ldap/servers/slapd/connection.c | 8 ++++++++
1 file changed, 8 insertions(+)
New commits:
commit 3fe24648364634649aa7379095e915e7ab9058cd
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Oct 27 17:22:46 2015 -0700
Ticket #48326 - [RFE] it could be nice to have nsslapd-maxbersize default to bigger than 2Mb
Description: In connection_dispatch_operation, if the operation sets
the flag OP_FLAG_REPLICATED, ignore the maxbersize by setting:
maxbersize = 0;
ber_sockbuf_ctrl(conn->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &maxbersize);
Note: openldap only.
https://fedorahosted.org/389/ticket/48326
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/slapd/connection.c b/ldap/servers/slapd/connection.c
index fc3b741..1a9301a 100644
--- a/ldap/servers/slapd/connection.c
+++ b/ldap/servers/slapd/connection.c
@@ -531,6 +531,14 @@ connection_dispatch_operation(Connection *conn, Operation *op, Slapi_PBlock *pb)
/* Copy the Connection DN and SSF into the operation struct */
op_copy_identity( conn, op );
+#if defined(USE_OPENLDAP)
+ if (slapi_operation_is_flag_set(op, OP_FLAG_REPLICATED)) {
+ /* If it is replicated op, ignore the maxbersize. */
+ ber_len_t maxbersize = 0;
+ ber_sockbuf_ctrl(conn->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &maxbersize);
+ }
+#endif
+
/* If the minimum SSF requirements are not met, only allow
* bind and extended operations through. The bind and extop
* code will ensure that only SASL binds and startTLS are
1
0
dirsrvtests/tickets/ticket548_test.py | 339 ++++++++++++++++++++++++++++++++++
ldap/servers/slapd/libglobs.c | 2
ldap/servers/slapd/log.c | 2
ldap/servers/slapd/opshared.c | 2
ldap/servers/slapd/proto-slap.h | 1
ldap/servers/slapd/pw.c | 167 ++++++++++++++--
ldap/servers/slapd/pw_mgmt.c | 45 +---
ldap/servers/slapd/slap.h | 2
8 files changed, 505 insertions(+), 55 deletions(-)
New commits:
commit cb209be7ca39b9064e7ce2c89a94715c258cd72b
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Oct 19 15:14:18 2015 -0700
Ticket #548 - CI test: added test cases for ticket 548
Description: RFE: Allow AD password sync to update shadowLastChange
https://fedorahosted.org/389/ticket/548
Reviwed by spichugi(a)redhat.com and wibrown(a)redhat.com (Thank you, Simon and William!)
diff --git a/dirsrvtests/tickets/ticket548_test.py b/dirsrvtests/tickets/ticket548_test.py
new file mode 100644
index 0000000..030ff4f
--- /dev/null
+++ b/dirsrvtests/tickets/ticket548_test.py
@@ -0,0 +1,339 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2015 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+#
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+# Assuming DEFAULT_SUFFIX is "dc=example,dc=com", otherwise it does not work... :(
+SUBTREE_CONTAINER = 'cn=nsPwPolicyContainer,' + DEFAULT_SUFFIX
+SUBTREE_PWPDN = 'cn=nsPwPolicyEntry,' + DEFAULT_SUFFIX
+SUBTREE_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cdc\3Dexample\2Cdc\3Dcom,' + SUBTREE_CONTAINER
+SUBTREE_COS_TMPLDN = 'cn=nsPwTemplateEntry,' + DEFAULT_SUFFIX
+SUBTREE_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cdc\3Dexample\2Cdc\3Dcom,' + SUBTREE_CONTAINER
+SUBTREE_COS_DEF = 'cn=nsPwPolicy_CoS,' + DEFAULT_SUFFIX
+
+USER1_DN = 'uid=user1,' + DEFAULT_SUFFIX
+USER2_DN = 'uid=user2,' + DEFAULT_SUFFIX
+USER3_DN = 'uid=user3,' + DEFAULT_SUFFIX
+USER_PW = 'password'
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ global installation_prefix
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ # Creating standalone instance ...
+ standalone = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ standalone.delete()
+ standalone.create()
+ standalone.open()
+
+ # Delete each instance in the end
+ def fin():
+ standalone.delete()
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ standalone.clearTmpDir(__file__)
+
+ return TopologyStandalone(standalone)
+
+
+def set_global_pwpolicy(topology):
+ log.info(" +++++ Enable global password policy +++++\n")
+ # Enable password policy
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])
+ except ldap.LDAPError as e:
+ log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])
+ assert False
+
+ log.info(" Set global password Min Age -- 1 day\n")
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'passwordMinAge', '86400')])
+ except ldap.LDAPError as e:
+ log.error('Failed to set passwordMinAge: error ' + e.message['desc'])
+ assert False
+
+ log.info(" Set global password Max Age -- 10 days\n")
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'passwordMaxAge', '864000')])
+ except ldap.LDAPError as e:
+ log.error('Failed to set passwordMaxAge: error ' + e.message['desc'])
+ assert False
+
+ log.info(" Set global password Warning -- 3 days\n")
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'passwordWarning', '259200')])
+ except ldap.LDAPError as e:
+ log.error('Failed to set passwordWarning: error ' + e.message['desc'])
+ assert False
+
+
+def set_subtree_pwpolicy(topology):
+ log.info(" +++++ Enable subtree level password policy +++++\n")
+ log.info(" Add the container")
+ try:
+ topology.standalone.add_s(Entry((SUBTREE_CONTAINER, {'objectclass': 'top nsContainer'.split(),
+ 'cn': 'nsPwPolicyContainer'})))
+ except ldap.LDAPError as e:
+ log.error('Failed to add subtree container: error ' + e.message['desc'])
+ assert False
+
+ log.info(" Add the password policy subentry {passwordMustChange: on, passwordMinAge: 2, passwordMaxAge: 20, passwordWarning: 6}")
+ try:
+ topology.standalone.add_s(Entry((SUBTREE_PWP, {'objectclass': 'top ldapsubentry passwordpolicy'.split(),
+ 'cn': SUBTREE_PWPDN,
+ 'passwordMustChange': 'on',
+ 'passwordExp': 'on',
+ 'passwordMinAge': '172800',
+ 'passwordMaxAge': '1728000',
+ 'passwordWarning': '518400',
+ 'passwordChange': 'on',
+ 'passwordStorageScheme': 'clear'})))
+ except ldap.LDAPError as e:
+ log.error('Failed to add passwordpolicy: error ' + e.message['desc'])
+ assert False
+
+ log.info(" Add the COS template")
+ try:
+ topology.standalone.add_s(Entry((SUBTREE_COS_TMPL, {'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),
+ 'cn': SUBTREE_PWPDN,
+ 'cosPriority': '1',
+ 'cn': SUBTREE_COS_TMPLDN,
+ 'pwdpolicysubentry': SUBTREE_PWP})))
+ except ldap.LDAPError as e:
+ log.error('Failed to add COS template: error ' + e.message['desc'])
+ assert False
+
+ log.info(" Add the COS definition")
+ try:
+ topology.standalone.add_s(Entry((SUBTREE_COS_DEF, {'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),
+ 'cn': SUBTREE_PWPDN,
+ 'costemplatedn': SUBTREE_COS_TMPL,
+ 'cosAttribute': 'pwdpolicysubentry default operational-default'})))
+ except ldap.LDAPError as e:
+ log.error('Failed to add COS def: error ' + e.message['desc'])
+ assert False
+
+ time.sleep(1)
+
+
+def update_passwd(topology, user, passwd, newpasswd):
+ log.info(" Bind as {%s,%s}" % (user, passwd))
+ topology.standalone.simple_bind_s(user, passwd)
+ try:
+ topology.standalone.modify_s(user, [(ldap.MOD_REPLACE, 'userpassword', newpasswd)])
+ except ldap.LDAPError as e:
+ log.fatal('test_ticket548: Failed to update the password ' + cpw + ' of user ' + user + ': error ' + e.message['desc'])
+ assert False
+
+ time.sleep(1)
+
+
+def check_shadow_attr_value(entry, attr_type, expected, dn):
+ if entry.hasAttr(attr_type):
+ actual = entry.getValue(attr_type)
+ if int(actual) == expected:
+ log.info('%s of entry %s has expected value %s' % (attr_type, dn, actual))
+ assert True
+ else:
+ log.fatal('%s %s of entry %s does not have expected value %s' % (attr_type, actual, dn, expected))
+ assert False
+ else:
+ log.fatal('entry %s does not have %s attr' % (dn, attr_type))
+ assert False
+
+
+def test_ticket548_test_with_no_policy(topology):
+ """
+ Check shadowAccount under no password policy
+ """
+ log.info("Case 1. No password policy")
+
+ log.info("Bind as %s" % DN_DM)
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+ log.info('Add an entry' + USER1_DN)
+ try:
+ topology.standalone.add_s(Entry((USER1_DN, {'objectclass': "top person organizationalPerson inetOrgPerson shadowAccount".split(),
+ 'sn': '1',
+ 'cn': 'user 1',
+ 'uid': 'user1',
+ 'givenname': 'user',
+ 'mail': 'user1(a)example.com',
+ 'userpassword': USER_PW})))
+ except ldap.LDAPError as e:
+ log.fatal('test_ticket548: Failed to add user' + USER1_DN + ': error ' + e.message['desc'])
+ assert False
+
+ edate = int(time.time() / (60 * 60 * 24))
+ log.info('Search entry %s' % USER1_DN)
+
+ log.info("Bind as %s" % USER1_DN)
+ topology.standalone.simple_bind_s(USER1_DN, USER_PW)
+ entry = topology.standalone.getEntry(USER1_DN, ldap.SCOPE_BASE, "(objectclass=*)", ['shadowLastChange'])
+ check_shadow_attr_value(entry, 'shadowLastChange', edate, USER1_DN)
+
+ log.info("Check shadowAccount with no policy was successfully verified.")
+
+
+def test_ticket548_test_global_policy(topology):
+ """
+ Check shadowAccount with global password policy
+ """
+
+ log.info("Case 2. Check shadowAccount with global password policy")
+
+ log.info("Bind as %s" % DN_DM)
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+ set_global_pwpolicy(topology)
+
+ log.info('Add an entry' + USER2_DN)
+ try:
+ topology.standalone.add_s(Entry((USER2_DN, {'objectclass': "top person organizationalPerson inetOrgPerson shadowAccount".split(),
+ 'sn': '2',
+ 'cn': 'user 2',
+ 'uid': 'user2',
+ 'givenname': 'user',
+ 'mail': 'user2(a)example.com',
+ 'userpassword': USER_PW})))
+ except ldap.LDAPError as e:
+ log.fatal('test_ticket548: Failed to add user' + USER2_DN + ': error ' + e.message['desc'])
+ assert False
+
+ log.info("Bind as %s" % USER2_DN)
+ topology.standalone.simple_bind_s(USER2_DN, USER_PW)
+
+ edate = int(time.time() / (60 * 60 * 24))
+ log.info('Search entry %s' % USER2_DN)
+ entry = topology.standalone.getEntry(USER2_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ check_shadow_attr_value(entry, 'shadowLastChange', edate, USER2_DN)
+
+ # passwordMinAge -- 1 day
+ check_shadow_attr_value(entry, 'shadowMin', 1, USER2_DN)
+
+ # passwordMaxAge -- 10 days
+ check_shadow_attr_value(entry, 'shadowMax', 10, USER2_DN)
+
+ # passwordWarning -- 3 days
+ check_shadow_attr_value(entry, 'shadowWarning', 3, USER2_DN)
+
+ log.info("Check shadowAccount with global policy was successfully verified.")
+
+
+def test_ticket548_test_subtree_policy(topology):
+ """
+ Check shadowAccount with subtree level password policy
+ """
+
+ log.info("Case 3. Check shadowAccount with subtree level password policy")
+
+ log.info("Bind as %s" % DN_DM)
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+ set_subtree_pwpolicy(topology)
+
+ log.info('Add an entry' + USER3_DN)
+ try:
+ topology.standalone.add_s(Entry((USER3_DN, {'objectclass': "top person organizationalPerson inetOrgPerson shadowAccount".split(),
+ 'sn': '3',
+ 'cn': 'user 3',
+ 'uid': 'user3',
+ 'givenname': 'user',
+ 'mail': 'user3(a)example.com',
+ 'userpassword': USER_PW})))
+ except ldap.LDAPError as e:
+ log.fatal('test_ticket548: Failed to add user' + USER3_DN + ': error ' + e.message['desc'])
+ assert False
+
+ log.info('Search entry %s' % USER3_DN)
+ entry0 = topology.standalone.getEntry(USER3_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+
+ log.info('Expecting shadowLastChange 0 since passwordMustChange is on')
+ check_shadow_attr_value(entry0, 'shadowLastChange', 0, USER3_DN)
+
+ # passwordMinAge -- 2 day
+ check_shadow_attr_value(entry0, 'shadowMin', 2, USER3_DN)
+
+ # passwordMaxAge -- 20 days
+ check_shadow_attr_value(entry0, 'shadowMax', 20, USER3_DN)
+
+ # passwordWarning -- 6 days
+ check_shadow_attr_value(entry0, 'shadowWarning', 6, USER3_DN)
+
+ log.info("Bind as %s" % USER3_DN)
+ topology.standalone.simple_bind_s(USER3_DN, USER_PW)
+
+ log.info('Search entry %s' % USER3_DN)
+ try:
+ entry1 = topology.standalone.getEntry(USER3_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ except ldap.UNWILLING_TO_PERFORM:
+ log.info('test_ticket548: Search by' + USER3_DN + ' failed by UNWILLING_TO_PERFORM as expected')
+ except ldap.LDAPError as e:
+ log.fatal('test_ticket548: Failed to serch user' + USER3_DN + ' by self: error ' + e.message['desc'])
+ assert False
+
+ log.info("Bind as %s and updating the password with a new one" % USER3_DN)
+ topology.standalone.simple_bind_s(USER3_DN, USER_PW)
+
+ newpasswd = USER_PW + '0'
+ update_passwd(topology, USER3_DN, USER_PW, newpasswd)
+
+ log.info("Re-bind as %s with new password" % USER3_DN)
+ topology.standalone.simple_bind_s(USER3_DN, newpasswd)
+
+ try:
+ entry2 = topology.standalone.getEntry(USER3_DN, ldap.SCOPE_BASE, "(objectclass=*)")
+ except ldap.LDAPError as e:
+ log.fatal('test_ticket548: Failed to serch user' + USER3_DN + ' by self: error ' + e.message['desc'])
+ assert False
+
+ edate = int(time.time() / (60 * 60 * 24))
+
+ log.info('Expecting shadowLastChange %d once userPassword is updated', edate)
+ check_shadow_attr_value(entry2, 'shadowLastChange', edate, USER3_DN)
+
+ log.info("Check shadowAccount with subtree level policy was successfully verified.")
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
commit 17f3624c19929ffa1d37a567b7a889fd397cca59
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Oct 26 22:11:43 2015 -0700
Ticket #548 - RFE: Allow AD password sync to update shadowLastChange
Shadow Account Support Design - http://www.port389.org/docs/389ds/design/shadow-account-support.html
https://fedorahosted.org/389/ticket/548
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index a3c4243..fde3885 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -1447,7 +1447,7 @@ FrontendConfig_init () {
cfg->pw_policy.pw_mintokenlength = 3;
cfg->pw_policy.pw_maxage = 8640000; /* 100 days */
cfg->pw_policy.pw_minage = 0;
- cfg->pw_policy.pw_warning = 86400; /* 1 day */
+ cfg->pw_policy.pw_warning = _SEC_PER_DAY; /* 1 day */
init_pw_history = cfg->pw_policy.pw_history = LDAP_OFF;
cfg->pw_policy.pw_inhistory = 6;
init_pw_lockout = cfg->pw_policy.pw_lockout = LDAP_OFF;
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 2ec90de..78701c4 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -200,7 +200,7 @@ void g_log_init(int log_enabled)
loginfo.log_access_rotationsyncclock = -1;
loginfo.log_access_rotationtime = 1; /* default: 1 */
loginfo.log_access_rotationunit = LOG_UNIT_DAYS; /* default: day */
- loginfo.log_access_rotationtime_secs = 86400; /* default: 1 day */
+ loginfo.log_access_rotationtime_secs = _SEC_PER_DAY; /* default: 1 day */
loginfo.log_access_maxdiskspace = -1;
loginfo.log_access_minfreespace = -1;
loginfo.log_access_exptime = -1; /* default: -1 */
diff --git a/ldap/servers/slapd/opshared.c b/ldap/servers/slapd/opshared.c
index dcdbb04..4fe7969 100644
--- a/ldap/servers/slapd/opshared.c
+++ b/ldap/servers/slapd/opshared.c
@@ -1439,6 +1439,8 @@ iterate(Slapi_PBlock *pb, Slapi_Backend *be, int send_result,
done = 1;
continue;
}
+ /* Adding shadow password attrs. */
+ add_shadow_ext_password_attrs(pb, e);
if (process_entry(pb, e, send_result))
{
/* shouldn't send this entry */
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index b10c1eb..c49f1d1 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -917,6 +917,7 @@ void add_password_attrs( Slapi_PBlock *pb, Operation *op, Slapi_Entry *e );
void mod_allowchange_aci(char *val);
void pw_mod_allowchange_aci(int pw_prohibit_change);
void pw_add_allowchange_aci(Slapi_Entry *e, int pw_prohibit_change);
+void add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry *e);
/*
* pw_retry.c
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 4e222d7..3985c2b 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -611,6 +611,13 @@ update_pw_info ( Slapi_PBlock *pb , char *old_pw)
cur_time = current_time();
slapi_mods_init(&smods, 0);
+ if (slapi_entry_attr_hasvalue(e, SLAPI_ATTR_OBJECTCLASS, "shadowAccount")) {
+ time_t ctime = cur_time / _SEC_PER_DAY;
+ timestr = slapi_ch_smprintf("%ld", ctime);
+ slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "shadowLastChange", timestr);
+ slapi_ch_free_string(×tr);
+ }
+
/* update passwordHistory */
if ( old_pw != NULL && pwpolicy->pw_history == 1 ) {
(void)update_pw_history(pb, sdn, old_pw);
@@ -699,7 +706,7 @@ update_pw_info ( Slapi_PBlock *pb , char *old_pw)
timestr = format_genTime ( pw_exp_date );
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestr);
- slapi_ch_free((void **)×tr);
+ slapi_ch_free_string(×tr);
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpWarned", "0");
@@ -722,8 +729,7 @@ check_pw_minage ( Slapi_PBlock *pb, const Slapi_DN *sdn, struct berval **vals)
pwpolicy = new_passwdPolicy(pb, dn);
slapi_pblock_get ( pb, SLAPI_PWPOLICY, &pwresponse_req );
- if ( !pb->pb_op->o_isroot &&
- pwpolicy->pw_minage != 0 ) {
+ if (!pb->pb_op->o_isroot && !pwpolicy->pw_minage) {
Slapi_Entry *e;
char *passwordAllowChangeTime;
@@ -753,9 +759,7 @@ check_pw_minage ( Slapi_PBlock *pb, const Slapi_DN *sdn, struct berval **vals)
slapi_pwpolicy_make_response_control ( pb, -1, -1,
LDAP_PWPOLICY_PWDTOOYOUNG );
}
- pw_send_ldap_result ( pb,
- LDAP_CONSTRAINT_VIOLATION, NULL,
- "within password minimum age", 0, NULL );
+ pw_send_ldap_result(pb, LDAP_CONSTRAINT_VIOLATION, NULL, "within password minimum age", 0, NULL);
slapi_entry_free( e );
slapi_ch_free((void **) &cur_time_str );
return ( 1 );
@@ -1379,17 +1383,23 @@ add_password_attrs( Slapi_PBlock *pb, Operation *op, Slapi_Entry *e )
const char *dn = slapi_entry_get_ndn(e);
int has_allowchangetime = 0, has_expirationtime = 0;
time_t existing_exptime = 0;
+ time_t exptime = 0;
+ int isShadowAccount = 0;
+ int has_shadowLastChange = 0;
- LDAPDebug( LDAP_DEBUG_TRACE, "add_password_attrs\n", 0, 0, 0 );
+ LDAPDebug0Args(LDAP_DEBUG_TRACE, "add_password_attrs\n");
bvals[0] = &bv;
bvals[1] = NULL;
-
+
+ if (slapi_entry_attr_hasvalue(e, SLAPI_ATTR_OBJECTCLASS, "shadowAccount")) {
+ isShadowAccount = 1;
+ }
+
/* If passwordexpirationtime is specified by the user, don't
try to assign the initial value */
- for ( a = &e->e_attrs; *a != NULL; a = next ) {
- if ( strcasecmp( (*a)->a_type,
- "passwordexpirationtime" ) == 0) {
+ for (a = &e->e_attrs; a && *a; a = next) {
+ if (!strcasecmp((*a)->a_type, "passwordexpirationtime")) {
Slapi_Value *sval;
if (slapi_attr_first_value(*a, &sval) == 0) {
const struct berval *bv = slapi_value_get_berval(sval);
@@ -1397,32 +1407,44 @@ add_password_attrs( Slapi_PBlock *pb, Operation *op, Slapi_Entry *e )
}
has_expirationtime = 1;
- } else if ( strcasecmp( (*a)->a_type,
- "passwordallowchangetime" ) == 0) {
+ } else if (!strcasecmp((*a)->a_type, "passwordallowchangetime")) {
has_allowchangetime = 1;
+ } else if (isShadowAccount && !strcasecmp((*a)->a_type, "shadowlastchange")) {
+ has_shadowLastChange = 1;
}
next = &(*a)->a_next;
}
- if ( has_allowchangetime && has_expirationtime ) {
+ if (has_allowchangetime && has_expirationtime && has_shadowLastChange) {
return;
}
pwpolicy = new_passwdPolicy(pb, dn);
- if ( !has_expirationtime &&
- ( pwpolicy->pw_exp || pwpolicy->pw_must_change ) ) {
- if ( pwpolicy->pw_must_change) {
+ if (!has_expirationtime && (pwpolicy->pw_exp || pwpolicy->pw_must_change)) {
+ if (pwpolicy->pw_must_change) {
/* must change password when first time logon */
bv.bv_val = format_genTime ( NO_TIME );
} else if ( pwpolicy->pw_exp ) {
- bv.bv_val = format_genTime ( time_plus_sec ( current_time (),
- pwpolicy->pw_maxage ) );
+ exptime = time_plus_sec(current_time(), pwpolicy->pw_maxage);
+ bv.bv_val = format_genTime(exptime);
}
bv.bv_len = strlen( bv.bv_val );
slapi_entry_attr_merge( e, "passwordexpirationtime", bvals );
slapi_ch_free_string( &bv.bv_val );
}
+ if (isShadowAccount && !has_shadowLastChange) {
+ if (pwpolicy->pw_must_change) {
+ /* must change password when first time logon */
+ bv.bv_val = slapi_ch_smprintf("0");
+ } else {
+ exptime = current_time() / _SEC_PER_DAY;
+ bv.bv_val = slapi_ch_smprintf("%ld", exptime);
+ }
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_merge(e, "shadowLastChange", bvals);
+ slapi_ch_free_string(&bv.bv_val);
+ }
/*
* If the password minimum age is not 0, calculate when the password
@@ -1434,12 +1456,11 @@ add_password_attrs( Slapi_PBlock *pb, Operation *op, Slapi_Entry *e )
*/
if ( !has_allowchangetime && pwpolicy->pw_minage != 0 &&
(has_expirationtime && existing_exptime > current_time()) ) {
- bv.bv_val = format_genTime ( time_plus_sec ( current_time (),
- pwpolicy->pw_minage ) );
+ bv.bv_val = format_genTime ( time_plus_sec ( current_time (), pwpolicy->pw_minage ) );
bv.bv_len = strlen( bv.bv_val );
-
+
slapi_entry_attr_merge( e, "passwordallowchangetime", bvals );
- slapi_ch_free((void **) &bv.bv_val );
+ slapi_ch_free_string( &bv.bv_val );
}
}
@@ -2800,3 +2821,103 @@ pw_get_ext_size(Slapi_Entry *entry, size_t *size)
}
return LDAP_SUCCESS;
}
+
+void
+add_shadow_ext_password_attrs(Slapi_PBlock *pb, Slapi_Entry *e)
+{
+ const char *dn = NULL;
+ passwdPolicy *pwpolicy = NULL;
+ time_t shadowval = 0;
+ time_t exptime = 0;
+ struct berval bv;
+ struct berval *bvals[2];
+
+ if (!e) {
+ return;
+ }
+ dn = slapi_entry_get_ndn(e);
+ if (!dn) {
+ return;
+ }
+ if (!slapi_entry_attr_hasvalue(e, SLAPI_ATTR_OBJECTCLASS, "shadowAccount")) {
+ /* Not a shadowAccount; nothing to do. */
+ return;
+ }
+ if (operation_is_flag_set(pb->pb_op, OP_FLAG_INTERNAL)) {
+ /* external only */
+ return;
+ }
+ pwpolicy = new_passwdPolicy(pb, dn);
+ if (!pwpolicy) {
+ return;
+ }
+
+ LDAPDebug0Args(LDAP_DEBUG_TRACE, "--> add_shadow_password_attrs\n");
+
+ bvals[0] = &bv;
+ bvals[1] = NULL;
+
+ /* shadowMin - the minimum number of days required between password changes. */
+ if (pwpolicy->pw_minage > 0) {
+ shadowval = pwpolicy->pw_minage / _SEC_PER_DAY;
+ } else {
+ shadowval = 0;
+ }
+ bv.bv_val = slapi_ch_smprintf("%ld", shadowval);
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(e, "shadowMin", bvals);
+ slapi_ch_free_string(&bv.bv_val);
+
+ /* shadowMax - the maximum number of days for which the user password remains valid. */
+ if (pwpolicy->pw_maxage > 0) {
+ shadowval = pwpolicy->pw_maxage / _SEC_PER_DAY;
+ exptime = time_plus_sec(current_time(), pwpolicy->pw_maxage);
+ } else {
+ shadowval = 99999;
+ }
+ bv.bv_val = slapi_ch_smprintf("%ld", shadowval);
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(e, "shadowMax", bvals);
+ slapi_ch_free_string(&bv.bv_val);
+
+ /* shadowWarning - the number of days of advance warning given to the user before the user password expires. */
+ if (pwpolicy->pw_warning > 0) {
+ shadowval = pwpolicy->pw_warning / _SEC_PER_DAY;
+ } else {
+ shadowval = 0;
+ }
+ bv.bv_val = slapi_ch_smprintf("%ld", shadowval);
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(e, "shadowWarning", bvals);
+ slapi_ch_free_string(&bv.bv_val);
+
+ /* shadowExpire - the date on which the user login will be disabled. */
+ if (exptime) {
+ exptime /= _SEC_PER_DAY;
+ bv.bv_val = slapi_ch_smprintf("%ld", exptime);
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(e, "shadowExpire", bvals);
+ slapi_ch_free_string(&bv.bv_val);
+ }
+
+#if 0 /* These 2 attributes are no need (or not able) to auto-fill. */
+ /*
+ * shadowInactive - the number of days of inactivity allowed for the user.
+ * Password Policy does not have the corresponding parameter.
+ */
+ shadowval = 0;
+ bv.bv_val = slapi_ch_smprintf("%ld", shadowval);
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(e, "shadowInactive", bvals);
+ slapi_ch_free_string(&bv.bv_val);
+
+ /* shadowFlag - not currently in use. */
+ bv.bv_val = slapi_ch_smprintf("%d", 0);
+ bv.bv_len = strlen(bv.bv_val);
+ slapi_entry_attr_replace(e, "shadowFlag", bvals);
+ slapi_ch_free_string(&bv.bv_val);
+#endif
+
+ LDAPDebug0Args(LDAP_DEBUG_TRACE, "<-- add_shadow_password_attrs\n");
+ return;
+}
diff --git a/ldap/servers/slapd/pw_mgmt.c b/ldap/servers/slapd/pw_mgmt.c
index 8f33751..a650b1c 100644
--- a/ldap/servers/slapd/pw_mgmt.c
+++ b/ldap/servers/slapd/pw_mgmt.c
@@ -27,11 +27,10 @@ int
need_new_pw( Slapi_PBlock *pb, long *t, Slapi_Entry *e, int pwresponse_req )
{
time_t cur_time, pw_exp_date;
- LDAPMod *mod;
Slapi_Mods smods;
double diff_t = 0;
char *cur_time_str = NULL;
- char *passwordExpirationTime;
+ char *passwordExpirationTime = NULL;
char *timestring;
char *dn;
const Slapi_DN *sdn;
@@ -67,13 +66,12 @@ need_new_pw( Slapi_PBlock *pb, long *t, Slapi_Entry *e, int pwresponse_req )
* This is ok for data that has been loaded via ldif2ldbm
* Set expiration time if needed,
* don't do further checking and return 0 */
- if ( pwpolicy->pw_exp == 1) {
- pw_exp_date = time_plus_sec ( cur_time,
- pwpolicy->pw_maxage );
+ if (pwpolicy->pw_exp == 1) {
+ pw_exp_date = time_plus_sec(cur_time, pwpolicy->pw_maxage);
timestring = format_genTime (pw_exp_date);
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
- slapi_ch_free((void **)×tring);
+ slapi_ch_free_string(×tring);
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpWarned", "0");
pw_apply_mods(sdn, &smods);
@@ -86,7 +84,7 @@ need_new_pw( Slapi_PBlock *pb, long *t, Slapi_Entry *e, int pwresponse_req )
pw_exp_date = parse_genTime(passwordExpirationTime);
- slapi_ch_free((void**)&passwordExpirationTime);
+ slapi_ch_free_string(&passwordExpirationTime);
/* Check if password has been reset */
if ( pw_exp_date == NO_TIME ) {
@@ -110,7 +108,7 @@ need_new_pw( Slapi_PBlock *pb, long *t, Slapi_Entry *e, int pwresponse_req )
pw_exp_date = NOT_FIRST_TIME;
timestring = format_genTime(pw_exp_date);
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
- slapi_ch_free((void **)×tring);
+ slapi_ch_free_string(×tring);
}
skip:
@@ -130,11 +128,8 @@ skip:
/* check if password expired. If so, abort bind. */
cur_time_str = format_genTime ( cur_time );
- if ( pw_exp_date != NO_TIME &&
- pw_exp_date != NOT_FIRST_TIME &&
- (diff_t = difftime ( pw_exp_date,
- parse_genTime ( cur_time_str ))) <= 0 ) {
-
+ if ((pw_exp_date != NO_TIME) && (pw_exp_date != NOT_FIRST_TIME) &&
+ (diff_t = difftime(pw_exp_date, parse_genTime(cur_time_str))) <= 0) {
slapi_ch_free_string(&cur_time_str); /* only need this above */
/* password has expired. Check the value of
* passwordGraceUserTime and compare it
@@ -144,7 +139,7 @@ skip:
pwdGraceUserTime++;
sprintf ( graceUserTime, "%d", pwdGraceUserTime );
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE,
- "passwordGraceUserTime", graceUserTime);
+ "passwordGraceUserTime", graceUserTime);
pw_apply_mods(sdn, &smods);
slapi_mods_done(&smods);
if (pwresponse_req) {
@@ -190,40 +185,30 @@ skip:
pw_apply_mods(sdn, &smods);
slapi_mods_done(&smods);
return (-1);
- }
+ }
slapi_ch_free((void **) &cur_time_str );
/* check if password is going to expire within "passwordWarning" */
/* Note that if pw_exp_date is NO_TIME or NOT_FIRST_TIME,
* we must send warning first and this changes the expiration time.
* This is done just below since diff_t is 0
- */
+ */
if ( diff_t <= pwpolicy->pw_warning ) {
int pw_exp_warned = 0;
- pw_exp_warned= slapi_entry_attr_get_int( e, "passwordExpWarned");
+ pw_exp_warned = slapi_entry_attr_get_int( e, "passwordExpWarned");
if ( !pw_exp_warned ){
/* first time send out a warning */
/* reset the expiration time to current + warning time
* and set passwordExpWarned to true
*/
if (pb->pb_conn->c_needpw != 1) {
- pw_exp_date = time_plus_sec ( cur_time,
- pwpolicy->pw_warning );
+ pw_exp_date = time_plus_sec(cur_time, pwpolicy->pw_warning);
}
timestring = format_genTime(pw_exp_date);
- /* At this time passwordExpirationTime may already be
- * in the list of mods: Remove it */
- for (mod = slapi_mods_get_first_mod(&smods); mod != NULL;
- mod = slapi_mods_get_next_mod(&smods))
- {
- if (!strcmp(mod->mod_type, "passwordExpirationTime"))
- slapi_mods_remove(&smods);
- }
-
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpirationTime", timestring);
- slapi_ch_free((void **)×tring);
+ slapi_ch_free_string(×tring);
slapi_mods_add_string(&smods, LDAP_MOD_REPLACE, "passwordExpWarned", "1");
@@ -232,7 +217,7 @@ skip:
} else {
*t = (long)diff_t; /* jcm: had to cast double to long */
}
-
+
pw_apply_mods(sdn, &smods);
slapi_mods_done(&smods);
if (pwresponse_req) {
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 823568d..f78bc46 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -2507,4 +2507,6 @@ extern char *attr_dataversion;
/* copied from replication/repl5.h */
#define RUV_STORAGE_ENTRY_UNIQUEID "ffffffff-ffffffff-ffffffff-ffffffff"
+#define _SEC_PER_DAY 86400
+
#endif /* _slap_h_ */
1
0
ldap/servers/slapd/daemon.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
New commits:
commit a8d30b356f312b24132f4ced324a67601b7cfb9b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Oct 23 15:17:44 2015 -0400
Ticket 48311 - nunc-stans: Attempt to release connection that
is not acquired
Bug Description: ns_connection_post_io_or_closing() was not aquiring the
connection in the optimized build, which led to the connection
ref count getting out sequence.
Fix Description Do not call connection_acquire_nolock() inside a PR_ASSERT call.
Also changed other PR_ASSERTs to only be called if DEBUG is set
https://fedorahosted.org/389/ticket/48311
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 97946bd212c5094a490d6a3429e0d5763ccd39ce)
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index ba73da3..82099bc 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1836,7 +1836,11 @@ ns_handle_closure(struct ns_job_t *job)
int do_yield = 0;
/* this function must be called from the event loop thread */
+#ifdef DEBUG
PR_ASSERT(0 == NS_JOB_IS_THREAD(ns_job_get_type(job)));
+#else
+ NS_JOB_IS_THREAD(ns_job_get_type(job));
+#endif
PR_Lock(c->c_mutex);
connection_release_nolock_ext(c, 1); /* release ref acquired for event framework */
PR_ASSERT(c->c_ns_close_jobs == 1); /* should be exactly 1 active close job - this one */
@@ -1889,7 +1893,11 @@ ns_connection_post_io_or_closing(Connection *conn)
/* process event normally - wait for I/O until idletimeout */
tv.tv_sec = conn->c_idletimeout;
tv.tv_usec = 0;
- PR_ASSERT(0 == connection_acquire_nolock(conn)); /* event framework now has a reference */
+#ifdef DEBUG
+ PR_ASSERT(0 == connection_acquire_nolock(conn));
+#else
+ connection_acquire_nolock(conn); /* event framework now has a reference */
+#endif
ns_add_io_timeout_job(conn->c_tp, conn->c_prfd, &tv,
NS_JOB_READ|NS_JOB_PRESERVE_FD,
ns_handle_pr_read_ready, conn, NULL);
@@ -1911,7 +1919,11 @@ ns_handle_pr_read_ready(struct ns_job_t *job)
Connection *c = (Connection *)ns_job_get_data(job);
/* this function must be called from the event loop thread */
+#ifdef DEBUG
PR_ASSERT(0 == NS_JOB_IS_THREAD(ns_job_get_type(job)));
+#else
+ NS_JOB_IS_THREAD(ns_job_get_type(job));
+#endif
PR_Lock(c->c_mutex);
LDAPDebug2Args(LDAP_DEBUG_CONNS, "activity on conn %" NSPRIu64 " for fd=%d\n",
1
0
ldap/servers/slapd/daemon.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
New commits:
commit 97946bd212c5094a490d6a3429e0d5763ccd39ce
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Fri Oct 23 15:17:44 2015 -0400
Ticket 48311 - nunc-stans: Attempt to release connection that
is not acquired
Bug Description: ns_connection_post_io_or_closing() was not aquiring the
connection in the optimized build, which led to the connection
ref count getting out sequence.
Fix Description Do not call connection_acquire_nolock() inside a PR_ASSERT call.
Also changed other PR_ASSERTs to only be called if DEBUG is set
https://fedorahosted.org/389/ticket/48311
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index ba73da3..82099bc 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1836,7 +1836,11 @@ ns_handle_closure(struct ns_job_t *job)
int do_yield = 0;
/* this function must be called from the event loop thread */
+#ifdef DEBUG
PR_ASSERT(0 == NS_JOB_IS_THREAD(ns_job_get_type(job)));
+#else
+ NS_JOB_IS_THREAD(ns_job_get_type(job));
+#endif
PR_Lock(c->c_mutex);
connection_release_nolock_ext(c, 1); /* release ref acquired for event framework */
PR_ASSERT(c->c_ns_close_jobs == 1); /* should be exactly 1 active close job - this one */
@@ -1889,7 +1893,11 @@ ns_connection_post_io_or_closing(Connection *conn)
/* process event normally - wait for I/O until idletimeout */
tv.tv_sec = conn->c_idletimeout;
tv.tv_usec = 0;
- PR_ASSERT(0 == connection_acquire_nolock(conn)); /* event framework now has a reference */
+#ifdef DEBUG
+ PR_ASSERT(0 == connection_acquire_nolock(conn));
+#else
+ connection_acquire_nolock(conn); /* event framework now has a reference */
+#endif
ns_add_io_timeout_job(conn->c_tp, conn->c_prfd, &tv,
NS_JOB_READ|NS_JOB_PRESERVE_FD,
ns_handle_pr_read_ready, conn, NULL);
@@ -1911,7 +1919,11 @@ ns_handle_pr_read_ready(struct ns_job_t *job)
Connection *c = (Connection *)ns_job_get_data(job);
/* this function must be called from the event loop thread */
+#ifdef DEBUG
PR_ASSERT(0 == NS_JOB_IS_THREAD(ns_job_get_type(job)));
+#else
+ NS_JOB_IS_THREAD(ns_job_get_type(job));
+#endif
PR_Lock(c->c_mutex);
LDAPDebug2Args(LDAP_DEBUG_CONNS, "activity on conn %" NSPRIu64 " for fd=%d\n",
1
0
dirsrvtests/tickets/ticket48266_test.py | 431 ++++++++++++++++++++++++++++++++
1 file changed, 431 insertions(+)
New commits:
commit 9c84b9326979f6163348b0d2a1eea8607e2f0729
Author: spichugi <spichugi(a)lib389-devel.test.redhat.com>
Date: Fri Sep 18 14:17:05 2015 +0200
Ticket 48266: test case
diff --git a/dirsrvtests/tickets/ticket48266_test.py b/dirsrvtests/tickets/ticket48266_test.py
new file mode 100644
index 0000000..e509e14
--- /dev/null
+++ b/dirsrvtests/tickets/ticket48266_test.py
@@ -0,0 +1,431 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+installation1_prefix = None
+
+NEW_ACCOUNT = "new_account"
+MAX_ACCOUNTS = 20
+
+class TopologyReplication(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+ master2.open()
+ self.master2 = master2
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ global installation1_prefix
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Creating master 1...
+ master1 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.delete()
+ master1.create()
+ master1.open()
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+
+ # Creating master 2...
+ master2 = DirSrv(verbose=False)
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.delete()
+ master2.create()
+ master2.open()
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ #
+ # Create all the agreements
+ #
+ # Creating agreement from master 1 to master 2
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m1_m2_agmt = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ if not m1_m2_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m1_m2_agmt)
+
+ # Creating agreement from master 2 to master 1
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m2_m1_agmt = master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
+ if not m2_m1_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m2_m1_agmt)
+
+ # Allow the replicas to get situated with the new agreements...
+ time.sleep(5)
+
+ #
+ # Initialize all the agreements
+ #
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(m1_m2_agmt)
+
+ # Check replication is working...
+ if master1.testReplication(DEFAULT_SUFFIX, master2):
+ log.info('Replication is working.')
+ else:
+ log.fatal('Replication is not working.')
+ assert False
+
+ # Delete each instance in the end
+ def fin():
+ master1.delete()
+ master2.delete()
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ master1.clearTmpDir(__file__)
+
+ return TopologyReplication(master1, master2)
+
+
+def pattern_accesslog(file, log_pattern):
+ try:
+ pattern_accesslog.last_pos += 1
+ except AttributeError:
+ pattern_accesslog.last_pos = 0
+
+
+ found = None
+ file.seek(pattern_accesslog.last_pos)
+
+ # Use a while true iteration because 'for line in file: hit a
+ # python bug that break file.tell()
+ while True:
+ line = file.readline()
+ found = log_pattern.search(line)
+ if ((line == '') or (found)):
+ break
+
+ pattern_accesslog.last_pos = file.tell()
+ if found:
+ return line
+ else:
+ return None
+
+
+(a)pytest.fixture(scope="module")
+def entries(topology):
+ # add dummy entries in the staging DIT
+ for cpt in range(MAX_ACCOUNTS):
+ name = "%s%d" % (NEW_ACCOUNT, cpt)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, SUFFIX), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+ mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '8192'),
+ (ldap.MOD_REPLACE, 'nsslapd-accesslog-level', str(256+4))]
+ topology.master1.modify_s(DN_CONFIG, mod)
+ topology.master2.modify_s(DN_CONFIG, mod)
+
+
+def test_ticket48266_fractional(topology, entries):
+ ents = topology.master1.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+
+ mod = [(ldap.MOD_REPLACE, 'nsDS5ReplicatedAttributeList', ['(objectclass=*) $ EXCLUDE telephonenumber']),
+ (ldap.MOD_REPLACE, 'nsds5ReplicaStripAttrs', ['modifiersname modifytimestamp'])]
+ ents = topology.master1.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+ m1_m2_agmt = ents[0].dn
+ topology.master1.modify_s(ents[0].dn, mod)
+
+ ents = topology.master2.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+ topology.master2.modify_s(ents[0].dn, mod)
+
+ topology.master1.restart(timeout=10)
+ topology.master2.restart(timeout=10)
+
+ topology.master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ topology.master1.waitForReplInit(m1_m2_agmt)
+
+
+def test_ticket48266_check_repl_desc(topology, entries):
+ name = "cn=%s1,%s" % (NEW_ACCOUNT, SUFFIX)
+ value = 'check repl. description'
+ mod = [(ldap.MOD_REPLACE, 'description', value)]
+ topology.master1.modify_s(name, mod)
+
+ loop = 0
+ while loop <= 10:
+ ent = topology.master2.getEntry(name, ldap.SCOPE_BASE, "(objectclass=*)")
+ if ent.hasAttr('description') and ent.getValue('description') == value:
+ break
+ time.sleep(1)
+ loop += 1
+ assert loop <= 10
+
+
+# will use this CSN as a starting point on error log
+# after this is one 'Skipped' then the first csn _get_first_not_replicated_csn
+# should no longer be Skipped in the error log
+def _get_last_not_replicated_csn(topology):
+ name = "cn=%s5,%s" % (NEW_ACCOUNT, SUFFIX)
+
+ # read the first CSN that will not be replicated
+ mod = [(ldap.MOD_REPLACE, 'telephonenumber', str(123456))]
+ topology.master1.modify_s(name, mod)
+ msgid = topology.master1.search_ext(name, ldap.SCOPE_SUBTREE, 'objectclass=*', ['nscpentrywsi'])
+ rtype, rdata, rmsgid = topology.master1.result2(msgid)
+ attrs = None
+ for dn, raw_attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ if 'nscpentrywsi' in raw_attrs:
+ attrs = raw_attrs['nscpentrywsi']
+ assert attrs
+ for attr in attrs:
+ if attr.lower().startswith('telephonenumber'):
+ break
+ assert attr
+
+ # now retrieve the CSN of the operation we are looking for
+ csn = None
+ topology.master1.stop(timeout=10)
+ file_path = os.path.join(topology.master1.prefix, "var/log/dirsrv/slapd-%s/access" % topology.master1.serverid)
+ file_obj = open(file_path, "r")
+
+ # First the conn/op of the operation
+ regex = re.compile("MOD dn=\"%s\"" % name)
+ found_op = pattern_accesslog(file_obj, regex)
+ assert found_op
+ if found_op:
+ conn_op_pattern = '.* (conn=[0-9]* op=[0-9]*) .*'
+ conn_op_re= re.compile(conn_op_pattern)
+ conn_op_match = conn_op_re.match(found_op)
+ conn_op = conn_op_match.group(1)
+
+ # now the related CSN
+ regex = re.compile("%s RESULT" % conn_op)
+ found_result = pattern_accesslog(file_obj, regex)
+ csn_pattern = '.* csn=(.*)'
+ csn_re = re.compile(csn_pattern)
+ csn_match = csn_re.match(found_result)
+ csn = csn_match.group(1)
+
+ topology.master1.start(timeout=10)
+ return csn
+
+
+def _get_first_not_replicated_csn(topology):
+ name = "cn=%s2,%s" % (NEW_ACCOUNT, SUFFIX)
+
+ # read the first CSN that will not be replicated
+ mod = [(ldap.MOD_REPLACE, 'telephonenumber', str(123456))]
+ topology.master1.modify_s(name, mod)
+ msgid = topology.master1.search_ext(name, ldap.SCOPE_SUBTREE, 'objectclass=*', ['nscpentrywsi'])
+ rtype, rdata, rmsgid = topology.master1.result2(msgid)
+ attrs = None
+ for dn, raw_attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ if 'nscpentrywsi' in raw_attrs:
+ attrs = raw_attrs['nscpentrywsi']
+ assert attrs
+ for attr in attrs:
+ if attr.lower().startswith('telephonenumber'):
+ break
+ assert attr
+
+ # now retrieve the CSN of the operation we are looking for
+ csn = None
+ topology.master1.stop(timeout=10)
+ file_path = os.path.join(topology.master1.prefix, "var/log/dirsrv/slapd-%s/access" % topology.master1.serverid)
+ file_obj = open(file_path, "r")
+
+ # First the conn/op of the operation
+ regex = re.compile("MOD dn=\"%s\"" % name)
+ found_op = pattern_accesslog(file_obj, regex)
+ assert found_op
+ if found_op:
+ conn_op_pattern = '.* (conn=[0-9]* op=[0-9]*) .*'
+ conn_op_re= re.compile(conn_op_pattern)
+ conn_op_match = conn_op_re.match(found_op)
+ conn_op = conn_op_match.group(1)
+
+ # now the related CSN
+ regex = re.compile("%s RESULT" % conn_op)
+ found_result = pattern_accesslog(file_obj, regex)
+ csn_pattern = '.* csn=(.*)'
+ csn_re = re.compile(csn_pattern)
+ csn_match = csn_re.match(found_result)
+ csn = csn_match.group(1)
+
+ topology.master1.start(timeout=10)
+ return csn
+
+
+def _count_full_session(topology):
+ file_path = os.path.join(topology.master1.prefix, "var/log/dirsrv/slapd-%s/errors" % topology.master1.serverid)
+
+ #
+ # compute the number of 'No more updates'
+ #
+ file_obj = open(file_path, "r")
+ # pattern to find
+ pattern = ".*No more updates to send.*"
+ regex = re.compile(pattern)
+ no_more_updates = 0
+
+ # check initiation number of 'No more updates
+ while True:
+ line = file_obj.readline()
+ found = regex.search(line)
+ if (found):
+ no_more_updates = no_more_updates + 1
+ if (line == ''):
+ break
+ file_obj.close()
+
+ return no_more_updates
+
+
+def test_ticket48266_count_csn_evaluation(topology, entries):
+ ents = topology.master1.agreement.list(suffix=SUFFIX)
+ assert len(ents) == 1
+ first_csn = _get_first_not_replicated_csn(topology)
+ name = "cn=%s3,%s" % (NEW_ACCOUNT, SUFFIX)
+ NB_SESSION = 102
+
+ no_more_update_cnt = _count_full_session(topology)
+ topology.master1.agreement.pause(ents[0].dn)
+ # now do a set of updates that will NOT be replicated
+ for telNumber in range(NB_SESSION):
+ mod = [(ldap.MOD_REPLACE, 'telephonenumber', str(telNumber))]
+ topology.master1.modify_s(name, mod)
+
+ topology.master1.agreement.resume(ents[0].dn)
+
+ # let's wait all replication session complete
+ MAX_LOOP = 10
+ cnt = 0
+ current_no_more_update = _count_full_session(topology)
+ while (current_no_more_update == no_more_update_cnt):
+ cnt = cnt + 1
+ if (cnt > MAX_LOOP):
+ break
+ time.sleep(5)
+ current_no_more_update = _count_full_session(topology)
+
+ log.info('after %d MODs we have completed %d replication sessions' % (NB_SESSION, (current_no_more_update - no_more_update_cnt)))
+ no_more_update_cnt = current_no_more_update
+
+
+ # At this point, with the fix a dummy update was made BUT may be not sent it
+ # make sure it was sent so that the consumer CSN will be updated
+ last_csn = _get_last_not_replicated_csn(topology)
+
+ # let's wait all replication session complete
+ MAX_LOOP = 10
+ cnt = 0
+ current_no_more_update = _count_full_session(topology)
+ while (current_no_more_update == no_more_update_cnt):
+ cnt = cnt + 1
+ if (cnt > MAX_LOOP):
+ break
+ time.sleep(5)
+ current_no_more_update = _count_full_session(topology)
+
+ log.info('This MODs %s triggered the send of the dummy update completed %d replication sessions' % (last_csn, (current_no_more_update - no_more_update_cnt)))
+ no_more_update_cnt = current_no_more_update
+
+ # so we should no longer see the first_csn in the log
+ # Let's create a new csn (last_csn) and check there is no longer first_csn
+ topology.master1.agreement.pause(ents[0].dn)
+ last_csn = _get_last_not_replicated_csn(topology)
+ topology.master1.agreement.resume(ents[0].dn)
+
+ # let's wait for the session to complete
+ MAX_LOOP = 10
+ cnt = 0
+ while (current_no_more_update == no_more_update_cnt):
+ cnt = cnt + 1
+ if (cnt > MAX_LOOP):
+ break
+ time.sleep(5)
+ current_no_more_update = _count_full_session(topology)
+
+ log.info('This MODs %s completed in %d replication sessions, should be sent without evaluating %s' % (last_csn, (current_no_more_update - no_more_update_cnt), first_csn))
+ no_more_update_cnt = current_no_more_update
+
+ # Now determine how many times we have skipped 'csn'
+ # no need to stop the server to check the error log
+ file_path = os.path.join(topology.master1.prefix, "var/log/dirsrv/slapd-%s/errors" % topology.master1.serverid)
+ file_obj = open(file_path, "r")
+
+ # find where the last_csn operation was processed
+ pattern = ".*ruv_add_csn_inprogress: successfully inserted csn %s.*" % last_csn
+ regex = re.compile(pattern)
+ cnt = 0
+
+ while True:
+ line = file_obj.readline()
+ found = regex.search(line)
+ if ((line == '') or (found)):
+ break
+ if (found):
+ log.info('last operation was found at %d' % file_obj.tell())
+ log.info(line)
+ log.info('Now check the we can not find the first csn %s in the log'% first_csn)
+
+ pattern = ".*Skipping update operation.*CSN %s.*" % first_csn
+ regex = re.compile(pattern)
+ found = False
+ while True:
+ line = file_obj.readline()
+ found = regex.search(line)
+ if ((line == '') or (found)):
+ break
+ if (found):
+ log.info('Unexpected found %s' % line)
+ assert not found
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
1
0
ldap/servers/slapd/tools/ldclt/ldclt.c | 5 +++++
1 file changed, 5 insertions(+)
New commits:
commit 5b33c781d2568c930a0856f0a42c1e1d53e3358f
Author: Stanislav Zidek <szidek(a)redhat.com>
Date: Wed Oct 21 17:58:31 2015 -0700
Ticket #48289 - 389-ds-base: ldclt-bin killed by SIGSEGV
Description: If NULL source string was passed to parseFilter, it caused
NULL dereference.
https://fedorahosted.org/389/ticket/48289
Reviewed by nhosoi(a)redhat.com.
diff --git a/ldap/servers/slapd/tools/ldclt/ldclt.c b/ldap/servers/slapd/tools/ldclt/ldclt.c
index 9e573a5..7296439 100644
--- a/ldap/servers/slapd/tools/ldclt/ldclt.c
+++ b/ldap/servers/slapd/tools/ldclt/ldclt.c
@@ -929,6 +929,11 @@ parseFilter (
{
int i, j;
+ if (!src) {
+ printf ("Error: NULL source string is passed.\n");
+ return (-1);
+ }
+
for (i=0 ; (i<strlen(src)) && (src[i]!='X') ; i++);
*head = (char *)malloc(i+1);
if (*head == NULL)
1
0
2 commits - aclocal.m4 config.guess config.sub configure configure.ac m4/libtool.m4 rpm/389-ds-base.spec.in
by Noriko Hosoi 21 Oct '15
by Noriko Hosoi 21 Oct '15
21 Oct '15
aclocal.m4 | 15 ---
config.guess | 192 +++++++++++++++++++++++++++++++++++++++++-------
config.sub | 40 +++-------
configure | 16 +---
configure.ac | 4 -
m4/libtool.m4 | 12 ---
rpm/389-ds-base.spec.in | 21 +++++
7 files changed, 211 insertions(+), 89 deletions(-)
New commits:
commit 79aa17822eacd619563611075677ec048c2bc872
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Oct 21 14:34:35 2015 -0700
Ticket #48285 - The dirsrv user/group should be created in rpm %pre, and ideally with fixed uid/gid
Description: Generated files by autogen for this diff in configure.ac:
# default user, group
-defaultuser=nobody
-defaultgroup=nobody
+defaultuser=dirsrv
+defaultgroup=dirsrv
https://fedorahosted.org/389/ticket/48285
diff --git a/aclocal.m4 b/aclocal.m4
index 6681aa3..25206b5 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -220,21 +220,6 @@ m4_popdef([pkg_default])
m4_popdef([pkg_description])
]) dnl PKG_NOARCH_INSTALLDIR
-
-# PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
-# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-# -------------------------------------------
-# Retrieves the value of the pkg-config variable for the given module.
