389-commits January 2015

389-commits@lists.fedoraproject.org

4 participants
91 discussions

ldap/servers
by Mark Reynolds 21 Jan '15

21 Jan '15

ldap/servers/plugins/acl/acllas.c | 34 +++++++++++++++++----------------- ldap/servers/plugins/acl/aclparse.c | 4 ++-- ldap/servers/plugins/acl/aclutil.c | 6 +++--- 3 files changed, 22 insertions(+), 22 deletions(-) New commits: commit 67177a2108ebf04094be003662f8091ecde5706b Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Wed Jan 21 15:51:30 2015 -0500 Ticket 47738 - use PL_strcasestr instead of strcasestr Bug Description: The use of strcasestr results in unresolved symbols for libacl-plugin.so on build on Solaris Fix Description: Use PR_strcasestr Original patch submitted by: cgrzemba(Thanks!) https://fedorahosted.org/389/ticket/47738 Reviewed by: mreynolds diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c index 4738a40..e3c1778 100644 --- a/ldap/servers/plugins/acl/acllas.c +++ b/ldap/servers/plugins/acl/acllas.c @@ -584,9 +584,9 @@ DS_LASUserDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator, } else { /* URL format */ - if ((strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) || - (strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || - (strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { + if ((PL_strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) || + (PL_strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || + (PL_strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { matched = aclutil_evaluate_macro( s_user, &lasinfo, ACL_EVAL_USER); @@ -856,9 +856,9 @@ DS_LASGroupDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator, "Group not evaluated(%s)\n", groupName); break; } else { - if ((strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) || - (strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || - (strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { + if ((PL_strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) || + (PL_strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || + (PL_strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { matched = aclutil_evaluate_macro( groupName, &lasinfo, ACL_EVAL_GROUP); slapi_log_error ( SLAPI_LOG_ACL, plugin_name, @@ -1075,9 +1075,9 @@ DS_LASRoleDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator, } else { /* Take care of param strings */ - if ((strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) || - (strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || - (strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { + if ((PL_strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) || + (PL_strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || + (PL_strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { matched = aclutil_evaluate_macro( role, &lasinfo, ACL_EVAL_ROLE); @@ -2626,9 +2626,9 @@ DS_LASGroupDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator, /* In this case "grppupdnattr="ldap:///base??attr" */ - if ((strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) || - (strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || - (strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { + if ((PL_strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) || + (PL_strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) || + (PL_strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) { matched = aclutil_evaluate_macro( attrName, &lasinfo, ACL_EVAL_GROUPDNATTR); @@ -4199,12 +4199,12 @@ acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) { int has_macro_levels = 0; /* Determine what the rule's got once */ - if ( strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) { + if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) { /* ($dn) exists */ has_macro_dn = 1; } - if ( strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) { + if ( PL_strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) { /* [$dn] exists */ has_macro_levels = 1; } @@ -4308,7 +4308,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo) int l; Slapi_Attr *attr = NULL; - str = strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY); + str = PL_strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY); if ( str == NULL ) { charray_add(&a, slapi_ch_strdup(rule)); @@ -4317,7 +4317,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo) } else { working_rule = slapi_ch_strdup(rule); - str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY); + str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY); charray_add(&working_list, working_rule ); while( str != NULL) { @@ -4415,7 +4415,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo) slapi_ch_free_string(&macro_str); slapi_ch_free_string(&macro_attr_name); - str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY); + str = PL_strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY); }/* while */ diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c index fd262e8..24b186e 100644 --- a/ldap/servers/plugins/acl/aclparse.c +++ b/ldap/servers/plugins/acl/aclparse.c @@ -318,8 +318,8 @@ __aclp__parse_aci(char *str, aci_t *aci_item, char **errbuf) * have a target and it must have a macro. */ - if ((strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) || - (strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) { + if ((PL_strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) || + (PL_strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) { /* Must have a targetmacro */ if ( !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) { diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c index 0720dae..619f857 100644 --- a/ldap/servers/plugins/acl/aclutil.c +++ b/ldap/servers/plugins/acl/aclutil.c @@ -1250,7 +1250,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) { char *working_s, *suffix, *prefix, *patched; int replace_with_len, substr_len, prefix_len, suffix_len; - if (strcasestr(s, substr) == NULL) { + if (PL_strcasestr(s, substr) == NULL) { return(slapi_ch_strdup(s)); } else { @@ -1260,7 +1260,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) { working_s = slapi_ch_strdup(s); prefix = working_s; - str = strcasestr(prefix, substr); + str = PL_strcasestr(prefix, substr); while (str != NULL) { @@ -1287,7 +1287,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) { working_s = patched; prefix = working_s; - str = strcasestr(prefix, substr); + str = PL_strcasestr(prefix, substr); }

1 0

Branch '389-ds-base-1.2.11' - ldap/servers
by Noriko Hosoi 21 Jan '15

21 Jan '15

ldap/servers/slapd/entry.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) New commits: commit 340b9dc5f979d75ab5bb92c7aa61808ff1fddd1f Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Thu Jun 13 18:22:21 2013 -0700 Ticket #569 - examine replication code to reduce amount of stored state information Description: commit c7f6f161f4967635d6f02b029be571d88ec61961 made this change: In case the deleted value list in an attribute is empty: * this means the entry is deleted and has no more attributes, * when writing the attr to disk we would loose the AD-csn. * Add an empty value to the set of deleted values. This will * never be seen by any client. It will never be moved to the * present values and is only used to preserve the AD-csn. The AD-csn size was not counted for the buffer size to allocate. This patch adds the size. https://fedorahosted.org/389/ticket/569 Reviewed by Nathan (Thanks!!) (cherry picked from commit ca02529c797903139c56bd9b8b90e8cd5bd0c3f4) Conflicts: ldap/servers/slapd/entry.c diff --git a/ldap/servers/slapd/entry.c b/ldap/servers/slapd/entry.c index 1341296..340844d 100644 --- a/ldap/servers/slapd/entry.c +++ b/ldap/servers/slapd/entry.c @@ -1476,7 +1476,17 @@ entry2str_internal_size_attrlist( const Slapi_Attr *attrlist, int entry2str_ctrl /* ";adcsn-" + a->a_deletioncsn */ if ( a->a_deletioncsn ) { - elen+= 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE; + elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE; + } + if ( valueset_isempty(&a->a_deleted_values)) { + /* this means the entry is deleted and has no more attributes, + * when writing the attr to disk we would loose the AD-csn. + * Add an empty value to the set of deleted values. This will + * never be seen by any client. It will never be moved to the + * present values and is only used to preserve the AD-csn + * We need to add the size for that. + */ + elen += 1 + LDIF_CSNPREFIX_MAXLENGTH + CSN_STRSIZE; } } }

1 0

Changes to 'refs/tags/389-ds-console-1.2.9'
by Noriko Hosoi 21 Jan '15

21 Jan '15

Changes since the dawn of time: Endi S. Dewata (3): Bug 496863 - 'Construct' button creates incorrect referral urls Resolves: bug 574098 Bug 563513 - New replication -> No changelong configured-msg Mark Reynolds (10): Ticket 370 - Opening merge qualifier CoS entry using RHDS console changes the entry Bumped version to 1.2.7 Ticket 96 - Window too large for Manage password policy Ticket 47883 - DS Console - java exception when refreshing Ticket 176 - DS Console should timeout when mismatched port Ticket 47886 - DS Console - mouse wheel speed very slow Ticket 47485 - DS instance cannot be restored from remote console Ticket 47887 - DS Console does not correctly disable SSL Ticket 135 - DS console - right clicking an object does not select that object Ticket 47994 - DS Console always sets nsSSL3 to "on" when a securty setting is adjusted Nathan Kinder (28): 171941 - Adjusted the version number and branding. I had to modify the checkVersion method to deal with running in Console 1.0. I also cleaned up references to consolesdk in the Ant build files. They should be console instead since we dropped the consolesdk naming. The external and internal imports files were adjusted to pick up the new 1.0 Console component. 171941 - checkVersion was comparing versions with greater than when it should have been using greater than or equal to 177696 - Changed usage of enum keyword as a variable name for Java 1.5 compatibility Bug(s) fixed: 181570 Resolves: 246513 Summary: Initial fedora-ds-console specfile. Resolves: ? Resolves: 250137 Resolves: 250145 Resolves: 204510 Resolves: 250636 Resolves: 252036 Add default ldapjdk path as well as a settable parameter Fixed typo from last checkin Use less restrictive version of Open Publication License for online help docs. Resolves: 308221 Resolves: 333171 Resolves: 178247 Resolves: 379191 Bug 599732 - Root node in directory browser shows DN syntax error Bug 229693 - Update naming attribute when objectclass is removed Bug 474113 - Allow access log level to be configured from Console Bug 504803 - Allow nsslapd-*-logmaxdiskspace to be set to -1 in UI Bug 158262 - Windows Sync UI is inconistent Bug 533505 - Warn about CA cert trust when enabling SSL in Console Bug 616707 - Add attribute matching rule UI to Console Bug 705753 - Refresh problem in Console directory browser Bug 700908 - Validate matching rules when creating a new attribute Noriko Hosoi (23): Changed the ldapconsole package name to <brand>-ds-<version>.jar Modified ant move syntax to support ant 1.6.2 [186105] Admin Server Makefile updates for Internal build Resolves: #247215 Resolves: #248073 Resolves: #379191 Resolves: #386041 Resolves: #379191 Resolves: #379191 Resolves: #379191 Resolves: #379191 Resolves: #379191 Resolves: 178947 Bug 553066 - Directory Console: do not display "subtree" index type Bug 151705 - Need to update Console Cipher Preferences with new ciphers Bug 661116 - 389-console Configuration tab admin permissions Bug 387981 - plain files can be chosen on the Restore Directory dialog Bug 450016 - RFE- Console display values in KB/MB/GB Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc) Bug 757773 - SSL Port issue in Console Ticket #47380 - RFE: Winsync loses connection with AD objects when they move from the console. Bumped version to 1.2.8 Bumped version to 1.2.9 Rich Megginson (39): Bug(s) fixed: 167761 allow the definition of the console location on the command line with different directory layouts than the default Bug(s) fixed: 178478 The console now builds jar files in the format bump version to 1.0.3 updated spec for Fedora DS 1.1 release Resolves: bug 428357 Bump version to 1.1.2 this is for the 1.1.2 release Resolves: bug 469261 Resolves: bug 469261 Resolves: bug 234948 Resolves: bug 452596 Resolves: bug 178947 Resolves: bug 177334 Resolves: bug 249120 Resolves: bug 238762 Resolves: bug 179193 Resolves: bug 179184 change version to 1.1.3 Resolves: bug 487831 Resolves: bug 481213 Resolves: bug 483660 Resolves: bug 483660 updated for 1.1.3 version must correspond to ds base version - 1.2.0 rename to 389 change mode of spec file to 644 added separate doc subpackage update to version 1.2.1 Bug 586571 - DS Console shows escaped DNs bump version to 1.2.2 Bug 586571 - DS Console shows escaped DNs Bug 591989 - [console] mis-matched trademark and text bump version to 1.2.4 bump version to 1.2.5 add skin support move dsbanner.gif to the localized jar for l10n/skinning dsbannerlite.gif is obsolete foxworth (2): Import initial source drop of Fedora DirectoryConsole Import initial source drop of Fedora DirectoryConsole

1 0

build.properties
by Noriko Hosoi 21 Jan '15

21 Jan '15

build.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit f9c99a54c56bcedfdb6b3d08c492c4cb43476572 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Jan 20 15:10:04 2015 -0800 Bumped version to 1.2.9 diff --git a/build.properties b/build.properties index 1d99d68..49b83dd 100755 --- a/build.properties +++ b/build.properties @@ -21,7 +21,7 @@ lang=en ldapconsole.root=.. -ldapconsole.version=1.2.8 +ldapconsole.version=1.2.9 ldapconsole.gen.version=1.2 brand=389 ldapconsole.name=${brand}-ds-${ldapconsole.version}

1 0

Changes to 'refs/tags/389-admin-1.1.37'
by Noriko Hosoi 21 Jan '15

21 Jan '15

Changes since 389-admin-1.1.11: Endi S. Dewata (3): Bug 573889 - Migration does not remove deprecated schema Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries Bug 470576 - Migration could do addition checks before commiting actions Ludwig (1): Ticket 47563 - cannot restart directory server from console Mark Reynolds (15): Ticket #286 - compilation fixes for 'format-security' Ticket 401 - Console login fails with anonymous access disabled Ticket 400 - BIND operation result not checked properly in admin server Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry Ticket 47495 - admin express: wrong instance creation time Ticket 47497 - Admin Express - remove "Security Level" Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time Ticket 47300 - Update man page for remove-ds-admin.pl Ticket 47891 - Admin Server reconfig breaks SSL config Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain Ticket 47548 - register-ds-admin does not register into remote config ds Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c Ticket 201 - nCipher HSM cannot be configured via the console Ticket 47929 - Admin Server - disable SSLv3 by default Nathan Kinder (49): Bug 648949 - Merge selinux policy into base OS Regenerated autoconf files Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled Bug 668950 - Add posix group support to Console Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH Bug 618897 - Wrong permissions when creating instance from Console Bug 493424 - remove unneeded modules for admin server apache config Bug 614690 - Don't use exec to call genrb Bug 699815 - (cov#10859) Add missing braces in mod_admserv code Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi Bug 699815 - (cov#10849,10851) Remove unused variables Bug 699907 - (cov#10844) Uninitialized time struct Bug 699907 - (cov#10843) Use of uninitialized variable in logging code Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi Bug 699907 - (cov#10836) Use of uninitialized var in http conn code Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code Bug 700532 - (cov#10832) Incorrect if condition in dsalib Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib Bug 700890 - (cov#10812) Check return value of open() properly in libadmin Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi Bug 700948 - (cov#10842) Use of unintialized variable in statusping Bug 700948 - (cov#10842) Use of unintialized variable in statusping Bug 702150 - (cov#10823) File descriptors leaked in help cgi Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi Bug 702150 - leak of config array in dsalib Bug 702150 - (cov#10816) file descriptor leak in dsalib Bug 702150 - (cov#10817) Leak of string in libdsa Bug 702150 - Resouce leaks in htmladmin.c Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin Bug 702705 - NULL pointer dereferences in viewlog cgi Bug 702705 - (cov#10803) NULL pointer dereference in security cgi Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy Bug 724808 - startup CGIs write temp file to / Bug 730079 - Update SELinux policy during upgrades Ticket #329 - Port modules to httpd 2.4 Ticket #47333 - Relabel lockfile when starting Admin Server Ticket #47334 - Avoid quoting all settings in console.conf Ticket 47468 - Change security password validation error is out of order Ticket 47466 - Importing CA cert with existing name crashes security CGI Ticket 362 - Directory Console generates insufficient key strength Ticket 47467 - Improve CRL import error messages Noriko Hosoi (26): Bug 151705 - Need to update Console Cipher Preferences with new ciphers start-ds-admin.in -- replaced "return 1" with "exit 1" Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies Bug 618858 - move start-ds-admin env file into main admin server Bug 387981 - plain files can be chosen on the Restore Directory dialog Bug 604881 - admin server log files have incorrect permissions/ownerships Bug 604881 - admin server log files have incorrect permissions/ownerships Bug 245278 - Changing to a password with a single quote does not work Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc) Bug 158926 - Unable to install CA certificate when using Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user Bug 476925 - Admin Server: Do not allow 8-bit passwords for Trac Ticket #307 - htmladmin keeps segfaulting If htmladmin fails to connect to the server, the cgi could crash. Ticket #293 - remove-ds-admin.pl does not remove everything Ticket #476 - 389 ds do not start on F18 due to missing modules bump version to 1.1.31 Ticket #567 - Restart of Admin server from console fails on segfault bump version to 1.1.32 bump version to 1.1.33 bump version to 1.1.34 Ticket #47493 - Configuration Tab does not work with FIPS mode enabled bump version to 1.1.36 Ticket 47891 - Admin Server reconfig breaks SSL config Ticket #47995 - Admin Server: source code cleaning bump version to 1.1.37 Rich Megginson (66): bump version to 1.1.12.a1 initial support for openldap add selinux policy for dsgw skip LD_PRELOAD if using openldap add more log information if nss init fails add even more nss debugging Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized bump version to 1.1.12.a2 fix building with mozldap bump version to 1.1.12.a3 fix autotool build issues with properties files setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error Bug 656441 - Missing library path entry causes LD_PRELOAD error bump version to 1.1.13 bump version to 1.1.14.a1 Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required bump version to 1.1.14 bump version to 1.1.15 bump version to 1.1.16 Bug 703990 - Support upgrade from Red Hat Directory Server bump version to 1.1.17 add support for different skins skip rebranding current brand bump version to 1.1.18 look for separate openldap ldif library bump version to 1.1.19 Bug 710372 - Not able to open the Manage Certificate from DS-console better NSS error handling - reduce memory leaks fix typo in NSS_Shutdown warning message added tests for the security cgi Bug 713000 - Migration stops if old admin server cannot be stopped Bug 718079 - Perl errors when running migrate-ds-admin.pl Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts bump version to 1.1.20 bump version to 1.1.21 handle binary upgrade add man pages for ds_removal and ds_unregister bump version to 1.1.22 fix binary paths bump version to 1.1.23 bump version to 1.1.24 Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd Bug 740959 - 389-console put CA certificates into wrong database bump version to 1.1.25 Bug 767823 - selinux: need to allow admin server to connect to ldap port bump version to 1.1.26 Ticket #161 - Review and address latest Coverity issues Ticket #281 - TLS not working with latest openldap bump version to 1.1.27 bump version to 1.1.28 bump version to 1.1.29 bump version to 1.1.30 ignore files generated by Eclipse Ticket #47486 compiler warnings in adminutil, admin, dsgw Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw add more debugging for SSL connection problems Ticket #47413 389-admin fails to build with latest httpd compiler warning - ldif_read_record lineno type depends on openldap version add Eclipse and patch files bump version to 1.1.35 Ticket #47498 Error Message for Failed to create the configuration directory server Ticket #418 Error with register-ds-admin.pl Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down. Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>" Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour Ticket #47478 No groups file? error restarting Admin server Wes Hardin (1): fix for bug 377 - Unchecked use of SELinux command noriko (1): Ticket #47298 - remove-ds-admin.pl does not stop the admin server --- .gitignore | 4 Makefile.am | 109 Makefile.in | 1767 - VERSION.sh | 4 aclocal.m4 | 7258 ---- admserv/cfgstuff/console.conf.in | 2 admserv/cfgstuff/httpd-2.2.conf.in | 13 admserv/cfgstuff/httpd-2.4.conf.in | 742 admserv/cfgstuff/httpd.conf.in | 2 admserv/cfgstuff/initconfig.in | 5 admserv/cfgstuff/start-ds-admin.in | 83 admserv/cgi-ds/ds_listdb.c | 26 admserv/cgi-ds/ds_snmpctrl.c | 5 admserv/cgi-src40/ReadLog.c | 18 admserv/cgi-src40/admlib.mk | 119 admserv/cgi-src40/admpw.c | 79 admserv/cgi-src40/cgicommon.h | 1 admserv/cgi-src40/cgicommon.properties | 3 admserv/cgi-src40/config.c | 43 admserv/cgi-src40/dllglue.c | 42 admserv/cgi-src40/ds_create.in | 18 admserv/cgi-src40/dsconfig.c | 10 admserv/cgi-src40/head.html | 1 admserv/cgi-src40/help.c | 15 admserv/cgi-src40/htmladmin.c | 810 admserv/cgi-src40/htmladmin.properties | 42 admserv/cgi-src40/monreplication.c | 7 admserv/cgi-src40/repl-monitor-cgi.pl.in | 37 admserv/cgi-src40/restartsrv.c | 9 admserv/cgi-src40/sec-activate.c | 163 admserv/cgi-src40/security.c | 314 admserv/cgi-src40/security.properties | 6 admserv/cgi-src40/start_config_ds.c | 11 admserv/cgi-src40/statpingserv.c | 82 admserv/cgi-src40/stopsrv.c | 10 admserv/cgi-src40/ugdsconfig.c | 39 admserv/cgi-src40/viewdata.c | 264 admserv/cgi-src40/viewdata.properties | 2 admserv/cgi-src40/viewlog.c | 75 admserv/cgi-src40/viewlog.properties | 6 admserv/genrb_wrapper.sh | 2 admserv/html/admserv.html.in | 11 admserv/html/htmladmin.html.in | 13 admserv/html/monreplication.html | 20 admserv/html/viewdata.html | 6 admserv/html/viewlog.html | 14 admserv/makeUpgradeTar.sh | 30 admserv/newinst/src/25changefedorato389.pl | 250 admserv/newinst/src/25rebrand.pl.in | 413 admserv/newinst/src/30updateglobalpref.pl.in | 9 admserv/newinst/src/AdminMigration.pm.in | 79 admserv/newinst/src/AdminServer.pm.in | 266 admserv/newinst/src/AdminUtil.pm.in | 91 admserv/newinst/src/ConfigDSDialogs.pm | 42 admserv/newinst/src/dirserver.map.in | 1 admserv/newinst/src/register-ds-admin.pl.in | 714 admserv/newinst/src/register-ds-admin.res.in | 36 admserv/newinst/src/register_param.map.in | 4 admserv/newinst/src/register_server.pl.in | 6 admserv/newinst/src/remove-ds-admin.pl.in | 8 admserv/newinst/src/setup-ds-admin.pl.in | 6 admserv/newinst/src/setup-ds-admin.res.in | 20 admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49 admserv/schema/ldif/10dsdata.ldif.tmpl | 39 compile | 240 config.guess | 529 config.h.in | 33 config.sub | 379 configure |38698 +++++++++------------- configure.ac | 111 depcomp | 343 include/base/file.h | 3 include/base/util.h | 3 include/libadmin/dbtlibadmin.h | 2 include/libadmin/libadmin.h | 92 include/libdsa/dsalib.h | 15 install-sh | 538 lib/base/file.cpp | 30 lib/base/nscputil.cpp | 51 lib/libadmin/dllglue.c | 77 lib/libadmin/httpcon.c | 5 lib/libadmin/referer.c | 4 lib/libadmin/template.c | 29 lib/libadmin/util.c | 973 lib/libdsa/dsalib_conf.c | 37 lib/libdsa/dsalib_confs.c | 93 lib/libdsa/dsalib_location.c | 56 lib/libdsa/dsalib_tailf.c | 1 lib/libdsa/dsalib_updown.c | 118 lib/libdsa/dsalib_util.c | 56 ltmain.sh |14878 +++++--- m4/adminutil.m4 | 4 m4/httpd.m4 | 3 m4/mozldap.m4 | 116 m4/openldap.m4 | 138 m4/selinux.m4 | 3 man/man8/ds_removal.8 | 54 man/man8/ds_unregister.8 | 48 man/man8/register-ds-admin.pl.8 | 139 man/man8/remove-ds-admin.pl.8 | 10 man/man8/restart-ds-admin.8 | 10 man/man8/start-ds-admin.8 | 10 man/man8/stop-ds-admin.8 | 10 missing | 234 mod_admserv/mod_admserv.c | 564 mod_admserv/mod_admserv.h | 15 mod_restartd/mod_restartd-2.2.c | 22 selinux/dirsrv-admin.fc.in | 5 selinux/dirsrv-admin.te | 2 tests/ds_create/testget.1 | 2 tests/htmladmin/testget.2 | 2 tests/htmladmin/testget.3 | 2 tests/htmladmin/testget.4 | 2 tests/htmladmin/testget.5 | 2 tests/htmladmin/testget.6 | 2 tests/htmladmin/testget.7 | 2 tests/htmladmin/testget.8 | 2 tests/security/testpost.1 | 1 tests/security/testpost.10 | 1 tests/security/testpost.11 | 1 tests/security/testpost.12 | 1 tests/security/testpost.13 | 1 tests/security/testpost.14 | 1 tests/security/testpost.15 | 1 tests/security/testpost.16 | 1 tests/security/testpost.17 | 1 tests/security/testpost.18 | 1 tests/security/testpost.19 | 1 tests/security/testpost.2 | 1 tests/security/testpost.20 | 1 tests/security/testpost.21 | 1 tests/security/testpost.3 | 1 tests/security/testpost.4 | 1 tests/security/testpost.5 | 1 tests/security/testpost.6 | 1 tests/security/testpost.7 | 1 tests/security/testpost.8 | 1 tests/security/testpost.9 | 1 tests/setup.sh | 250 tests/ugdsconfig/testget.10 | 2 tests/viewdata/testget.2 | 2 tests/viewdata/testget.3 | 2 tests/viewdata/testget.4 | 2 tests/viewlog/testget.3 | 2 tests/viewlog/testget.4 | 2 wrappers/initscript.in | 3 wrappers/systemd.service.in | 24 147 files changed, 35279 insertions(+), 38203 deletions(-) ---

1 0

2 commits - lib/libadmin VERSION.sh
by Noriko Hosoi 21 Jan '15

21 Jan '15

VERSION.sh | 2 +- lib/libadmin/httpcon.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) New commits: commit 963909573337291e400ce25964bf42fdf9134713 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Jan 20 13:36:36 2015 -0800 bump version to 1.1.37 diff --git a/VERSION.sh b/VERSION.sh index 2942ec3..366bcab 100644 --- a/VERSION.sh +++ b/VERSION.sh @@ -11,7 +11,7 @@ vendorurl=http://port389.org # PACKAGE_VERSION is constructed from these VERSION_MAJOR=1 VERSION_MINOR=1 -VERSION_MAINT=36 +VERSION_MAINT=37 # if this is a PRERELEASE, set VERSION_PREREL # otherwise, comment it out # be sure to include the dot prefix in the prerel commit 9ea342d2e63ca060bf6a7f195610815c29b99550 Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Jan 20 13:56:31 2015 -0800 Ticket #47995 - Admin Server: source code cleaning Description: Removing unnecessary full path. Note: it's in the DEBUG_TRACE which is not enabled. https://fedorahosted.org/389/ticket/47995 diff --git a/lib/libadmin/httpcon.c b/lib/libadmin/httpcon.c index 4bc5abe..24a39e1 100644 --- a/lib/libadmin/httpcon.c +++ b/lib/libadmin/httpcon.c @@ -69,7 +69,8 @@ extern void SEC_Init(void); #ifdef DEBUG_TRACE FILE *dbf = NULL; int numconns = 0; -char *dbd = "/tmp/http_trace.%d"; +/* Replace '/path/to' with a real path when DEBUG_TRACE is enabled. */ +char *dbd = "/path/to/http_trace.%d"; char dbp[256]; #endif

