+
+ return com_Result;
}
static int cos_cache_string_compare(const void *e1, const void *e2)
1
0
05 Jan '15
dirsrvtests/tickets/ticket47980_test.py | 710 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 20
2 files changed, 717 insertions(+), 13 deletions(-)
New commits:
commit 3494fec27bd3a970aad30993d4867f677b3ebba1
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 5 16:56:09 2015 -0500
Ticket 47980 - Nested COS definitions can be incorrectly
processed
Bug Description: The COS cache attribute index gets incorrectly sorted
and results in unexpected COS values being applied to
an entry.
Fix Description: The sorting method for comparing the target tree does
not work as indended, but we don't need to sort by the
target tree if the cos attributes are the same, as the
list is already in the proper tree order as returned by
the internal search. The fix was just to remove the
target tree comparison from the qsort compare function.
https://fedorahosted.org/389/ticket/47980
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 987580d6fb42e358d84539a78879ae9a00393bd1)
diff --git a/dirsrvtests/tickets/ticket47980_test.py b/dirsrvtests/tickets/ticket47980_test.py
new file mode 100644
index 0000000..406d72d
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47980_test.py
@@ -0,0 +1,710 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH1 = 'ou=level1,' + DEFAULT_SUFFIX
+BRANCH2 = 'ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH3 = 'ou=level3,ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH4 = 'ou=people,' + DEFAULT_SUFFIX
+BRANCH5 = 'ou=lower,ou=people,' + DEFAULT_SUFFIX
+BRANCH6 = 'ou=lower,ou=lower,ou=people,' + DEFAULT_SUFFIX
+USER1_DN = 'uid=user1,%s' % (BRANCH1)
+USER2_DN = 'uid=user2,%s' % (BRANCH2)
+USER3_DN = 'uid=user3,%s' % (BRANCH3)
+USER4_DN = 'uid=user4,%s' % (BRANCH4)
+USER5_DN = 'uid=user5,%s' % (BRANCH5)
+USER6_DN = 'uid=user6,%s' % (BRANCH6)
+
+BRANCH1_CONTAINER = 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level1,dc=example,dc=com'
+
+BRANCH2_CONTAINER = 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH3_CONTAINER = 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH4_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH4_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+
+BRANCH5_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=people,dc=example,dc=com'
+BRANCH5_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=People,dc=example,dc=com'
+
+BRANCH6_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47980(topology):
+ """
+ Multiple COS pointer definitions that use the same attribute are not correctly ordered.
+ The cos plugin was incorrectly sorting the attribute indexes based on subtree, which lead
+ to the wrong cos attribute value being applied to the entry.
+ """
+
+ log.info('Testing Ticket 47980 - Testing multiple nested COS pointer definitions are processed correctly')
+
+ # Add our nested branches
+ try:
+ topology.standalone.add_s(Entry((BRANCH1, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH2, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH3, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level3: error ' + e.message['desc'])
+ assert False
+
+ # People branch, might already exist
+ try:
+ topology.standalone.add_s(Entry((BRANCH4, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add level4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH5, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH6, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level6: error ' + e.message['desc'])
+ assert False
+
+ # Add users to each branch
+ try:
+ topology.standalone.add_s(Entry((USER1_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER2_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER3_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user3: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER4_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user4'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER5_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER6_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user6: error ' + e.message['desc'])
+ assert False
+
+ # Enable password policy
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 1
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level1,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH1_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'costemplatedn': BRANCH1_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 2
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level2,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH2_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'costemplatedn': BRANCH2_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level2: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 3
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level3,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH3_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'costemplatedn': BRANCH3_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 4
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch4: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH4_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH4_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch4: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 5
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH5_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH5_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 6