-AC_DEFUN([PKG_CHECK_VAR],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
-
-_PKG_CONFIG([$1], [variable="][$3]["], [$2])
-AS_VAR_COPY([$1], [pkg_cv_][$1])
-
-AS_VAR_IF([$1], [""], [$5], [$4])dnl
-])# PKG_CHECK_VAR
-
# Copyright (C) 2002-2013 Free Software Foundation, Inc.
#
# This file is free software; the Free Software Foundation
diff --git a/config.guess b/config.guess
index 1f5c50c..b79252d 100755
--- a/config.guess
+++ b/config.guess
@@ -1,8 +1,8 @@
#! /bin/sh
# Attempt to guess a canonical system name.
-# Copyright 1992-2014 Free Software Foundation, Inc.
+# Copyright 1992-2013 Free Software Foundation, Inc.
-timestamp='2014-03-23'
+timestamp='2013-06-10'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -50,7 +50,7 @@ version="\
GNU config.guess ($timestamp)
Originally written by Per Bothner.
-Copyright 1992-2014 Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -149,7 +149,7 @@ Linux|GNU|GNU/*)
LIBC=gnu
#endif
EOF
- eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
+ eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
;;
esac
@@ -826,7 +826,7 @@ EOF
*:MINGW*:*)
echo ${UNAME_MACHINE}-pc-mingw32
exit ;;
- *:MSYS*:*)
+ i*:MSYS*:*)
echo ${UNAME_MACHINE}-pc-msys
exit ;;
i*:windows32*:*)
@@ -969,10 +969,10 @@ EOF
eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
;;
- openrisc*:Linux:*:*)
- echo or1k-unknown-linux-${LIBC}
+ or1k:Linux:*:*)
+ echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
- or32:Linux:*:* | or1k*:Linux:*:*)
+ or32:Linux:*:*)
echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
exit ;;
padre:Linux:*:*)
@@ -1260,26 +1260,16 @@ EOF
if test "$UNAME_PROCESSOR" = unknown ; then
UNAME_PROCESSOR=powerpc
fi
- if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
- if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
- if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
- (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
- grep IS_64BIT_ARCH >/dev/null
- then
- case $UNAME_PROCESSOR in
- i386) UNAME_PROCESSOR=x86_64 ;;
- powerpc) UNAME_PROCESSOR=powerpc64 ;;
- esac
- fi
+ if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+ if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+ (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+ grep IS_64BIT_ARCH >/dev/null
+ then
+ case $UNAME_PROCESSOR in
+ i386) UNAME_PROCESSOR=x86_64 ;;
+ powerpc) UNAME_PROCESSOR=powerpc64 ;;
+ esac
fi
- elif test "$UNAME_PROCESSOR" = i386 ; then
- # Avoid executing cc on OS X 10.9, as it ships with a stub
- # that puts up a graphical alert prompting to install
- # developer tools. Any system running Mac OS X 10.7 or
- # later (Darwin 11 and later) is required to have a 64-bit
- # processor. This is not true of the ARM version of Darwin
- # that Apple uses in portable devices.
- UNAME_PROCESSOR=x86_64
fi
echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
exit ;;
@@ -1371,6 +1361,154 @@ EOF
exit ;;
esac
+eval $set_cc_for_build
+cat >$dummy.c <<EOF
+#ifdef _SEQUENT_
+# include <sys/types.h>
+# include <sys/utsname.h>
+#endif
+main ()
+{
+#if defined (sony)
+#if defined (MIPSEB)
+ /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed,
+ I don't know.... */
+ printf ("mips-sony-bsd\n"); exit (0);
+#else
+#include <sys/param.h>
+ printf ("m68k-sony-newsos%s\n",
+#ifdef NEWSOS4
+ "4"
+#else
+ ""
+#endif
+ ); exit (0);
+#endif
+#endif
+
+#if defined (__arm) && defined (__acorn) && defined (__unix)
+ printf ("arm-acorn-riscix\n"); exit (0);
+#endif
+
+#if defined (hp300) && !defined (hpux)
+ printf ("m68k-hp-bsd\n"); exit (0);
+#endif
+
+#if defined (NeXT)
+#if !defined (__ARCHITECTURE__)
+#define __ARCHITECTURE__ "m68k"
+#endif
+ int version;
+ version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
+ if (version < 4)
+ printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
+ else
+ printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
+ exit (0);
+#endif
+
+#if defined (MULTIMAX) || defined (n16)
+#if defined (UMAXV)
+ printf ("ns32k-encore-sysv\n"); exit (0);
+#else
+#if defined (CMU)
+ printf ("ns32k-encore-mach\n"); exit (0);
+#else
+ printf ("ns32k-encore-bsd\n"); exit (0);
+#endif
+#endif
+#endif
+
+#if defined (__386BSD__)
+ printf ("i386-pc-bsd\n"); exit (0);
+#endif
+
+#if defined (sequent)
+#if defined (i386)
+ printf ("i386-sequent-dynix\n"); exit (0);
+#endif
+#if defined (ns32000)
+ printf ("ns32k-sequent-dynix\n"); exit (0);
+#endif
+#endif
+
+#if defined (_SEQUENT_)
+ struct utsname un;
+
+ uname(&un);
+
+ if (strncmp(un.version, "V2", 2) == 0) {
+ printf ("i386-sequent-ptx2\n"); exit (0);
+ }
+ if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
+ printf ("i386-sequent-ptx1\n"); exit (0);
+ }
+ printf ("i386-sequent-ptx\n"); exit (0);
+
+#endif
+
+#if defined (vax)
+# if !defined (ultrix)
+# include <sys/param.h>
+# if defined (BSD)
+# if BSD == 43
+ printf ("vax-dec-bsd4.3\n"); exit (0);
+# else
+# if BSD == 199006
+ printf ("vax-dec-bsd4.3reno\n"); exit (0);
+# else
+ printf ("vax-dec-bsd\n"); exit (0);
+# endif
+# endif
+# else
+ printf ("vax-dec-bsd\n"); exit (0);
+# endif
+# else
+ printf ("vax-dec-ultrix\n"); exit (0);
+# endif
+#endif
+
+#if defined (alliant) && defined (i860)
+ printf ("i860-alliant-bsd\n"); exit (0);
+#endif
+
+ exit (1);
+}
+EOF
+
+$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
+ { echo "$SYSTEM_NAME"; exit; }
+
+# Apollos put the system type in the environment.
+
+test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
+
+# Convex versions that predate uname can use getsysinfo(1)
+
+if [ -x /usr/convex/getsysinfo ]
+then
+ case `getsysinfo -f cpu_type` in
+ c1*)
+ echo c1-convex-bsd
+ exit ;;
+ c2*)
+ if getsysinfo -f scalar_acc
+ then echo c32-convex-bsd
+ else echo c2-convex-bsd
+ fi
+ exit ;;
+ c34*)
+ echo c34-convex-bsd
+ exit ;;
+ c38*)
+ echo c38-convex-bsd
+ exit ;;
+ c4*)
+ echo c4-convex-bsd
+ exit ;;
+ esac
+fi
+
cat >&2 <<EOF
$0: unable to guess system type
diff --git a/config.sub b/config.sub
index 66c5074..c765b34 100755
--- a/config.sub
+++ b/config.sub
@@ -1,8 +1,8 @@
#! /bin/sh
# Configuration validation subroutine script.
-# Copyright 1992-2014 Free Software Foundation, Inc.
+# Copyright 1992-2013 Free Software Foundation, Inc.
-timestamp='2014-07-28'
+timestamp='2013-04-24'
# This file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
@@ -68,7 +68,7 @@ Report bugs and patches to <config-patches(a)gnu.org>."
version="\
GNU config.sub ($timestamp)
-Copyright 1992-2014 Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -257,7 +257,7 @@ case $basic_machine in
| avr | avr32 \
| be32 | be64 \
| bfin \
- | c4x | c8051 | clipper \
+ | c4x | clipper \
| d10v | d30v | dlx | dsp16xx \
| epiphany \
| fido | fr30 | frv \
@@ -265,7 +265,6 @@ case $basic_machine in
| hexagon \
| i370 | i860 | i960 | ia64 \
| ip2k | iq2000 \
- | k1om \
| le32 | le64 \
| lm32 \
| m32c | m32r | m32rle | m68000 | m68k | m88k \
@@ -283,10 +282,8 @@ case $basic_machine in
| mips64vr5900 | mips64vr5900el \
| mipsisa32 | mipsisa32el \
| mipsisa32r2 | mipsisa32r2el \
- | mipsisa32r6 | mipsisa32r6el \
| mipsisa64 | mipsisa64el \
| mipsisa64r2 | mipsisa64r2el \
- | mipsisa64r6 | mipsisa64r6el \
| mipsisa64sb1 | mipsisa64sb1el \
| mipsisa64sr71k | mipsisa64sr71kel \
| mipsr5900 | mipsr5900el \
@@ -298,7 +295,8 @@ case $basic_machine in
| nds32 | nds32le | nds32be \
| nios | nios2 | nios2eb | nios2el \
| ns16k | ns32k \
- | open8 | or1k | or1knd | or32 \
+ | open8 \
+ | or1k | or32 \
| pdp10 | pdp11 | pj | pjl \
| powerpc | powerpc64 | powerpc64le | powerpcle \
| pyramid \
@@ -326,7 +324,7 @@ case $basic_machine in
c6x)
basic_machine=tic6x-unknown
;;
- m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
+ m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip)
basic_machine=$basic_machine-unknown
os=-none
;;
@@ -374,7 +372,7 @@ case $basic_machine in
| be32-* | be64-* \
| bfin-* | bs2000-* \
| c[123]* | c30-* | [cjt]90-* | c4x-* \
- | c8051-* | clipper-* | craynv-* | cydra-* \
+ | clipper-* | craynv-* | cydra-* \
| d10v-* | d30v-* | dlx-* \
| elxsi-* \
| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
@@ -383,7 +381,6 @@ case $basic_machine in
| hexagon-* \
| i*86-* | i860-* | i960-* | ia64-* \
| ip2k-* | iq2000-* \
- | k1om-* \
| le32-* | le64-* \
| lm32-* \
| m32c-* | m32r-* | m32rle-* \
@@ -403,10 +400,8 @@ case $basic_machine in
| mips64vr5900-* | mips64vr5900el-* \
| mipsisa32-* | mipsisa32el-* \
| mipsisa32r2-* | mipsisa32r2el-* \
- | mipsisa32r6-* | mipsisa32r6el-* \
| mipsisa64-* | mipsisa64el-* \
| mipsisa64r2-* | mipsisa64r2el-* \
- | mipsisa64r6-* | mipsisa64r6el-* \
| mipsisa64sb1-* | mipsisa64sb1el-* \
| mipsisa64sr71k-* | mipsisa64sr71kel-* \
| mipsr5900-* | mipsr5900el-* \
@@ -418,7 +413,6 @@ case $basic_machine in
| nios-* | nios2-* | nios2eb-* | nios2el-* \
| none-* | np1-* | ns16k-* | ns32k-* \
| open8-* \
- | or1k*-* \
| orion-* \
| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
@@ -800,7 +794,7 @@ case $basic_machine in
os=-mingw64
;;
mingw32)
- basic_machine=i686-pc
+ basic_machine=i386-pc
os=-mingw32
;;
mingw32ce)
@@ -828,10 +822,6 @@ case $basic_machine in
basic_machine=powerpc-unknown
os=-morphos
;;
- moxiebox)
- basic_machine=moxie-unknown
- os=-moxiebox
- ;;
msdos)
basic_machine=i386-pc
os=-msdos
@@ -840,7 +830,7 @@ case $basic_machine in
basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
;;
msys)
- basic_machine=i686-pc
+ basic_machine=i386-pc
os=-msys
;;
mvs)
@@ -1377,14 +1367,14 @@ case $os in
| -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
| -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
| -linux-newlib* | -linux-musl* | -linux-uclibc* \
- | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
+ | -uxpv* | -beos* | -mpeix* | -udk* \
| -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
| -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
| -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
| -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
| -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
| -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
- | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
+ | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
# Remember, each alternative MUST END IN *, to match a version number.
;;
-qnx*)
@@ -1556,9 +1546,6 @@ case $basic_machine in
c4x-* | tic4x-*)
os=-coff
;;
- c8051-*)
- os=-elf
- ;;
hexagon-*)
os=-elf
;;
@@ -1602,6 +1589,9 @@ case $basic_machine in
mips*-*)
os=-elf
;;
+ or1k-*)
+ os=-elf
+ ;;
or32-*)
os=-coff
;;
diff --git a/configure b/configure
index 0274c94..d4219e8 100755
--- a/configure
+++ b/configure
@@ -7540,7 +7540,7 @@ ia64-*-hpux*)
rm -rf conftest*
;;
-x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \
+x86_64-*kfreebsd*-gnu|x86_64-*linux*|ppc*-*linux*|powerpc*-*linux*| \
s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
# Find out which ABI we are using.
echo 'int i;' > conftest.$ac_ext
@@ -7558,10 +7558,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
x86_64-*linux*)
LD="${LD-ld} -m elf_i386"
;;
- powerpc64le-*linux*)
- LD="${LD-ld} -m elf32lppclinux"
- ;;
- powerpc64-*linux*)
+ ppc64-*linux*|powerpc64-*linux*)
LD="${LD-ld} -m elf32ppclinux"
;;
s390x-*linux*)
@@ -7580,10 +7577,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
x86_64-*linux*)
LD="${LD-ld} -m elf_x86_64"
;;
- powerpcle-*linux*)
- LD="${LD-ld} -m elf64lppc"
- ;;
- powerpc-*linux*)
+ ppc*-*linux*|powerpc*-*linux*)
LD="${LD-ld} -m elf64ppc"
;;
s390*-*linux*|s390*-*tpf*)
@@ -18166,8 +18160,8 @@ configdir=/$PACKAGE_NAME/config
schemadir=/$PACKAGE_NAME/schema
# default user, group
-defaultuser=nobody
-defaultgroup=nobody
+defaultuser=dirsrv
+defaultgroup=dirsrv
if test -z "$with_tmpfiles_d" ; then
if test -d $sysconfdir/tmpfiles.d ; then
diff --git a/m4/libtool.m4 b/m4/libtool.m4
index f12cfdf..56666f0 100644
--- a/m4/libtool.m4
+++ b/m4/libtool.m4
@@ -1312,7 +1312,7 @@ ia64-*-hpux*)
rm -rf conftest*
;;
-x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \
+x86_64-*kfreebsd*-gnu|x86_64-*linux*|ppc*-*linux*|powerpc*-*linux*| \
s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
# Find out which ABI we are using.
echo 'int i;' > conftest.$ac_ext
@@ -1326,10 +1326,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
x86_64-*linux*)
LD="${LD-ld} -m elf_i386"
;;
- powerpc64le-*linux*)
- LD="${LD-ld} -m elf32lppclinux"
- ;;
- powerpc64-*linux*)
+ ppc64-*linux*|powerpc64-*linux*)
LD="${LD-ld} -m elf32ppclinux"
;;
s390x-*linux*)
@@ -1348,10 +1345,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
x86_64-*linux*)
LD="${LD-ld} -m elf_x86_64"
;;
- powerpcle-*linux*)
- LD="${LD-ld} -m elf64lppc"
- ;;
- powerpc-*linux*)
+ ppc*-*linux*|powerpc*-*linux*)
LD="${LD-ld} -m elf64ppc"
;;
s390*-*linux*|s390*-*tpf*)
commit 44d47d566a912cf0ffbe51770ede3ea5a2cc0548
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Oct 20 17:47:43 2015 -0700
Ticket #48285 - The dirsrv user/group should be created in rpm %pre, and ideally with fixed uid/gid
Description: Adding user dirsrv (uid 389) and group dirsrv (gid 389)
if they do not exist. If the uid and the gid are in use, increase
one by one and find unused id for them. If they exists, no change
is made. The default user and group pair (nobody, nobody) is also
replaced with (dirsrv, dirsrv).
https://fedorahosted.org/389/ticket/48285
Reviewed by wibrown(a)redhat.com (Thank you, William!)
diff --git a/configure.ac b/configure.ac
index c6471a7..f683b1c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -328,8 +328,8 @@ configdir=/$PACKAGE_NAME/config
schemadir=/$PACKAGE_NAME/schema
# default user, group
-defaultuser=nobody
-defaultgroup=nobody
+defaultuser=dirsrv
+defaultgroup=dirsrv
if test -z "$with_tmpfiles_d" ; then
if test -d $sysconfdir/tmpfiles.d ; then
diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in
index b589b93..52a0245 100644
--- a/rpm/389-ds-base.spec.in
+++ b/rpm/389-ds-base.spec.in
@@ -274,6 +274,27 @@ if [ -n "$DEBUGPOSTTRANS" ] ; then
output=$DEBUGPOSTTRANS
output2=${DEBUGPOSTTRANS}.upgrade
fi
+
+has_dirsrv=`/usr/bin/egrep -i "^dirsrv\>" /etc/passwd` || :
+if [ "$has_dirsrv" = "" ]; then
+ dirsrv_uid=389
+ while [ "`getent passwd | awk -F: '{print $3}' | grep $dirsrv_uid`" != "" ]; do
+ dirsrv_uid=`expr $dirsrv_uid + 1`
+ done
+ echo "User dirsrv does not exist, create it with uid %dirsrv_uid." >> $output 2>&1 || :
+ /usr/sbin/useradd -c "389-ds-base" -u $dirsrv_uid \
+ -s /sbin/nologin -r -d /usr/share/dirsrv dirsrv 2> /dev/null || :
+ fi
+ has_dirsrv=`/usr/bin/egrep -i "^dirsrv\>" /etc/group` || :
+ if [ "$has_dirsrv" = "" ]; then
+ dirsrv_gid=389
+ while [ "`getent group | grep $dirsrv_gid`" != "" ]; do
+ dirsrv_gid=`expr $dirsrv_gid + 1`
+ done
+ echo "Group dirsrv does not exist, create it with uid %dirsrv_gid." >> $output 2>&1 || :
+ /usr/sbin/groupadd -g $dirsrv_gid -r dirsrv 2> /dev/null || :
+fi
+
echo looking for instances in %{_sysconfdir}/%{pkgname} > $output 2>&1 || :
instbase="%{_sysconfdir}/%{pkgname}"
for dir in $instbase/slapd-* ; do
1
0
dirsrvtests/tickets/ticket48312_test.py | 168 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/mep/mep.c | 18 ++-
ldap/servers/slapd/modrdn.c | 24 ++--
3 files changed, 197 insertions(+), 13 deletions(-)
New commits:
commit 6f8c5550733bd7aad116230813ec85975ae7d657
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Mon Oct 19 12:53:53 2015 -0400
Ticket 48312 - Crash when doing modrdn on managed entry
Bug Description: If performing a modrdn on a managed entry, where the new
rdn begins with a "+", the server will crash. This is
caused by the way MEP creates the new managed entry - where
it uses the rdn attribute value from the attribute,
and not the DN. So in this case the DN rdn value escapes
the "+", but it is not escaped in the rdn attribute in
the entry. Then the internal modrdn setup thinks it
is a multivalued RDN, and the first RDN ends up being null.
This actually generates an error, but we don't return an error
from slapi_rename_internal_set_pb_ext(), and the operation
is not set in the pblock. Then slapi_modrdn_internal_pb()
dereferences the operation struct, and we crash.
Fix Description: Instead when updating the managed entry during the modrdn
get the DN value from the DN(which is already escaped), and
not from the attribute value from the entry(which is not escaped).
Also improved the modrdn code to check for NULL operations
in the pblock, report an error, and not dereference them.
https://fedorahosted.org/389/ticket/48312
Reviewed by: nhosoi(Thanks!)
diff --git a/dirsrvtests/tickets/ticket48312_test.py b/dirsrvtests/tickets/ticket48312_test.py
new file mode 100644
index 0000000..0989279
--- /dev/null
+++ b/dirsrvtests/tickets/ticket48312_test.py
@@ -0,0 +1,168 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+installation1_prefix = None
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ global installation1_prefix
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Creating standalone instance ...
+ standalone = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ standalone.delete()
+ standalone.create()
+ standalone.open()
+
+ # Delete each instance in the end
+ def fin():
+ standalone.delete()
+
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ standalone.clearTmpDir(__file__)
+
+ return TopologyStandalone(standalone)
+
+
+def test_ticket48312(topology):
+ """
+ Configure managed entries plugins(tempalte/definition), then perform a
+ modrdn(deleteoldrdn 1), and make sure the server does not crash.
+ """
+
+ GROUP_OU = 'ou=groups,' + DEFAULT_SUFFIX
+ PEOPLE_OU = 'ou=people,' + DEFAULT_SUFFIX
+ USER_DN = 'uid=user1,ou=people,' + DEFAULT_SUFFIX
+ CONFIG_DN = 'cn=config,cn=' + PLUGIN_MANAGED_ENTRY + ',cn=plugins,cn=config'
+ TEMPLATE_DN = 'cn=MEP Template,' + DEFAULT_SUFFIX
+ USER_NEWRDN = 'uid=\+user1'
+
+ #
+ # First enable dynamic plugins
+ #
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-dynamic-plugins', 'on')])
+ except ldap.LDAPError as e:
+ ldap.fatal('Failed to enable dynamic plugin!' + e.message['desc'])
+ assert False
+ topology.standalone.plugins.enable(name=PLUGIN_MANAGED_ENTRY)
+
+ #
+ # Add our org units (they should already exist, but do it just in case)
+ #
+ try:
+ topology.standalone.add_s(Entry((PEOPLE_OU, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'people'})))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError as e:
+ log.fatal('test_mep: Failed to add people org unit: error ' + e.message['desc'])
+ assert False
+
+ try:
+ topology.standalone.add_s(Entry((GROUP_OU, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'ou': 'people'})))
+ except ldap.ALREADY_EXISTS:
+ pass
+ except ldap.LDAPError as e:
+ log.fatal('test_mep: Failed to add people org unit: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add the template entry
+ #
+ try:
+ topology.standalone.add_s(Entry((TEMPLATE_DN, {
+ 'objectclass': 'top mepTemplateEntry extensibleObject'.split(),
+ 'cn': 'MEP Template',
+ 'mepRDNAttr': 'cn',
+ 'mepStaticAttr': ['objectclass: posixGroup', 'objectclass: extensibleObject'],
+ 'mepMappedAttr': ['cn: $uid', 'uid: $cn', 'gidNumber: $uidNumber']
+ })))
+ except ldap.LDAPError as e:
+ log.fatal('test_mep: Failed to add template entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add the definition entry
+ #
+ try:
+ topology.standalone.add_s(Entry((CONFIG_DN, {
+ 'objectclass': 'top extensibleObject'.split(),
+ 'cn': 'config',
+ 'originScope': PEOPLE_OU,
+ 'originFilter': 'objectclass=posixAccount',
+ 'managedBase': GROUP_OU,
+ 'managedTemplate': TEMPLATE_DN
+ })))
+ except ldap.LDAPError as e:
+ log.fatal('test_mep: Failed to add config entry: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Add an entry that meets the MEP scope
+ #
+ try:
+ topology.standalone.add_s(Entry((USER_DN, {
+ 'objectclass': 'top posixAccount extensibleObject'.split(),
+ 'uid': 'user1',
+ 'cn': 'user1',
+ 'uidNumber': '1',
+ 'gidNumber': '1',
+ 'homeDirectory': '/home/user1',
+ 'description': 'uiser description'
+ })))
+ except ldap.LDAPError as e:
+ log.fatal('test_mep: Failed to user1: error ' + e.message['desc'])
+ assert False
+
+ #
+ # Perform a modrdn on USER_DN
+ #
+ try:
+ topology.standalone.rename_s(USER_DN, USER_NEWRDN, delold=1)
+ except ldap.LDAPError as e:
+ log.error('Failed to modrdn: error ' + e.message['desc'])
+ assert False
+
+ log.info('Test complete')
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
\ No newline at end of file
diff --git a/ldap/servers/plugins/mep/mep.c b/ldap/servers/plugins/mep/mep.c
index 4399851..46acb4b 100644
--- a/ldap/servers/plugins/mep/mep.c
+++ b/ldap/servers/plugins/mep/mep.c
@@ -1309,19 +1309,29 @@ mep_create_managed_entry(struct configEntry *config, Slapi_Entry *origin)
goto done;
} else {
/* Build the DN and set it in the entry. */
- char *dn = NULL;
+ char **rdn_vals = NULL;
char *rdn_val = NULL;
+ char *dn = NULL;
/* If an origin entry was supplied, the RDN value will be
* the mapped value. If no origin entry was supplied, the
* value will be the mapping rule from the template. */
- rdn_val = slapi_entry_attr_get_charptr(managed_entry, rdn_type);
+ if (origin){
+ const char *origin_dn = slapi_entry_get_dn(origin);
+ rdn_vals = slapi_ldap_explode_dn(origin_dn, 1);
+ rdn_val = rdn_vals[0];
+ } else {
+ rdn_val = slapi_entry_attr_get_charptr(managed_entry, rdn_type);
+ }
/* Create the DN using the mapped RDN value
* and the base specified in the config. */
dn = slapi_ch_smprintf("%s=%s,%s", rdn_type, rdn_val, config->managed_base);
-
- slapi_ch_free_string(&rdn_val);
+ if(origin){
+ slapi_ldap_value_free(rdn_vals);
+ } else {
+ slapi_ch_free_string(&rdn_val);
+ }
if (dn != NULL) {
slapi_sdn_set_dn_passin(slapi_entry_get_sdn(managed_entry), dn);
diff --git a/ldap/servers/slapd/modrdn.c b/ldap/servers/slapd/modrdn.c
index 798d3d4..e80e1f9 100644
--- a/ldap/servers/slapd/modrdn.c
+++ b/ldap/servers/slapd/modrdn.c
@@ -338,20 +338,26 @@ slapi_rename_internal_set_pb_ext(Slapi_PBlock *pb,
static int rename_internal_pb (Slapi_PBlock *pb)
{
- LDAPControl **controls;
- Operation *op;
- int opresult = 0;
+ LDAPControl **controls;
+ Operation *op;
+ int opresult = 0;
PR_ASSERT (pb != NULL);
slapi_pblock_get(pb, SLAPI_CONTROLS_ARG, &controls);
-
- slapi_pblock_get(pb, SLAPI_OPERATION, &op);
- op->o_handler_data = &opresult;
- op->o_result_handler = internal_getresult_callback;
+ slapi_pblock_get(pb, SLAPI_OPERATION, &op);
+ if (!op) {
+ opresult = 1;
+ slapi_pblock_set(pb, SLAPI_PLUGIN_INTOP_RESULT, &opresult);
+ slapi_log_error(SLAPI_LOG_FATAL, "rename_internal_pb",
+ "Internal error: pblock was not properly initialized\n");
+ return -1;
+ }
+ op->o_handler_data = &opresult;
+ op->o_result_handler = internal_getresult_callback;
slapi_pblock_set(pb, SLAPI_REQCONTROLS, controls);
-
+
/* set parameters common for all internal operations */
set_common_params (pb);
@@ -359,7 +365,7 @@ static int rename_internal_pb (Slapi_PBlock *pb)
set_config_params (pb);
op_shared_rename (pb, 0 /* not passing ownership of args */ );
-
+
slapi_pblock_set(pb, SLAPI_PLUGIN_INTOP_RESULT, &opresult);
return 0;
1
0
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
New commits:
commit bdaed4e2fb4633d6fec16eb1ea55b7e2fcbd4df4
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Mon Oct 19 11:03:54 2015 +0200
Ticket 47978: Deadlock between two MODs on the same entry between entry cache and backend lock
Bug Description:
During a modify, the modified entry gets into the entry cache and is locked.
If after the be_txn_postop/txn_commit and before the modify returns
the modified entry gets out of the entry cache, the entry is not unlocked.
It can lead to hang as soon as an other write operation hit that unlocked entry.
This is a side effect of fix:
#47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Fix Description:
When the entry is locked, set a flag so that can later be unlocked
independently of its presence in the entry cache
https://fedorahosted.org/389/ticket/47978
Reviewed by: Noriko Hosoi (Thanks Noriko)
Platforms tested: F22 (IPA CI test test_integration/test_vault.py, one failure out 2-4)
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modify.c b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
index 69bf246..bfcaf3d 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modify.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
@@ -387,6 +387,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
int repl_op;
int opreturn = 0;
int mod_count = 0;
+ int ec_locked = 0;
slapi_pblock_get( pb, SLAPI_BACKEND, &be);
slapi_pblock_get( pb, SLAPI_PLUGIN_PRIVATE, &li );
@@ -745,6 +746,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
/* lock new entry in cache to prevent usage until we are complete */
cache_lock_entry( &inst->inst_cache, ec );
+ ec_locked = 1;
postentry = slapi_entry_dup( ec->ep_entry );
slapi_pblock_set( pb, SLAPI_ENTRY_POST_OP, postentry );
@@ -861,7 +863,7 @@ common_return:
slapi_mods_done(&smods);
if(inst){
- if (cache_is_in_cache( &inst->inst_cache, ec))
+ if (ec_locked || cache_is_in_cache( &inst->inst_cache, ec))
{
cache_unlock_entry( &inst->inst_cache, ec);
} else if (e) {
1
0
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
New commits:
commit 68445928510b48570cafef8badab46062d316006
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Fri Oct 16 18:18:01 2015 +0200
Ticket 47978: Deadlock between two MODs on the same entry between entry cache and backend lock
Bug Description:
During a modify, the modified entry gets into the entry cache and is locked.
If after the be_txn_postop/txn_commit and before the modify returns
the modified entry gets out of the entry cache, the entry is not unlocked.
It can lead to hang as soon as an other write operation hit that unlocked entry.
This is a side effect of fix:
#47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Fix Description:
When the entry is locked, set a flag so that can later be unlocked
independently of its presence in the entry cache
https://fedorahosted.org/389/ticket/47978
Reviewed by: Noriko Hosoi (Thanks Noriko)
Platforms tested: F22 (IPA CI test test_integration/test_vault.py, one failure out 2-4)
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modify.c b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
index b9f754d..80ffce4 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modify.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
@@ -420,6 +420,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
int mod_count = 0;
int not_an_error = 0;
int fixup_tombstone = 0;
+ int ec_locked = 0;
slapi_pblock_get( pb, SLAPI_BACKEND, &be);
slapi_pblock_get( pb, SLAPI_PLUGIN_PRIVATE, &li );
@@ -827,6 +828,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
CACHE_RETURN( &inst->inst_cache, &e );
/* lock new entry in cache to prevent usage until we are complete */
cache_lock_entry( &inst->inst_cache, ec );
+ ec_locked = 1;
postentry = slapi_entry_dup( ec->ep_entry );
slapi_pblock_set( pb, SLAPI_ENTRY_POST_OP, postentry );
@@ -947,7 +949,7 @@ common_return:
slapi_mods_done(&smods);
if (inst) {
- if (cache_is_in_cache(&inst->inst_cache, ec)) {
+ if (ec_locked || cache_is_in_cache(&inst->inst_cache, ec)) {
cache_unlock_entry(&inst->inst_cache, ec);
} else if (e) {
/* if ec was not in cache, cache_replace was not done.
1
0
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
New commits:
commit f27c164a1e04d76ec2cff0422e3073077d2f7cb8
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Fri Oct 16 18:18:01 2015 +0200
Ticket 47978: Deadlock between two MODs on the same entry between entry cache and backend lock
Bug Description:
During a modify, the modified entry gets into the entry cache and is locked.
If after the be_txn_postop/txn_commit and before the modify returns
the modified entry gets out of the entry cache, the entry is not unlocked.
It can lead to hang as soon as an other write operation hit that unlocked entry.
This is a side effect of fix:
#47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Fix Description:
When the entry is locked, set a flag so that can later be unlocked
independently of its presence in the entry cache
https://fedorahosted.org/389/ticket/47978
Reviewed by: Noriko Hosoi (Thanks Noriko)
Platforms tested: F22 (IPA CI test test_integration/test_vault.py, one failure out 2-4)
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modify.c b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
index 2682bcf..83b7b55 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modify.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
@@ -391,6 +391,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
int mod_count = 0;
int not_an_error = 0;
int fixup_tombstone = 0;
+ int ec_locked = 0;
slapi_pblock_get( pb, SLAPI_BACKEND, &be);
slapi_pblock_get( pb, SLAPI_PLUGIN_PRIVATE, &li );
@@ -799,6 +800,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
CACHE_RETURN( &inst->inst_cache, &e );
/* lock new entry in cache to prevent usage until we are complete */
cache_lock_entry( &inst->inst_cache, ec );
+ ec_locked = 1;
postentry = slapi_entry_dup( ec->ep_entry );
slapi_pblock_set( pb, SLAPI_ENTRY_POST_OP, postentry );
@@ -919,7 +921,7 @@ common_return:
slapi_mods_done(&smods);
if (inst) {
- if (cache_is_in_cache(&inst->inst_cache, ec)) {
+ if (ec_locked || cache_is_in_cache(&inst->inst_cache, ec)) {
cache_unlock_entry(&inst->inst_cache, ec);
} else if (e) {
/* if ec was not in cache, cache_replace was not done.
1
0
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
New commits:
commit f1e30b0fdc06f8e8916c195cc9ff2b3c81fb8ece
Author: Thierry Bordaz <tbordaz(a)redhat.com>
Date: Fri Oct 16 18:18:01 2015 +0200
Ticket 47978: Deadlock between two MODs on the same entry between entry cache and backend lock
Bug Description:
During a modify, the modified entry gets into the entry cache and is locked.
If after the be_txn_postop/txn_commit and before the modify returns
the modified entry gets out of the entry cache, the entry is not unlocked.
It can lead to hang as soon as an other write operation hit that unlocked entry.
This is a side effect of fix:
#47834 - Tombstone_to_glue: if parents are also converted to glue, the target entry's DN must be adjusted.
Fix Description:
When the entry is locked, set a flag so that can later be unlocked
independently of its presence in the entry cache
https://fedorahosted.org/389/ticket/47978
Reviewed by: Noriko Hosoi (Thanks Noriko)
Platforms tested: F22 (IPA CI test test_integration/test_vault.py, one failure out 2-4)
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modify.c b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
index 2682bcf..83b7b55 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modify.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
@@ -391,6 +391,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
int mod_count = 0;
int not_an_error = 0;
int fixup_tombstone = 0;
+ int ec_locked = 0;
slapi_pblock_get( pb, SLAPI_BACKEND, &be);
slapi_pblock_get( pb, SLAPI_PLUGIN_PRIVATE, &li );
@@ -799,6 +800,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
CACHE_RETURN( &inst->inst_cache, &e );
/* lock new entry in cache to prevent usage until we are complete */
cache_lock_entry( &inst->inst_cache, ec );
+ ec_locked = 1;
postentry = slapi_entry_dup( ec->ep_entry );
slapi_pblock_set( pb, SLAPI_ENTRY_POST_OP, postentry );
@@ -919,7 +921,7 @@ common_return:
slapi_mods_done(&smods);
if (inst) {
- if (cache_is_in_cache(&inst->inst_cache, ec)) {
+ if (ec_locked || cache_is_in_cache(&inst->inst_cache, ec)) {
cache_unlock_entry(&inst->inst_cache, ec);
} else if (e) {
/* if ec was not in cache, cache_replace was not done.
1
0
ldap/admin/src/scripts/DSCreate.pm.in | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 72a638098626bb84d9c7f2c233c1231d3b539f27
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 11:43:36 2015 -0700
Ticket #48305 - perl module conditional test is not conditional when checking SELinux policies
Description: If sestatus reports SELinux is disabled, SELinux commands
such as semanage and restorecon fail. This patch checks the availability
and only if the status says SELinux is enabled, it calls the SELinux
commands.
https://fedorahosted.org/389/ticket/48305
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 9fefc13c02c9ae037fad053152193794706aaa31)
(cherry picked from commit 2a05a3a75ce082a28375cb2f687739d7474164a1)
(cherry picked from commit b20756b735cf62763822ba93d892608e7a715b18)
diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in
index 30de40e..76d2e88 100644
--- a/ldap/admin/src/scripts/DSCreate.pm.in
+++ b/ldap/admin/src/scripts/DSCreate.pm.in
@@ -969,9 +969,11 @@ sub setDefaults {
sub updateSelinuxPolicy {
my $inf = shift;
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
# if selinux is not available, do nothing
- if ("@with_selinux@") {
+ if ("@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
my $localstatedir = $inf->{slapd}->{localstatedir};
# run restorecon on all of the parent directories we
@@ -1375,7 +1377,9 @@ sub removeDSInstance {
}
# remove the selinux label from the ports if needed
- if ("@with_selinux@") {
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
+ if ("@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
foreach my $port (@{$entry->{"nsslapd-port"}})
{
my $semanage_err = `semanage port -d -t ldap_port_t -p tcp $port 2>&1`;
1
0
ldap/admin/src/scripts/DSCreate.pm.in | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit b20756b735cf62763822ba93d892608e7a715b18
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 11:43:36 2015 -0700
Ticket #48305 - perl module conditional test is not conditional when checking SELinux policies
Description: If sestatus reports SELinux is disabled, SELinux commands
such as semanage and restorecon fail. This patch checks the availability
and only if the status says SELinux is enabled, it calls the SELinux
commands.
https://fedorahosted.org/389/ticket/48305
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 9fefc13c02c9ae037fad053152193794706aaa31)
(cherry picked from commit 2a05a3a75ce082a28375cb2f687739d7474164a1)
diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in
index 58408c1..1b5e2aa 100644
--- a/ldap/admin/src/scripts/DSCreate.pm.in
+++ b/ldap/admin/src/scripts/DSCreate.pm.in
@@ -984,9 +984,11 @@ sub setDefaults {
sub updateSelinuxPolicy {
my $inf = shift;
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
# if selinux is not available, do nothing
- if ("@with_selinux@") {
+ if ("@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
my $localstatedir = $inf->{slapd}->{localstatedir};
# run restorecon on all of the parent directories we
@@ -1431,7 +1433,9 @@ sub removeDSInstance {
}
# remove the selinux label from the ports if needed
- if ("@with_selinux@") {
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
+ if ("@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
foreach my $port (@{$entry->{"nsslapd-port"}})
{
my $semanage_err;
1
0
ldap/admin/src/scripts/DSCreate.pm.in | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 2a05a3a75ce082a28375cb2f687739d7474164a1
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 11:43:36 2015 -0700
Ticket #48305 - perl module conditional test is not conditional when checking SELinux policies
Description: If sestatus reports SELinux is disabled, SELinux commands
such as semanage and restorecon fail. This patch checks the availability
and only if the status says SELinux is enabled, it calls the SELinux
commands.
https://fedorahosted.org/389/ticket/48305
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit 9fefc13c02c9ae037fad053152193794706aaa31)
diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in
index cdde339..3ce5a73 100644
--- a/ldap/admin/src/scripts/DSCreate.pm.in
+++ b/ldap/admin/src/scripts/DSCreate.pm.in
@@ -956,9 +956,11 @@ sub setDefaults {
sub updateSelinuxPolicy {
my $inf = shift;
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
# if selinux is not available, do nothing
- if ((getLogin() eq 'root') and "@with_selinux@") {
+ if ((getLogin() eq 'root') and "@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
my $localstatedir = $inf->{slapd}->{localstatedir};
# run restorecon on all of the parent directories we
@@ -1404,7 +1406,9 @@ sub removeDSInstance {
}
# remove the selinux label from the ports if needed
- if ((getLogin() eq 'root') and "@with_selinux@") {
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
+ if ((getLogin() eq 'root') and "@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
foreach my $port (@{$entry->{"nsslapd-port"}})
{
my $semanage_err;
1
0
ldap/admin/src/scripts/DSCreate.pm.in | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 9fefc13c02c9ae037fad053152193794706aaa31
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 11:43:36 2015 -0700
Ticket #48305 - perl module conditional test is not conditional when checking SELinux policies
Description: If sestatus reports SELinux is disabled, SELinux commands
such as semanage and restorecon fail. This patch checks the availability
and only if the status says SELinux is enabled, it calls the SELinux
commands.
https://fedorahosted.org/389/ticket/48305
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in
index cdde339..3ce5a73 100644
--- a/ldap/admin/src/scripts/DSCreate.pm.in
+++ b/ldap/admin/src/scripts/DSCreate.pm.in
@@ -956,9 +956,11 @@ sub setDefaults {
sub updateSelinuxPolicy {
my $inf = shift;
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
# if selinux is not available, do nothing
- if ((getLogin() eq 'root') and "@with_selinux@") {
+ if ((getLogin() eq 'root') and "@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
my $localstatedir = $inf->{slapd}->{localstatedir};
# run restorecon on all of the parent directories we
@@ -1404,7 +1406,9 @@ sub removeDSInstance {
}
# remove the selinux label from the ports if needed
- if ((getLogin() eq 'root') and "@with_selinux@") {
+ my $mydevnull = (-f "/dev/null" ? " /dev/null " : " NUL ");
+ if ((getLogin() eq 'root') and "@with_selinux@" and
+ -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
foreach my $port (@{$entry->{"nsslapd-port"}})
{
my $semanage_err;
1
0
ldap/servers/slapd/add.c | 6 ++----
ldap/servers/slapd/back-ldbm/ldbm_add.c | 19 ++++++++++++++-----
2 files changed, 16 insertions(+), 9 deletions(-)
New commits:
commit 265c6e399016ad4a46c8709d32367b9c30ea57cf
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Oct 12 15:24:55 2015 -0700
Ticket #48287 - Double free while adding entries (1.2.11 only)
Description: If a callback at SLAPI_PLUGIN_BE_TXN_*_ADD_FN fails and the
adding-entry is in a cache, the ldbm_back_add is supposed to remove the
adding-entry from the cache and free it. The issue was fixed in 1.3.1
and newer by these tickets:
Ticket #47808 - If be_txn plugin fails in ldbm_back_add, adding entry is double freed.
Ticket #47815 - Add operations rejected by betxn plugins remain in cache
which were not backported to 1.2.11.
https://fedorahosted.org/389/ticket/48287
Reviewed by tbordaz(a)redhat.com (Thank you, Thierry!!)
diff --git a/ldap/servers/slapd/add.c b/ldap/servers/slapd/add.c
index 0198b1c..9f0bbc0 100644
--- a/ldap/servers/slapd/add.c
+++ b/ldap/servers/slapd/add.c
@@ -726,10 +726,8 @@ static void op_shared_add (Slapi_PBlock *pb)
}
else
{
- /* restore e so we can free it below */
- if (save_e) {
- e = save_e;
- }
+ /* PR_ASSERT(!save_e); save_e is supposed to be freed in the backend. */
+ e = save_e;
if (rc == SLAPI_FAIL_DISKFULL)
{
operation_out_of_disk_space();
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c b/ldap/servers/slapd/back-ldbm/ldbm_add.c
index f27e78d..3397c0f 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_add.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c
@@ -108,7 +108,6 @@ ldbm_back_add( Slapi_PBlock *pb )
Slapi_DN parentsdn;
Slapi_Operation *operation;
int dblock_acquired= 0;
- int is_remove_from_cache= 0;
int is_replicated_operation= 0;
int is_resurect_operation= 0;
int is_tombstone_operation= 0;
@@ -1174,7 +1173,20 @@ diskfull_return:
}
slapi_pblock_get(pb, SLAPI_PB_RESULT_TEXT, &ldap_result_message);
}
-
+ if ( addingentry ) {
+ if (inst && cache_is_in_cache(&inst->inst_cache, addingentry)) {
+ CACHE_REMOVE(&inst->inst_cache, addingentry);
+ /* tell frontend not to free this entry */
+ slapi_pblock_set(pb, SLAPI_ADD_ENTRY, NULL);
+ }
+ else if (!cache_has_otherref(&inst->inst_cache, addingentry))
+ {
+ if (!is_resurect_operation) { /* if resurect, tombstoneentry is dupped. */
+ backentry_clear_entry(addingentry); /* e is released in the frontend */
+ }
+ }
+ CACHE_RETURN( &inst->inst_cache, &addingentry );
+ }
if (!noabort) {
dblayer_txn_abort(li,&txn); /* abort crashes in case disk full */
}
@@ -1226,9 +1238,6 @@ common_return:
}
}
}
- if (is_remove_from_cache) {
- CACHE_REMOVE(&inst->inst_cache, addingentry);
- }
CACHE_RETURN( &inst->inst_cache, &addingentry );
}
}
1
0
13 Oct '15
dirsrvtests/suites/acl/acl_test.py | 953 +++++++++++++++-
dirsrvtests/tickets/ticket47553_ger.py | 553 ---------
dirsrvtests/tickets/ticket47553_rdn_write_test.py | 135 --
dirsrvtests/tickets/ticket47553_single_aci_test.py | 1224 ---------------------
4 files changed, 929 insertions(+), 1936 deletions(-)
New commits:
commit 8b097d1c40facaa3e4d93293bffb3a5e322227a2
Author: Simon Pichugin <spichugi(a)redhat.com>
Date: Wed Sep 2 11:27:36 2015 +0200
Ticket 48264 - Ticket 47553 tests refactoring
Description: Refactor these tests according to the pytest and PEP8 way:
- ticket47553_ger.py;
- ticket47553_rdn_write_test.py;
- ticket47553_single_aci_test.py.
Move them to the dirsrvtests/suites/acl/acl_test.py test suite.
https://fedorahosted.org/389/ticket/48264
Reviewed by: mreynolds(a)redhat.com (Thanks!)
(cherry picked from commit edaa28b1266312ef8dce737af46e09e130c7135a)
diff --git a/dirsrvtests/suites/acl/acl_test.py b/dirsrvtests/suites/acl/acl_test.py
index b85ee22..fd1092b 100644
--- a/dirsrvtests/suites/acl/acl_test.py
+++ b/dirsrvtests/suites/acl/acl_test.py
@@ -10,48 +10,167 @@ from lib389._constants import *
from lib389.properties import *
from lib389.tasks import *
from lib389.utils import *
+from ldap.controls.simple import GetEffectiveRightsControl
logging.getLogger(__name__).setLevel(logging.DEBUG)
log = logging.getLogger(__name__)
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
installation1_prefix = None
+installation2_prefix = None
+TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
-class TopologyStandalone(object):
- def __init__(self, standalone):
- standalone.open()
- self.standalone = standalone
+STAGING_CN = "staged user"
+PRODUCTION_CN = "accounts"
+EXCEPT_CN = "excepts"
+
+STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
+PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
+PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
+
+STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
+PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
+BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
+BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
+
+BIND_CN = "bind_entry"
+BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
+BIND_PW = "password"
+
+NEW_ACCOUNT = "new_account"
+MAX_ACCOUNTS = 20
+
+CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
+
+SRC_ENTRY_CN = "tuser"
+EXT_RDN = "01"
+DST_ENTRY_CN = SRC_ENTRY_CN + EXT_RDN
+
+SRC_ENTRY_DN = "cn=%s,%s" % (SRC_ENTRY_CN, SUFFIX)
+DST_ENTRY_DN = "cn=%s,%s" % (DST_ENTRY_CN, SUFFIX)
+
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
@pytest.fixture(scope="module")
def topology(request):
+ """This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ """
+
global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
- # Creating standalone instance ...
- standalone = DirSrv(verbose=False)
- args_instance[SER_HOST] = HOST_STANDALONE
- args_instance[SER_PORT] = PORT_STANDALONE
- args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
- args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
- args_standalone = args_instance.copy()
- standalone.allocate(args_standalone)
- instance_standalone = standalone.exists()
- if instance_standalone:
- standalone.delete()
- standalone.create()
- standalone.open()
-
- # Delete each instance in the end
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ instance_master2 = master2.exists()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX,
+ role=REPLICAROLE_MASTER,
+ replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX,
+ role=REPLICAROLE_MASTER,
+ replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ repl_agreement = master1.agreement.create(suffix=SUFFIX,
+ host=master2.host,
+ port=master2.port,
+ properties=properties)
+
+ if not repl_agreement:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % repl_agreement)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=SUFFIX,
+ host=master1.host,
+ port=master1.port,
+ properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(repl_agreement)
+
+ # Check replication is working fine
+ if master1.testReplication(DEFAULT_SUFFIX, master2):
+ log.info('Replication is working.')
+ else:
+ log.fatal('Replication is not working.')
+ assert False
+
def fin():
- standalone.delete()
+ master1.delete()
+ master2.delete()
request.addfinalizer(fin)
- # Clear out the tmp dir
- standalone.clearTmpDir(__file__)
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
- return TopologyStandalone(standalone)
+ # Here we have two instances master and consumer
+ # with replication working.
+ return TopologyMaster1Master2(master1, master2)
def add_attr(topology, attr_name):
@@ -127,7 +246,7 @@ def test_aci_attr_subtype_targetattr(topology, aci_with_attr_subtype):
log.info(" Search for the added attribute")
try:
- entries = topology.standalone.search_s(DEFAULT_SUFFIX,
+ entries = topology.master1.search_s(DEFAULT_SUFFIX,
ldap.SCOPE_BASE,
'(objectclass=*)', ['aci'])
entry = str(entries[0])
@@ -139,6 +258,792 @@ def test_aci_attr_subtype_targetattr(topology, aci_with_attr_subtype):
assert False
+def _bind_manager(topology):
+ topology.master1.log.info("Bind as %s " % DN_DM)
+ topology.master1.simple_bind_s(DN_DM, PASSWORD)
+
+
+def _bind_normal(topology):
+ # bind as bind_entry
+ topology.master1.log.info("Bind as %s" % BIND_DN)
+ topology.master1.simple_bind_s(BIND_DN, BIND_PW)
+
+
+def _moddn_aci_deny_tree(topology, mod_type=None,
+ target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
+ """It denies the access moddn_to in cn=except,cn=accounts,SUFFIX"""
+
+ assert mod_type is not None
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ #topology.master1.modify_s(SUFFIX, mod)
+ topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
+ topology.master1.modify_s(PROD_EXCEPT_DN, mod)
+
+
+def _write_aci_staging(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % STAGING_DN
+ ACI_ALLOW = "(version 3.0; acl \"write staging entries\"; allow (write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+
+def _write_aci_production(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % PRODUCTION_DN
+ ACI_ALLOW = "(version 3.0; acl \"write production entries\"; allow (write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+
+def _moddn_aci_staging_to_production(topology, mod_type=None,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN):
+ assert mod_type is not None
+
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+ _write_aci_staging(topology, mod_type=mod_type)
+
+
+def _moddn_aci_from_production_to_staging(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (
+ PRODUCTION_DN, STAGING_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+ _write_aci_production(topology, mod_type=mod_type)
+
+
+(a)pytest.fixture(scope="module")
+def moddn_setup(topology):
+ """Creates
+ - a staging DIT
+ - a production DIT
+ - add accounts in staging DIT
+ - enable ACL logging (commented for performance reason)
+ """
+
+ topology.master1.log.info("\n\n######## INITIALIZATION ########\n")
+
+ # entry used to bind with
+ topology.master1.log.info("Add %s" % BIND_DN)
+ topology.master1.add_s(Entry((BIND_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': BIND_CN,
+ 'cn': BIND_CN,
+ 'userpassword': BIND_PW})))
+
+ # DIT for staging
+ topology.master1.log.info("Add %s" % STAGING_DN)
+ topology.master1.add_s(Entry((STAGING_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': STAGING_CN,
+ 'description': "staging DIT"})))
+
+ # DIT for production
+ topology.master1.log.info("Add %s" % PRODUCTION_DN)
+ topology.master1.add_s(Entry((PRODUCTION_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': PRODUCTION_CN,
+ 'description': "production DIT"})))
+
+ # DIT for production/except
+ topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
+ topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': EXCEPT_CN,
+ 'description': "production except DIT"})))
+
+ # enable acl error logging
+ #mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
+ #topology.master1.modify_s(DN_CONFIG, mod)
+ #topology.master2.modify_s(DN_CONFIG, mod)
+
+ # add dummy entries in the staging DIT
+ for cpt in range(MAX_ACCOUNTS):
+ name = "%s%d" % (NEW_ACCOUNT, cpt)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+
+
+def test_mode_default_add_deny(topology, moddn_setup):
+ """This test case checks
+ that the ADD operation fails (no ADD aci on production)
+ """
+
+ topology.master1.log.info("\n\n######## mode moddn_aci : ADD (should fail) ########\n")
+
+ _bind_normal(topology)
+
+ #
+ # First try to add an entry in production => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
+ name = "%s%d" % (NEW_ACCOUNT, 0)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+ assert 0 # this is an error, we should not be allowed to add an entry in production
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+def test_mode_default_delete_deny(topology, moddn_setup):
+ """This test case checks
+ that the DEL operation fails (no 'delete' aci on production)
+ """
+
+ topology.master1.log.info("\n\n######## DELETE (should fail) ########\n")
+
+ _bind_normal(topology)
+ #
+ # Second try to delete an entry in staging => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to delete %s" % STAGING_DN)
+ name = "%s%d" % (NEW_ACCOUNT, 0)
+ topology.master1.delete_s("cn=%s,%s" % (name, STAGING_DN))
+ assert 0 # this is an error, we should not be allowed to add an entry in production
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+(a)pytest.mark.parametrize("index,tfrom,tto,failure",
+ [(0, STAGING_DN, PRODUCTION_DN, False),
+ (1, STAGING_DN, PRODUCTION_DN, False),
+ (2, STAGING_DN, BAD_PRODUCTION_PATTERN, True),
+ (3, STAGING_PATTERN, PRODUCTION_DN, False),
+ (4, BAD_STAGING_PATTERN, PRODUCTION_DN, True),
+ (5, STAGING_PATTERN, PRODUCTION_PATTERN, False),
+ (6, None, PRODUCTION_PATTERN, False),
+ (7, STAGING_PATTERN, None, False),
+ (8, None, None, False)])
+def test_moddn_staging_prod(topology, moddn_setup,
+ index, tfrom, tto, failure):
+ """This test case MOVE entry NEW_ACCOUNT0 from staging to prod
+ target_to/target_from: equality filter
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (%s) ########\n" % index)
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s%s" % (NEW_ACCOUNT, index)
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=tfrom, target_to=tto)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ if failure:
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=tfrom, target_to=tto)
+ _bind_normal(topology)
+
+
+def test_moddn_staging_prod_9(topology, moddn_setup):
+ """This test case disable the 'moddn' right so a MODDN requires a 'add' right
+ to be successfull.