1 0

admserv/newinst
by Noriko Hosoi 20 Jan '15

20 Jan '15

admserv/newinst/src/AdminServer.pm.in | 44 +++++++++++++++++++++++------- admserv/newinst/src/setup-ds-admin.res.in | 2 + 2 files changed, 36 insertions(+), 10 deletions(-) New commits: commit 894e5b9a64c2edaea6f1a1ef089015a1920169df Author: Noriko Hosoi <nhosoi(a)redhat.com> Date: Tue Jan 20 13:18:59 2015 -0800 Ticket 47891 - Admin Server reconfig breaks SSL config Description: 1) Use mkdtemp to reduce the risk to disclose the sec file backup location that is in the same file system as the original files exist. 2) reconfig_backup_secfiles and reconfig_restore_secfiles expect the admin config dir, e.g., "/etc/dirsrv/admin-serv" or the dir specified by the environment variable. 3) Update (--update) did not call reconfig_restore_secfiles in which restores and delete the backup dir. 4) If creating or accessing the sec backup dir fails, it issues a fatal error and quits the reconfiguration. https://fedorahosted.org/389/ticket/47891 Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!) diff --git a/admserv/newinst/src/AdminServer.pm.in b/admserv/newinst/src/AdminServer.pm.in index a189c66..0c98a6e 100644 --- a/admserv/newinst/src/AdminServer.pm.in +++ b/admserv/newinst/src/AdminServer.pm.in @@ -30,8 +30,11 @@ require Exporter; use File::Path; use File::Copy; +use File::Basename; +use File::Temp; -my $secfile_backup_dir = "/tmp/adm-sec-files." . $$; +my $template_backup_dir = "tmpdirXXXX"; +my $secfile_backup_dir = ""; # tempfiles use File::Temp qw(tempfile tempdir); @@ -515,8 +518,12 @@ sub reconfig_backup_secfiles # my $configdir = shift; + my $dirname = dirname $configdir; + my $my_template_backup_dir = $dirname . "/" . $template_backup_dir; + $secfile_backup_dir = mkdtemp($my_template_backup_dir); if ( ! -d $secfile_backup_dir){ - mkdir ($secfile_backup_dir, 0755); + $setup->msg($FATAL, 'error_creating_secfile_backup', $secfile_backup_dir, $!); + return 0; } foreach my $savefile (@reconfigsavefiles) { if ( -e "$configdir/$savefile"){ @@ -527,6 +534,7 @@ sub reconfig_backup_secfiles } } } + return 1; } sub reconfig_restore_secfiles @@ -536,11 +544,16 @@ sub reconfig_restore_secfiles # my $configdir = shift; + if ( ! -d $secfile_backup_dir){ + $setup->msg($FATAL, 'error_accessing_secfile_backup', $secfile_backup_dir); + return 0; + } foreach my $savefile (@reconfigsavefiles) { move ("$secfile_backup_dir/$savefile" ,"$configdir/$savefile"); debug(1, "Restoring $configdir/$savefile with $secfile_backup_dir/$savefile\n"); } rmdir ($secfile_backup_dir); + return 1; } sub createAdminServer { @@ -548,13 +561,6 @@ sub createAdminServer { my $reconfig = shift; # setup has inf, res, and log - if ($reconfig) { - $setup->msg('begin_reconfig_adminserver'); - reconfig_backup_secfiles($setup->{inf}->{admin}->{config_dir}); - } else { - $setup->msg('begin_create_adminserver'); - } - if (!setDefaults($setup)) { return 0; } @@ -578,6 +584,15 @@ sub createAdminServer { $ENV{ADMSERV_PID_DIR} || "@piddir@"; + if ($reconfig) { + $setup->msg('begin_reconfig_adminserver'); + if (!reconfig_backup_secfiles($configdir)) { + return 0; + } + } else { + $setup->msg('begin_create_adminserver'); + } + # if we're just doing the update, just register and return if ($setup->{update}) { if (!registerASWithConfigDS($setup, $configdir)) { @@ -587,6 +602,13 @@ sub createAdminServer { # Update SELinux policy if needed updateSelinuxPolicy($setup, $configdir, $securitydir, $logdir, $rundir); + # Restore the security files before we start the server + if ($reconfig) { + if (!reconfig_restore_secfiles($configdir)) { + return 0; + } + } + return 1; } @@ -619,7 +641,9 @@ sub createAdminServer { # Restore the security files before we start the server if ($reconfig) { - reconfig_restore_secfiles($setup->{inf}->{admin}->{config_dir}); + if (!reconfig_restore_secfiles($configdir)) { + return 0; + } } if (!startAdminServer($setup, $configdir, $logdir, $rundir)) { diff --git a/admserv/newinst/src/setup-ds-admin.res.in b/admserv/newinst/src/setup-ds-admin.res.in index e83d045..b03bc0c 100644 --- a/admserv/newinst/src/setup-ds-admin.res.in +++ b/admserv/newinst/src/setup-ds-admin.res.in @@ -161,3 +161,5 @@ error_removing_port_label = Error: could not remove selinux label from port '%s' error_product_already_exists = Error: the product %s already exists.\ If you want to delete this entry and force the conversion of the older\ product, run this program again with the --force option.\n\n +error_creating_secfile_backup = Could not create temporary directory %s to backup security files. Error: %s\n +error_accessing_secfile_backup = Could not access temporary directory %s to restore security files.\n

1 0

Branch '389-ds-base-1.3.3' - aclocal.m4 config.guess config.sub dirsrvtests/tickets ldap/admin ldap/ldif ldap/servers Makefile.am Makefile.in
by Mark Reynolds 20 Jan '15