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH6_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH6_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch6: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Now check that each user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER1_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH1_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER1_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER2_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH2_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER2_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER2_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER3_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH3_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER3_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER3_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER4_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH4_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER4_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER4_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER5_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH5_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER5_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER5_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER6_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH6_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER6_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER6_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47980_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47980(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index de003fd..3214f82 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -3054,25 +3054,19 @@ static int cos_cache_attr_compare(const void *e1, const void *e2)
int com_Result;
cosAttributes *pAttr = (*(cosAttributes**)e1);
cosTemplates *pTemplate = (cosTemplates*)pAttr->pParent;
- cosDefinitions *pDef = (cosDefinitions*)pTemplate->pParent;
- cosAttrValue *pcostt = pDef->pCosTargetTree;
cosAttributes *pAttr1 = (*(cosAttributes**)e2);
cosTemplates *pTemplate1 = (cosTemplates*)pAttr1->pParent;
- cosDefinitions *pDef1 = (cosDefinitions*)pTemplate1->pParent;
- cosAttrValue *pcostt1 = pDef1->pCosTargetTree;
/* Now compare the names of the attributes */
com_Result = slapi_utf8casecmp((unsigned char*)(*(cosAttributes**)e1)->pAttrName,(unsigned char*)(*(cosAttributes**)e2)->pAttrName);
+ if(0 == com_Result){
+ /* Now compare the cosPriorities */
+ com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
+ }
if(0 == com_Result)
- /* Now compare the definition Dn parents */
- com_Result = slapi_utf8casecmp((unsigned char*)pcostt1->val,(unsigned char*)pcostt->val);
- if(0 == com_Result)
- /* Now compare the cosPririoties */
- com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
- /* Now compare the prirority */
- if(0 == com_Result)
- return -1;
- return com_Result;
+ return -1;
+
+ return com_Result;
}
static int cos_cache_string_compare(const void *e1, const void *e2)
1
0
05 Jan '15
dirsrvtests/tickets/ticket47980_test.py | 710 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 20
2 files changed, 717 insertions(+), 13 deletions(-)
New commits:
commit 18eb6cec9f3841ba7afb6fb489f420e36d40cb90
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 5 16:56:09 2015 -0500
Ticket 47980 - Nested COS definitions can be incorrectly
processed
Bug Description: The COS cache attribute index gets incorrectly sorted
and results in unexpected COS values being applied to
an entry.
Fix Description: The sorting method for comparing the target tree does
not work as indended, but we don't need to sort by the
target tree if the cos attributes are the same, as the
list is already in the proper tree order as returned by
the internal search. The fix was just to remove the
target tree comparison from the qsort compare function.
https://fedorahosted.org/389/ticket/47980
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 987580d6fb42e358d84539a78879ae9a00393bd1)
diff --git a/dirsrvtests/tickets/ticket47980_test.py b/dirsrvtests/tickets/ticket47980_test.py
new file mode 100644
index 0000000..406d72d
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47980_test.py
@@ -0,0 +1,710 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH1 = 'ou=level1,' + DEFAULT_SUFFIX
+BRANCH2 = 'ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH3 = 'ou=level3,ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH4 = 'ou=people,' + DEFAULT_SUFFIX
+BRANCH5 = 'ou=lower,ou=people,' + DEFAULT_SUFFIX
+BRANCH6 = 'ou=lower,ou=lower,ou=people,' + DEFAULT_SUFFIX
+USER1_DN = 'uid=user1,%s' % (BRANCH1)
+USER2_DN = 'uid=user2,%s' % (BRANCH2)
+USER3_DN = 'uid=user3,%s' % (BRANCH3)
+USER4_DN = 'uid=user4,%s' % (BRANCH4)
+USER5_DN = 'uid=user5,%s' % (BRANCH5)
+USER6_DN = 'uid=user6,%s' % (BRANCH6)
+
+BRANCH1_CONTAINER = 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level1,dc=example,dc=com'
+
+BRANCH2_CONTAINER = 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH3_CONTAINER = 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH4_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH4_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+
+BRANCH5_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=people,dc=example,dc=com'
+BRANCH5_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=People,dc=example,dc=com'
+
+BRANCH6_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47980(topology):
+ """
+ Multiple COS pointer definitions that use the same attribute are not correctly ordered.
+ The cos plugin was incorrectly sorting the attribute indexes based on subtree, which lead
+ to the wrong cos attribute value being applied to the entry.