+ It fails to MOVE entry NEW_ACCOUNT9 from staging to prod.
+ Add a 'add' right to prod.
+ Then it succeeds to MOVE NEW_ACCOUNT9 from staging to prod.
+
+ Then enable the 'moddn' right so a MODDN requires a 'moddn' right
+ It fails to MOVE entry NEW_ACCOUNT10 from staging to prod.
+ Add a 'moddn' right to prod.
+ Then it succeeds to MOVE NEW_ACCOUNT10 from staging to prod.
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (9) ########\n")
+
+ _bind_normal(topology)
+ old_rdn = "cn=%s9" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ #############
+ # Now do tests with no support of moddn aci
+ #############
+ topology.master1.log.info("Disable the moddn right")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+ # Add the moddn aci that will not be evaluated because of the config flag
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ # It will fail because it will test the ADD right
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # remove the moddn aci
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ #
+ # add the 'add' right to the production DN
+ # Then do a successfull moddn
+ #
+ ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_ALLOW + ACI_SUBJECT
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ #############
+ # Now do tests with support of moddn aci
+ #############
+ topology.master1.log.info("Enable the moddn right")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'on')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (10) ########\n")
+
+ _bind_normal(topology)
+ old_rdn = "cn=%s10" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ #
+ # add the 'add' right to the production DN
+ # Then do a failing moddn
+ #
+ ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_ALLOW + ACI_SUBJECT
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ # Add the moddn aci that will be evaluated because of the config flag
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ # remove the moddn aci
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_moddn_prod_staging(topology, moddn_setup):
+ """This test checks that we can move ACCOUNT11 from staging to prod
+ but not move back ACCOUNT11 from prod to staging
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (11) ########\n")
+
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s11" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ # Now check we can not move back the entry to staging
+ old_rdn = "cn=%s11" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, PRODUCTION_DN)
+ new_rdn = old_rdn
+ new_superior = STAGING_DN
+
+ # add the write right because we want to check the moddn
+ _bind_manager(topology)
+ _write_aci_production(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to move back MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ _bind_manager(topology)
+ _write_aci_production(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_check_repl_M2_to_M1(topology, moddn_setup):
+ """Checks that replication is still working M2->M1, using ACCOUNT12"""
+
+ topology.master1.log.info("Bind as %s (M2)" % DN_DM)
+ topology.master2.simple_bind_s(DN_DM, PASSWORD)
+
+ rdn = "cn=%s12" % NEW_ACCOUNT
+ dn = "%s,%s" % (rdn, STAGING_DN)
+
+ # First wait for the ACCOUNT19 entry being replicated on M2
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ assert loop <= 10
+
+ attribute = 'description'
+ tested_value = 'Hello world'
+ mod = [(ldap.MOD_ADD, attribute, tested_value)]
+ topology.master1.log.info("Update (M2) %s (%s)" % (dn, attribute))
+ topology.master2.modify_s(dn, mod)
+
+ loop = 0
+ while loop <= 10:
+ ent = topology.master1.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
+ assert ent is not None
+ if ent.hasAttr(attribute) and (ent.getValue(attribute) == tested_value):
+ break
+
+ time.sleep(1)
+ loop += 1
+ assert loop < 10
+ topology.master1.log.info("Update %s (%s) replicated on M1" % (dn, attribute))
+
+
+def test_moddn_staging_prod_except(topology, moddn_setup):
+ """This test case MOVE entry NEW_ACCOUNT13 from staging to prod
+ but fails to move entry NEW_ACCOUNT14 from staging to prod_except
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (13) ########\n")
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s13" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ #
+ # Now try to move an entry under except
+ #
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod/Except (14) ########\n")
+ old_rdn = "cn=%s14" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PROD_EXCEPT_DN
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+
+def test_mode_default_ger_no_moddn(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode moddn_aci : GER no moddn ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_mode_default_ger_with_moddn(topology, moddn_setup):
+ """This test case adds the moddn aci and check ger contains 'n'"""
+
+ topology.master1.log.info("\n\n######## mode moddn_aci: GER with moddn ########\n")
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_mode_switch_default_to_legacy(topology, moddn_setup):
+ """This test switch the server from default mode to legacy"""
+
+ topology.master1.log.info("\n\n######## Disable the moddn aci mod ########\n")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+
+def test_mode_legacy_ger_no_moddn1(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy 1: GER no moddn ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_mode_legacy_ger_no_moddn2(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy 2: GER no moddn ########\n")
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_mode_legacy_ger_with_moddn(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy : GER with moddn ########\n")
+
+ # being allowed to read/write the RDN attribute use to allow the RDN
+ ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"cn\")" % (PRODUCTION_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN production changing the RDN attribute\"; allow (read,search,write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ #_bind_normal(topology)
+
+
+(a)pytest.fixture(scope="module")
+def rdn_write_setup(topology):
+ topology.master1.log.info("\n\n######## Add entry tuser ########\n")
+ topology.master1.add_s(Entry((SRC_ENTRY_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': SRC_ENTRY_CN,
+ 'cn': SRC_ENTRY_CN})))
+
+
+def test_rdn_write_get_ger(topology, rdn_write_setup):
+ ANONYMOUS_DN = ""
+ topology.master1.log.info("\n\n######## GER rights for anonymous ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True,
+ authzId="dn:" + ANONYMOUS_DN)
+ msg_id = topology.master1.search_ext(SUFFIX,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ for value in attrs['entryLevelRights']:
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_rdn_write_modrdn_anonymous(topology, rdn_write_setup):
+ ANONYMOUS_DN = ""
+ topology.master1.close()
+ topology.master1.binddn = ANONYMOUS_DN
+ topology.master1.open()
+ msg_id = topology.master1.search_ext("", ldap.SCOPE_BASE, "objectclass=*")
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ for attr in attrs:
+ topology.master1.log.info("######## %r: %r" % (attr, attrs[attr]))
+
+ try:
+ topology.master1.rename_s(SRC_ENTRY_DN, "cn=%s" % DST_ENTRY_CN, delold=True)
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ try:
+ topology.master1.getEntry(DST_ENTRY_DN, ldap.SCOPE_BASE, "objectclass=*")
+ assert False
+ except Exception as e:
+ topology.master1.log.info("The entry was not renamed (expected)")
+ isinstance(e, ldap.NO_SUCH_OBJECT)
+
+ _bind_manager(topology)
+
+
if __name__ == '__main__':
# Run isolated
# -s for DEBUG mode
diff --git a/dirsrvtests/tickets/ticket47553_ger.py b/dirsrvtests/tickets/ticket47553_ger.py
deleted file mode 100644
index d688c70..0000000
--- a/dirsrvtests/tickets/ticket47553_ger.py
+++ /dev/null
@@ -1,553 +0,0 @@
-'''
-Created on Nov 7, 2013
-
-@author: tbordaz
-'''
-import os
-import sys
-import time
-import ldap
-import logging
-import socket
-import time
-import logging
-import pytest
-import re
-from lib389 import DirSrv, Entry, tools
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from constants import *
-from lib389._constants import REPLICAROLE_MASTER
-from ldap.controls.simple import GetEffectiveRightsControl
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-#
-# important part. We can deploy Master1 and Master2 on different versions
-#
-installation1_prefix = None
-installation2_prefix = None
-
-TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
-
-STAGING_CN = "staged user"
-PRODUCTION_CN = "accounts"
-EXCEPT_CN = "excepts"
-
-STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
-PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
-PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
-
-STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
-PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
-BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
-BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
-
-BIND_CN = "bind_entry"
-BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
-BIND_PW = "password"
-
-NEW_ACCOUNT = "new_account"
-MAX_ACCOUNTS = 20
-
-CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
-
-class TopologyMaster1Master2(object):
- def __init__(self, master1, master2):
- master1.open()
- self.master1 = master1
-
- master2.open()
- self.master2 = master2
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- '''
- This fixture is used to create a replicated topology for the 'module'.
- The replicated topology is MASTER1 <-> Master2.
- At the beginning, It may exists a master2 instance and/or a master2 instance.
- It may also exists a backup for the master1 and/or the master2.
-
- Principle:
- If master1 instance exists:
- restart it
- If master2 instance exists:
- restart it
- If backup of master1 AND backup of master2 exists:
- create or rebind to master1
- create or rebind to master2
-
- restore master1 from backup
- restore master2 from backup
- else:
- Cleanup everything
- remove instances
- remove backups
- Create instances
- Initialize replication
- Create backups
- '''
- global installation1_prefix
- global installation2_prefix
-
- # allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
- # Args for the master1 instance
- args_instance[SER_HOST] = HOST_MASTER_1
- args_instance[SER_PORT] = PORT_MASTER_1
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
- args_master = args_instance.copy()
- master1.allocate(args_master)
-
- # allocate master1 on a given deployement
- master2 = DirSrv(verbose=False)
- if installation2_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
- # Args for the consumer instance
- args_instance[SER_HOST] = HOST_MASTER_2
- args_instance[SER_PORT] = PORT_MASTER_2
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
- args_master = args_instance.copy()
- master2.allocate(args_master)
-
-
- # Get the status of the backups
- backup_master1 = master1.checkBackupFS()
- backup_master2 = master2.checkBackupFS()
-
- # Get the status of the instance and restart it if it exists
- instance_master1 = master1.exists()
- if instance_master1:
- master1.stop(timeout=10)
- master1.start(timeout=10)
-
- instance_master2 = master2.exists()
- if instance_master2:
- master2.stop(timeout=10)
- master2.start(timeout=10)
-
- if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
- # we just re-init the instances with them
- if not instance_master1:
- master1.create()
- # Used to retrieve configuration information (dbdir, confdir...)
- master1.open()
-
- if not instance_master2:
- master2.create()
- # Used to retrieve configuration information (dbdir, confdir...)
- master2.open()
-
- # restore master1 from backup
- master1.stop(timeout=10)
- master1.restoreFS(backup_master1)
- master1.start(timeout=10)
-
- # restore master2 from backup
- master2.stop(timeout=10)
- master2.restoreFS(backup_master2)
- master2.start(timeout=10)
- else:
- # We should be here only in two conditions
- # - This is the first time a test involve master-consumer
- # so we need to create everything
- # - Something weird happened (instance/backup destroyed)
- # so we discard everything and recreate all
-
- # Remove all the backups. So even if we have a specific backup file
- # (e.g backup_master) we clear all backups that an instance my have created
- if backup_master1:
- master1.clearBackupFS()
- if backup_master2:
- master2.clearBackupFS()
-
- # Remove all the instances
- if instance_master1:
- master1.delete()
- if instance_master2:
- master2.delete()
-
- # Create the instances
- master1.create()
- master1.open()
- master2.create()
- master2.open()
-
- #
- # Now prepare the Master-Consumer topology
- #
- # First Enable replication
- master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
- master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
- # Initialize the supplier->consumer
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
- if not repl_agreement:
- log.fatal("Fail to create a replica agreement")
- sys.exit(1)
-
- log.debug("%s created" % repl_agreement)
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
-
- master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
- master1.waitForReplInit(repl_agreement)
-
- # Check replication is working fine
- master1.add_s(Entry((TEST_REPL_DN, {
- 'objectclass': "top person".split(),
- 'sn': 'test_repl',
- 'cn': 'test_repl'})))
- loop = 0
- while loop <= 10:
- try:
- ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
- break
- except ldap.NO_SUCH_OBJECT:
- time.sleep(1)
- loop += 1
-
- # Time to create the backups
- master1.stop(timeout=10)
- master1.backupfile = master1.backupFS()
- master1.start(timeout=10)
-
- master2.stop(timeout=10)
- master2.backupfile = master2.backupFS()
- master2.start(timeout=10)
-
- # clear the tmp directory
- master1.clearTmpDir(__file__)
-
- #
- # Here we have two instances master and consumer
- # with replication working. Either coming from a backup recovery
- # or from a fresh (re)init
- # Time to return the topology
- return TopologyMaster1Master2(master1, master2)
-
-
-
-def _bind_manager(topology):
- topology.master1.log.info("Bind as %s " % DN_DM)
- topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
-def _bind_normal(topology):
- # bind as bind_entry
- topology.master1.log.info("Bind as %s" % BIND_DN)
- topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
-def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
- '''
- It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
- '''
- assert mod_type != None
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- #topology.master1.modify_s(SUFFIX, mod)
- topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
- topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type != None
-
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- assert mod_type != None
-
- ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-
-def test_ticket47553_init(topology):
- """
- Creates
- - a staging DIT
- - a production DIT
- - add accounts in staging DIT
- - enable ACL logging (commented for performance reason)
-
- """
-
- topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
- # entry used to bind with
- topology.master1.log.info("Add %s" % BIND_DN)
- topology.master1.add_s(Entry((BIND_DN, {
- 'objectclass': "top person".split(),
- 'sn': BIND_CN,
- 'cn': BIND_CN,
- 'userpassword': BIND_PW})))
-
- # DIT for staging
- topology.master1.log.info("Add %s" % STAGING_DN)
- topology.master1.add_s(Entry((STAGING_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': STAGING_CN,
- 'description': "staging DIT"})))
-
- # DIT for production
- topology.master1.log.info("Add %s" % PRODUCTION_DN)
- topology.master1.add_s(Entry((PRODUCTION_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': PRODUCTION_CN,
- 'description': "production DIT"})))
-
- # DIT for production/except
- topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
- topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': EXCEPT_CN,
- 'description': "production except DIT"})))
-
- # enable acl error logging
- #mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
- #topology.master1.modify_s(DN_CONFIG, mod)
- #topology.master2.modify_s(DN_CONFIG, mod)
-
-
-
-
-
- # add dummy entries in the staging DIT
- for cpt in range(MAX_ACCOUNTS):
- name = "%s%d" % (NEW_ACCOUNT, cpt)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
-
-
-def test_ticket47553_mode_default_add_deny(topology):
- '''
- This test case checks that the ADD operation fails (no ADD aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### mode moddn_aci : ADD (should fail) ######################\n")
-
- _bind_normal(topology)
-
- #
- # First try to add an entry in production => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-def test_ticket47553_mode_default_ger_no_moddn(topology):
- topology.master1.log.info("\n\n######################### mode moddn_aci : GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
- for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-def test_ticket47553_mode_default_ger_with_moddn(topology):
- '''
- This test case adds the moddn aci and check ger contains 'n'
- '''
-
- topology.master1.log.info("\n\n######################### mode moddn_aci: GER with moddn ######################\n")
-
- # successfull MOD with the ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
- assert 'n' in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-def test_ticket47553_mode_switch_default_to_legacy(topology):
- '''
- This test switch the server from default mode to legacy
- '''
- topology.master1.log.info("\n\n######################### Disable the moddn aci mod ######################\n" )
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
-def test_ticket47553_mode_legacy_ger_no_moddn1(topology):
- topology.master1.log.info("\n\n######################### mode legacy 1: GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
- for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-def test_ticket47553_mode_legacy_ger_no_moddn2(topology):
- topology.master1.log.info("\n\n######################### mode legacy 2: GER no moddn ######################\n")
- # successfull MOD with the ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
- for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-def test_ticket47553_mode_legacy_ger_with_moddn(topology):
- topology.master1.log.info("\n\n######################### mode legacy : GER with moddn ######################\n")
-
- # being allowed to read/write the RDN attribute use to allow the RDN
- ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"cn\")" % (PRODUCTION_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN production changing the RDN attribute\"; allow (read,search,write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
-
- # successfull MOD with the ACI
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True,authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype,rdata,rmsgid,response_ctrl = topology.master1.result3(msg_id)
- ger={}
- value=''
- for dn, attrs in rdata:
- topology.master1.log.info ("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info ("############### entryLevelRights: %r" % value)
- assert 'n' in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
- _bind_normal(topology)
-
-
-def test_ticket47553_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
-
-def run_isolated():
- '''
- run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
- - edit this file and comment '@pytest.fixture' line before 'topology' function.
- - set the installation prefix
- - run this program
- '''
- global installation1_prefix
- global installation2_prefix
- installation1_prefix = None
- installation2_prefix = None
-
- topo = topology(True)
- topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
- test_ticket47553_init(topo)
-
- # Check that without appropriate aci we are not allowed to add/delete
- test_ticket47553_mode_default_add_deny(topo)
- test_ticket47553_mode_default_ger_no_moddn(topo)
- test_ticket47553_mode_default_ger_with_moddn(topo)
- test_ticket47553_mode_switch_default_to_legacy(topo)
- test_ticket47553_mode_legacy_ger_no_moddn1(topo)
- test_ticket47553_mode_legacy_ger_no_moddn2(topo)
- test_ticket47553_mode_legacy_ger_with_moddn(topo)
-
- test_ticket47553_final(topo)
-
-
-
-
-if __name__ == '__main__':
- run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47553_rdn_write_test.py b/dirsrvtests/tickets/ticket47553_rdn_write_test.py
deleted file mode 100644
index 826e709..0000000
--- a/dirsrvtests/tickets/ticket47553_rdn_write_test.py
+++ /dev/null
@@ -1,135 +0,0 @@
-import os
-import sys
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry, tools, tasks
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from lib389.tasks import *
-from lib389.utils import *
-from ldap.controls.simple import GetEffectiveRightsControl
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-installation1_prefix = None
-
-SRC_ENTRY_CN = "tuser"
-EXT_RDN = "01"
-DST_ENTRY_CN = SRC_ENTRY_CN + EXT_RDN
-
-SRC_ENTRY_DN = "cn=%s,%s" % (SRC_ENTRY_CN, SUFFIX)
-DST_ENTRY_DN = "cn=%s,%s" % (DST_ENTRY_CN, SUFFIX)
-
-
-class TopologyStandalone(object):
- def __init__(self, standalone):
- standalone.open()
- self.standalone = standalone
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- global installation1_prefix
-
- # Creating standalone instance ...
- standalone = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
- args_instance[SER_HOST] = HOST_STANDALONE
- args_instance[SER_PORT] = PORT_STANDALONE
- args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
- args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
- args_standalone = args_instance.copy()
- standalone.allocate(args_standalone)
- instance_standalone = standalone.exists()
- if instance_standalone:
- standalone.delete()
- standalone.create()
- standalone.open()
-
- # Clear out the tmp dir
- standalone.clearTmpDir(__file__)
-
- return TopologyStandalone(standalone)
-
-
-def test_ticket47553_rdn_write_init(topology):
- topology.standalone.log.info("\n\n######################### Add entry tuser ######################\n")
- topology.standalone.add_s(Entry((SRC_ENTRY_DN, {
- 'objectclass': "top person".split(),
- 'sn': SRC_ENTRY_CN,
- 'cn': SRC_ENTRY_CN})))
-
-
-def test_ticket47553_rdn_write_get_ger(topology):
- ANONYMOUS_DN = ""
- topology.standalone.log.info("\n\n######################### GER rights for anonymous ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn:" + ANONYMOUS_DN)
- msg_id = topology.standalone.search_ext(SUFFIX, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.standalone.result3(msg_id)
- value = ''
- for dn, attrs in rdata:
- topology.standalone.log.info("dn: %s" % dn)
- for value in attrs['entryLevelRights']:
- topology.standalone.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-
-def test_ticket47553_rdn_write_modrdn_anonymous(topology):
- ANONYMOUS_DN = ""
- topology.standalone.close()
- topology.standalone.binddn = ANONYMOUS_DN
- topology.standalone.open()
- msg_id = topology.standalone.search_ext("", ldap.SCOPE_BASE, "objectclass=*")
- rtype, rdata, rmsgid, response_ctrl = topology.standalone.result3(msg_id)
- for dn, attrs in rdata:
- topology.standalone.log.info("dn: %s" % dn)
- for attr in attrs:
- topology.standalone.log.info("############### %r: %r" % (attr, attrs[attr]))
-
- try:
- topology.standalone.rename_s(SRC_ENTRY_DN, "cn=%s" % DST_ENTRY_CN, delold=True)
- except Exception as e:
- topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
- isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- try:
- topology.standalone.getEntry(DST_ENTRY_DN, ldap.SCOPE_BASE, "objectclass=*")
- assert False
- except Exception as e:
- topology.standalone.log.info("The entry was not renamed (expected)")
- isinstance(e, ldap.NO_SUCH_OBJECT)
-
-
-def test_ticket47553_rdn_write(topology):
- '''
- Write your testcase here...
- '''
-
- log.info('Test complete')
-
-
-def test_ticket47553_rdn_write_final(topology):
- topology.standalone.delete()
- log.info('Testcase PASSED')
-
-
-def run_isolated():
- global installation1_prefix
- installation1_prefix = '/home/tbordaz/install_master'
-
- topo = topology(True)
- test_ticket47553_rdn_write_init(topo)
- test_ticket47553_rdn_write_get_ger(topo)
- test_ticket47553_rdn_write(topo)
- test_ticket47553_rdn_write_modrdn_anonymous(topo)
- test_ticket47553_rdn_write_final(topo)
-
-
-if __name__ == '__main__':
- run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47553_single_aci_test.py b/dirsrvtests/tickets/ticket47553_single_aci_test.py
deleted file mode 100644
index 0c8d7e9..0000000
--- a/dirsrvtests/tickets/ticket47553_single_aci_test.py
+++ /dev/null
@@ -1,1224 +0,0 @@
-'''
-Created on Nov 7, 2013
-
-@author: tbordaz
-'''
-import os
-import sys
-import time
-import ldap
-import logging
-import socket
-import time
-import logging
-import pytest
-import re
-from lib389 import DirSrv, Entry, tools
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from constants import *
-from lib389._constants import REPLICAROLE_MASTER
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-#
-# important part. We can deploy Master1 and Master2 on different versions
-#
-installation1_prefix = None
-installation2_prefix = None
-
-TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
-
-STAGING_CN = "staged user"
-PRODUCTION_CN = "accounts"
-EXCEPT_CN = "excepts"
-
-STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
-PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
-PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
-
-STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
-PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
-BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
-BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
-
-BIND_CN = "bind_entry"
-BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
-BIND_PW = "password"
-
-NEW_ACCOUNT = "new_account"
-MAX_ACCOUNTS = 20
-
-CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
-
-class TopologyMaster1Master2(object):
- def __init__(self, master1, master2):
- master1.open()
- self.master1 = master1
-
- master2.open()
- self.master2 = master2
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- '''
- This fixture is used to create a replicated topology for the 'module'.
- The replicated topology is MASTER1 <-> Master2.
- At the beginning, It may exists a master2 instance and/or a master2 instance.
- It may also exists a backup for the master1 and/or the master2.
-
- Principle:
- If master1 instance exists:
- restart it
- If master2 instance exists:
- restart it
- If backup of master1 AND backup of master2 exists:
- create or rebind to master1
- create or rebind to master2
-
- restore master1 from backup
- restore master2 from backup
- else:
- Cleanup everything
- remove instances
- remove backups
- Create instances
- Initialize replication
- Create backups
- '''
- global installation1_prefix
- global installation2_prefix
-
- # allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
- # Args for the master1 instance
- args_instance[SER_HOST] = HOST_MASTER_1
- args_instance[SER_PORT] = PORT_MASTER_1
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
- args_master = args_instance.copy()
- master1.allocate(args_master)
-
- # allocate master1 on a given deployement
- master2 = DirSrv(verbose=False)
- if installation2_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
- # Args for the consumer instance
- args_instance[SER_HOST] = HOST_MASTER_2
- args_instance[SER_PORT] = PORT_MASTER_2
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
- args_master = args_instance.copy()
- master2.allocate(args_master)
-
-
- # Get the status of the backups
- backup_master1 = master1.checkBackupFS()
- backup_master2 = master2.checkBackupFS()
-
- # Get the status of the instance and restart it if it exists
- instance_master1 = master1.exists()
- if instance_master1:
- master1.stop(timeout=10)
- master1.start(timeout=10)
-
- instance_master2 = master2.exists()
- if instance_master2:
- master2.stop(timeout=10)
- master2.start(timeout=10)
-
- if backup_master1 and backup_master2:
- # The backups exist, assuming they are correct
- # we just re-init the instances with them
- if not instance_master1:
- master1.create()
- # Used to retrieve configuration information (dbdir, confdir...)
- master1.open()
-
- if not instance_master2:
- master2.create()
- # Used to retrieve configuration information (dbdir, confdir...)
- master2.open()
-
- # restore master1 from backup
- master1.stop(timeout=10)
- master1.restoreFS(backup_master1)
- master1.start(timeout=10)
-
- # restore master2 from backup
- master2.stop(timeout=10)
- master2.restoreFS(backup_master2)
- master2.start(timeout=10)
- else:
- # We should be here only in two conditions
- # - This is the first time a test involve master-consumer
- # so we need to create everything
- # - Something weird happened (instance/backup destroyed)
- # so we discard everything and recreate all
-
- # Remove all the backups. So even if we have a specific backup file
- # (e.g backup_master) we clear all backups that an instance my have created
- if backup_master1:
- master1.clearBackupFS()
- if backup_master2:
- master2.clearBackupFS()
-
- # Remove all the instances
- if instance_master1:
- master1.delete()
- if instance_master2:
- master2.delete()
-
- # Create the instances
- master1.create()
- master1.open()
- master2.create()
- master2.open()
-
- #
- # Now prepare the Master-Consumer topology
- #
- # First Enable replication
- master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
- master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
- # Initialize the supplier->consumer
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
- if not repl_agreement:
- log.fatal("Fail to create a replica agreement")
- sys.exit(1)
-
- log.debug("%s created" % repl_agreement)
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
-
- master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
- master1.waitForReplInit(repl_agreement)
-
- # Check replication is working fine
- master1.add_s(Entry((TEST_REPL_DN, {
- 'objectclass': "top person".split(),
- 'sn': 'test_repl',
- 'cn': 'test_repl'})))
- loop = 0
- while loop <= 10:
- try:
- ent = master2.getEntry(TEST_REPL_DN, ldap.SCOPE_BASE, "(objectclass=*)")
- break
- except ldap.NO_SUCH_OBJECT:
- time.sleep(1)
- loop += 1
-
- # Time to create the backups
- master1.stop(timeout=10)
- master1.backupfile = master1.backupFS()
- master1.start(timeout=10)
-
- master2.stop(timeout=10)
- master2.backupfile = master2.backupFS()
- master2.start(timeout=10)
-
- # clear the tmp directory
- master1.clearTmpDir(__file__)
-
- #
- # Here we have two instances master and consumer
- # with replication working. Either coming from a backup recovery
- # or from a fresh (re)init
- # Time to return the topology
- return TopologyMaster1Master2(master1, master2)
-
-
-
-def _bind_manager(topology):
- topology.master1.log.info("Bind as %s " % DN_DM)
- topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
-def _bind_normal(topology):
- # bind as bind_entry
- topology.master1.log.info("Bind as %s" % BIND_DN)
- topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
-def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
- '''
- It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
- '''
- assert mod_type != None
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- #topology.master1.modify_s(SUFFIX, mod)
- topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
- topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-def _write_aci_staging(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % STAGING_DN
- ACI_ALLOW = "(version 3.0; acl \"write staging entries\"; allow (write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-def _write_aci_production(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % PRODUCTION_DN
- ACI_ALLOW = "(version 3.0; acl \"write production entries\"; allow (write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type != None
-
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
- _write_aci_staging(topology, mod_type=mod_type)
-
-def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- assert mod_type != None
-
- ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
- _write_aci_production(topology, mod_type=mod_type)
-
-
-def test_ticket47553_init(topology):
- """
- Creates
- - a staging DIT
- - a production DIT
- - add accounts in staging DIT
- - enable ACL logging (commented for performance reason)
-
- """
-
- topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
- # entry used to bind with
- topology.master1.log.info("Add %s" % BIND_DN)
- topology.master1.add_s(Entry((BIND_DN, {
- 'objectclass': "top person".split(),
- 'sn': BIND_CN,
- 'cn': BIND_CN,
- 'userpassword': BIND_PW})))
-
- # DIT for staging
- topology.master1.log.info("Add %s" % STAGING_DN)
- topology.master1.add_s(Entry((STAGING_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': STAGING_CN,
- 'description': "staging DIT"})))
-
- # DIT for production
- topology.master1.log.info("Add %s" % PRODUCTION_DN)
- topology.master1.add_s(Entry((PRODUCTION_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': PRODUCTION_CN,
- 'description': "production DIT"})))
-
- # DIT for production/except
- topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
- topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': EXCEPT_CN,
- 'description': "production except DIT"})))
-
- # enable acl error logging
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(128+262144))]
- topology.master1.modify_s(DN_CONFIG, mod)
- topology.master2.modify_s(DN_CONFIG, mod)
-
-
- # add dummy entries in the staging DIT
- for cpt in range(MAX_ACCOUNTS):
- name = "%s%d" % (NEW_ACCOUNT, cpt)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
-
-
-def test_ticket47553_add(topology):
- '''
- This test case checks that the ADD operation fails (no ADD aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### ADD (should fail) ######################\n")
-
- _bind_normal(topology)
-
- #
- # First try to add an entry in production => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-def test_ticket47553_delete(topology):
- '''
- This test case checks that the DEL operation fails (no 'delete' aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### DELETE (should fail) ######################\n")
-
- _bind_normal(topology)
- #
- # Second try to delete an entry in staging => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to delete %s" % STAGING_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.delete_s("cn=%s,%s" % (name, STAGING_DN))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
-def test_ticket47553_moddn_staging_prod_0(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT0 from staging to prod
- target_to/target_from: equality filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (0) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s0" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_1(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT1 from staging to prod
- target_to/target_from: substring/equality filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (1) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s1" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to substring/ from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_staging_prod_2(topology):
- '''
- This test case fails to MOVE entry NEW_ACCOUNT2 from staging to prod
- because of bad pattern
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (2) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s2" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to substring (BAD)/ from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_staging_prod_3(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT3 from staging to prod
- target_to/target_from: equality/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (3) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s3" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:equality filter / from substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_staging_prod_4(topology):
- '''
- This test case fails to MOVE entry NEW_ACCOUNT4 from staging to prod
- because of bad pattern
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (4) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s4" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: equality filter/ from: substring (BAD) ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_staging_prod_5(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT5 from staging to prod
- target_to/target_from: substring/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (5) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s5" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_staging_prod_6(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT6 from staging to prod
- target_to/target_from: substring/<enmpty> filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (6) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s6" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: empty ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_staging_prod_7(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT7 from staging to prod
- target_to/target_from: <empty>/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (7) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s7" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: empty/ from: substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=None)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=None)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_8(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT8 from staging to prod
- target_to/target_from: <empty>/<empty> filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (8) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s8" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: empty/ from: empty ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=None)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=None)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_staging_prod_9(topology):
- '''
- This test case disable the 'moddn' right so a MODDN requires a 'add' right
- to be successfull.
- It fails to MOVE entry NEW_ACCOUNT9 from staging to prod.
- Add a 'add' right to prod.
- Then it succeeds to MOVE NEW_ACCOUNT9 from staging to prod.
-
- Then enable the 'moddn' right so a MODDN requires a 'moddn' right
- It fails to MOVE entry NEW_ACCOUNT10 from staging to prod.
- Add a 'moddn' right to prod.
- Then it succeeds to MOVE NEW_ACCOUNT10 from staging to prod.
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (9) ######################\n")
-
- _bind_normal(topology)
- old_rdn = "cn=%s9" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- ############################################
- # Now do tests with no support of moddn aci
- ############################################
- topology.master1.log.info("Disable the moddn right" )
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
- # Add the moddn aci that will not be evaluated because of the config flag
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- # It will fail because it will test the ADD right
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # remove the moddn aci
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- #
- # add the 'add' right to the production DN
- # Then do a successfull moddn
- #
- ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
-
- ############################################
- # Now do tests with support of moddn aci
- ############################################
- topology.master1.log.info("Enable the moddn right" )
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'on')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (10) ######################\n")
-
- _bind_normal(topology)
- old_rdn = "cn=%s10" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- #
- # add the 'add' right to the production DN
- # Then do a failing moddn
- #
- ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- # Add the moddn aci that will be evaluated because of the config flag
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # remove the moddn aci
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-def test_ticket47553_moddn_prod_staging(topology):
- '''
- This test checks that we can move ACCOUNT11 from staging to prod
- but not move back ACCOUNT11 from prod to staging
- '''
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (11) ######################\n")
-
- _bind_normal(topology)
-
- old_rdn = "cn=%s11" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
-
- #
- # Now check we can not move back the entry to staging
- old_rdn = "cn=%s11" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, PRODUCTION_DN)
- new_rdn = old_rdn
- new_superior = STAGING_DN
-
- # add the write right because we want to check the moddn
- _bind_manager(topology)
- _write_aci_production(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to move back MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- _bind_manager(topology)
- _write_aci_production(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_check_repl_M2_to_M1(topology):
- '''
- Checks that replication is still working M2->M1, using ACCOUNT12
- '''
-
- topology.master1.log.info("Bind as %s (M2)" % DN_DM)
- topology.master2.simple_bind_s(DN_DM, PASSWORD)
-
- rdn = "cn=%s12" % NEW_ACCOUNT
- dn = "%s,%s" % (rdn, STAGING_DN)
-
- # First wait for the ACCOUNT19 entry being replicated on M2
- loop = 0
- while loop <= 10:
- try:
- ent = topology.master2.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
- break
- except ldap.NO_SUCH_OBJECT:
- time.sleep(1)
- loop += 1
- assert loop <= 10
-
-
- attribute = 'description'
- tested_value = 'Hello world'
- mod = [(ldap.MOD_ADD, attribute, tested_value)]
- topology.master1.log.info("Update (M2) %s (%s)" % (dn, attribute))
- topology.master2.modify_s(dn, mod)
-
- loop = 0
- while loop <= 10:
- ent = topology.master1.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
- assert ent != None
- if ent.hasAttr(attribute) and (ent.getValue(attribute) == tested_value):
- break
-
- time.sleep(1)
- loop += 1
- assert loop < 10
- topology.master1.log.info("Update %s (%s) replicated on M1" % (dn, attribute))
-
-def test_ticket47553_moddn_staging_prod_except(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT13 from staging to prod
- but fails to move entry NEW_ACCOUNT14 from staging to prod_except
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (13) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s13" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- #
- # Now try to move an entry under except
- #
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod/Except (14) ######################\n")
- old_rdn = "cn=%s14" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PROD_EXCEPT_DN
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
-def test_ticket47553_final(topology):
- topology.master1.stop(timeout=10)
- topology.master2.stop(timeout=10)
-
-def run_isolated():
- '''
- run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
- - edit this file and comment '@pytest.fixture' line before 'topology' function.
- - set the installation prefix
- - run this program
- '''
- global installation1_prefix
- global installation2_prefix
- installation1_prefix = None
- installation2_prefix = None
-
- topo = topology(True)
- topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
- test_ticket47553_init(topo)
-
-
- # Check that without appropriate aci we are not allowed to add/delete
- test_ticket47553_add(topo)
- test_ticket47553_delete(topo)
-
- # tests the ACI as equality/substring filter
- test_ticket47553_moddn_staging_prod_0(topo)
- test_ticket47553_moddn_staging_prod_1(topo)
- test_ticket47553_moddn_staging_prod_2(topo)
- test_ticket47553_moddn_staging_prod_3(topo)
- test_ticket47553_moddn_staging_prod_4(topo)
- test_ticket47553_moddn_staging_prod_5(topo)
-
- # tests the ACI with undefined 'target_to'/'target_from'
- test_ticket47553_moddn_staging_prod_6(topo)
- test_ticket47553_moddn_staging_prod_7(topo)
- test_ticket47553_moddn_staging_prod_8(topo)
-
- # Check we can control the behavior with nsslapd-moddn-aci
- test_ticket47553_moddn_staging_prod_9(topo)
-
- # Check we can move entry 'from' -> 'to' but not 'to' -> 'from'
- test_ticket47553_moddn_prod_staging(topo)
-
- # check replication is still working
- test_ticket47553_check_repl_M2_to_M1(topo)
-
- # check DENY rule is working
- test_ticket47553_moddn_staging_prod_except(topo)
-
- test_ticket47553_final(topo)
-
-
-
-
-if __name__ == '__main__':
- run_isolated()
-
1
0
dirsrvtests/suites/replication/wait_for_async_feature_test.py | 280 ++++++++++
1 file changed, 280 insertions(+)
New commits:
commit 339bbafbd8c35b944059395d2d2ff571a98b62ca
Author: Simon Pichugin <spichugi(a)redhat.com>
Date: Tue Oct 13 14:10:59 2015 +0200
Ticket 47957 - Add replication test suite for a wait async feature
Description: Test new attribute "nsDS5ReplicaWaitForAsyncResults".
After setting the attribute, supplier will sleep established
amount of millisecond if it finds the response from consumer
is not ready.
Tests:
- not integer value;
- multi value;
- check that value has been set correctly [None, 2000, 0, -5];
- replication behavior with valid values [None, 2000, 0, -5].
https://fedorahosted.org/389/ticket/47957
Reviewed by: nhosoi(a)redhat.com (Thanks, Noriko!)
(cherry picked from commit 2c702c4f44512e8731c3d0a026cbc8838517345f)
diff --git a/dirsrvtests/suites/replication/wait_for_async_feature_test.py b/dirsrvtests/suites/replication/wait_for_async_feature_test.py
new file mode 100644
index 0000000..4905088
--- /dev/null
+++ b/dirsrvtests/suites/replication/wait_for_async_feature_test.py
@@ -0,0 +1,280 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+from collections import Counter
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+installation1_prefix = None
+
+WAITFOR_ASYNC_ATTR = "nsDS5ReplicaWaitForAsyncResults"
+
+class TopologyReplication(object):
+ def __init__(self, master1, master2, m1_m2_agmt, m2_m1_agmt):
+ master1.open()
+ master2.open()
+ self.masters = ((master1, m1_m2_agmt),
+ (master2, m2_m1_agmt))
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ global installation1_prefix
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Creating master 1...
+ master1 = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.delete()
+ master1.create()
+ master1.open()
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+
+ # Creating master 2...
+ master2 = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.delete()
+ master2.create()
+ master2.open()
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ #
+ # Create all the agreements
+ #
+ # Creating agreement from master 1 to master 2
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m1_m2_agmt = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ if not m1_m2_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m1_m2_agmt)
+
+ # Creating agreement from master 2 to master 1
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m2_m1_agmt = master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
+ if not m2_m1_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m2_m1_agmt)
+
+ # Allow the replicas to get situated with the new agreements...
+ time.sleep(5)
+
+ #
+ # Initialize all the agreements
+ #
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(m1_m2_agmt)
+ master2.agreement.init(SUFFIX, HOST_MASTER_1, PORT_MASTER_1)
+ master2.waitForReplInit(m2_m1_agmt)
+
+ # Check replication is working...
+ if master1.testReplication(DEFAULT_SUFFIX, master2):
+ log.info('Replication is working.')
+ else:
+ log.fatal('Replication is not working.')
+ assert False
+
+ log.info("Set Replication Debugging loglevel for the errorlog")
+ master1.setLogLevel(lib389.LOG_REPLICA)
+ master2.setLogLevel(lib389.LOG_REPLICA)
+
+ # Delete each instance in the end
+ def fin():
+ master1.delete()
+ master2.delete()
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ master1.clearTmpDir(__file__)
+
+ return TopologyReplication(master1, master2, m1_m2_agmt, m2_m1_agmt)
+
+
+(a)pytest.fixture(params=[(None, (4, 10)),
+ ('2000', (0, 1)),
+ ('0', (4, 10)),
+ ('-5', (4, 10))])
+def waitfor_async_attr(topology, request):
+ """Sets attribute on all replicas"""
+
+ attr_value = request.param[0]
+ expected_result = request.param[1]
+
+ # Run through all masters
+ for master in topology.masters:
+ agmt = master[1]
+ try:
+ if attr_value:
+ log.info("Set %s: %s on %s" % (
+ WAITFOR_ASYNC_ATTR, attr_value, master[0].serverid))
+ mod = [(ldap.MOD_REPLACE, WAITFOR_ASYNC_ATTR, attr_value)]
+ else:
+ log.info("Delete %s from %s" % (
+ WAITFOR_ASYNC_ATTR, master[0].serverid))
+ mod = [(ldap.MOD_DELETE, WAITFOR_ASYNC_ATTR, None)]
+ master[0].modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ log.error('Failed to set or delete %s attribute: (%s)' % (
+ WAITFOR_ASYNC_ATTR, e.message['desc']))
+
+ return (attr_value, expected_result)
+
+
+(a)pytest.fixture
+def entries(topology, request):
+ """Adds entries to the master1"""
+
+ master1 = topology.masters[0][0]
+
+ TEST_OU = "test"
+ test_dn = SUFFIX
+ test_list = []
+
+ log.info("Add 100 nested entries under replicated suffix on %s" % master1.serverid)
+ for i in xrange(100):
+ test_dn = 'ou=%s%s,%s' % (TEST_OU, i, test_dn)
+ test_list.insert(0, test_dn)
+ try:
+ master1.add_s(Entry((test_dn,
+ {'objectclass': 'top',
+ 'objectclass': 'organizationalUnit',
+ 'ou': TEST_OU})))
+ except ldap.LDAPError as e:
+ log.error('Failed to add entry (%s): error (%s)' % (test_dn,
+ e.message['desc']))
+ assert False
+
+ log.info("Delete created entries")
+ for test_dn in test_list:
+ try:
+ master1.delete_s(test_dn)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete entry (%s): error (%s)' % (test_dn,
+ e.message['desc']))
+ assert False
+
+ def fin():
+ log.info("Clear the errors log in the end of the test case")
+ with open(master1.errlog, 'w') as errlog:
+ errlog.writelines("")
+ request.addfinalizer(fin)
+
+
+def test_not_int_value(topology):
+ """Tests not integer value"""
+
+ master1 = topology.masters[0][0]
+ agmt = topology.masters[0][1]
+
+ log.info("Try to set %s: wv1" % WAITFOR_ASYNC_ATTR)
+ try:
+ mod = [(ldap.MOD_REPLACE, WAITFOR_ASYNC_ATTR, "wv1")]
+ master1.modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ assert e.message['desc'] == 'Invalid syntax'
+
+
+def test_multi_value(topology):
+ """Tests multi value"""
+
+ master1 = topology.masters[0][0]
+ agmt = topology.masters[0][1]
+ log.info("agmt: %s" % agmt)
+
+ log.info("Try to set %s: 100 and 101 in the same time (multi value test)" % (
+ WAITFOR_ASYNC_ATTR))
+ try:
+ mod = [(ldap.MOD_ADD, WAITFOR_ASYNC_ATTR, "100")]
+ master1.modify_s(agmt, mod)
+ mod = [(ldap.MOD_ADD, WAITFOR_ASYNC_ATTR, "101")]
+ master1.modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ assert e.message['desc'] == 'Object class violation'
+
+
+def test_value_check(topology, waitfor_async_attr):
+ """Checks that value has been set correctly"""
+
+ attr_value = waitfor_async_attr[0]
+
+ for master in topology.masters:
+ agmt = master[1]
+
+ log.info("Check attr %s on %s" % (WAITFOR_ASYNC_ATTR, master[0].serverid))
+ try:
+ if attr_value:
+ entry = master[0].search_s(agmt, ldap.SCOPE_BASE, "%s=%s" % (
+ WAITFOR_ASYNC_ATTR, attr_value))
+ assert entry
+ else:
+ entry = master[0].search_s(agmt, ldap.SCOPE_BASE, "%s=*" % WAITFOR_ASYNC_ATTR)
+ assert not entry
+ except ldap.LDAPError as e:
+ log.fatal('Search failed, error: ' + e.message['desc'])
+ assert False
+
+
+def test_behavior_with_value(topology, waitfor_async_attr, entries):
+ """Tests replication behavior with valid
+ nsDS5ReplicaWaitForAsyncResults attribute values
+ """
+
+ master1 = topology.masters[0][0]
+ sync_dict = Counter()
+ min_ap = waitfor_async_attr[1][0]
+ max_ap = waitfor_async_attr[1][1]
+
+ log.info("Gather all sync attempts within Counter dict, group by timestamp")
+ with open(master1.errlog, 'r') as errlog:
+ errlog_filtered = filter(lambda x: "waitfor_async_results" in x, errlog)
+ for line in errlog_filtered:
+ # Watch only over unsuccessful sync attempts
+ if line.split()[4] != line.split()[5]:
+ timestamp = line.split(']')[0]
+ sync_dict[timestamp] += 1
+
+ log.info("Take the most common timestamp and assert it has appeared " \
+ "in the range from %s to %s times" % (min_ap, max_ap))
+ most_common_val = sync_dict.most_common(1)[0][1]
+ assert min_ap <= most_common_val <= max_ap
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
1
0
dirsrvtests/suites/replication/wait_for_async_feature_test.py | 280 ++++++++++
1 file changed, 280 insertions(+)
New commits:
commit 7ee822e1a246d6d32a52dce5f7ad3ed9e491490d
Author: Simon Pichugin <spichugi(a)redhat.com>
Date: Tue Oct 13 14:10:59 2015 +0200
Ticket 47957 - Add replication test suite for a wait async feature
Description: Test new attribute "nsDS5ReplicaWaitForAsyncResults".
After setting the attribute, supplier will sleep established
amount of millisecond if it finds the response from consumer
is not ready.
Tests:
- not integer value;
- multi value;
- check that value has been set correctly [None, 2000, 0, -5];
- replication behavior with valid values [None, 2000, 0, -5].
https://fedorahosted.org/389/ticket/47957
Reviewed by: nhosoi(a)redhat.com (Thanks, Noriko!)
(cherry picked from commit 2c702c4f44512e8731c3d0a026cbc8838517345f)
diff --git a/dirsrvtests/suites/replication/wait_for_async_feature_test.py b/dirsrvtests/suites/replication/wait_for_async_feature_test.py
new file mode 100644
index 0000000..4905088
--- /dev/null
+++ b/dirsrvtests/suites/replication/wait_for_async_feature_test.py
@@ -0,0 +1,280 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+from collections import Counter
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+installation1_prefix = None
+
+WAITFOR_ASYNC_ATTR = "nsDS5ReplicaWaitForAsyncResults"
+
+class TopologyReplication(object):
+ def __init__(self, master1, master2, m1_m2_agmt, m2_m1_agmt):
+ master1.open()
+ master2.open()
+ self.masters = ((master1, m1_m2_agmt),
+ (master2, m2_m1_agmt))
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ global installation1_prefix
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Creating master 1...
+ master1 = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.delete()
+ master1.create()
+ master1.open()
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+
+ # Creating master 2...
+ master2 = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.delete()
+ master2.create()
+ master2.open()
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ #
+ # Create all the agreements
+ #
+ # Creating agreement from master 1 to master 2
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m1_m2_agmt = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ if not m1_m2_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m1_m2_agmt)
+
+ # Creating agreement from master 2 to master 1
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m2_m1_agmt = master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
+ if not m2_m1_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m2_m1_agmt)
+
+ # Allow the replicas to get situated with the new agreements...
+ time.sleep(5)
+
+ #
+ # Initialize all the agreements
+ #
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(m1_m2_agmt)
+ master2.agreement.init(SUFFIX, HOST_MASTER_1, PORT_MASTER_1)
+ master2.waitForReplInit(m2_m1_agmt)
+
+ # Check replication is working...
+ if master1.testReplication(DEFAULT_SUFFIX, master2):
+ log.info('Replication is working.')
+ else:
+ log.fatal('Replication is not working.')
+ assert False
+
+ log.info("Set Replication Debugging loglevel for the errorlog")
+ master1.setLogLevel(lib389.LOG_REPLICA)
+ master2.setLogLevel(lib389.LOG_REPLICA)
+
+ # Delete each instance in the end
+ def fin():
+ master1.delete()
+ master2.delete()
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ master1.clearTmpDir(__file__)
+
+ return TopologyReplication(master1, master2, m1_m2_agmt, m2_m1_agmt)
+
+
+(a)pytest.fixture(params=[(None, (4, 10)),
+ ('2000', (0, 1)),
+ ('0', (4, 10)),
+ ('-5', (4, 10))])
+def waitfor_async_attr(topology, request):
+ """Sets attribute on all replicas"""
+
+ attr_value = request.param[0]
+ expected_result = request.param[1]
+
+ # Run through all masters
+ for master in topology.masters:
+ agmt = master[1]
+ try:
+ if attr_value:
+ log.info("Set %s: %s on %s" % (
+ WAITFOR_ASYNC_ATTR, attr_value, master[0].serverid))
+ mod = [(ldap.MOD_REPLACE, WAITFOR_ASYNC_ATTR, attr_value)]
+ else:
+ log.info("Delete %s from %s" % (
+ WAITFOR_ASYNC_ATTR, master[0].serverid))
+ mod = [(ldap.MOD_DELETE, WAITFOR_ASYNC_ATTR, None)]
+ master[0].modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ log.error('Failed to set or delete %s attribute: (%s)' % (
+ WAITFOR_ASYNC_ATTR, e.message['desc']))
+
+ return (attr_value, expected_result)
+
+
+(a)pytest.fixture
+def entries(topology, request):
+ """Adds entries to the master1"""
+
+ master1 = topology.masters[0][0]
+
+ TEST_OU = "test"
+ test_dn = SUFFIX
+ test_list = []
+
+ log.info("Add 100 nested entries under replicated suffix on %s" % master1.serverid)
+ for i in xrange(100):
+ test_dn = 'ou=%s%s,%s' % (TEST_OU, i, test_dn)
+ test_list.insert(0, test_dn)
+ try:
+ master1.add_s(Entry((test_dn,
+ {'objectclass': 'top',
+ 'objectclass': 'organizationalUnit',
+ 'ou': TEST_OU})))
+ except ldap.LDAPError as e:
+ log.error('Failed to add entry (%s): error (%s)' % (test_dn,
+ e.message['desc']))
+ assert False
+
+ log.info("Delete created entries")
+ for test_dn in test_list:
+ try:
+ master1.delete_s(test_dn)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete entry (%s): error (%s)' % (test_dn,
+ e.message['desc']))
+ assert False
+
+ def fin():
+ log.info("Clear the errors log in the end of the test case")
+ with open(master1.errlog, 'w') as errlog:
+ errlog.writelines("")
+ request.addfinalizer(fin)
+
+
+def test_not_int_value(topology):
+ """Tests not integer value"""
+
+ master1 = topology.masters[0][0]
+ agmt = topology.masters[0][1]
+
+ log.info("Try to set %s: wv1" % WAITFOR_ASYNC_ATTR)
+ try:
+ mod = [(ldap.MOD_REPLACE, WAITFOR_ASYNC_ATTR, "wv1")]
+ master1.modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ assert e.message['desc'] == 'Invalid syntax'
+
+
+def test_multi_value(topology):
+ """Tests multi value"""
+
+ master1 = topology.masters[0][0]
+ agmt = topology.masters[0][1]
+ log.info("agmt: %s" % agmt)
+
+ log.info("Try to set %s: 100 and 101 in the same time (multi value test)" % (
+ WAITFOR_ASYNC_ATTR))
+ try:
+ mod = [(ldap.MOD_ADD, WAITFOR_ASYNC_ATTR, "100")]
+ master1.modify_s(agmt, mod)
+ mod = [(ldap.MOD_ADD, WAITFOR_ASYNC_ATTR, "101")]
+ master1.modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ assert e.message['desc'] == 'Object class violation'
+
+
+def test_value_check(topology, waitfor_async_attr):
+ """Checks that value has been set correctly"""
+
+ attr_value = waitfor_async_attr[0]
+
+ for master in topology.masters:
+ agmt = master[1]
+
+ log.info("Check attr %s on %s" % (WAITFOR_ASYNC_ATTR, master[0].serverid))
+ try:
+ if attr_value:
+ entry = master[0].search_s(agmt, ldap.SCOPE_BASE, "%s=%s" % (
+ WAITFOR_ASYNC_ATTR, attr_value))
+ assert entry
+ else:
+ entry = master[0].search_s(agmt, ldap.SCOPE_BASE, "%s=*" % WAITFOR_ASYNC_ATTR)
+ assert not entry
+ except ldap.LDAPError as e:
+ log.fatal('Search failed, error: ' + e.message['desc'])
+ assert False
+
+
+def test_behavior_with_value(topology, waitfor_async_attr, entries):
+ """Tests replication behavior with valid
+ nsDS5ReplicaWaitForAsyncResults attribute values
+ """
+
+ master1 = topology.masters[0][0]
+ sync_dict = Counter()
+ min_ap = waitfor_async_attr[1][0]
+ max_ap = waitfor_async_attr[1][1]
+
+ log.info("Gather all sync attempts within Counter dict, group by timestamp")
+ with open(master1.errlog, 'r') as errlog:
+ errlog_filtered = filter(lambda x: "waitfor_async_results" in x, errlog)
+ for line in errlog_filtered:
+ # Watch only over unsuccessful sync attempts
+ if line.split()[4] != line.split()[5]:
+ timestamp = line.split(']')[0]
+ sync_dict[timestamp] += 1
+
+ log.info("Take the most common timestamp and assert it has appeared " \
+ "in the range from %s to %s times" % (min_ap, max_ap))
+ most_common_val = sync_dict.most_common(1)[0][1]
+ assert min_ap <= most_common_val <= max_ap
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
1
0
dirsrvtests/suites/replication/wait_for_async_feature_test.py | 280 ++++++++++
1 file changed, 280 insertions(+)
New commits:
commit 2c702c4f44512e8731c3d0a026cbc8838517345f
Author: Simon Pichugin <spichugi(a)redhat.com>
Date: Tue Oct 13 14:10:59 2015 +0200
Ticket 47957 - Add replication test suite for a wait async feature
Description: Test new attribute "nsDS5ReplicaWaitForAsyncResults".