20 Jan '15

Makefile.am | 14 Makefile.in | 104 ++-- aclocal.m4 | 15 config.guess | 192 +------- config.sub | 40 + dirsrvtests/tickets/ticket47462_test.py | 452 +++++++++++++++++++ ldap/admin/src/scripts/50AES-pbe-plugin.ldif | 16 ldap/admin/src/scripts/52updateAESplugin.pl | 84 +++ ldap/ldif/50replication-plugins.ldif | 2 ldap/ldif/template-dse.ldif.in | 16 ldap/servers/plugins/rever/des.c | 551 ----------------------- ldap/servers/plugins/rever/pbe.c | 621 +++++++++++++++++++++++++++ ldap/servers/plugins/rever/rever.c | 116 +++-- ldap/servers/plugins/rever/rever.h | 11 ldap/servers/slapd/daemon.c | 244 ++++++++++ ldap/servers/slapd/proto-slap.h | 1 ldap/servers/slapd/pw.c | 82 ++- ldap/servers/slapd/pw.h | 2 ldap/servers/slapd/result.c | 3 ldap/servers/slapd/security_wrappers.c | 6 ldap/servers/slapd/slap.h | 10 ldap/servers/slapd/slapi-plugin.h | 1 ldap/servers/slapd/ssl.c | 4 23 files changed, 1731 insertions(+), 856 deletions(-) New commits: commit 603501ec6bbe6ee9b3f033e924a4eef2a4925aa7 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Jan 20 10:59:05 2015 -0500 Ticket 47462 - Stop using DES in the reversible password encryption plug-in Bug Description: DES is not a safe cipher to use for Password Based Encryption(pbe). AES should be used instead. Fix Description: Use AES for all new password encodings. AES requires that the algorithm ID used to encode the password, must also be used to decode it. So, the algorithm ID is now stored in the cipher prefix: {AES-<BASE64 encoded alg ID>}<ENCODED PASSWORD> Since DES is no longer being used, the library has been renamed to a more apprpriate name: libdes-plugin -> libpbe-plugin During upgrades the DES plugin entry has its library path updated to use libpbe-plugin. The MMR plugin changes its dependency from DES to AES, and the AES plugin entry is added, and all the password attributes found in the old DES Plugin are migrated over to the new AES Plugin entry. When the server is restarted it checks for any DES passwords in the database and cn=config. If any are found they are converted to AES, and the DES plugin is disabled. Also created a new operation flag: SLAPI_OP_FLAG_IGNORE_UNINDEXED This flag prevents an internal unnidexed search from being logged in the "errors" log. When the server starts up it can potentially do unindexed searches while looking for DES passwords. We don't want this log "noise" in the errors log everytime the server starts. https://fedorahosted.org/389/ticket/47462 Design Doc: http://www.port389.org/docs/389ds/design/pbe.html Valgrind: Passed Reviewed by: nhosoi(Thanks!) (cherry picked from commit a57494fcaffccb6fdd060a93ba605d432e38bc09) diff --git a/Makefile.am b/Makefile.am index 049ff74..17aadff 100644 --- a/Makefile.am +++ b/Makefile.am @@ -225,7 +225,7 @@ endif serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \ libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \ libcollation-plugin.la libcos-plugin.la libderef-plugin.la \ - libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ + libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ liblinkedattrs-plugin.la libmanagedentries-plugin.la \ libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \ libcontentsync-plugin.la \ @@ -583,7 +583,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \ ldap/admin/src/scripts/82targetuniqueidindex.pl \ ldap/admin/src/scripts/90subtreerename.pl \ ldap/admin/src/scripts/91subtreereindex.pl \ + ldap/admin/src/scripts/50AES-pbe-plugin.ldif\ ldap/admin/src/scripts/50updateconfig.ldif \ + ldap/admin/src/scripts/52updateAESplugin.pl \ ldap/admin/src/scripts/dnaplugindepends.ldif update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh @@ -1016,14 +1018,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK) libderef_plugin_la_LDFLAGS = -avoid-version #------------------------ -# libdes-plugin +# libpbe-plugin #----------------------- -libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \ +libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \ ldap/servers/plugins/rever/rever.c -libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ -libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK) -libdes_plugin_la_LDFLAGS = -avoid-version +libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ +libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK) +libpbe_plugin_la_LDFLAGS = -avoid-version #------------------------ # libdistrib-plugin diff --git a/Makefile.in b/Makefile.in index 24a9ddf..dff7462 100644 --- a/Makefile.in +++ b/Makefile.in @@ -396,15 +396,6 @@ libderef_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ $(AM_CFLAGS) $(CFLAGS) $(libderef_plugin_la_LDFLAGS) \ $(LDFLAGS) -o $@ -libdes_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1) -am_libdes_plugin_la_OBJECTS = \ - ldap/servers/plugins/rever/libdes_plugin_la-des.lo \ - ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -libdes_plugin_la_OBJECTS = $(am_libdes_plugin_la_OBJECTS) -libdes_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ - $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ - $(AM_CFLAGS) $(CFLAGS) $(libdes_plugin_la_LDFLAGS) $(LDFLAGS) \ - -o $@ libdistrib_plugin_la_DEPENDENCIES = libslapd.la am_libdistrib_plugin_la_OBJECTS = \ ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo @@ -548,6 +539,15 @@ libpassthru_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ $(AM_CFLAGS) $(CFLAGS) $(libpassthru_plugin_la_LDFLAGS) \ $(LDFLAGS) -o $@ +libpbe_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1) +am_libpbe_plugin_la_OBJECTS = \ + ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo \ + ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo +libpbe_plugin_la_OBJECTS = $(am_libpbe_plugin_la_OBJECTS) +libpbe_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ + $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ + $(AM_CFLAGS) $(CFLAGS) $(libpbe_plugin_la_LDFLAGS) $(LDFLAGS) \ + -o $@ libposix_winsync_plugin_la_DEPENDENCIES = libslapd.la \ $(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1) am_libposix_winsync_plugin_la_OBJECTS = ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo \ @@ -1154,14 +1154,13 @@ SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \ $(libcollation_plugin_la_SOURCES) \ $(libcontentsync_plugin_la_SOURCES) \ $(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \ - $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \ - $(libdna_plugin_la_SOURCES) \ + $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \ $(libhttp_client_plugin_la_SOURCES) \ $(liblinkedattrs_plugin_la_SOURCES) \ $(libmanagedentries_plugin_la_SOURCES) \ $(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \ $(libpam_passthru_plugin_la_SOURCES) \ - $(libpassthru_plugin_la_SOURCES) \ + $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \ $(libposix_winsync_plugin_la_SOURCES) \ $(libpresence_plugin_la_SOURCES) \ $(libpwdstorage_plugin_la_SOURCES) \ @@ -1190,14 +1189,13 @@ DIST_SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \ $(libcollation_plugin_la_SOURCES) \ $(libcontentsync_plugin_la_SOURCES) \ $(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \ - $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \ - $(libdna_plugin_la_SOURCES) \ + $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \ $(libhttp_client_plugin_la_SOURCES) \ $(liblinkedattrs_plugin_la_SOURCES) \ $(libmanagedentries_plugin_la_SOURCES) \ $(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \ $(libpam_passthru_plugin_la_SOURCES) \ - $(libpassthru_plugin_la_SOURCES) \ + $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \ $(libposix_winsync_plugin_la_SOURCES) \ $(libpresence_plugin_la_SOURCES) \ $(libpwdstorage_plugin_la_SOURCES) \ @@ -1637,7 +1635,7 @@ server_LTLIBRARIES = libslapd.la libns-dshttpd.la serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \ libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \ libcollation-plugin.la libcos-plugin.la libderef-plugin.la \ - libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ + libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ liblinkedattrs-plugin.la libmanagedentries-plugin.la \ libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \ libcontentsync-plugin.la \ @@ -1991,7 +1989,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \ ldap/admin/src/scripts/82targetuniqueidindex.pl \ ldap/admin/src/scripts/90subtreerename.pl \ ldap/admin/src/scripts/91subtreereindex.pl \ + ldap/admin/src/scripts/50AES-pbe-plugin.ldif\ ldap/admin/src/scripts/50updateconfig.ldif \ + ldap/admin/src/scripts/52updateAESplugin.pl \ ldap/admin/src/scripts/dnaplugindepends.ldif update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh @@ -2363,14 +2363,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK) libderef_plugin_la_LDFLAGS = -avoid-version #------------------------ -# libdes-plugin +# libpbe-plugin #----------------------- -libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \ +libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \ ldap/servers/plugins/rever/rever.c -libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ -libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK) -libdes_plugin_la_LDFLAGS = -avoid-version +libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ +libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK) +libpbe_plugin_la_LDFLAGS = -avoid-version #------------------------ # libdistrib-plugin @@ -3596,21 +3596,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: \ libderef-plugin.la: $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_DEPENDENCIES) $(EXTRA_libderef_plugin_la_DEPENDENCIES) $(AM_V_CCLD)$(libderef_plugin_la_LINK) -rpath $(serverplugindir) $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_LIBADD) $(LIBS) -ldap/servers/plugins/rever/$(am__dirstamp): - @$(MKDIR_P) ldap/servers/plugins/rever - @: > ldap/servers/plugins/rever/$(am__dirstamp) -ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp): - @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR) - @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) -ldap/servers/plugins/rever/libdes_plugin_la-des.lo: \ - ldap/servers/plugins/rever/$(am__dirstamp) \ - ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) -ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: \ - ldap/servers/plugins/rever/$(am__dirstamp) \ - ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) - -libdes-plugin.la: $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_DEPENDENCIES) $(EXTRA_libdes_plugin_la_DEPENDENCIES) - $(AM_V_CCLD)$(libdes_plugin_la_LINK) -rpath $(serverplugindir) $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_LIBADD) $(LIBS) ldap/servers/plugins/distrib/$(am__dirstamp): @$(MKDIR_P) ldap/servers/plugins/distrib @: > ldap/servers/plugins/distrib/$(am__dirstamp) @@ -3900,6 +3885,21 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: \ libpassthru-plugin.la: $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_DEPENDENCIES) $(EXTRA_libpassthru_plugin_la_DEPENDENCIES) $(AM_V_CCLD)$(libpassthru_plugin_la_LINK) -rpath $(serverplugindir) $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_LIBADD) $(LIBS) +ldap/servers/plugins/rever/$(am__dirstamp): + @$(MKDIR_P) ldap/servers/plugins/rever + @: > ldap/servers/plugins/rever/$(am__dirstamp) +ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR) + @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) +ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: \ + ldap/servers/plugins/rever/$(am__dirstamp) \ + ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) +ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: \ + ldap/servers/plugins/rever/$(am__dirstamp) \ + ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) + +libpbe-plugin.la: $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_DEPENDENCIES) $(EXTRA_libpbe_plugin_la_DEPENDENCIES) + $(AM_V_CCLD)$(libpbe_plugin_la_LINK) -rpath $(serverplugindir) $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_LIBADD) $(LIBS) ldap/servers/plugins/posix-winsync/$(am__dirstamp): @$(MKDIR_P) ldap/servers/plugins/posix-winsync @: > ldap/servers/plugins/posix-winsync/$(am__dirstamp) @@ -5441,8 +5441,8 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_po.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_rootdse.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_trim.Plo@am__quote@ -@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo@am__quote@ -@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_cache.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_plugin.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rootdn_access/$(DEPDIR)/librootdn_access_plugin_la-rootdn_access.Plo@am__quote@ @@ -6739,20 +6739,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: ldap/servers/plugins/der @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libderef_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/deref/libderef_plugin_la-deref.lo `test -f 'ldap/servers/plugins/deref/deref.c' || echo '$(srcdir)/'`ldap/servers/plugins/deref/deref.c -ldap/servers/plugins/rever/libdes_plugin_la-des.lo: ldap/servers/plugins/rever/des.c -@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-des.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c -@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/des.c' object='ldap/servers/plugins/rever/libdes_plugin_la-des.lo' libtool=yes @AMDEPBACKSLASH@ -@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c - -ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c -@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c -@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libdes_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@ -@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c - ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo: ldap/servers/plugins/distrib/distrib.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdistrib_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo -MD -MP -MF ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo -c -o ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo `test -f 'ldap/servers/plugins/distrib/distrib.c' || echo '$(srcdir)/'`ldap/servers/plugins/distrib/distrib.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Plo @@ -6991,6 +6977,20 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: ldap/servers/plug @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpassthru_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo `test -f 'ldap/servers/plugins/passthru/ptutil.c' || echo '$(srcdir)/'`ldap/servers/plugins/passthru/ptutil.c +ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: ldap/servers/plugins/rever/pbe.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/pbe.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c + +ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c + ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo: ldap/servers/plugins/posix-winsync/posix-winsync.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libposix_winsync_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo -MD -MP -MF ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo -c -o ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo `test -f 'ldap/servers/plugins/posix-winsync/posix-winsync.c' || echo '$(srcdir)/'`ldap/servers/plugins/posix-winsync/posix-winsync.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Plo diff --git a/aclocal.m4 b/aclocal.m4 index 8136dd1..7afd01a 100644 --- a/aclocal.m4 +++ b/aclocal.m4 @@ -220,6 +220,21 @@ m4_popdef([pkg_default]) m4_popdef([pkg_description]) ]) dnl PKG_NOARCH_INSTALLDIR + +# PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE, +# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) +# ------------------------------------------- +# Retrieves the value of the pkg-config variable for the given module. +AC_DEFUN([PKG_CHECK_VAR], +[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl +AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl + +_PKG_CONFIG([$1], [variable="][$3]["], [$2]) +AS_VAR_COPY([$1], [pkg_cv_][$1]) + +AS_VAR_IF([$1], [""], [$5], [$4])dnl +])# PKG_CHECK_VAR + # Copyright (C) 2002-2013 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation diff --git a/config.guess b/config.guess index b79252d..1f5c50c 100755 --- a/config.guess +++ b/config.guess @@ -1,8 +1,8 @@ #! /bin/sh # Attempt to guess a canonical system name. -# Copyright 1992-2013 Free Software Foundation, Inc. +# Copyright 1992-2014 Free Software Foundation, Inc. -timestamp='2013-06-10' +timestamp='2014-03-23' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -50,7 +50,7 @@ version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. -Copyright 1992-2013 Free Software Foundation, Inc. +Copyright 1992-2014 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -149,7 +149,7 @@ Linux|GNU|GNU/*) LIBC=gnu #endif EOF - eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'` + eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'` ;; esac @@ -826,7 +826,7 @@ EOF *:MINGW*:*) echo ${UNAME_MACHINE}-pc-mingw32 exit ;; - i*:MSYS*:*) + *:MSYS*:*) echo ${UNAME_MACHINE}-pc-msys exit ;; i*:windows32*:*) @@ -969,10 +969,10 @@ EOF eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'` test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; } ;; - or1k:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + openrisc*:Linux:*:*) + echo or1k-unknown-linux-${LIBC} exit ;; - or32:Linux:*:*) + or32:Linux:*:* | or1k*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; padre:Linux:*:*) @@ -1260,16 +1260,26 @@ EOF if test "$UNAME_PROCESSOR" = unknown ; then UNAME_PROCESSOR=powerpc fi - if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then - if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ - (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ - grep IS_64BIT_ARCH >/dev/null - then - case $UNAME_PROCESSOR in - i386) UNAME_PROCESSOR=x86_64 ;; - powerpc) UNAME_PROCESSOR=powerpc64 ;; - esac + if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then + if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then + if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ + (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ + grep IS_64BIT_ARCH >/dev/null + then + case $UNAME_PROCESSOR in + i386) UNAME_PROCESSOR=x86_64 ;; + powerpc) UNAME_PROCESSOR=powerpc64 ;; + esac + fi fi + elif test "$UNAME_PROCESSOR" = i386 ; then + # Avoid executing cc on OS X 10.9, as it ships with a stub + # that puts up a graphical alert prompting to install + # developer tools. Any system running Mac OS X 10.7 or + # later (Darwin 11 and later) is required to have a 64-bit + # processor. This is not true of the ARM version of Darwin + # that Apple uses in portable devices. + UNAME_PROCESSOR=x86_64 fi echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE} exit ;; @@ -1361,154 +1371,6 @@ EOF exit ;; esac -eval $set_cc_for_build -cat >$dummy.c <<EOF -#ifdef _SEQUENT_ -# include <sys/types.h> -# include <sys/utsname.h> -#endif -main () -{ -#if defined (sony) -#if defined (MIPSEB) - /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed, - I don't know.... */ - printf ("mips-sony-bsd\n"); exit (0); -#else -#include <sys/param.h> - printf ("m68k-sony-newsos%s\n", -#ifdef NEWSOS4 - "4" -#else - "" -#endif - ); exit (0); -#endif -#endif - -#if defined (__arm) && defined (__acorn) && defined (__unix) - printf ("arm-acorn-riscix\n"); exit (0); -#endif - -#if defined (hp300) && !defined (hpux) - printf ("m68k-hp-bsd\n"); exit (0); -#endif - -#if defined (NeXT) -#if !defined (__ARCHITECTURE__) -#define __ARCHITECTURE__ "m68k" -#endif - int version; - version=`(hostinfo | sed -n 's/.*NeXT Mach $[0-9]*$.*/\1/p') 2>/dev/null`; - if (version < 4) - printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version); - else - printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version); - exit (0); -#endif - -#if defined (MULTIMAX) || defined (n16) -#if defined (UMAXV) - printf ("ns32k-encore-sysv\n"); exit (0); -#else -#if defined (CMU) - printf ("ns32k-encore-mach\n"); exit (0); -#else - printf ("ns32k-encore-bsd\n"); exit (0); -#endif -#endif -#endif - -#if defined (__386BSD__) - printf ("i386-pc-bsd\n"); exit (0); -#endif - -#if defined (sequent) -#if defined (i386) - printf ("i386-sequent-dynix\n"); exit (0); -#endif -#if defined (ns32000) - printf ("ns32k-sequent-dynix\n"); exit (0); -#endif -#endif - -#if defined (_SEQUENT_) - struct utsname un; - - uname(&un); - - if (strncmp(un.version, "V2", 2) == 0) { - printf ("i386-sequent-ptx2\n"); exit (0); - } - if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */ - printf ("i386-sequent-ptx1\n"); exit (0); - } - printf ("i386-sequent-ptx\n"); exit (0); - -#endif - -#if defined (vax) -# if !defined (ultrix) -# include <sys/param.h> -# if defined (BSD) -# if BSD == 43 - printf ("vax-dec-bsd4.3\n"); exit (0); -# else -# if BSD == 199006 - printf ("vax-dec-bsd4.3reno\n"); exit (0); -# else - printf ("vax-dec-bsd\n"); exit (0); -# endif -# endif -# else - printf ("vax-dec-bsd\n"); exit (0); -# endif -# else - printf ("vax-dec-ultrix\n"); exit (0); -# endif -#endif - -#if defined (alliant) && defined (i860) - printf ("i860-alliant-bsd\n"); exit (0); -#endif - - exit (1); -} -EOF - -$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` && - { echo "$SYSTEM_NAME"; exit; } - -# Apollos put the system type in the environment. - -test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; } - -# Convex versions that predate uname can use getsysinfo(1) - -if [ -x /usr/convex/getsysinfo ] -then - case `getsysinfo -f cpu_type` in - c1*) - echo c1-convex-bsd - exit ;; - c2*) - if getsysinfo -f scalar_acc - then echo c32-convex-bsd - else echo c2-convex-bsd - fi - exit ;; - c34*) - echo c34-convex-bsd - exit ;; - c38*) - echo c38-convex-bsd - exit ;; - c4*) - echo c4-convex-bsd - exit ;; - esac -fi - cat >&2 <<EOF $0: unable to guess system type diff --git a/config.sub b/config.sub index c765b34..66c5074 100755 --- a/config.sub +++ b/config.sub @@ -1,8 +1,8 @@ #! /bin/sh # Configuration validation subroutine script. -# Copyright 1992-2013 Free Software Foundation, Inc. +# Copyright 1992-2014 Free Software Foundation, Inc. -timestamp='2013-04-24' +timestamp='2014-07-28' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -68,7 +68,7 @@ Report bugs and patches to <config-patches(a)gnu.org>." version="\ GNU config.sub ($timestamp) -Copyright 1992-2013 Free Software Foundation, Inc. +Copyright 1992-2014 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -257,7 +257,7 @@ case $basic_machine in | avr | avr32 \ | be32 | be64 \ | bfin \ - | c4x | clipper \ + | c4x | c8051 | clipper \ | d10v | d30v | dlx | dsp16xx \ | epiphany \ | fido | fr30 | frv \ @@ -265,6 +265,7 @@ case $basic_machine in | hexagon \ | i370 | i860 | i960 | ia64 \ | ip2k | iq2000 \ + | k1om \ | le32 | le64 \ | lm32 \ | m32c | m32r | m32rle | m68000 | m68k | m88k \ @@ -282,8 +283,10 @@ case $basic_machine in | mips64vr5900 | mips64vr5900el \ | mipsisa32 | mipsisa32el \ | mipsisa32r2 | mipsisa32r2el \ + | mipsisa32r6 | mipsisa32r6el \ | mipsisa64 | mipsisa64el \ | mipsisa64r2 | mipsisa64r2el \ + | mipsisa64r6 | mipsisa64r6el \ | mipsisa64sb1 | mipsisa64sb1el \ | mipsisa64sr71k | mipsisa64sr71kel \ | mipsr5900 | mipsr5900el \ @@ -295,8 +298,7 @@ case $basic_machine in | nds32 | nds32le | nds32be \ | nios | nios2 | nios2eb | nios2el \ | ns16k | ns32k \ - | open8 \ - | or1k | or32 \ + | open8 | or1k | or1knd | or32 \ | pdp10 | pdp11 | pj | pjl \ | powerpc | powerpc64 | powerpc64le | powerpcle \ | pyramid \ @@ -324,7 +326,7 @@ case $basic_machine in c6x) basic_machine=tic6x-unknown ;; - m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip) + m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip) basic_machine=$basic_machine-unknown os=-none ;; @@ -372,7 +374,7 @@ case $basic_machine in | be32-* | be64-* \ | bfin-* | bs2000-* \ | c[123]* | c30-* | [cjt]90-* | c4x-* \ - | clipper-* | craynv-* | cydra-* \ + | c8051-* | clipper-* | craynv-* | cydra-* \ | d10v-* | d30v-* | dlx-* \ | elxsi-* \ | f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \ @@ -381,6 +383,7 @@ case $basic_machine in | hexagon-* \ | i*86-* | i860-* | i960-* | ia64-* \ | ip2k-* | iq2000-* \ + | k1om-* \ | le32-* | le64-* \ | lm32-* \ | m32c-* | m32r-* | m32rle-* \ @@ -400,8 +403,10 @@ case $basic_machine in | mips64vr5900-* | mips64vr5900el-* \ | mipsisa32-* | mipsisa32el-* \ | mipsisa32r2-* | mipsisa32r2el-* \ + | mipsisa32r6-* | mipsisa32r6el-* \ | mipsisa64-* | mipsisa64el-* \ | mipsisa64r2-* | mipsisa64r2el-* \ + | mipsisa64r6-* | mipsisa64r6el-* \ | mipsisa64sb1-* | mipsisa64sb1el-* \ | mipsisa64sr71k-* | mipsisa64sr71kel-* \ | mipsr5900-* | mipsr5900el-* \ @@ -413,6 +418,7 @@ case $basic_machine in | nios-* | nios2-* | nios2eb-* | nios2el-* \ | none-* | np1-* | ns16k-* | ns32k-* \ | open8-* \ + | or1k*-* \ | orion-* \ | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \ @@ -794,7 +800,7 @@ case $basic_machine in os=-mingw64 ;; mingw32) - basic_machine=i386-pc + basic_machine=i686-pc os=-mingw32 ;; mingw32ce) @@ -822,6 +828,10 @@ case $basic_machine in basic_machine=powerpc-unknown os=-morphos ;; + moxiebox) + basic_machine=moxie-unknown + os=-moxiebox + ;; msdos) basic_machine=i386-pc os=-msdos @@ -830,7 +840,7 @@ case $basic_machine in basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'` ;; msys) - basic_machine=i386-pc + basic_machine=i686-pc os=-msys ;; mvs) @@ -1367,14 +1377,14 @@ case $os in | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \ | -linux-newlib* | -linux-musl* | -linux-uclibc* \ - | -uxpv* | -beos* | -mpeix* | -udk* \ + | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \ | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \ | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \ | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \ | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \ | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \ | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \ - | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*) + | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*) # Remember, each alternative MUST END IN *, to match a version number. ;; -qnx*) @@ -1546,6 +1556,9 @@ case $basic_machine in c4x-* | tic4x-*) os=-coff ;; + c8051-*) + os=-elf + ;; hexagon-*) os=-elf ;; @@ -1589,9 +1602,6 @@ case $basic_machine in mips*-*) os=-elf ;; - or1k-*) - os=-elf - ;; or32-*) os=-coff ;; diff --git a/dirsrvtests/tickets/ticket47462_test.py b/dirsrvtests/tickets/ticket47462_test.py new file mode 100644 index 0000000..a909b37 --- /dev/null +++ b/dirsrvtests/tickets/ticket47462_test.py @@ -0,0 +1,452 @@ +import os +import sys +import time +import ldap +import logging +import socket +import time +import logging +import pytest +import re +from lib389 import DirSrv, Entry, tools +from lib389.tools import DirSrvTools +from lib389._constants import * +from lib389.properties import * +from constants import * +from lib389._constants import * + +logging.getLogger(__name__).setLevel(logging.DEBUG) +log = logging.getLogger(__name__) + +# +# important part. We can deploy Master1 and Master2 on different versions +# +installation1_prefix = None +installation2_prefix = None + +DES_PLUGIN = 'cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config' +AES_PLUGIN = 'cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config' +MMR_PLUGIN = 'cn=Multimaster Replication Plugin,cn=plugins,cn=config' +AGMT_DN = '' +USER_DN = 'cn=test_user,' + DEFAULT_SUFFIX +USER1_DN = 'cn=test_user1,' + DEFAULT_SUFFIX +TEST_REPL_DN = 'cn=test repl,' + DEFAULT_SUFFIX + + +class TopologyMaster1Master2(object): + def __init__(self, master1, master2): + master1.open() + self.master1 = master1 + + master2.open() + self.master2 = master2 + + +(a)pytest.fixture(scope="module") +def topology(request): + ''' + This fixture is used to create a replicated topology for the 'module'. + The replicated topology is MASTER1 <-> Master2. + At the beginning, It may exists a master2 instance and/or a master2 instance. + It may also exists a backup for the master1 and/or the master2. + + Principle: + If master1 instance exists: + restart it + If master2 instance exists: + restart it + If backup of master1 AND backup of master2 exists: + create or rebind to master1 + create or rebind to master2 + + restore master1 from backup + restore master2 from backup + else: + Cleanup everything + remove instances + remove backups + Create instances + Initialize replication + Create backups + ''' + global installation1_prefix + global installation2_prefix + + # allocate master1 on a given deployement + master1 = DirSrv(verbose=False) + if installation1_prefix: + args_instance[SER_DEPLOYED_DIR] = installation1_prefix + + # Args for the master1 instance + args_instance[SER_HOST] = HOST_MASTER_1 + args_instance[SER_PORT] = PORT_MASTER_1 + args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1 + args_master = args_instance.copy() + master1.allocate(args_master) + + # allocate master1 on a given deployement + master2 = DirSrv(verbose=False) + if installation2_prefix: + args_instance[SER_DEPLOYED_DIR] = installation2_prefix + + # Args for the consumer instance + args_instance[SER_HOST] = HOST_MASTER_2 + args_instance[SER_PORT] = PORT_MASTER_2 + args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2 + args_master = args_instance.copy() + master2.allocate(args_master) + + # Get the status of the backups + backup_master1 = master1.checkBackupFS() + backup_master2 = master2.checkBackupFS() + + # Get the status of the instance and restart it if it exists + instance_master1 = master1.exists() + if instance_master1: + master1.stop(timeout=10) + master1.start(timeout=10) + + instance_master2 = master2.exists() + if instance_master2: + master2.stop(timeout=10) + master2.start(timeout=10) + + if backup_master1 and backup_master2: + # The backups exist, assuming they are correct + # we just re-init the instances with them + if not instance_master1: + master1.create() + # Used to retrieve configuration information (dbdir, confdir...) + master1.open() + + if not instance_master2: + master2.create() + # Used to retrieve configuration information (dbdir, confdir...) + master2.open() + + # restore master1 from backup + master1.stop(timeout=10) + master1.restoreFS(backup_master1) + master1.start(timeout=10) + + # restore master2 from backup + master2.stop(timeout=10) + master2.restoreFS(backup_master2) + master2.start(timeout=10) + else: + # We should be here only in two conditions + # - This is the first time a test involve master-consumer + # so we need to create everything + # - Something weird happened (instance/backup destroyed) + # so we discard everything and recreate all + + # Remove all the backups. So even if we have a specific backup file + # (e.g backup_master) we clear all backups that an instance my have created + if backup_master1: + master1.clearBackupFS() + if backup_master2: + master2.clearBackupFS() + + # Remove all the instances + if instance_master1: + master1.delete() + if instance_master2: + master2.delete() + + # Create the instances + master1.create() + master1.open() + master2.create() + master2.open() + + # + # Now prepare the Master-Consumer topology + # + # First Enable replication + master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1) + master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2) + + # Initialize the supplier->consumer + + properties = {RA_NAME: r'meTo_$host:$port', + RA_BINDDN: defaultProperties[REPLICATION_BIND_DN], + RA_BINDPW: defaultProperties[REPLICATION_BIND_PW], + RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD], + RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]} + AGMT_DN = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties) + master1.agreement + if not AGMT_DN: + log.fatal("Fail to create a replica agreement") + sys.exit(1) + + log.debug("%s created" % AGMT_DN) + + properties = {RA_NAME: r'meTo_$host:$port', + RA_BINDDN: defaultProperties[REPLICATION_BIND_DN], + RA_BINDPW: defaultProperties[REPLICATION_BIND_PW], + RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD], + RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]} + master2.agreement.create(suffix=DEFAULT_SUFFIX, host=master1.host, port=master1.port, properties=properties) + + master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2) + master1.waitForReplInit(AGMT_DN) + + # Check replication is working fine + master1.add_s(Entry((TEST_REPL_DN, {'objectclass': "top person".split(), + 'sn': 'test_repl', + 'cn': 'test_repl'}))) + loop = 0 + while loop <= 10: + try: + ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)") + break + except ldap.NO_SUCH_OBJECT: + time.sleep(1) + loop += 1 + if not ent: + log.fatal('Replication is not working!') + assert False + + # Time to create the backups + master1.stop(timeout=10) + master1.backupfile = master1.backupFS() + master1.start(timeout=10) + + master2.stop(timeout=10) + master2.backupfile = master2.backupFS() + master2.start(timeout=10) + + # clear the tmp directory + master1.clearTmpDir(__file__) + + # + # Here we have two instances master and consumer + # with replication working. Either coming from a backup recovery + # or from a fresh (re)init + # Time to return the topology + return TopologyMaster1Master2(master1, master2) + + +def test_ticket47462(topology): + """ + Test that AES properly replaces DES during an update/restart, and that + replication also works correctly. + """ + + # + # First set config as if it's an older version. Set DES to use libdes-plugin, + # MMR to depend on DES, delete the existing AES plugin, and set a DES password + # for the replication agreement. + # + + # + # Add an extra attribute to the DES plugin args + # + try: + topology.master1.modify_s(DES_PLUGIN, + [(ldap.MOD_REPLACE, 'nsslapd-pluginPath', 'libdes-plugin'), + (ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')]) + + except ldap.LDAPError, e: + log.fatal('Failed to reset DES plugin, error: ' + e.message['desc']) + assert False + + try: + topology.master1.modify_s(MMR_PLUGIN, + [(ldap.MOD_DELETE, 'nsslapd-plugin-depends-on-named', 'AES')]) + + except ldap.NO_SUCH_ATTRIBUTE: + pass + except ldap.LDAPError, e: + log.fatal('Failed to reset DES plugin, error: ' + e.message['desc']) + assert False + + # + # Delete the AES plugin + # + try: + topology.master1.delete_s(AES_PLUGIN) + except ldap.NO_SUCH_OBJECT: + pass + except ldap.LDAPError, e: + log.fatal('Failed to delete AES plugin, error: ' + e.message['desc']) + assert False + + # restart the server so we must use DES plugin + topology.master1.restart(timeout=10) + + # + # Get the agmt dn, and set the password + # + try: + entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'objectclass=nsDS5ReplicationAgreement') + if entry: + agmt_dn = entry[0].dn + log.info('Found agmt dn (%s)' % agmt_dn) + else: + log.fatal('No replication agreements!') + assert False + except ldap.LDAPError, e: + log.fatal('Failed to search for replica credentials: ' + e.message['desc']) + assert False + + try: + properties = {RA_BINDPW: "password"} + topology.master1.agreement.setProperties(None, agmt_dn, None, properties) + log.info('Successfully modified replication agreement') + except ValueError: + log.error('Failed to update replica agreement: ' + AGMT_DN) + assert False + + # + # Check replication works with the new DES password + # + try: + topology.master1.add_s(Entry((USER1_DN, + {'objectclass': "top person".split(), + 'sn': 'sn', + 'cn': 'test_user'}))) + loop = 0 + ent = None + while loop <= 10: + try: + ent = topology.master2.getEntry(USER1_DN, ldap.SCOPE_BASE, "(objectclass=*)") + break + except ldap.NO_SUCH_OBJECT: + time.sleep(1) + loop += 1 + if not ent: + log.fatal('Replication test failed fo user1!') + assert False + else: + log.info('Replication test passed') + except ldap.LDAPError, e: + log.fatal('Failed to add test user: ' + e.message['desc']) + assert False + + # + # Run the upgrade... + # + topology.master1.upgrade('online') + topology.master1.restart(timeout=10) + topology.master2.restart(timeout=10) + + # + # Check that the restart converted existing DES credentials + # + try: + entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'nsDS5ReplicaCredentials=*') + if entry: + val = entry[0].getValue('nsDS5ReplicaCredentials') + if val.startswith('{AES-'): + log.info('The DES credentials have been converted to AES') + else: + log.fatal('Failed to convert credentials from DES to AES!') + assert False + else: + log.fatal('Failed to find any entries with nsDS5ReplicaCredentials ') + assert False + except ldap.LDAPError, e: + log.fatal('Failed to search for replica credentials: ' + e.message['desc']) + assert False + + # + # Check that the AES plugin exists, and has all the attributes listed in DES plugin. + # The attributes might not be in the expected order so check all the attributes. + # + try: + entry = topology.master1.search_s(AES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*') + if not entry[0].hasValue('nsslapd-pluginarg0', 'description') and \ + not entry[0].hasValue('nsslapd-pluginarg1', 'description') and \ + not entry[0].hasValue('nsslapd-pluginarg2', 'description'): + log.fatal('The AES plugin did not have the DES attribute copied over correctly') + assert False + else: + log.info('The AES plugin was correctly setup') + except ldap.LDAPError, e: + log.fatal('Failed to find AES plugin: ' + e.message['desc']) + assert False + + # + # Check that the MMR plugin was updated + # + try: + entry = topology.master1.search_s(MMR_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*') + if not entry[0].hasValue('nsslapd-plugin-depends-on-named', 'AES'): + log.fatal('The MMR Plugin was not correctly updated') + assert False + else: + log.info('The MMR plugin was correctly updated') + except ldap.LDAPError, e: + log.fatal('Failed to find AES plugin: ' + e.message['desc']) + assert False + + # + # Check that the DES plugin was correctly updated + # + try: + entry = topology.master1.search_s(DES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*') + if not entry[0].hasValue('nsslapd-pluginPath', 'libpbe-plugin'): + log.fatal('The DES Plugin was not correctly updated') + assert False + else: + log.info('The DES plugin was correctly updated') + except ldap.LDAPError, e: + log.fatal('Failed to find AES plugin: ' + e.message['desc']) + assert False + + # + # Check replication one last time + # + try: + topology.master1.add_s(Entry((USER_DN, + {'objectclass': "top person".split(), + 'sn': 'sn', + 'cn': 'test_user'}))) + loop = 0 + ent = None + while loop <= 10: + try: + ent = topology.master2.getEntry(USER_DN, ldap.SCOPE_BASE, "(objectclass=*)") + break + except ldap.NO_SUCH_OBJECT: + time.sleep(1) + loop += 1 + if not ent: + log.fatal('Replication test failed!') + assert False + else: + log.info('Replication test passed') + except ldap.LDAPError, e: + log.fatal('Failed to add test user: ' + e.message['desc']) + assert False + + # + # If we got here the test passed + # + log.info('Test PASSED') + + +def test_ticket47462_final(topology): + topology.master1.stop(timeout=10) + topology.master2.stop(timeout=10) + + +def run_isolated(): + ''' + run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..) + To run isolated without py.test, you need to + - edit this file and comment '@pytest.fixture' line before 'topology' function. + - set the installation prefix + - run this program + ''' + global installation1_prefix + global installation2_prefix + installation1_prefix = None + installation2_prefix = None + + topo = topology(True) + test_ticket47462(topo) + +if __name__ == '__main__': + run_isolated() diff --git a/ldap/admin/src/scripts/50AES-pbe-plugin.ldif b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif new file mode 100644 index 0000000..564ceae --- /dev/null +++ b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif @@ -0,0 +1,16 @@ +dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config +objectclass: top +objectclass: nsSlapdPlugin +objectclass: extensibleObject +cn: AES +nsslapd-pluginpath: libpbe-plugin +nsslapd-plugininitfunc: aes_init +nsslapd-plugintype: reverpwdstoragescheme +nsslapd-pluginenabled: on +nsslapd-pluginarg0: nsmultiplexorcredentials +nsslapd-pluginarg1: nsds5ReplicaCredentials +nsslapd-pluginprecedence: 1 +nsslapd-pluginid: ID +nsslapd-pluginDescription: DESC +nsslapd-pluginVersion: PACKAGE_VERSION +nsslapd-pluginVendor: VENDOR diff --git a/ldap/admin/src/scripts/52updateAESplugin.pl b/ldap/admin/src/scripts/52updateAESplugin.pl new file mode 100644 index 0000000..6a8a885 --- /dev/null +++ b/ldap/admin/src/scripts/52updateAESplugin.pl @@ -0,0 +1,84 @@ +use Mozilla::LDAP::Conn; +use Mozilla::LDAP::Entry; +use Mozilla::LDAP::Utils qw(normalizeDN); +use Mozilla::LDAP::API qw(:constant ldap_url_parse ldap_explode_dn); +use File::Basename; +use File::Copy; +use DSUtil qw(debug serverIsRunning); + +# +# Check if there is a DES plugin and make sure the AES plugin contains the same attributes +# +sub runinst { + my ($inf, $inst, $dseldif, $conn) = @_; + my @attrs; + my @attrs_to_add; + my $aes_count = 0; + my $des_count = 0; + my $i = 0; + + my $aes_dn = "cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config"; + my $aes_entry = $conn->search($aes_dn, "base", "(cn=*)"); + if (!$aes_entry) { + # No AES plugin - nothing to do + return (); + } + + # We need to grab the AES plugin args... + while(1){ + my $argattr = "nsslapd-pluginarg" . $i; + my $val = $aes_entry->getValues($argattr); + if($val ne ""){ + $attrs[$aes_count] = $val; + $aes_count++; + } else { + last; + } + $i++; + } + + # Grab the DES plugin + my $des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config"; + my $des_entry = $conn->search($des_dn, "base", "(cn=*)"); + if (!$des_entry) { + # No DES plugin - nothing to do + return (); + } + + # We need to check the DES plugin args against the AES args. + $i = 0; + while(1){ + my $argattr = "nsslapd-pluginarg" . $i; + my $val = $des_entry->getValues($argattr); + if($val eq ""){ + last; + } + if(!