+ """
+
+ log.info('Testing Ticket 47980 - Testing multiple nested COS pointer definitions are processed correctly')
+
+ # Add our nested branches
+ try:
+ topology.standalone.add_s(Entry((BRANCH1, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH2, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH3, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level3: error ' + e.message['desc'])
+ assert False
+
+ # People branch, might already exist
+ try:
+ topology.standalone.add_s(Entry((BRANCH4, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add level4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH5, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH6, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level6: error ' + e.message['desc'])
+ assert False
+
+ # Add users to each branch
+ try:
+ topology.standalone.add_s(Entry((USER1_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER2_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER3_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user3: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER4_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user4'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER5_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER6_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user6: error ' + e.message['desc'])
+ assert False
+
+ # Enable password policy
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 1
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level1,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH1_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'costemplatedn': BRANCH1_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 2
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level2,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH2_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'costemplatedn': BRANCH2_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level2: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 3
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level3,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH3_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'costemplatedn': BRANCH3_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 4
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch4: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH4_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH4_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch4: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 5
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH5_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH5_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 6
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH6_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH6_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch6: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Now check that each user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER1_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH1_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER1_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER2_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH2_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER2_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER2_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER3_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH3_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER3_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER3_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER4_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH4_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER4_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER4_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER5_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH5_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER5_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER5_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER6_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH6_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER6_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER6_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47980_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47980(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index a74389d..0d9a61e 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -3054,25 +3054,19 @@ static int cos_cache_attr_compare(const void *e1, const void *e2)
int com_Result;
cosAttributes *pAttr = (*(cosAttributes**)e1);
cosTemplates *pTemplate = (cosTemplates*)pAttr->pParent;
- cosDefinitions *pDef = (cosDefinitions*)pTemplate->pParent;
- cosAttrValue *pcostt = pDef->pCosTargetTree;
cosAttributes *pAttr1 = (*(cosAttributes**)e2);
cosTemplates *pTemplate1 = (cosTemplates*)pAttr1->pParent;
- cosDefinitions *pDef1 = (cosDefinitions*)pTemplate1->pParent;
- cosAttrValue *pcostt1 = pDef1->pCosTargetTree;
/* Now compare the names of the attributes */
com_Result = slapi_utf8casecmp((unsigned char*)(*(cosAttributes**)e1)->pAttrName,(unsigned char*)(*(cosAttributes**)e2)->pAttrName);
+ if(0 == com_Result){
+ /* Now compare the cosPriorities */
+ com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
+ }
if(0 == com_Result)
- /* Now compare the definition Dn parents */
- com_Result = slapi_utf8casecmp((unsigned char*)pcostt1->val,(unsigned char*)pcostt->val);
- if(0 == com_Result)
- /* Now compare the cosPririoties */
- com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
- /* Now compare the prirority */
- if(0 == com_Result)
- return -1;
- return com_Result;
+ return -1;
+
+ return com_Result;
}
static int cos_cache_string_compare(const void *e1, const void *e2)
1
0
dirsrvtests/tickets/ticket47980_test.py | 710 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/cos/cos_cache.c | 20
2 files changed, 717 insertions(+), 13 deletions(-)
New commits:
commit 987580d6fb42e358d84539a78879ae9a00393bd1
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Jan 5 16:56:09 2015 -0500
Ticket 47980 - Nested COS definitions can be incorrectly
processed
Bug Description: The COS cache attribute index gets incorrectly sorted
and results in unexpected COS values being applied to
an entry.
Fix Description: The sorting method for comparing the target tree does
not work as indended, but we don't need to sort by the
target tree if the cos attributes are the same, as the
list is already in the proper tree order as returned by
the internal search. The fix was just to remove the
target tree comparison from the qsort compare function.
https://fedorahosted.org/389/ticket/47980
Reviewed by: nhosoi(Thanks!)