After setting the attribute, supplier will sleep established
amount of millisecond if it finds the response from consumer
is not ready.
Tests:
- not integer value;
- multi value;
- check that value has been set correctly [None, 2000, 0, -5];
- replication behavior with valid values [None, 2000, 0, -5].
https://fedorahosted.org/389/ticket/47957
Reviewed by: nhosoi(a)redhat.com (Thanks, Noriko!)
diff --git a/dirsrvtests/suites/replication/wait_for_async_feature_test.py b/dirsrvtests/suites/replication/wait_for_async_feature_test.py
new file mode 100644
index 0000000..4905088
--- /dev/null
+++ b/dirsrvtests/suites/replication/wait_for_async_feature_test.py
@@ -0,0 +1,280 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+from collections import Counter
+
+logging.getLogger(__name__).setLevel(logging.DEBUG)
+log = logging.getLogger(__name__)
+
+installation1_prefix = None
+
+WAITFOR_ASYNC_ATTR = "nsDS5ReplicaWaitForAsyncResults"
+
+class TopologyReplication(object):
+ def __init__(self, master1, master2, m1_m2_agmt, m2_m1_agmt):
+ master1.open()
+ master2.open()
+ self.masters = ((master1, m1_m2_agmt),
+ (master2, m2_m1_agmt))
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ global installation1_prefix
+ if installation1_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation1_prefix
+
+ # Creating master 1...
+ master1 = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+ instance_master1 = master1.exists()
+ if instance_master1:
+ master1.delete()
+ master1.create()
+ master1.open()
+ master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
+
+ # Creating master 2...
+ master2 = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+ instance_master2 = master2.exists()
+ if instance_master2:
+ master2.delete()
+ master2.create()
+ master2.open()
+ master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
+
+ #
+ # Create all the agreements
+ #
+ # Creating agreement from master 1 to master 2
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m1_m2_agmt = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
+ if not m1_m2_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m1_m2_agmt)
+
+ # Creating agreement from master 2 to master 1
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ m2_m1_agmt = master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
+ if not m2_m1_agmt:
+ log.fatal("Fail to create a master -> master replica agreement")
+ sys.exit(1)
+ log.debug("%s created" % m2_m1_agmt)
+
+ # Allow the replicas to get situated with the new agreements...
+ time.sleep(5)
+
+ #
+ # Initialize all the agreements
+ #
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(m1_m2_agmt)
+ master2.agreement.init(SUFFIX, HOST_MASTER_1, PORT_MASTER_1)
+ master2.waitForReplInit(m2_m1_agmt)
+
+ # Check replication is working...
+ if master1.testReplication(DEFAULT_SUFFIX, master2):
+ log.info('Replication is working.')
+ else:
+ log.fatal('Replication is not working.')
+ assert False
+
+ log.info("Set Replication Debugging loglevel for the errorlog")
+ master1.setLogLevel(lib389.LOG_REPLICA)
+ master2.setLogLevel(lib389.LOG_REPLICA)
+
+ # Delete each instance in the end
+ def fin():
+ master1.delete()
+ master2.delete()
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ master1.clearTmpDir(__file__)
+
+ return TopologyReplication(master1, master2, m1_m2_agmt, m2_m1_agmt)
+
+
+(a)pytest.fixture(params=[(None, (4, 10)),
+ ('2000', (0, 1)),
+ ('0', (4, 10)),
+ ('-5', (4, 10))])
+def waitfor_async_attr(topology, request):
+ """Sets attribute on all replicas"""
+
+ attr_value = request.param[0]
+ expected_result = request.param[1]
+
+ # Run through all masters
+ for master in topology.masters:
+ agmt = master[1]
+ try:
+ if attr_value:
+ log.info("Set %s: %s on %s" % (
+ WAITFOR_ASYNC_ATTR, attr_value, master[0].serverid))
+ mod = [(ldap.MOD_REPLACE, WAITFOR_ASYNC_ATTR, attr_value)]
+ else:
+ log.info("Delete %s from %s" % (
+ WAITFOR_ASYNC_ATTR, master[0].serverid))
+ mod = [(ldap.MOD_DELETE, WAITFOR_ASYNC_ATTR, None)]
+ master[0].modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ log.error('Failed to set or delete %s attribute: (%s)' % (
+ WAITFOR_ASYNC_ATTR, e.message['desc']))
+
+ return (attr_value, expected_result)
+
+
+(a)pytest.fixture
+def entries(topology, request):
+ """Adds entries to the master1"""
+
+ master1 = topology.masters[0][0]
+
+ TEST_OU = "test"
+ test_dn = SUFFIX
+ test_list = []
+
+ log.info("Add 100 nested entries under replicated suffix on %s" % master1.serverid)
+ for i in xrange(100):
+ test_dn = 'ou=%s%s,%s' % (TEST_OU, i, test_dn)
+ test_list.insert(0, test_dn)
+ try:
+ master1.add_s(Entry((test_dn,
+ {'objectclass': 'top',
+ 'objectclass': 'organizationalUnit',
+ 'ou': TEST_OU})))
+ except ldap.LDAPError as e:
+ log.error('Failed to add entry (%s): error (%s)' % (test_dn,
+ e.message['desc']))
+ assert False
+
+ log.info("Delete created entries")
+ for test_dn in test_list:
+ try:
+ master1.delete_s(test_dn)
+ except ldap.LDAPError, e:
+ log.error('Failed to delete entry (%s): error (%s)' % (test_dn,
+ e.message['desc']))
+ assert False
+
+ def fin():
+ log.info("Clear the errors log in the end of the test case")
+ with open(master1.errlog, 'w') as errlog:
+ errlog.writelines("")
+ request.addfinalizer(fin)
+
+
+def test_not_int_value(topology):
+ """Tests not integer value"""
+
+ master1 = topology.masters[0][0]
+ agmt = topology.masters[0][1]
+
+ log.info("Try to set %s: wv1" % WAITFOR_ASYNC_ATTR)
+ try:
+ mod = [(ldap.MOD_REPLACE, WAITFOR_ASYNC_ATTR, "wv1")]
+ master1.modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ assert e.message['desc'] == 'Invalid syntax'
+
+
+def test_multi_value(topology):
+ """Tests multi value"""
+
+ master1 = topology.masters[0][0]
+ agmt = topology.masters[0][1]
+ log.info("agmt: %s" % agmt)
+
+ log.info("Try to set %s: 100 and 101 in the same time (multi value test)" % (
+ WAITFOR_ASYNC_ATTR))
+ try:
+ mod = [(ldap.MOD_ADD, WAITFOR_ASYNC_ATTR, "100")]
+ master1.modify_s(agmt, mod)
+ mod = [(ldap.MOD_ADD, WAITFOR_ASYNC_ATTR, "101")]
+ master1.modify_s(agmt, mod)
+ except ldap.LDAPError as e:
+ assert e.message['desc'] == 'Object class violation'
+
+
+def test_value_check(topology, waitfor_async_attr):
+ """Checks that value has been set correctly"""
+
+ attr_value = waitfor_async_attr[0]
+
+ for master in topology.masters:
+ agmt = master[1]
+
+ log.info("Check attr %s on %s" % (WAITFOR_ASYNC_ATTR, master[0].serverid))
+ try:
+ if attr_value:
+ entry = master[0].search_s(agmt, ldap.SCOPE_BASE, "%s=%s" % (
+ WAITFOR_ASYNC_ATTR, attr_value))
+ assert entry
+ else:
+ entry = master[0].search_s(agmt, ldap.SCOPE_BASE, "%s=*" % WAITFOR_ASYNC_ATTR)
+ assert not entry
+ except ldap.LDAPError as e:
+ log.fatal('Search failed, error: ' + e.message['desc'])
+ assert False
+
+
+def test_behavior_with_value(topology, waitfor_async_attr, entries):
+ """Tests replication behavior with valid
+ nsDS5ReplicaWaitForAsyncResults attribute values
+ """
+
+ master1 = topology.masters[0][0]
+ sync_dict = Counter()
+ min_ap = waitfor_async_attr[1][0]
+ max_ap = waitfor_async_attr[1][1]
+
+ log.info("Gather all sync attempts within Counter dict, group by timestamp")
+ with open(master1.errlog, 'r') as errlog:
+ errlog_filtered = filter(lambda x: "waitfor_async_results" in x, errlog)
+ for line in errlog_filtered:
+ # Watch only over unsuccessful sync attempts
+ if line.split()[4] != line.split()[5]:
+ timestamp = line.split(']')[0]
+ sync_dict[timestamp] += 1
+
+ log.info("Take the most common timestamp and assert it has appeared " \
+ "in the range from %s to %s times" % (min_ap, max_ap))
+ most_common_val = sync_dict.most_common(1)[0][1]
+ assert min_ap <= most_common_val <= max_ap
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
1
0
rpm.mk | 4 ++++
1 file changed, 4 insertions(+)
New commits:
commit 46c40528284ee9a717aea59d99ff2bcab0c980f2
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Tue Jul 21 11:28:33 2015 -0600
Ticket #48227 rpm.mk doesn't build srpms for 389-ds and nunc-stans
https://fedorahosted.org/389/ticket/48227
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.3.4
Fix Description: Add makefile macros for the nunc stans tarball name
and url. Grab the nunc stans tarball from the url with wget and
copy it to the SOURCES.
Platforms tested: Fedora 21
Flag Day: no
Doc impact: no
(cherry picked from commit 684f8c5f10226ce4328a37c510a1ef0a61db4e69)
diff --git a/rpm.mk b/rpm.mk
index fffc528..aa397b7 100644
--- a/rpm.mk
+++ b/rpm.mk
@@ -4,6 +4,8 @@ RPM_RELEASE ?= $(shell $(PWD)/rpm/rpmverrel.sh release)
PACKAGE = 389-ds-base
RPM_NAME_VERSION = $(PACKAGE)-$(RPM_VERSION)
TARBALL = $(RPM_NAME_VERSION).tar.bz2
+NUNC_STANS_URL ?= $(shell rpmspec -P -D 'use_nunc_stans 1' $(PWD)/rpm/389-ds-base.spec.in | awk '/^Source3:/ {print $$2}')
+NUNC_STANS_TARBALL ?= $(shell basename "$(NUNC_STANS_URL)")
clean:
rm -rf dist
@@ -17,6 +19,7 @@ tarballs: local-archive
-mkdir -p dist/sources
cd dist; tar cfj sources/$(TARBALL) $(RPM_NAME_VERSION)
rm -rf dist/$(RPM_NAME_VERSION)
+ cd dist/sources; wget $(NUNC_STANS_URL)
rpmroot:
rm -rf $(RPMBUILD)
@@ -34,6 +37,7 @@ srpmdistdir:
rpmbuildprep:
cp dist/sources/$(TARBALL) $(RPMBUILD)/SOURCES/
+ cp dist/sources/$(NUNC_STANS_TARBALL) $(RPMBUILD)/SOURCES/
cp rpm/$(PACKAGE)-* $(RPMBUILD)/SOURCES/
sed -e s/__VERSION__/$(RPM_VERSION)/ -e s/__RELEASE__/$(RPM_RELEASE)/ \
rpm/$(PACKAGE).spec.in > $(RPMBUILD)/SPECS/$(PACKAGE).spec
1
0
09 Oct '15
dirsrvtests/suites/acl/acl_test.py | 953 +++++++++++++++++
dirsrvtests/tickets/ticket47553_ger.py | 475 --------
dirsrvtests/tickets/ticket47553_rdn_write_test.py | 143 --
dirsrvtests/tickets/ticket47553_single_aci_test.py | 1137 ---------------------
4 files changed, 929 insertions(+), 1779 deletions(-)
New commits:
commit cc7229e97bd5cc40b5786ca693a7feed4d3521d5
Author: Simon Pichugin <spichugi(a)redhat.com>
Date: Wed Sep 2 11:27:36 2015 +0200
Ticket 48264 - Ticket 47553 tests refactoring
Description: Refactor these tests according to the pytest and PEP8 way:
- ticket47553_ger.py;
- ticket47553_rdn_write_test.py;
- ticket47553_single_aci_test.py.
Move them to the dirsrvtests/suites/acl/acl_test.py test suite.
https://fedorahosted.org/389/ticket/48264
Reviewed by: mreynolds(a)redhat.com (Thanks!)
(cherry picked from commit edaa28b1266312ef8dce737af46e09e130c7135a)
diff --git a/dirsrvtests/suites/acl/acl_test.py b/dirsrvtests/suites/acl/acl_test.py
index 36aed33..422a1ec 100644
--- a/dirsrvtests/suites/acl/acl_test.py
+++ b/dirsrvtests/suites/acl/acl_test.py
@@ -18,48 +18,167 @@ from lib389._constants import *
from lib389.properties import *
from lib389.tasks import *
from lib389.utils import *
+from ldap.controls.simple import GetEffectiveRightsControl
logging.getLogger(__name__).setLevel(logging.DEBUG)
log = logging.getLogger(__name__)
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
installation1_prefix = None
+installation2_prefix = None
+
+TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
+
+STAGING_CN = "staged user"
+PRODUCTION_CN = "accounts"
+EXCEPT_CN = "excepts"
+
+STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
+PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
+PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
+
+STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
+PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
+BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
+BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
+
+BIND_CN = "bind_entry"
+BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
+BIND_PW = "password"
+NEW_ACCOUNT = "new_account"
+MAX_ACCOUNTS = 20
-class TopologyStandalone(object):
- def __init__(self, standalone):
- standalone.open()
- self.standalone = standalone
+CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
+
+SRC_ENTRY_CN = "tuser"
+EXT_RDN = "01"
+DST_ENTRY_CN = SRC_ENTRY_CN + EXT_RDN
+
+SRC_ENTRY_DN = "cn=%s,%s" % (SRC_ENTRY_CN, SUFFIX)
+DST_ENTRY_DN = "cn=%s,%s" % (DST_ENTRY_CN, SUFFIX)
+
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
@pytest.fixture(scope="module")
def topology(request):
+ """This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ """
+
global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
- # Creating standalone instance ...
- standalone = DirSrv(verbose=False)
- args_instance[SER_HOST] = HOST_STANDALONE
- args_instance[SER_PORT] = PORT_STANDALONE
- args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
- args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
- args_standalone = args_instance.copy()
- standalone.allocate(args_standalone)
- instance_standalone = standalone.exists()
- if instance_standalone:
- standalone.delete()
- standalone.create()
- standalone.open()
-
- # Delete each instance in the end
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ instance_master2 = master2.exists()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX,
+ role=REPLICAROLE_MASTER,
+ replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX,
+ role=REPLICAROLE_MASTER,
+ replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ repl_agreement = master1.agreement.create(suffix=SUFFIX,
+ host=master2.host,
+ port=master2.port,
+ properties=properties)
+
+ if not repl_agreement:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % repl_agreement)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=SUFFIX,
+ host=master1.host,
+ port=master1.port,
+ properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(repl_agreement)
+
+ # Check replication is working fine
+ if master1.testReplication(DEFAULT_SUFFIX, master2):
+ log.info('Replication is working.')
+ else:
+ log.fatal('Replication is not working.')
+ assert False
+
def fin():
- standalone.delete()
+ master1.delete()
+ master2.delete()
request.addfinalizer(fin)
- # Clear out the tmp dir
- standalone.clearTmpDir(__file__)
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
- return TopologyStandalone(standalone)
+ # Here we have two instances master and consumer
+ # with replication working.
+ return TopologyMaster1Master2(master1, master2)
def add_attr(topology, attr_name):
@@ -135,7 +254,7 @@ def test_aci_attr_subtype_targetattr(topology, aci_with_attr_subtype):
log.info(" Search for the added attribute")
try:
- entries = topology.standalone.search_s(DEFAULT_SUFFIX,
+ entries = topology.master1.search_s(DEFAULT_SUFFIX,
ldap.SCOPE_BASE,
'(objectclass=*)', ['aci'])
entry = str(entries[0])
@@ -147,6 +266,792 @@ def test_aci_attr_subtype_targetattr(topology, aci_with_attr_subtype):
assert False
+def _bind_manager(topology):
+ topology.master1.log.info("Bind as %s " % DN_DM)
+ topology.master1.simple_bind_s(DN_DM, PASSWORD)
+
+
+def _bind_normal(topology):
+ # bind as bind_entry
+ topology.master1.log.info("Bind as %s" % BIND_DN)
+ topology.master1.simple_bind_s(BIND_DN, BIND_PW)
+
+
+def _moddn_aci_deny_tree(topology, mod_type=None,
+ target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
+ """It denies the access moddn_to in cn=except,cn=accounts,SUFFIX"""
+
+ assert mod_type is not None
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ #topology.master1.modify_s(SUFFIX, mod)
+ topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
+ topology.master1.modify_s(PROD_EXCEPT_DN, mod)
+
+
+def _write_aci_staging(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % STAGING_DN
+ ACI_ALLOW = "(version 3.0; acl \"write staging entries\"; allow (write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+
+def _write_aci_production(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % PRODUCTION_DN
+ ACI_ALLOW = "(version 3.0; acl \"write production entries\"; allow (write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+
+def _moddn_aci_staging_to_production(topology, mod_type=None,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN):
+ assert mod_type is not None
+
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+ _write_aci_staging(topology, mod_type=mod_type)
+
+
+def _moddn_aci_from_production_to_staging(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (
+ PRODUCTION_DN, STAGING_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+ _write_aci_production(topology, mod_type=mod_type)
+
+
+(a)pytest.fixture(scope="module")
+def moddn_setup(topology):
+ """Creates
+ - a staging DIT
+ - a production DIT
+ - add accounts in staging DIT
+ - enable ACL logging (commented for performance reason)
+ """
+
+ topology.master1.log.info("\n\n######## INITIALIZATION ########\n")
+
+ # entry used to bind with
+ topology.master1.log.info("Add %s" % BIND_DN)
+ topology.master1.add_s(Entry((BIND_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': BIND_CN,
+ 'cn': BIND_CN,
+ 'userpassword': BIND_PW})))
+
+ # DIT for staging
+ topology.master1.log.info("Add %s" % STAGING_DN)
+ topology.master1.add_s(Entry((STAGING_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': STAGING_CN,
+ 'description': "staging DIT"})))
+
+ # DIT for production
+ topology.master1.log.info("Add %s" % PRODUCTION_DN)
+ topology.master1.add_s(Entry((PRODUCTION_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': PRODUCTION_CN,
+ 'description': "production DIT"})))
+
+ # DIT for production/except
+ topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
+ topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': EXCEPT_CN,
+ 'description': "production except DIT"})))
+
+ # enable acl error logging
+ #mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
+ #topology.master1.modify_s(DN_CONFIG, mod)
+ #topology.master2.modify_s(DN_CONFIG, mod)
+
+ # add dummy entries in the staging DIT
+ for cpt in range(MAX_ACCOUNTS):
+ name = "%s%d" % (NEW_ACCOUNT, cpt)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+
+
+def test_mode_default_add_deny(topology, moddn_setup):
+ """This test case checks
+ that the ADD operation fails (no ADD aci on production)
+ """
+
+ topology.master1.log.info("\n\n######## mode moddn_aci : ADD (should fail) ########\n")
+
+ _bind_normal(topology)
+
+ #
+ # First try to add an entry in production => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
+ name = "%s%d" % (NEW_ACCOUNT, 0)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+ assert 0 # this is an error, we should not be allowed to add an entry in production
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+def test_mode_default_delete_deny(topology, moddn_setup):
+ """This test case checks
+ that the DEL operation fails (no 'delete' aci on production)
+ """
+
+ topology.master1.log.info("\n\n######## DELETE (should fail) ########\n")
+
+ _bind_normal(topology)
+ #
+ # Second try to delete an entry in staging => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to delete %s" % STAGING_DN)
+ name = "%s%d" % (NEW_ACCOUNT, 0)
+ topology.master1.delete_s("cn=%s,%s" % (name, STAGING_DN))
+ assert 0 # this is an error, we should not be allowed to add an entry in production
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+(a)pytest.mark.parametrize("index,tfrom,tto,failure",
+ [(0, STAGING_DN, PRODUCTION_DN, False),
+ (1, STAGING_DN, PRODUCTION_DN, False),
+ (2, STAGING_DN, BAD_PRODUCTION_PATTERN, True),
+ (3, STAGING_PATTERN, PRODUCTION_DN, False),
+ (4, BAD_STAGING_PATTERN, PRODUCTION_DN, True),
+ (5, STAGING_PATTERN, PRODUCTION_PATTERN, False),
+ (6, None, PRODUCTION_PATTERN, False),
+ (7, STAGING_PATTERN, None, False),
+ (8, None, None, False)])
+def test_moddn_staging_prod(topology, moddn_setup,
+ index, tfrom, tto, failure):
+ """This test case MOVE entry NEW_ACCOUNT0 from staging to prod
+ target_to/target_from: equality filter
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (%s) ########\n" % index)
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s%s" % (NEW_ACCOUNT, index)
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=tfrom, target_to=tto)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ if failure:
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=tfrom, target_to=tto)
+ _bind_normal(topology)
+
+
+def test_moddn_staging_prod_9(topology, moddn_setup):
+ """This test case disable the 'moddn' right so a MODDN requires a 'add' right
+ to be successfull.
+ It fails to MOVE entry NEW_ACCOUNT9 from staging to prod.
+ Add a 'add' right to prod.
+ Then it succeeds to MOVE NEW_ACCOUNT9 from staging to prod.
+
+ Then enable the 'moddn' right so a MODDN requires a 'moddn' right
+ It fails to MOVE entry NEW_ACCOUNT10 from staging to prod.
+ Add a 'moddn' right to prod.
+ Then it succeeds to MOVE NEW_ACCOUNT10 from staging to prod.
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (9) ########\n")
+
+ _bind_normal(topology)
+ old_rdn = "cn=%s9" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ #############
+ # Now do tests with no support of moddn aci
+ #############
+ topology.master1.log.info("Disable the moddn right")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+ # Add the moddn aci that will not be evaluated because of the config flag
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ # It will fail because it will test the ADD right
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # remove the moddn aci
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ #
+ # add the 'add' right to the production DN
+ # Then do a successfull moddn
+ #
+ ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_ALLOW + ACI_SUBJECT
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ #############
+ # Now do tests with support of moddn aci
+ #############
+ topology.master1.log.info("Enable the moddn right")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'on')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (10) ########\n")
+
+ _bind_normal(topology)
+ old_rdn = "cn=%s10" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ #
+ # add the 'add' right to the production DN
+ # Then do a failing moddn
+ #
+ ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_ALLOW + ACI_SUBJECT
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ # Add the moddn aci that will be evaluated because of the config flag
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ # remove the moddn aci
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_moddn_prod_staging(topology, moddn_setup):
+ """This test checks that we can move ACCOUNT11 from staging to prod
+ but not move back ACCOUNT11 from prod to staging
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (11) ########\n")
+
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s11" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ # Now check we can not move back the entry to staging
+ old_rdn = "cn=%s11" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, PRODUCTION_DN)
+ new_rdn = old_rdn
+ new_superior = STAGING_DN
+
+ # add the write right because we want to check the moddn
+ _bind_manager(topology)
+ _write_aci_production(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to move back MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ _bind_manager(topology)
+ _write_aci_production(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_check_repl_M2_to_M1(topology, moddn_setup):
+ """Checks that replication is still working M2->M1, using ACCOUNT12"""
+
+ topology.master1.log.info("Bind as %s (M2)" % DN_DM)
+ topology.master2.simple_bind_s(DN_DM, PASSWORD)
+
+ rdn = "cn=%s12" % NEW_ACCOUNT
+ dn = "%s,%s" % (rdn, STAGING_DN)
+
+ # First wait for the ACCOUNT19 entry being replicated on M2
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ assert loop <= 10
+
+ attribute = 'description'
+ tested_value = 'Hello world'
+ mod = [(ldap.MOD_ADD, attribute, tested_value)]
+ topology.master1.log.info("Update (M2) %s (%s)" % (dn, attribute))
+ topology.master2.modify_s(dn, mod)
+
+ loop = 0
+ while loop <= 10:
+ ent = topology.master1.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
+ assert ent is not None
+ if ent.hasAttr(attribute) and (ent.getValue(attribute) == tested_value):
+ break
+
+ time.sleep(1)
+ loop += 1
+ assert loop < 10
+ topology.master1.log.info("Update %s (%s) replicated on M1" % (dn, attribute))
+
+
+def test_moddn_staging_prod_except(topology, moddn_setup):
+ """This test case MOVE entry NEW_ACCOUNT13 from staging to prod
+ but fails to move entry NEW_ACCOUNT14 from staging to prod_except
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (13) ########\n")
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s13" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ #
+ # Now try to move an entry under except
+ #
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod/Except (14) ########\n")
+ old_rdn = "cn=%s14" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PROD_EXCEPT_DN
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+
+def test_mode_default_ger_no_moddn(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode moddn_aci : GER no moddn ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_mode_default_ger_with_moddn(topology, moddn_setup):
+ """This test case adds the moddn aci and check ger contains 'n'"""
+
+ topology.master1.log.info("\n\n######## mode moddn_aci: GER with moddn ########\n")
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_mode_switch_default_to_legacy(topology, moddn_setup):
+ """This test switch the server from default mode to legacy"""
+
+ topology.master1.log.info("\n\n######## Disable the moddn aci mod ########\n")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+
+def test_mode_legacy_ger_no_moddn1(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy 1: GER no moddn ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_mode_legacy_ger_no_moddn2(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy 2: GER no moddn ########\n")
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_mode_legacy_ger_with_moddn(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy : GER with moddn ########\n")
+
+ # being allowed to read/write the RDN attribute use to allow the RDN
+ ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"cn\")" % (PRODUCTION_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN production changing the RDN attribute\"; allow (read,search,write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ #_bind_normal(topology)
+
+
+(a)pytest.fixture(scope="module")
+def rdn_write_setup(topology):
+ topology.master1.log.info("\n\n######## Add entry tuser ########\n")
+ topology.master1.add_s(Entry((SRC_ENTRY_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': SRC_ENTRY_CN,
+ 'cn': SRC_ENTRY_CN})))
+
+
+def test_rdn_write_get_ger(topology, rdn_write_setup):
+ ANONYMOUS_DN = ""
+ topology.master1.log.info("\n\n######## GER rights for anonymous ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True,
+ authzId="dn:" + ANONYMOUS_DN)
+ msg_id = topology.master1.search_ext(SUFFIX,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ for value in attrs['entryLevelRights']:
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_rdn_write_modrdn_anonymous(topology, rdn_write_setup):
+ ANONYMOUS_DN = ""
+ topology.master1.close()
+ topology.master1.binddn = ANONYMOUS_DN
+ topology.master1.open()
+ msg_id = topology.master1.search_ext("", ldap.SCOPE_BASE, "objectclass=*")
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ for attr in attrs:
+ topology.master1.log.info("######## %r: %r" % (attr, attrs[attr]))
+
+ try:
+ topology.master1.rename_s(SRC_ENTRY_DN, "cn=%s" % DST_ENTRY_CN, delold=True)
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ try:
+ topology.master1.getEntry(DST_ENTRY_DN, ldap.SCOPE_BASE, "objectclass=*")
+ assert False
+ except Exception as e:
+ topology.master1.log.info("The entry was not renamed (expected)")
+ isinstance(e, ldap.NO_SUCH_OBJECT)
+
+ _bind_manager(topology)
+
+
if __name__ == '__main__':
# Run isolated
# -s for DEBUG mode
diff --git a/dirsrvtests/tickets/ticket47553_ger.py b/dirsrvtests/tickets/ticket47553_ger.py
deleted file mode 100644
index 1829b48..0000000
--- a/dirsrvtests/tickets/ticket47553_ger.py
+++ /dev/null
@@ -1,475 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2015 Red Hat, Inc.
-# All rights reserved.
-#
-# License: GPL (version 3 or any later version).
-# See LICENSE for details.
-# --- END COPYRIGHT BLOCK ---
-#
-'''
-Created on Nov 7, 2013
-
-@author: tbordaz
-'''
-import os
-import sys
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry, tools
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from ldap.controls.simple import GetEffectiveRightsControl
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-#
-# important part. We can deploy Master1 and Master2 on different versions
-#
-installation1_prefix = None
-installation2_prefix = None
-
-TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
-
-STAGING_CN = "staged user"
-PRODUCTION_CN = "accounts"
-EXCEPT_CN = "excepts"
-
-STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
-PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
-PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
-
-STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
-PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
-BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
-BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
-
-BIND_CN = "bind_entry"
-BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
-BIND_PW = "password"
-
-NEW_ACCOUNT = "new_account"
-MAX_ACCOUNTS = 20
-
-CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
-
-
-class TopologyMaster1Master2(object):
- def __init__(self, master1, master2):
- master1.open()
- self.master1 = master1
-
- master2.open()
- self.master2 = master2
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- '''
- This fixture is used to create a replicated topology for the 'module'.
- The replicated topology is MASTER1 <-> Master2.
- '''
- global installation1_prefix
- global installation2_prefix
-
- # allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
- # Args for the master1 instance
- args_instance[SER_HOST] = HOST_MASTER_1
- args_instance[SER_PORT] = PORT_MASTER_1
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
- args_master = args_instance.copy()
- master1.allocate(args_master)
-
- # allocate master1 on a given deployement
- master2 = DirSrv(verbose=False)
- if installation2_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
- # Args for the consumer instance
- args_instance[SER_HOST] = HOST_MASTER_2
- args_instance[SER_PORT] = PORT_MASTER_2
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
- args_master = args_instance.copy()
- master2.allocate(args_master)
-
- # Get the status of the instance and restart it if it exists
- instance_master1 = master1.exists()
- instance_master2 = master2.exists()
-
- # Remove all the instances
- if instance_master1:
- master1.delete()
- if instance_master2:
- master2.delete()
-
- # Create the instances
- master1.create()
- master1.open()
- master2.create()
- master2.open()
-
- #
- # Now prepare the Master-Consumer topology
- #
- # First Enable replication
- master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
- master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
- # Initialize the supplier->consumer
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
- if not repl_agreement:
- log.fatal("Fail to create a replica agreement")
- sys.exit(1)
-
- log.debug("%s created" % repl_agreement)
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
-
- master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
- master1.waitForReplInit(repl_agreement)
-
- # Check replication is working fine
- if master1.testReplication(DEFAULT_SUFFIX, master2):
- log.info('Replication is working.')
- else:
- log.fatal('Replication is not working.')
- assert False
-
- # clear the tmp directory
- master1.clearTmpDir(__file__)
-
- # Here we have two instances master and consumer
- # with replication working.
- return TopologyMaster1Master2(master1, master2)
-
-
-def _bind_manager(topology):
- topology.master1.log.info("Bind as %s " % DN_DM)
- topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
-
-def _bind_normal(topology):
- # bind as bind_entry
- topology.master1.log.info("Bind as %s" % BIND_DN)
- topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
-
-def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
- '''
- It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
- '''
- if mod_type is None:
- assert False
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- #topology.master1.modify_s(SUFFIX, mod)
- topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
- topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- if mod_type is None:
- assert False
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-
-def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- if mod_type is None:
- assert False
-
- ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-
-def test_ticket47553_init(topology):
- """
- Creates
- - a staging DIT
- - a production DIT
- - add accounts in staging DIT
- - enable ACL logging (commented for performance reason)
-
- """
-
- topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
- # entry used to bind with
- topology.master1.log.info("Add %s" % BIND_DN)
- topology.master1.add_s(Entry((BIND_DN, {
- 'objectclass': "top person".split(),
- 'sn': BIND_CN,
- 'cn': BIND_CN,
- 'userpassword': BIND_PW})))
-
- # DIT for staging
- topology.master1.log.info("Add %s" % STAGING_DN)
- topology.master1.add_s(Entry((STAGING_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': STAGING_CN,
- 'description': "staging DIT"})))
-
- # DIT for production
- topology.master1.log.info("Add %s" % PRODUCTION_DN)
- topology.master1.add_s(Entry((PRODUCTION_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': PRODUCTION_CN,
- 'description': "production DIT"})))
-
- # DIT for production/except
- topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
- topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': EXCEPT_CN,
- 'description': "production except DIT"})))
-
- # enable acl error logging
- #mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
- #topology.master1.modify_s(DN_CONFIG, mod)
- #topology.master2.modify_s(DN_CONFIG, mod)
-
- # add dummy entries in the staging DIT
- for cpt in range(MAX_ACCOUNTS):
- name = "%s%d" % (NEW_ACCOUNT, cpt)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
-
-
-def test_ticket47553_mode_default_add_deny(topology):
- '''
- This test case checks that the ADD operation fails (no ADD aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### mode moddn_aci : ADD (should fail) ######################\n")
-
- _bind_normal(topology)
-
- #
- # First try to add an entry in production => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
-def test_ticket47553_mode_default_ger_no_moddn(topology):
- topology.master1.log.info("\n\n######################### mode moddn_aci : GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-
-def test_ticket47553_mode_default_ger_with_moddn(topology):
- '''
- This test case adds the moddn aci and check ger contains 'n'
- '''
-
- topology.master1.log.info("\n\n######################### mode moddn_aci: GER with moddn ######################\n")
-
- # successfull MOD with the ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_mode_switch_default_to_legacy(topology):
- '''
- This test switch the server from default mode to legacy
- '''
- topology.master1.log.info("\n\n######################### Disable the moddn aci mod ######################\n")
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
-
-def test_ticket47553_mode_legacy_ger_no_moddn1(topology):
- topology.master1.log.info("\n\n######################### mode legacy 1: GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-
-def test_ticket47553_mode_legacy_ger_no_moddn2(topology):
- topology.master1.log.info("\n\n######################### mode legacy 2: GER no moddn ######################\n")
- # successfull MOD with the ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_mode_legacy_ger_with_moddn(topology):
- topology.master1.log.info("\n\n######################### mode legacy : GER with moddn ######################\n")
-
- # being allowed to read/write the RDN attribute use to allow the RDN
- ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"cn\")" % (PRODUCTION_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN production changing the RDN attribute\"; allow (read,search,write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
-
- # successfull MOD with the ACI
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
- _bind_normal(topology)
-
-
-def test_ticket47553_final(topology):
- topology.master1.delete()
- topology.master2.delete()
- log.info('Testcase PASSED')
-
-
-def run_isolated():
- '''
- run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
- - edit this file and comment '@pytest.fixture' line before 'topology' function.
- - set the installation prefix
- - run this program
- '''
- global installation1_prefix
- global installation2_prefix
- installation1_prefix = None
- installation2_prefix = None
-
- topo = topology(True)
- topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
- test_ticket47553_init(topo)
-
- # Check that without appropriate aci we are not allowed to add/delete
- test_ticket47553_mode_default_add_deny(topo)
- test_ticket47553_mode_default_ger_no_moddn(topo)
- test_ticket47553_mode_default_ger_with_moddn(topo)
- test_ticket47553_mode_switch_default_to_legacy(topo)
- test_ticket47553_mode_legacy_ger_no_moddn1(topo)
- test_ticket47553_mode_legacy_ger_no_moddn2(topo)
- test_ticket47553_mode_legacy_ger_with_moddn(topo)
-
- test_ticket47553_final(topo)
-
-
-if __name__ == '__main__':
- run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47553_rdn_write_test.py b/dirsrvtests/tickets/ticket47553_rdn_write_test.py
deleted file mode 100644
index 15d334b..0000000
--- a/dirsrvtests/tickets/ticket47553_rdn_write_test.py
+++ /dev/null
@@ -1,143 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2015 Red Hat, Inc.
-# All rights reserved.
-#
-# License: GPL (version 3 or any later version).
-# See LICENSE for details.
-# --- END COPYRIGHT BLOCK ---
-#
-import os
-import sys
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry, tools, tasks
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from lib389.tasks import *
-from lib389.utils import *
-from ldap.controls.simple import GetEffectiveRightsControl
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-installation1_prefix = None
-
-SRC_ENTRY_CN = "tuser"
-EXT_RDN = "01"
-DST_ENTRY_CN = SRC_ENTRY_CN + EXT_RDN
-
-SRC_ENTRY_DN = "cn=%s,%s" % (SRC_ENTRY_CN, SUFFIX)
-DST_ENTRY_DN = "cn=%s,%s" % (DST_ENTRY_CN, SUFFIX)
-
-
-class TopologyStandalone(object):
- def __init__(self, standalone):
- standalone.open()
- self.standalone = standalone
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- global installation1_prefix
-
- # Creating standalone instance ...
- standalone = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
- args_instance[SER_HOST] = HOST_STANDALONE
- args_instance[SER_PORT] = PORT_STANDALONE
- args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
- args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
- args_standalone = args_instance.copy()
- standalone.allocate(args_standalone)
- instance_standalone = standalone.exists()
- if instance_standalone:
- standalone.delete()
- standalone.create()
- standalone.open()
-
- # Clear out the tmp dir
- standalone.clearTmpDir(__file__)
-
- return TopologyStandalone(standalone)
-
-
-def test_ticket47553_rdn_write_init(topology):
- topology.standalone.log.info("\n\n######################### Add entry tuser ######################\n")
- topology.standalone.add_s(Entry((SRC_ENTRY_DN, {
- 'objectclass': "top person".split(),
- 'sn': SRC_ENTRY_CN,
- 'cn': SRC_ENTRY_CN})))
-
-
-def test_ticket47553_rdn_write_get_ger(topology):
- ANONYMOUS_DN = ""
- topology.standalone.log.info("\n\n######################### GER rights for anonymous ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn:" + ANONYMOUS_DN)
- msg_id = topology.standalone.search_ext(SUFFIX, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.standalone.result3(msg_id)
- value = ''
- for dn, attrs in rdata:
- topology.standalone.log.info("dn: %s" % dn)
- for value in attrs['entryLevelRights']:
- topology.standalone.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-
-def test_ticket47553_rdn_write_modrdn_anonymous(topology):
- ANONYMOUS_DN = ""
- topology.standalone.close()
- topology.standalone.binddn = ANONYMOUS_DN
- topology.standalone.open()
- msg_id = topology.standalone.search_ext("", ldap.SCOPE_BASE, "objectclass=*")
- rtype, rdata, rmsgid, response_ctrl = topology.standalone.result3(msg_id)
- for dn, attrs in rdata:
- topology.standalone.log.info("dn: %s" % dn)
- for attr in attrs:
- topology.standalone.log.info("############### %r: %r" % (attr, attrs[attr]))
-
- try:
- topology.standalone.rename_s(SRC_ENTRY_DN, "cn=%s" % DST_ENTRY_CN, delold=True)
- except Exception as e:
- topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
- isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- try:
- topology.standalone.getEntry(DST_ENTRY_DN, ldap.SCOPE_BASE, "objectclass=*")
- assert False
- except Exception as e:
- topology.standalone.log.info("The entry was not renamed (expected)")
- isinstance(e, ldap.NO_SUCH_OBJECT)
-
-
-def test_ticket47553_rdn_write(topology):
- '''
- Write your testcase here...
- '''
-
- log.info('Test complete')
-
-
-def test_ticket47553_rdn_write_final(topology):
- topology.standalone.delete()
- log.info('Testcase PASSED')
-
-
-def run_isolated():
- global installation1_prefix
- installation1_prefix = '/home/tbordaz/install_master'
-
- topo = topology(True)
- test_ticket47553_rdn_write_init(topo)
- test_ticket47553_rdn_write_get_ger(topo)
- test_ticket47553_rdn_write(topo)
- test_ticket47553_rdn_write_modrdn_anonymous(topo)
- test_ticket47553_rdn_write_final(topo)
-
-
-if __name__ == '__main__':
- run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47553_single_aci_test.py b/dirsrvtests/tickets/ticket47553_single_aci_test.py
deleted file mode 100644
index 1c0b88b..0000000
--- a/dirsrvtests/tickets/ticket47553_single_aci_test.py
+++ /dev/null
@@ -1,1137 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2015 Red Hat, Inc.
-# All rights reserved.
-#
-# License: GPL (version 3 or any later version).
-# See LICENSE for details.
-# --- END COPYRIGHT BLOCK ---
-#
-'''
-Created on Nov 7, 2013
-
-@author: tbordaz
-'''
-import os
-import sys
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry, tools
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from lib389._constants import REPLICAROLE_MASTER
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-#
-# important part. We can deploy Master1 and Master2 on different versions
-#
-installation1_prefix = None
-installation2_prefix = None
-
-TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
-
-STAGING_CN = "staged user"
-PRODUCTION_CN = "accounts"
-EXCEPT_CN = "excepts"
-
-STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
-PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
-PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
-
-STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
-PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
-BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
-BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
-
-BIND_CN = "bind_entry"
-BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
-BIND_PW = "password"
-
-NEW_ACCOUNT = "new_account"
-MAX_ACCOUNTS = 20
-
-CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
-
-
-class TopologyMaster1Master2(object):
- def __init__(self, master1, master2):
- master1.open()
- self.master1 = master1
-
- master2.open()
- self.master2 = master2
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- '''
- This fixture is used to create a replicated topology for the 'module'.
- The replicated topology is MASTER1 <-> Master2.
- '''
- global installation1_prefix
- global installation2_prefix
-
- # allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
- # Args for the master1 instance
- args_instance[SER_HOST] = HOST_MASTER_1
- args_instance[SER_PORT] = PORT_MASTER_1
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
- args_master = args_instance.copy()
- master1.allocate(args_master)
-
- # allocate master1 on a given deployement
- master2 = DirSrv(verbose=False)
- if installation2_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
- # Args for the consumer instance
- args_instance[SER_HOST] = HOST_MASTER_2
- args_instance[SER_PORT] = PORT_MASTER_2
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
- args_master = args_instance.copy()
- master2.allocate(args_master)
-
- # Get the status of the instance
- instance_master1 = master1.exists()
- instance_master2 = master2.exists()
-
- # Remove all the instances
- if instance_master1:
- master1.delete()
- if instance_master2:
- master2.delete()
-
- # Create the instances
- master1.create()
- master1.open()
- master2.create()
- master2.open()
-
- #
- # Now prepare the Master-Consumer topology
- #
- # First Enable replication
- master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
- master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
- # Initialize the supplier->consumer
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
- if not repl_agreement:
- log.fatal("Fail to create a replica agreement")
- sys.exit(1)
-
- log.debug("%s created" % repl_agreement)
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
-
- master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
- master1.waitForReplInit(repl_agreement)
-
- # Check replication is working fine
- if master1.testReplication(DEFAULT_SUFFIX, master2):
- log.info('Replication is working.')
- else:
- log.fatal('Replication is not working.')
- assert False
-
- # clear the tmp directory
- master1.clearTmpDir(__file__)
-
- # Here we have two instances master and consumer
- # with replication working.
- return TopologyMaster1Master2(master1, master2)
-
-
-def _bind_manager(topology):
- topology.master1.log.info("Bind as %s " % DN_DM)
- topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
-
-def _bind_normal(topology):
- # bind as bind_entry
- topology.master1.log.info("Bind as %s" % BIND_DN)
- topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
-
-def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
- '''
- It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
- '''
- assert mod_type is not None
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- #topology.master1.modify_s(SUFFIX, mod)
- topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
- topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-def _write_aci_staging(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % STAGING_DN
- ACI_ALLOW = "(version 3.0; acl \"write staging entries\"; allow (write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-def _write_aci_production(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % PRODUCTION_DN
- ACI_ALLOW = "(version 3.0; acl \"write production entries\"; allow (write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type != None
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type is not None
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
- _write_aci_staging(topology, mod_type=mod_type)
-
-
-def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
- _write_aci_production(topology, mod_type=mod_type)
-
-
-def test_ticket47553_init(topology):
- """
- Creates
- - a staging DIT
- - a production DIT
- - add accounts in staging DIT
- - enable ACL logging (commented for performance reason)
-
- """
-
- topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
- # entry used to bind with
- topology.master1.log.info("Add %s" % BIND_DN)
- topology.master1.add_s(Entry((BIND_DN, {
- 'objectclass': "top person".split(),
- 'sn': BIND_CN,
- 'cn': BIND_CN,
- 'userpassword': BIND_PW})))
-
- # DIT for staging
- topology.master1.log.info("Add %s" % STAGING_DN)
- topology.master1.add_s(Entry((STAGING_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': STAGING_CN,
- 'description': "staging DIT"})))
-
- # DIT for production
- topology.master1.log.info("Add %s" % PRODUCTION_DN)
- topology.master1.add_s(Entry((PRODUCTION_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': PRODUCTION_CN,
- 'description': "production DIT"})))
-
- # DIT for production/except
- topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
- topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': EXCEPT_CN,
- 'description': "production except DIT"})))
-
- # enable acl error logging
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(128+262144))]
- topology.master1.modify_s(DN_CONFIG, mod)
- topology.master2.modify_s(DN_CONFIG, mod)
-
- # add dummy entries in the staging DIT
- for cpt in range(MAX_ACCOUNTS):
- name = "%s%d" % (NEW_ACCOUNT, cpt)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
-
-
-def test_ticket47553_add(topology):
- '''
- This test case checks that the ADD operation fails (no ADD aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### ADD (should fail) ######################\n")
-
- _bind_normal(topology)
-
- #
- # First try to add an entry in production => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
-def test_ticket47553_delete(topology):
- '''
- This test case checks that the DEL operation fails (no 'delete' aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### DELETE (should fail) ######################\n")
-
- _bind_normal(topology)
- #
- # Second try to delete an entry in staging => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to delete %s" % STAGING_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.delete_s("cn=%s,%s" % (name, STAGING_DN))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
-def test_ticket47553_moddn_staging_prod_0(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT0 from staging to prod
- target_to/target_from: equality filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (0) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s0" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_1(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT1 from staging to prod
- target_to/target_from: substring/equality filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (1) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s1" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to substring/ from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_2(topology):
- '''
- This test case fails to MOVE entry NEW_ACCOUNT2 from staging to prod
- because of bad pattern
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (2) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s2" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to substring (BAD)/ from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_3(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT3 from staging to prod
- target_to/target_from: equality/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (3) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s3" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:equality filter / from substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_4(topology):
- '''
- This test case fails to MOVE entry NEW_ACCOUNT4 from staging to prod
- because of bad pattern
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (4) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s4" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: equality filter/ from: substring (BAD) ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_5(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT5 from staging to prod
- target_to/target_from: substring/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (5) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s5" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_6(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT6 from staging to prod
- target_to/target_from: substring/<enmpty> filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (6) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s6" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: empty ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_7(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT7 from staging to prod
- target_to/target_from: <empty>/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (7) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s7" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: empty/ from: substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=None)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=None)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_8(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT8 from staging to prod
- target_to/target_from: <empty>/<empty> filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (8) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s8" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: empty/ from: empty ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=None)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=None)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_9(topology):
- '''
- This test case disable the 'moddn' right so a MODDN requires a 'add' right
- to be successfull.
- It fails to MOVE entry NEW_ACCOUNT9 from staging to prod.
- Add a 'add' right to prod.
- Then it succeeds to MOVE NEW_ACCOUNT9 from staging to prod.
-
- Then enable the 'moddn' right so a MODDN requires a 'moddn' right
- It fails to MOVE entry NEW_ACCOUNT10 from staging to prod.
- Add a 'moddn' right to prod.
- Then it succeeds to MOVE NEW_ACCOUNT10 from staging to prod.
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (9) ######################\n")
-
- _bind_normal(topology)
- old_rdn = "cn=%s9" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- ############################################
- # Now do tests with no support of moddn aci
- ############################################
- topology.master1.log.info("Disable the moddn right")
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
- # Add the moddn aci that will not be evaluated because of the config flag
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- # It will fail because it will test the ADD right
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # remove the moddn aci
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- #
- # add the 'add' right to the production DN
- # Then do a successfull moddn
- #
- ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- ############################################
- # Now do tests with support of moddn aci
- ############################################
- topology.master1.log.info("Enable the moddn right")
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'on')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (10) ######################\n")
-
- _bind_normal(topology)
- old_rdn = "cn=%s10" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- #
- # add the 'add' right to the production DN
- # Then do a failing moddn
- #
- ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- # Add the moddn aci that will be evaluated because of the config flag
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # remove the moddn aci
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_prod_staging(topology):
- '''
- This test checks that we can move ACCOUNT11 from staging to prod
- but not move back ACCOUNT11 from prod to staging
- '''
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (11) ######################\n")
-
- _bind_normal(topology)
-
- old_rdn = "cn=%s11" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # Now check we can not move back the entry to staging
- old_rdn = "cn=%s11" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, PRODUCTION_DN)
- new_rdn = old_rdn
- new_superior = STAGING_DN
-
- # add the write right because we want to check the moddn
- _bind_manager(topology)
- _write_aci_production(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to move back MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- _bind_manager(topology)
- _write_aci_production(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_check_repl_M2_to_M1(topology):
- '''
- Checks that replication is still working M2->M1, using ACCOUNT12
- '''
-
- topology.master1.log.info("Bind as %s (M2)" % DN_DM)
- topology.master2.simple_bind_s(DN_DM, PASSWORD)
-
- rdn = "cn=%s12" % NEW_ACCOUNT
- dn = "%s,%s" % (rdn, STAGING_DN)
-
- # First wait for the ACCOUNT19 entry being replicated on M2
- loop = 0
- while loop <= 10:
- try:
- ent = topology.master2.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
- break
- except ldap.NO_SUCH_OBJECT:
- time.sleep(1)
- loop += 1
- assert loop <= 10
-
- attribute = 'description'
- tested_value = 'Hello world'
- mod = [(ldap.MOD_ADD, attribute, tested_value)]
- topology.master1.log.info("Update (M2) %s (%s)" % (dn, attribute))
- topology.master2.modify_s(dn, mod)
-
- loop = 0
- while loop <= 10:
- ent = topology.master1.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
- assert ent is not None
- if ent.hasAttr(attribute) and (ent.getValue(attribute) == tested_value):
- break
-
- time.sleep(1)
- loop += 1
- assert loop < 10
- topology.master1.log.info("Update %s (%s) replicated on M1" % (dn, attribute))
-
-
-def test_ticket47553_moddn_staging_prod_except(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT13 from staging to prod
- but fails to move entry NEW_ACCOUNT14 from staging to prod_except
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (13) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s13" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- #
- # Now try to move an entry under except
- #
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod/Except (14) ######################\n")
- old_rdn = "cn=%s14" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PROD_EXCEPT_DN
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
-
-def test_ticket47553_final(topology):
- topology.master1.delete()
- topology.master2.delete()
- log.info('Testcase PASSED')
-
-
-def run_isolated():
- '''
- run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
- - edit this file and comment '@pytest.fixture' line before 'topology' function.