($val ~~ @attrs) ){ + $attrs_to_add[$des_count] = $val; + $des_count++; + } + $i++; + } + + # Add the missing attributes to the AES plugin + if($#attrs_to_add >= 0){ + foreach $val (@attrs_to_add){ + $aes_entry->addValue("nsslapd-pluginarg" . $aes_count, $val); + $aes_count++; + } + $conn->update($aes_entry); + } + + # Change replication plugin dependency from DES to AES + my $mmr_entry = $conn->search("cn=Multimaster Replication Plugin,cn=plugins,cn=config", "base", "(cn=*)"); + $mmr_entry->removeValue("nsslapd-plugin-depends-on-named", "DES"); + $mmr_entry->addValue("nsslapd-plugin-depends-on-named", "AES"); + $conn->update($mmr_entry); + + # Change the des plugin to use the new libpbe-plugin library + $des_entry->{"nsslapd-pluginPath"} = [ "libpbe-plugin" ]; + $conn->update($des_entry); + + return (); +} + diff --git a/ldap/ldif/50replication-plugins.ldif b/ldap/ldif/50replication-plugins.ldif index 0b4924c..71afbea 100644 --- a/ldap/ldif/50replication-plugins.ldif +++ b/ldap/ldif/50replication-plugins.ldif @@ -22,6 +22,6 @@ nsslapd-plugintype: object nsslapd-pluginbetxn: on nsslapd-pluginenabled: on nsslapd-plugin-depends-on-named: ldbm database -nsslapd-plugin-depends-on-named: DES +nsslapd-plugin-depends-on-named: AES nsslapd-plugin-depends-on-named: Class of Service diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in index 720ebad..6acbfae 100644 --- a/ldap/ldif/template-dse.ldif.in +++ b/ldap/ldif/template-dse.ldif.in @@ -207,12 +207,26 @@ nsslapd-plugininitfunc: ns_mta_md5_pwd_storage_scheme_init nsslapd-plugintype: pwdstoragescheme nsslapd-pluginenabled: on +dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config +objectclass: top +objectclass: nsSlapdPlugin +objectclass: extensibleObject +cn: AES +nsslapd-pluginpath: libpbe-plugin +nsslapd-plugininitfunc: aes_init +nsslapd-plugintype: reverpwdstoragescheme +nsslapd-pluginenabled: on +nsslapd-pluginarg0: nsmultiplexorcredentials +nsslapd-pluginarg1: nsds5ReplicaCredentials +nsslapd-pluginid: aes-storage-scheme +nsslapd-pluginprecedence: 1 + dn: cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config objectclass: top objectclass: nsSlapdPlugin objectclass: extensibleObject cn: DES -nsslapd-pluginpath: libdes-plugin +nsslapd-pluginpath: libpbe-plugin nsslapd-plugininitfunc: des_init nsslapd-plugintype: reverpwdstoragescheme nsslapd-pluginenabled: on diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c deleted file mode 100644 index 73830f0..0000000 --- a/ldap/servers/plugins/rever/des.c +++ /dev/null @@ -1,551 +0,0 @@ -/** BEGIN COPYRIGHT BLOCK - * This Program is free software; you can redistribute it and/or modify it under - * the terms of the GNU General Public License as published by the Free Software - * Foundation; version 2 of the License. - * - * This Program is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License along with - * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple - * Place, Suite 330, Boston, MA 02111-1307 USA. - * - * In addition, as a special exception, Red Hat, Inc. gives You the additional - * right to link the code of this Program with code not covered under the GNU - * General Public License ("Non-GPL Code") and to distribute linked combinations - * including the two, subject to the limitations in this paragraph. Non-GPL Code - * permitted under this exception must only link to the code of this Program - * through those well defined interfaces identified in the file named EXCEPTION - * found in the source code files (the "Approved Interfaces"). The files of - * Non-GPL Code may instantiate templates or use macros or inline functions from - * the Approved Interfaces without causing the resulting work to be covered by - * the GNU General Public License. Only Red Hat, Inc. may make changes or - * additions to the list of Approved Interfaces. You must obey the GNU General - * Public License in all respects for all of the Program code and other code used - * in conjunction with the Program except the Non-GPL Code covered by this - * exception. If you modify this file, you may extend this exception to your - * version of the file, but you are not obligated to do so. If you do not wish to - * provide this exception without modification, you must delete this exception - * statement from your version and license this file solely under the GPL without - * exception. - * - * - * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. - * Copyright (C) 2005 Red Hat, Inc. - * All rights reserved. - * END COPYRIGHT BLOCK **/ - -#ifdef HAVE_CONFIG_H -# include <config.h> -#endif - -/* from /usr/project/iplanet/ws/ds5.ke/ns/svrcore/pkcs7/tstarchive.c */ - -#include <string.h> -#include <stdio.h> - -#include <ldap.h> -#include <nspr.h> -#include <nss.h> -#include <secmod.h> -/* -#include <secasn1.h> -#include <secpkcs7.h> -*/ -#include <key.h> -#include <certdb.h> -#include <cert.h> -#include <svrcore.h> -#include <secmodt.h> -#include <prtypes.h> -#include <seccomon.h> -#include <pk11func.h> - -#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */ -#include "rever.h" -#include <slap.h> -#include "slapi-plugin.h" -#include <uuid.h> - - -struct pk11MechItem -{ - CK_MECHANISM_TYPE type; - const char *mechName; -}; -static const struct pk11MechItem mymech = { CKM_DES_CBC, "DES CBC encryption" }; - - -static Slapi_Mutex *mylock = NULL; - -struct pk11ContextStore -{ - PK11SlotInfo *slot; - const struct pk11MechItem *mech; - - PK11SymKey *key; - SECItem *params; - - int length; - unsigned char *crypt; -}; - -static int encode_path(char *inPlain, char **outCipher, char *path); -static int decode_path(char *inCipher, char **outPlain, char *path); -static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path); -static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out); -static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len); -static void freeDes(struct pk11ContextStore *out); - -void -init_des_plugin() -{ - mylock = slapi_new_mutex(); -} - -int -encode(char *inPlain, char **outCipher) -{ - return encode_path(inPlain, outCipher, NULL); -} - -static int -encode_path(char *inPlain, char **outCipher, char *path) -{ - struct pk11ContextStore *context = NULL; - int err; - - unsigned char *cipher = NULL; - char *tmp = NULL; - char *base = NULL; - - - *outCipher = NULL; - err = 1; - - if ( genKey(&context, tokDes, path) == SVRCORE_Success ) - { - /* Try an encryption */ - if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ) - { - base = BTOA_DataToAscii(cipher, context->length); - if ( base != NULL ) - { - tmp = slapi_ch_malloc( 3 + strlen(REVER_SCHEME_NAME) + strlen(base)); - if ( tmp != NULL ) - { - sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, REVER_SCHEME_NAME, PWD_HASH_PREFIX_END, base); - *outCipher = tmp; - tmp = NULL; - err = 0; - } - PORT_Free(base); - } - } - } - - freeDes(context); - slapi_ch_free((void **) &context); - return(err); -} - -int -decode(char *inCipher, char **outPlain) -{ - return decode_path(inCipher, outPlain, NULL); -} - - -static int -decode_path(char *inCipher, char **outPlain, char *path) -{ - struct pk11ContextStore *context = NULL; - char *plain= NULL; - int err; - - unsigned char *base = NULL; - int len = 0; - - - *outPlain = NULL; - err = 1; - - if ( genKey(&context, tokDes, path) == SVRCORE_Success ) - { - /* it seems that there is memory leak in that function: bug 400170 */ - - base = ATOB_AsciiToData(inCipher, (unsigned int*)&len); - if ( base != NULL ) - { - if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ) - { - *outPlain = plain; - err = 0; - } - } - } - - PORT_Free(base); - freeDes(context); - slapi_ch_free((void **) &context); - return(err); -} - -static void freeDes(struct pk11ContextStore *out) -{ - if (out) - { - if (out->slot) - slapd_pk11_freeSlot(out->slot); - if (out->key) - slapd_pk11_freeSymKey(out->key); - if (out->params) - SECITEM_FreeItem(out->params,PR_TRUE); - if (out->crypt) - free(out->crypt); - } -} - -static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path) -{ - SVRCOREError err = SVRCORE_Success; - struct pk11ContextStore *store = NULL; - SECItem *pwitem = NULL; - SECItem *result = NULL; - SECAlgorithmID *algid = NULL; - SECOidTag algoid; - SECItem *salt = NULL; - CK_MECHANISM pbeMech; - CK_MECHANISM cryptoMech; - - char *configdir = NULL; - char *iv = NULL; - - store = (struct pk11ContextStore*)slapi_ch_malloc(sizeof(*store)); - if (store == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - *out = store; - - /* Low-level init */ - store->slot = NULL; - store->key = NULL; - store->params = NULL; - store->crypt = NULL; - - /* Use the tokenName to find a PKCS11 slot */ - store->slot = slapd_pk11_findSlotByName((char *)token); - if (store->slot == NULL) - { - err = SVRCORE_NoSuchToken_Error; - goto done; - } - - /* Generate a key and parameters to do the encryption */ - store->mech = &mymech; - - /* Generate a unique id, used as salt for the key generation */ - if ( path == NULL ) - { - configdir = config_get_configdir(); - if ( configdir == NULL ) - { - err = SVRCORE_System_Error; - goto done; - } - } - else - { - configdir = slapi_ch_strdup(path); - } - if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ) - { - slapi_ch_free((void**)&configdir); - err = SVRCORE_System_Error; - goto done; - } - slapi_ch_free((void**)&configdir); - - pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem)); - if (pwitem == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - pwitem->type = siBuffer; - pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); - if (pwitem->data == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - strcpy((char*)pwitem->data, iv); - pwitem->len = strlen(iv) + 1; - - algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC; - - salt = (SECItem *) PORT_Alloc(sizeof(SECItem)); - if (salt == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - salt->type = siBuffer; - salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); - if ( salt->data == NULL ) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - strcpy((char*)salt->data, iv); - salt->len = strlen(iv) + 1; - - algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt); - - slapi_lock_mutex(mylock); - store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0); - if (store->key == 0) - { - slapi_unlock_mutex(mylock); - err = SVRCORE_System_Error; - goto done; - } - - slapi_unlock_mutex(mylock); - pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid); - result = slapd_pk11_paramFromAlgid(algid); - secoid_destroyAlgorithmID(algid, PR_TRUE); - pbeMech.pParameter = result->data; - pbeMech.ulParameterLen = result->len; - if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem, - PR_FALSE) != CKR_OK) - { - SECITEM_FreeItem(result, PR_TRUE); - err = SVRCORE_System_Error; - goto done; - } - SECITEM_FreeItem(result, PR_TRUE); - SECITEM_FreeItem(pwitem, PR_TRUE); - SECITEM_FreeItem(salt, PR_TRUE); - store->params = (SECItem *) PORT_Alloc(sizeof(SECItem)); - if (store->params == NULL) - { - err = SVRCORE_System_Error; - goto done; - } - store->params->type = store->mech->type; - store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen); - if (store->params->data == NULL) - { - err = SVRCORE_System_Error; - goto done; - } - memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen); - store->params->len = cryptoMech.ulParameterLen; - PORT_Free(cryptoMech.pParameter); - -done: - slapi_ch_free((void**)&iv); - return (err); -} - -static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len) -{ - SVRCOREError err = SVRCORE_Success; - unsigned char *plain = NULL; - unsigned char *cipher_with_padding = NULL; - SECStatus rv; - PK11Context *ctx = 0; - int outLen = 0; - int blocksize = 0; - - blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); - store->length = len; - - /* store->length is the max. length of the returned clear text - - must be >= length of crypted bytes - also must be a multiple - of blocksize */ - if (blocksize != 0) - { - store->length += blocksize - (store->length % blocksize); - } - - /* plain will hold the returned clear text */ - plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), - store->length+1); - if (!plain) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - - /* create a buffer holding the original cipher bytes, padded with - zeros to a multiple of blocksize - do not need +1 since buffer is not - a string */ - cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), - store->length); - if (!cipher_with_padding) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - memcpy(cipher_with_padding, cipher, len); - - ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT, - store->key, store->params); - if (!ctx) - { - err = SVRCORE_System_Error; - goto done; - } - - /* warning - there is a purify UMR in the NSS des code - you may see it when the - password is not a multiple of 8 bytes long */ - rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length, - cipher_with_padding, store->length); - if (rv) - { - err = SVRCORE_System_Error; - } - - rv = slapd_pk11_finalize(ctx); - /* we must do the finalize, but we only want to set the err return - code if it is not already set */ - if (rv && (SVRCORE_Success == err)) - err = SVRCORE_System_Error; - -done: - if (err == SVRCORE_Success) - { - *out = (char *)plain; - } - else - { - slapi_ch_free((void **)&plain); - } - - slapi_ch_free((void **)&cipher_with_padding); - /* We should free the PK11Context... Something like : */ - if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE); - - return err; -} - -static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out) -{ - SVRCOREError err = SVRCORE_Success; - SECStatus rv; - PK11Context *ctx = 0; - int outLen = 0; - int blocksize = 0; - unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */ - - blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); - store->length = strlen(clear); - - /* the size of the clear text buffer passed to the des encryption functions - must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer - of this size, copy the clear text password into it, and pad the rest with - zeros */ - if (blocksize != 0) - { - store->length += blocksize - (store->length % blocksize); - } - - /* store->crypt will hold the crypted password - it must be >= clear length */ - /* store->crypt is freed in NSS; let's not use slapi_ch_calloc */ - store->crypt = (unsigned char *)calloc(sizeof(unsigned char), - store->length+1); - if (!store->crypt) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - - /* create a buffer big enough to hold the clear text password and padding */ - clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), - store->length+1); - if (!clear_with_padding) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - /* copy the clear text password into the buffer - the calloc insures the - remainder is zero padded */ - strcpy((char *)clear_with_padding, clear); - - ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT, - store->key, store->params); - if (!ctx) - { - err = SVRCORE_System_Error; - goto done; - } - - rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length, - clear_with_padding, store->length); - if (rv) - { - err = SVRCORE_System_Error; - } - - rv = slapd_pk11_finalize(ctx); - /* we must do the finalize, but we only want to set the err return - code if it is not already set */ - if (rv && (SVRCORE_Success == err)) - err = SVRCORE_System_Error; - -done: - if (err == SVRCORE_Success) - *out = store->crypt; - - slapi_ch_free((void **)&clear_with_padding); - /* We should free the PK11Context... Something like : */ - if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE); - - return err; -} - -/* - The UUID name based generator was broken on x86 platforms. We use - this to generate the password encryption key. During migration, - we have to fix this so we can use the fixed generator. The env. - var USE_BROKEN_UUID tells the uuid generator to use the old - broken method to create the UUID. That will allow us to decrypt - the password to the correct clear text, then we can turn off - the broken method and use the fixed method to encrypt the - password. -*/ -char * -migrateCredentials(char *oldpath, char *newpath, char *oldcred) -{ - static char *useBrokenUUID = "USE_BROKEN_UUID=1"; - static char *disableBrokenUUID = "USE_BROKEN_UUID=0"; - char *plain = NULL; - char *cipher = NULL; - - init_des_plugin(); - - slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 ); - NSS_NoDB_Init(NULL); - - if (getenv("MIGRATE_BROKEN_PWD")) { - putenv(useBrokenUUID); - } - - if ( decode_path(oldcred, &plain, oldpath) == 0 ) - { - if (getenv("MIGRATE_BROKEN_PWD")) { - putenv(disableBrokenUUID); - } - if ( encode_path(plain, &cipher, newpath) != 0 ) - return(NULL); - else - return(cipher); - } - else - return(NULL); -} diff --git a/ldap/servers/plugins/rever/pbe.c b/ldap/servers/plugins/rever/pbe.c new file mode 100644 index 0000000..abb8d1b --- /dev/null +++ b/ldap/servers/plugins/rever/pbe.c @@ -0,0 +1,621 @@ +/** BEGIN COPYRIGHT BLOCK + * This Program is free software; you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free Software + * Foundation; version 2 of the License. + * + * This Program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along with + * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple + * Place, Suite 330, Boston, MA 02111-1307 USA. + * + * In addition, as a special exception, Red Hat, Inc. gives You the additional + * right to link the code of this Program with code not covered under the GNU + * General Public License ("Non-GPL Code") and to distribute linked combinations + * including the two, subject to the limitations in this paragraph. Non-GPL Code + * permitted under this exception must only link to the code of this Program + * through those well defined interfaces identified in the file named EXCEPTION + * found in the source code files (the "Approved Interfaces"). The files of + * Non-GPL Code may instantiate templates or use macros or inline functions from + * the Approved Interfaces without causing the resulting work to be covered by + * the GNU General Public License. Only Red Hat, Inc. may make changes or + * additions to the list of Approved Interfaces. You must obey the GNU General + * Public License in all respects for all of the Program code and other code used + * in conjunction with the Program except the Non-GPL Code covered by this + * exception. If you modify this file, you may extend this exception to your + * version of the file, but you are not obligated to do so. If you do not wish to + * provide this exception without modification, you must delete this exception + * statement from your version and license this file solely under the GPL without + * exception. + * + * + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. + * Copyright (C) 2015 Red Hat, Inc. + * All rights reserved. + * END COPYRIGHT BLOCK **/ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <string.h> +#include <stdio.h> + +#include <ldap.h> +#include <nspr.h> +#include <nss.h> +#include <secmod.h> +/* +#include <secasn1.h> +#include <secpkcs7.h> +*/ +#include <key.h> +#include <certdb.h> +#include <cert.h> +#include <svrcore.h> +#include <secmodt.h> +#include <prtypes.h> +#include <seccomon.h> +#include <pk11func.h> + +#define NEED_TOK_PBE /* see slap.h - defines tokPBE and ptokPBE */ +#include "rever.h" +#include <slap.h> +#include "slapi-plugin.h" +#include <uuid.h> +#include <plbase64.h> + +struct pk11MechItem +{ + CK_MECHANISM_TYPE type; + const char *mechName; +}; + +static const struct pk11MechItem DESmech = { CKM_DES_CBC, "DES CBC encryption" }; +static const struct pk11MechItem AESmech = { CKM_AES_CBC, "AES CBC encryption" }; +static Slapi_Mutex *pbe_lock = NULL; + +struct pk11ContextStore +{ + PK11SlotInfo *slot; + const struct pk11MechItem *mech; + PK11SymKey *key; + SECItem *params; + int length; + unsigned char *crypt; + char *algid_base64; +}; + +/* + * der_algid converting functions: + * + * SECStatus ATOB_ConvertAsciiToItem(SECItem *binary_item, const char *ascii); + * char * BTOA_ConvertItemToAscii(SECItem *binary_item); + * + */ + +static int encode_path(char *inPlain, char **outCipher, char *path, int mech); +static int decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid); +static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *algid); +static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out); +static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len); +static void freePBE(struct pk11ContextStore *store); + +void +init_pbe_plugin() +{ + if(!pbe_lock){ + pbe_lock = slapi_new_mutex(); + } +} + +int +encode(char *inPlain, char **outCipher, int mech) +{ + return encode_path(inPlain, outCipher, NULL, mech); +} + +static int +encode_path(char *inPlain, char **outCipher, char *path, int mech) +{ + struct pk11ContextStore *context = NULL; + PRArenaPool *arena = NULL; + unsigned char *cipher = NULL; + char *tmp = NULL; + char *base = NULL; + int len = 0; + int err; + + *outCipher = NULL; + err = 1; + + if ( genKey(&context, tokPBE, path, mech, arena, NULL) == SVRCORE_Success ){ + /* Try an encryption */ + if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ){ + base = BTOA_DataToAscii(cipher, context->length); + if ( base != NULL ){ + const char *scheme; + if (mech == AES_MECH){ + scheme = AES_REVER_SCHEME_NAME; + len = 3 + strlen(scheme)+ strlen(context->algid_base64) + strlen(base) + 1; + if( (tmp = slapi_ch_malloc( len )) ){ + /* + * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD> + */ + sprintf( tmp, "%c%s-%s%c%s", PWD_HASH_PREFIX_START, scheme, + context->algid_base64,PWD_HASH_PREFIX_END, base); + } + } else { + /* Old school DES */ + scheme = DES_REVER_SCHEME_NAME; + if((tmp = slapi_ch_malloc( 3 + strlen(scheme) + strlen(base)))){ + sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, scheme, + PWD_HASH_PREFIX_END, base); + } + } + if ( tmp != NULL ){ + *outCipher = tmp; + tmp = NULL; + err = 0; + } + PORT_Free(base); + } + } + } + freePBE(context); + + return(err); +} + +int +decode(char *inCipher, char **outPlain, int mech, char *algid) +{ + return decode_path(inCipher, outPlain, NULL, mech, algid); +} + + +static int +decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid) +{ + struct pk11ContextStore *context = NULL; + PRArenaPool *arena = NULL; + unsigned char *base = NULL; + char *plain = NULL; + int err; + int len = 0; + + *outPlain = NULL; + err = 1; + + if ( genKey(&context, tokPBE, path, mech, arena, algid) == SVRCORE_Success ){ + /* it seems that there is memory leak in that function: bug 400170 */ + base = ATOB_AsciiToData(inCipher, (unsigned int*)&len); + if ( base != NULL ){ + if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ){ + *outPlain = plain; + err = 0; + } + } + } + + slapi_ch_free_string(&algid); + PORT_Free(base); + PORT_FreeArena(arena, PR_TRUE); + freePBE(context); + + return(err); +} + +static void +freePBE(struct pk11ContextStore *store) +{ + if (store){ + if (store->slot) + slapd_pk11_freeSlot(store->slot); + if (store->key) + slapd_pk11_freeSymKey(store->key); + if (store->params) + SECITEM_FreeItem(store->params, PR_TRUE); + slapi_ch_free((void **)&store->crypt); + slapi_ch_free_string(&store->algid_base64); + slapi_ch_free((void **)&store); + } +} + +static SVRCOREError +genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *alg) +{ + SVRCOREError err = SVRCORE_Success; + struct pk11ContextStore *store = NULL; + SECItem *pwitem = NULL; + SECItem *result = NULL; + SECItem *salt = NULL; + SECItem der_algid; + SECAlgorithmID *algid = NULL; + SECOidTag algoid; + CK_MECHANISM pbeMech; + CK_MECHANISM cryptoMech; + SECAlgorithmID my_algid; + char *configdir = NULL; + char *der_ascii = NULL; + char *iv = NULL; + int free_it = 0; + + arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + + store = (struct pk11ContextStore*)slapi_ch_calloc(1, sizeof(*store)); + if (store == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + *out = store; + + /* Use the tokenName to find a PKCS11 slot */ + store->slot = slapd_pk11_findSlotByName((char *)token); + if (store->slot == NULL){ + err = SVRCORE_NoSuchToken_Error; + goto done; + } + + /* Generate a key and parameters to do the encryption */ + if(mech == AES_MECH){ + store->mech = &AESmech; + algoid = SEC_OID_AES_256_CBC; + } else { + store->mech = &DESmech; + algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC; + } + + /* Generate a unique id, used as salt for the key generation */ + if ( path == NULL ){ + configdir = config_get_configdir(); + if ( configdir == NULL ){ + err = SVRCORE_System_Error; + goto done; + } + } else { + configdir = slapi_ch_strdup(path); + } + if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ){ + err = SVRCORE_System_Error; + goto done; + } + + pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem)); + if (pwitem == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + pwitem->type = siBuffer; + pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); + if (pwitem->data == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + strcpy((char*)pwitem->data, iv); + pwitem->len = strlen(iv) + 1; + + salt = (SECItem *) PORT_Alloc(sizeof(SECItem)); + if (salt == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + salt->type = siBuffer; + salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); + if ( salt->data == NULL ){ + err = SVRCORE_NoMemory_Error; + goto done; + } + strcpy((char*)salt->data, iv); + salt->len = strlen(iv) + 1; + + PORT_Memset(&der_algid, 0, sizeof(der_algid)); + if(!alg){ + /* + * This is DES, or we are encoding AES - the process is the same. + */ + algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt); + free_it = 1; /* we need to free this algid */ + + /* + * The following is only need for AES - we need to store + * algid for future decodings(unlike with DES). So convert + * algid to its DER encoding. Then convert the DER to ascii, + * and finally convert the DER ascii to base64 so we can store + * it in the cipher prefix. + */ + SEC_ASN1EncodeItem(arena, &der_algid, algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate)); + der_ascii = BTOA_ConvertItemToAscii(&der_algid); + store->algid_base64 = PL_Base64Encode(der_ascii,strlen(der_ascii), NULL); + slapi_ch_free_string(&der_ascii); + } else { + /* + * We are decoding AES - use the supplied algid + */ + PORT_Memset(&my_algid, 0, sizeof(my_algid)); + + /* Decode the base64 der encoding */ + der_ascii = PL_Base64Decode(alg, strlen(alg), NULL); + + /* convert the der ascii to the SEC item */ + ATOB_ConvertAsciiToItem(&der_algid, der_ascii); + SEC_ASN1DecodeItem(arena, &my_algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate), &der_algid); + SECITEM_FreeItem(&der_algid, PR_FALSE); + algid = &my_algid; + slapi_ch_free_string(&der_ascii); + } + + slapi_lock_mutex(pbe_lock); + store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0); + if (store->key == 0){ + slapi_unlock_mutex(pbe_lock); + err = SVRCORE_System_Error; + goto done; + } + + slapi_unlock_mutex(pbe_lock); + + if(mech == AES_MECH) + { + cryptoMech.mechanism = PK11_GetPBECryptoMechanism(algid, &store->params, pwitem); + if (cryptoMech.mechanism == CKM_INVALID_MECHANISM) { + err = SVRCORE_System_Error; + goto done; + } + } + else + { + /* DES */ + pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid); + result = slapd_pk11_paramFromAlgid(algid); + if(result){ + pbeMech.pParameter = result->data; + pbeMech.ulParameterLen = result->len; + } + if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem, + PR_FALSE) != CKR_OK){ + err = SVRCORE_System_Error; + goto done; + } + + store->params = (SECItem *) PORT_Alloc(sizeof(SECItem)); + if (store->params == NULL){ + err = SVRCORE_System_Error; + goto done; + } + store->params->type = store->mech->type; + store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen); + if (store->params->data == NULL){ + err = SVRCORE_System_Error; + goto done; + } + memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen); + store->params->len = cryptoMech.ulParameterLen; + PORT_Free(cryptoMech.pParameter); + } + +done: + SECITEM_FreeItem(result, PR_TRUE); + SECITEM_FreeItem(pwitem, PR_TRUE); + SECITEM_FreeItem(salt, PR_TRUE); + if(free_it){ + secoid_destroyAlgorithmID(algid, PR_TRUE); + } + slapi_ch_free_string(&configdir); + slapi_ch_free_string(&iv); + if (arena) { + PORT_FreeArena(arena, PR_TRUE); + } + return (err); +} + +static SVRCOREError +decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len) +{ + SVRCOREError err = SVRCORE_Success; + unsigned char *plain = NULL; + unsigned char *cipher_with_padding = NULL; + SECStatus rv; + PK11Context *ctx = NULL; + int outLen = 0; + int blocksize = 0; + + blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); + store->length = len; + + /* + * store->length is the max. length of the returned clear text - + * must be >= length of crypted bytes - also must be a multiple + * of blocksize + */ + if (blocksize != 0){ + store->length += blocksize - (store->length % blocksize); + } + + /* plain will hold the returned clear text */ + plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), + store->length+1); + if (!plain){ + err = SVRCORE_NoMemory_Error; + goto done; + } + + /* + * create a buffer holding the original cipher bytes, padded with + * zeros to a multiple of blocksize - do not need +1 since buffer is not + * a string + */ + cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), + store->length); + if (!cipher_with_padding){ + err = SVRCORE_NoMemory_Error; + goto done; + } + memcpy(cipher_with_padding, cipher, len); + + ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT, + store->key, store->params); + if (!ctx) { + err = SVRCORE_System_Error; + goto done; + } + + /* + * Warning - there is a purify UMR in the NSS des code - you may see it when the + * password is not a multiple of 8 bytes long + */ + rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length, + cipher_with_padding, store->length); + if (rv){ + err = SVRCORE_System_Error; + } + + rv = slapd_pk11_finalize(ctx); + /* + * We must do the finalize, but we only want to set the err return + * code if it is not already set + */ + if (rv && (SVRCORE_Success == err)) + err = SVRCORE_System_Error; + +done: + if (err == SVRCORE_Success){ + *out = (char *)plain; + } else { + slapi_ch_free((void **)&plain); + } + + slapi_ch_free((void **)&cipher_with_padding); + /* We should free the PK11Context... Something like : */ + if (ctx){ + slapd_pk11_destroyContext(ctx, PR_TRUE); + } + + return err; +} + +static SVRCOREError +cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out) +{ + SVRCOREError err = SVRCORE_Success; + SECStatus rv; + PK11Context *ctx = NULL; + unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */ + int blocksize = 0; + int outLen = 0; + + blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); + store->length = strlen(clear); + + /* + * The size of the clear text buffer passed to the encryption functions + * must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer + * of this size, copy the clear text password into it, and pad the rest with + * zeros. + */ + if (blocksize != 0){ + store->length += blocksize - (store->length % blocksize); + } + + /* + * store->crypt will hold the crypted password - it must be >= clear length + * store->crypt is freed in NSS; let's not use slapi_ch_calloc + */ + store->crypt = (unsigned char *)calloc(sizeof(unsigned char), + store->length+1); + if (!store->crypt) { + err = SVRCORE_NoMemory_Error; + goto done; + } + + /* Create a buffer big enough to hold the clear text password and padding */ + clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), + store->length+1); + if (!clear_with_padding){ + err = SVRCORE_NoMemory_Error; + goto done; + } + /* + * Copy the clear text password into the buffer - the calloc insures the + * remainder is zero padded . + */ + strcpy((char *)clear_with_padding, clear); + + ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT, + store->key, store->params); + if (!ctx) { + err = SVRCORE_System_Error; + goto done; + } + + rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length, + clear_with_padding, store->length); + if (rv) { + err = SVRCORE_System_Error; + } + + rv = slapd_pk11_finalize(ctx); + /* + * We must do the finalize, but we only want to set the err return + * code if it is not already set + */ + if (rv && (SVRCORE_Success == err)){ + err = SVRCORE_System_Error; + } + +done: + if (err == SVRCORE_Success){ + *out = store->crypt; + } + + slapi_ch_free((void **)&clear_with_padding); + /* We should free the PK11Context... Something like : */ + if (ctx){ + slapd_pk11_destroyContext(ctx, PR_TRUE); + } + + return err; +} + +/* + * The UUID name based generator was broken on x86 platforms. We use + * this to generate the password encryption key. During migration, + * we have to fix this so we can use the fixed generator. The env. + * var USE_BROKEN_UUID tells the uuid generator to use the old + * broken method to create the UUID. That will allow us to decrypt + * the password to the correct clear text, then we can turn off + * the broken method and use the fixed method to encrypt the + * password. + */ +char * +migrateCredentials(char *oldpath, char *newpath, char *oldcred) +{ + static char *useBrokenUUID = "USE_BROKEN_UUID=1"; + static char *disableBrokenUUID = "USE_BROKEN_UUID=0"; + char *plain = NULL; + char *cipher = NULL; + + init_pbe_plugin(); + + slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 ); + NSS_NoDB_Init(NULL); + + if (getenv("MIGRATE_BROKEN_PWD")) { + putenv(useBrokenUUID); + } + + if ( decode_path(oldcred, &plain, oldpath, DES_MECH, NULL) == 0 ){ + if (getenv("MIGRATE_BROKEN_PWD")) { + putenv(disableBrokenUUID); + } + if ( encode_path(plain, &cipher, newpath, AES_MECH) != 0 ){ + return(NULL); + } else { + return(cipher); + } + } else { + return(NULL); + } +} diff --git a/ldap/servers/plugins/rever/rever.c b/ldap/servers/plugins/rever/rever.c index 9d7e82d..51d602f 100644 --- a/ldap/servers/plugins/rever/rever.c +++ b/ldap/servers/plugins/rever/rever.c @@ -43,25 +43,92 @@ #include <stdio.h> #include <string.h> #include <sys/types.h> - #include "rever.h" -static Slapi_PluginDesc pdesc = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" }; +static Slapi_PluginDesc pdesc_aes = { "aes-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "AES storage scheme plugin" }; +static Slapi_PluginDesc pdesc_des = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" }; + static char *plugin_name = "ReverStoragePlugin"; +#define AES_MECH 1 +#define DES_MECH 2 + +int +aes_cmp( char *userpwd, char *dbpwd ) +{ + char *cipher = NULL; + int rc = 0; + + if ( encode(userpwd, &cipher, AES_MECH) != 0 ){ + rc = 1; + } else { + rc = strcmp(cipher, dbpwd); + } + slapi_ch_free_string(&cipher); + + return rc; +} + +char * +aes_enc( char *pwd ) +{ + char *cipher = NULL; + + if ( encode(pwd, &cipher, AES_MECH) != 0 ){ + return(NULL); + } else { + return( cipher ); + } +} + +char * +aes_dec( char *pwd, char *alg ) +{ + char *plain = NULL; + + if ( decode(pwd, &plain, AES_MECH, alg) != 0 ){ + return(NULL); + } else { + return( plain ); + } +} + +int +aes_init( Slapi_PBlock *pb) +{ + char *name = slapi_ch_strdup(AES_REVER_SCHEME_NAME); + int rc; + + slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> aes_init\n" ); + + rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_aes ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) aes_enc); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) aes_cmp ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) aes_dec ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name ); + + init_pbe_plugin(); + + slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= aes_init %d\n", rc ); + + return( rc ); +} + int des_cmp( char *userpwd, char *dbpwd ) { char *cipher = NULL; int rc = 0; - if ( encode(userpwd, &cipher) != 0 ) + if ( encode(userpwd, &cipher, DES_MECH) != 0 ){ rc = 1; - else + } else { rc = strcmp(cipher, dbpwd); + } + slapi_ch_free_string(&cipher); - slapi_ch_free((void**)&cipher); return rc; } @@ -70,10 +137,11 @@ des_enc( char *pwd ) { char *cipher = NULL; - if ( encode(pwd, &cipher) != 0 ) + if ( encode(pwd, &cipher, DES_MECH ) != 0 ){ return(NULL); - else + } else { return( cipher ); + } } char * @@ -81,37 +149,31 @@ des_dec( char *pwd ) { char *plain = NULL; - if ( decode(pwd, &plain) != 0 ) + if ( decode(pwd, &plain, DES_MECH, NULL) != 0 ){ return(NULL); - else + } else { return( plain ); + } } int des_init( Slapi_PBlock *pb ) { + char *name = slapi_ch_strdup(DES_REVER_SCHEME_NAME); int rc; - char *name; slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> des_init\n" ); - rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, - (void *) SLAPI_PLUGIN_VERSION_01 ); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, - (void *)&pdesc ); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, - (void *) des_enc); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, - (void *) des_cmp ); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, - (void *) des_dec ); - name = slapi_ch_strdup(REVER_SCHEME_NAME); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, - name ); - - init_des_plugin(); - - slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n\n", rc ); + rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_des ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) des_enc); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) des_cmp ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) des_dec ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name ); + + init_pbe_plugin(); + + slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n", rc ); return( rc ); } diff --git a/ldap/servers/plugins/rever/rever.h b/ldap/servers/plugins/rever/rever.h index 8ea6279..9edddd8 100644 --- a/ldap/servers/plugins/rever/rever.h +++ b/ldap/servers/plugins/rever/rever.h @@ -49,7 +49,10 @@ #include "slap.h" #include "ldaplog.h" -#define REVER_SCHEME_NAME "DES" +#define AES_MECH 1 +#define DES_MECH 2 +#define AES_REVER_SCHEME_NAME "AES" +#define DES_REVER_SCHEME_NAME "DES" #define PWD_HASH_PREFIX_START '{' #define PWD_HASH_PREFIX_END '}' @@ -58,10 +61,10 @@ int rever_cmp( char *userpwd, char *dbpwd ); char *rever_enc( char *pwd ); char *rever_dec( char *pwd ); int rever_init( Slapi_PBlock *pb ); -void init_des_plugin(); +void init_pbe_plugin(); -int encode(char *inPlain, char ** outCipher); -int decode(char *inCipher, char **outPlain); +int encode(char *inPlain, char **outCipher, int mech); +int decode(char *inCipher, char **outPlain, int mech, char *algid); char *migrateCredentials(char *oldpath, char *newpath, char *oldcred); typedef char *(*migrate_fn_type)(char *, char *, char *); diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index 0c11238..3cb8451 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -937,6 +937,244 @@ handle_listeners(Connection_Table *ct, listener_info *listener_idxs, int n_liste return; } +/* + * Convert any pre-existing DES passwords to AES. + * + * Grab the "password" attributes and search all the backends for + * these attributes and convert them to AES if they are DES encoded. + */ +static void +convert_pbe_des_to_aes() +{ + Slapi_PBlock *pb = NULL; + Slapi_Entry **entries = NULL; + struct slapdplugin *plugin = NULL; + char **attrs = NULL; + char **backends = NULL; + char *val = NULL; + int converted_des = 0; + int result = -1; + int have_aes = 0; + int have_des = 0; + int i = 0, ii = 0, be_idx = 0; + + /* + * Check that AES plugin is enabled, and grab all the unique + * password attributes. + */ + for ( plugin = get_plugin_list(PLUGIN_LIST_REVER_PWD_STORAGE_SCHEME); + plugin != NULL; + plugin = plugin->plg_next ) + { + char *arg = NULL; + + if(plugin->plg_started && strcasecmp(plugin->plg_name, "AES") == 0){ + /* We have the AES plugin, and its enabled */ + have_aes = 1; + } + if(plugin->plg_started && strcasecmp(plugin->plg_name, "DES") == 0){ + /* We have the DES plugin, and its enabled */ + have_des = 1; + } + /* Gather all the unique password attributes from all the PBE plugins */ + for ( i = 0, arg = plugin->plg_argv[i]; + i < plugin->plg_argc; + arg = plugin->plg_argv[++i] ) + { + if(charray_inlist(attrs, arg)){ + continue; + } + charray_add(&attrs, slapi_ch_strdup(arg)); + } + } + + if(have_aes && have_des){ + /* + * Build a list of all the backend dn's + */ + Slapi_Backend *be = NULL; + struct suffixlist *list; + char *cookie = NULL; + + LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: " + "Converting DES passwords to AES...\n",0,0,0); + + be = slapi_get_first_backend(&cookie); + while (be){ + int suffix_idx = 0; + int count = slapi_counter_get_value(be->be_suffixcounter); + + list = be->be_suffixlist; + for (suffix_idx = 0; list && suffix_idx < count; suffix_idx++) { + char *suffix = (char *)slapi_sdn_get_ndn(list->be_suffix); + if(charray_inlist(backends, suffix) || strlen(suffix) == 0){ + list = list->next; + continue; + } + charray_add(&backends, slapi_ch_strdup(suffix)); + list = list->next; + } + be = slapi_get_next_backend (cookie); + } + slapi_ch_free ((void **)&cookie); + + /* + * Search for the password attributes + */ + for (i = 0; attrs && attrs[i]; i++){ + char *filter = PR_smprintf("%s=*", attrs[i]); + /* + * Loop over all the backends looking for the password attribute + */ + for(be_idx = 0; backends[be_idx]; be_idx++){ + pb = slapi_pblock_new(); + slapi_search_internal_set_pb(pb, backends[be_idx], + LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL, + (void *)plugin_get_default_component_id(), + SLAPI_OP_FLAG_IGNORE_UNINDEXED); + slapi_search_internal_pb(pb); + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if (LDAP_SUCCESS != result) { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to search for password on (%s) error (%d)\n", + backends[be_idx], result, 0); + goto done; + } + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries); + for (ii = 0; entries && entries[ii]; ii++){ + if((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))){ + if(strlen(val) >= 5 && strncmp(val,"{DES}", 5) == 0){ + /* + * We have a DES encoded password, convert it AES + */ + Slapi_PBlock *mod_pb = NULL; + Slapi_Value *sval = NULL; + LDAPMod mod_replace; + LDAPMod *mods[2]; + char *replace_val[2]; + char *passwd = NULL; + + /* decode the DES password */ + if(pw_rever_decode(val, &passwd, attrs[i]) == -1){ + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to decode existing DES password for (%s)\n", + slapi_entry_get_dn(entries[ii]), 0, 0); + converted_des = 0; + goto done; + } + + /* encode the password */ + sval = slapi_value_new_string(passwd); + if(pw_rever_encode(&sval, attrs[i]) == -1){ + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to encode AES password for (%s)\n", + slapi_entry_get_dn(entries[ii]), 0, 0); + slapi_ch_free_string(&passwd); + slapi_value_free(&sval); + converted_des = 0; + goto done; + } + + /* replace the attribute in the entry */ + replace_val[0] = (char *)slapi_value_get_string(sval); + replace_val[1] = NULL; + mod_replace.mod_op = LDAP_MOD_REPLACE; + mod_replace.mod_type = attrs[i]; + mod_replace.mod_values = replace_val; + mods[0] = &mod_replace; + mods[1] = 0; + + mod_pb = slapi_pblock_new(); + slapi_modify_internal_set_pb(mod_pb, slapi_entry_get_dn(entries[ii]), + mods, 0, 0, (void *)plugin_get_default_component_id(), 0); + slapi_modify_internal_pb(mod_pb); + + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if (LDAP_SUCCESS != result) { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to convert password for (%s) error (%d)\n", + slapi_entry_get_dn(entries[ii]), result, 0); + converted_des = -1; + } else { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "successfully converted password for (%s)\n", + slapi_entry_get_dn(entries[ii]), result, 0); + converted_des = 1; + + } + slapi_ch_free_string(&passwd); + slapi_value_free(&sval); + slapi_pblock_destroy(mod_pb); + if(result){ + goto done; + } + } + slapi_ch_free_string(&val); + } + } + slapi_free_search_results_internal(pb); + slapi_pblock_destroy(pb); + pb = NULL; + } + slapi_ch_free_string(&filter); + } + } + +done: + charray_free(attrs); + charray_free(backends); + slapi_free_search_results_internal(pb); + slapi_pblock_destroy(pb); + + if (have_aes && have_des){ + /* + * If a conversion attempt did not fail, disable DES plugin + */ + if(converted_des != -1){ + /* + * Disable the DES plugin - this also prevents potentially expensive + * searches at every server startup. + */ + LDAPMod mod_replace; + LDAPMod *mods[2]; + char *replace_val[2]; + char *des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config"; + + replace_val[0] = "off"; + replace_val[1] = NULL; + mod_replace.mod_op = LDAP_MOD_REPLACE; + mod_replace.mod_type = "nsslapd-pluginEnabled"; + mod_replace.mod_values = replace_val; + mods[0] = &mod_replace; + mods[1] = 0; + + pb = slapi_pblock_new(); + slapi_modify_internal_set_pb(pb, des_dn, mods, 0, 0, + (void *)plugin_get_default_component_id(), 0); + slapi_modify_internal_pb(pb); + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if (LDAP_SUCCESS != result) { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "Failed to disable DES plugin (%s), error (%d)\n", + des_dn, result, 0); + } else { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "Successfully disabled DES plugin (%s)\n", + des_dn, 0, 0); + } + slapi_pblock_destroy(pb); + } + if(converted_des == 1){ + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "Finished - all DES passwords have been converted to AES.\n", + 0, 0, 0); + } else if (converted_des == 0){ + LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: " + "Finished - no DES passwords to convert.\n",0,0,0); + } + } +} + void slapd_daemon( daemon_ports_t *ports ) { /* We are passed some ports---one for regular connections, one @@ -1140,7 +1378,6 @@ void slapd_daemon( daemon_ports_t *ports ) } #endif /* ENABLE_LDAPI */ #endif - listener_idxs = (listener_info *)slapi_ch_calloc(n_listeners, sizeof(*listener_idxs)); /* Now we write the pid file, indicating that the server is finally and listening for connections */ write_pid_file(); @@ -1148,6 +1385,11 @@ void slapd_daemon( daemon_ports_t *ports ) /* The server is ready and listening for connections. Logging "slapd started" message. */ unfurl_banners(the_connection_table,ports,n_tcps,s_tcps,i_unix); + /* + * Convert old DES encoded passwords to AES + */ + convert_pbe_des_to_aes(); + /* The meat of the operation is in a loop on a call to select */ while(!g_get_shutdown()) { diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 48188ed..35b45e3 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -1123,6 +1123,7 @@ void slapd_pk11_DestroyPublicKey(SECKEYPublicKey *key); PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type); PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm); PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx); +CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem); /* * start_tls_extop.c diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c index 082f69a..43a11c7 100644 --- a/ldap/servers/slapd/pw.c +++ b/ldap/servers/slapd/pw.c @@ -384,9 +384,8 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals ) if ((!enc) && (( enc = (*pws_enc)( (char*)slapi_value_get_string(vals[ i ]) )) == NULL )) { return( -1 ); } - - slapi_value_free(&vals[ i ]); - vals[ i ] = slapi_value_new_string_passin(enc); + slapi_value_free(&vals[ i ]); + vals[ i ] = slapi_value_new_string_passin(enc); } return( 0 ); @@ -396,28 +395,57 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals ) * Check if the prefix of the cipher is the one that is supposed to be * Extract from the whole cipher the encrypted password (remove the prefix) */ -int checkPrefix(char *cipher, char *schemaName, char **encrypt) +int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid) { int namelen; /* buf contains the extracted schema name */ char *end, buf[ 3*PWD_MAX_NAME_LEN + 1 ]; + char *delim = NULL; if ( (*cipher == PWD_HASH_PREFIX_START) && - ((end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) && - ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)) ) + (end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) { - memcpy( buf, cipher + 1, namelen ); - buf[ namelen ] = '\0'; - if ( strcasecmp( buf, schemaName) != 0 ) - { - /* schema names are different, error */ - return 1; - } - else - { - /* extract the encrypted password */ - *encrypt = cipher + strlen(schemaName) + 2; - return 0; + if((delim = strchr(cipher, PWD_PBE_DELIM)) != NULL){ + /* + * We have an algid in the prefix: + * + * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD> + */ + if((namelen = delim - cipher - 1) <= (3*PWD_MAX_NAME_LEN)){ + memcpy( buf, cipher + 1, namelen ); + buf[ namelen ] = '\0'; + + if ( strcasecmp( buf, schemaName) != 0 ){ + /* schema names are different, error */ + return 1; + } else { + char algid_buf[256]; + + /* extract the algid (length is never greater than 216 */ + memcpy(algid_buf, delim + 1 , (end - delim)); + algid_buf[end - delim - 1] = '\0'; + *algid = strdup(algid_buf); + + /* extract the encrypted password */ + *encrypt = cipher + strlen(*algid) + strlen (schemaName) + 3; + return 0; + } + } + } else if ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)){ + /* no delimiter - must be old school DES */ + memcpy( buf, cipher + 1, namelen ); + buf[ namelen ] = '\0'; + if ( strcasecmp( buf, schemaName) != 0 ) + { + /* schema names are different, error */ + return 1; + } + else + { + /* extract the encrypted password */ + *encrypt = cipher + strlen(schemaName) + 2; + return 0; + } } } /* cipher is not prefixed, already in clear ? */ @@ -443,6 +471,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) char *L_attr = NULL; int i = 0; char *encrypt = NULL; + char *algid = NULL; int prefixOK = -1; /* Get the appropriate decoding function */ @@ -450,10 +479,9 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) { if (slapi_attr_types_equivalent(L_attr, attr_name)) { - typedef char * (*ENCFP)(char *); + typedef char * (*ENCFP)(char *, char *); pwsp = (struct pw_scheme *) slapi_ch_calloc (1, sizeof(struct pw_scheme)); - pwsp->pws_dec = (ENCFP)p->plg_pwdstorageschemedec; pwsp->pws_name = slapi_ch_strdup( p->plg_pwdstorageschemename ); pwsp->pws_len = strlen(pwsp->pws_name) ; @@ -461,7 +489,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) { /* check that the prefix of the cipher is the same name as the scheme name */ - prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt); + prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt, &algid); if ( prefixOK == -1 ) { /* no prefix, already in clear ? */ @@ -471,13 +499,15 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) } else if ( prefixOK == 1 ) { - /* scheme names are different */ + /* scheme names are different, try the next plugin */ ret_code = -1; - goto free_and_return; + free_pw_scheme( pwsp ); + pwsp = NULL; + continue; } else { - if ( ( *plain = (pwsp->pws_dec)( encrypt )) == NULL ) + if ( ( *plain = (pwsp->pws_dec)( encrypt, algid )) == NULL ) { /* pb during decoding */ ret_code = -1; @@ -536,11 +566,13 @@ pw_rever_encode(Slapi_Value **vals, char * attr_name) for ( i = 0; vals[i] != NULL; ++i ) { char *encrypt = NULL; + char *algid = NULL; int prefixOK; prefixOK = checkPrefix((char*)slapi_value_get_string(vals[i]), pwsp->pws_name, - &encrypt); + &encrypt, &algid); + slapi_ch_free_string(&algid); if ( prefixOK == 0 ) { /* Don't touch already encoded value */ diff --git a/ldap/servers/slapd/pw.h b/ldap/servers/slapd/pw.h index 7190a1d..79a90a0 100644 --- a/ldap/servers/slapd/pw.h +++ b/ldap/servers/slapd/pw.h @@ -61,7 +61,7 @@ struct pw_scheme *pw_name2scheme( char *name ); struct pw_scheme *pw_val2scheme( char *val, char **valpwdp, int first_is_default ); int pw_encodevals( Slapi_Value **vals ); int pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals ); -int checkPrefix(char *cipher, char *schemaName, char **encrypt); +int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid); struct passwordpolicyarray *new_passwdPolicy ( Slapi_PBlock *pb, const char *dn ); void delete_passwdPolicy( struct passwordpolicyarray **pwpolicy); diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c index 2198337..544a9c7 100644 --- a/ldap/servers/slapd/result.c +++ b/ldap/servers/slapd/result.c @@ -2083,7 +2083,8 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie slapi_pblock_get( pb, SLAPI_OPERATION_TYPE, &optype ); if(optype == SLAPI_OPERATION_SEARCH && /* search, */ strcmp(notes_str,"") && /* that's unindexed, */ - !(config_get_accesslog_level() & LDAP_DEBUG_ARGS)) /* and not logged in access log */ + !(config_get_accesslog_level() & LDAP_DEBUG_ARGS) && /* and not logged in access log */ + !(op->o_flags & SLAPI_OP_FLAG_IGNORE_UNINDEXED) ) /* and not ignoring unindexed search */ { struct slapdplugin *plugin = NULL; struct slapi_componentid *cid = NULL; diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c index 33d512f..4ffda8b 100644 --- a/ldap/servers/slapd/security_wrappers.c +++ b/ldap/servers/slapd/security_wrappers.c @@ -409,3 +409,9 @@ PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, return PK11_TokenKeyGenWithFlags(slot, type, param, keySize, keyid, opFlags, attrFlags, wincx); } + +CK_MECHANISM_TYPE +slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem) +{ + return PK11_GetPBECryptoMechanism(algid, params, pwitem ); +} diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index d234c13..3db8fe7 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -53,9 +53,9 @@ /* Used by SSL and DES plugin */ -#ifdef NEED_TOK_DES -static char tokDes[34] = "Communicator Generic Crypto Svcs"; -static char ptokDes[34] = "Internal (Software) Token "; +#ifdef NEED_TOK_PBE +static char tokPBE[34] = "Communicator Generic Crypto Svcs"; +static char ptokPBE[34] = "Internal (Software) Token "; #endif /* @@ -307,6 +307,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */ #define ATTR_NETSCAPEMDSUFFIX "netscapemdsuffix" +#define PWD_PBE_DELIM '-' + #define REFERRAL_REMOVE_CMD "remove" /* Filenames for DSE storage */ @@ -1592,7 +1594,7 @@ struct pw_scheme { char *(*pws_enc)( char *pwd ); /* thread-safe decoding function (returns pointer to malloc'd string) */ - char *(*pws_dec)( char *pwd ); + char *(*pws_dec)( char *pwd, char *algid); }; typedef struct passwordpolicyarray { diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index a61d954..41dd2c8 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -222,6 +222,7 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...) #define SLAPI_OP_FLAG_NO_ACCESS_CHECK 0x10000 /* Do not check for access control - bypass them */ #define SLAPI_OP_FLAG_BYPASS_REFERRALS 0x40000 /* Useful for performing internal operations on read-only replica */ #define SLAPI_OP_FLAG_NEVER_CACHE 0x200000 /* added entry should not be kept in cache */ +#define SLAPI_OP_FLAG_IGNORE_UNINDEXED 0x800000 /* Do not log unindexed search */ #define SLAPI_OC_FLAG_REQUIRED 0x0001 #define SLAPI_OC_FLAG_ALLOWED 0x0002 diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 6b51e0c..67d01cd 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -64,7 +64,7 @@ #include <string.h> #include <errno.h> -#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */ +#define NEED_TOK_PBE /* defines tokPBE and ptokPBE - see slap.h */ #include "slap.h" #include "svrcore.h" @@ -1108,7 +1108,7 @@ slapd_nss_init(int init_ssl, int config_available) /******** Initialise NSS *********/ nssFlags &= (~NSS_INIT_READONLY); - slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 ); + slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 ); secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags); dongle_file_name = PR_smprintf("%s/pin.txt", certdir);