diff --git a/dirsrvtests/tickets/ticket47980_test.py b/dirsrvtests/tickets/ticket47980_test.py
new file mode 100644
index 0000000..406d72d
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47980_test.py
@@ -0,0 +1,710 @@
+import os
+import sys
+import time
+import ldap
+import ldap.sasl
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+BRANCH1 = 'ou=level1,' + DEFAULT_SUFFIX
+BRANCH2 = 'ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH3 = 'ou=level3,ou=level2,ou=level1,' + DEFAULT_SUFFIX
+BRANCH4 = 'ou=people,' + DEFAULT_SUFFIX
+BRANCH5 = 'ou=lower,ou=people,' + DEFAULT_SUFFIX
+BRANCH6 = 'ou=lower,ou=lower,ou=people,' + DEFAULT_SUFFIX
+USER1_DN = 'uid=user1,%s' % (BRANCH1)
+USER2_DN = 'uid=user2,%s' % (BRANCH2)
+USER3_DN = 'uid=user3,%s' % (BRANCH3)
+USER4_DN = 'uid=user4,%s' % (BRANCH4)
+USER5_DN = 'uid=user5,%s' % (BRANCH5)
+USER6_DN = 'uid=user6,%s' % (BRANCH6)
+
+BRANCH1_CONTAINER = 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level1,dc=example,dc=com'
+BRANCH1_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level1,dc=example,dc=com'
+
+BRANCH2_CONTAINER = 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH2_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH3_CONTAINER = 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlevel3\2Cou\3Dlevel2\2Cou\3Dlevel1\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+BRANCH3_COS_DEF = 'cn=nsPwPolicy_CoS,ou=level3,ou=level2,ou=level1,dc=example,dc=com'
+
+BRANCH4_CONTAINER = 'cn=nsPwPolicyContainer,ou=people,dc=example,dc=com'
+BRANCH4_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=People,dc=example,dc=com'
+BRANCH4_COS_DEF = 'cn=nsPwPolicy_CoS,ou=people,dc=example,dc=com'
+
+BRANCH5_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=people,dc=example,dc=com'
+BRANCH5_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=People,dc=example,dc=com'
+BRANCH5_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=People,dc=example,dc=com'
+
+BRANCH6_CONTAINER = 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cou\3Dlower\2Cou\3Dlower\2Cou\3DPeople\2Cdc\3Dexample\2Cdc\3Dcom,' + \
+ 'cn=nsPwPolicyContainer,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+BRANCH6_COS_DEF = 'cn=nsPwPolicy_CoS,ou=lower,ou=lower,ou=People,dc=example,dc=com'
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47980(topology):
+ """
+ Multiple COS pointer definitions that use the same attribute are not correctly ordered.
+ The cos plugin was incorrectly sorting the attribute indexes based on subtree, which lead
+ to the wrong cos attribute value being applied to the entry.
+ """
+
+ log.info('Testing Ticket 47980 - Testing multiple nested COS pointer definitions are processed correctly')
+
+ # Add our nested branches
+ try:
+ topology.standalone.add_s(Entry((BRANCH1, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH2, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH3, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level3: error ' + e.message['desc'])
+ assert False
+
+ # People branch, might already exist
+ try:
+ topology.standalone.add_s(Entry((BRANCH4, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level4'
+ })))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError, e:
+ log.error('Failed to add level4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH5, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'level5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((BRANCH6, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'level6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add level6: error ' + e.message['desc'])
+ assert False
+
+ # Add users to each branch
+ try:
+ topology.standalone.add_s(Entry((USER1_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user1'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user1: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER2_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user2'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user2: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER3_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user3'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user3: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER4_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user4'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user4: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER5_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user5'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user5: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((USER6_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'uid': 'user6'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add user6: error ' + e.message['desc'])
+ assert False
+
+ # Enable password policy
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError, e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 1
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level1,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH1_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level1: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH1_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level1,dc=example,dc=com',
+ 'costemplatedn': BRANCH1_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 2
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level2,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH2_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level2: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH2_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level2,dc=example,dc=com',
+ 'costemplatedn': BRANCH2_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level2: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 3
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=level3,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH3_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH3_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'costemplatedn': BRANCH3_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 4
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch4: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH4_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for level3: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH4_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH4_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch4: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 5
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH5_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch5: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH5_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH5_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for level3: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add subtree policy to branch 6
+ #
+ # Add the container
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_CONTAINER, {
+ 'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add subtree container for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the password policy subentry
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_PWP, {
+ 'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=level3,dc=example,dc=com',
+ 'passwordMustChange': 'off',
+ 'passwordExp': 'off',
+ 'passwordHistory': 'off',
+ 'passwordMinAge': '0',
+ 'passwordChange': 'off',
+ 'passwordStorageScheme': 'ssha'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add passwordpolicy for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS template
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_TMPL, {
+ 'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'cosPriority': '1',
+ 'cn': 'cn=nsPwTemplateEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'pwdpolicysubentry': BRANCH6_PWP
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS template for branch6: error ' + e.message['desc'])
+ assert False
+
+ # Add the COS definition
+ try:
+ topology.standalone.add_s(Entry((BRANCH6_COS_DEF, {
+ 'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': 'cn=nsPwPolicyEntry,ou=lower,ou=lower,ou=people,dc=example,dc=com',
+ 'costemplatedn': BRANCH6_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'
+ })))
+ except ldap.LDAPError, e:
+ log.error('Failed to add COS def for branch6: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Now check that each user has its expected passwordPolicy subentry
+ #
+ try:
+ entries = topology.standalone.search_s(USER1_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH1_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!')