- - set the installation prefix
- - run this program
- '''
- global installation1_prefix
- global installation2_prefix
- installation1_prefix = None
- installation2_prefix = None
-
- topo = topology(True)
- topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
- test_ticket47553_init(topo)
-
- # Check that without appropriate aci we are not allowed to add/delete
- test_ticket47553_add(topo)
- test_ticket47553_delete(topo)
-
- # tests the ACI as equality/substring filter
- test_ticket47553_moddn_staging_prod_0(topo)
- test_ticket47553_moddn_staging_prod_1(topo)
- test_ticket47553_moddn_staging_prod_2(topo)
- test_ticket47553_moddn_staging_prod_3(topo)
- test_ticket47553_moddn_staging_prod_4(topo)
- test_ticket47553_moddn_staging_prod_5(topo)
-
- # tests the ACI with undefined 'target_to'/'target_from'
- test_ticket47553_moddn_staging_prod_6(topo)
- test_ticket47553_moddn_staging_prod_7(topo)
- test_ticket47553_moddn_staging_prod_8(topo)
-
- # Check we can control the behavior with nsslapd-moddn-aci
- test_ticket47553_moddn_staging_prod_9(topo)
-
- # Check we can move entry 'from' -> 'to' but not 'to' -> 'from'
- test_ticket47553_moddn_prod_staging(topo)
-
- # check replication is still working
- test_ticket47553_check_repl_M2_to_M1(topo)
-
- # check DENY rule is working
- test_ticket47553_moddn_staging_prod_except(topo)
-
- test_ticket47553_final(topo)
-
-
-if __name__ == '__main__':
- run_isolated()
-
1
0
dirsrvtests/suites/acl/acl_test.py | 953 +++++++++++++++++
dirsrvtests/tickets/ticket47553_ger.py | 475 --------
dirsrvtests/tickets/ticket47553_rdn_write_test.py | 143 --
dirsrvtests/tickets/ticket47553_single_aci_test.py | 1137 ---------------------
4 files changed, 929 insertions(+), 1779 deletions(-)
New commits:
commit edaa28b1266312ef8dce737af46e09e130c7135a
Author: Simon Pichugin <spichugi(a)redhat.com>
Date: Wed Sep 2 11:27:36 2015 +0200
Ticket 48264 - Ticket 47553 tests refactoring
Description: Refactor these tests according to the pytest and PEP8 way:
- ticket47553_ger.py;
- ticket47553_rdn_write_test.py;
- ticket47553_single_aci_test.py.
Move them to the dirsrvtests/suites/acl/acl_test.py test suite.
https://fedorahosted.org/389/ticket/48264
Reviewed by: mreynolds(a)redhat.com (Thanks!)
diff --git a/dirsrvtests/suites/acl/acl_test.py b/dirsrvtests/suites/acl/acl_test.py
index 36aed33..422a1ec 100644
--- a/dirsrvtests/suites/acl/acl_test.py
+++ b/dirsrvtests/suites/acl/acl_test.py
@@ -18,48 +18,167 @@ from lib389._constants import *
from lib389.properties import *
from lib389.tasks import *
from lib389.utils import *
+from ldap.controls.simple import GetEffectiveRightsControl
logging.getLogger(__name__).setLevel(logging.DEBUG)
log = logging.getLogger(__name__)
+#
+# important part. We can deploy Master1 and Master2 on different versions
+#
installation1_prefix = None
+installation2_prefix = None
+
+TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
+
+STAGING_CN = "staged user"
+PRODUCTION_CN = "accounts"
+EXCEPT_CN = "excepts"
+
+STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
+PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
+PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
+
+STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
+PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
+BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
+BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
+
+BIND_CN = "bind_entry"
+BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
+BIND_PW = "password"
+NEW_ACCOUNT = "new_account"
+MAX_ACCOUNTS = 20
-class TopologyStandalone(object):
- def __init__(self, standalone):
- standalone.open()
- self.standalone = standalone
+CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
+
+SRC_ENTRY_CN = "tuser"
+EXT_RDN = "01"
+DST_ENTRY_CN = SRC_ENTRY_CN + EXT_RDN
+
+SRC_ENTRY_DN = "cn=%s,%s" % (SRC_ENTRY_CN, SUFFIX)
+DST_ENTRY_DN = "cn=%s,%s" % (DST_ENTRY_CN, SUFFIX)
+
+
+class TopologyMaster1Master2(object):
+ def __init__(self, master1, master2):
+ master1.open()
+ self.master1 = master1
+
+ master2.open()
+ self.master2 = master2
@pytest.fixture(scope="module")
def topology(request):
+ """This fixture is used to create a replicated topology for the 'module'.
+ The replicated topology is MASTER1 <-> Master2.
+ """
+
global installation1_prefix
+ global installation2_prefix
+
+ # allocate master1 on a given deployement
+ master1 = DirSrv(verbose=False)
if installation1_prefix:
args_instance[SER_DEPLOYED_DIR] = installation1_prefix
- # Creating standalone instance ...
- standalone = DirSrv(verbose=False)
- args_instance[SER_HOST] = HOST_STANDALONE
- args_instance[SER_PORT] = PORT_STANDALONE
- args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
- args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
- args_standalone = args_instance.copy()
- standalone.allocate(args_standalone)
- instance_standalone = standalone.exists()
- if instance_standalone:
- standalone.delete()
- standalone.create()
- standalone.open()
-
- # Delete each instance in the end
+ # Args for the master1 instance
+ args_instance[SER_HOST] = HOST_MASTER_1
+ args_instance[SER_PORT] = PORT_MASTER_1
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
+ args_master = args_instance.copy()
+ master1.allocate(args_master)
+
+ # allocate master1 on a given deployement
+ master2 = DirSrv(verbose=False)
+ if installation2_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation2_prefix
+
+ # Args for the consumer instance
+ args_instance[SER_HOST] = HOST_MASTER_2
+ args_instance[SER_PORT] = PORT_MASTER_2
+ args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
+ args_master = args_instance.copy()
+ master2.allocate(args_master)
+
+ # Get the status of the instance and restart it if it exists
+ instance_master1 = master1.exists()
+ instance_master2 = master2.exists()
+
+ # Remove all the instances
+ if instance_master1:
+ master1.delete()
+ if instance_master2:
+ master2.delete()
+
+ # Create the instances
+ master1.create()
+ master1.open()
+ master2.create()
+ master2.open()
+
+ #
+ # Now prepare the Master-Consumer topology
+ #
+ # First Enable replication
+ master1.replica.enableReplication(suffix=SUFFIX,
+ role=REPLICAROLE_MASTER,
+ replicaId=REPLICAID_MASTER_1)
+ master2.replica.enableReplication(suffix=SUFFIX,
+ role=REPLICAROLE_MASTER,
+ replicaId=REPLICAID_MASTER_2)
+
+ # Initialize the supplier->consumer
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ repl_agreement = master1.agreement.create(suffix=SUFFIX,
+ host=master2.host,
+ port=master2.port,
+ properties=properties)
+
+ if not repl_agreement:
+ log.fatal("Fail to create a replica agreement")
+ sys.exit(1)
+
+ log.debug("%s created" % repl_agreement)
+
+ properties = {RA_NAME: r'meTo_$host:$port',
+ RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
+ RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
+ RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
+ RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
+ master2.agreement.create(suffix=SUFFIX,
+ host=master1.host,
+ port=master1.port,
+ properties=properties)
+
+ master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
+ master1.waitForReplInit(repl_agreement)
+
+ # Check replication is working fine
+ if master1.testReplication(DEFAULT_SUFFIX, master2):
+ log.info('Replication is working.')
+ else:
+ log.fatal('Replication is not working.')
+ assert False
+
def fin():
- standalone.delete()
+ master1.delete()
+ master2.delete()
request.addfinalizer(fin)
- # Clear out the tmp dir
- standalone.clearTmpDir(__file__)
+ # clear the tmp directory
+ master1.clearTmpDir(__file__)
- return TopologyStandalone(standalone)
+ # Here we have two instances master and consumer
+ # with replication working.
+ return TopologyMaster1Master2(master1, master2)
def add_attr(topology, attr_name):
@@ -135,7 +254,7 @@ def test_aci_attr_subtype_targetattr(topology, aci_with_attr_subtype):
log.info(" Search for the added attribute")
try:
- entries = topology.standalone.search_s(DEFAULT_SUFFIX,
+ entries = topology.master1.search_s(DEFAULT_SUFFIX,
ldap.SCOPE_BASE,
'(objectclass=*)', ['aci'])
entry = str(entries[0])
@@ -147,6 +266,792 @@ def test_aci_attr_subtype_targetattr(topology, aci_with_attr_subtype):
assert False
+def _bind_manager(topology):
+ topology.master1.log.info("Bind as %s " % DN_DM)
+ topology.master1.simple_bind_s(DN_DM, PASSWORD)
+
+
+def _bind_normal(topology):
+ # bind as bind_entry
+ topology.master1.log.info("Bind as %s" % BIND_DN)
+ topology.master1.simple_bind_s(BIND_DN, BIND_PW)
+
+
+def _moddn_aci_deny_tree(topology, mod_type=None,
+ target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
+ """It denies the access moddn_to in cn=except,cn=accounts,SUFFIX"""
+
+ assert mod_type is not None
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ #topology.master1.modify_s(SUFFIX, mod)
+ topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
+ topology.master1.modify_s(PROD_EXCEPT_DN, mod)
+
+
+def _write_aci_staging(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % STAGING_DN
+ ACI_ALLOW = "(version 3.0; acl \"write staging entries\"; allow (write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+
+def _write_aci_production(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % PRODUCTION_DN
+ ACI_ALLOW = "(version 3.0; acl \"write production entries\"; allow (write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+
+def _moddn_aci_staging_to_production(topology, mod_type=None,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN):
+ assert mod_type is not None
+
+
+ ACI_TARGET_FROM = ""
+ ACI_TARGET_TO = ""
+ if target_from:
+ ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
+ if target_to:
+ ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
+
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+ _write_aci_staging(topology, mod_type=mod_type)
+
+
+def _moddn_aci_from_production_to_staging(topology, mod_type=None):
+ assert mod_type is not None
+
+ ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (
+ PRODUCTION_DN, STAGING_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+ mod = [(mod_type, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+
+ _write_aci_production(topology, mod_type=mod_type)
+
+
+(a)pytest.fixture(scope="module")
+def moddn_setup(topology):
+ """Creates
+ - a staging DIT
+ - a production DIT
+ - add accounts in staging DIT
+ - enable ACL logging (commented for performance reason)
+ """
+
+ topology.master1.log.info("\n\n######## INITIALIZATION ########\n")
+
+ # entry used to bind with
+ topology.master1.log.info("Add %s" % BIND_DN)
+ topology.master1.add_s(Entry((BIND_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': BIND_CN,
+ 'cn': BIND_CN,
+ 'userpassword': BIND_PW})))
+
+ # DIT for staging
+ topology.master1.log.info("Add %s" % STAGING_DN)
+ topology.master1.add_s(Entry((STAGING_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': STAGING_CN,
+ 'description': "staging DIT"})))
+
+ # DIT for production
+ topology.master1.log.info("Add %s" % PRODUCTION_DN)
+ topology.master1.add_s(Entry((PRODUCTION_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': PRODUCTION_CN,
+ 'description': "production DIT"})))
+
+ # DIT for production/except
+ topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
+ topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
+ 'objectclass': "top organizationalRole".split(),
+ 'cn': EXCEPT_CN,
+ 'description': "production except DIT"})))
+
+ # enable acl error logging
+ #mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
+ #topology.master1.modify_s(DN_CONFIG, mod)
+ #topology.master2.modify_s(DN_CONFIG, mod)
+
+ # add dummy entries in the staging DIT
+ for cpt in range(MAX_ACCOUNTS):
+ name = "%s%d" % (NEW_ACCOUNT, cpt)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+
+
+def test_mode_default_add_deny(topology, moddn_setup):
+ """This test case checks
+ that the ADD operation fails (no ADD aci on production)
+ """
+
+ topology.master1.log.info("\n\n######## mode moddn_aci : ADD (should fail) ########\n")
+
+ _bind_normal(topology)
+
+ #
+ # First try to add an entry in production => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
+ name = "%s%d" % (NEW_ACCOUNT, 0)
+ topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
+ 'objectclass': "top person".split(),
+ 'sn': name,
+ 'cn': name})))
+ assert 0 # this is an error, we should not be allowed to add an entry in production
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+def test_mode_default_delete_deny(topology, moddn_setup):
+ """This test case checks
+ that the DEL operation fails (no 'delete' aci on production)
+ """
+
+ topology.master1.log.info("\n\n######## DELETE (should fail) ########\n")
+
+ _bind_normal(topology)
+ #
+ # Second try to delete an entry in staging => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to delete %s" % STAGING_DN)
+ name = "%s%d" % (NEW_ACCOUNT, 0)
+ topology.master1.delete_s("cn=%s,%s" % (name, STAGING_DN))
+ assert 0 # this is an error, we should not be allowed to add an entry in production
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+(a)pytest.mark.parametrize("index,tfrom,tto,failure",
+ [(0, STAGING_DN, PRODUCTION_DN, False),
+ (1, STAGING_DN, PRODUCTION_DN, False),
+ (2, STAGING_DN, BAD_PRODUCTION_PATTERN, True),
+ (3, STAGING_PATTERN, PRODUCTION_DN, False),
+ (4, BAD_STAGING_PATTERN, PRODUCTION_DN, True),
+ (5, STAGING_PATTERN, PRODUCTION_PATTERN, False),
+ (6, None, PRODUCTION_PATTERN, False),
+ (7, STAGING_PATTERN, None, False),
+ (8, None, None, False)])
+def test_moddn_staging_prod(topology, moddn_setup,
+ index, tfrom, tto, failure):
+ """This test case MOVE entry NEW_ACCOUNT0 from staging to prod
+ target_to/target_from: equality filter
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (%s) ########\n" % index)
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s%s" % (NEW_ACCOUNT, index)
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=tfrom, target_to=tto)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ if failure:
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=tfrom, target_to=tto)
+ _bind_normal(topology)
+
+
+def test_moddn_staging_prod_9(topology, moddn_setup):
+ """This test case disable the 'moddn' right so a MODDN requires a 'add' right
+ to be successfull.
+ It fails to MOVE entry NEW_ACCOUNT9 from staging to prod.
+ Add a 'add' right to prod.
+ Then it succeeds to MOVE NEW_ACCOUNT9 from staging to prod.
+
+ Then enable the 'moddn' right so a MODDN requires a 'moddn' right
+ It fails to MOVE entry NEW_ACCOUNT10 from staging to prod.
+ Add a 'moddn' right to prod.
+ Then it succeeds to MOVE NEW_ACCOUNT10 from staging to prod.
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (9) ########\n")
+
+ _bind_normal(topology)
+ old_rdn = "cn=%s9" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ #############
+ # Now do tests with no support of moddn aci
+ #############
+ topology.master1.log.info("Disable the moddn right")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+ # Add the moddn aci that will not be evaluated because of the config flag
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ # It will fail because it will test the ADD right
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # remove the moddn aci
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ #
+ # add the 'add' right to the production DN
+ # Then do a successfull moddn
+ #
+ ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_ALLOW + ACI_SUBJECT
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ #############
+ # Now do tests with support of moddn aci
+ #############
+ topology.master1.log.info("Enable the moddn right")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'on')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (10) ########\n")
+
+ _bind_normal(topology)
+ old_rdn = "cn=%s10" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ #
+ # add the 'add' right to the production DN
+ # Then do a failing moddn
+ #
+ ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_ALLOW + ACI_SUBJECT
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(PRODUCTION_DN, mod)
+ _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ # Add the moddn aci that will be evaluated because of the config flag
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ # remove the moddn aci
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_moddn_prod_staging(topology, moddn_setup):
+ """This test checks that we can move ACCOUNT11 from staging to prod
+ but not move back ACCOUNT11 from prod to staging
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (11) ########\n")
+
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s11" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ # Now check we can not move back the entry to staging
+ old_rdn = "cn=%s11" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, PRODUCTION_DN)
+ new_rdn = old_rdn
+ new_superior = STAGING_DN
+
+ # add the write right because we want to check the moddn
+ _bind_manager(topology)
+ _write_aci_production(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ try:
+ topology.master1.log.info("Try to move back MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ _bind_manager(topology)
+ _write_aci_production(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_check_repl_M2_to_M1(topology, moddn_setup):
+ """Checks that replication is still working M2->M1, using ACCOUNT12"""
+
+ topology.master1.log.info("Bind as %s (M2)" % DN_DM)
+ topology.master2.simple_bind_s(DN_DM, PASSWORD)
+
+ rdn = "cn=%s12" % NEW_ACCOUNT
+ dn = "%s,%s" % (rdn, STAGING_DN)
+
+ # First wait for the ACCOUNT19 entry being replicated on M2
+ loop = 0
+ while loop <= 10:
+ try:
+ ent = topology.master2.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
+ break
+ except ldap.NO_SUCH_OBJECT:
+ time.sleep(1)
+ loop += 1
+ assert loop <= 10
+
+ attribute = 'description'
+ tested_value = 'Hello world'
+ mod = [(ldap.MOD_ADD, attribute, tested_value)]
+ topology.master1.log.info("Update (M2) %s (%s)" % (dn, attribute))
+ topology.master2.modify_s(dn, mod)
+
+ loop = 0
+ while loop <= 10:
+ ent = topology.master1.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
+ assert ent is not None
+ if ent.hasAttr(attribute) and (ent.getValue(attribute) == tested_value):
+ break
+
+ time.sleep(1)
+ loop += 1
+ assert loop < 10
+ topology.master1.log.info("Update %s (%s) replicated on M1" % (dn, attribute))
+
+
+def test_moddn_staging_prod_except(topology, moddn_setup):
+ """This test case MOVE entry NEW_ACCOUNT13 from staging to prod
+ but fails to move entry NEW_ACCOUNT14 from staging to prod_except
+ """
+
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod (13) ########\n")
+ _bind_normal(topology)
+
+ old_rdn = "cn=%s13" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PRODUCTION_DN
+
+ #
+ # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
+ #
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the ACI
+ topology.master1.log.info("\n\n######## MOVE to and from equality filter ########\n")
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_ADD)
+ _bind_normal(topology)
+
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+
+ #
+ # Now try to move an entry under except
+ #
+ topology.master1.log.info("\n\n######## MOVE staging -> Prod/Except (14) ########\n")
+ old_rdn = "cn=%s14" % NEW_ACCOUNT
+ old_dn = "%s,%s" % (old_rdn, STAGING_DN)
+ new_rdn = old_rdn
+ new_superior = PROD_EXCEPT_DN
+ try:
+ topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
+ topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
+ assert 0
+ except AssertionError:
+ topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_DELETE)
+ _bind_normal(topology)
+
+
+def test_mode_default_ger_no_moddn(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode moddn_aci : GER no moddn ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_mode_default_ger_with_moddn(topology, moddn_setup):
+ """This test case adds the moddn aci and check ger contains 'n'"""
+
+ topology.master1.log.info("\n\n######## mode moddn_aci: GER with moddn ########\n")
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_mode_switch_default_to_legacy(topology, moddn_setup):
+ """This test switch the server from default mode to legacy"""
+
+ topology.master1.log.info("\n\n######## Disable the moddn aci mod ########\n")
+ _bind_manager(topology)
+ mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
+ topology.master1.modify_s(DN_CONFIG, mod)
+
+
+def test_mode_legacy_ger_no_moddn1(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy 1: GER no moddn ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_mode_legacy_ger_no_moddn2(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy 2: GER no moddn ########\n")
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE,
+ target_from=STAGING_DN, target_to=PRODUCTION_DN)
+ _bind_normal(topology)
+
+
+def test_mode_legacy_ger_with_moddn(topology, moddn_setup):
+ topology.master1.log.info("\n\n######## mode legacy : GER with moddn ########\n")
+
+ # being allowed to read/write the RDN attribute use to allow the RDN
+ ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"cn\")" % (PRODUCTION_DN)
+ ACI_ALLOW = "(version 3.0; acl \"MODDN production changing the RDN attribute\"; allow (read,search,write)"
+ ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+
+ # successfull MOD with the ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ _bind_normal(topology)
+
+ request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
+ msg_id = topology.master1.search_ext(PRODUCTION_DN,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ #ger={}
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ value = attrs['entryLevelRights'][0]
+
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' in value
+
+ # successfull MOD with the both ACI
+ _bind_manager(topology)
+ mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
+ topology.master1.modify_s(SUFFIX, mod)
+ #_bind_normal(topology)
+
+
+(a)pytest.fixture(scope="module")
+def rdn_write_setup(topology):
+ topology.master1.log.info("\n\n######## Add entry tuser ########\n")
+ topology.master1.add_s(Entry((SRC_ENTRY_DN, {
+ 'objectclass': "top person".split(),
+ 'sn': SRC_ENTRY_CN,
+ 'cn': SRC_ENTRY_CN})))
+
+
+def test_rdn_write_get_ger(topology, rdn_write_setup):
+ ANONYMOUS_DN = ""
+ topology.master1.log.info("\n\n######## GER rights for anonymous ########\n")
+ request_ctrl = GetEffectiveRightsControl(criticality=True,
+ authzId="dn:" + ANONYMOUS_DN)
+ msg_id = topology.master1.search_ext(SUFFIX,
+ ldap.SCOPE_SUBTREE,
+ "objectclass=*",
+ serverctrls=[request_ctrl])
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ value = ''
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ for value in attrs['entryLevelRights']:
+ topology.master1.log.info("######## entryLevelRights: %r" % value)
+ assert 'n' not in value
+
+
+def test_rdn_write_modrdn_anonymous(topology, rdn_write_setup):
+ ANONYMOUS_DN = ""
+ topology.master1.close()
+ topology.master1.binddn = ANONYMOUS_DN
+ topology.master1.open()
+ msg_id = topology.master1.search_ext("", ldap.SCOPE_BASE, "objectclass=*")
+ rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
+ for dn, attrs in rdata:
+ topology.master1.log.info("dn: %s" % dn)
+ for attr in attrs:
+ topology.master1.log.info("######## %r: %r" % (attr, attrs[attr]))
+
+ try:
+ topology.master1.rename_s(SRC_ENTRY_DN, "cn=%s" % DST_ENTRY_CN, delold=True)
+ except Exception as e:
+ topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
+ isinstance(e, ldap.INSUFFICIENT_ACCESS)
+
+ try:
+ topology.master1.getEntry(DST_ENTRY_DN, ldap.SCOPE_BASE, "objectclass=*")
+ assert False
+ except Exception as e:
+ topology.master1.log.info("The entry was not renamed (expected)")
+ isinstance(e, ldap.NO_SUCH_OBJECT)
+
+ _bind_manager(topology)
+
+
if __name__ == '__main__':
# Run isolated
# -s for DEBUG mode
diff --git a/dirsrvtests/tickets/ticket47553_ger.py b/dirsrvtests/tickets/ticket47553_ger.py
deleted file mode 100644
index 1829b48..0000000
--- a/dirsrvtests/tickets/ticket47553_ger.py
+++ /dev/null
@@ -1,475 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2015 Red Hat, Inc.
-# All rights reserved.
-#
-# License: GPL (version 3 or any later version).
-# See LICENSE for details.
-# --- END COPYRIGHT BLOCK ---
-#
-'''
-Created on Nov 7, 2013
-
-@author: tbordaz
-'''
-import os
-import sys
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry, tools
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from ldap.controls.simple import GetEffectiveRightsControl
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-#
-# important part. We can deploy Master1 and Master2 on different versions
-#
-installation1_prefix = None
-installation2_prefix = None
-
-TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
-
-STAGING_CN = "staged user"
-PRODUCTION_CN = "accounts"
-EXCEPT_CN = "excepts"
-
-STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
-PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
-PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
-
-STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
-PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
-BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
-BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
-
-BIND_CN = "bind_entry"
-BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
-BIND_PW = "password"
-
-NEW_ACCOUNT = "new_account"
-MAX_ACCOUNTS = 20
-
-CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
-
-
-class TopologyMaster1Master2(object):
- def __init__(self, master1, master2):
- master1.open()
- self.master1 = master1
-
- master2.open()
- self.master2 = master2
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- '''
- This fixture is used to create a replicated topology for the 'module'.
- The replicated topology is MASTER1 <-> Master2.
- '''
- global installation1_prefix
- global installation2_prefix
-
- # allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
- # Args for the master1 instance
- args_instance[SER_HOST] = HOST_MASTER_1
- args_instance[SER_PORT] = PORT_MASTER_1
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
- args_master = args_instance.copy()
- master1.allocate(args_master)
-
- # allocate master1 on a given deployement
- master2 = DirSrv(verbose=False)
- if installation2_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
- # Args for the consumer instance
- args_instance[SER_HOST] = HOST_MASTER_2
- args_instance[SER_PORT] = PORT_MASTER_2
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
- args_master = args_instance.copy()
- master2.allocate(args_master)
-
- # Get the status of the instance and restart it if it exists
- instance_master1 = master1.exists()
- instance_master2 = master2.exists()
-
- # Remove all the instances
- if instance_master1:
- master1.delete()
- if instance_master2:
- master2.delete()
-
- # Create the instances
- master1.create()
- master1.open()
- master2.create()
- master2.open()
-
- #
- # Now prepare the Master-Consumer topology
- #
- # First Enable replication
- master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
- master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
- # Initialize the supplier->consumer
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
- if not repl_agreement:
- log.fatal("Fail to create a replica agreement")
- sys.exit(1)
-
- log.debug("%s created" % repl_agreement)
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
-
- master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
- master1.waitForReplInit(repl_agreement)
-
- # Check replication is working fine
- if master1.testReplication(DEFAULT_SUFFIX, master2):
- log.info('Replication is working.')
- else:
- log.fatal('Replication is not working.')
- assert False
-
- # clear the tmp directory
- master1.clearTmpDir(__file__)
-
- # Here we have two instances master and consumer
- # with replication working.
- return TopologyMaster1Master2(master1, master2)
-
-
-def _bind_manager(topology):
- topology.master1.log.info("Bind as %s " % DN_DM)
- topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
-
-def _bind_normal(topology):
- # bind as bind_entry
- topology.master1.log.info("Bind as %s" % BIND_DN)
- topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
-
-def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
- '''
- It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
- '''
- if mod_type is None:
- assert False
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- #topology.master1.modify_s(SUFFIX, mod)
- topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
- topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- if mod_type is None:
- assert False
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-
-def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- if mod_type is None:
- assert False
-
- ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-
-def test_ticket47553_init(topology):
- """
- Creates
- - a staging DIT
- - a production DIT
- - add accounts in staging DIT
- - enable ACL logging (commented for performance reason)
-
- """
-
- topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
- # entry used to bind with
- topology.master1.log.info("Add %s" % BIND_DN)
- topology.master1.add_s(Entry((BIND_DN, {
- 'objectclass': "top person".split(),
- 'sn': BIND_CN,
- 'cn': BIND_CN,
- 'userpassword': BIND_PW})))
-
- # DIT for staging
- topology.master1.log.info("Add %s" % STAGING_DN)
- topology.master1.add_s(Entry((STAGING_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': STAGING_CN,
- 'description': "staging DIT"})))
-
- # DIT for production
- topology.master1.log.info("Add %s" % PRODUCTION_DN)
- topology.master1.add_s(Entry((PRODUCTION_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': PRODUCTION_CN,
- 'description': "production DIT"})))
-
- # DIT for production/except
- topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
- topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': EXCEPT_CN,
- 'description': "production except DIT"})))
-
- # enable acl error logging
- #mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', '128')]
- #topology.master1.modify_s(DN_CONFIG, mod)
- #topology.master2.modify_s(DN_CONFIG, mod)
-
- # add dummy entries in the staging DIT
- for cpt in range(MAX_ACCOUNTS):
- name = "%s%d" % (NEW_ACCOUNT, cpt)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
-
-
-def test_ticket47553_mode_default_add_deny(topology):
- '''
- This test case checks that the ADD operation fails (no ADD aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### mode moddn_aci : ADD (should fail) ######################\n")
-
- _bind_normal(topology)
-
- #
- # First try to add an entry in production => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
-def test_ticket47553_mode_default_ger_no_moddn(topology):
- topology.master1.log.info("\n\n######################### mode moddn_aci : GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-
-def test_ticket47553_mode_default_ger_with_moddn(topology):
- '''
- This test case adds the moddn aci and check ger contains 'n'
- '''
-
- topology.master1.log.info("\n\n######################### mode moddn_aci: GER with moddn ######################\n")
-
- # successfull MOD with the ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_mode_switch_default_to_legacy(topology):
- '''
- This test switch the server from default mode to legacy
- '''
- topology.master1.log.info("\n\n######################### Disable the moddn aci mod ######################\n")
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
-
-def test_ticket47553_mode_legacy_ger_no_moddn1(topology):
- topology.master1.log.info("\n\n######################### mode legacy 1: GER no moddn ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-
-def test_ticket47553_mode_legacy_ger_no_moddn2(topology):
- topology.master1.log.info("\n\n######################### mode legacy 2: GER no moddn ######################\n")
- # successfull MOD with the ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_mode_legacy_ger_with_moddn(topology):
- topology.master1.log.info("\n\n######################### mode legacy : GER with moddn ######################\n")
-
- # being allowed to read/write the RDN attribute use to allow the RDN
- ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"cn\")" % (PRODUCTION_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN production changing the RDN attribute\"; allow (read,search,write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
-
- # successfull MOD with the ACI
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
- _bind_normal(topology)
-
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn: " + BIND_DN)
- msg_id = topology.master1.search_ext(PRODUCTION_DN, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.master1.result3(msg_id)
- #ger={}
- value = ''
- for dn, attrs in rdata:
- topology.master1.log.info("dn: %s" % dn)
- value = attrs['entryLevelRights'][0]
-
- topology.master1.log.info("############### entryLevelRights: %r" % value)
- assert 'n' in value
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
- _bind_normal(topology)
-
-
-def test_ticket47553_final(topology):
- topology.master1.delete()
- topology.master2.delete()
- log.info('Testcase PASSED')
-
-
-def run_isolated():
- '''
- run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
- - edit this file and comment '@pytest.fixture' line before 'topology' function.
- - set the installation prefix
- - run this program
- '''
- global installation1_prefix
- global installation2_prefix
- installation1_prefix = None
- installation2_prefix = None
-
- topo = topology(True)
- topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
- test_ticket47553_init(topo)
-
- # Check that without appropriate aci we are not allowed to add/delete
- test_ticket47553_mode_default_add_deny(topo)
- test_ticket47553_mode_default_ger_no_moddn(topo)
- test_ticket47553_mode_default_ger_with_moddn(topo)
- test_ticket47553_mode_switch_default_to_legacy(topo)
- test_ticket47553_mode_legacy_ger_no_moddn1(topo)
- test_ticket47553_mode_legacy_ger_no_moddn2(topo)
- test_ticket47553_mode_legacy_ger_with_moddn(topo)
-
- test_ticket47553_final(topo)
-
-
-if __name__ == '__main__':
- run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47553_rdn_write_test.py b/dirsrvtests/tickets/ticket47553_rdn_write_test.py
deleted file mode 100644
index 15d334b..0000000
--- a/dirsrvtests/tickets/ticket47553_rdn_write_test.py
+++ /dev/null
@@ -1,143 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2015 Red Hat, Inc.
-# All rights reserved.
-#
-# License: GPL (version 3 or any later version).
-# See LICENSE for details.
-# --- END COPYRIGHT BLOCK ---
-#
-import os
-import sys
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry, tools, tasks
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from lib389.tasks import *
-from lib389.utils import *
-from ldap.controls.simple import GetEffectiveRightsControl
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-installation1_prefix = None
-
-SRC_ENTRY_CN = "tuser"
-EXT_RDN = "01"
-DST_ENTRY_CN = SRC_ENTRY_CN + EXT_RDN
-
-SRC_ENTRY_DN = "cn=%s,%s" % (SRC_ENTRY_CN, SUFFIX)
-DST_ENTRY_DN = "cn=%s,%s" % (DST_ENTRY_CN, SUFFIX)
-
-
-class TopologyStandalone(object):
- def __init__(self, standalone):
- standalone.open()
- self.standalone = standalone
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- global installation1_prefix
-
- # Creating standalone instance ...
- standalone = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
- args_instance[SER_HOST] = HOST_STANDALONE
- args_instance[SER_PORT] = PORT_STANDALONE
- args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
- args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
- args_standalone = args_instance.copy()
- standalone.allocate(args_standalone)
- instance_standalone = standalone.exists()
- if instance_standalone:
- standalone.delete()
- standalone.create()
- standalone.open()
-
- # Clear out the tmp dir
- standalone.clearTmpDir(__file__)
-
- return TopologyStandalone(standalone)
-
-
-def test_ticket47553_rdn_write_init(topology):
- topology.standalone.log.info("\n\n######################### Add entry tuser ######################\n")
- topology.standalone.add_s(Entry((SRC_ENTRY_DN, {
- 'objectclass': "top person".split(),
- 'sn': SRC_ENTRY_CN,
- 'cn': SRC_ENTRY_CN})))
-
-
-def test_ticket47553_rdn_write_get_ger(topology):
- ANONYMOUS_DN = ""
- topology.standalone.log.info("\n\n######################### GER rights for anonymous ######################\n")
- request_ctrl = GetEffectiveRightsControl(criticality=True, authzId="dn:" + ANONYMOUS_DN)
- msg_id = topology.standalone.search_ext(SUFFIX, ldap.SCOPE_SUBTREE, "objectclass=*", serverctrls=[request_ctrl])
- rtype, rdata, rmsgid, response_ctrl = topology.standalone.result3(msg_id)
- value = ''
- for dn, attrs in rdata:
- topology.standalone.log.info("dn: %s" % dn)
- for value in attrs['entryLevelRights']:
- topology.standalone.log.info("############### entryLevelRights: %r" % value)
- assert 'n' not in value
-
-
-def test_ticket47553_rdn_write_modrdn_anonymous(topology):
- ANONYMOUS_DN = ""
- topology.standalone.close()
- topology.standalone.binddn = ANONYMOUS_DN
- topology.standalone.open()
- msg_id = topology.standalone.search_ext("", ldap.SCOPE_BASE, "objectclass=*")
- rtype, rdata, rmsgid, response_ctrl = topology.standalone.result3(msg_id)
- for dn, attrs in rdata:
- topology.standalone.log.info("dn: %s" % dn)
- for attr in attrs:
- topology.standalone.log.info("############### %r: %r" % (attr, attrs[attr]))
-
- try:
- topology.standalone.rename_s(SRC_ENTRY_DN, "cn=%s" % DST_ENTRY_CN, delold=True)
- except Exception as e:
- topology.standalone.log.info("Exception (expected): %s" % type(e).__name__)
- isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- try:
- topology.standalone.getEntry(DST_ENTRY_DN, ldap.SCOPE_BASE, "objectclass=*")
- assert False
- except Exception as e:
- topology.standalone.log.info("The entry was not renamed (expected)")
- isinstance(e, ldap.NO_SUCH_OBJECT)
-
-
-def test_ticket47553_rdn_write(topology):
- '''
- Write your testcase here...
- '''
-
- log.info('Test complete')
-
-
-def test_ticket47553_rdn_write_final(topology):
- topology.standalone.delete()
- log.info('Testcase PASSED')
-
-
-def run_isolated():
- global installation1_prefix
- installation1_prefix = '/home/tbordaz/install_master'
-
- topo = topology(True)
- test_ticket47553_rdn_write_init(topo)
- test_ticket47553_rdn_write_get_ger(topo)
- test_ticket47553_rdn_write(topo)
- test_ticket47553_rdn_write_modrdn_anonymous(topo)
- test_ticket47553_rdn_write_final(topo)
-
-
-if __name__ == '__main__':
- run_isolated()
-
diff --git a/dirsrvtests/tickets/ticket47553_single_aci_test.py b/dirsrvtests/tickets/ticket47553_single_aci_test.py
deleted file mode 100644
index 1c0b88b..0000000
--- a/dirsrvtests/tickets/ticket47553_single_aci_test.py
+++ /dev/null
@@ -1,1137 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2015 Red Hat, Inc.
-# All rights reserved.
-#
-# License: GPL (version 3 or any later version).
-# See LICENSE for details.
-# --- END COPYRIGHT BLOCK ---
-#
-'''
-Created on Nov 7, 2013
-
-@author: tbordaz
-'''
-import os
-import sys
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry, tools
-from lib389.tools import DirSrvTools
-from lib389._constants import *
-from lib389.properties import *
-from lib389._constants import REPLICAROLE_MASTER
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-#
-# important part. We can deploy Master1 and Master2 on different versions
-#
-installation1_prefix = None
-installation2_prefix = None
-
-TEST_REPL_DN = "cn=test_repl, %s" % SUFFIX
-
-STAGING_CN = "staged user"
-PRODUCTION_CN = "accounts"
-EXCEPT_CN = "excepts"
-
-STAGING_DN = "cn=%s,%s" % (STAGING_CN, SUFFIX)
-PRODUCTION_DN = "cn=%s,%s" % (PRODUCTION_CN, SUFFIX)
-PROD_EXCEPT_DN = "cn=%s,%s" % (EXCEPT_CN, PRODUCTION_DN)
-
-STAGING_PATTERN = "cn=%s*,%s" % (STAGING_CN[:2], SUFFIX)
-PRODUCTION_PATTERN = "cn=%s*,%s" % (PRODUCTION_CN[:2], SUFFIX)
-BAD_STAGING_PATTERN = "cn=bad*,%s" % (SUFFIX)
-BAD_PRODUCTION_PATTERN = "cn=bad*,%s" % (SUFFIX)
-
-BIND_CN = "bind_entry"
-BIND_DN = "cn=%s,%s" % (BIND_CN, SUFFIX)
-BIND_PW = "password"
-
-NEW_ACCOUNT = "new_account"
-MAX_ACCOUNTS = 20
-
-CONFIG_MODDN_ACI_ATTR = "nsslapd-moddn-aci"
-
-
-class TopologyMaster1Master2(object):
- def __init__(self, master1, master2):
- master1.open()
- self.master1 = master1
-
- master2.open()
- self.master2 = master2
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- '''
- This fixture is used to create a replicated topology for the 'module'.
- The replicated topology is MASTER1 <-> Master2.
- '''
- global installation1_prefix
- global installation2_prefix
-
- # allocate master1 on a given deployement
- master1 = DirSrv(verbose=False)
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
- # Args for the master1 instance
- args_instance[SER_HOST] = HOST_MASTER_1
- args_instance[SER_PORT] = PORT_MASTER_1
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_1
- args_master = args_instance.copy()
- master1.allocate(args_master)
-
- # allocate master1 on a given deployement
- master2 = DirSrv(verbose=False)
- if installation2_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation2_prefix
-
- # Args for the consumer instance
- args_instance[SER_HOST] = HOST_MASTER_2
- args_instance[SER_PORT] = PORT_MASTER_2
- args_instance[SER_SERVERID_PROP] = SERVERID_MASTER_2
- args_master = args_instance.copy()
- master2.allocate(args_master)
-
- # Get the status of the instance
- instance_master1 = master1.exists()
- instance_master2 = master2.exists()
-
- # Remove all the instances
- if instance_master1:
- master1.delete()
- if instance_master2:
- master2.delete()
-
- # Create the instances
- master1.create()
- master1.open()
- master2.create()
- master2.open()
-
- #
- # Now prepare the Master-Consumer topology
- #
- # First Enable replication
- master1.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_1)
- master2.replica.enableReplication(suffix=SUFFIX, role=REPLICAROLE_MASTER, replicaId=REPLICAID_MASTER_2)
-
- # Initialize the supplier->consumer
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- repl_agreement = master1.agreement.create(suffix=SUFFIX, host=master2.host, port=master2.port, properties=properties)
-
- if not repl_agreement:
- log.fatal("Fail to create a replica agreement")
- sys.exit(1)
-
- log.debug("%s created" % repl_agreement)
-
- properties = {RA_NAME: r'meTo_$host:$port',
- RA_BINDDN: defaultProperties[REPLICATION_BIND_DN],
- RA_BINDPW: defaultProperties[REPLICATION_BIND_PW],
- RA_METHOD: defaultProperties[REPLICATION_BIND_METHOD],
- RA_TRANSPORT_PROT: defaultProperties[REPLICATION_TRANSPORT]}
- master2.agreement.create(suffix=SUFFIX, host=master1.host, port=master1.port, properties=properties)
-
- master1.agreement.init(SUFFIX, HOST_MASTER_2, PORT_MASTER_2)
- master1.waitForReplInit(repl_agreement)
-
- # Check replication is working fine
- if master1.testReplication(DEFAULT_SUFFIX, master2):
- log.info('Replication is working.')
- else:
- log.fatal('Replication is not working.')
- assert False
-
- # clear the tmp directory
- master1.clearTmpDir(__file__)
-
- # Here we have two instances master and consumer
- # with replication working.
- return TopologyMaster1Master2(master1, master2)
-
-
-def _bind_manager(topology):
- topology.master1.log.info("Bind as %s " % DN_DM)
- topology.master1.simple_bind_s(DN_DM, PASSWORD)
-
-
-def _bind_normal(topology):
- # bind as bind_entry
- topology.master1.log.info("Bind as %s" % BIND_DN)
- topology.master1.simple_bind_s(BIND_DN, BIND_PW)
-
-
-def _moddn_aci_deny_tree(topology, mod_type=None, target_from=STAGING_DN, target_to=PROD_EXCEPT_DN):
- '''
- It denies the access moddn_to in cn=except,cn=accounts,SUFFIX
- '''
- assert mod_type is not None
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"Deny MODDN to prod_except\"; deny (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- #topology.master1.modify_s(SUFFIX, mod)
- topology.master1.log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)
- topology.master1.modify_s(PROD_EXCEPT_DN, mod)
-
-def _write_aci_staging(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % STAGING_DN
- ACI_ALLOW = "(version 3.0; acl \"write staging entries\"; allow (write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-def _write_aci_production(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(targetattr= \"cn\")(target=\"ldap:///cn=*,%s\")" % PRODUCTION_DN
- ACI_ALLOW = "(version 3.0; acl \"write production entries\"; allow (write)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type != None
-
-def _moddn_aci_staging_to_production(topology, mod_type=None, target_from=STAGING_DN, target_to=PRODUCTION_DN):
- assert mod_type is not None
-
- ACI_TARGET_FROM = ""
- ACI_TARGET_TO = ""
- if target_from:
- ACI_TARGET_FROM = "(target_from = \"ldap:///%s\")" % (target_from)
- if target_to:
- ACI_TARGET_TO = "(target_to = \"ldap:///%s\")" % (target_to)
-
- ACI_ALLOW = "(version 3.0; acl \"MODDN from staging to production\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET_FROM + ACI_TARGET_TO + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
- _write_aci_staging(topology, mod_type=mod_type)
-
-
-def _moddn_aci_from_production_to_staging(topology, mod_type=None):
- assert mod_type is not None
-
- ACI_TARGET = "(target_from = \"ldap:///%s\") (target_to = \"ldap:///%s\")" % (PRODUCTION_DN, STAGING_DN)
- ACI_ALLOW = "(version 3.0; acl \"MODDN from production to staging\"; allow (moddn)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
- mod = [(mod_type, 'aci', ACI_BODY)]
- topology.master1.modify_s(SUFFIX, mod)
-
- _write_aci_production(topology, mod_type=mod_type)
-
-
-def test_ticket47553_init(topology):
- """
- Creates
- - a staging DIT
- - a production DIT
- - add accounts in staging DIT
- - enable ACL logging (commented for performance reason)
-
- """
-
- topology.master1.log.info("\n\n######################### INITIALIZATION ######################\n")
-
- # entry used to bind with
- topology.master1.log.info("Add %s" % BIND_DN)
- topology.master1.add_s(Entry((BIND_DN, {
- 'objectclass': "top person".split(),
- 'sn': BIND_CN,
- 'cn': BIND_CN,
- 'userpassword': BIND_PW})))
-
- # DIT for staging
- topology.master1.log.info("Add %s" % STAGING_DN)
- topology.master1.add_s(Entry((STAGING_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': STAGING_CN,
- 'description': "staging DIT"})))
-
- # DIT for production
- topology.master1.log.info("Add %s" % PRODUCTION_DN)
- topology.master1.add_s(Entry((PRODUCTION_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': PRODUCTION_CN,
- 'description': "production DIT"})))
-
- # DIT for production/except
- topology.master1.log.info("Add %s" % PROD_EXCEPT_DN)
- topology.master1.add_s(Entry((PROD_EXCEPT_DN, {
- 'objectclass': "top organizationalRole".split(),
- 'cn': EXCEPT_CN,
- 'description': "production except DIT"})))
-
- # enable acl error logging
- mod = [(ldap.MOD_REPLACE, 'nsslapd-errorlog-level', str(128+262144))]
- topology.master1.modify_s(DN_CONFIG, mod)
- topology.master2.modify_s(DN_CONFIG, mod)
-
- # add dummy entries in the staging DIT
- for cpt in range(MAX_ACCOUNTS):
- name = "%s%d" % (NEW_ACCOUNT, cpt)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, STAGING_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
-
-
-def test_ticket47553_add(topology):
- '''
- This test case checks that the ADD operation fails (no ADD aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### ADD (should fail) ######################\n")
-
- _bind_normal(topology)
-
- #
- # First try to add an entry in production => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to add %s" % PRODUCTION_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.add_s(Entry(("cn=%s,%s" % (name, PRODUCTION_DN), {
- 'objectclass': "top person".split(),
- 'sn': name,
- 'cn': name})))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
-def test_ticket47553_delete(topology):
- '''
- This test case checks that the DEL operation fails (no 'delete' aci on production)
- '''
-
- topology.master1.log.info("\n\n######################### DELETE (should fail) ######################\n")
-
- _bind_normal(topology)
- #
- # Second try to delete an entry in staging => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to delete %s" % STAGING_DN)
- name = "%s%d" % (NEW_ACCOUNT, 0)
- topology.master1.delete_s("cn=%s,%s" % (name, STAGING_DN))
- assert 0 # this is an error, we should not be allowed to add an entry in production
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
-def test_ticket47553_moddn_staging_prod_0(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT0 from staging to prod
- target_to/target_from: equality filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (0) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s0" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_1(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT1 from staging to prod
- target_to/target_from: substring/equality filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (1) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s1" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to substring/ from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_2(topology):
- '''
- This test case fails to MOVE entry NEW_ACCOUNT2 from staging to prod
- because of bad pattern
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (2) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s2" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to substring (BAD)/ from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=BAD_PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_3(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT3 from staging to prod
- target_to/target_from: equality/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (3) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s3" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:equality filter / from substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_4(topology):
- '''
- This test case fails to MOVE entry NEW_ACCOUNT4 from staging to prod
- because of bad pattern
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (4) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s4" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: equality filter/ from: substring (BAD) ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=BAD_STAGING_PATTERN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_5(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT5 from staging to prod
- target_to/target_from: substring/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (5) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s5" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_6(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT6 from staging to prod
- target_to/target_from: substring/<enmpty> filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (6) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s6" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to:substring filter / from: empty ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=PRODUCTION_PATTERN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_7(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT7 from staging to prod
- target_to/target_from: <empty>/substring filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (7) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s7" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: empty/ from: substring filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_PATTERN, target_to=None)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_PATTERN, target_to=None)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_8(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT8 from staging to prod
- target_to/target_from: <empty>/<empty> filter
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (8) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s8" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to: empty/ from: empty ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=None, target_to=None)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=None, target_to=None)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_staging_prod_9(topology):
- '''
- This test case disable the 'moddn' right so a MODDN requires a 'add' right
- to be successfull.
- It fails to MOVE entry NEW_ACCOUNT9 from staging to prod.
- Add a 'add' right to prod.
- Then it succeeds to MOVE NEW_ACCOUNT9 from staging to prod.
-
- Then enable the 'moddn' right so a MODDN requires a 'moddn' right
- It fails to MOVE entry NEW_ACCOUNT10 from staging to prod.
- Add a 'moddn' right to prod.
- Then it succeeds to MOVE NEW_ACCOUNT10 from staging to prod.
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (9) ######################\n")
-
- _bind_normal(topology)
- old_rdn = "cn=%s9" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- ############################################
- # Now do tests with no support of moddn aci
- ############################################
- topology.master1.log.info("Disable the moddn right")
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'off')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
- # Add the moddn aci that will not be evaluated because of the config flag
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- # It will fail because it will test the ADD right
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # remove the moddn aci
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- #
- # add the 'add' right to the production DN
- # Then do a successfull moddn
- #
- ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- ############################################
- # Now do tests with support of moddn aci
- ############################################
- topology.master1.log.info("Enable the moddn right")
- _bind_manager(topology)
- mod = [(ldap.MOD_REPLACE, CONFIG_MODDN_ACI_ATTR, 'on')]
- topology.master1.modify_s(DN_CONFIG, mod)
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (10) ######################\n")
-
- _bind_normal(topology)
- old_rdn = "cn=%s10" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- #
- # add the 'add' right to the production DN
- # Then do a failing moddn
- #
- ACI_ALLOW = "(version 3.0; acl \"ADD rights to allow moddn\"; allow (add)"
- ACI_SUBJECT = " userdn = \"ldap:///%s\";)" % BIND_DN
- ACI_BODY = ACI_ALLOW + ACI_SUBJECT
-
- _bind_manager(topology)
- mod = [(ldap.MOD_ADD, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- _bind_manager(topology)
- mod = [(ldap.MOD_DELETE, 'aci', ACI_BODY)]
- topology.master1.modify_s(PRODUCTION_DN, mod)
- _write_aci_staging(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- # Add the moddn aci that will be evaluated because of the config flag
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # remove the moddn aci
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_moddn_prod_staging(topology):
- '''
- This test checks that we can move ACCOUNT11 from staging to prod
- but not move back ACCOUNT11 from prod to staging
- '''
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (11) ######################\n")
-
- _bind_normal(topology)
-
- old_rdn = "cn=%s11" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- # Now check we can not move back the entry to staging
- old_rdn = "cn=%s11" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, PRODUCTION_DN)
- new_rdn = old_rdn
- new_superior = STAGING_DN
-
- # add the write right because we want to check the moddn
- _bind_manager(topology)
- _write_aci_production(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- try:
- topology.master1.log.info("Try to move back MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- _bind_manager(topology)
- _write_aci_production(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _bind_normal(topology)
-
-
-def test_ticket47553_check_repl_M2_to_M1(topology):
- '''
- Checks that replication is still working M2->M1, using ACCOUNT12
- '''
-
- topology.master1.log.info("Bind as %s (M2)" % DN_DM)
- topology.master2.simple_bind_s(DN_DM, PASSWORD)
-
- rdn = "cn=%s12" % NEW_ACCOUNT
- dn = "%s,%s" % (rdn, STAGING_DN)
-
- # First wait for the ACCOUNT19 entry being replicated on M2
- loop = 0
- while loop <= 10:
- try:
- ent = topology.master2.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
- break
- except ldap.NO_SUCH_OBJECT:
- time.sleep(1)
- loop += 1
- assert loop <= 10
-
- attribute = 'description'
- tested_value = 'Hello world'
- mod = [(ldap.MOD_ADD, attribute, tested_value)]
- topology.master1.log.info("Update (M2) %s (%s)" % (dn, attribute))
- topology.master2.modify_s(dn, mod)
-
- loop = 0
- while loop <= 10:
- ent = topology.master1.getEntry(dn, ldap.SCOPE_BASE, "(objectclass=*)")
- assert ent is not None
- if ent.hasAttr(attribute) and (ent.getValue(attribute) == tested_value):
- break
-
- time.sleep(1)
- loop += 1
- assert loop < 10
- topology.master1.log.info("Update %s (%s) replicated on M1" % (dn, attribute))
-
-
-def test_ticket47553_moddn_staging_prod_except(topology):
- '''
- This test case MOVE entry NEW_ACCOUNT13 from staging to prod
- but fails to move entry NEW_ACCOUNT14 from staging to prod_except
- '''
-
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod (13) ######################\n")
- _bind_normal(topology)
-
- old_rdn = "cn=%s13" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PRODUCTION_DN
-
- #
- # Try to rename without the apropriate ACI => INSUFFICIENT_ACCESS
- #
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the ACI
- topology.master1.log.info("\n\n######################### MOVE to and from equality filter ######################\n")
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_ADD, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_ADD)
- _bind_normal(topology)
-
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
-
- #
- # Now try to move an entry under except
- #
- topology.master1.log.info("\n\n######################### MOVE staging -> Prod/Except (14) ######################\n")
- old_rdn = "cn=%s14" % NEW_ACCOUNT
- old_dn = "%s,%s" % (old_rdn, STAGING_DN)
- new_rdn = old_rdn
- new_superior = PROD_EXCEPT_DN
- try:
- topology.master1.log.info("Try to MODDN %s -> %s,%s" % (old_dn, new_rdn, new_superior))
- topology.master1.rename_s(old_dn, new_rdn, newsuperior=new_superior)
- assert 0
- except AssertionError:
- topology.master1.log.info("Exception (not really expected exception but that is fine as it fails to rename)")
- except Exception as e:
- topology.master1.log.info("Exception (expected): %s" % type(e).__name__)
- assert isinstance(e, ldap.INSUFFICIENT_ACCESS)
-
- # successfull MOD with the both ACI
- _bind_manager(topology)
- _moddn_aci_staging_to_production(topology, mod_type=ldap.MOD_DELETE, target_from=STAGING_DN, target_to=PRODUCTION_DN)
- _moddn_aci_deny_tree(topology, mod_type=ldap.MOD_DELETE)
- _bind_normal(topology)
-
-
-def test_ticket47553_final(topology):
- topology.master1.delete()
- topology.master2.delete()
- log.info('Testcase PASSED')
-
-
-def run_isolated():
- '''
- run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)
- To run isolated without py.test, you need to
- - edit this file and comment '@pytest.fixture' line before 'topology' function.