1 0

aclocal.m4 config.guess config.sub dirsrvtests/tickets ldap/admin ldap/ldif ldap/servers Makefile.am Makefile.in
by Mark Reynolds 20 Jan '15

20 Jan '15

Makefile.am | 14 Makefile.in | 104 ++-- aclocal.m4 | 15 config.guess | 192 +------- config.sub | 40 + dirsrvtests/tickets/ticket47462_test.py | 452 +++++++++++++++++++ ldap/admin/src/scripts/50AES-pbe-plugin.ldif | 16 ldap/admin/src/scripts/52updateAESplugin.pl | 84 +++ ldap/ldif/50replication-plugins.ldif | 2 ldap/ldif/template-dse.ldif.in | 16 ldap/servers/plugins/rever/des.c | 551 ----------------------- ldap/servers/plugins/rever/pbe.c | 621 +++++++++++++++++++++++++++ ldap/servers/plugins/rever/rever.c | 116 +++-- ldap/servers/plugins/rever/rever.h | 11 ldap/servers/slapd/daemon.c | 244 ++++++++++ ldap/servers/slapd/proto-slap.h | 1 ldap/servers/slapd/pw.c | 82 ++- ldap/servers/slapd/pw.h | 2 ldap/servers/slapd/result.c | 3 ldap/servers/slapd/security_wrappers.c | 6 ldap/servers/slapd/slap.h | 10 ldap/servers/slapd/slapi-plugin.h | 1 ldap/servers/slapd/ssl.c | 4 23 files changed, 1731 insertions(+), 856 deletions(-) New commits: commit a57494fcaffccb6fdd060a93ba605d432e38bc09 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Jan 20 10:59:05 2015 -0500 Ticket 47462 - Stop using DES in the reversible password encryption plug-in Bug Description: DES is not a safe cipher to use for Password Based Encryption(pbe). AES should be used instead. Fix Description: Use AES for all new password encodings. AES requires that the algorithm ID used to encode the password, must also be used to decode it. So, the algorithm ID is now stored in the cipher prefix: {AES-<BASE64 encoded alg ID>}<ENCODED PASSWORD> Since DES is no longer being used, the library has been renamed to a more apprpriate name: libdes-plugin -> libpbe-plugin During upgrades the DES plugin entry has its library path updated to use libpbe-plugin. The MMR plugin changes its dependency from DES to AES, and the AES plugin entry is added, and all the password attributes found in the old DES Plugin are migrated over to the new AES Plugin entry. When the server is restarted it checks for any DES passwords in the database and cn=config. If any are found they are converted to AES, and the DES plugin is disabled. Also created a new operation flag: SLAPI_OP_FLAG_IGNORE_UNINDEXED This flag prevents an internal unnidexed search from being logged in the "errors" log. When the server starts up it can potentially do unindexed searches while looking for DES passwords. We don't want this log "noise" in the errors log everytime the server starts. https://fedorahosted.org/389/ticket/47462 Design Doc: http://www.port389.org/docs/389ds/design/pbe.html Valgrind: Passed Reviewed by: nhosoi(Thanks!) diff --git a/Makefile.am b/Makefile.am index 049ff74..17aadff 100644 --- a/Makefile.am +++ b/Makefile.am @@ -225,7 +225,7 @@ endif serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \ libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \ libcollation-plugin.la libcos-plugin.la libderef-plugin.la \ - libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ + libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ liblinkedattrs-plugin.la libmanagedentries-plugin.la \ libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \ libcontentsync-plugin.la \ @@ -583,7 +583,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \ ldap/admin/src/scripts/82targetuniqueidindex.pl \ ldap/admin/src/scripts/90subtreerename.pl \ ldap/admin/src/scripts/91subtreereindex.pl \ + ldap/admin/src/scripts/50AES-pbe-plugin.ldif\ ldap/admin/src/scripts/50updateconfig.ldif \ + ldap/admin/src/scripts/52updateAESplugin.pl \ ldap/admin/src/scripts/dnaplugindepends.ldif update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh @@ -1016,14 +1018,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK) libderef_plugin_la_LDFLAGS = -avoid-version #------------------------ -# libdes-plugin +# libpbe-plugin #----------------------- -libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \ +libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \ ldap/servers/plugins/rever/rever.c -libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ -libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK) -libdes_plugin_la_LDFLAGS = -avoid-version +libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ +libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK) +libpbe_plugin_la_LDFLAGS = -avoid-version #------------------------ # libdistrib-plugin diff --git a/Makefile.in b/Makefile.in index 24a9ddf..dff7462 100644 --- a/Makefile.in +++ b/Makefile.in @@ -396,15 +396,6 @@ libderef_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ $(AM_CFLAGS) $(CFLAGS) $(libderef_plugin_la_LDFLAGS) \ $(LDFLAGS) -o $@ -libdes_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1) -am_libdes_plugin_la_OBJECTS = \ - ldap/servers/plugins/rever/libdes_plugin_la-des.lo \ - ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -libdes_plugin_la_OBJECTS = $(am_libdes_plugin_la_OBJECTS) -libdes_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ - $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ - $(AM_CFLAGS) $(CFLAGS) $(libdes_plugin_la_LDFLAGS) $(LDFLAGS) \ - -o $@ libdistrib_plugin_la_DEPENDENCIES = libslapd.la am_libdistrib_plugin_la_OBJECTS = \ ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo @@ -548,6 +539,15 @@ libpassthru_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ $(AM_CFLAGS) $(CFLAGS) $(libpassthru_plugin_la_LDFLAGS) \ $(LDFLAGS) -o $@ +libpbe_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1) +am_libpbe_plugin_la_OBJECTS = \ + ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo \ + ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo +libpbe_plugin_la_OBJECTS = $(am_libpbe_plugin_la_OBJECTS) +libpbe_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ + $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ + $(AM_CFLAGS) $(CFLAGS) $(libpbe_plugin_la_LDFLAGS) $(LDFLAGS) \ + -o $@ libposix_winsync_plugin_la_DEPENDENCIES = libslapd.la \ $(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1) am_libposix_winsync_plugin_la_OBJECTS = ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo \ @@ -1154,14 +1154,13 @@ SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \ $(libcollation_plugin_la_SOURCES) \ $(libcontentsync_plugin_la_SOURCES) \ $(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \ - $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \ - $(libdna_plugin_la_SOURCES) \ + $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \ $(libhttp_client_plugin_la_SOURCES) \ $(liblinkedattrs_plugin_la_SOURCES) \ $(libmanagedentries_plugin_la_SOURCES) \ $(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \ $(libpam_passthru_plugin_la_SOURCES) \ - $(libpassthru_plugin_la_SOURCES) \ + $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \ $(libposix_winsync_plugin_la_SOURCES) \ $(libpresence_plugin_la_SOURCES) \ $(libpwdstorage_plugin_la_SOURCES) \ @@ -1190,14 +1189,13 @@ DIST_SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \ $(libcollation_plugin_la_SOURCES) \ $(libcontentsync_plugin_la_SOURCES) \ $(libcos_plugin_la_SOURCES) $(libderef_plugin_la_SOURCES) \ - $(libdes_plugin_la_SOURCES) $(libdistrib_plugin_la_SOURCES) \ - $(libdna_plugin_la_SOURCES) \ + $(libdistrib_plugin_la_SOURCES) $(libdna_plugin_la_SOURCES) \ $(libhttp_client_plugin_la_SOURCES) \ $(liblinkedattrs_plugin_la_SOURCES) \ $(libmanagedentries_plugin_la_SOURCES) \ $(libmemberof_plugin_la_SOURCES) $(libns_dshttpd_la_SOURCES) \ $(libpam_passthru_plugin_la_SOURCES) \ - $(libpassthru_plugin_la_SOURCES) \ + $(libpassthru_plugin_la_SOURCES) $(libpbe_plugin_la_SOURCES) \ $(libposix_winsync_plugin_la_SOURCES) \ $(libpresence_plugin_la_SOURCES) \ $(libpwdstorage_plugin_la_SOURCES) \ @@ -1637,7 +1635,7 @@ server_LTLIBRARIES = libslapd.la libns-dshttpd.la serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \ libautomember-plugin.la libback-ldbm.la libchainingdb-plugin.la \ libcollation-plugin.la libcos-plugin.la libderef-plugin.la \ - libdes-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ + libpbe-plugin.la libdistrib-plugin.la libhttp-client-plugin.la \ liblinkedattrs-plugin.la libmanagedentries-plugin.la \ libmemberof-plugin.la libpassthru-plugin.la libpwdstorage-plugin.la \ libcontentsync-plugin.la \ @@ -1991,7 +1989,9 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \ ldap/admin/src/scripts/82targetuniqueidindex.pl \ ldap/admin/src/scripts/90subtreerename.pl \ ldap/admin/src/scripts/91subtreereindex.pl \ + ldap/admin/src/scripts/50AES-pbe-plugin.ldif\ ldap/admin/src/scripts/50updateconfig.ldif \ + ldap/admin/src/scripts/52updateAESplugin.pl \ ldap/admin/src/scripts/dnaplugindepends.ldif update_SCRIPTS = ldap/admin/src/scripts/exampleupdate.sh @@ -2363,14 +2363,14 @@ libderef_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK) libderef_plugin_la_LDFLAGS = -avoid-version #------------------------ -# libdes-plugin +# libpbe-plugin #----------------------- -libdes_plugin_la_SOURCES = ldap/servers/plugins/rever/des.c \ +libpbe_plugin_la_SOURCES = ldap/servers/plugins/rever/pbe.c \ ldap/servers/plugins/rever/rever.c -libdes_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ -libdes_plugin_la_LIBADD = libslapd.la $(NSS_LINK) -libdes_plugin_la_LDFLAGS = -avoid-version +libpbe_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS) @svrcore_inc@ +libpbe_plugin_la_LIBADD = libslapd.la $(NSS_LINK) +libpbe_plugin_la_LDFLAGS = -avoid-version #------------------------ # libdistrib-plugin @@ -3596,21 +3596,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: \ libderef-plugin.la: $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_DEPENDENCIES) $(EXTRA_libderef_plugin_la_DEPENDENCIES) $(AM_V_CCLD)$(libderef_plugin_la_LINK) -rpath $(serverplugindir) $(libderef_plugin_la_OBJECTS) $(libderef_plugin_la_LIBADD) $(LIBS) -ldap/servers/plugins/rever/$(am__dirstamp): - @$(MKDIR_P) ldap/servers/plugins/rever - @: > ldap/servers/plugins/rever/$(am__dirstamp) -ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp): - @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR) - @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) -ldap/servers/plugins/rever/libdes_plugin_la-des.lo: \ - ldap/servers/plugins/rever/$(am__dirstamp) \ - ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) -ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: \ - ldap/servers/plugins/rever/$(am__dirstamp) \ - ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) - -libdes-plugin.la: $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_DEPENDENCIES) $(EXTRA_libdes_plugin_la_DEPENDENCIES) - $(AM_V_CCLD)$(libdes_plugin_la_LINK) -rpath $(serverplugindir) $(libdes_plugin_la_OBJECTS) $(libdes_plugin_la_LIBADD) $(LIBS) ldap/servers/plugins/distrib/$(am__dirstamp): @$(MKDIR_P) ldap/servers/plugins/distrib @: > ldap/servers/plugins/distrib/$(am__dirstamp) @@ -3900,6 +3885,21 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: \ libpassthru-plugin.la: $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_DEPENDENCIES) $(EXTRA_libpassthru_plugin_la_DEPENDENCIES) $(AM_V_CCLD)$(libpassthru_plugin_la_LINK) -rpath $(serverplugindir) $(libpassthru_plugin_la_OBJECTS) $(libpassthru_plugin_la_LIBADD) $(LIBS) +ldap/servers/plugins/rever/$(am__dirstamp): + @$(MKDIR_P) ldap/servers/plugins/rever + @: > ldap/servers/plugins/rever/$(am__dirstamp) +ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) ldap/servers/plugins/rever/$(DEPDIR) + @: > ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) +ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: \ + ldap/servers/plugins/rever/$(am__dirstamp) \ + ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) +ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: \ + ldap/servers/plugins/rever/$(am__dirstamp) \ + ldap/servers/plugins/rever/$(DEPDIR)/$(am__dirstamp) + +libpbe-plugin.la: $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_DEPENDENCIES) $(EXTRA_libpbe_plugin_la_DEPENDENCIES) + $(AM_V_CCLD)$(libpbe_plugin_la_LINK) -rpath $(serverplugindir) $(libpbe_plugin_la_OBJECTS) $(libpbe_plugin_la_LIBADD) $(LIBS) ldap/servers/plugins/posix-winsync/$(am__dirstamp): @$(MKDIR_P) ldap/servers/plugins/posix-winsync @: > ldap/servers/plugins/posix-winsync/$(am__dirstamp) @@ -5441,8 +5441,8 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_po.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_rootdse.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/retrocl/$(DEPDIR)/libretrocl_plugin_la-retrocl_trim.Plo@am__quote@ -@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo@am__quote@ -@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_cache.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/roles/$(DEPDIR)/libroles_plugin_la-roles_plugin.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/rootdn_access/$(DEPDIR)/librootdn_access_plugin_la-rootdn_access.Plo@am__quote@ @@ -6739,20 +6739,6 @@ ldap/servers/plugins/deref/libderef_plugin_la-deref.lo: ldap/servers/plugins/der @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libderef_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/deref/libderef_plugin_la-deref.lo `test -f 'ldap/servers/plugins/deref/deref.c' || echo '$(srcdir)/'`ldap/servers/plugins/deref/deref.c -ldap/servers/plugins/rever/libdes_plugin_la-des.lo: ldap/servers/plugins/rever/des.c -@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-des.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c -@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-des.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/des.c' object='ldap/servers/plugins/rever/libdes_plugin_la-des.lo' libtool=yes @AMDEPBACKSLASH@ -@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-des.lo `test -f 'ldap/servers/plugins/rever/des.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/des.c - -ldap/servers/plugins/rever/libdes_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c -@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libdes_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c -@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libdes_plugin_la-rever.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libdes_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@ -@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdes_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libdes_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c - ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo: ldap/servers/plugins/distrib/distrib.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libdistrib_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo -MD -MP -MF ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo -c -o ldap/servers/plugins/distrib/libdistrib_plugin_la-distrib.lo `test -f 'ldap/servers/plugins/distrib/distrib.c' || echo '$(srcdir)/'`ldap/servers/plugins/distrib/distrib.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Tpo ldap/servers/plugins/distrib/$(DEPDIR)/libdistrib_plugin_la-distrib.Plo @@ -6991,6 +6977,20 @@ ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo: ldap/servers/plug @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpassthru_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/passthru/libpassthru_plugin_la-ptutil.lo `test -f 'ldap/servers/plugins/passthru/ptutil.c' || echo '$(srcdir)/'`ldap/servers/plugins/passthru/ptutil.c +ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo: ldap/servers/plugins/rever/pbe.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-pbe.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/pbe.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-pbe.lo `test -f 'ldap/servers/plugins/rever/pbe.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/pbe.c + +ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo: ldap/servers/plugins/rever/rever.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo -MD -MP -MF ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Tpo ldap/servers/plugins/rever/$(DEPDIR)/libpbe_plugin_la-rever.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ldap/servers/plugins/rever/rever.c' object='ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libpbe_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/rever/libpbe_plugin_la-rever.lo `test -f 'ldap/servers/plugins/rever/rever.c' || echo '$(srcdir)/'`ldap/servers/plugins/rever/rever.c + ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo: ldap/servers/plugins/posix-winsync/posix-winsync.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libposix_winsync_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo -MD -MP -MF ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo -c -o ldap/servers/plugins/posix-winsync/libposix_winsync_plugin_la-posix-winsync.lo `test -f 'ldap/servers/plugins/posix-winsync/posix-winsync.c' || echo '$(srcdir)/'`ldap/servers/plugins/posix-winsync/posix-winsync.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Tpo ldap/servers/plugins/posix-winsync/$(DEPDIR)/libposix_winsync_plugin_la-posix-winsync.Plo diff --git a/aclocal.m4 b/aclocal.m4 index 8136dd1..7afd01a 100644 --- a/aclocal.m4 +++ b/aclocal.m4 @@ -220,6 +220,21 @@ m4_popdef([pkg_default]) m4_popdef([pkg_description]) ]) dnl PKG_NOARCH_INSTALLDIR + +# PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE, +# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) +# ------------------------------------------- +# Retrieves the value of the pkg-config variable for the given module. +AC_DEFUN([PKG_CHECK_VAR], +[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl +AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl + +_PKG_CONFIG([$1], [variable="][$3]["], [$2]) +AS_VAR_COPY([$1], [pkg_cv_][$1]) + +AS_VAR_IF([$1], [""], [$5], [$4])dnl +])# PKG_CHECK_VAR + # Copyright (C) 2002-2013 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation diff --git a/config.guess b/config.guess index b79252d..1f5c50c 100755 --- a/config.guess +++ b/config.guess @@ -1,8 +1,8 @@ #! /bin/sh # Attempt to guess a canonical system name. -# Copyright 1992-2013 Free Software Foundation, Inc. +# Copyright 1992-2014 Free Software Foundation, Inc. -timestamp='2013-06-10' +timestamp='2014-03-23' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -50,7 +50,7 @@ version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. -Copyright 1992-2013 Free Software Foundation, Inc. +Copyright 1992-2014 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -149,7 +149,7 @@ Linux|GNU|GNU/*) LIBC=gnu #endif EOF - eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'` + eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'` ;; esac @@ -826,7 +826,7 @@ EOF *:MINGW*:*) echo ${UNAME_MACHINE}-pc-mingw32 exit ;; - i*:MSYS*:*) + *:MSYS*:*) echo ${UNAME_MACHINE}-pc-msys exit ;; i*:windows32*:*) @@ -969,10 +969,10 @@ EOF eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'` test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; } ;; - or1k:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + openrisc*:Linux:*:*) + echo or1k-unknown-linux-${LIBC} exit ;; - or32:Linux:*:*) + or32:Linux:*:* | or1k*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; padre:Linux:*:*) @@ -1260,16 +1260,26 @@ EOF if test "$UNAME_PROCESSOR" = unknown ; then UNAME_PROCESSOR=powerpc fi - if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then - if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ - (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ - grep IS_64BIT_ARCH >/dev/null - then - case $UNAME_PROCESSOR in - i386) UNAME_PROCESSOR=x86_64 ;; - powerpc) UNAME_PROCESSOR=powerpc64 ;; - esac + if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then + if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then + if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ + (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ + grep IS_64BIT_ARCH >/dev/null + then + case $UNAME_PROCESSOR in + i386) UNAME_PROCESSOR=x86_64 ;; + powerpc) UNAME_PROCESSOR=powerpc64 ;; + esac + fi fi + elif test "$UNAME_PROCESSOR" = i386 ; then + # Avoid executing cc on OS X 10.9, as it ships with a stub + # that puts up a graphical alert prompting to install + # developer tools. Any system running Mac OS X 10.7 or + # later (Darwin 11 and later) is required to have a 64-bit + # processor. This is not true of the ARM version of Darwin + # that Apple uses in portable devices. + UNAME_PROCESSOR=x86_64 fi echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE} exit ;; @@ -1361,154 +1371,6 @@ EOF exit ;; esac -eval $set_cc_for_build -cat >$dummy.c <<EOF -#ifdef _SEQUENT_ -# include <sys/types.h> -# include <sys/utsname.h> -#endif -main () -{ -#if defined (sony) -#if defined (MIPSEB) - /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed, - I don't know.... */ - printf ("mips-sony-bsd\n"); exit (0); -#else -#include <sys/param.h> - printf ("m68k-sony-newsos%s\n", -#ifdef NEWSOS4 - "4" -#else - "" -#endif - ); exit (0); -#endif -#endif - -#if defined (__arm) && defined (__acorn) && defined (__unix) - printf ("arm-acorn-riscix\n"); exit (0); -#endif - -#if defined (hp300) && !defined (hpux) - printf ("m68k-hp-bsd\n"); exit (0); -#endif - -#if defined (NeXT) -#if !defined (__ARCHITECTURE__) -#define __ARCHITECTURE__ "m68k" -#endif - int version; - version=`(hostinfo | sed -n 's/.*NeXT Mach $[0-9]*$.*/\1/p') 2>/dev/null`; - if (version < 4) - printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version); - else - printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version); - exit (0); -#endif - -#if defined (MULTIMAX) || defined (n16) -#if defined (UMAXV) - printf ("ns32k-encore-sysv\n"); exit (0); -#else -#if defined (CMU) - printf ("ns32k-encore-mach\n"); exit (0); -#else - printf ("ns32k-encore-bsd\n"); exit (0); -#endif -#endif -#endif - -#if defined (__386BSD__) - printf ("i386-pc-bsd\n"); exit (0); -#endif - -#if defined (sequent) -#if defined (i386) - printf ("i386-sequent-dynix\n"); exit (0); -#endif -#if defined (ns32000) - printf ("ns32k-sequent-dynix\n"); exit (0); -#endif -#endif - -#if defined (_SEQUENT_) - struct utsname un; - - uname(&un); - - if (strncmp(un.version, "V2", 2) == 0) { - printf ("i386-sequent-ptx2\n"); exit (0); - } - if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */ - printf ("i386-sequent-ptx1\n"); exit (0); - } - printf ("i386-sequent-ptx\n"); exit (0); - -#endif - -#if defined (vax) -# if !defined (ultrix) -# include <sys/param.h> -# if defined (BSD) -# if BSD == 43 - printf ("vax-dec-bsd4.3\n"); exit (0); -# else -# if BSD == 199006 - printf ("vax-dec-bsd4.3reno\n"); exit (0); -# else - printf ("vax-dec-bsd\n"); exit (0); -# endif -# endif -# else - printf ("vax-dec-bsd\n"); exit (0); -# endif -# else - printf ("vax-dec-ultrix\n"); exit (0); -# endif -#endif - -#if defined (alliant) && defined (i860) - printf ("i860-alliant-bsd\n"); exit (0); -#endif - - exit (1); -} -EOF - -$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` && - { echo "$SYSTEM_NAME"; exit; } - -# Apollos put the system type in the environment. - -test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; } - -# Convex versions that predate uname can use getsysinfo(1) - -if [ -x /usr/convex/getsysinfo ] -then - case `getsysinfo -f cpu_type` in - c1*) - echo c1-convex-bsd - exit ;; - c2*) - if getsysinfo -f scalar_acc - then echo c32-convex-bsd - else echo c2-convex-bsd - fi - exit ;; - c34*) - echo c34-convex-bsd - exit ;; - c38*) - echo c38-convex-bsd - exit ;; - c4*) - echo c4-convex-bsd - exit ;; - esac -fi - cat >&2 <<EOF $0: unable to guess system type diff --git a/config.sub b/config.sub index c765b34..66c5074 100755 --- a/config.sub +++ b/config.sub @@ -1,8 +1,8 @@ #! /bin/sh # Configuration validation subroutine script. -# Copyright 1992-2013 Free Software Foundation, Inc. +# Copyright 1992-2014 Free Software Foundation, Inc. -timestamp='2013-04-24' +timestamp='2014-07-28' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -68,7 +68,7 @@ Report bugs and patches to <config-patches(a)gnu.org>." version="\ GNU config.sub ($timestamp) -Copyright 1992-2013 Free Software Foundation, Inc. +Copyright 1992-2014 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -257,7 +257,7 @@ case $basic_machine in | avr | avr32 \ | be32 | be64 \ | bfin \ - | c4x | clipper \ + | c4x | c8051 | clipper \ | d10v | d30v | dlx | dsp16xx \ | epiphany \ | fido | fr30 | frv \ @@ -265,6 +265,7 @@ case $basic_machine in | hexagon \ | i370 | i860 | i960 | ia64 \ | ip2k | iq2000 \ + | k1om \ | le32 | le64 \ | lm32 \ | m32c | m32r | m32rle | m68000 | m68k | m88k \ @@ -282,8 +283,10 @@ case $basic_machine in | mips64vr5900 | mips64vr5900el \ | mipsisa32 | mipsisa32el \ | mipsisa32r2 | mipsisa32r2el \ + | mipsisa32r6 | mipsisa32r6el \ | mipsisa64 | mipsisa64el \ | mipsisa64r2 | mipsisa64r2el \ + | mipsisa64r6 | mipsisa64r6el \ | mipsisa64sb1 | mipsisa64sb1el \ | mipsisa64sr71k | mipsisa64sr71kel \ | mipsr5900 | mipsr5900el \ @@ -295,8 +298,7 @@ case $basic_machine in | nds32 | nds32le | nds32be \ | nios | nios2 | nios2eb | nios2el \ | ns16k | ns32k \ - | open8 \ - | or1k | or32 \ + | open8 | or1k | or1knd | or32 \ | pdp10 | pdp11 | pj | pjl \ | powerpc | powerpc64 | powerpc64le | powerpcle \ | pyramid \ @@ -324,7 +326,7 @@ case $basic_machine in c6x) basic_machine=tic6x-unknown ;; - m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip) + m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip) basic_machine=$basic_machine-unknown os=-none ;; @@ -372,7 +374,7 @@ case $basic_machine in | be32-* | be64-* \ | bfin-* | bs2000-* \ | c[123]* | c30-* | [cjt]90-* | c4x-* \ - | clipper-* | craynv-* | cydra-* \ + | c8051-* | clipper-* | craynv-* | cydra-* \ | d10v-* | d30v-* | dlx-* \ | elxsi-* \ | f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \ @@ -381,6 +383,7 @@ case $basic_machine in | hexagon-* \ | i*86-* | i860-* | i960-* | ia64-* \ | ip2k-* | iq2000-* \ + | k1om-* \ | le32-* | le64-* \ | lm32-* \ | m32c-* | m32r-* | m32rle-* \ @@ -400,8 +403,10 @@ case $basic_machine in | mips64vr5900-* | mips64vr5900el-* \ | mipsisa32-* | mipsisa32el-* \ | mipsisa32r2-* | mipsisa32r2el-* \ + | mipsisa32r6-* | mipsisa32r6el-* \ | mipsisa64-* | mipsisa64el-* \ | mipsisa64r2-* | mipsisa64r2el-* \ + | mipsisa64r6-* | mipsisa64r6el-* \ | mipsisa64sb1-* | mipsisa64sb1el-* \ | mipsisa64sr71k-* | mipsisa64sr71kel-* \ | mipsr5900-* | mipsr5900el-* \ @@ -413,6 +418,7 @@ case $basic_machine in | nios-* | nios2-* | nios2eb-* | nios2el-* \ | none-* | np1-* | ns16k-* | ns32k-* \ | open8-* \ + | or1k*-* \ | orion-* \ | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \ @@ -794,7 +800,7 @@ case $basic_machine in os=-mingw64 ;; mingw32) - basic_machine=i386-pc + basic_machine=i686-pc os=-mingw32 ;; mingw32ce) @@ -822,6 +828,10 @@ case $basic_machine in basic_machine=powerpc-unknown os=-morphos ;; + moxiebox) + basic_machine=moxie-unknown + os=-moxiebox + ;; msdos) basic_machine=i386-pc os=-msdos @@ -830,7 +840,7 @@ case $basic_machine in basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'` ;; msys) - basic_machine=i386-pc + basic_machine=i686-pc os=-msys ;; mvs) @@ -1367,14 +1377,14 @@ case $os in | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \ | -linux-newlib* | -linux-musl* | -linux-uclibc* \ - | -uxpv* | -beos* | -mpeix* | -udk* \ + | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \ | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \ | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \ | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \ | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \ | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \ | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \ - | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*) + | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*) # Remember, each alternative MUST END IN *, to match a version number. ;; -qnx*) @@ -1546,6 +1556,9 @@ case $basic_machine in c4x-* | tic4x-*) os=-coff ;; + c8051-*) + os=-elf + ;; hexagon-*) os=-elf ;; @@ -1589,9 +1602,6 @@ case $basic_machine in mips*-*) os=-elf ;; - or1k-*) - os=-elf - ;; or32-*) os=-coff ;; diff --git a/dirsrvtests/tickets/ticket47462_test.py b/dirsrvtests/tickets/ticket47462_test.py new file mode 100644 index 0000000..a909b37 --- /dev/null +++ b/dirsrvtests/tickets/ticket47462_test.py @@ -0,0 +1,452 @@ +import os +import sys +import time +import ldap +import logging +import socket +import time +import logging +import pytest +import re +from lib389 import DirSrv, Entry, tools +from lib389.tools import DirSrvTools +from lib389._constants import * +from lib389.properties import * +from constants import * +from lib389._constants import * + +logging.getLogger(__name__).setLevel(logging.DEBUG) +log = logging.getLogger(__name__) + +# +# important part. We can deploy Master1 and Master2 on different versions +# +installation1_prefix = None +installation2_prefix = None + +DES_PLUGIN = 'cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config' +AES_PLUGIN = 'cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config' +MMR_PLUGIN = 'cn=Multimaster Replication Plugin,cn=plugins,cn=config' +AGMT_DN = '' +USER_DN = 'cn=test_user,' + DEFAULT_SUFFIX +USER1_DN = 'cn=test_user1,' + DEFAULT_SUFFIX +TEST_REPL_DN = 'cn=test repl,' + DEFAULT_SUFFIX + + +class TopologyMaster1Master2(object): + def __init__(self, master1, master2): + master1.open() + self.master1 = master1 + + master2.open() + self.master2 = master2 + + +(a)pytest.fixture(scope="module") +def topology(request): + ''' + This fixture is used to create a replicated topology for the 'module'. + The replicated topology is MASTER1 <-> Master2. + At the beginning, It may exists a master2 instance and/or a master2 instance. + It may also exists a backup for the master1 and/or the master2. + + Principle: + If master1 instance exists: + restart it + If master2 instance exists: + restart it + If backup of master1 AND backup of master2 exists: + create or rebind to master1 + create or rebind to master2 + + restore master1 from backup + restore master2 from backup + else: + Cleanup everything + remove instances + remove backups + Create instances + Initialize replication + Create backups + ''' + global installation1_prefix + global installation2_prefix + + # allocate master1 on a given deployement + master1 = DirSrv(verbose=False) + if installation1_prefix: + args_instance[SER_DEPLOYED_DIR] = installation1_prefix + + # Args for the master1 instance + args_instance[SER_HOST] = HOST_MASTER_1 + args_instance[SER_PORT] = PORT_MASTER_1 + args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1 + args_master = args_instance.copy() + master1.allocate(args_master) + + # allocate master1 on a given deployement + master2 = DirSrv(verbose=False) + if installation2_prefix: + args_instance[SER_DEPLOYED_DIR] = installation2_prefix + + # Args for the consumer instance + args_instance[SER_HOST] = HOST_MASTER_2 + args_instance[SER_PORT] = PORT_MASTER_2 + args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2 + args_master = args_instance.copy() + master2.allocate(args_master) + + # Get the status of the backups + backup_master1 = master1.checkBackupFS() + backup_master2 = master2.checkBackupFS() + + # Get the status of the instance and restart it if it exists + instance_master1 = master1.exists() + if instance_master1: + master1.stop(timeout=10) + master1.start(timeout=10) + + instance_master2 = master2.exists() + if instance_master2: + master2.stop(timeout=10) + master2.start(timeout=10) + + if backup_master1 and backup_master2: + # The backups exist, assuming they are correct + # we just re-init the instances with them + if not instance_master1: + master1.create() + # Used to retrieve configuration information (dbdir, confdir...) + master1.open() + + if not instance_master2: + master2.create() + # Used to retrieve configuration information (dbdir, confdir...) + master2.open() + + # restore master1 from backup + master1.stop(timeout=10) + master1.restoreFS(backup_master1) + master1.start(timeout=10) + + # restore master2 from backup + master2.stop(timeout=10) + master2.restoreFS(backup_master2) + master2.start(timeout=10) + else: + # We should be here only in two conditions + # - This is the first time a test involve master-consumer + # so we need to create everything + # - Something weird happened (instance/backup destroyed) + # so we discard everything and recreate all + + # Remove all the backups. So even if we have a specific backup file + # (e.g backup_master) we clear all backups that an instance my have created + if backup_master1: + master1.clearBackupFS() + if backup_master2: + master2.clearBackupFS() + + # Remove all the instances + if instance_master1: + master1.delete() + if instance_master2: + master2.delete() + + # Create the instances + master1.create() + master1.open() + master2.create() + master2.open() + + # + # Now prepare the Master-Consumer topology + # + # First Enable replication + master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1) + master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2) + + # Initialize the supplier->consumer + + properties = {RA_NAME: r'meTo_$host:$port', + RA_BINDDN: defaultProperties[REPLICATION_BIND_DN], + RA_BINDPW: defaultProperties[REPLICATION_BIND_PW], + RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD], + RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]} + AGMT_DN = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties) + master1.agreement + if not AGMT_DN: + log.fatal("Fail to create a replica agreement") + sys.exit(1) + + log.debug("%s created" % AGMT_DN) + + properties = {RA_NAME: r'meTo_$host:$port', + RA_BINDDN: defaultProperties[REPLICATION_BIND_DN], + RA_BINDPW: defaultProperties[REPLICATION_BIND_PW], + RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD], + RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]} + master2.agreement.create(suffix=DEFAULT_SUFFIX, host=master1.host, port=master1.port, properties=properties) + + master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2) + master1.waitForReplInit(AGMT_DN) + + # Check replication is working fine + master1.add_s(Entry((TEST_REPL_DN, {'objectclass': "top person".split(), + 'sn': 'test_repl', + 'cn': 'test_repl'}))) + loop = 0 + while loop <= 10: + try: + ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)") + break + except ldap.NO_SUCH_OBJECT: + time.sleep(1) + loop += 1 + if not ent: + log.fatal('Replication is not working!') + assert False + + # Time to create the backups + master1.stop(timeout=10) + master1.backupfile = master1.backupFS() + master1.start(timeout=10) + + master2.stop(timeout=10) + master2.backupfile = master2.backupFS() + master2.start(timeout=10) + + # clear the tmp directory + master1.clearTmpDir(__file__) + + # + # Here we have two instances master and consumer + # with replication working. Either coming from a backup recovery + # or from a fresh (re)init + # Time to return the topology + return TopologyMaster1Master2(master1, master2) + + +def test_ticket47462(topology): + """ + Test that AES properly replaces DES during an update/restart, and that + replication also works correctly. + """ + + # + # First set config as if it's an older version. Set DES to use libdes-plugin, + # MMR to depend on DES, delete the existing AES plugin, and set a DES password + # for the replication agreement. + # + + # + # Add an extra attribute to the DES plugin args + # + try: + topology.master1.modify_s(DES_PLUGIN, + [(ldap.MOD_REPLACE, 'nsslapd-pluginPath', 'libdes-plugin'), + (ldap.MOD_ADD, 'nsslapd-pluginarg2', 'description')]) + + except ldap.LDAPError, e: + log.fatal('Failed to reset DES plugin, error: ' + e.message['desc']) + assert False + + try: + topology.master1.modify_s(MMR_PLUGIN, + [(ldap.MOD_DELETE, 'nsslapd-plugin-depends-on-named', 'AES')]) + + except ldap.NO_SUCH_ATTRIBUTE: + pass + except ldap.LDAPError, e: + log.fatal('Failed to reset DES plugin, error: ' + e.message['desc']) + assert False + + # + # Delete the AES plugin + # + try: + topology.master1.delete_s(AES_PLUGIN) + except ldap.NO_SUCH_OBJECT: + pass + except ldap.LDAPError, e: + log.fatal('Failed to delete AES plugin, error: ' + e.message['desc']) + assert False + + # restart the server so we must use DES plugin + topology.master1.restart(timeout=10) + + # + # Get the agmt dn, and set the password + # + try: + entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'objectclass=nsDS5ReplicationAgreement') + if entry: + agmt_dn = entry[0].dn + log.info('Found agmt dn (%s)' % agmt_dn) + else: + log.fatal('No replication agreements!') + assert False + except ldap.LDAPError, e: + log.fatal('Failed to search for replica credentials: ' + e.message['desc']) + assert False + + try: + properties = {RA_BINDPW: "password"} + topology.master1.agreement.setProperties(None, agmt_dn, None, properties) + log.info('Successfully modified replication agreement') + except ValueError: + log.error('Failed to update replica agreement: ' + AGMT_DN) + assert False + + # + # Check replication works with the new DES password + # + try: + topology.master1.add_s(Entry((USER1_DN, + {'objectclass': "top person".split(), + 'sn': 'sn', + 'cn': 'test_user'}))) + loop = 0 + ent = None + while loop <= 10: + try: + ent = topology.master2.getEntry(USER1_DN, ldap.SCOPE_BASE, "(objectclass=*)") + break + except ldap.NO_SUCH_OBJECT: + time.sleep(1) + loop += 1 + if not ent: + log.fatal('Replication test failed fo user1!') + assert False + else: + log.info('Replication test passed') + except ldap.LDAPError, e: + log.fatal('Failed to add test user: ' + e.message['desc']) + assert False + + # + # Run the upgrade... + # + topology.master1.upgrade('online') + topology.master1.restart(timeout=10) + topology.master2.restart(timeout=10) + + # + # Check that the restart converted existing DES credentials + # + try: + entry = topology.master1.search_s('cn=config', ldap.SCOPE_SUBTREE, 'nsDS5ReplicaCredentials=*') + if entry: + val = entry[0].getValue('nsDS5ReplicaCredentials') + if val.startswith('{AES-'): + log.info('The DES credentials have been converted to AES') + else: + log.fatal('Failed to convert credentials from DES to AES!') + assert False + else: + log.fatal('Failed to find any entries with nsDS5ReplicaCredentials ') + assert False + except ldap.LDAPError, e: + log.fatal('Failed to search for replica credentials: ' + e.message['desc']) + assert False + + # + # Check that the AES plugin exists, and has all the attributes listed in DES plugin. + # The attributes might not be in the expected order so check all the attributes. + # + try: + entry = topology.master1.search_s(AES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*') + if not entry[0].hasValue('nsslapd-pluginarg0', 'description') and \ + not entry[0].hasValue('nsslapd-pluginarg1', 'description') and \ + not entry[0].hasValue('nsslapd-pluginarg2', 'description'): + log.fatal('The AES plugin did not have the DES attribute copied over correctly') + assert False + else: + log.info('The AES plugin was correctly setup') + except ldap.LDAPError, e: + log.fatal('Failed to find AES plugin: ' + e.message['desc']) + assert False + + # + # Check that the MMR plugin was updated + # + try: + entry = topology.master1.search_s(MMR_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*') + if not entry[0].hasValue('nsslapd-plugin-depends-on-named', 'AES'): + log.fatal('The MMR Plugin was not correctly updated') + assert False + else: + log.info('The MMR plugin was correctly updated') + except ldap.LDAPError, e: + log.fatal('Failed to find AES plugin: ' + e.message['desc']) + assert False + + # + # Check that the DES plugin was correctly updated + # + try: + entry = topology.master1.search_s(DES_PLUGIN, ldap.SCOPE_BASE, 'objectclass=*') + if not entry[0].hasValue('nsslapd-pluginPath', 'libpbe-plugin'): + log.fatal('The DES Plugin was not correctly updated') + assert False + else: + log.info('The DES plugin was correctly updated') + except ldap.LDAPError, e: + log.fatal('Failed to find AES plugin: ' + e.message['desc']) + assert False + + # + # Check replication one last time + # + try: + topology.master1.add_s(Entry((USER_DN, + {'objectclass': "top person".split(), + 'sn': 'sn', + 'cn': 'test_user'}))) + loop = 0 + ent = None + while loop <= 10: + try: + ent = topology.master2.getEntry(USER_DN, ldap.SCOPE_BASE, "(objectclass=*)") + break + except ldap.NO_SUCH_OBJECT: + time.sleep(1) + loop += 1 + if not ent: + log.fatal('Replication test failed!') + assert False + else: + log.info('Replication test passed') + except ldap.LDAPError, e: + log.fatal('Failed to add test user: ' + e.message['desc']) + assert False + + # + # If we got here the test passed + # + log.info('Test PASSED') + + +def test_ticket47462_final(topology): + topology.master1.stop(timeout=10) + topology.master2.stop(timeout=10) + + +def run_isolated(): + ''' + run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..) + To run isolated without py.test, you need to + - edit this file and comment '@pytest.fixture' line before 'topology' function. + - set the installation prefix + - run this program + ''' + global installation1_prefix + global installation2_prefix + installation1_prefix = None + installation2_prefix = None + + topo = topology(True) + test_ticket47462(topo) + +if __name__ == '__main__': + run_isolated() diff --git a/ldap/admin/src/scripts/50AES-pbe-plugin.ldif b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif new file mode 100644 index 0000000..564ceae --- /dev/null +++ b/ldap/admin/src/scripts/50AES-pbe-plugin.ldif @@ -0,0 +1,16 @@ +dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config +objectclass: top +objectclass: nsSlapdPlugin +objectclass: extensibleObject +cn: AES +nsslapd-pluginpath: libpbe-plugin +nsslapd-plugininitfunc: aes_init +nsslapd-plugintype: reverpwdstoragescheme +nsslapd-pluginenabled: on +nsslapd-pluginarg0: nsmultiplexorcredentials +nsslapd-pluginarg1: nsds5ReplicaCredentials +nsslapd-pluginprecedence: 1 +nsslapd-pluginid: ID +nsslapd-pluginDescription: DESC +nsslapd-pluginVersion: PACKAGE_VERSION +nsslapd-pluginVendor: VENDOR diff --git a/ldap/admin/src/scripts/52updateAESplugin.pl b/ldap/admin/src/scripts/52updateAESplugin.pl new file mode 100644 index 0000000..6a8a885 --- /dev/null +++ b/ldap/admin/src/scripts/52updateAESplugin.pl @@ -0,0 +1,84 @@ +use Mozilla::LDAP::Conn; +use Mozilla::LDAP::Entry; +use Mozilla::LDAP::Utils qw(normalizeDN); +use Mozilla::LDAP::API qw(:constant ldap_url_parse ldap_explode_dn); +use File::Basename; +use File::Copy; +use DSUtil qw(debug serverIsRunning); + +# +# Check if there is a DES plugin and make sure the AES plugin contains the same attributes +# +sub runinst { + my ($inf, $inst, $dseldif, $conn) = @_; + my @attrs; + my @attrs_to_add; + my $aes_count = 0; + my $des_count = 0; + my $i = 0; + + my $aes_dn = "cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config"; + my $aes_entry = $conn->search($aes_dn, "base", "(cn=*)"); + if (!$aes_entry) { + # No AES plugin - nothing to do + return (); + } + + # We need to grab the AES plugin args... + while(1){ + my $argattr = "nsslapd-pluginarg" . $i; + my $val = $aes_entry->getValues($argattr); + if($val ne ""){ + $attrs[$aes_count] = $val; + $aes_count++; + } else { + last; + } + $i++; + } + + # Grab the DES plugin + my $des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config"; + my $des_entry = $conn->search($des_dn, "base", "(cn=*)"); + if (!$des_entry) { + # No DES plugin - nothing to do + return (); + } + + # We need to check the DES plugin args against the AES args. + $i = 0; + while(1){ + my $argattr = "nsslapd-pluginarg" . $i; + my $val = $des_entry->getValues($argattr); + if($val eq ""){ + last; + } + if(!($val ~~ @attrs) ){ + $attrs_to_add[$des_count] = $val; + $des_count++; + } + $i++; + } + + # Add the missing attributes to the AES plugin + if($#attrs_to_add >= 0){ + foreach $val (@attrs_to_add){ + $aes_entry->addValue("nsslapd-pluginarg" . $aes_count, $val); + $aes_count++; + } + $conn->update($aes_entry); + } + + # Change replication plugin dependency from DES to AES + my $mmr_entry = $conn->search("cn=Multimaster Replication Plugin,cn=plugins,cn=config", "base", "(cn=*)"); + $mmr_entry->removeValue("nsslapd-plugin-depends-on-named", "DES"); + $mmr_entry->addValue("nsslapd-plugin-depends-on-named", "AES"); + $conn->update($mmr_entry); + + # Change the des plugin to use the new libpbe-plugin library + $des_entry->{"nsslapd-pluginPath"} = [ "libpbe-plugin" ]; + $conn->update($des_entry); + + return (); +} + diff --git a/ldap/ldif/50replication-plugins.ldif b/ldap/ldif/50replication-plugins.ldif index 0b4924c..71afbea 100644 --- a/ldap/ldif/50replication-plugins.ldif +++ b/ldap/ldif/50replication-plugins.ldif @@ -22,6 +22,6 @@ nsslapd-plugintype: object nsslapd-pluginbetxn: on nsslapd-pluginenabled: on nsslapd-plugin-depends-on-named: ldbm database -nsslapd-plugin-depends-on-named: DES +nsslapd-plugin-depends-on-named: AES nsslapd-plugin-depends-on-named: Class of Service diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in index 720ebad..6acbfae 100644 --- a/ldap/ldif/template-dse.ldif.in +++ b/ldap/ldif/template-dse.ldif.in @@ -207,12 +207,26 @@ nsslapd-plugininitfunc: ns_mta_md5_pwd_storage_scheme_init nsslapd-plugintype: pwdstoragescheme nsslapd-pluginenabled: on +dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config +objectclass: top +objectclass: nsSlapdPlugin +objectclass: extensibleObject +cn: AES +nsslapd-pluginpath: libpbe-plugin +nsslapd-plugininitfunc: aes_init +nsslapd-plugintype: reverpwdstoragescheme +nsslapd-pluginenabled: on +nsslapd-pluginarg0: nsmultiplexorcredentials +nsslapd-pluginarg1: nsds5ReplicaCredentials +nsslapd-pluginid: aes-storage-scheme +nsslapd-pluginprecedence: 1 + dn: cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config objectclass: top objectclass: nsSlapdPlugin objectclass: extensibleObject cn: DES -nsslapd-pluginpath: libdes-plugin +nsslapd-pluginpath: libpbe-plugin nsslapd-plugininitfunc: des_init nsslapd-plugintype: reverpwdstoragescheme nsslapd-pluginenabled: on diff --git a/ldap/servers/plugins/rever/des.c b/ldap/servers/plugins/rever/des.c deleted file mode 100644 index 73830f0..0000000 --- a/ldap/servers/plugins/rever/des.c +++ /dev/null @@ -1,551 +0,0 @@ -/** BEGIN COPYRIGHT BLOCK - * This Program is free software; you can redistribute it and/or modify it under - * the terms of the GNU General Public License as published by the Free Software - * Foundation; version 2 of the License. - * - * This Program is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License along with - * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple - * Place, Suite 330, Boston, MA 02111-1307 USA. - * - * In addition, as a special exception, Red Hat, Inc. gives You the additional - * right to link the code of this Program with code not covered under the GNU - * General Public License ("Non-GPL Code") and to distribute linked combinations - * including the two, subject to the limitations in this paragraph. Non-GPL Code - * permitted under this exception must only link to the code of this Program - * through those well defined interfaces identified in the file named EXCEPTION - * found in the source code files (the "Approved Interfaces"). The files of - * Non-GPL Code may instantiate templates or use macros or inline functions from - * the Approved Interfaces without causing the resulting work to be covered by - * the GNU General Public License. Only Red Hat, Inc. may make changes or - * additions to the list of Approved Interfaces. You must obey the GNU General - * Public License in all respects for all of the Program code and other code used - * in conjunction with the Program except the Non-GPL Code covered by this - * exception. If you modify this file, you may extend this exception to your - * version of the file, but you are not obligated to do so. If you do not wish to - * provide this exception without modification, you must delete this exception - * statement from your version and license this file solely under the GPL without - * exception. - * - * - * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. - * Copyright (C) 2005 Red Hat, Inc. - * All rights reserved. - * END COPYRIGHT BLOCK **/ - -#ifdef HAVE_CONFIG_H -# include <config.h> -#endif - -/* from /usr/project/iplanet/ws/ds5.ke/ns/svrcore/pkcs7/tstarchive.c */ - -#include <string.h> -#include <stdio.h> - -#include <ldap.h> -#include <nspr.h> -#include <nss.h> -#include <secmod.h> -/* -#include <secasn1.h> -#include <secpkcs7.h> -*/ -#include <key.h> -#include <certdb.h> -#include <cert.h> -#include <svrcore.h> -#include <secmodt.h> -#include <prtypes.h> -#include <seccomon.h> -#include <pk11func.h> - -#define NEED_TOK_DES /* see slap.h - defines tokDes and ptokDes */ -#include "rever.h" -#include <slap.h> -#include "slapi-plugin.h" -#include <uuid.h> - - -struct pk11MechItem -{ - CK_MECHANISM_TYPE type; - const char *mechName; -}; -static const struct pk11MechItem mymech = { CKM_DES_CBC, "DES CBC encryption" }; - - -static Slapi_Mutex *mylock = NULL; - -struct pk11ContextStore -{ - PK11SlotInfo *slot; - const struct pk11MechItem *mech; - - PK11SymKey *key; - SECItem *params; - - int length; - unsigned char *crypt; -}; - -static int encode_path(char *inPlain, char **outCipher, char *path); -static int decode_path(char *inCipher, char **outPlain, char *path); -static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path); -static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out); -static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len); -static void freeDes(struct pk11ContextStore *out); - -void -init_des_plugin() -{ - mylock = slapi_new_mutex(); -} - -int -encode(char *inPlain, char **outCipher) -{ - return encode_path(inPlain, outCipher, NULL); -} - -static int -encode_path(char *inPlain, char **outCipher, char *path) -{ - struct pk11ContextStore *context = NULL; - int err; - - unsigned char *cipher = NULL; - char *tmp = NULL; - char *base = NULL; - - - *outCipher = NULL; - err = 1; - - if ( genKey(&context, tokDes, path) == SVRCORE_Success ) - { - /* Try an encryption */ - if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ) - { - base = BTOA_DataToAscii(cipher, context->length); - if ( base != NULL ) - { - tmp = slapi_ch_malloc( 3 + strlen(REVER_SCHEME_NAME) + strlen(base)); - if ( tmp != NULL ) - { - sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, REVER_SCHEME_NAME, PWD_HASH_PREFIX_END, base); - *outCipher = tmp; - tmp = NULL; - err = 0; - } - PORT_Free(base); - } - } - } - - freeDes(context); - slapi_ch_free((void **) &context); - return(err); -} - -int -decode(char *inCipher, char **outPlain) -{ - return decode_path(inCipher, outPlain, NULL); -} - - -static int -decode_path(char *inCipher, char **outPlain, char *path) -{ - struct pk11ContextStore *context = NULL; - char *plain= NULL; - int err; - - unsigned char *base = NULL; - int len = 0; - - - *outPlain = NULL; - err = 1; - - if ( genKey(&context, tokDes, path) == SVRCORE_Success ) - { - /* it seems that there is memory leak in that function: bug 400170 */ - - base = ATOB_AsciiToData(inCipher, (unsigned int*)&len); - if ( base != NULL ) - { - if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ) - { - *outPlain = plain; - err = 0; - } - } - } - - PORT_Free(base); - freeDes(context); - slapi_ch_free((void **) &context); - return(err); -} - -static void freeDes(struct pk11ContextStore *out) -{ - if (out) - { - if (out->slot) - slapd_pk11_freeSlot(out->slot); - if (out->key) - slapd_pk11_freeSymKey(out->key); - if (out->params) - SECITEM_FreeItem(out->params,PR_TRUE); - if (out->crypt) - free(out->crypt); - } -} - -static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path) -{ - SVRCOREError err = SVRCORE_Success; - struct pk11ContextStore *store = NULL; - SECItem *pwitem = NULL; - SECItem *result = NULL; - SECAlgorithmID *algid = NULL; - SECOidTag algoid; - SECItem *salt = NULL; - CK_MECHANISM pbeMech; - CK_MECHANISM cryptoMech; - - char *configdir = NULL; - char *iv = NULL; - - store = (struct pk11ContextStore*)slapi_ch_malloc(sizeof(*store)); - if (store == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - *out = store; - - /* Low-level init */ - store->slot = NULL; - store->key = NULL; - store->params = NULL; - store->crypt = NULL; - - /* Use the tokenName to find a PKCS11 slot */ - store->slot = slapd_pk11_findSlotByName((char *)token); - if (store->slot == NULL) - { - err = SVRCORE_NoSuchToken_Error; - goto done; - } - - /* Generate a key and parameters to do the encryption */ - store->mech = &mymech; - - /* Generate a unique id, used as salt for the key generation */ - if ( path == NULL ) - { - configdir = config_get_configdir(); - if ( configdir == NULL ) - { - err = SVRCORE_System_Error; - goto done; - } - } - else - { - configdir = slapi_ch_strdup(path); - } - if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ) - { - slapi_ch_free((void**)&configdir); - err = SVRCORE_System_Error; - goto done; - } - slapi_ch_free((void**)&configdir); - - pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem)); - if (pwitem == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - pwitem->type = siBuffer; - pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); - if (pwitem->data == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - strcpy((char*)pwitem->data, iv); - pwitem->len = strlen(iv) + 1; - - algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC; - - salt = (SECItem *) PORT_Alloc(sizeof(SECItem)); - if (salt == NULL) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - salt->type = siBuffer; - salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); - if ( salt->data == NULL ) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - strcpy((char*)salt->data, iv); - salt->len = strlen(iv) + 1; - - algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt); - - slapi_lock_mutex(mylock); - store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0); - if (store->key == 0) - { - slapi_unlock_mutex(mylock); - err = SVRCORE_System_Error; - goto done; - } - - slapi_unlock_mutex(mylock); - pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid); - result = slapd_pk11_paramFromAlgid(algid); - secoid_destroyAlgorithmID(algid, PR_TRUE); - pbeMech.pParameter = result->data; - pbeMech.ulParameterLen = result->len; - if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem, - PR_FALSE) != CKR_OK) - { - SECITEM_FreeItem(result, PR_TRUE); - err = SVRCORE_System_Error; - goto done; - } - SECITEM_FreeItem(result, PR_TRUE); - SECITEM_FreeItem(pwitem, PR_TRUE); - SECITEM_FreeItem(salt, PR_TRUE); - store->params = (SECItem *) PORT_Alloc(sizeof(SECItem)); - if (store->params == NULL) - { - err = SVRCORE_System_Error; - goto done; - } - store->params->type = store->mech->type; - store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen); - if (store->params->data == NULL) - { - err = SVRCORE_System_Error; - goto done; - } - memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen); - store->params->len = cryptoMech.ulParameterLen; - PORT_Free(cryptoMech.pParameter); - -done: - slapi_ch_free((void**)&iv); - return (err); -} - -static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len) -{ - SVRCOREError err = SVRCORE_Success; - unsigned char *plain = NULL; - unsigned char *cipher_with_padding = NULL; - SECStatus rv; - PK11Context *ctx = 0; - int outLen = 0; - int blocksize = 0; - - blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); - store->length = len; - - /* store->length is the max. length of the returned clear text - - must be >= length of crypted bytes - also must be a multiple - of blocksize */ - if (blocksize != 0) - { - store->length += blocksize - (store->length % blocksize); - } - - /* plain will hold the returned clear text */ - plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), - store->length+1); - if (!plain) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - - /* create a buffer holding the original cipher bytes, padded with - zeros to a multiple of blocksize - do not need +1 since buffer is not - a string */ - cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), - store->length); - if (!cipher_with_padding) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - memcpy(cipher_with_padding, cipher, len); - - ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT, - store->key, store->params); - if (!ctx) - { - err = SVRCORE_System_Error; - goto done; - } - - /* warning - there is a purify UMR in the NSS des code - you may see it when the - password is not a multiple of 8 bytes long */ - rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length, - cipher_with_padding, store->length); - if (rv) - { - err = SVRCORE_System_Error; - } - - rv = slapd_pk11_finalize(ctx); - /* we must do the finalize, but we only want to set the err return - code if it is not already set */ - if (rv && (SVRCORE_Success == err)) - err = SVRCORE_System_Error; - -done: - if (err == SVRCORE_Success) - { - *out = (char *)plain; - } - else - { - slapi_ch_free((void **)&plain); - } - - slapi_ch_free((void **)&cipher_with_padding); - /* We should free the PK11Context... Something like : */ - if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE); - - return err; -} - -static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out) -{ - SVRCOREError err = SVRCORE_Success; - SECStatus rv; - PK11Context *ctx = 0; - int outLen = 0; - int blocksize = 0; - unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */ - - blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); - store->length = strlen(clear); - - /* the size of the clear text buffer passed to the des encryption functions - must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer - of this size, copy the clear text password into it, and pad the rest with - zeros */ - if (blocksize != 0) - { - store->length += blocksize - (store->length % blocksize); - } - - /* store->crypt will hold the crypted password - it must be >= clear length */ - /* store->crypt is freed in NSS; let's not use slapi_ch_calloc */ - store->crypt = (unsigned char *)calloc(sizeof(unsigned char), - store->length+1); - if (!store->crypt) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - - /* create a buffer big enough to hold the clear text password and padding */ - clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), - store->length+1); - if (!clear_with_padding) - { - err = SVRCORE_NoMemory_Error; - goto done; - } - /* copy the clear text password into the buffer - the calloc insures the - remainder is zero padded */ - strcpy((char *)clear_with_padding, clear); - - ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT, - store->key, store->params); - if (!ctx) - { - err = SVRCORE_System_Error; - goto done; - } - - rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length, - clear_with_padding, store->length); - if (rv) - { - err = SVRCORE_System_Error; - } - - rv = slapd_pk11_finalize(ctx); - /* we must do the finalize, but we only want to set the err return - code if it is not already set */ - if (rv && (SVRCORE_Success == err)) - err = SVRCORE_System_Error; - -done: - if (err == SVRCORE_Success) - *out = store->crypt; - - slapi_ch_free((void **)&clear_with_padding); - /* We should free the PK11Context... Something like : */ - if (ctx) slapd_pk11_destroyContext(ctx, PR_TRUE); - - return err; -} - -/* - The UUID name based generator was broken on x86 platforms. We use - this to generate the password encryption key. During migration, - we have to fix this so we can use the fixed generator. The env. - var USE_BROKEN_UUID tells the uuid generator to use the old - broken method to create the UUID. That will allow us to decrypt - the password to the correct clear text, then we can turn off - the broken method and use the fixed method to encrypt the - password. -*/ -char * -migrateCredentials(char *oldpath, char *newpath, char *oldcred) -{ - static char *useBrokenUUID = "USE_BROKEN_UUID=1"; - static char *disableBrokenUUID = "USE_BROKEN_UUID=0"; - char *plain = NULL; - char *cipher = NULL; - - init_des_plugin(); - - slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 ); - NSS_NoDB_Init(NULL); - - if (getenv("MIGRATE_BROKEN_PWD")) { - putenv(useBrokenUUID); - } - - if ( decode_path(oldcred, &plain, oldpath) == 0 ) - { - if (getenv("MIGRATE_BROKEN_PWD")) { - putenv(disableBrokenUUID); - } - if ( encode_path(plain, &cipher, newpath) != 0 ) - return(NULL); - else - return(cipher); - } - else - return(NULL); -} diff --git a/ldap/servers/plugins/rever/pbe.c b/ldap/servers/plugins/rever/pbe.c new file mode 100644 index 0000000..abb8d1b --- /dev/null +++ b/ldap/servers/plugins/rever/pbe.c @@ -0,0 +1,621 @@ +/** BEGIN COPYRIGHT BLOCK + * This Program is free software; you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free Software + * Foundation; version 2 of the License. + * + * This Program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along with + * this Program; if not, write to the Free Software Foundation, Inc., 59 Temple + * Place, Suite 330, Boston, MA 02111-1307 USA. + * + * In addition, as a special exception, Red Hat, Inc. gives You the additional + * right to link the code of this Program with code not covered under the GNU + * General Public License ("Non-GPL Code") and to distribute linked combinations + * including the two, subject to the limitations in this paragraph. Non-GPL Code + * permitted under this exception must only link to the code of this Program + * through those well defined interfaces identified in the file named EXCEPTION + * found in the source code files (the "Approved Interfaces"). The files of + * Non-GPL Code may instantiate templates or use macros or inline functions from + * the Approved Interfaces without causing the resulting work to be covered by + * the GNU General Public License. Only Red Hat, Inc. may make changes or + * additions to the list of Approved Interfaces. You must obey the GNU General + * Public License in all respects for all of the Program code and other code used + * in conjunction with the Program except the Non-GPL Code covered by this + * exception. If you modify this file, you may extend this exception to your + * version of the file, but you are not obligated to do so. If you do not wish to + * provide this exception without modification, you must delete this exception + * statement from your version and license this file solely under the GPL without + * exception. + * + * + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. + * Copyright (C) 2015 Red Hat, Inc. + * All rights reserved. + * END COPYRIGHT BLOCK **/ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <string.h> +#include <stdio.h> + +#include <ldap.h> +#include <nspr.h> +#include <nss.h> +#include <secmod.h> +/* +#include <secasn1.h> +#include <secpkcs7.h> +*/ +#include <key.h> +#include <certdb.h> +#include <cert.h> +#include <svrcore.h> +#include <secmodt.h> +#include <prtypes.h> +#include <seccomon.h> +#include <pk11func.h> + +#define NEED_TOK_PBE /* see slap.h - defines tokPBE and ptokPBE */ +#include "rever.h" +#include <slap.h> +#include "slapi-plugin.h" +#include <uuid.h> +#include <plbase64.h> + +struct pk11MechItem +{ + CK_MECHANISM_TYPE type; + const char *mechName; +}; + +static const struct pk11MechItem DESmech = { CKM_DES_CBC, "DES CBC encryption" }; +static const struct pk11MechItem AESmech = { CKM_AES_CBC, "AES CBC encryption" }; +static Slapi_Mutex *pbe_lock = NULL; + +struct pk11ContextStore +{ + PK11SlotInfo *slot; + const struct pk11MechItem *mech; + PK11SymKey *key; + SECItem *params; + int length; + unsigned char *crypt; + char *algid_base64; +}; + +/* + * der_algid converting functions: + * + * SECStatus ATOB_ConvertAsciiToItem(SECItem *binary_item, const char *ascii); + * char * BTOA_ConvertItemToAscii(SECItem *binary_item); + * + */ + +static int encode_path(char *inPlain, char **outCipher, char *path, int mech); +static int decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid); +static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *algid); +static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out); +static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len); +static void freePBE(struct pk11ContextStore *store); + +void +init_pbe_plugin() +{ + if(!pbe_lock){ + pbe_lock = slapi_new_mutex(); + } +} + +int +encode(char *inPlain, char **outCipher, int mech) +{ + return encode_path(inPlain, outCipher, NULL, mech); +} + +static int +encode_path(char *inPlain, char **outCipher, char *path, int mech) +{ + struct pk11ContextStore *context = NULL; + PRArenaPool *arena = NULL; + unsigned char *cipher = NULL; + char *tmp = NULL; + char *base = NULL; + int len = 0; + int err; + + *outCipher = NULL; + err = 1; + + if ( genKey(&context, tokPBE, path, mech, arena, NULL) == SVRCORE_Success ){ + /* Try an encryption */ + if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ){ + base = BTOA_DataToAscii(cipher, context->length); + if ( base != NULL ){ + const char *scheme; + if (mech == AES_MECH){ + scheme = AES_REVER_SCHEME_NAME; + len = 3 + strlen(scheme)+ strlen(context->algid_base64) + strlen(base) + 1; + if( (tmp = slapi_ch_malloc( len )) ){ + /* + * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD> + */ + sprintf( tmp, "%c%s-%s%c%s", PWD_HASH_PREFIX_START, scheme, + context->algid_base64,PWD_HASH_PREFIX_END, base); + } + } else { + /* Old school DES */ + scheme = DES_REVER_SCHEME_NAME; + if((tmp = slapi_ch_malloc( 3 + strlen(scheme) + strlen(base)))){ + sprintf( tmp, "%c%s%c%s", PWD_HASH_PREFIX_START, scheme, + PWD_HASH_PREFIX_END, base); + } + } + if ( tmp != NULL ){ + *outCipher = tmp; + tmp = NULL; + err = 0; + } + PORT_Free(base); + } + } + } + freePBE(context); + + return(err); +} + +int +decode(char *inCipher, char **outPlain, int mech, char *algid) +{ + return decode_path(inCipher, outPlain, NULL, mech, algid); +} + + +static int +decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid) +{ + struct pk11ContextStore *context = NULL; + PRArenaPool *arena = NULL; + unsigned char *base = NULL; + char *plain = NULL; + int err; + int len = 0; + + *outPlain = NULL; + err = 1; + + if ( genKey(&context, tokPBE, path, mech, arena, algid) == SVRCORE_Success ){ + /* it seems that there is memory leak in that function: bug 400170 */ + base = ATOB_AsciiToData(inCipher, (unsigned int*)&len); + if ( base != NULL ){ + if ( decryptPassword(context, base, &plain, len) == SVRCORE_Success ){ + *outPlain = plain; + err = 0; + } + } + } + + slapi_ch_free_string(&algid); + PORT_Free(base); + PORT_FreeArena(arena, PR_TRUE); + freePBE(context); + + return(err); +} + +static void +freePBE(struct pk11ContextStore *store) +{ + if (store){ + if (store->slot) + slapd_pk11_freeSlot(store->slot); + if (store->key) + slapd_pk11_freeSymKey(store->key); + if (store->params) + SECITEM_FreeItem(store->params, PR_TRUE); + slapi_ch_free((void **)&store->crypt); + slapi_ch_free_string(&store->algid_base64); + slapi_ch_free((void **)&store); + } +} + +static SVRCOREError +genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *alg) +{ + SVRCOREError err = SVRCORE_Success; + struct pk11ContextStore *store = NULL; + SECItem *pwitem = NULL; + SECItem *result = NULL; + SECItem *salt = NULL; + SECItem der_algid; + SECAlgorithmID *algid = NULL; + SECOidTag algoid; + CK_MECHANISM pbeMech; + CK_MECHANISM cryptoMech; + SECAlgorithmID my_algid; + char *configdir = NULL; + char *der_ascii = NULL; + char *iv = NULL; + int free_it = 0; + + arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + + store = (struct pk11ContextStore*)slapi_ch_calloc(1, sizeof(*store)); + if (store == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + *out = store; + + /* Use the tokenName to find a PKCS11 slot */ + store->slot = slapd_pk11_findSlotByName((char *)token); + if (store->slot == NULL){ + err = SVRCORE_NoSuchToken_Error; + goto done; + } + + /* Generate a key and parameters to do the encryption */ + if(mech == AES_MECH){ + store->mech = &AESmech; + algoid = SEC_OID_AES_256_CBC; + } else { + store->mech = &DESmech; + algoid = SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC; + } + + /* Generate a unique id, used as salt for the key generation */ + if ( path == NULL ){ + configdir = config_get_configdir(); + if ( configdir == NULL ){ + err = SVRCORE_System_Error; + goto done; + } + } else { + configdir = slapi_ch_strdup(path); + } + if ( slapi_uniqueIDGenerateFromNameString (&iv, NULL, configdir, strlen(configdir)) != UID_SUCCESS ){ + err = SVRCORE_System_Error; + goto done; + } + + pwitem = (SECItem *) PORT_Alloc(sizeof(SECItem)); + if (pwitem == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + pwitem->type = siBuffer; + pwitem->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); + if (pwitem->data == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + strcpy((char*)pwitem->data, iv); + pwitem->len = strlen(iv) + 1; + + salt = (SECItem *) PORT_Alloc(sizeof(SECItem)); + if (salt == NULL){ + err = SVRCORE_NoMemory_Error; + goto done; + } + salt->type = siBuffer; + salt->data = (unsigned char *)PORT_Alloc(strlen(iv)+1); + if ( salt->data == NULL ){ + err = SVRCORE_NoMemory_Error; + goto done; + } + strcpy((char*)salt->data, iv); + salt->len = strlen(iv) + 1; + + PORT_Memset(&der_algid, 0, sizeof(der_algid)); + if(!alg){ + /* + * This is DES, or we are encoding AES - the process is the same. + */ + algid = slapd_pk11_createPBEAlgorithmID(algoid, 2, salt); + free_it = 1; /* we need to free this algid */ + + /* + * The following is only need for AES - we need to store + * algid for future decodings(unlike with DES). So convert + * algid to its DER encoding. Then convert the DER to ascii, + * and finally convert the DER ascii to base64 so we can store + * it in the cipher prefix. + */ + SEC_ASN1EncodeItem(arena, &der_algid, algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate)); + der_ascii = BTOA_ConvertItemToAscii(&der_algid); + store->algid_base64 = PL_Base64Encode(der_ascii,strlen(der_ascii), NULL); + slapi_ch_free_string(&der_ascii); + } else { + /* + * We are decoding AES - use the supplied algid + */ + PORT_Memset(&my_algid, 0, sizeof(my_algid)); + + /* Decode the base64 der encoding */ + der_ascii = PL_Base64Decode(alg, strlen(alg), NULL); + + /* convert the der ascii to the SEC item */ + ATOB_ConvertAsciiToItem(&der_algid, der_ascii); + SEC_ASN1DecodeItem(arena, &my_algid, SEC_ASN1_GET(SECOID_AlgorithmIDTemplate), &der_algid); + SECITEM_FreeItem(&der_algid, PR_FALSE); + algid = &my_algid; + slapi_ch_free_string(&der_ascii); + } + + slapi_lock_mutex(pbe_lock); + store->key = slapd_pk11_pbeKeyGen(store->slot, algid, pwitem, 0, 0); + if (store->key == 0){ + slapi_unlock_mutex(pbe_lock); + err = SVRCORE_System_Error; + goto done; + } + + slapi_unlock_mutex(pbe_lock); + + if(mech == AES_MECH) + { + cryptoMech.mechanism = PK11_GetPBECryptoMechanism(algid, &store->params, pwitem); + if (cryptoMech.mechanism == CKM_INVALID_MECHANISM) { + err = SVRCORE_System_Error; + goto done; + } + } + else + { + /* DES */ + pbeMech.mechanism = slapd_pk11_algtagToMechanism(algoid); + result = slapd_pk11_paramFromAlgid(algid); + if(result){ + pbeMech.pParameter = result->data; + pbeMech.ulParameterLen = result->len; + } + if(slapd_pk11_mapPBEMechanismToCryptoMechanism(&pbeMech, &cryptoMech, pwitem, + PR_FALSE) != CKR_OK){ + err = SVRCORE_System_Error; + goto done; + } + + store->params = (SECItem *) PORT_Alloc(sizeof(SECItem)); + if (store->params == NULL){ + err = SVRCORE_System_Error; + goto done; + } + store->params->type = store->mech->type; + store->params->data = (unsigned char *)PORT_Alloc(cryptoMech.ulParameterLen); + if (store->params->data == NULL){ + err = SVRCORE_System_Error; + goto done; + } + memcpy(store->params->data, (unsigned char *)cryptoMech.pParameter, cryptoMech.ulParameterLen); + store->params->len = cryptoMech.ulParameterLen; + PORT_Free(cryptoMech.pParameter); + } + +done: + SECITEM_FreeItem(result, PR_TRUE); + SECITEM_FreeItem(pwitem, PR_TRUE); + SECITEM_FreeItem(salt, PR_TRUE); + if(free_it){ + secoid_destroyAlgorithmID(algid, PR_TRUE); + } + slapi_ch_free_string(&configdir); + slapi_ch_free_string(&iv); + if (arena) { + PORT_FreeArena(arena, PR_TRUE); + } + return (err); +} + +static SVRCOREError +decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len) +{ + SVRCOREError err = SVRCORE_Success; + unsigned char *plain = NULL; + unsigned char *cipher_with_padding = NULL; + SECStatus rv; + PK11Context *ctx = NULL; + int outLen = 0; + int blocksize = 0; + + blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); + store->length = len; + + /* + * store->length is the max. length of the returned clear text - + * must be >= length of crypted bytes - also must be a multiple + * of blocksize + */ + if (blocksize != 0){ + store->length += blocksize - (store->length % blocksize); + } + + /* plain will hold the returned clear text */ + plain = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), + store->length+1); + if (!plain){ + err = SVRCORE_NoMemory_Error; + goto done; + } + + /* + * create a buffer holding the original cipher bytes, padded with + * zeros to a multiple of blocksize - do not need +1 since buffer is not + * a string + */ + cipher_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), + store->length); + if (!cipher_with_padding){ + err = SVRCORE_NoMemory_Error; + goto done; + } + memcpy(cipher_with_padding, cipher, len); + + ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_DECRYPT, + store->key, store->params); + if (!ctx) { + err = SVRCORE_System_Error; + goto done; + } + + /* + * Warning - there is a purify UMR in the NSS des code - you may see it when the + * password is not a multiple of 8 bytes long + */ + rv = slapd_pk11_cipherOp(ctx, plain, &outLen, store->length, + cipher_with_padding, store->length); + if (rv){ + err = SVRCORE_System_Error; + } + + rv = slapd_pk11_finalize(ctx); + /* + * We must do the finalize, but we only want to set the err return + * code if it is not already set + */ + if (rv && (SVRCORE_Success == err)) + err = SVRCORE_System_Error; + +done: + if (err == SVRCORE_Success){ + *out = (char *)plain; + } else { + slapi_ch_free((void **)&plain); + } + + slapi_ch_free((void **)&cipher_with_padding); + /* We should free the PK11Context... Something like : */ + if (ctx){ + slapd_pk11_destroyContext(ctx, PR_TRUE); + } + + return err; +} + +static SVRCOREError +cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out) +{ + SVRCOREError err = SVRCORE_Success; + SECStatus rv; + PK11Context *ctx = NULL; + unsigned char *clear_with_padding = NULL; /* clear with padding up to blocksize */ + int blocksize = 0; + int outLen = 0; + + blocksize = slapd_pk11_getBlockSize(store->mech->type, 0); + store->length = strlen(clear); + + /* + * The size of the clear text buffer passed to the encryption functions + * must be a multiple of blocksize (usually 8 bytes) - we allocate a buffer + * of this size, copy the clear text password into it, and pad the rest with + * zeros. + */ + if (blocksize != 0){ + store->length += blocksize - (store->length % blocksize); + } + + /* + * store->crypt will hold the crypted password - it must be >= clear length + * store->crypt is freed in NSS; let's not use slapi_ch_calloc + */ + store->crypt = (unsigned char *)calloc(sizeof(unsigned char), + store->length+1); + if (!store->crypt) { + err = SVRCORE_NoMemory_Error; + goto done; + } + + /* Create a buffer big enough to hold the clear text password and padding */ + clear_with_padding = (unsigned char *)slapi_ch_calloc(sizeof(unsigned char), + store->length+1); + if (!clear_with_padding){ + err = SVRCORE_NoMemory_Error; + goto done; + } + /* + * Copy the clear text password into the buffer - the calloc insures the + * remainder is zero padded . + */ + strcpy((char *)clear_with_padding, clear); + + ctx = slapd_pk11_createContextBySymKey(store->mech->type, CKA_ENCRYPT, + store->key, store->params); + if (!ctx) { + err = SVRCORE_System_Error; + goto done; + } + + rv = slapd_pk11_cipherOp(ctx, store->crypt, &outLen, store->length, + clear_with_padding, store->length); + if (rv) { + err = SVRCORE_System_Error; + } + + rv = slapd_pk11_finalize(ctx); + /* + * We must do the finalize, but we only want to set the err return + * code if it is not already set + */ + if (rv && (SVRCORE_Success == err)){ + err = SVRCORE_System_Error; + } + +done: + if (err == SVRCORE_Success){ + *out = store->crypt; + } + + slapi_ch_free((void **)&clear_with_padding); + /* We should free the PK11Context... Something like : */ + if (ctx){ + slapd_pk11_destroyContext(ctx, PR_TRUE); + } + + return err; +} + +/* + * The UUID name based generator was broken on x86 platforms. We use + * this to generate the password encryption key. During migration, + * we have to fix this so we can use the fixed generator. The env. + * var USE_BROKEN_UUID tells the uuid generator to use the old + * broken method to create the UUID. That will allow us to decrypt + * the password to the correct clear text, then we can turn off + * the broken method and use the fixed method to encrypt the + * password. + */ +char * +migrateCredentials(char *oldpath, char *newpath, char *oldcred) +{ + static char *useBrokenUUID = "USE_BROKEN_UUID=1"; + static char *disableBrokenUUID = "USE_BROKEN_UUID=0"; + char *plain = NULL; + char *cipher = NULL; + + init_pbe_plugin(); + + slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 ); + NSS_NoDB_Init(NULL); + + if (getenv("MIGRATE_BROKEN_PWD")) { + putenv(useBrokenUUID); + } + + if ( decode_path(oldcred, &plain, oldpath, DES_MECH, NULL) == 0 ){ + if (getenv("MIGRATE_BROKEN_PWD")) { + putenv(disableBrokenUUID); + } + if ( encode_path(plain, &cipher, newpath, AES_MECH) != 0 ){ + return(NULL); + } else { + return(cipher); + } + } else { + return(NULL); + } +} diff --git a/ldap/servers/plugins/rever/rever.c b/ldap/servers/plugins/rever/rever.c index 9d7e82d..51d602f 100644 --- a/ldap/servers/plugins/rever/rever.c +++ b/ldap/servers/plugins/rever/rever.c @@ -43,25 +43,92 @@ #include <stdio.h> #include <string.h> #include <sys/types.h> - #include "rever.h" -static Slapi_PluginDesc pdesc = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" }; +static Slapi_PluginDesc pdesc_aes = { "aes-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "AES storage scheme plugin" }; +static Slapi_PluginDesc pdesc_des = { "des-storage-scheme", VENDOR, DS_PACKAGE_VERSION, "DES storage scheme plugin" }; + static char *plugin_name = "ReverStoragePlugin"; +#define AES_MECH 1 +#define DES_MECH 2 + +int +aes_cmp( char *userpwd, char *dbpwd ) +{ + char *cipher = NULL; + int rc = 0; + + if ( encode(userpwd, &cipher, AES_MECH) != 0 ){ + rc = 1; + } else { + rc = strcmp(cipher, dbpwd); + } + slapi_ch_free_string(&cipher); + + return rc; +} + +char * +aes_enc( char *pwd ) +{ + char *cipher = NULL; + + if ( encode(pwd, &cipher, AES_MECH) != 0 ){ + return(NULL); + } else { + return( cipher ); + } +} + +char * +aes_dec( char *pwd, char *alg ) +{ + char *plain = NULL; + + if ( decode(pwd, &plain, AES_MECH, alg) != 0 ){ + return(NULL); + } else { + return( plain ); + } +} + +int +aes_init( Slapi_PBlock *pb) +{ + char *name = slapi_ch_strdup(AES_REVER_SCHEME_NAME); + int rc; + + slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> aes_init\n" ); + + rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_aes ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) aes_enc); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) aes_cmp ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) aes_dec ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name ); + + init_pbe_plugin(); + + slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= aes_init %d\n", rc ); + + return( rc ); +} + int des_cmp( char *userpwd, char *dbpwd ) { char *cipher = NULL; int rc = 0; - if ( encode(userpwd, &cipher) != 0 ) + if ( encode(userpwd, &cipher, DES_MECH) != 0 ){ rc = 1; - else + } else { rc = strcmp(cipher, dbpwd); + } + slapi_ch_free_string(&cipher); - slapi_ch_free((void**)&cipher); return rc; } @@ -70,10 +137,11 @@ des_enc( char *pwd ) { char *cipher = NULL; - if ( encode(pwd, &cipher) != 0 ) + if ( encode(pwd, &cipher, DES_MECH ) != 0 ){ return(NULL); - else + } else { return( cipher ); + } } char * @@ -81,37 +149,31 @@ des_dec( char *pwd ) { char *plain = NULL; - if ( decode(pwd, &plain) != 0 ) + if ( decode(pwd, &plain, DES_MECH, NULL) != 0 ){ return(NULL); - else + } else { return( plain ); + } } int des_init( Slapi_PBlock *pb ) { + char *name = slapi_ch_strdup(DES_REVER_SCHEME_NAME); int rc; - char *name; slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "=> des_init\n" ); - rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, - (void *) SLAPI_PLUGIN_VERSION_01 ); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, - (void *)&pdesc ); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, - (void *) des_enc); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, - (void *) des_cmp ); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, - (void *) des_dec ); - name = slapi_ch_strdup(REVER_SCHEME_NAME); - rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, - name ); - - init_des_plugin(); - - slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n\n", rc ); + rc = slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, (void *) SLAPI_PLUGIN_VERSION_01 ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc_des ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_ENC_FN, (void *) des_enc); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_CMP_FN, (void *) des_cmp ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_DEC_FN, (void *) des_dec ); + rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_PWD_STORAGE_SCHEME_NAME, name ); + + init_pbe_plugin(); + + slapi_log_error( SLAPI_LOG_PLUGIN, plugin_name, "<= des_init %d\n", rc ); return( rc ); } diff --git a/ldap/servers/plugins/rever/rever.h b/ldap/servers/plugins/rever/rever.h index 8ea6279..9edddd8 100644 --- a/ldap/servers/plugins/rever/rever.h +++ b/ldap/servers/plugins/rever/rever.h @@ -49,7 +49,10 @@ #include "slap.h" #include "ldaplog.h" -#define REVER_SCHEME_NAME "DES" +#define AES_MECH 1 +#define DES_MECH 2 +#define AES_REVER_SCHEME_NAME "AES" +#define DES_REVER_SCHEME_NAME "DES" #define PWD_HASH_PREFIX_START '{' #define PWD_HASH_PREFIX_END '}' @@ -58,10 +61,10 @@ int rever_cmp( char *userpwd, char *dbpwd ); char *rever_enc( char *pwd ); char *rever_dec( char *pwd ); int rever_init( Slapi_PBlock *pb ); -void init_des_plugin(); +void init_pbe_plugin(); -int encode(char *inPlain, char ** outCipher); -int decode(char *inCipher, char **outPlain); +int encode(char *inPlain, char **outCipher, int mech); +int decode(char *inCipher, char **outPlain, int mech, char *algid); char *migrateCredentials(char *oldpath, char *newpath, char *oldcred); typedef char *(*migrate_fn_type)(char *, char *, char *); diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index 0c11238..3cb8451 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -937,6 +937,244 @@ handle_listeners(Connection_Table *ct, listener_info *listener_idxs, int n_liste return; } +/* + * Convert any pre-existing DES passwords to AES. + * + * Grab the "password" attributes and search all the backends for + * these attributes and convert them to AES if they are DES encoded. + */ +static void +convert_pbe_des_to_aes() +{ + Slapi_PBlock *pb = NULL; + Slapi_Entry **entries = NULL; + struct slapdplugin *plugin = NULL; + char **attrs = NULL; + char **backends = NULL; + char *val = NULL; + int converted_des = 0; + int result = -1; + int have_aes = 0; + int have_des = 0; + int i = 0, ii = 0, be_idx = 0; + + /* + * Check that AES plugin is enabled, and grab all the unique + * password attributes. + */ + for ( plugin = get_plugin_list(PLUGIN_LIST_REVER_PWD_STORAGE_SCHEME); + plugin != NULL; + plugin = plugin->plg_next ) + { + char *arg = NULL; + + if(plugin->plg_started && strcasecmp(plugin->plg_name, "AES") == 0){ + /* We have the AES plugin, and its enabled */ + have_aes = 1; + } + if(plugin->plg_started && strcasecmp(plugin->plg_name, "DES") == 0){ + /* We have the DES plugin, and its enabled */ + have_des = 1; + } + /* Gather all the unique password attributes from all the PBE plugins */ + for ( i = 0, arg = plugin->plg_argv[i]; + i < plugin->plg_argc; + arg = plugin->plg_argv[++i] ) + { + if(charray_inlist(attrs, arg)){ + continue; + } + charray_add(&attrs, slapi_ch_strdup(arg)); + } + } + + if(have_aes && have_des){ + /* + * Build a list of all the backend dn's + */ + Slapi_Backend *be = NULL; + struct suffixlist *list; + char *cookie = NULL; + + LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: " + "Converting DES passwords to AES...\n",0,0,0); + + be = slapi_get_first_backend(&cookie); + while (be){ + int suffix_idx = 0; + int count = slapi_counter_get_value(be->be_suffixcounter); + + list = be->be_suffixlist; + for (suffix_idx = 0; list && suffix_idx < count; suffix_idx++) { + char *suffix = (char *)slapi_sdn_get_ndn(list->be_suffix); + if(charray_inlist(backends, suffix) || strlen(suffix) == 0){ + list = list->next; + continue; + } + charray_add(&backends, slapi_ch_strdup(suffix)); + list = list->next; + } + be = slapi_get_next_backend (cookie); + } + slapi_ch_free ((void **)&cookie); + + /* + * Search for the password attributes + */ + for (i = 0; attrs && attrs[i]; i++){ + char *filter = PR_smprintf("%s=*", attrs[i]); + /* + * Loop over all the backends looking for the password attribute + */ + for(be_idx = 0; backends[be_idx]; be_idx++){ + pb = slapi_pblock_new(); + slapi_search_internal_set_pb(pb, backends[be_idx], + LDAP_SCOPE_SUBTREE, filter, NULL, 0, NULL, NULL, + (void *)plugin_get_default_component_id(), + SLAPI_OP_FLAG_IGNORE_UNINDEXED); + slapi_search_internal_pb(pb); + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if (LDAP_SUCCESS != result) { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to search for password on (%s) error (%d)\n", + backends[be_idx], result, 0); + goto done; + } + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &entries); + for (ii = 0; entries && entries[ii]; ii++){ + if((val = slapi_entry_attr_get_charptr(entries[ii], attrs[i]))){ + if(strlen(val) >= 5 && strncmp(val,"{DES}", 5) == 0){ + /* + * We have a DES encoded password, convert it AES + */ + Slapi_PBlock *mod_pb = NULL; + Slapi_Value *sval = NULL; + LDAPMod mod_replace; + LDAPMod *mods[2]; + char *replace_val[2]; + char *passwd = NULL; + + /* decode the DES password */ + if(pw_rever_decode(val, &passwd, attrs[i]) == -1){ + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to decode existing DES password for (%s)\n", + slapi_entry_get_dn(entries[ii]), 0, 0); + converted_des = 0; + goto done; + } + + /* encode the password */ + sval = slapi_value_new_string(passwd); + if(pw_rever_encode(&sval, attrs[i]) == -1){ + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to encode AES password for (%s)\n", + slapi_entry_get_dn(entries[ii]), 0, 0); + slapi_ch_free_string(&passwd); + slapi_value_free(&sval); + converted_des = 0; + goto done; + } + + /* replace the attribute in the entry */ + replace_val[0] = (char *)slapi_value_get_string(sval); + replace_val[1] = NULL; + mod_replace.mod_op = LDAP_MOD_REPLACE; + mod_replace.mod_type = attrs[i]; + mod_replace.mod_values = replace_val; + mods[0] = &mod_replace; + mods[1] = 0; + + mod_pb = slapi_pblock_new(); + slapi_modify_internal_set_pb(mod_pb, slapi_entry_get_dn(entries[ii]), + mods, 0, 0, (void *)plugin_get_default_component_id(), 0); + slapi_modify_internal_pb(mod_pb); + + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if (LDAP_SUCCESS != result) { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "failed to convert password for (%s) error (%d)\n", + slapi_entry_get_dn(entries[ii]), result, 0); + converted_des = -1; + } else { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "successfully converted password for (%s)\n", + slapi_entry_get_dn(entries[ii]), result, 0); + converted_des = 1; + + } + slapi_ch_free_string(&passwd); + slapi_value_free(&sval); + slapi_pblock_destroy(mod_pb); + if(result){ + goto done; + } + } + slapi_ch_free_string(&val); + } + } + slapi_free_search_results_internal(pb); + slapi_pblock_destroy(pb); + pb = NULL; + } + slapi_ch_free_string(&filter); + } + } + +done: + charray_free(attrs); + charray_free(backends); + slapi_free_search_results_internal(pb); + slapi_pblock_destroy(pb); + + if (have_aes && have_des){ + /* + * If a conversion attempt did not fail, disable DES plugin + */ + if(converted_des != -1){ + /* + * Disable the DES plugin - this also prevents potentially expensive + * searches at every server startup. + */ + LDAPMod mod_replace; + LDAPMod *mods[2]; + char *replace_val[2]; + char *des_dn = "cn=DES,cn=Password Storage Schemes,cn=plugins,cn=config"; + + replace_val[0] = "off"; + replace_val[1] = NULL; + mod_replace.mod_op = LDAP_MOD_REPLACE; + mod_replace.mod_type = "nsslapd-pluginEnabled"; + mod_replace.mod_values = replace_val; + mods[0] = &mod_replace; + mods[1] = 0; + + pb = slapi_pblock_new(); + slapi_modify_internal_set_pb(pb, des_dn, mods, 0, 0, + (void *)plugin_get_default_component_id(), 0); + slapi_modify_internal_pb(pb); + slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result); + if (LDAP_SUCCESS != result) { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "Failed to disable DES plugin (%s), error (%d)\n", + des_dn, result, 0); + } else { + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "Successfully disabled DES plugin (%s)\n", + des_dn, 0, 0); + } + slapi_pblock_destroy(pb); + } + if(converted_des == 1){ + LDAPDebug(LDAP_DEBUG_ANY,"convert_pbe_des_to_aes: " + "Finished - all DES passwords have been converted to AES.\n", + 0, 0, 0); + } else if (converted_des == 0){ + LDAPDebug(LDAP_DEBUG_ANY, "convert_pbe_des_to_aes: " + "Finished - no DES passwords to convert.\n",0,0,0); + } + } +} + void slapd_daemon( daemon_ports_t *ports ) { /* We are passed some ports---one for regular connections, one @@ -1140,7 +1378,6 @@ void slapd_daemon( daemon_ports_t *ports ) } #endif /* ENABLE_LDAPI */ #endif - listener_idxs = (listener_info *)slapi_ch_calloc(n_listeners, sizeof(*listener_idxs)); /* Now we write the pid file, indicating that the server is finally and listening for connections */ write_pid_file(); @@ -1148,6 +1385,11 @@ void slapd_daemon( daemon_ports_t *ports ) /* The server is ready and listening for connections. Logging "slapd started" message. */ unfurl_banners(the_connection_table,ports,n_tcps,s_tcps,i_unix); + /* + * Convert old DES encoded passwords to AES + */ + convert_pbe_des_to_aes(); + /* The meat of the operation is in a loop on a call to select */ while(!g_get_shutdown()) { diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 48188ed..35b45e3 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -1123,6 +1123,7 @@ void slapd_pk11_DestroyPublicKey(SECKEYPublicKey *key); PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type); PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm); PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx); +CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem); /* * start_tls_extop.c diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c index 082f69a..43a11c7 100644 --- a/ldap/servers/slapd/pw.c +++ b/ldap/servers/slapd/pw.c @@ -384,9 +384,8 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals ) if ((!enc) && (( enc = (*pws_enc)( (char*)slapi_value_get_string(vals[ i ]) )) == NULL )) { return( -1 ); } - - slapi_value_free(&vals[ i ]); - vals[ i ] = slapi_value_new_string_passin(enc); + slapi_value_free(&vals[ i ]); + vals[ i ] = slapi_value_new_string_passin(enc); } return( 0 ); @@ -396,28 +395,57 @@ pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals ) * Check if the prefix of the cipher is the one that is supposed to be * Extract from the whole cipher the encrypted password (remove the prefix) */ -int checkPrefix(char *cipher, char *schemaName, char **encrypt) +int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid) { int namelen; /* buf contains the extracted schema name */ char *end, buf[ 3*PWD_MAX_NAME_LEN + 1 ]; + char *delim = NULL; if ( (*cipher == PWD_HASH_PREFIX_START) && - ((end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) && - ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)) ) + (end = strchr(cipher, PWD_HASH_PREFIX_END)) != NULL) { - memcpy( buf, cipher + 1, namelen ); - buf[ namelen ] = '\0'; - if ( strcasecmp( buf, schemaName) != 0 ) - { - /* schema names are different, error */ - return 1; - } - else - { - /* extract the encrypted password */ - *encrypt = cipher + strlen(schemaName) + 2; - return 0; + if((delim = strchr(cipher, PWD_PBE_DELIM)) != NULL){ + /* + * We have an algid in the prefix: + * + * {AES-<BASE64_ALG_ID>}<ENCODED PASSWORD> + */ + if((namelen = delim - cipher - 1) <= (3*PWD_MAX_NAME_LEN)){ + memcpy( buf, cipher + 1, namelen ); + buf[ namelen ] = '\0'; + + if ( strcasecmp( buf, schemaName) != 0 ){ + /* schema names are different, error */ + return 1; + } else { + char algid_buf[256]; + + /* extract the algid (length is never greater than 216 */ + memcpy(algid_buf, delim + 1 , (end - delim)); + algid_buf[end - delim - 1] = '\0'; + *algid = strdup(algid_buf); + + /* extract the encrypted password */ + *encrypt = cipher + strlen(*algid) + strlen (schemaName) + 3; + return 0; + } + } + } else if ((namelen = end - cipher - 1 ) <= (3*PWD_MAX_NAME_LEN)){ + /* no delimiter - must be old school DES */ + memcpy( buf, cipher + 1, namelen ); + buf[ namelen ] = '\0'; + if ( strcasecmp( buf, schemaName) != 0 ) + { + /* schema names are different, error */ + return 1; + } + else + { + /* extract the encrypted password */ + *encrypt = cipher + strlen(schemaName) + 2; + return 0; + } } } /* cipher is not prefixed, already in clear ? */ @@ -443,6 +471,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) char *L_attr = NULL; int i = 0; char *encrypt = NULL; + char *algid = NULL; int prefixOK = -1; /* Get the appropriate decoding function */ @@ -450,10 +479,9 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) { if (slapi_attr_types_equivalent(L_attr, attr_name)) { - typedef char * (*ENCFP)(char *); + typedef char * (*ENCFP)(char *, char *); pwsp = (struct pw_scheme *) slapi_ch_calloc (1, sizeof(struct pw_scheme)); - pwsp->pws_dec = (ENCFP)p->plg_pwdstorageschemedec; pwsp->pws_name = slapi_ch_strdup( p->plg_pwdstorageschemename ); pwsp->pws_len = strlen(pwsp->pws_name) ; @@ -461,7 +489,7 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) { /* check that the prefix of the cipher is the same name as the scheme name */ - prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt); + prefixOK = checkPrefix(cipher, pwsp->pws_name, &encrypt, &algid); if ( prefixOK == -1 ) { /* no prefix, already in clear ? */ @@ -471,13 +499,15 @@ pw_rever_decode(char *cipher, char **plain, const char * attr_name) } else if ( prefixOK == 1 ) { - /* scheme names are different */ + /* scheme names are different, try the next plugin */ ret_code = -1; - goto free_and_return; + free_pw_scheme( pwsp ); + pwsp = NULL; + continue; } else { - if ( ( *plain = (pwsp->pws_dec)( encrypt )) == NULL ) + if ( ( *plain = (pwsp->pws_dec)( encrypt, algid )) == NULL ) { /* pb during decoding */ ret_code = -1; @@ -536,11 +566,13 @@ pw_rever_encode(Slapi_Value **vals, char * attr_name) for ( i = 0; vals[i] != NULL; ++i ) { char *encrypt = NULL; + char *algid = NULL; int prefixOK; prefixOK = checkPrefix((char*)slapi_value_get_string(vals[i]), pwsp->pws_name, - &encrypt); + &encrypt, &algid); + slapi_ch_free_string(&algid); if ( prefixOK == 0 ) { /* Don't touch already encoded value */ diff --git a/ldap/servers/slapd/pw.h b/ldap/servers/slapd/pw.h index 7190a1d..79a90a0 100644 --- a/ldap/servers/slapd/pw.h +++ b/ldap/servers/slapd/pw.h @@ -61,7 +61,7 @@ struct pw_scheme *pw_name2scheme( char *name ); struct pw_scheme *pw_val2scheme( char *val, char **valpwdp, int first_is_default ); int pw_encodevals( Slapi_Value **vals ); int pw_encodevals_ext( Slapi_PBlock *pb, const Slapi_DN *sdn, Slapi_Value **vals ); -int checkPrefix(char *cipher, char *schemaName, char **encrypt); +int checkPrefix(char *cipher, char *schemaName, char **encrypt, char **algid); struct passwordpolicyarray *new_passwdPolicy ( Slapi_PBlock *pb, const char *dn ); void delete_passwdPolicy( struct passwordpolicyarray **pwpolicy); diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c index 2198337..544a9c7 100644 --- a/ldap/servers/slapd/result.c +++ b/ldap/servers/slapd/result.c @@ -2083,7 +2083,8 @@ log_result( Slapi_PBlock *pb, Operation *op, int err, ber_tag_t tag, int nentrie slapi_pblock_get( pb, SLAPI_OPERATION_TYPE, &optype ); if(optype == SLAPI_OPERATION_SEARCH && /* search, */ strcmp(notes_str,"") && /* that's unindexed, */ - !(config_get_accesslog_level() & LDAP_DEBUG_ARGS)) /* and not logged in access log */ + !(config_get_accesslog_level() & LDAP_DEBUG_ARGS) && /* and not logged in access log */ + !(op->o_flags & SLAPI_OP_FLAG_IGNORE_UNINDEXED) ) /* and not ignoring unindexed search */ { struct slapdplugin *plugin = NULL; struct slapi_componentid *cid = NULL; diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c index 33d512f..4ffda8b 100644 --- a/ldap/servers/slapd/security_wrappers.c +++ b/ldap/servers/slapd/security_wrappers.c @@ -409,3 +409,9 @@ PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, return PK11_TokenKeyGenWithFlags(slot, type, param, keySize, keyid, opFlags, attrFlags, wincx); } + +CK_MECHANISM_TYPE +slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem) +{ + return PK11_GetPBECryptoMechanism(algid, params, pwitem ); +} diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index d234c13..3db8fe7 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -53,9 +53,9 @@ /* Used by SSL and DES plugin */ -#ifdef NEED_TOK_DES -static char tokDes[34] = "Communicator Generic Crypto Svcs"; -static char ptokDes[34] = "Internal (Software) Token "; +#ifdef NEED_TOK_PBE +static char tokPBE[34] = "Communicator Generic Crypto Svcs"; +static char ptokPBE[34] = "Internal (Software) Token "; #endif /* @@ -307,6 +307,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */ #define ATTR_NETSCAPEMDSUFFIX "netscapemdsuffix" +#define PWD_PBE_DELIM '-' + #define REFERRAL_REMOVE_CMD "remove" /* Filenames for DSE storage */ @@ -1592,7 +1594,7 @@ struct pw_scheme { char *(*pws_enc)( char *pwd ); /* thread-safe decoding function (returns pointer to malloc'd string) */ - char *(*pws_dec)( char *pwd ); + char *(*pws_dec)( char *pwd, char *algid); }; typedef struct passwordpolicyarray { diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index a61d954..41dd2c8 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -222,6 +222,7 @@ NSPR_API(PRUint32) PR_fprintf(struct PRFileDesc* fd, const char *fmt, ...) #define SLAPI_OP_FLAG_NO_ACCESS_CHECK 0x10000 /* Do not check for access control - bypass them */ #define SLAPI_OP_FLAG_BYPASS_REFERRALS 0x40000 /* Useful for performing internal operations on read-only replica */ #define SLAPI_OP_FLAG_NEVER_CACHE 0x200000 /* added entry should not be kept in cache */ +#define SLAPI_OP_FLAG_IGNORE_UNINDEXED 0x800000 /* Do not log unindexed search */ #define SLAPI_OC_FLAG_REQUIRED 0x0001 #define SLAPI_OC_FLAG_ALLOWED 0x0002 diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 6b51e0c..67d01cd 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -64,7 +64,7 @@ #include <string.h> #include <errno.h> -#define NEED_TOK_DES /* defines tokDes and ptokDes - see slap.h */ +#define NEED_TOK_PBE /* defines tokPBE and ptokPBE - see slap.h */ #include "slap.h" #include "svrcore.h" @@ -1108,7 +1108,7 @@ slapd_nss_init(int init_ssl, int config_available) /******** Initialise NSS *********/ nssFlags &= (~NSS_INIT_READONLY); - slapd_pk11_configurePKCS11(NULL, NULL, tokDes, ptokDes, NULL, NULL, NULL, NULL, 0, 0 ); + slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 ); secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags); dongle_file_name = PR_smprintf("%s/pin.txt", certdir);