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER1_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER2_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH2_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER2_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER2_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER3_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH3_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER3_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER3_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER4_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH4_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER4_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER4_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER5_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH5_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER5_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER5_DN, e.message['desc']))
+ assert False
+
+ try:
+ entries = topology.standalone.search_s(USER6_DN, ldap.SCOPE_BASE, '(objectclass=top)', ['pwdpolicysubentry'])
+ if not entries[0].hasValue('pwdpolicysubentry', BRANCH6_PWP):
+ log.fatal('User %s does not have expected pwdpolicysubentry!' % USER6_DN)
+ assert False
+ except ldap.LDAPError, e:
+ log.fatal('Unable to search for entry %s: error %s' % (USER6_DN, e.message['desc']))
+ assert False
+
+ # If we got here the test passed
+ log.info('Test PASSED')
+
+
+def test_ticket47980_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '@pytest.fixture' line before 'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47980(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
diff --git a/ldap/servers/plugins/cos/cos_cache.c b/ldap/servers/plugins/cos/cos_cache.c
index a74389d..0d9a61e 100644
--- a/ldap/servers/plugins/cos/cos_cache.c
+++ b/ldap/servers/plugins/cos/cos_cache.c
@@ -3054,25 +3054,19 @@ static int cos_cache_attr_compare(const void *e1, const void *e2)
int com_Result;
cosAttributes *pAttr = (*(cosAttributes**)e1);
cosTemplates *pTemplate = (cosTemplates*)pAttr->pParent;
- cosDefinitions *pDef = (cosDefinitions*)pTemplate->pParent;
- cosAttrValue *pcostt = pDef->pCosTargetTree;
cosAttributes *pAttr1 = (*(cosAttributes**)e2);
cosTemplates *pTemplate1 = (cosTemplates*)pAttr1->pParent;
- cosDefinitions *pDef1 = (cosDefinitions*)pTemplate1->pParent;
- cosAttrValue *pcostt1 = pDef1->pCosTargetTree;
/* Now compare the names of the attributes */
com_Result = slapi_utf8casecmp((unsigned char*)(*(cosAttributes**)e1)->pAttrName,(unsigned char*)(*(cosAttributes**)e2)->pAttrName);
+ if(0 == com_Result){
+ /* Now compare the cosPriorities */
+ com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
+ }
if(0 == com_Result)
- /* Now compare the definition Dn parents */
- com_Result = slapi_utf8casecmp((unsigned char*)pcostt1->val,(unsigned char*)pcostt->val);
- if(0 == com_Result)
- /* Now compare the cosPririoties */
- com_Result = pTemplate->cosPriority - pTemplate1->cosPriority;
- /* Now compare the prirority */
- if(0 == com_Result)
- return -1;
- return com_Result;
+ return -1;
+
+ return com_Result;
}
static int cos_cache_string_compare(const void *e1, const void *e2)
1
0