- - set the installation prefix
- - run this program
- '''
- global installation1_prefix
- global installation2_prefix
- installation1_prefix = None
- installation2_prefix = None
-
- topo = topology(True)
- topo.master1.log.info("\n\n######################### Ticket 47553 ######################\n")
- test_ticket47553_init(topo)
-
- # Check that without appropriate aci we are not allowed to add/delete
- test_ticket47553_add(topo)
- test_ticket47553_delete(topo)
-
- # tests the ACI as equality/substring filter
- test_ticket47553_moddn_staging_prod_0(topo)
- test_ticket47553_moddn_staging_prod_1(topo)
- test_ticket47553_moddn_staging_prod_2(topo)
- test_ticket47553_moddn_staging_prod_3(topo)
- test_ticket47553_moddn_staging_prod_4(topo)
- test_ticket47553_moddn_staging_prod_5(topo)
-
- # tests the ACI with undefined 'target_to'/'target_from'
- test_ticket47553_moddn_staging_prod_6(topo)
- test_ticket47553_moddn_staging_prod_7(topo)
- test_ticket47553_moddn_staging_prod_8(topo)
-
- # Check we can control the behavior with nsslapd-moddn-aci
- test_ticket47553_moddn_staging_prod_9(topo)
-
- # Check we can move entry 'from' -> 'to' but not 'to' -> 'from'
- test_ticket47553_moddn_prod_staging(topo)
-
- # check replication is still working
- test_ticket47553_check_repl_M2_to_M1(topo)
-
- # check DENY rule is working
- test_ticket47553_moddn_staging_prod_except(topo)
-
- test_ticket47553_final(topo)
-
-
-if __name__ == '__main__':
- run_isolated()
-
1
0
ldap/servers/slapd/log.c | 109 ++++++++++++++++++++++++++++-------------------
1 file changed, 67 insertions(+), 42 deletions(-)
New commits:
commit 217ea08b60eedb2da254517d47991ab0d42e578a
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 10:30:07 2015 -0700
Ticket #48304 - ns-slapd - LOGINFO:Unable to remove file
Description: In the log rotation, if a log file to be deleted does
not exist, the "Unable to remove file" is logged in the error log,
which is not necessary.
This patch updates the logging code to suppress the unnecessary log
messages as well as replace with more detailed ones.
https://fedorahosted.org/389/ticket/48304
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit e2abffcc5cf6e63136fc0bcb5b0e12830cca22a5)
(cherry picked from commit 6c71c0d96d2287bcae88942ce6d5a0f7df5bee84)
(cherry picked from commit 8081a91a7a1714396a377871d1f676f000d7a4d5)
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 3a31260..4db8946 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -2466,15 +2466,25 @@ log__delete_access_logfile()
loginfo.log_access_fdes = NULL;
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -2576,15 +2586,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_access_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_access_file,tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_access_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_access_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_access_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_access_logs--;
@@ -3246,7 +3256,6 @@ log__delete_error_logfile(int locked)
char buffer[BUFSIZ];
char tbuf[TBUFSIZE];
-
/* If we have only one log, then will delete this one */
if (loginfo.log_error_maxnumlogs == 1) {
LOG_CLOSE(loginfo.log_error_fdes);
@@ -3254,10 +3263,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
@@ -3265,11 +3278,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n",
- loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
return 0;
@@ -3381,10 +3397,11 @@ delete_logfile:
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_error_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
PRErrorCode prerr = PR_GetError();
- PR_snprintf(buffer, sizeof(buffer),
- "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
- loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
- log__error_emergency(buffer, 0, locked);
+ if (PR_FILE_NOT_FOUND_ERROR != prerr) {
+ PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ log__error_emergency(buffer, 0, locked);
+ }
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_error_logs--;
@@ -3424,15 +3441,25 @@ log__delete_audit_logfile()
loginfo.log_audit_fdes = NULL;
PR_snprintf(buffer, sizeof(buffer), "%s", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf(buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotatoininfo error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -3533,15 +3560,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf(buffer, sizeof(buffer), "%s.%s", loginfo.log_audit_file, tbuf );
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_audit_file, tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_audit_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_audit_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_audit_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_audit_logs--;
@@ -3823,10 +3850,8 @@ log__open_errorlogfile(int logfile_state, int locked)
Even if PR_Rename fails with the error, we continue logging.
*/
if (PR_FILE_EXISTS_ERROR != prerr) {
- PR_snprintf(buffer, sizeof(buffer),
- "Failed to rename errors log file, "
- SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...",
- prerr, slapd_pr_strerror(prerr));
+ PR_snprintf(buffer, sizeof(buffer), "Failed to rename errors log file, "
+ SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...\n", prerr, slapd_pr_strerror(prerr));
log__error_emergency(buffer, 1, 1);
slapi_ch_free((void **)&log);
if (!locked) LOG_ERROR_UNLOCK_WRITE();
1
0
ldap/servers/plugins/replication/cl5_api.c | 452 ++++++++++++++--
ldap/servers/plugins/replication/cl5_api.h | 5
ldap/servers/plugins/replication/repl5_replica_config.c | 44 -
3 files changed, 433 insertions(+), 68 deletions(-)
New commits:
commit a1dc207eb1566b5b64ceeb54bb59b6d2b50c48f1
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jul 8 11:48:27 2015 -0400
Ticket 48208 - CleanAllRUV should completely purge changelog
Bug Description: After cleanAllRUV finishes, the changelog still
contains entries from the cleaned rid. Under certain
conditions this can allow the RUV to get polluted
again, and the ruv element will be missing the replica
url.
Fix Description: At the end of the cleaning task, fire of a thread to
to completely purge the changelog of all entries
containing the cleaned rid.
Also, improved the cleanAllRUV task when dealing
with a server shutdown - previously if the timing is
right the task can "delay/hang" the shutdown process.
https://fedorahosted.org/389/ticket/48208
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit ff1c34538b0600259dba4801da2b2f0993fa5404)
(cherry picked from commit 9e4cf12cfbfde0761325b75c3fd5a8b39223760a)
(cherry picked from commit 264f67218aec5e11f68ad4e36e444730c8c3110c)
(cherry picked from commit e8803f5ad77ec742c57c0121dfc83822633ab602)
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index dd3168a..13bf203 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -345,14 +345,18 @@ static int _cl5TrimInit ();
static void _cl5TrimCleanup ();
static int _cl5TrimMain (void *param);
static void _cl5DoTrimming (ReplicaId rid);
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid);
static PRBool _cl5CanTrim (time_t time, long *numToTrim);
+static void _cl5TrimFile (Object *obj, long *numToTrim);
+
+static void _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid);
+static int _cl5PurgeGetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key);
+static int _cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key);
static int _cl5ReadRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5WriteRUV (CL5DBFile *file, PRBool purge);
static int _cl5ConstructRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5UpdateRUV (Object *obj, CSN *csn, PRBool newReplica, PRBool purge);
static int _cl5GetRUV2Purge2 (Object *fileObj, RUV **ruv);
-void trigger_cl_trimming_thread(void *rid);
+void trigger_cl_purging_thread(void *rid);
/* bakup/recovery, import/export */
static int _cl5LDIF2Operation (char *ldifEntry, slapi_operation_parameters *op,
@@ -3467,10 +3471,18 @@ static void _cl5DoTrimming (ReplicaId rid)
trimmed more often than other. We might have to fix that by, for
example, randomizing starting point */
obj = objset_first_obj (s_cl5Desc.dbFiles);
- while (obj && _cl5CanTrim ((time_t)0, &numToTrim))
- {
- _cl5TrimFile (obj, &numToTrim, rid);
- obj = objset_next_obj (s_cl5Desc.dbFiles, obj);
+ while (obj && (_cl5CanTrim ((time_t)0, &numToTrim) || rid))
+ {
+ if (rid){
+ /*
+ * We are cleaning an invalid rid, and need to strip it
+ * from the changelog.
+ */
+ _cl5PurgeRID (obj, rid);
+ } else {
+ _cl5TrimFile (obj, &numToTrim);
+ }
+ obj = objset_next_obj (s_cl5Desc.dbFiles, obj);
}
if (obj)
@@ -3481,12 +3493,351 @@ static void _cl5DoTrimming (ReplicaId rid)
return;
}
+/*
+ * If the rid is not set it is the very first iteration of the changelog.
+ * If the rid is set, we are doing another pass, and we have a key as our
+ * starting point.
+ */
+static int
+_cl5PurgeGetFirstEntry(Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key)
+{
+ DBC *cursor = NULL;
+ DBT data = {0};
+ CL5Iterator *it;
+ CL5DBFile *file;
+ int rc;
+
+ file = (CL5DBFile*)object_get_data (obj);
+
+ /* create cursor */
+ rc = file->db->cursor(file->db, txnid, &cursor, 0);
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to create cursor; db error - %d %s\n", rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+ goto done;
+ }
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = cursor->c_get(cursor, key, &data, rid?DB_SET:DB_NEXT)) == 0)
+ {
+ /* skip service entries on the first pass (rid == 0)*/
+ if (!rid && cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry(data.data, data.size, entry);
+ slapi_ch_free(&(data.data));
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to format entry: %d\n", rc);
+ goto done;
+ }
+
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
+ it->cursor = cursor;
+ object_acquire (obj);
+ it->file = obj;
+ *(CL5Iterator**)iterator = it;
+
+ return CL5_SUCCESS;
+ }
+
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file */
+ if (rc == DB_NOTFOUND)
+ {
+ rc = CL5_NOTFOUND;
+ goto done;
+ }
+
+ /* db error occured while iterating */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+
+done:
+ /*
+ * We didn't success in assigning this cursor to the iterator,
+ * so we need to free the cursor here.
+ */
+ if (cursor)
+ cursor->c_close(cursor);
+
+ return rc;
+}
+
+/*
+ * Get the next entry. If we get a lock error we will restart the process
+ * starting at the current key.
+ */
+static int
+_cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key)
+{
+ CL5Iterator *it;
+ DBT data={0};
+ int rc;
+
+ it = (CL5Iterator*) iterator;
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = it->cursor->c_get(it->cursor, key, &data, DB_NEXT)) == 0)
+ {
+ if (cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry (data.data, data.size, entry);
+ slapi_ch_free (&(data.data));
+ if (rc != 0)
+ {
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to format entry: %d\n",
+ rc);
+
+ }
+
+ return rc;
+ }
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file or entry is out of range */
+ if (rc == 0 || rc == DB_NOTFOUND){
+ slapi_ch_free(&key->data);
+ return CL5_NOTFOUND;
+ }
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+
+ /* cursor operation failed */
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+
+ return rc;
+}
+
+#define MAX_RETRIES 10
+/*
+ * _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+ *
+ * Clean the entire changelog of updates from the "cleaned rid" via CLEANALLRUV
+ * Delete entries in batches so we don't consume too many db locks, and we don't
+ * lockup the changelog during the entire purging process using one transaction.
+ * We save the key from the last iteration so we don't have to start from the
+ * beginning for each new iteration.
+ */
+static void
+_cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+{
+ slapi_operation_parameters op = {0};
+ ReplicaId csn_rid;
+ CL5Entry entry;
+ DB_TXN *txnid = NULL;
+ DBT key = {0};
+ void *iterator = NULL;
+ long totalTrimmed = 0;
+ long trimmed = 0;
+ char *starting_key = NULL;
+ int batch_count = 0;
+ int db_lock_retry_count = 0;
+ int first_pass = 1;
+ int finished = 0;
+ int rc = 0;
+
+ PR_ASSERT (obj);
+ entry.op = &op;
+
+ /*
+ * Keep processing the changelog until we are done, shutting down, or we
+ * maxed out on the db lock retries.
+ */
+ while (!finished && db_lock_retry_count < MAX_RETRIES && !slapi_is_shutting_down()){
+ trimmed = 0;
+
+ /*
+ * Sleep a bit to allow others to use the changelog - we can't hog the
+ * changelog for the entire purge.
+ */
+ DS_Sleep(PR_MillisecondsToInterval(100));
+
+ rc = TXN_BEGIN(s_cl5Desc.dbEnv, NULL, &txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to begin transaction; db error - %d %s. "
+ "Changelog was not purged of rid(%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ return;
+ }
+
+ /*
+ * Check every changelog entry for the cleaned rid
+ */
+ rc = _cl5PurgeGetFirstEntry(obj, &entry, &iterator, txnid, first_pass?0:cleaned_rid, &key);
+ first_pass = 0;
+ while (rc == CL5_SUCCESS && !slapi_is_shutting_down()) {
+ /*
+ * Store the new starting key - we need this starting key in case
+ * we run out of locks and have to start the transaction over.
+ */
+ slapi_ch_free_string(&starting_key);
+ starting_key = slapi_ch_strdup((char*)key.data);
+
+ if(trimmed == 10000 || (batch_count && trimmed == batch_count)){
+ /*
+ * Break out, and commit these deletes. Do not free the key,
+ * we need it for the next pass.
+ */
+ cl5_operation_parameters_done (&op);
+ db_lock_retry_count = 0; /* reset the retry count */
+ break;
+ }
+ if(op.csn){
+ csn_rid = csn_get_replicaid (op.csn);
+ if (csn_rid == cleaned_rid){
+ rc = _cl5CurrentDeleteEntry (iterator);
+ if (rc != CL5_SUCCESS){
+ /* log error */
+ cl5_operation_parameters_done (&op);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to
+ * the starting point
+ */
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks deleting entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ } else {
+ /* fatal error */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: fatal error (%d)\n", rc);
+ slapi_ch_free(&(key.data));
+ finished = 1;
+ break;
+ }
+ }
+ trimmed++;
+ }
+ }
+ slapi_ch_free(&(key.data));
+ cl5_operation_parameters_done (&op);
+
+ rc = _cl5PurgeGetNextEntry (&entry, iterator, &key);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to the starting
+ * point.
+ */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks getting the next entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ cl5_operation_parameters_done (&op);
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ }
+ }
+
+ if (rc == CL5_NOTFOUND){
+ /* Scanned the entire changelog, we're done */
+ finished = 1;
+ }
+
+ /* Destroy the iterator before we finish with the txn */
+ cl5DestroyIterator (iterator);
+
+ /*
+ * Commit or abort the txn
+ */
+ if (rc == CL5_SUCCESS || rc == CL5_NOTFOUND){
+ rc = TXN_COMMIT (txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to commit transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ break;
+ } else if (finished){
+ /* We're done */
+ totalTrimmed += trimmed;
+ break;
+ } else {
+ /* Not done yet */
+ totalTrimmed += trimmed;
+ trimmed = 0;
+ }
+ } else {
+ rc = TXN_ABORT (txnid);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to abort transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ }
+ if (batch_count == 0){
+ /* This was not a retry. Fatal error, break out */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Changelog was not purged of rid (%d)\n",
+ cleaned_rid);
+ break;
+ }
+ }
+ }
+ slapi_ch_free_string(&starting_key);
+
+ slapi_log_error (SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Removed (%ld entries) that originated from rid (%d)\n",
+ totalTrimmed, cleaned_rid);
+}
+
/* Note that each file contains changes for a single replicated area.
trimming algorithm:
*/
#define CL5_TRIM_MAX_PER_TRANSACTION 10
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
+static void _cl5TrimFile (Object *obj, long *numToTrim)
{
DB_TXN *txnid;
RUV *ruv = NULL;
@@ -3509,7 +3860,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
entry.op = &op;
-
while ( !finished && !slapi_is_shutting_down() )
{
it = NULL;
@@ -3530,7 +3880,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
finished = _cl5GetFirstEntry (obj, &entry, &it, txnid);
- while ( !finished )
+ while ( !finished && !slapi_is_shutting_down())
{
/*
* This change can be trimmed if it exceeds purge
@@ -3544,11 +3894,12 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
continue;
}
csn_rid = csn_get_replicaid (op.csn);
+
if ( (*numToTrim > 0 || _cl5CanTrim (entry.time, numToTrim)) &&
ruv_covers_csn_strict (ruv, op.csn) )
{
rc = _cl5CurrentDeleteEntry (it);
- if ( rc == CL5_SUCCESS && cleaned_rid != csn_rid)
+ if ( rc == CL5_SUCCESS)
{
rc = _cl5UpdateRUV (obj, op.csn, PR_FALSE, PR_TRUE);
}
@@ -3562,7 +3913,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
/* The above two functions have logged the error */
abort = PR_TRUE;
}
-
}
else
{
@@ -3619,7 +3969,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
rc = TXN_ABORT (txnid);
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to abort transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -3630,7 +3980,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
if (rc != 0)
{
finished = 1;
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to commit transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -4654,9 +5004,9 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
goto done;
}
#endif
- /* back off */
+ /* back off */
interval = PR_MillisecondsToInterval(slapi_rand() % 100);
- DS_Sleep(interval);
+ DS_Sleep(interval);
}
#if USE_DB_TXN
/* begin transaction */
@@ -4702,19 +5052,19 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
}
cnt ++;
}
-
+
if (rc == 0) /* we successfully added entry */
{
#if USE_DB_TXN
rc = TXN_COMMIT (txnid, 0);
#endif
}
- else
+ else
{
- char s[CSN_STRSIZE];
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ char s[CSN_STRSIZE];
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5WriteOperationTxn: failed to write entry with csn (%s); "
- "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
+ "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
rc, db_strerror(rc));
#if USE_DB_TXN
rc = TXN_ABORT (txnid);
@@ -4735,7 +5085,7 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
/* update purge vector if we have not seen any changes from this replica before */
_cl5UpdateRUV (file_obj, op->csn, PR_TRUE, PR_TRUE);
- slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
"cl5WriteOperationTxn: successfully written entry with csn (%s)\n", csnStr);
rc = CL5_SUCCESS;
done:
@@ -4749,7 +5099,7 @@ done:
return rc;
}
-static int _cl5WriteOperation(const char *replName, const char *replGen,
+static int _cl5WriteOperation(const char *replName, const char *replGen,
const slapi_operation_parameters *op, PRBool local)
{
return _cl5WriteOperationTxn(replName, replGen, op, local, NULL);
@@ -4800,7 +5150,7 @@ static int _cl5GetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_
goto done;
}
- it = (CL5Iterator*)slapi_ch_malloc (sizeof (CL5Iterator));
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
it->cursor = cursor;
object_acquire (obj);
it->file = obj;
@@ -4875,7 +5225,7 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
slapi_ch_free (&(data.data));
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5GetNextEntry: failed to format entry: %d\n", rc);
}
@@ -4904,38 +5254,42 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
}
/* cursor operation failed */
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
- rc, db_strerror(rc));
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
- return CL5_DB_ERROR;
+ return rc;
}
static int _cl5CurrentDeleteEntry (void *iterator)
{
int rc;
CL5Iterator *it;
- CL5DBFile *file;
+ CL5DBFile *file;
- PR_ASSERT (iterator);
+ PR_ASSERT (iterator);
it = (CL5Iterator*)iterator;
rc = it->cursor->c_del (it->cursor, 0);
if (rc == 0) {
- /* decrement entry count */
- file = (CL5DBFile*)object_get_data (it->file);
- PR_AtomicDecrement (&file->entryCount);
- return CL5_SUCCESS;
- } else {
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5CurrentDeleteEntry failed, err=%d %s\n",
- rc, db_strerror(rc));
- /* We don't free(close) the cursor here, as the caller will free it by a call to cl5DestroyIterator */
- /* Freeing it here is a potential bug, as the cursor can't be referenced later once freed */
- return CL5_DB_ERROR;
- }
+ /* decrement entry count */
+ file = (CL5DBFile*)object_get_data (it->file);
+ PR_AtomicDecrement (&file->entryCount);
+ return CL5_SUCCESS;
+ } else {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5CurrentDeleteEntry failed, err=%d %s\n",
+ rc, db_strerror(rc));
+ /*
+ * We don't free(close) the cursor here, as the caller will free it by
+ * a call to cl5DestroyIterator. Freeing it here is a potential bug,
+ * as the cursor can't be referenced later once freed.
+ */
+ return rc;
+ }
}
static PRBool _cl5IsValidIterator (const CL5Iterator *iterator)
@@ -6186,7 +6540,7 @@ static int _cl5ExportFile (PRFileDesc *prFile, Object *obj)
slapi_write_buffer (prFile, "\n", strlen("\n"));
entry.op = &op;
- rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
+ rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
while (rc == CL5_SUCCESS)
{
rc = _cl5Operation2LDIF (&op, file->replGen, &buff, &len);
@@ -6607,16 +6961,16 @@ cl5CleanRUV(ReplicaId rid){
slapi_rwlock_unlock (s_cl5Desc.stLock);
}
-void trigger_cl_trimming(ReplicaId rid){
+void trigger_cl_purging(ReplicaId rid){
PRThread *trim_tid = NULL;
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_trimming: rid (%d)\n",(int)rid);
- trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_trimming_thread,
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_purging: rid (%d)\n",(int)rid);
+ trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_purging_thread,
(void *)&rid, PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD,
PR_UNJOINABLE_THREAD, DEFAULT_THREAD_STACKSIZE);
if (NULL == trim_tid){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to create trimming "
+ "trigger_cl_purging: failed to create trimming "
"thread; NSPR error - %d\n", PR_GetError ());
} else {
/* need a little time for the thread to get started */
@@ -6625,7 +6979,7 @@ void trigger_cl_trimming(ReplicaId rid){
}
void
-trigger_cl_trimming_thread(void *arg){
+trigger_cl_purging_thread(void *arg){
ReplicaId rid = *(ReplicaId *)arg;
/* make sure we have a change log, and we aren't closing it */
@@ -6634,7 +6988,7 @@ trigger_cl_trimming_thread(void *arg){
}
if (CL5_SUCCESS != _cl5AddThread()) {
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to increment thread count "
+ "trigger_cl_purging: failed to increment thread count "
"NSPR error - %d\n", PR_GetError ());
}
_cl5DoTrimming(rid);
diff --git a/ldap/servers/plugins/replication/cl5_api.h b/ldap/servers/plugins/replication/cl5_api.h
index 9b285ca..b46a691 100644
--- a/ldap/servers/plugins/replication/cl5_api.h
+++ b/ldap/servers/plugins/replication/cl5_api.h
@@ -145,6 +145,9 @@ enum
CL5_CSN_ERROR, /* CSN API failed */
CL5_RUV_ERROR, /* RUV API failed */
CL5_OBJSET_ERROR, /* namedobjset api failed */
+ CL5_DB_LOCK_ERROR, /* bdb returns error 12 when the db runs out of locks,
+ this var needs to be in slot 12 of the list.
+ Do not re-order enum above! */
CL5_PURGED_DATA, /* requested data has been purged */
CL5_MISSING_DATA, /* data should be in the changelog, but is missing */
CL5_UNKNOWN_ERROR, /* unclassified error */
@@ -490,6 +493,6 @@ int cl5WriteRUV();
int cl5DeleteRUV();
void cl5CleanRUV(ReplicaId rid);
void cl5NotifyCleanup(int rid);
-void trigger_cl_trimming(ReplicaId rid);
+void trigger_cl_purging(ReplicaId rid);
#endif
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index ae4c2ff..68b3ce5 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -1216,6 +1216,11 @@ replica_execute_cleanruv_task (Object *r, ReplicaId rid, char *returntext /* not
*/
cl5CleanRUV(rid);
+ /*
+ * Now purge the changelog
+ */
+ trigger_cl_purging(rid);
+
if (rc != RUV_SUCCESS){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "cleanruv_task: task failed(%d)\n",rc);
return LDAP_OPERATIONS_ERROR;
@@ -1603,7 +1608,7 @@ replica_cleanallruv_thread(void *arg)
/* no agmts, just clean this replica */
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -1685,13 +1690,15 @@ replica_cleanallruv_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
- "retrying in %d seconds", interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
+ "retrying in %d seconds", interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -1702,10 +1709,9 @@ replica_cleanallruv_thread(void *arg)
done:
/*
- * If the replicas are cleaned, release the rid, and trim the changelog
+ * If the replicas are cleaned, release the rid
*/
if(!aborted){
- trigger_cl_trimming(data->rid);
delete_cleaned_rid_config(data);
/* make sure all the replicas have been "pre_cleaned" before finishing */
check_replicas_are_done_cleaning(data);
@@ -1715,7 +1721,7 @@ done:
/*
* Shutdown or abort
*/
- if(!is_task_aborted(data->rid)){
+ if(!is_task_aborted(data->rid) || slapi_is_shutting_down()){
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Server shutting down. Process will resume at server startup");
} else {
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Task aborted for rid(%d).",data->rid);
@@ -1918,7 +1924,7 @@ check_agmts_are_caught_up(cleanruv_data *data, char *maxcsn)
not_all_caughtup = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -1976,7 +1982,7 @@ check_agmts_are_alive(Replica *replica, ReplicaId rid, Slapi_Task *task)
not_all_alive = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (replica, agmt_obj);
@@ -2746,12 +2752,14 @@ replica_abort_task_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes. unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -2769,7 +2777,7 @@ done:
* Wait for this server to stop its cleanallruv task(which removes the rid from the cleaned list)
*/
cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID, "Waiting for CleanAllRUV task to abort...");
- while(is_cleaned_rid(data->rid)){
+ while(is_cleaned_rid(data->rid) && !slapi_is_shutting_down()){
DS_Sleep(PR_SecondsToInterval(1));
count++;
if(count == 60){ /* it should not take this long */
1
0
ldap/servers/plugins/replication/cl5_api.c | 452 ++++++++++++++--
ldap/servers/plugins/replication/cl5_api.h | 5
ldap/servers/plugins/replication/repl5_replica_config.c | 44 -
3 files changed, 433 insertions(+), 68 deletions(-)
New commits:
commit e8803f5ad77ec742c57c0121dfc83822633ab602
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jul 8 11:48:27 2015 -0400
Ticket 48208 - CleanAllRUV should completely purge changelog
Bug Description: After cleanAllRUV finishes, the changelog still
contains entries from the cleaned rid. Under certain
conditions this can allow the RUV to get polluted
again, and the ruv element will be missing the replica
url.
Fix Description: At the end of the cleaning task, fire of a thread to
to completely purge the changelog of all entries
containing the cleaned rid.
Also, improved the cleanAllRUV task when dealing
with a server shutdown - previously if the timing is
right the task can "delay/hang" the shutdown process.
https://fedorahosted.org/389/ticket/48208
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit ff1c34538b0600259dba4801da2b2f0993fa5404)
(cherry picked from commit 9e4cf12cfbfde0761325b75c3fd5a8b39223760a)
(cherry picked from commit 264f67218aec5e11f68ad4e36e444730c8c3110c)
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 4ab0eb0..9e31074 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -350,14 +350,18 @@ static int _cl5TrimInit ();
static void _cl5TrimCleanup ();
static int _cl5TrimMain (void *param);
static void _cl5DoTrimming (ReplicaId rid);
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid);
static PRBool _cl5CanTrim (time_t time, long *numToTrim);
+static void _cl5TrimFile (Object *obj, long *numToTrim);
+
+static void _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid);
+static int _cl5PurgeGetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key);
+static int _cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key);
static int _cl5ReadRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5WriteRUV (CL5DBFile *file, PRBool purge);
static int _cl5ConstructRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5UpdateRUV (Object *obj, CSN *csn, PRBool newReplica, PRBool purge);
static int _cl5GetRUV2Purge2 (Object *fileObj, RUV **ruv);
-void trigger_cl_trimming_thread(void *rid);
+void trigger_cl_purging_thread(void *rid);
/* bakup/recovery, import/export */
static int _cl5LDIF2Operation (char *ldifEntry, slapi_operation_parameters *op,
@@ -3477,10 +3481,18 @@ static void _cl5DoTrimming (ReplicaId rid)
trimmed more often than other. We might have to fix that by, for
example, randomizing starting point */
obj = objset_first_obj (s_cl5Desc.dbFiles);
- while (obj && _cl5CanTrim ((time_t)0, &numToTrim))
- {
- _cl5TrimFile (obj, &numToTrim, rid);
- obj = objset_next_obj (s_cl5Desc.dbFiles, obj);
+ while (obj && (_cl5CanTrim ((time_t)0, &numToTrim) || rid))
+ {
+ if (rid){
+ /*
+ * We are cleaning an invalid rid, and need to strip it
+ * from the changelog.
+ */
+ _cl5PurgeRID (obj, rid);
+ } else {
+ _cl5TrimFile (obj, &numToTrim);
+ }
+ obj = objset_next_obj (s_cl5Desc.dbFiles, obj);
}
if (obj)
@@ -3491,12 +3503,351 @@ static void _cl5DoTrimming (ReplicaId rid)
return;
}
+/*
+ * If the rid is not set it is the very first iteration of the changelog.
+ * If the rid is set, we are doing another pass, and we have a key as our
+ * starting point.
+ */
+static int
+_cl5PurgeGetFirstEntry(Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key)
+{
+ DBC *cursor = NULL;
+ DBT data = {0};
+ CL5Iterator *it;
+ CL5DBFile *file;
+ int rc;
+
+ file = (CL5DBFile*)object_get_data (obj);
+
+ /* create cursor */
+ rc = file->db->cursor(file->db, txnid, &cursor, 0);
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to create cursor; db error - %d %s\n", rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+ goto done;
+ }
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = cursor->c_get(cursor, key, &data, rid?DB_SET:DB_NEXT)) == 0)
+ {
+ /* skip service entries on the first pass (rid == 0)*/
+ if (!rid && cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry(data.data, data.size, entry);
+ slapi_ch_free(&(data.data));
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to format entry: %d\n", rc);
+ goto done;
+ }
+
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
+ it->cursor = cursor;
+ object_acquire (obj);
+ it->file = obj;
+ *(CL5Iterator**)iterator = it;
+
+ return CL5_SUCCESS;
+ }
+
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file */
+ if (rc == DB_NOTFOUND)
+ {
+ rc = CL5_NOTFOUND;
+ goto done;
+ }
+
+ /* db error occured while iterating */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+
+done:
+ /*
+ * We didn't success in assigning this cursor to the iterator,
+ * so we need to free the cursor here.
+ */
+ if (cursor)
+ cursor->c_close(cursor);
+
+ return rc;
+}
+
+/*
+ * Get the next entry. If we get a lock error we will restart the process
+ * starting at the current key.
+ */
+static int
+_cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key)
+{
+ CL5Iterator *it;
+ DBT data={0};
+ int rc;
+
+ it = (CL5Iterator*) iterator;
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = it->cursor->c_get(it->cursor, key, &data, DB_NEXT)) == 0)
+ {
+ if (cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry (data.data, data.size, entry);
+ slapi_ch_free (&(data.data));
+ if (rc != 0)
+ {
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to format entry: %d\n",
+ rc);
+
+ }
+
+ return rc;
+ }
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file or entry is out of range */
+ if (rc == 0 || rc == DB_NOTFOUND){
+ slapi_ch_free(&key->data);
+ return CL5_NOTFOUND;
+ }
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+
+ /* cursor operation failed */
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+
+ return rc;
+}
+
+#define MAX_RETRIES 10
+/*
+ * _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+ *
+ * Clean the entire changelog of updates from the "cleaned rid" via CLEANALLRUV
+ * Delete entries in batches so we don't consume too many db locks, and we don't
+ * lockup the changelog during the entire purging process using one transaction.
+ * We save the key from the last iteration so we don't have to start from the
+ * beginning for each new iteration.
+ */
+static void
+_cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+{
+ slapi_operation_parameters op = {0};
+ ReplicaId csn_rid;
+ CL5Entry entry;
+ DB_TXN *txnid = NULL;
+ DBT key = {0};
+ void *iterator = NULL;
+ long totalTrimmed = 0;
+ long trimmed = 0;
+ char *starting_key = NULL;
+ int batch_count = 0;
+ int db_lock_retry_count = 0;
+ int first_pass = 1;
+ int finished = 0;
+ int rc = 0;
+
+ PR_ASSERT (obj);
+ entry.op = &op;
+
+ /*
+ * Keep processing the changelog until we are done, shutting down, or we
+ * maxed out on the db lock retries.
+ */
+ while (!finished && db_lock_retry_count < MAX_RETRIES && !slapi_is_shutting_down()){
+ trimmed = 0;
+
+ /*
+ * Sleep a bit to allow others to use the changelog - we can't hog the
+ * changelog for the entire purge.
+ */
+ DS_Sleep(PR_MillisecondsToInterval(100));
+
+ rc = TXN_BEGIN(s_cl5Desc.dbEnv, NULL, &txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to begin transaction; db error - %d %s. "
+ "Changelog was not purged of rid(%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ return;
+ }
+
+ /*
+ * Check every changelog entry for the cleaned rid
+ */
+ rc = _cl5PurgeGetFirstEntry(obj, &entry, &iterator, txnid, first_pass?0:cleaned_rid, &key);
+ first_pass = 0;
+ while (rc == CL5_SUCCESS && !slapi_is_shutting_down()) {
+ /*
+ * Store the new starting key - we need this starting key in case
+ * we run out of locks and have to start the transaction over.
+ */
+ slapi_ch_free_string(&starting_key);
+ starting_key = slapi_ch_strdup((char*)key.data);
+
+ if(trimmed == 10000 || (batch_count && trimmed == batch_count)){
+ /*
+ * Break out, and commit these deletes. Do not free the key,
+ * we need it for the next pass.
+ */
+ cl5_operation_parameters_done (&op);
+ db_lock_retry_count = 0; /* reset the retry count */
+ break;
+ }
+ if(op.csn){
+ csn_rid = csn_get_replicaid (op.csn);
+ if (csn_rid == cleaned_rid){
+ rc = _cl5CurrentDeleteEntry (iterator);
+ if (rc != CL5_SUCCESS){
+ /* log error */
+ cl5_operation_parameters_done (&op);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to
+ * the starting point
+ */
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks deleting entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ } else {
+ /* fatal error */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: fatal error (%d)\n", rc);
+ slapi_ch_free(&(key.data));
+ finished = 1;
+ break;
+ }
+ }
+ trimmed++;
+ }
+ }
+ slapi_ch_free(&(key.data));
+ cl5_operation_parameters_done (&op);
+
+ rc = _cl5PurgeGetNextEntry (&entry, iterator, &key);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to the starting
+ * point.
+ */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks getting the next entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ cl5_operation_parameters_done (&op);
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ }
+ }
+
+ if (rc == CL5_NOTFOUND){
+ /* Scanned the entire changelog, we're done */
+ finished = 1;
+ }
+
+ /* Destroy the iterator before we finish with the txn */
+ cl5DestroyIterator (iterator);
+
+ /*
+ * Commit or abort the txn
+ */
+ if (rc == CL5_SUCCESS || rc == CL5_NOTFOUND){
+ rc = TXN_COMMIT (txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to commit transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ break;
+ } else if (finished){
+ /* We're done */
+ totalTrimmed += trimmed;
+ break;
+ } else {
+ /* Not done yet */
+ totalTrimmed += trimmed;
+ trimmed = 0;
+ }
+ } else {
+ rc = TXN_ABORT (txnid);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to abort transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ }
+ if (batch_count == 0){
+ /* This was not a retry. Fatal error, break out */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Changelog was not purged of rid (%d)\n",
+ cleaned_rid);
+ break;
+ }
+ }
+ }
+ slapi_ch_free_string(&starting_key);
+
+ slapi_log_error (SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Removed (%ld entries) that originated from rid (%d)\n",
+ totalTrimmed, cleaned_rid);
+}
+
/* Note that each file contains changes for a single replicated area.
trimming algorithm:
*/
#define CL5_TRIM_MAX_PER_TRANSACTION 10
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
+static void _cl5TrimFile (Object *obj, long *numToTrim)
{
DB_TXN *txnid;
RUV *ruv = NULL;
@@ -3519,7 +3870,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
entry.op = &op;
-
while ( !finished && !slapi_is_shutting_down() )
{
it = NULL;
@@ -3540,7 +3890,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
finished = _cl5GetFirstEntry (obj, &entry, &it, txnid);
- while ( !finished )
+ while ( !finished && !slapi_is_shutting_down())
{
/*
* This change can be trimmed if it exceeds purge
@@ -3554,11 +3904,12 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
continue;
}
csn_rid = csn_get_replicaid (op.csn);
+
if ( (*numToTrim > 0 || _cl5CanTrim (entry.time, numToTrim)) &&
ruv_covers_csn_strict (ruv, op.csn) )
{
rc = _cl5CurrentDeleteEntry (it);
- if ( rc == CL5_SUCCESS && cleaned_rid != csn_rid)
+ if ( rc == CL5_SUCCESS)
{
rc = _cl5UpdateRUV (obj, op.csn, PR_FALSE, PR_TRUE);
}
@@ -3572,7 +3923,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
/* The above two functions have logged the error */
abort = PR_TRUE;
}
-
}
else
{
@@ -3629,7 +3979,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
rc = TXN_ABORT (txnid);
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to abort transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -3640,7 +3990,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
if (rc != 0)
{
finished = 1;
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to commit transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -4664,9 +5014,9 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
goto done;
}
#endif
- /* back off */
+ /* back off */
interval = PR_MillisecondsToInterval(slapi_rand() % 100);
- DS_Sleep(interval);
+ DS_Sleep(interval);
}
#if USE_DB_TXN
/* begin transaction */
@@ -4712,19 +5062,19 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
}
cnt ++;
}
-
+
if (rc == 0) /* we successfully added entry */
{
#if USE_DB_TXN
rc = TXN_COMMIT (txnid, 0);
#endif
}
- else
+ else
{
- char s[CSN_STRSIZE];
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ char s[CSN_STRSIZE];
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5WriteOperationTxn: failed to write entry with csn (%s); "
- "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
+ "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
rc, db_strerror(rc));
#if USE_DB_TXN
rc = TXN_ABORT (txnid);
@@ -4745,7 +5095,7 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
/* update purge vector if we have not seen any changes from this replica before */
_cl5UpdateRUV (file_obj, op->csn, PR_TRUE, PR_TRUE);
- slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
"cl5WriteOperationTxn: successfully written entry with csn (%s)\n", csnStr);
rc = CL5_SUCCESS;
done:
@@ -4759,7 +5109,7 @@ done:
return rc;
}
-static int _cl5WriteOperation(const char *replName, const char *replGen,
+static int _cl5WriteOperation(const char *replName, const char *replGen,
const slapi_operation_parameters *op, PRBool local)
{
return _cl5WriteOperationTxn(replName, replGen, op, local, NULL);
@@ -4810,7 +5160,7 @@ static int _cl5GetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_
goto done;
}
- it = (CL5Iterator*)slapi_ch_malloc (sizeof (CL5Iterator));
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
it->cursor = cursor;
object_acquire (obj);
it->file = obj;
@@ -4885,7 +5235,7 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
slapi_ch_free (&(data.data));
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5GetNextEntry: failed to format entry: %d\n", rc);
}
@@ -4914,38 +5264,42 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
}
/* cursor operation failed */
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
- rc, db_strerror(rc));
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
- return CL5_DB_ERROR;
+ return rc;
}
static int _cl5CurrentDeleteEntry (void *iterator)
{
int rc;
CL5Iterator *it;
- CL5DBFile *file;
+ CL5DBFile *file;
- PR_ASSERT (iterator);
+ PR_ASSERT (iterator);
it = (CL5Iterator*)iterator;
rc = it->cursor->c_del (it->cursor, 0);
if (rc == 0) {
- /* decrement entry count */
- file = (CL5DBFile*)object_get_data (it->file);
- PR_AtomicDecrement (&file->entryCount);
- return CL5_SUCCESS;
- } else {
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5CurrentDeleteEntry failed, err=%d %s\n",
- rc, db_strerror(rc));
- /* We don't free(close) the cursor here, as the caller will free it by a call to cl5DestroyIterator */
- /* Freeing it here is a potential bug, as the cursor can't be referenced later once freed */
- return CL5_DB_ERROR;
- }
+ /* decrement entry count */
+ file = (CL5DBFile*)object_get_data (it->file);
+ PR_AtomicDecrement (&file->entryCount);
+ return CL5_SUCCESS;
+ } else {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5CurrentDeleteEntry failed, err=%d %s\n",
+ rc, db_strerror(rc));
+ /*
+ * We don't free(close) the cursor here, as the caller will free it by
+ * a call to cl5DestroyIterator. Freeing it here is a potential bug,
+ * as the cursor can't be referenced later once freed.
+ */
+ return rc;
+ }
}
static PRBool _cl5IsValidIterator (const CL5Iterator *iterator)
@@ -6217,7 +6571,7 @@ static int _cl5ExportFile (PRFileDesc *prFile, Object *obj)
slapi_write_buffer (prFile, "\n", strlen("\n"));
entry.op = &op;
- rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
+ rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
while (rc == CL5_SUCCESS)
{
rc = _cl5Operation2LDIF (&op, file->replGen, &buff, &len);
@@ -6638,16 +6992,16 @@ cl5CleanRUV(ReplicaId rid){
slapi_rwlock_unlock (s_cl5Desc.stLock);
}
-void trigger_cl_trimming(ReplicaId rid){
+void trigger_cl_purging(ReplicaId rid){
PRThread *trim_tid = NULL;
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_trimming: rid (%d)\n",(int)rid);
- trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_trimming_thread,
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_purging: rid (%d)\n",(int)rid);
+ trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_purging_thread,
(void *)&rid, PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD,
PR_UNJOINABLE_THREAD, DEFAULT_THREAD_STACKSIZE);
if (NULL == trim_tid){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to create trimming "
+ "trigger_cl_purging: failed to create trimming "
"thread; NSPR error - %d\n", PR_GetError ());
} else {
/* need a little time for the thread to get started */
@@ -6656,7 +7010,7 @@ void trigger_cl_trimming(ReplicaId rid){
}
void
-trigger_cl_trimming_thread(void *arg){
+trigger_cl_purging_thread(void *arg){
ReplicaId rid = *(ReplicaId *)arg;
/* make sure we have a change log, and we aren't closing it */
@@ -6665,7 +7019,7 @@ trigger_cl_trimming_thread(void *arg){
}
if (CL5_SUCCESS != _cl5AddThread()) {
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to increment thread count "
+ "trigger_cl_purging: failed to increment thread count "
"NSPR error - %d\n", PR_GetError ());
}
_cl5DoTrimming(rid);
diff --git a/ldap/servers/plugins/replication/cl5_api.h b/ldap/servers/plugins/replication/cl5_api.h
index 9b285ca..b46a691 100644
--- a/ldap/servers/plugins/replication/cl5_api.h
+++ b/ldap/servers/plugins/replication/cl5_api.h
@@ -145,6 +145,9 @@ enum
CL5_CSN_ERROR, /* CSN API failed */
CL5_RUV_ERROR, /* RUV API failed */
CL5_OBJSET_ERROR, /* namedobjset api failed */
+ CL5_DB_LOCK_ERROR, /* bdb returns error 12 when the db runs out of locks,
+ this var needs to be in slot 12 of the list.
+ Do not re-order enum above! */
CL5_PURGED_DATA, /* requested data has been purged */
CL5_MISSING_DATA, /* data should be in the changelog, but is missing */
CL5_UNKNOWN_ERROR, /* unclassified error */
@@ -490,6 +493,6 @@ int cl5WriteRUV();
int cl5DeleteRUV();
void cl5CleanRUV(ReplicaId rid);
void cl5NotifyCleanup(int rid);
-void trigger_cl_trimming(ReplicaId rid);
+void trigger_cl_purging(ReplicaId rid);
#endif
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 73eef6f..7bc387a 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -1324,6 +1324,11 @@ replica_execute_cleanruv_task (Object *r, ReplicaId rid, char *returntext /* not
*/
cl5CleanRUV(rid);
+ /*
+ * Now purge the changelog
+ */
+ trigger_cl_purging(rid);
+
if (rc != RUV_SUCCESS){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "cleanruv_task: task failed(%d)\n",rc);
return LDAP_OPERATIONS_ERROR;
@@ -1711,7 +1716,7 @@ replica_cleanallruv_thread(void *arg)
/* no agmts, just clean this replica */
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -1793,13 +1798,15 @@ replica_cleanallruv_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
- "retrying in %d seconds", interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
+ "retrying in %d seconds", interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -1810,10 +1817,9 @@ replica_cleanallruv_thread(void *arg)
done:
/*
- * If the replicas are cleaned, release the rid, and trim the changelog
+ * If the replicas are cleaned, release the rid
*/
if(!aborted){
- trigger_cl_trimming(data->rid);
delete_cleaned_rid_config(data);
/* make sure all the replicas have been "pre_cleaned" before finishing */
check_replicas_are_done_cleaning(data);
@@ -1823,7 +1829,7 @@ done:
/*
* Shutdown or abort
*/
- if(!is_task_aborted(data->rid)){
+ if(!is_task_aborted(data->rid) || slapi_is_shutting_down()){
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Server shutting down. Process will resume at server startup");
} else {
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Task aborted for rid(%d).",data->rid);
@@ -2026,7 +2032,7 @@ check_agmts_are_caught_up(cleanruv_data *data, char *maxcsn)
not_all_caughtup = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -2084,7 +2090,7 @@ check_agmts_are_alive(Replica *replica, ReplicaId rid, Slapi_Task *task)
not_all_alive = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (replica, agmt_obj);
@@ -2853,12 +2859,14 @@ replica_abort_task_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes. unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -2876,7 +2884,7 @@ done:
* Wait for this server to stop its cleanallruv task(which removes the rid from the cleaned list)
*/
cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID, "Waiting for CleanAllRUV task to abort...");
- while(is_cleaned_rid(data->rid)){
+ while(is_cleaned_rid(data->rid) && !slapi_is_shutting_down()){
DS_Sleep(PR_SecondsToInterval(1));
count++;
if(count == 60){ /* it should not take this long */
1
0
ldap/servers/slapd/log.c | 109 ++++++++++++++++++++++++++++-------------------
1 file changed, 67 insertions(+), 42 deletions(-)
New commits:
commit 8081a91a7a1714396a377871d1f676f000d7a4d5
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 10:30:07 2015 -0700
Ticket #48304 - ns-slapd - LOGINFO:Unable to remove file
Description: In the log rotation, if a log file to be deleted does
not exist, the "Unable to remove file" is logged in the error log,
which is not necessary.
This patch updates the logging code to suppress the unnecessary log
messages as well as replace with more detailed ones.
https://fedorahosted.org/389/ticket/48304
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit e2abffcc5cf6e63136fc0bcb5b0e12830cca22a5)
(cherry picked from commit 6c71c0d96d2287bcae88942ce6d5a0f7df5bee84)
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 1014a03..817751a 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -2465,15 +2465,25 @@ log__delete_access_logfile()
loginfo.log_access_fdes = NULL;
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -2575,15 +2585,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_access_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_access_file,tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_access_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_access_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_access_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_access_logs--;
@@ -3245,7 +3255,6 @@ log__delete_error_logfile(int locked)
char buffer[BUFSIZ];
char tbuf[TBUFSIZE];
-
/* If we have only one log, then will delete this one */
if (loginfo.log_error_maxnumlogs == 1) {
LOG_CLOSE(loginfo.log_error_fdes);
@@ -3253,10 +3262,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
@@ -3264,11 +3277,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n",
- loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
return 0;
@@ -3380,10 +3396,11 @@ delete_logfile:
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_error_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
PRErrorCode prerr = PR_GetError();
- PR_snprintf(buffer, sizeof(buffer),
- "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
- loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
- log__error_emergency(buffer, 0, locked);
+ if (PR_FILE_NOT_FOUND_ERROR != prerr) {
+ PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ log__error_emergency(buffer, 0, locked);
+ }
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_error_logs--;
@@ -3423,15 +3440,25 @@ log__delete_audit_logfile()
loginfo.log_audit_fdes = NULL;
PR_snprintf(buffer, sizeof(buffer), "%s", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf(buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotatoininfo error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -3532,15 +3559,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf(buffer, sizeof(buffer), "%s.%s", loginfo.log_audit_file, tbuf );
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_audit_file, tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_audit_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_audit_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_audit_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_audit_logs--;
@@ -3822,10 +3849,8 @@ log__open_errorlogfile(int logfile_state, int locked)
Even if PR_Rename fails with the error, we continue logging.
*/
if (PR_FILE_EXISTS_ERROR != prerr) {
- PR_snprintf(buffer, sizeof(buffer),
- "Failed to rename errors log file, "
- SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...",
- prerr, slapd_pr_strerror(prerr));
+ PR_snprintf(buffer, sizeof(buffer), "Failed to rename errors log file, "
+ SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...\n", prerr, slapd_pr_strerror(prerr));
log__error_emergency(buffer, 1, 1);
slapi_ch_free((void **)&log);
if (!locked) LOG_ERROR_UNLOCK_WRITE();
1
0
ldap/servers/slapd/log.c | 109 ++++++++++++++++++++++++++++-------------------
1 file changed, 67 insertions(+), 42 deletions(-)
New commits:
commit 6c71c0d96d2287bcae88942ce6d5a0f7df5bee84
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 10:30:07 2015 -0700
Ticket #48304 - ns-slapd - LOGINFO:Unable to remove file
Description: In the log rotation, if a log file to be deleted does
not exist, the "Unable to remove file" is logged in the error log,
which is not necessary.
This patch updates the logging code to suppress the unnecessary log
messages as well as replace with more detailed ones.
https://fedorahosted.org/389/ticket/48304
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
(cherry picked from commit e2abffcc5cf6e63136fc0bcb5b0e12830cca22a5)
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 1458e54..2ec90de 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -2330,15 +2330,25 @@ log__delete_access_logfile()
loginfo.log_access_fdes = NULL;
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -2440,15 +2450,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_access_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_access_file,tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_access_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_access_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_access_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_access_logs--;
@@ -3067,7 +3077,6 @@ log__delete_error_logfile(int locked)
char buffer[BUFSIZ];
char tbuf[TBUFSIZE];
-
/* If we have only one log, then will delete this one */
if (loginfo.log_error_maxnumlogs == 1) {
LOG_CLOSE(loginfo.log_error_fdes);
@@ -3075,10 +3084,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
@@ -3086,11 +3099,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n",
- loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
return 0;
@@ -3202,10 +3218,11 @@ delete_logfile:
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_error_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
PRErrorCode prerr = PR_GetError();
- PR_snprintf(buffer, sizeof(buffer),
- "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
- loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
- log__error_emergency(buffer, 0, locked);
+ if (PR_FILE_NOT_FOUND_ERROR != prerr) {
+ PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ log__error_emergency(buffer, 0, locked);
+ }
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_error_logs--;
@@ -3245,15 +3262,25 @@ log__delete_audit_logfile()
loginfo.log_audit_fdes = NULL;
PR_snprintf(buffer, sizeof(buffer), "%s", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf(buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotatoininfo error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -3354,15 +3381,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf(buffer, sizeof(buffer), "%s.%s", loginfo.log_audit_file, tbuf );
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_audit_file, tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_audit_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_audit_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_audit_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_audit_logs--;
@@ -3640,10 +3667,8 @@ log__open_errorlogfile(int logfile_state, int locked)
Even if PR_Rename fails with the error, we continue logging.
*/
if (PR_FILE_EXISTS_ERROR != prerr) {
- PR_snprintf(buffer, sizeof(buffer),
- "Failed to rename errors log file, "
- SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...",
- prerr, slapd_pr_strerror(prerr));
+ PR_snprintf(buffer, sizeof(buffer), "Failed to rename errors log file, "
+ SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...\n", prerr, slapd_pr_strerror(prerr));
log__error_emergency(buffer, 1, 1);
slapi_ch_free((void **)&log);
if (!locked) LOG_ERROR_UNLOCK_WRITE();
1
0
ldap/servers/slapd/log.c | 109 ++++++++++++++++++++++++++++-------------------
1 file changed, 67 insertions(+), 42 deletions(-)
New commits:
commit e2abffcc5cf6e63136fc0bcb5b0e12830cca22a5
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 8 10:30:07 2015 -0700
Ticket #48304 - ns-slapd - LOGINFO:Unable to remove file
Description: In the log rotation, if a log file to be deleted does
not exist, the "Unable to remove file" is logged in the error log,
which is not necessary.