1 0

Branch '389-ds-base-1.3.3' - ldap/servers
by Mark Reynolds 20 Jan '15

20 Jan '15

ldap/servers/slapd/extendop.c | 2 ++ 1 file changed, 2 insertions(+) New commits: commit 8a8e1fc6b3fd4662ba3d5828934d2c0a4dab9373 Author: Mark Reynolds <mreynolds(a)redhat.com> Date: Tue Jan 20 14:37:59 2015 -0500 Ticket 47807 - SLAPI_REQUESTOR_ISROOT not set for extended operation plugins Bug Description: SLAPI_REQUESTOR_ISROOT not set for extended operation plugins Fix Description: Added the appropriate call to slapi_pblock_set just before the plugin functions get called in extendop.c https://fedorahosted.org/389/ticket/47807 Patch proivded by: Jochen Schneider <scne59(a)gmail.com> (Thanks!!) Reviewed by: mreynolds (cherry picked from commit ce4ff66498c66a3dd0d59dc2537cc95035c95fd1) diff --git a/ldap/servers/slapd/extendop.c b/ldap/servers/slapd/extendop.c index ced632d..4710c98 100644 --- a/ldap/servers/slapd/extendop.c +++ b/ldap/servers/slapd/extendop.c @@ -361,6 +361,8 @@ do_extended( Slapi_PBlock *pb ) slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_OID, extoid ); slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_VALUE, &extval ); + slapi_pblock_set( pb, SLAPI_REQUESTOR_ISROOT, &pb->pb_op->o_isroot); + rc = plugin_call_exop_plugins( pb, extoid ); if ( SLAPI_PLUGIN_EXTENDED_SENT_RESULT != rc ) {

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits January 2015