This patch updates the logging code to suppress the unnecessary log
messages as well as replace with more detailed ones.
https://fedorahosted.org/389/ticket/48304
Reviewed by mreynolds(a)redhat.com (Thank you, Mark!!)
diff --git a/ldap/servers/slapd/log.c b/ldap/servers/slapd/log.c
index 1458e54..2ec90de 100644
--- a/ldap/servers/slapd/log.c
+++ b/ldap/servers/slapd/log.c
@@ -2330,15 +2330,25 @@ log__delete_access_logfile()
loginfo.log_access_fdes = NULL;
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_access_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_access_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_access_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -2440,15 +2450,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_access_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_access_file,tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_access_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_access_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_access_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_access_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_access_logs--;
@@ -3067,7 +3077,6 @@ log__delete_error_logfile(int locked)
char buffer[BUFSIZ];
char tbuf[TBUFSIZE];
-
/* If we have only one log, then will delete this one */
if (loginfo.log_error_maxnumlogs == 1) {
LOG_CLOSE(loginfo.log_error_fdes);
@@ -3075,10 +3084,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
@@ -3086,11 +3099,14 @@ log__delete_error_logfile(int locked)
PR_snprintf (buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_error_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
if (!locked) {
- /* if locked, we should not call LDAPDebug,
- which tries to get a lock internally. */
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n",
- loginfo.log_error_file,0,0);
+ /* If locked, we should not call LDAPDebug, which tries to get a lock internally. */
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_error_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotationinfo error %d (%s)\n",
+ loginfo.log_error_file, prerr, slapd_pr_strerror(prerr));
+ }
}
}
return 0;
@@ -3202,10 +3218,11 @@ delete_logfile:
PR_snprintf (buffer, sizeof(buffer), "%s.%s", loginfo.log_error_file, tbuf);
if (PR_Delete(buffer) != PR_SUCCESS) {
PRErrorCode prerr = PR_GetError();
- PR_snprintf(buffer, sizeof(buffer),
- "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
- loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
- log__error_emergency(buffer, 0, locked);
+ if (PR_FILE_NOT_FOUND_ERROR != prerr) {
+ PR_snprintf(buffer, sizeof(buffer), "LOGINFO:Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_error_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ log__error_emergency(buffer, 0, locked);
+ }
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_error_logs--;
@@ -3245,15 +3262,25 @@ log__delete_audit_logfile()
loginfo.log_audit_fdes = NULL;
PR_snprintf(buffer, sizeof(buffer), "%s", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
/* Delete the rotation file also. */
PR_snprintf(buffer, sizeof(buffer), "%s.rotationinfo", loginfo.log_audit_file);
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.rotationinfo\n", loginfo.log_audit_file,0,0);
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.rotatoininfo error %d (%s)\n",
+ loginfo.log_audit_file, prerr, slapd_pr_strerror(prerr));
+ }
}
return 0;
}
@@ -3354,15 +3381,15 @@ delete_logfile:
log_convert_time (delete_logp->l_ctime, tbuf, 1 /*short */);
PR_snprintf(buffer, sizeof(buffer), "%s.%s", loginfo.log_audit_file, tbuf );
if (PR_Delete(buffer) != PR_SUCCESS) {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Unable to remove file:%s.%s\n",
- loginfo.log_audit_file, tbuf,0);
-
+ PRErrorCode prerr = PR_GetError();
+ if (PR_FILE_NOT_FOUND_ERROR == prerr) {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "File %s already removed\n", loginfo.log_audit_file);
+ } else {
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Unable to remove file:%s.%s error %d (%s)\n",
+ loginfo.log_audit_file, tbuf, prerr, slapd_pr_strerror(prerr));
+ }
} else {
- LDAPDebug(LDAP_DEBUG_TRACE,
- "LOGINFO:Removed file:%s.%s because of (%s)\n",
- loginfo.log_audit_file, tbuf,
- logstr);
+ slapi_log_error(SLAPI_LOG_TRACE, "LOGINFO", "Removed file:%s.%s because of (%s)\n", loginfo.log_audit_file, tbuf, logstr);
}
slapi_ch_free((void**)&delete_logp);
loginfo.log_numof_audit_logs--;
@@ -3640,10 +3667,8 @@ log__open_errorlogfile(int logfile_state, int locked)
Even if PR_Rename fails with the error, we continue logging.
*/
if (PR_FILE_EXISTS_ERROR != prerr) {
- PR_snprintf(buffer, sizeof(buffer),
- "Failed to rename errors log file, "
- SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...",
- prerr, slapd_pr_strerror(prerr));
+ PR_snprintf(buffer, sizeof(buffer), "Failed to rename errors log file, "
+ SLAPI_COMPONENT_NAME_NSPR " error %d (%s). Exiting...\n", prerr, slapd_pr_strerror(prerr));
log__error_emergency(buffer, 1, 1);
slapi_ch_free((void **)&log);
if (!locked) LOG_ERROR_UNLOCK_WRITE();
1
0
ldap/servers/plugins/replication/cl5_api.c | 447 ++++++++++++++--
ldap/servers/plugins/replication/cl5_api.h | 5
ldap/servers/plugins/replication/repl5_replica_config.c | 44 -
3 files changed, 430 insertions(+), 66 deletions(-)
New commits:
commit 98def844d2aadf80e96e3db6f1461a81c0ea36a9
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jul 8 11:48:27 2015 -0400
Ticket 48208 - CleanAllRUV should completely purge changelog
Bug Description: After cleanAllRUV finishes, the changelog still
contains entries from the cleaned rid. Under certain
conditions this can allow the RUV to get polluted
again, and the ruv element will be missing the replica
url.
Fix Description: At the end of the cleaning task, fire of a thread to
to completely purge the changelog of all entries
containing the cleaned rid.
Also, improved the cleanAllRUV task when dealing
with a server shutdown - previously if the timing is
right the task can "delay/hang" the shutdown process.
https://fedorahosted.org/389/ticket/48208
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit ff1c34538b0600259dba4801da2b2f0993fa5404)
(cherry picked from commit 9e4cf12cfbfde0761325b75c3fd5a8b39223760a)
(cherry picked from commit 264f67218aec5e11f68ad4e36e444730c8c3110c)
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 2d9a0bd..2cf5a3f 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -353,14 +353,17 @@ static void _cl5TrimCleanup ();
static int _cl5TrimMain (void *param);
static void _cl5DoTrimming (ReplicaId rid);
static void _cl5CompactDBs();
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid);
+static void _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid);
+static int _cl5PurgeGetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key);
+static int _cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key);
+static void _cl5TrimFile (Object *obj, long *numToTrim);
static PRBool _cl5CanTrim (time_t time, long *numToTrim);
static int _cl5ReadRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5WriteRUV (CL5DBFile *file, PRBool purge);
static int _cl5ConstructRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5UpdateRUV (Object *obj, CSN *csn, PRBool newReplica, PRBool purge);
static int _cl5GetRUV2Purge2 (Object *fileObj, RUV **ruv);
-void trigger_cl_trimming_thread(void *rid);
+void trigger_cl_purging_thread(void *rid);
/* bakup/recovery, import/export */
static int _cl5LDIF2Operation (char *ldifEntry, slapi_operation_parameters *op,
@@ -3504,9 +3507,17 @@ static void _cl5DoTrimming (ReplicaId rid)
trimmed more often than other. We might have to fix that by, for
example, randomizing starting point */
obj = objset_first_obj (s_cl5Desc.dbFiles);
- while (obj && _cl5CanTrim ((time_t)0, &numToTrim))
+ while (obj && (_cl5CanTrim ((time_t)0, &numToTrim) || rid))
{
- _cl5TrimFile (obj, &numToTrim, rid);
+ if (rid){
+ /*
+ * We are cleaning an invalid rid, and need to strip it
+ * from the changelog.
+ */
+ _cl5PurgeRID (obj, rid);
+ } else {
+ _cl5TrimFile (obj, &numToTrim);
+ }
obj = objset_next_obj (s_cl5Desc.dbFiles, obj);
}
@@ -3583,12 +3594,351 @@ bail:
return;
}
+/*
+ * If the rid is not set it is the very first iteration of the changelog.
+ * If the rid is set, we are doing another pass, and we have a key as our
+ * starting point.
+ */
+static int
+_cl5PurgeGetFirstEntry(Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key)
+{
+ DBC *cursor = NULL;
+ DBT data = {0};
+ CL5Iterator *it;
+ CL5DBFile *file;
+ int rc;
+
+ file = (CL5DBFile*)object_get_data (obj);
+
+ /* create cursor */
+ rc = file->db->cursor(file->db, txnid, &cursor, 0);
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to create cursor; db error - %d %s\n", rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+ goto done;
+ }
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = cursor->c_get(cursor, key, &data, rid?DB_SET:DB_NEXT)) == 0)
+ {
+ /* skip service entries on the first pass (rid == 0)*/
+ if (!rid && cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry(data.data, data.size, entry);
+ slapi_ch_free(&(data.data));
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to format entry: %d\n", rc);
+ goto done;
+ }
+
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
+ it->cursor = cursor;
+ object_acquire (obj);
+ it->file = obj;
+ *(CL5Iterator**)iterator = it;
+
+ return CL5_SUCCESS;
+ }
+
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file */
+ if (rc == DB_NOTFOUND)
+ {
+ rc = CL5_NOTFOUND;
+ goto done;
+ }
+
+ /* db error occured while iterating */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+
+done:
+ /*
+ * We didn't success in assigning this cursor to the iterator,
+ * so we need to free the cursor here.
+ */
+ if (cursor)
+ cursor->c_close(cursor);
+
+ return rc;
+}
+
+/*
+ * Get the next entry. If we get a lock error we will restart the process
+ * starting at the current key.
+ */
+static int
+_cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key)
+{
+ CL5Iterator *it;
+ DBT data={0};
+ int rc;
+
+ it = (CL5Iterator*) iterator;
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = it->cursor->c_get(it->cursor, key, &data, DB_NEXT)) == 0)
+ {
+ if (cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry (data.data, data.size, entry);
+ slapi_ch_free (&(data.data));
+ if (rc != 0)
+ {
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to format entry: %d\n",
+ rc);
+
+ }
+
+ return rc;
+ }
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file or entry is out of range */
+ if (rc == 0 || rc == DB_NOTFOUND){
+ slapi_ch_free(&key->data);
+ return CL5_NOTFOUND;
+ }
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+
+ /* cursor operation failed */
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+
+ return rc;
+}
+
+#define MAX_RETRIES 10
+/*
+ * _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+ *
+ * Clean the entire changelog of updates from the "cleaned rid" via CLEANALLRUV
+ * Delete entries in batches so we don't consume too many db locks, and we don't
+ * lockup the changelog during the entire purging process using one transaction.
+ * We save the key from the last iteration so we don't have to start from the
+ * beginning for each new iteration.
+ */
+static void
+_cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+{
+ slapi_operation_parameters op = {0};
+ ReplicaId csn_rid;
+ CL5Entry entry;
+ DB_TXN *txnid = NULL;
+ DBT key = {0};
+ void *iterator = NULL;
+ long totalTrimmed = 0;
+ long trimmed = 0;
+ char *starting_key = NULL;
+ int batch_count = 0;
+ int db_lock_retry_count = 0;
+ int first_pass = 1;
+ int finished = 0;
+ int rc = 0;
+
+ PR_ASSERT (obj);
+ entry.op = &op;
+
+ /*
+ * Keep processing the changelog until we are done, shutting down, or we
+ * maxed out on the db lock retries.
+ */
+ while (!finished && db_lock_retry_count < MAX_RETRIES && !slapi_is_shutting_down()){
+ trimmed = 0;
+
+ /*
+ * Sleep a bit to allow others to use the changelog - we can't hog the
+ * changelog for the entire purge.
+ */
+ DS_Sleep(PR_MillisecondsToInterval(100));
+
+ rc = TXN_BEGIN(s_cl5Desc.dbEnv, NULL, &txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to begin transaction; db error - %d %s. "
+ "Changelog was not purged of rid(%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ return;
+ }
+
+ /*
+ * Check every changelog entry for the cleaned rid
+ */
+ rc = _cl5PurgeGetFirstEntry(obj, &entry, &iterator, txnid, first_pass?0:cleaned_rid, &key);
+ first_pass = 0;
+ while (rc == CL5_SUCCESS && !slapi_is_shutting_down()) {
+ /*
+ * Store the new starting key - we need this starting key in case
+ * we run out of locks and have to start the transaction over.
+ */
+ slapi_ch_free_string(&starting_key);
+ starting_key = slapi_ch_strdup((char*)key.data);
+
+ if(trimmed == 10000 || (batch_count && trimmed == batch_count)){
+ /*
+ * Break out, and commit these deletes. Do not free the key,
+ * we need it for the next pass.
+ */
+ cl5_operation_parameters_done (&op);
+ db_lock_retry_count = 0; /* reset the retry count */
+ break;
+ }
+ if(op.csn){
+ csn_rid = csn_get_replicaid (op.csn);
+ if (csn_rid == cleaned_rid){
+ rc = _cl5CurrentDeleteEntry (iterator);
+ if (rc != CL5_SUCCESS){
+ /* log error */
+ cl5_operation_parameters_done (&op);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to
+ * the starting point
+ */
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks deleting entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ } else {
+ /* fatal error */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: fatal error (%d)\n", rc);
+ slapi_ch_free(&(key.data));
+ finished = 1;
+ break;
+ }
+ }
+ trimmed++;
+ }
+ }
+ slapi_ch_free(&(key.data));
+ cl5_operation_parameters_done (&op);
+
+ rc = _cl5PurgeGetNextEntry (&entry, iterator, &key);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to the starting
+ * point.
+ */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks getting the next entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ cl5_operation_parameters_done (&op);
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ }
+ }
+
+ if (rc == CL5_NOTFOUND){
+ /* Scanned the entire changelog, we're done */
+ finished = 1;
+ }
+
+ /* Destroy the iterator before we finish with the txn */
+ cl5DestroyIterator (iterator);
+
+ /*
+ * Commit or abort the txn
+ */
+ if (rc == CL5_SUCCESS || rc == CL5_NOTFOUND){
+ rc = TXN_COMMIT (txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to commit transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ break;
+ } else if (finished){
+ /* We're done */
+ totalTrimmed += trimmed;
+ break;
+ } else {
+ /* Not done yet */
+ totalTrimmed += trimmed;
+ trimmed = 0;
+ }
+ } else {
+ rc = TXN_ABORT (txnid);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to abort transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ }
+ if (batch_count == 0){
+ /* This was not a retry. Fatal error, break out */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Changelog was not purged of rid (%d)\n",
+ cleaned_rid);
+ break;
+ }
+ }
+ }
+ slapi_ch_free_string(&starting_key);
+
+ slapi_log_error (SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Removed (%ld entries) that originated from rid (%d)\n",
+ totalTrimmed, cleaned_rid);
+}
+
/* Note that each file contains changes for a single replicated area.
trimming algorithm:
*/
#define CL5_TRIM_MAX_PER_TRANSACTION 10
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
+static void _cl5TrimFile (Object *obj, long *numToTrim)
{
DB_TXN *txnid;
RUV *ruv = NULL;
@@ -3611,7 +3961,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
entry.op = &op;
-
while ( !finished && !slapi_is_shutting_down() )
{
it = NULL;
@@ -3632,7 +3981,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
finished = _cl5GetFirstEntry (obj, &entry, &it, txnid);
- while ( !finished )
+ while ( !finished && !slapi_is_shutting_down())
{
/*
* This change can be trimmed if it exceeds purge
@@ -3646,11 +3995,12 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
continue;
}
csn_rid = csn_get_replicaid (op.csn);
+
if ( (*numToTrim > 0 || _cl5CanTrim (entry.time, numToTrim)) &&
ruv_covers_csn_strict (ruv, op.csn) )
{
rc = _cl5CurrentDeleteEntry (it);
- if ( rc == CL5_SUCCESS && cleaned_rid != csn_rid)
+ if ( rc == CL5_SUCCESS)
{
rc = _cl5UpdateRUV (obj, op.csn, PR_FALSE, PR_TRUE);
}
@@ -3664,7 +4014,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
/* The above two functions have logged the error */
abort = PR_TRUE;
}
-
}
else
{
@@ -3721,7 +4070,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
rc = TXN_ABORT (txnid);
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to abort transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -3732,7 +4081,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
if (rc != 0)
{
finished = 1;
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to commit transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -4756,9 +5105,9 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
goto done;
}
#endif
- /* back off */
+ /* back off */
interval = PR_MillisecondsToInterval(slapi_rand() % 100);
- DS_Sleep(interval);
+ DS_Sleep(interval);
}
#if USE_DB_TXN
/* begin transaction */
@@ -4804,19 +5153,19 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
}
cnt ++;
}
-
+
if (rc == 0) /* we successfully added entry */
{
#if USE_DB_TXN
rc = TXN_COMMIT (txnid, 0);
#endif
}
- else
+ else
{
- char s[CSN_STRSIZE];
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ char s[CSN_STRSIZE];
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5WriteOperationTxn: failed to write entry with csn (%s); "
- "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
+ "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
rc, db_strerror(rc));
#if USE_DB_TXN
rc = TXN_ABORT (txnid);
@@ -4837,7 +5186,7 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
/* update purge vector if we have not seen any changes from this replica before */
_cl5UpdateRUV (file_obj, op->csn, PR_TRUE, PR_TRUE);
- slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
"cl5WriteOperationTxn: successfully written entry with csn (%s)\n", csnStr);
rc = CL5_SUCCESS;
done:
@@ -4851,7 +5200,7 @@ done:
return rc;
}
-static int _cl5WriteOperation(const char *replName, const char *replGen,
+static int _cl5WriteOperation(const char *replName, const char *replGen,
const slapi_operation_parameters *op, PRBool local)
{
return _cl5WriteOperationTxn(replName, replGen, op, local, NULL);
@@ -4902,7 +5251,7 @@ static int _cl5GetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_
goto done;
}
- it = (CL5Iterator*)slapi_ch_malloc (sizeof (CL5Iterator));
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
it->cursor = cursor;
object_acquire (obj);
it->file = obj;
@@ -4977,7 +5326,7 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
slapi_ch_free (&(data.data));
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5GetNextEntry: failed to format entry: %d\n", rc);
}
@@ -5006,38 +5355,42 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
}
/* cursor operation failed */
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
- rc, db_strerror(rc));
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
- return CL5_DB_ERROR;
+ return rc;
}
static int _cl5CurrentDeleteEntry (void *iterator)
{
int rc;
CL5Iterator *it;
- CL5DBFile *file;
+ CL5DBFile *file;
- PR_ASSERT (iterator);
+ PR_ASSERT (iterator);
it = (CL5Iterator*)iterator;
rc = it->cursor->c_del (it->cursor, 0);
if (rc == 0) {
- /* decrement entry count */
- file = (CL5DBFile*)object_get_data (it->file);
- PR_AtomicDecrement (&file->entryCount);
- return CL5_SUCCESS;
- } else {
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5CurrentDeleteEntry failed, err=%d %s\n",
- rc, db_strerror(rc));
- /* We don't free(close) the cursor here, as the caller will free it by a call to cl5DestroyIterator */
- /* Freeing it here is a potential bug, as the cursor can't be referenced later once freed */
- return CL5_DB_ERROR;
- }
+ /* decrement entry count */
+ file = (CL5DBFile*)object_get_data (it->file);
+ PR_AtomicDecrement (&file->entryCount);
+ return CL5_SUCCESS;
+ } else {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5CurrentDeleteEntry failed, err=%d %s\n",
+ rc, db_strerror(rc));
+ /*
+ * We don't free(close) the cursor here, as the caller will free it by
+ * a call to cl5DestroyIterator. Freeing it here is a potential bug,
+ * as the cursor can't be referenced later once freed.
+ */
+ return rc;
+ }
}
static PRBool _cl5IsValidIterator (const CL5Iterator *iterator)
@@ -6309,7 +6662,7 @@ static int _cl5ExportFile (PRFileDesc *prFile, Object *obj)
slapi_write_buffer (prFile, "\n", strlen("\n"));
entry.op = &op;
- rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
+ rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
while (rc == CL5_SUCCESS)
{
rc = _cl5Operation2LDIF (&op, file->replGen, &buff, &len);
@@ -6730,16 +7083,16 @@ cl5CleanRUV(ReplicaId rid){
slapi_rwlock_unlock (s_cl5Desc.stLock);
}
-void trigger_cl_trimming(ReplicaId rid){
+void trigger_cl_purging(ReplicaId rid){
PRThread *trim_tid = NULL;
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_trimming: rid (%d)\n",(int)rid);
- trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_trimming_thread,
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_purging: rid (%d)\n",(int)rid);
+ trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_purging_thread,
(void *)&rid, PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD,
PR_UNJOINABLE_THREAD, DEFAULT_THREAD_STACKSIZE);
if (NULL == trim_tid){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to create trimming "
+ "trigger_cl_purging: failed to create trimming "
"thread; NSPR error - %d\n", PR_GetError ());
} else {
/* need a little time for the thread to get started */
@@ -6748,7 +7101,7 @@ void trigger_cl_trimming(ReplicaId rid){
}
void
-trigger_cl_trimming_thread(void *arg){
+trigger_cl_purging_thread(void *arg){
ReplicaId rid = *(ReplicaId *)arg;
/* make sure we have a change log, and we aren't closing it */
@@ -6757,7 +7110,7 @@ trigger_cl_trimming_thread(void *arg){
}
if (CL5_SUCCESS != _cl5AddThread()) {
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to increment thread count "
+ "trigger_cl_purging: failed to increment thread count "
"NSPR error - %d\n", PR_GetError ());
}
_cl5DoTrimming(rid);
diff --git a/ldap/servers/plugins/replication/cl5_api.h b/ldap/servers/plugins/replication/cl5_api.h
index eaf936f..0abd46d 100644
--- a/ldap/servers/plugins/replication/cl5_api.h
+++ b/ldap/servers/plugins/replication/cl5_api.h
@@ -146,6 +146,9 @@ enum
CL5_CSN_ERROR, /* CSN API failed */
CL5_RUV_ERROR, /* RUV API failed */
CL5_OBJSET_ERROR, /* namedobjset api failed */
+ CL5_DB_LOCK_ERROR, /* bdb returns error 12 when the db runs out of locks,
+ this var needs to be in slot 12 of the list.
+ Do not re-order enum above! */
CL5_PURGED_DATA, /* requested data has been purged */
CL5_MISSING_DATA, /* data should be in the changelog, but is missing */
CL5_UNKNOWN_ERROR, /* unclassified error */
@@ -493,6 +496,6 @@ int cl5WriteRUV();
int cl5DeleteRUV();
void cl5CleanRUV(ReplicaId rid);
void cl5NotifyCleanup(int rid);
-void trigger_cl_trimming(ReplicaId rid);
+void trigger_cl_purging(ReplicaId rid);
#endif
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index e025d4f..755097a 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -1399,6 +1399,11 @@ replica_execute_cleanruv_task (Object *r, ReplicaId rid, char *returntext /* not
*/
cl5CleanRUV(rid);
+ /*
+ * Now purge the changelog
+ */
+ trigger_cl_purging(rid);
+
if (rc != RUV_SUCCESS){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "cleanruv_task: task failed(%d)\n",rc);
return LDAP_OPERATIONS_ERROR;
@@ -1786,7 +1791,7 @@ replica_cleanallruv_thread(void *arg)
/* no agmts, just clean this replica */
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -1868,13 +1873,15 @@ replica_cleanallruv_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
- "retrying in %d seconds", interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
+ "retrying in %d seconds", interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -1885,10 +1892,9 @@ replica_cleanallruv_thread(void *arg)
done:
/*
- * If the replicas are cleaned, release the rid, and trim the changelog
+ * If the replicas are cleaned, release the rid
*/
if(!aborted){
- trigger_cl_trimming(data->rid);
delete_cleaned_rid_config(data);
/* make sure all the replicas have been "pre_cleaned" before finishing */
check_replicas_are_done_cleaning(data);
@@ -1898,7 +1904,7 @@ done:
/*
* Shutdown or abort
*/
- if(!is_task_aborted(data->rid)){
+ if(!is_task_aborted(data->rid) || slapi_is_shutting_down()){
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Server shutting down. Process will resume at server startup");
} else {
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Task aborted for rid(%d).",data->rid);
@@ -2101,7 +2107,7 @@ check_agmts_are_caught_up(cleanruv_data *data, char *maxcsn)
not_all_caughtup = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -2159,7 +2165,7 @@ check_agmts_are_alive(Replica *replica, ReplicaId rid, Slapi_Task *task)
not_all_alive = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (replica, agmt_obj);
@@ -2928,12 +2934,14 @@ replica_abort_task_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes. unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -2951,7 +2959,7 @@ done:
* Wait for this server to stop its cleanallruv task(which removes the rid from the cleaned list)
*/
cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID, "Waiting for CleanAllRUV task to abort...");
- while(is_cleaned_rid(data->rid)){
+ while(is_cleaned_rid(data->rid) && !slapi_is_shutting_down()){
DS_Sleep(PR_SecondsToInterval(1));
count++;
if(count == 60){ /* it should not take this long */
1
0
ldap/servers/plugins/replication/cl5_api.c | 447 ++++++++++++++--
ldap/servers/plugins/replication/cl5_api.h | 5
ldap/servers/plugins/replication/repl5_replica_config.c | 44 -
3 files changed, 430 insertions(+), 66 deletions(-)
New commits:
commit 264f67218aec5e11f68ad4e36e444730c8c3110c
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Jul 8 11:48:27 2015 -0400
Ticket 48208 - CleanAllRUV should completely purge changelog
Bug Description: After cleanAllRUV finishes, the changelog still
contains entries from the cleaned rid. Under certain
conditions this can allow the RUV to get polluted
again, and the ruv element will be missing the replica
url.
Fix Description: At the end of the cleaning task, fire of a thread to
to completely purge the changelog of all entries
containing the cleaned rid.
Also, improved the cleanAllRUV task when dealing
with a server shutdown - previously if the timing is
right the task can "delay/hang" the shutdown process.
https://fedorahosted.org/389/ticket/48208
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit ff1c34538b0600259dba4801da2b2f0993fa5404)
(cherry picked from commit 9e4cf12cfbfde0761325b75c3fd5a8b39223760a)
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 2d9a0bd..2cf5a3f 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -353,14 +353,17 @@ static void _cl5TrimCleanup ();
static int _cl5TrimMain (void *param);
static void _cl5DoTrimming (ReplicaId rid);
static void _cl5CompactDBs();
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid);
+static void _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid);
+static int _cl5PurgeGetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key);
+static int _cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key);
+static void _cl5TrimFile (Object *obj, long *numToTrim);
static PRBool _cl5CanTrim (time_t time, long *numToTrim);
static int _cl5ReadRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5WriteRUV (CL5DBFile *file, PRBool purge);
static int _cl5ConstructRUV (const char *replGen, Object *obj, PRBool purge);
static int _cl5UpdateRUV (Object *obj, CSN *csn, PRBool newReplica, PRBool purge);
static int _cl5GetRUV2Purge2 (Object *fileObj, RUV **ruv);
-void trigger_cl_trimming_thread(void *rid);
+void trigger_cl_purging_thread(void *rid);
/* bakup/recovery, import/export */
static int _cl5LDIF2Operation (char *ldifEntry, slapi_operation_parameters *op,
@@ -3504,9 +3507,17 @@ static void _cl5DoTrimming (ReplicaId rid)
trimmed more often than other. We might have to fix that by, for
example, randomizing starting point */
obj = objset_first_obj (s_cl5Desc.dbFiles);
- while (obj && _cl5CanTrim ((time_t)0, &numToTrim))
+ while (obj && (_cl5CanTrim ((time_t)0, &numToTrim) || rid))
{
- _cl5TrimFile (obj, &numToTrim, rid);
+ if (rid){
+ /*
+ * We are cleaning an invalid rid, and need to strip it
+ * from the changelog.
+ */
+ _cl5PurgeRID (obj, rid);
+ } else {
+ _cl5TrimFile (obj, &numToTrim);
+ }
obj = objset_next_obj (s_cl5Desc.dbFiles, obj);
}
@@ -3583,12 +3594,351 @@ bail:
return;
}
+/*
+ * If the rid is not set it is the very first iteration of the changelog.
+ * If the rid is set, we are doing another pass, and we have a key as our
+ * starting point.
+ */
+static int
+_cl5PurgeGetFirstEntry(Object *obj, CL5Entry *entry, void **iterator, DB_TXN *txnid, int rid, DBT *key)
+{
+ DBC *cursor = NULL;
+ DBT data = {0};
+ CL5Iterator *it;
+ CL5DBFile *file;
+ int rc;
+
+ file = (CL5DBFile*)object_get_data (obj);
+
+ /* create cursor */
+ rc = file->db->cursor(file->db, txnid, &cursor, 0);
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to create cursor; db error - %d %s\n", rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+ goto done;
+ }
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = cursor->c_get(cursor, key, &data, rid?DB_SET:DB_NEXT)) == 0)
+ {
+ /* skip service entries on the first pass (rid == 0)*/
+ if (!rid && cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry(data.data, data.size, entry);
+ slapi_ch_free(&(data.data));
+ if (rc != 0)
+ {
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to format entry: %d\n", rc);
+ goto done;
+ }
+
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
+ it->cursor = cursor;
+ object_acquire (obj);
+ it->file = obj;
+ *(CL5Iterator**)iterator = it;
+
+ return CL5_SUCCESS;
+ }
+
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file */
+ if (rc == DB_NOTFOUND)
+ {
+ rc = CL5_NOTFOUND;
+ goto done;
+ }
+
+ /* db error occured while iterating */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeGetFirstEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+ rc = CL5_DB_ERROR;
+
+done:
+ /*
+ * We didn't success in assigning this cursor to the iterator,
+ * so we need to free the cursor here.
+ */
+ if (cursor)
+ cursor->c_close(cursor);
+
+ return rc;
+}
+
+/*
+ * Get the next entry. If we get a lock error we will restart the process
+ * starting at the current key.
+ */
+static int
+_cl5PurgeGetNextEntry (CL5Entry *entry, void *iterator, DBT *key)
+{
+ CL5Iterator *it;
+ DBT data={0};
+ int rc;
+
+ it = (CL5Iterator*) iterator;
+
+ key->flags = DB_DBT_MALLOC;
+ data.flags = DB_DBT_MALLOC;
+ while ((rc = it->cursor->c_get(it->cursor, key, &data, DB_NEXT)) == 0)
+ {
+ if (cl5HelperEntry ((char*)key->data, NULL))
+ {
+ slapi_ch_free(&key->data);
+ slapi_ch_free(&(data.data));
+ continue;
+ }
+
+ /* format entry */
+ rc = cl5DBData2Entry (data.data, data.size, entry);
+ slapi_ch_free (&(data.data));
+ if (rc != 0)
+ {
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to format entry: %d\n",
+ rc);
+
+ }
+
+ return rc;
+ }
+ slapi_ch_free(&(data.data));
+
+ /* walked of the end of the file or entry is out of range */
+ if (rc == 0 || rc == DB_NOTFOUND){
+ slapi_ch_free(&key->data);
+ return CL5_NOTFOUND;
+ }
+ if (rc != CL5_DB_LOCK_ERROR){
+ /* Not a lock error, free the key */
+ slapi_ch_free(&key->data);
+ }
+
+ /* cursor operation failed */
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5PurgeGetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
+
+ return rc;
+}
+
+#define MAX_RETRIES 10
+/*
+ * _cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+ *
+ * Clean the entire changelog of updates from the "cleaned rid" via CLEANALLRUV
+ * Delete entries in batches so we don't consume too many db locks, and we don't
+ * lockup the changelog during the entire purging process using one transaction.
+ * We save the key from the last iteration so we don't have to start from the
+ * beginning for each new iteration.
+ */
+static void
+_cl5PurgeRID(Object *obj, ReplicaId cleaned_rid)
+{
+ slapi_operation_parameters op = {0};
+ ReplicaId csn_rid;
+ CL5Entry entry;
+ DB_TXN *txnid = NULL;
+ DBT key = {0};
+ void *iterator = NULL;
+ long totalTrimmed = 0;
+ long trimmed = 0;
+ char *starting_key = NULL;
+ int batch_count = 0;
+ int db_lock_retry_count = 0;
+ int first_pass = 1;
+ int finished = 0;
+ int rc = 0;
+
+ PR_ASSERT (obj);
+ entry.op = &op;
+
+ /*
+ * Keep processing the changelog until we are done, shutting down, or we
+ * maxed out on the db lock retries.
+ */
+ while (!finished && db_lock_retry_count < MAX_RETRIES && !slapi_is_shutting_down()){
+ trimmed = 0;
+
+ /*
+ * Sleep a bit to allow others to use the changelog - we can't hog the
+ * changelog for the entire purge.
+ */
+ DS_Sleep(PR_MillisecondsToInterval(100));
+
+ rc = TXN_BEGIN(s_cl5Desc.dbEnv, NULL, &txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to begin transaction; db error - %d %s. "
+ "Changelog was not purged of rid(%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ return;
+ }
+
+ /*
+ * Check every changelog entry for the cleaned rid
+ */
+ rc = _cl5PurgeGetFirstEntry(obj, &entry, &iterator, txnid, first_pass?0:cleaned_rid, &key);
+ first_pass = 0;
+ while (rc == CL5_SUCCESS && !slapi_is_shutting_down()) {
+ /*
+ * Store the new starting key - we need this starting key in case
+ * we run out of locks and have to start the transaction over.
+ */
+ slapi_ch_free_string(&starting_key);
+ starting_key = slapi_ch_strdup((char*)key.data);
+
+ if(trimmed == 10000 || (batch_count && trimmed == batch_count)){
+ /*
+ * Break out, and commit these deletes. Do not free the key,
+ * we need it for the next pass.
+ */
+ cl5_operation_parameters_done (&op);
+ db_lock_retry_count = 0; /* reset the retry count */
+ break;
+ }
+ if(op.csn){
+ csn_rid = csn_get_replicaid (op.csn);
+ if (csn_rid == cleaned_rid){
+ rc = _cl5CurrentDeleteEntry (iterator);
+ if (rc != CL5_SUCCESS){
+ /* log error */
+ cl5_operation_parameters_done (&op);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to
+ * the starting point
+ */
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks deleting entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ } else {
+ /* fatal error */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: fatal error (%d)\n", rc);
+ slapi_ch_free(&(key.data));
+ finished = 1;
+ break;
+ }
+ }
+ trimmed++;
+ }
+ }
+ slapi_ch_free(&(key.data));
+ cl5_operation_parameters_done (&op);
+
+ rc = _cl5PurgeGetNextEntry (&entry, iterator, &key);
+ if (rc == CL5_DB_LOCK_ERROR){
+ /*
+ * Ran out of locks, need to restart the transaction.
+ * Reduce the the batch count and reset the key to the starting
+ * point.
+ */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Ran out of db locks getting the next entry. "
+ "Reduce the batch value and restart.\n");
+ batch_count = trimmed - 10;
+ if (batch_count < 10){
+ batch_count = 10;
+ }
+ trimmed = 0;
+ cl5_operation_parameters_done (&op);
+ slapi_ch_free(&(key.data));
+ key.data = starting_key;
+ starting_key = NULL;
+ db_lock_retry_count++;
+ break;
+ }
+ }
+
+ if (rc == CL5_NOTFOUND){
+ /* Scanned the entire changelog, we're done */
+ finished = 1;
+ }
+
+ /* Destroy the iterator before we finish with the txn */
+ cl5DestroyIterator (iterator);
+
+ /*
+ * Commit or abort the txn
+ */
+ if (rc == CL5_SUCCESS || rc == CL5_NOTFOUND){
+ rc = TXN_COMMIT (txnid, 0);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to commit transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ break;
+ } else if (finished){
+ /* We're done */
+ totalTrimmed += trimmed;
+ break;
+ } else {
+ /* Not done yet */
+ totalTrimmed += trimmed;
+ trimmed = 0;
+ }
+ } else {
+ rc = TXN_ABORT (txnid);
+ if (rc != 0){
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: failed to abort transaction; db error - %d %s. "
+ "Changelog was not completely purged of rid (%d)\n",
+ rc, db_strerror(rc), cleaned_rid);
+ }
+ if (batch_count == 0){
+ /* This was not a retry. Fatal error, break out */
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Changelog was not purged of rid (%d)\n",
+ cleaned_rid);
+ break;
+ }
+ }
+ }
+ slapi_ch_free_string(&starting_key);
+
+ slapi_log_error (SLAPI_LOG_REPL, repl_plugin_name_cl,
+ "_cl5PurgeRID: Removed (%ld entries) that originated from rid (%d)\n",
+ totalTrimmed, cleaned_rid);
+}
+
/* Note that each file contains changes for a single replicated area.
trimming algorithm:
*/
#define CL5_TRIM_MAX_PER_TRANSACTION 10
-static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
+static void _cl5TrimFile (Object *obj, long *numToTrim)
{
DB_TXN *txnid;
RUV *ruv = NULL;
@@ -3611,7 +3961,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
entry.op = &op;
-
while ( !finished && !slapi_is_shutting_down() )
{
it = NULL;
@@ -3632,7 +3981,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
}
finished = _cl5GetFirstEntry (obj, &entry, &it, txnid);
- while ( !finished )
+ while ( !finished && !slapi_is_shutting_down())
{
/*
* This change can be trimmed if it exceeds purge
@@ -3646,11 +3995,12 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
continue;
}
csn_rid = csn_get_replicaid (op.csn);
+
if ( (*numToTrim > 0 || _cl5CanTrim (entry.time, numToTrim)) &&
ruv_covers_csn_strict (ruv, op.csn) )
{
rc = _cl5CurrentDeleteEntry (it);
- if ( rc == CL5_SUCCESS && cleaned_rid != csn_rid)
+ if ( rc == CL5_SUCCESS)
{
rc = _cl5UpdateRUV (obj, op.csn, PR_FALSE, PR_TRUE);
}
@@ -3664,7 +4014,6 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
/* The above two functions have logged the error */
abort = PR_TRUE;
}
-
}
else
{
@@ -3721,7 +4070,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
rc = TXN_ABORT (txnid);
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to abort transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -3732,7 +4081,7 @@ static void _cl5TrimFile (Object *obj, long *numToTrim, ReplicaId cleaned_rid)
if (rc != 0)
{
finished = 1;
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5TrimFile: failed to commit transaction; db error - %d %s\n",
rc, db_strerror(rc));
}
@@ -4756,9 +5105,9 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
goto done;
}
#endif
- /* back off */
+ /* back off */
interval = PR_MillisecondsToInterval(slapi_rand() % 100);
- DS_Sleep(interval);
+ DS_Sleep(interval);
}
#if USE_DB_TXN
/* begin transaction */
@@ -4804,19 +5153,19 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
}
cnt ++;
}
-
+
if (rc == 0) /* we successfully added entry */
{
#if USE_DB_TXN
rc = TXN_COMMIT (txnid, 0);
#endif
}
- else
+ else
{
- char s[CSN_STRSIZE];
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ char s[CSN_STRSIZE];
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5WriteOperationTxn: failed to write entry with csn (%s); "
- "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
+ "db error - %d %s\n", csn_as_string(op->csn,PR_FALSE,s),
rc, db_strerror(rc));
#if USE_DB_TXN
rc = TXN_ABORT (txnid);
@@ -4837,7 +5186,7 @@ static int _cl5WriteOperationTxn(const char *replName, const char *replGen,
/* update purge vector if we have not seen any changes from this replica before */
_cl5UpdateRUV (file_obj, op->csn, PR_TRUE, PR_TRUE);
- slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_PLUGIN, repl_plugin_name_cl,
"cl5WriteOperationTxn: successfully written entry with csn (%s)\n", csnStr);
rc = CL5_SUCCESS;
done:
@@ -4851,7 +5200,7 @@ done:
return rc;
}
-static int _cl5WriteOperation(const char *replName, const char *replGen,
+static int _cl5WriteOperation(const char *replName, const char *replGen,
const slapi_operation_parameters *op, PRBool local)
{
return _cl5WriteOperationTxn(replName, replGen, op, local, NULL);
@@ -4902,7 +5251,7 @@ static int _cl5GetFirstEntry (Object *obj, CL5Entry *entry, void **iterator, DB_
goto done;
}
- it = (CL5Iterator*)slapi_ch_malloc (sizeof (CL5Iterator));
+ it = (CL5Iterator*)slapi_ch_malloc(sizeof (CL5Iterator));
it->cursor = cursor;
object_acquire (obj);
it->file = obj;
@@ -4977,7 +5326,7 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
slapi_ch_free (&(data.data));
if (rc != 0)
{
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl,
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
"_cl5GetNextEntry: failed to format entry: %d\n", rc);
}
@@ -5006,38 +5355,42 @@ static int _cl5GetNextEntry (CL5Entry *entry, void *iterator)
}
/* cursor operation failed */
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
- rc, db_strerror(rc));
+ slapi_log_error(rc == CL5_DB_LOCK_ERROR?SLAPI_LOG_REPL:SLAPI_LOG_FATAL,
+ repl_plugin_name_cl,
+ "_cl5GetNextEntry: failed to get entry; db error - %d %s\n",
+ rc, db_strerror(rc));
- return CL5_DB_ERROR;
+ return rc;
}
static int _cl5CurrentDeleteEntry (void *iterator)
{
int rc;
CL5Iterator *it;
- CL5DBFile *file;
+ CL5DBFile *file;
- PR_ASSERT (iterator);
+ PR_ASSERT (iterator);
it = (CL5Iterator*)iterator;
rc = it->cursor->c_del (it->cursor, 0);
if (rc == 0) {
- /* decrement entry count */
- file = (CL5DBFile*)object_get_data (it->file);
- PR_AtomicDecrement (&file->entryCount);
- return CL5_SUCCESS;
- } else {
- slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "_cl5CurrentDeleteEntry failed, err=%d %s\n",
- rc, db_strerror(rc));
- /* We don't free(close) the cursor here, as the caller will free it by a call to cl5DestroyIterator */
- /* Freeing it here is a potential bug, as the cursor can't be referenced later once freed */
- return CL5_DB_ERROR;
- }
+ /* decrement entry count */
+ file = (CL5DBFile*)object_get_data (it->file);
+ PR_AtomicDecrement (&file->entryCount);
+ return CL5_SUCCESS;
+ } else {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
+ "_cl5CurrentDeleteEntry failed, err=%d %s\n",
+ rc, db_strerror(rc));
+ /*
+ * We don't free(close) the cursor here, as the caller will free it by
+ * a call to cl5DestroyIterator. Freeing it here is a potential bug,
+ * as the cursor can't be referenced later once freed.
+ */
+ return rc;
+ }
}
static PRBool _cl5IsValidIterator (const CL5Iterator *iterator)
@@ -6309,7 +6662,7 @@ static int _cl5ExportFile (PRFileDesc *prFile, Object *obj)
slapi_write_buffer (prFile, "\n", strlen("\n"));
entry.op = &op;
- rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
+ rc = _cl5GetFirstEntry (obj, &entry, &iterator, NULL);
while (rc == CL5_SUCCESS)
{
rc = _cl5Operation2LDIF (&op, file->replGen, &buff, &len);
@@ -6730,16 +7083,16 @@ cl5CleanRUV(ReplicaId rid){
slapi_rwlock_unlock (s_cl5Desc.stLock);
}
-void trigger_cl_trimming(ReplicaId rid){
+void trigger_cl_purging(ReplicaId rid){
PRThread *trim_tid = NULL;
- slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_trimming: rid (%d)\n",(int)rid);
- trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_trimming_thread,
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name_cl, "trigger_cl_purging: rid (%d)\n",(int)rid);
+ trim_tid = PR_CreateThread(PR_USER_THREAD, (VFP)(void*)trigger_cl_purging_thread,
(void *)&rid, PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD,
PR_UNJOINABLE_THREAD, DEFAULT_THREAD_STACKSIZE);
if (NULL == trim_tid){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to create trimming "
+ "trigger_cl_purging: failed to create trimming "
"thread; NSPR error - %d\n", PR_GetError ());
} else {
/* need a little time for the thread to get started */
@@ -6748,7 +7101,7 @@ void trigger_cl_trimming(ReplicaId rid){
}
void
-trigger_cl_trimming_thread(void *arg){
+trigger_cl_purging_thread(void *arg){
ReplicaId rid = *(ReplicaId *)arg;
/* make sure we have a change log, and we aren't closing it */
@@ -6757,7 +7110,7 @@ trigger_cl_trimming_thread(void *arg){
}
if (CL5_SUCCESS != _cl5AddThread()) {
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name_cl,
- "trigger_cl_trimming: failed to increment thread count "
+ "trigger_cl_purging: failed to increment thread count "
"NSPR error - %d\n", PR_GetError ());
}
_cl5DoTrimming(rid);
diff --git a/ldap/servers/plugins/replication/cl5_api.h b/ldap/servers/plugins/replication/cl5_api.h
index eaf936f..0abd46d 100644
--- a/ldap/servers/plugins/replication/cl5_api.h
+++ b/ldap/servers/plugins/replication/cl5_api.h
@@ -146,6 +146,9 @@ enum
CL5_CSN_ERROR, /* CSN API failed */
CL5_RUV_ERROR, /* RUV API failed */
CL5_OBJSET_ERROR, /* namedobjset api failed */
+ CL5_DB_LOCK_ERROR, /* bdb returns error 12 when the db runs out of locks,
+ this var needs to be in slot 12 of the list.
+ Do not re-order enum above! */
CL5_PURGED_DATA, /* requested data has been purged */
CL5_MISSING_DATA, /* data should be in the changelog, but is missing */
CL5_UNKNOWN_ERROR, /* unclassified error */
@@ -493,6 +496,6 @@ int cl5WriteRUV();
int cl5DeleteRUV();
void cl5CleanRUV(ReplicaId rid);
void cl5NotifyCleanup(int rid);
-void trigger_cl_trimming(ReplicaId rid);
+void trigger_cl_purging(ReplicaId rid);
#endif
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 767853e..8718f92 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -1468,6 +1468,11 @@ replica_execute_cleanruv_task (Object *r, ReplicaId rid, char *returntext /* not
*/
cl5CleanRUV(rid);
+ /*
+ * Now purge the changelog
+ */
+ trigger_cl_purging(rid);
+
if (rc != RUV_SUCCESS){
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "cleanruv_task: task failed(%d)\n",rc);
return LDAP_OPERATIONS_ERROR;
@@ -1866,7 +1871,7 @@ replica_cleanallruv_thread(void *arg)
/* no agmts, just clean this replica */
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -1948,13 +1953,15 @@ replica_cleanallruv_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
- "retrying in %d seconds", interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, CLEANALLRUV_ID, "Replicas have not been cleaned yet, "
+ "retrying in %d seconds", interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -1965,10 +1972,9 @@ replica_cleanallruv_thread(void *arg)
done:
/*
- * If the replicas are cleaned, release the rid, and trim the changelog
+ * If the replicas are cleaned, release the rid
*/
if(!aborted){
- trigger_cl_trimming(data->rid);
delete_cleaned_rid_config(data);
/* make sure all the replicas have been "pre_cleaned" before finishing */
check_replicas_are_done_cleaning(data);
@@ -1978,7 +1984,7 @@ done:
/*
* Shutdown or abort
*/
- if(!is_task_aborted(data->rid)){
+ if(!is_task_aborted(data->rid) || slapi_is_shutting_down()){
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Server shutting down. Process will resume at server startup");
} else {
cleanruv_log(data->task, data->rid, CLEANALLRUV_ID,"Task aborted for rid(%d).",data->rid);
@@ -2213,7 +2219,7 @@ check_agmts_are_caught_up(cleanruv_data *data, char *maxcsn)
not_all_caughtup = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (data->replica, agmt_obj);
@@ -2271,7 +2277,7 @@ check_agmts_are_alive(Replica *replica, ReplicaId rid, Slapi_Task *task)
not_all_alive = 0;
break;
}
- while (agmt_obj){
+ while (agmt_obj && !slapi_is_shutting_down()){
agmt = (Repl_Agmt*)object_get_data (agmt_obj);
if(!agmt_is_enabled(agmt) || get_agmt_agreement_type(agmt) == REPLICA_TYPE_WINDOWS){
agmt_obj = agmtlist_get_next_agreement_for_replica (replica, agmt_obj);
@@ -3045,12 +3051,14 @@ replica_abort_task_thread(void *arg)
break;
}
/*
- * need to sleep between passes
+ * Need to sleep between passes. unless we are shutting down
*/
- cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
- PR_Lock( notify_lock );
- PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
- PR_Unlock( notify_lock );
+ if (!slapi_is_shutting_down()){
+ cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID,"Retrying in %d seconds",interval);
+ PR_Lock( notify_lock );
+ PR_WaitCondVar( notify_cvar, PR_SecondsToInterval(interval) );
+ PR_Unlock( notify_lock );
+ }
if(interval < 14400){ /* 4 hour max */
interval = interval * 2;
@@ -3068,7 +3076,7 @@ done:
* Wait for this server to stop its cleanallruv task(which removes the rid from the cleaned list)
*/
cleanruv_log(data->task, data->rid, ABORT_CLEANALLRUV_ID, "Waiting for CleanAllRUV task to abort...");
- while(is_cleaned_rid(data->rid)){
+ while(is_cleaned_rid(data->rid) && !slapi_is_shutting_down()){
DS_Sleep(PR_SecondsToInterval(1));
count++;
if(count == 60){ /* it should not take this long */
1
0
ldap/servers/slapd/filter.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
New commits:
commit 21dda6195d750875491f11fde2d9d59c8eceb896
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Tue Oct 6 14:14:46 2015 -0700
Ticket #48016 - search, matching rules and filter error "unsupported type 0xA9"
Description: Since extensible filter (LDAP_FILTER_EXTENDED) was not
implemented in slapi_filter_to_string_internal, it issued a bogus
message "unsupported type 0xA9" which could be logged in the error
log and confuse the troubleshooting.
This patch adds the case LDAP_FILTER_EXTENDED to slapi_filter_to_
string{_internal}.
https://fedorahosted.org/389/ticket/48016
Reviewed by rmeggins(a)redhat.com (Thank you, Rich!!)
diff --git a/ldap/servers/slapd/filter.c b/ldap/servers/slapd/filter.c
index 7ec3fbf..d63cac8 100644
--- a/ldap/servers/slapd/filter.c
+++ b/ldap/servers/slapd/filter.c
@@ -1309,6 +1309,10 @@ slapi_filter_to_string_internal( const struct slapi_filter *f, char *buf, size_t
operator = "~=";
break;
+ case LDAP_FILTER_EXTENDED:
+ operator = ":=";
+ break;
+
default: break;
}
@@ -1415,6 +1419,18 @@ slapi_filter_to_string_internal( const struct slapi_filter *f, char *buf, size_t
}
break;
+ case LDAP_FILTER_EXTENDED:
+ size = strlen(f->f_mr_type) + f->f_mr_value.bv_len + strlen(operator) +
+ (f->f_mr_dnAttrs ? sizeof(":dn") - 1 : 0) +
+ (f->f_mr_oid ? strlen(f->f_mr_oid) + 1 /* : */ : 0) + 3;
+ if(size < *bufsize) {
+ sprintf(buf, "(%s%s%s%s%s%.*s)", f->f_mr_type, f->f_mr_dnAttrs ? ":dn" : "",
+ f->f_mr_oid ? ":" : "", f->f_mr_oid ? f->f_mr_oid : "",
+ operator, (int)f->f_mr_value.bv_len, f->f_mr_value.bv_val);
+ *bufsize -= size;
+ }
+ break;
+
default:
size = 25;
1
0
ldap/servers/plugins/replication/repl5_tot_protocol.c | 1 +
1 file changed, 1 insertion(+)
New commits:
commit 1e7e99d60227276dac6ca78ba519a4a237999b7a
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Mon Oct 5 13:46:47 2015 -0700
Ticket #48266 - (1.2.11 only) Fractional replication evaluates several times the same CSN
Description: Regression introdced by commit 1a58bf85389fc4373af2bf07e96eeb4618cee2b7.
The patch expected replica_object was set in prp_total, which was missing
in 1.2.11. This patch sets it to prp_total in Repl_5_Tot_Protocol_new.
Note: replica_object in prp_total is set in the newer version (1.3.1 and
newer) by Ticket 47620.
Tested on rhel-6 following the reproducer:
on ipa master:
ipa-server-install -p PW -a PW -r DOMAIN -n domainname --ip-address=IP -U
ipa-replica-prepare -p PW REPLICA_FQDN
scp /var/lib/ipa/replica-info-REPLICA_FQDN.gpg REPLICA:/var/lib/ipa
on ipa replica:
ipa-replica-install /var/lib/ipa/replica-info-REPLICA_FQDN.gpg -p PW -w PW --ip-address=IP
Without the patch, the DS on master crashed.
https://fedorahosted.org/389/ticket/48266
Reviewed by tbordaz(a)redhat.com (Thank you, Thierry!!)
diff --git a/ldap/servers/plugins/replication/repl5_tot_protocol.c b/ldap/servers/plugins/replication/repl5_tot_protocol.c
index 0143e19..1bc987c 100644
--- a/ldap/servers/plugins/replication/repl5_tot_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_tot_protocol.c
@@ -613,6 +613,7 @@ Repl_5_Tot_Protocol_new(Repl_Protocol *rp)
prp->repl50consumer = 0;
prp->repl71consumer = 0;
prp->repl90consumer = 0;
+ prp->replica_object = prot_get_replica_object(rp);
return prp;
loser:
repl5_tot_delete(&prp);
1
0
ldap/servers/plugins/replication/repl5.h | 1
ldap/servers/plugins/replication/repl5_agmt.c | 17 ++++++-
ldap/servers/plugins/replication/repl5_agmtlist.c | 34 ++++++++++++---
ldap/servers/plugins/replication/repl5_inc_protocol.c | 10 +++-
ldap/servers/plugins/replication/repl5_replica_config.c | 6 ++
ldap/servers/plugins/replication/repl5_tot_protocol.c | 12 +++--
ldap/servers/plugins/replication/repl_session_plugin.c | 22 +++++++--
ldap/servers/plugins/replication/windows_protocol_util.c | 12 +++++
8 files changed, 98 insertions(+), 16 deletions(-)
New commits:
commit f09eb8c0f8ee315b2a20d6460c975a546207411e
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Oct 2 11:38:01 2015 -0700
Ticket #48298 - ns-slapd crash during ipa-replica-manage del
Bug Description: The cause of the problem is rather not a race condition but
accessing an already freed agreement in a plug-in:
> The crashed thread is deleting an agreement object, which calls mep_pre_op.
> It eventually calls op_shared_search with the deleted agreement object with
> base scope and filter "(|(objectclass=*)(objectclass=ldapsubentry))"
> Since it is a DSE entry it goes to dse_search, in which it calls agmt_get_
> replarea and crashes in slapi_sdn_copy by NULL dereference in from SDN...
Fix Description: This patch adds the check to agmt_get_replarea, in which if
the agreement is not in the agreement list, it returnes NULL repl area. When
the NULL repl area is returned the callers back off with an error.
https://fedorahosted.org/389/ticket/48298
Reviewed by rmeggins(a)redhat.com (Thanks, Rich!)
(cherry picked from commit 3cbdfa613ed8668337213fe9c3c15cf54ce798aa)
diff --git a/ldap/servers/plugins/replication/repl5.h b/ldap/servers/plugins/replication/repl5.h
index 17282bb..df92ca0 100644
--- a/ldap/servers/plugins/replication/repl5.h
+++ b/ldap/servers/plugins/replication/repl5.h
@@ -390,6 +390,7 @@ void agmtlist_shutdown();
void agmtlist_notify_all(Slapi_PBlock *pb);
Object* agmtlist_get_first_agreement_for_replica (Replica *r);
Object* agmtlist_get_next_agreement_for_replica (Replica *r, Object *prev);
+int agmtlist_agmt_exists(const Repl_Agmt *ra);
/* In repl5_backoff.c */
typedef struct backoff_timer Backoff_Timer;
diff --git a/ldap/servers/plugins/replication/repl5_agmt.c b/ldap/servers/plugins/replication/repl5_agmt.c
index f84eacb..76d26a1 100644
--- a/ldap/servers/plugins/replication/repl5_agmt.c
+++ b/ldap/servers/plugins/replication/repl5_agmt.c
@@ -696,6 +696,12 @@ agmt_start(Repl_Agmt *ra)
* index.
*/
repl_sdn = agmt_get_replarea(ra);
+ if (!repl_sdn) {
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "agmt_start: failed to get repl area. Please check agreement.\n");
+ prot_free(&prot);
+ return -1;
+ }
pb = slapi_pblock_new();
attrs[0] = (char*)type_agmtMaxCSN;
@@ -770,7 +776,7 @@ agmt_start(Repl_Agmt *ra)
slapi_rdn_get_value_by_ref(slapi_rdn_get_rdn(ra->rdn)),
ra->hostname, ra->port);
if(strstr(maxcsns[i], buf) || strstr(maxcsns[i], unavail_buf)){
- /* Set the maxcsn */
+ /* Set the maxcsn */
slapi_ch_free_string(&ra->maxcsn);
ra->maxcsn = slapi_ch_strdup(maxcsns[i]);
ra->consumerRID = agmt_maxcsn_get_rid(maxcsns[i]);
@@ -976,8 +982,11 @@ agmt_get_bindmethod(const Repl_Agmt *ra)
Slapi_DN *
agmt_get_replarea(const Repl_Agmt *ra)
{
- Slapi_DN *return_value;
+ Slapi_DN *return_value = NULL;
PR_ASSERT(NULL != ra);
+ if (!agmtlist_agmt_exists(ra)) {
+ return return_value;
+ }
PR_Lock(ra->lock);
return_value = slapi_sdn_new();
slapi_sdn_copy(ra->replarea, return_value);
@@ -2690,6 +2699,9 @@ get_agmt_status(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
Object *repl_obj = NULL;
replarea_sdn = agmt_get_replarea(ra);
+ if (!replarea_sdn) {
+ goto bail;
+ }
repl_obj = replica_get_replica_from_dn(replarea_sdn);
slapi_sdn_free(&replarea_sdn);
if (repl_obj) {
@@ -2748,6 +2760,7 @@ get_agmt_status(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
slapi_entry_add_string(e, "nsds5replicaLastInitStatus", ra->last_init_status);
}
}
+bail:
return SLAPI_DSE_CALLBACK_OK;
}
diff --git a/ldap/servers/plugins/replication/repl5_agmtlist.c b/ldap/servers/plugins/replication/repl5_agmtlist.c
index 34650b4..f50862f 100644
--- a/ldap/servers/plugins/replication/repl5_agmtlist.c
+++ b/ldap/servers/plugins/replication/repl5_agmtlist.c
@@ -109,6 +109,24 @@ agmtlist_release_agmt(Repl_Agmt *ra)
}
}
+int
+agmtlist_agmt_exists(const Repl_Agmt *ra)
+{
+ Object *ro;
+ int exists = 0;
+
+ PR_ASSERT(NULL != agmt_set);
+ if (!ra) {
+ return exists;
+ }
+ ro = objset_find(agmt_set, agmt_ptr_cmp, (const void *)ra);
+ if (ro) {
+ exists = 1;
+ object_release(ro);
+ }
+ return exists;
+}
+
/*
* Note: when we add the new object, we have a reference to it. We hold
@@ -135,6 +153,9 @@ add_new_agreement(Slapi_Entry *e)
/* get the replica for this agreement */
replarea_sdn = agmt_get_replarea(ra);
+ if (!replarea_sdn) {
+ return 1;
+ }
repl_obj = replica_get_replica_from_dn(replarea_sdn);
slapi_sdn_free(&replarea_sdn);
if (repl_obj) {
@@ -841,13 +862,16 @@ Object* agmtlist_get_next_agreement_for_replica (Replica *r, Object *prev)
else
obj = objset_first_obj(agmt_set);
- while (obj)
- {
+ for ( ; obj; obj = objset_next_obj(agmt_set, obj)) {
agmt = (Repl_Agmt*)object_get_data (obj);
- PR_ASSERT (agmt);
+ if (!agmt) {
+ continue;
+ }
agmt_root = agmt_get_replarea(agmt);
- PR_ASSERT (agmt_root);
+ if (!agmt_root) {
+ continue;
+ }
if (slapi_sdn_compare (replica_root, agmt_root) == 0)
{
@@ -856,7 +880,7 @@ Object* agmtlist_get_next_agreement_for_replica (Replica *r, Object *prev)
}
slapi_sdn_free (&agmt_root);
- obj = objset_next_obj(agmt_set, obj);
+
}
return NULL;
diff --git a/ldap/servers/plugins/replication/repl5_inc_protocol.c b/ldap/servers/plugins/replication/repl5_inc_protocol.c
index 7680340..244bbb2 100644
--- a/ldap/servers/plugins/replication/repl5_inc_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_inc_protocol.c
@@ -1906,6 +1906,7 @@ send_updates(Private_Repl_Protocol *prp, RUV *remote_update_vector, PRUint32 *nu
{
Replica *replica;
ReplicaId rid = -1; /* Used to create the replica keep alive subentry */
+ Slapi_DN *replarea_sdn = NULL;
replica = (Replica*) object_get_data(prp->replica_object);
if (replica)
{
@@ -1914,7 +1915,14 @@ send_updates(Private_Repl_Protocol *prp, RUV *remote_update_vector, PRUint32 *nu
slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
"%s: skipped updates was definitely too high (%d) update the subentry now\n",
agmt_get_long_name(prp->agmt), skipped_updates);
- replica_subentry_update(agmt_get_replarea(prp->agmt), rid);
+ replarea_sdn = agmt_get_replarea(prp->agmt);
+ if (!replarea_sdn) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
+ "send_updates: Unknown replication area due to agreement not found.");
+ return_value = UPDATE_FATAL_ERROR;
+ } else {
+ replica_subentry_update(replarea_sdn, rid);
+ }
}
/* Terminate the results reading thread */
if (!prp->repl50consumer)
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 8d3c481..e85ae3e 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -2368,13 +2368,17 @@ replica_send_cleanruv_task(Repl_Agmt *agmt, cleanruv_data *clean_data)
conn_delete_internal_ext(conn);
return;
}
- val.bv_len = PR_snprintf(data, sizeof(data), "CLEANRUV%d", clean_data->rid);
sdn = agmt_get_replarea(agmt);
+ if (!sdn) {
+ conn_delete_internal_ext(conn);
+ return;
+ }
mod.mod_op = LDAP_MOD_ADD|LDAP_MOD_BVALUES;
mod.mod_type = "nsds5task";
mod.mod_bvalues = vals;
vals [0] = &val;
vals [1] = NULL;
+ val.bv_len = PR_snprintf(data, sizeof(data), "CLEANRUV%d", clean_data->rid);
val.bv_val = data;
mods[0] = &mod;
mods[1] = NULL;
diff --git a/ldap/servers/plugins/replication/repl5_tot_protocol.c b/ldap/servers/plugins/replication/repl5_tot_protocol.c
index 9059efe..d0c4402 100644
--- a/ldap/servers/plugins/replication/repl5_tot_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_tot_protocol.c
@@ -332,6 +332,13 @@ repl5_tot_run(Private_Repl_Protocol *prp)
goto done;
}
+ area_sdn = agmt_get_replarea(prp->agmt);
+ if (!area_sdn) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Warning: unable to "
+ "get repl area. Please check agreement.\n");
+ goto done;
+ }
+
conn_set_timeout(prp->conn, agmt_get_timeout(prp->agmt));
/* acquire remote replica */
@@ -405,11 +412,10 @@ retry:
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Beginning total update of replica "
"\"%s\".\n", agmt_get_long_name(prp->agmt));
- pb = slapi_pblock_new ();
+ /* RMREPL - need to send schema here */
- /* RMREPL - need to send schema here */
+ pb = slapi_pblock_new ();
- area_sdn = agmt_get_replarea(prp->agmt);
/* we need to provide managedsait control so that referral entries can
be replicated */
ctrls = (LDAPControl **)slapi_ch_calloc (3, sizeof (LDAPControl *));
diff --git a/ldap/servers/plugins/replication/repl_session_plugin.c b/ldap/servers/plugins/replication/repl_session_plugin.c
index 1c04089..2fa993d 100644
--- a/ldap/servers/plugins/replication/repl_session_plugin.c
+++ b/ldap/servers/plugins/replication/repl_session_plugin.c
@@ -48,6 +48,10 @@ repl_session_plugin_call_agmt_init_cb(Repl_Agmt *ra)
}
if (initfunc) {
replarea = agmt_get_replarea(ra);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_agmt_init_cb -- Aborted -- No replication area\n");
+ return;
+ }
cookie = (*initfunc)(replarea);
slapi_sdn_free(&replarea);
}
@@ -73,8 +77,11 @@ repl_session_plugin_call_pre_acquire_cb(const Repl_Agmt *ra, int is_total,
if (thefunc) {
replarea = agmt_get_replarea(ra);
- rc = (*thefunc)(agmt_get_priv(ra), replarea, is_total,
- data_guid, data);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_pre_acquire_cb -- Aborted -- No replication area\n");
+ return 1;
+ }
+ rc = (*thefunc)(agmt_get_priv(ra), replarea, is_total, data_guid, data);
slapi_sdn_free(&replarea);
}
@@ -95,8 +102,11 @@ repl_session_plugin_call_post_acquire_cb(const Repl_Agmt *ra, int is_total,
if (thefunc) {
replarea = agmt_get_replarea(ra);
- rc = (*thefunc)(agmt_get_priv(ra), replarea,
- is_total, data_guid, data);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_post_acquire_cb -- Aborted -- No replication area\n");
+ return 1;
+ }
+ rc = (*thefunc)(agmt_get_priv(ra), replarea, is_total, data_guid, data);
slapi_sdn_free(&replarea);
}
@@ -151,6 +161,10 @@ repl_session_plugin_call_destroy_agmt_cb(const Repl_Agmt *ra)
if (thefunc) {
replarea = agmt_get_replarea(ra);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_destroy_agmt_cb -- Aborted -- No replication area\n");
+ return;
+ }
(*thefunc)(agmt_get_priv(ra), replarea);
slapi_sdn_free(&replarea);
}
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 5c12af7..084b520 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -5319,6 +5319,13 @@ windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,
* in the groups caused by moving member entries.
* We need to update the local groups manually... */
local_subtree = agmt_get_replarea(prp->agmt);
+ if (!local_subtree) {
+ slapi_log_error(SLAPI_LOG_FATAL, windows_repl_plugin_name,
+ "failed to get local subtree from agreement\n");
+ local_entry = orig_local_entry;
+ orig_local_entry = NULL;
+ goto bail;
+ }
local_subtree_sdn = local_subtree;
orig_local_sdn = slapi_entry_get_sdn_const(orig_local_entry);
escaped_filter_val = slapi_escape_filter_value((char *)slapi_sdn_get_ndn(orig_local_sdn),
@@ -5651,6 +5658,11 @@ windows_search_local_entry_by_uniqueid(Private_Repl_Protocol *prp,
*ret_entry = NULL;
if (is_global) { /* Search from the suffix (rename case) */
local_subtree = agmt_get_replarea(prp->agmt);
+ if (!local_subtree) {
+ slapi_log_error(SLAPI_LOG_FATAL, windows_repl_plugin_name,
+ "failed to get local subtree from agreement\n");
+ return LDAP_PARAM_ERROR;
+ }
local_subtree_sdn = local_subtree;
} else {
local_subtree_sdn = windows_private_get_directory_treetop(prp->agmt);
1
0
ldap/servers/plugins/replication/repl5.h | 1
ldap/servers/plugins/replication/repl5_agmt.c | 17 ++++++-
ldap/servers/plugins/replication/repl5_agmtlist.c | 34 ++++++++++++---
ldap/servers/plugins/replication/repl5_inc_protocol.c | 10 +++-
ldap/servers/plugins/replication/repl5_replica_config.c | 6 ++
ldap/servers/plugins/replication/repl5_tot_protocol.c | 12 +++--
ldap/servers/plugins/replication/repl_session_plugin.c | 22 +++++++--
ldap/servers/plugins/replication/windows_protocol_util.c | 12 +++++
8 files changed, 98 insertions(+), 16 deletions(-)
New commits:
commit 3cbdfa613ed8668337213fe9c3c15cf54ce798aa
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Oct 2 11:38:01 2015 -0700
Ticket #48298 - ns-slapd crash during ipa-replica-manage del
Bug Description: The cause of the problem is rather not a race condition but
accessing an already freed agreement in a plug-in:
> The crashed thread is deleting an agreement object, which calls mep_pre_op.
> It eventually calls op_shared_search with the deleted agreement object with
> base scope and filter "(|(objectclass=*)(objectclass=ldapsubentry))"
> Since it is a DSE entry it goes to dse_search, in which it calls agmt_get_
> replarea and crashes in slapi_sdn_copy by NULL dereference in from SDN...
Fix Description: This patch adds the check to agmt_get_replarea, in which if
the agreement is not in the agreement list, it returnes NULL repl area. When
the NULL repl area is returned the callers back off with an error.
https://fedorahosted.org/389/ticket/48298
Reviewed by rmeggins(a)redhat.com (Thanks, Rich!)
diff --git a/ldap/servers/plugins/replication/repl5.h b/ldap/servers/plugins/replication/repl5.h
index 17282bb..df92ca0 100644
--- a/ldap/servers/plugins/replication/repl5.h
+++ b/ldap/servers/plugins/replication/repl5.h
@@ -390,6 +390,7 @@ void agmtlist_shutdown();
void agmtlist_notify_all(Slapi_PBlock *pb);
Object* agmtlist_get_first_agreement_for_replica (Replica *r);
Object* agmtlist_get_next_agreement_for_replica (Replica *r, Object *prev);
+int agmtlist_agmt_exists(const Repl_Agmt *ra);
/* In repl5_backoff.c */
typedef struct backoff_timer Backoff_Timer;
diff --git a/ldap/servers/plugins/replication/repl5_agmt.c b/ldap/servers/plugins/replication/repl5_agmt.c
index f84eacb..76d26a1 100644
--- a/ldap/servers/plugins/replication/repl5_agmt.c
+++ b/ldap/servers/plugins/replication/repl5_agmt.c
@@ -696,6 +696,12 @@ agmt_start(Repl_Agmt *ra)
* index.
*/
repl_sdn = agmt_get_replarea(ra);
+ if (!repl_sdn) {
+ slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
+ "agmt_start: failed to get repl area. Please check agreement.\n");
+ prot_free(&prot);
+ return -1;
+ }
pb = slapi_pblock_new();
attrs[0] = (char*)type_agmtMaxCSN;
@@ -770,7 +776,7 @@ agmt_start(Repl_Agmt *ra)
slapi_rdn_get_value_by_ref(slapi_rdn_get_rdn(ra->rdn)),
ra->hostname, ra->port);
if(strstr(maxcsns[i], buf) || strstr(maxcsns[i], unavail_buf)){
- /* Set the maxcsn */
+ /* Set the maxcsn */
slapi_ch_free_string(&ra->maxcsn);
ra->maxcsn = slapi_ch_strdup(maxcsns[i]);
ra->consumerRID = agmt_maxcsn_get_rid(maxcsns[i]);
@@ -976,8 +982,11 @@ agmt_get_bindmethod(const Repl_Agmt *ra)
Slapi_DN *
agmt_get_replarea(const Repl_Agmt *ra)
{
- Slapi_DN *return_value;
+ Slapi_DN *return_value = NULL;
PR_ASSERT(NULL != ra);
+ if (!agmtlist_agmt_exists(ra)) {
+ return return_value;
+ }
PR_Lock(ra->lock);
return_value = slapi_sdn_new();
slapi_sdn_copy(ra->replarea, return_value);
@@ -2690,6 +2699,9 @@ get_agmt_status(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
Object *repl_obj = NULL;
replarea_sdn = agmt_get_replarea(ra);
+ if (!replarea_sdn) {
+ goto bail;
+ }
repl_obj = replica_get_replica_from_dn(replarea_sdn);
slapi_sdn_free(&replarea_sdn);
if (repl_obj) {
@@ -2748,6 +2760,7 @@ get_agmt_status(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
slapi_entry_add_string(e, "nsds5replicaLastInitStatus", ra->last_init_status);
}
}
+bail:
return SLAPI_DSE_CALLBACK_OK;
}
diff --git a/ldap/servers/plugins/replication/repl5_agmtlist.c b/ldap/servers/plugins/replication/repl5_agmtlist.c
index 34650b4..f50862f 100644
--- a/ldap/servers/plugins/replication/repl5_agmtlist.c
+++ b/ldap/servers/plugins/replication/repl5_agmtlist.c
@@ -109,6 +109,24 @@ agmtlist_release_agmt(Repl_Agmt *ra)
}
}
+int
+agmtlist_agmt_exists(const Repl_Agmt *ra)
+{
+ Object *ro;
+ int exists = 0;
+
+ PR_ASSERT(NULL != agmt_set);
+ if (!ra) {
+ return exists;
+ }
+ ro = objset_find(agmt_set, agmt_ptr_cmp, (const void *)ra);
+ if (ro) {
+ exists = 1;
+ object_release(ro);
+ }
+ return exists;
+}
+
/*
* Note: when we add the new object, we have a reference to it. We hold
@@ -135,6 +153,9 @@ add_new_agreement(Slapi_Entry *e)
/* get the replica for this agreement */
replarea_sdn = agmt_get_replarea(ra);
+ if (!replarea_sdn) {
+ return 1;
+ }
repl_obj = replica_get_replica_from_dn(replarea_sdn);
slapi_sdn_free(&replarea_sdn);
if (repl_obj) {
@@ -841,13 +862,16 @@ Object* agmtlist_get_next_agreement_for_replica (Replica *r, Object *prev)
else
obj = objset_first_obj(agmt_set);
- while (obj)
- {
+ for ( ; obj; obj = objset_next_obj(agmt_set, obj)) {
agmt = (Repl_Agmt*)object_get_data (obj);
- PR_ASSERT (agmt);
+ if (!agmt) {
+ continue;
+ }
agmt_root = agmt_get_replarea(agmt);
- PR_ASSERT (agmt_root);
+ if (!agmt_root) {
+ continue;
+ }
if (slapi_sdn_compare (replica_root, agmt_root) == 0)
{
@@ -856,7 +880,7 @@ Object* agmtlist_get_next_agreement_for_replica (Replica *r, Object *prev)
}
slapi_sdn_free (&agmt_root);
- obj = objset_next_obj(agmt_set, obj);
+
}
return NULL;
diff --git a/ldap/servers/plugins/replication/repl5_inc_protocol.c b/ldap/servers/plugins/replication/repl5_inc_protocol.c
index 7680340..244bbb2 100644
--- a/ldap/servers/plugins/replication/repl5_inc_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_inc_protocol.c
@@ -1906,6 +1906,7 @@ send_updates(Private_Repl_Protocol *prp, RUV *remote_update_vector, PRUint32 *nu
{
Replica *replica;
ReplicaId rid = -1; /* Used to create the replica keep alive subentry */
+ Slapi_DN *replarea_sdn = NULL;
replica = (Replica*) object_get_data(prp->replica_object);
if (replica)
{
@@ -1914,7 +1915,14 @@ send_updates(Private_Repl_Protocol *prp, RUV *remote_update_vector, PRUint32 *nu
slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name,
"%s: skipped updates was definitely too high (%d) update the subentry now\n",
agmt_get_long_name(prp->agmt), skipped_updates);
- replica_subentry_update(agmt_get_replarea(prp->agmt), rid);
+ replarea_sdn = agmt_get_replarea(prp->agmt);
+ if (!replarea_sdn) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
+ "send_updates: Unknown replication area due to agreement not found.");
+ return_value = UPDATE_FATAL_ERROR;
+ } else {
+ replica_subentry_update(replarea_sdn, rid);
+ }
}
/* Terminate the results reading thread */
if (!prp->repl50consumer)
diff --git a/ldap/servers/plugins/replication/repl5_replica_config.c b/ldap/servers/plugins/replication/repl5_replica_config.c
index 8d3c481..e85ae3e 100644
--- a/ldap/servers/plugins/replication/repl5_replica_config.c
+++ b/ldap/servers/plugins/replication/repl5_replica_config.c
@@ -2368,13 +2368,17 @@ replica_send_cleanruv_task(Repl_Agmt *agmt, cleanruv_data *clean_data)
conn_delete_internal_ext(conn);
return;
}
- val.bv_len = PR_snprintf(data, sizeof(data), "CLEANRUV%d", clean_data->rid);
sdn = agmt_get_replarea(agmt);
+ if (!sdn) {
+ conn_delete_internal_ext(conn);
+ return;
+ }
mod.mod_op = LDAP_MOD_ADD|LDAP_MOD_BVALUES;
mod.mod_type = "nsds5task";
mod.mod_bvalues = vals;
vals [0] = &val;
vals [1] = NULL;
+ val.bv_len = PR_snprintf(data, sizeof(data), "CLEANRUV%d", clean_data->rid);
val.bv_val = data;
mods[0] = &mod;
mods[1] = NULL;
diff --git a/ldap/servers/plugins/replication/repl5_tot_protocol.c b/ldap/servers/plugins/replication/repl5_tot_protocol.c
index 9059efe..d0c4402 100644
--- a/ldap/servers/plugins/replication/repl5_tot_protocol.c
+++ b/ldap/servers/plugins/replication/repl5_tot_protocol.c
@@ -332,6 +332,13 @@ repl5_tot_run(Private_Repl_Protocol *prp)
goto done;
}
+ area_sdn = agmt_get_replarea(prp->agmt);
+ if (!area_sdn) {
+ slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Warning: unable to "
+ "get repl area. Please check agreement.\n");
+ goto done;
+ }
+
conn_set_timeout(prp->conn, agmt_get_timeout(prp->agmt));
/* acquire remote replica */
@@ -405,11 +412,10 @@ retry:
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Beginning total update of replica "
"\"%s\".\n", agmt_get_long_name(prp->agmt));
- pb = slapi_pblock_new ();
+ /* RMREPL - need to send schema here */
- /* RMREPL - need to send schema here */
+ pb = slapi_pblock_new ();
- area_sdn = agmt_get_replarea(prp->agmt);
/* we need to provide managedsait control so that referral entries can
be replicated */
ctrls = (LDAPControl **)slapi_ch_calloc (3, sizeof (LDAPControl *));
diff --git a/ldap/servers/plugins/replication/repl_session_plugin.c b/ldap/servers/plugins/replication/repl_session_plugin.c
index 1c04089..2fa993d 100644
--- a/ldap/servers/plugins/replication/repl_session_plugin.c
+++ b/ldap/servers/plugins/replication/repl_session_plugin.c
@@ -48,6 +48,10 @@ repl_session_plugin_call_agmt_init_cb(Repl_Agmt *ra)
}
if (initfunc) {
replarea = agmt_get_replarea(ra);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_agmt_init_cb -- Aborted -- No replication area\n");
+ return;
+ }
cookie = (*initfunc)(replarea);
slapi_sdn_free(&replarea);
}
@@ -73,8 +77,11 @@ repl_session_plugin_call_pre_acquire_cb(const Repl_Agmt *ra, int is_total,
if (thefunc) {
replarea = agmt_get_replarea(ra);
- rc = (*thefunc)(agmt_get_priv(ra), replarea, is_total,
- data_guid, data);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_pre_acquire_cb -- Aborted -- No replication area\n");
+ return 1;
+ }
+ rc = (*thefunc)(agmt_get_priv(ra), replarea, is_total, data_guid, data);
slapi_sdn_free(&replarea);
}
@@ -95,8 +102,11 @@ repl_session_plugin_call_post_acquire_cb(const Repl_Agmt *ra, int is_total,
if (thefunc) {
replarea = agmt_get_replarea(ra);
- rc = (*thefunc)(agmt_get_priv(ra), replarea,
- is_total, data_guid, data);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_post_acquire_cb -- Aborted -- No replication area\n");
+ return 1;
+ }
+ rc = (*thefunc)(agmt_get_priv(ra), replarea, is_total, data_guid, data);
slapi_sdn_free(&replarea);
}
@@ -151,6 +161,10 @@ repl_session_plugin_call_destroy_agmt_cb(const Repl_Agmt *ra)
if (thefunc) {
replarea = agmt_get_replarea(ra);
+ if (!replarea) {
+ LDAPDebug0Args(LDAP_DEBUG_ANY, "repl_session_plugin_call_destroy_agmt_cb -- Aborted -- No replication area\n");
+ return;
+ }
(*thefunc)(agmt_get_priv(ra), replarea);
slapi_sdn_free(&replarea);
}
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c b/ldap/servers/plugins/replication/windows_protocol_util.c
index 5c12af7..084b520 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -5319,6 +5319,13 @@ windows_update_local_entry(Private_Repl_Protocol *prp,Slapi_Entry *remote_entry,
* in the groups caused by moving member entries.
* We need to update the local groups manually... */
local_subtree = agmt_get_replarea(prp->agmt);
+ if (!local_subtree) {
+ slapi_log_error(SLAPI_LOG_FATAL, windows_repl_plugin_name,
+ "failed to get local subtree from agreement\n");
+ local_entry = orig_local_entry;
+ orig_local_entry = NULL;
+ goto bail;
+ }
local_subtree_sdn = local_subtree;
orig_local_sdn = slapi_entry_get_sdn_const(orig_local_entry);
escaped_filter_val = slapi_escape_filter_value((char *)slapi_sdn_get_ndn(orig_local_sdn),
@@ -5651,6 +5658,11 @@ windows_search_local_entry_by_uniqueid(Private_Repl_Protocol *prp,
*ret_entry = NULL;
if (is_global) { /* Search from the suffix (rename case) */
local_subtree = agmt_get_replarea(prp->agmt);
+ if (!local_subtree) {
+ slapi_log_error(SLAPI_LOG_FATAL, windows_repl_plugin_name,
+ "failed to get local subtree from agreement\n");
+ return LDAP_PARAM_ERROR;
+ }
local_subtree_sdn = local_subtree;
} else {
local_subtree_sdn = windows_private_get_directory_treetop(prp->agmt);
1
0
ldap/servers/slapd/pagedresults.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit fb94767d78e15617101ff8299c724194f0c858ea
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 1 15:11:24 2015 -0700
Ticket #48192 - Individual abandoned simple paged results request has no chance to be cleaned up
Description: If CONN_FLAG_PAGEDRESULTS_ABANDONED is set to pr_flags,
the search results in the pagedresults handle is supposed to have been
cleaned up. But when there is a contention, there is a case that it
is reset with the already released search results. This patch adds an
additional check for abandoned flag in pagedresults_set_search_result.
If the pagedresults handle shows it is abandoned, the search results
is not set to the handle unless it is for cleaning up with NULL.
https://fedorahosted.org/389/ticket/48192
Reviewed by rmeggins(a)redhat.com (Thanks, Rich!!)
(cherry picked from commit 6e453918e82af6c597390aebf92a8eb3283c3591)
(cherry picked from commit 96b9b6794e0a6bfa0d74c84f6c80131c4f820fa7)
(cherry picked from commit 4a4a7ed06d3271f7337e5fac5f85498dfe79b0db)
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index 9e183ec..434e48d 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -350,7 +350,7 @@ pagedresults_free_one_msgid_nolock( Connection *conn, ber_int_t msgid )
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++) {
if (conn->c_pagedresults.prl_list[i].pr_msgid == msgid) {
PagedResults *prp = conn->c_pagedresults.prl_list + i;
- if (prp && prp->pr_current_be &&
+ if (prp->pr_current_be &&
prp->pr_current_be->be_search_results_release &&
prp->pr_search_result_set) {
prp->pr_current_be->be_search_results_release(&(prp->pr_search_result_set));
@@ -442,7 +442,11 @@ pagedresults_set_search_result(Connection *conn, Operation *op, void *sr,
if (conn && (index > -1)) {
if (!locked) PR_Lock(conn->c_mutex);
if (index < conn->c_pagedresults.prl_maxlen) {
- conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ PagedResults *prp = conn->c_pagedresults.prl_list + index;
+ if (!(prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) || !sr) {
+ /* If abandoned, don't set the search result unless it is NULL */
+ prp->pr_search_result_set = sr;
+ }
rc = 0;
}
if (!locked) PR_Unlock(conn->c_mutex);
1
0
ldap/servers/slapd/pagedresults.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 4a4a7ed06d3271f7337e5fac5f85498dfe79b0db
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 1 15:11:24 2015 -0700
Ticket #48192 - Individual abandoned simple paged results request has no chance to be cleaned up
Description: If CONN_FLAG_PAGEDRESULTS_ABANDONED is set to pr_flags,
the search results in the pagedresults handle is supposed to have been
cleaned up. But when there is a contention, there is a case that it
is reset with the already released search results. This patch adds an
additional check for abandoned flag in pagedresults_set_search_result.
If the pagedresults handle shows it is abandoned, the search results
is not set to the handle unless it is for cleaning up with NULL.
https://fedorahosted.org/389/ticket/48192
Reviewed by rmeggins(a)redhat.com (Thanks, Rich!!)
(cherry picked from commit 6e453918e82af6c597390aebf92a8eb3283c3591)
(cherry picked from commit 96b9b6794e0a6bfa0d74c84f6c80131c4f820fa7)
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index 9e183ec..434e48d 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -350,7 +350,7 @@ pagedresults_free_one_msgid_nolock( Connection *conn, ber_int_t msgid )
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++) {
if (conn->c_pagedresults.prl_list[i].pr_msgid == msgid) {
PagedResults *prp = conn->c_pagedresults.prl_list + i;
- if (prp && prp->pr_current_be &&
+ if (prp->pr_current_be &&
prp->pr_current_be->be_search_results_release &&
prp->pr_search_result_set) {
prp->pr_current_be->be_search_results_release(&(prp->pr_search_result_set));
@@ -442,7 +442,11 @@ pagedresults_set_search_result(Connection *conn, Operation *op, void *sr,
if (conn && (index > -1)) {
if (!locked) PR_Lock(conn->c_mutex);
if (index < conn->c_pagedresults.prl_maxlen) {
- conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ PagedResults *prp = conn->c_pagedresults.prl_list + index;
+ if (!(prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) || !sr) {
+ /* If abandoned, don't set the search result unless it is NULL */
+ prp->pr_search_result_set = sr;
+ }
rc = 0;
}
if (!locked) PR_Unlock(conn->c_mutex);
1
0
ldap/servers/slapd/pagedresults.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 96b9b6794e0a6bfa0d74c84f6c80131c4f820fa7
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 1 15:11:24 2015 -0700
Ticket #48192 - Individual abandoned simple paged results request has no chance to be cleaned up
Description: If CONN_FLAG_PAGEDRESULTS_ABANDONED is set to pr_flags,
the search results in the pagedresults handle is supposed to have been
cleaned up. But when there is a contention, there is a case that it
is reset with the already released search results. This patch adds an
additional check for abandoned flag in pagedresults_set_search_result.
If the pagedresults handle shows it is abandoned, the search results
is not set to the handle unless it is for cleaning up with NULL.
https://fedorahosted.org/389/ticket/48192
Reviewed by rmeggins(a)redhat.com (Thanks, Rich!!)
(cherry picked from commit 6e453918e82af6c597390aebf92a8eb3283c3591)
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index 6dd6432..87447c4 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -337,7 +337,7 @@ pagedresults_free_one_msgid_nolock( Connection *conn, ber_int_t msgid )
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++) {
if (conn->c_pagedresults.prl_list[i].pr_msgid == msgid) {
PagedResults *prp = conn->c_pagedresults.prl_list + i;
- if (prp && prp->pr_current_be &&
+ if (prp->pr_current_be &&
prp->pr_current_be->be_search_results_release &&
prp->pr_search_result_set) {
prp->pr_current_be->be_search_results_release(&(prp->pr_search_result_set));
@@ -429,7 +429,11 @@ pagedresults_set_search_result(Connection *conn, Operation *op, void *sr,
if (conn && (index > -1)) {
if (!locked) PR_Lock(conn->c_mutex);
if (index < conn->c_pagedresults.prl_maxlen) {
- conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ PagedResults *prp = conn->c_pagedresults.prl_list + index;
+ if (!(prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) || !sr) {
+ /* If abandoned, don't set the search result unless it is NULL */
+ prp->pr_search_result_set = sr;
+ }
rc = 0;
}
if (!locked) PR_Unlock(conn->c_mutex);
1
0
ldap/servers/slapd/pagedresults.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 6e453918e82af6c597390aebf92a8eb3283c3591
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Thu Oct 1 15:11:24 2015 -0700
Ticket #48192 - Individual abandoned simple paged results request has no chance to be cleaned up
Description: If CONN_FLAG_PAGEDRESULTS_ABANDONED is set to pr_flags,
the search results in the pagedresults handle is supposed to have been
cleaned up. But when there is a contention, there is a case that it
is reset with the already released search results. This patch adds an
additional check for abandoned flag in pagedresults_set_search_result.
If the pagedresults handle shows it is abandoned, the search results
is not set to the handle unless it is for cleaning up with NULL.
https://fedorahosted.org/389/ticket/48192
Reviewed by rmeggins(a)redhat.com (Thanks, Rich!!)
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index 6dd6432..87447c4 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -337,7 +337,7 @@ pagedresults_free_one_msgid_nolock( Connection *conn, ber_int_t msgid )
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++) {
if (conn->c_pagedresults.prl_list[i].pr_msgid == msgid) {
PagedResults *prp = conn->c_pagedresults.prl_list + i;
- if (prp && prp->pr_current_be &&
+ if (prp->pr_current_be &&
prp->pr_current_be->be_search_results_release &&
prp->pr_search_result_set) {
prp->pr_current_be->be_search_results_release(&(prp->pr_search_result_set));
@@ -429,7 +429,11 @@ pagedresults_set_search_result(Connection *conn, Operation *op, void *sr,
if (conn && (index > -1)) {
if (!locked) PR_Lock(conn->c_mutex);
if (index < conn->c_pagedresults.prl_maxlen) {
- conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ PagedResults *prp = conn->c_pagedresults.prl_list + index;
+ if (!(prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) || !sr) {
+ /* If abandoned, don't set the search result unless it is NULL */
+ prp->pr_search_result_set = sr;
+ }
rc = 0;
}
if (!locked) PR_Unlock(conn->c_mutex);
1
0
ldap/servers/slapd/back-ldbm/ldbm_search.c | 1
ldap/servers/slapd/dse.c | 1
ldap/servers/slapd/pagedresults.c | 33 ++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 1
4 files changed, 35 insertions(+), 1 deletion(-)
New commits:
commit 54e574ad5334fc9c0e27be0a57551add38d84d1e
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Sep 30 13:32:05 2015 -0700
Ticket #48299 - pagedresults - when timed out, search results could have been already freed.
Description: When a search results object is freed, there is a window
until the information is set to the pagedresults handle. If the paged-
results handle is released due to a timeout in the window, double free
occurs.
This patch sets NULL just before the search results object is freed
in the backend as well as in dse.
Plus, fixed a minor memory leak in pagedresults_parse_control_value.
https://fedorahosted.org/389/ticket/48299
Reviewed and a bug found by tbordaz(a)redhat.com (Thank you, Thierry!!)
(cherry picked from commit f90c3a6e1933b9cc19a51b17a038f26652c4b2bc)
(cherry picked from commit 56151ed75bbd63af80932fe73a512df835b17593)
(cherry picked from commit 10ed80cf265fbfbec0c8dda005dcb84b6f39762b)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index de688fc..a9a05ac 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -1890,6 +1890,7 @@ delete_search_result_set( Slapi_PBlock *pb, back_search_result_set **sr )
/* If the op is pagedresults, let the module clean up sr. */
return;
}
+ pagedresults_set_search_result_pb(pb, NULL, 0);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
if ( NULL != (*sr)->sr_candidates )
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index 22cbff1..8080ec9 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -2578,6 +2578,7 @@ dse_next_search_entry (Slapi_PBlock *pb)
/* we reached the end of the list */
if (e == NULL)
{
+ pagedresults_set_search_result_pb(pb, NULL, 0);
dse_search_set_delete (ss);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index 010e5c1..9e183ec 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -185,7 +185,6 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
}
/* reset sizelimit */
op->o_pagedresults_sizelimit = -1;
- slapi_ch_free((void **)&cookie.bv_val);
if ((*index > -1) && (*index < conn->c_pagedresults.prl_maxlen)) {
if (conn->c_pagedresults.prl_list[*index].pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) {
@@ -202,6 +201,7 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
LDAPDebug1Arg(LDAP_DEBUG_ANY, "pagedresults_parse_control_value: invalid cookie: %d\n", *index);
}
bail:
+ slapi_ch_free((void **)&cookie.bv_val);
/* cleaning up the rest of the timedout or abandoned if any */
prp = conn->c_pagedresults.prl_list;
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++, prp++) {
@@ -1023,3 +1023,34 @@ pagedresults_is_abandoned_or_notavailable( Connection *conn, int index )
PR_Unlock(conn->c_mutex);
return prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED;
}
+
+int
+pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked)
+{
+ int rc = -1;
+ Connection *conn = NULL;
+ Operation *op = NULL;
+ int index = -1;
+ if (!pb) {
+ return 0;
+ }
+ slapi_pblock_get(pb, SLAPI_OPERATION, &op);
+ if (!op_is_pagedresults(op)) {
+ return 0; /* noop */
+ }
+ slapi_pblock_get(pb, SLAPI_CONNECTION, &conn);
+ slapi_pblock_get(pb, SLAPI_PAGED_RESULTS_INDEX, &index);
+ LDAPDebug2Args(LDAP_DEBUG_TRACE,
+ "--> pagedresults_set_search_result_pb: idx=%d, sr=%p\n", index, sr);
+ if (conn && (index > -1)) {
+ if (!locked) PR_Lock(conn->c_mutex);
+ if (index < conn->c_pagedresults.prl_maxlen) {
+ conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ rc = 0;
+ }
+ if (!locked) PR_Unlock(conn->c_mutex);
+ }
+ LDAPDebug1Arg(LDAP_DEBUG_TRACE,
+ "<-- pagedresults_set_search_result_pb: %d\n", rc);
+ return rc;
+}
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 7a1ab46..8f86eb7 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1481,6 +1481,7 @@ void op_set_pagedresults(Operation *op);
void pagedresults_lock(Connection *conn, int index);
void pagedresults_unlock(Connection *conn, int index);
int pagedresults_is_abandoned_or_notavailable(Connection *conn, int index);
+int pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked);
/*
* sort.c
1
0
ldap/servers/slapd/back-ldbm/ldbm_search.c | 1
ldap/servers/slapd/dse.c | 1
ldap/servers/slapd/pagedresults.c | 33 ++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 1
4 files changed, 35 insertions(+), 1 deletion(-)
New commits:
commit 10ed80cf265fbfbec0c8dda005dcb84b6f39762b
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Sep 30 13:32:05 2015 -0700
Ticket #48299 - pagedresults - when timed out, search results could have been already freed.
Description: When a search results object is freed, there is a window
until the information is set to the pagedresults handle. If the paged-
results handle is released due to a timeout in the window, double free
occurs.
This patch sets NULL just before the search results object is freed
in the backend as well as in dse.
Plus, fixed a minor memory leak in pagedresults_parse_control_value.
https://fedorahosted.org/389/ticket/48299
Reviewed and a bug found by tbordaz(a)redhat.com (Thank you, Thierry!!)
(cherry picked from commit f90c3a6e1933b9cc19a51b17a038f26652c4b2bc)
(cherry picked from commit 56151ed75bbd63af80932fe73a512df835b17593)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index ae0eef5..719f093 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -1919,6 +1919,7 @@ delete_search_result_set( Slapi_PBlock *pb, back_search_result_set **sr )
/* If the op is pagedresults, let the module clean up sr. */
return;
}
+ pagedresults_set_search_result_pb(pb, NULL, 0);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
if ( NULL != (*sr)->sr_candidates )
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index 55e5aa5..6623f13 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -2859,6 +2859,7 @@ dse_next_search_entry (Slapi_PBlock *pb)
/* we reached the end of the list */
if (e == NULL)
{
+ pagedresults_set_search_result_pb(pb, NULL, 0);
dse_search_set_delete (ss);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index 010e5c1..9e183ec 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -185,7 +185,6 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
}
/* reset sizelimit */
op->o_pagedresults_sizelimit = -1;
- slapi_ch_free((void **)&cookie.bv_val);
if ((*index > -1) && (*index < conn->c_pagedresults.prl_maxlen)) {
if (conn->c_pagedresults.prl_list[*index].pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) {
@@ -202,6 +201,7 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
LDAPDebug1Arg(LDAP_DEBUG_ANY, "pagedresults_parse_control_value: invalid cookie: %d\n", *index);
}
bail:
+ slapi_ch_free((void **)&cookie.bv_val);
/* cleaning up the rest of the timedout or abandoned if any */
prp = conn->c_pagedresults.prl_list;
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++, prp++) {
@@ -1023,3 +1023,34 @@ pagedresults_is_abandoned_or_notavailable( Connection *conn, int index )
PR_Unlock(conn->c_mutex);
return prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED;
}
+
+int
+pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked)
+{
+ int rc = -1;
+ Connection *conn = NULL;
+ Operation *op = NULL;
+ int index = -1;
+ if (!pb) {
+ return 0;
+ }
+ slapi_pblock_get(pb, SLAPI_OPERATION, &op);
+ if (!op_is_pagedresults(op)) {
+ return 0; /* noop */
+ }
+ slapi_pblock_get(pb, SLAPI_CONNECTION, &conn);
+ slapi_pblock_get(pb, SLAPI_PAGED_RESULTS_INDEX, &index);
+ LDAPDebug2Args(LDAP_DEBUG_TRACE,
+ "--> pagedresults_set_search_result_pb: idx=%d, sr=%p\n", index, sr);
+ if (conn && (index > -1)) {
+ if (!locked) PR_Lock(conn->c_mutex);
+ if (index < conn->c_pagedresults.prl_maxlen) {
+ conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ rc = 0;
+ }
+ if (!locked) PR_Unlock(conn->c_mutex);
+ }
+ LDAPDebug1Arg(LDAP_DEBUG_TRACE,
+ "<-- pagedresults_set_search_result_pb: %d\n", rc);
+ return rc;
+}
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index c6cd4ed..5fa2310 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1525,6 +1525,7 @@ void op_set_pagedresults(Operation *op);
void pagedresults_lock(Connection *conn, int index);
void pagedresults_unlock(Connection *conn, int index);
int pagedresults_is_abandoned_or_notavailable(Connection *conn, int index);
+int pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked);
/*
* sort.c
1
0
ldap/servers/slapd/back-ldbm/ldbm_search.c | 1
ldap/servers/slapd/dse.c | 1
ldap/servers/slapd/pagedresults.c | 33 ++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 1
4 files changed, 35 insertions(+), 1 deletion(-)
New commits:
commit 56151ed75bbd63af80932fe73a512df835b17593
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Sep 30 13:32:05 2015 -0700
Ticket #48299 - pagedresults - when timed out, search results could have been already freed.
Description: When a search results object is freed, there is a window
until the information is set to the pagedresults handle. If the paged-
results handle is released due to a timeout in the window, double free
occurs.
This patch sets NULL just before the search results object is freed
in the backend as well as in dse.
Plus, fixed a minor memory leak in pagedresults_parse_control_value.
https://fedorahosted.org/389/ticket/48299
Reviewed and a bug found by tbordaz(a)redhat.com (Thank you, Thierry!!)
(cherry picked from commit f90c3a6e1933b9cc19a51b17a038f26652c4b2bc)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index 73c54d3..8ed6b4d 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -1890,6 +1890,7 @@ delete_search_result_set( Slapi_PBlock *pb, back_search_result_set **sr )
/* If the op is pagedresults, let the module clean up sr. */
return;
}
+ pagedresults_set_search_result_pb(pb, NULL, 0);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
if ( NULL != (*sr)->sr_candidates )
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index e8e393b..68ce751 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -2830,6 +2830,7 @@ dse_next_search_entry (Slapi_PBlock *pb)
/* we reached the end of the list */
if (e == NULL)
{
+ pagedresults_set_search_result_pb(pb, NULL, 0);
dse_search_set_delete (ss);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index d0c93cd..6dd6432 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -172,7 +172,6 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
}
/* reset sizelimit */
op->o_pagedresults_sizelimit = -1;
- slapi_ch_free((void **)&cookie.bv_val);
if ((*index > -1) && (*index < conn->c_pagedresults.prl_maxlen)) {
if (conn->c_pagedresults.prl_list[*index].pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) {
@@ -189,6 +188,7 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
LDAPDebug1Arg(LDAP_DEBUG_ANY, "pagedresults_parse_control_value: invalid cookie: %d\n", *index);
}
bail:
+ slapi_ch_free((void **)&cookie.bv_val);
/* cleaning up the rest of the timedout or abandoned if any */
prp = conn->c_pagedresults.prl_list;
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++, prp++) {
@@ -1010,3 +1010,34 @@ pagedresults_is_abandoned_or_notavailable( Connection *conn, int index )
PR_Unlock(conn->c_mutex);
return prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED;
}
+
+int
+pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked)
+{
+ int rc = -1;
+ Connection *conn = NULL;
+ Operation *op = NULL;
+ int index = -1;
+ if (!pb) {
+ return 0;
+ }
+ slapi_pblock_get(pb, SLAPI_OPERATION, &op);
+ if (!op_is_pagedresults(op)) {
+ return 0; /* noop */
+ }
+ slapi_pblock_get(pb, SLAPI_CONNECTION, &conn);
+ slapi_pblock_get(pb, SLAPI_PAGED_RESULTS_INDEX, &index);
+ LDAPDebug2Args(LDAP_DEBUG_TRACE,
+ "--> pagedresults_set_search_result_pb: idx=%d, sr=%p\n", index, sr);
+ if (conn && (index > -1)) {
+ if (!locked) PR_Lock(conn->c_mutex);
+ if (index < conn->c_pagedresults.prl_maxlen) {
+ conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ rc = 0;
+ }
+ if (!locked) PR_Unlock(conn->c_mutex);
+ }
+ LDAPDebug1Arg(LDAP_DEBUG_TRACE,
+ "<-- pagedresults_set_search_result_pb: %d\n", rc);
+ return rc;
+}
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index e8673e1..b10c1eb 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1488,6 +1488,7 @@ void op_set_pagedresults(Operation *op);
void pagedresults_lock(Connection *conn, int index);
void pagedresults_unlock(Connection *conn, int index);
int pagedresults_is_abandoned_or_notavailable(Connection *conn, int index);
+int pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked);
/*
* sort.c
1
0
ldap/servers/slapd/back-ldbm/ldbm_search.c | 1
ldap/servers/slapd/dse.c | 1
ldap/servers/slapd/pagedresults.c | 33 ++++++++++++++++++++++++++++-
ldap/servers/slapd/proto-slap.h | 1
4 files changed, 35 insertions(+), 1 deletion(-)
New commits:
commit f90c3a6e1933b9cc19a51b17a038f26652c4b2bc
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Sep 30 13:32:05 2015 -0700
Ticket #48299 - pagedresults - when timed out, search results could have been already freed.
Description: When a search results object is freed, there is a window
until the information is set to the pagedresults handle. If the paged-
results handle is released due to a timeout in the window, double free
occurs.
This patch sets NULL just before the search results object is freed
in the backend as well as in dse.
Plus, fixed a minor memory leak in pagedresults_parse_control_value.
https://fedorahosted.org/389/ticket/48299
Reviewed and a bug found by tbordaz(a)redhat.com (Thank you, Thierry!!)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c
index 73c54d3..8ed6b4d 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_search.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c
@@ -1890,6 +1890,7 @@ delete_search_result_set( Slapi_PBlock *pb, back_search_result_set **sr )
/* If the op is pagedresults, let the module clean up sr. */
return;
}
+ pagedresults_set_search_result_pb(pb, NULL, 0);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
if ( NULL != (*sr)->sr_candidates )
diff --git a/ldap/servers/slapd/dse.c b/ldap/servers/slapd/dse.c
index e8e393b..68ce751 100644
--- a/ldap/servers/slapd/dse.c
+++ b/ldap/servers/slapd/dse.c
@@ -2830,6 +2830,7 @@ dse_next_search_entry (Slapi_PBlock *pb)
/* we reached the end of the list */
if (e == NULL)
{
+ pagedresults_set_search_result_pb(pb, NULL, 0);
dse_search_set_delete (ss);
slapi_pblock_set(pb, SLAPI_SEARCH_RESULT_SET, NULL);
}
diff --git a/ldap/servers/slapd/pagedresults.c b/ldap/servers/slapd/pagedresults.c
index d0c93cd..6dd6432 100644
--- a/ldap/servers/slapd/pagedresults.c
+++ b/ldap/servers/slapd/pagedresults.c
@@ -172,7 +172,6 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
}
/* reset sizelimit */
op->o_pagedresults_sizelimit = -1;
- slapi_ch_free((void **)&cookie.bv_val);
if ((*index > -1) && (*index < conn->c_pagedresults.prl_maxlen)) {
if (conn->c_pagedresults.prl_list[*index].pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED) {
@@ -189,6 +188,7 @@ pagedresults_parse_control_value( Slapi_PBlock *pb,
LDAPDebug1Arg(LDAP_DEBUG_ANY, "pagedresults_parse_control_value: invalid cookie: %d\n", *index);
}
bail:
+ slapi_ch_free((void **)&cookie.bv_val);
/* cleaning up the rest of the timedout or abandoned if any */
prp = conn->c_pagedresults.prl_list;
for (i = 0; i < conn->c_pagedresults.prl_maxlen; i++, prp++) {
@@ -1010,3 +1010,34 @@ pagedresults_is_abandoned_or_notavailable( Connection *conn, int index )
PR_Unlock(conn->c_mutex);
return prp->pr_flags & CONN_FLAG_PAGEDRESULTS_ABANDONED;
}
+
+int
+pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked)
+{
+ int rc = -1;
+ Connection *conn = NULL;
+ Operation *op = NULL;
+ int index = -1;
+ if (!pb) {
+ return 0;
+ }
+ slapi_pblock_get(pb, SLAPI_OPERATION, &op);
+ if (!op_is_pagedresults(op)) {
+ return 0; /* noop */
+ }
+ slapi_pblock_get(pb, SLAPI_CONNECTION, &conn);
+ slapi_pblock_get(pb, SLAPI_PAGED_RESULTS_INDEX, &index);
+ LDAPDebug2Args(LDAP_DEBUG_TRACE,
+ "--> pagedresults_set_search_result_pb: idx=%d, sr=%p\n", index, sr);
+ if (conn && (index > -1)) {
+ if (!locked) PR_Lock(conn->c_mutex);
+ if (index < conn->c_pagedresults.prl_maxlen) {
+ conn->c_pagedresults.prl_list[index].pr_search_result_set = sr;
+ rc = 0;
+ }
+ if (!locked) PR_Unlock(conn->c_mutex);
+ }
+ LDAPDebug1Arg(LDAP_DEBUG_TRACE,
+ "<-- pagedresults_set_search_result_pb: %d\n", rc);
+ return rc;
+}
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index e8673e1..b10c1eb 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1488,6 +1488,7 @@ void op_set_pagedresults(Operation *op);
void pagedresults_lock(Connection *conn, int index);
void pagedresults_unlock(Connection *conn, int index);
int pagedresults_is_abandoned_or_notavailable(Connection *conn, int index);
+int pagedresults_set_search_result_pb(Slapi_PBlock *pb, void *sr, int locked);
/*
* sort.c
1
0
ldap/servers/slapd/dl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit e9c84a65e014b4ecda8edbebbdaa6a2a1ca932cf
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Tue Sep 22 17:51:35 2015 +0200
Ticket 48283 - many attrlist_replace errors in connection with cleanallruv
Bug Description: attrlist_replace error messages are logged because the
list of values contains duplicate attributes
Fix Description: the duplicate values can appear because when a replica
is removed from the ruv the array is compacted, but
memcpy is used instead of memmove
https://fedorahosted.org/389/ticket/48283
Reviewed by: Rich, Thanks
diff --git a/ldap/servers/slapd/dl.c b/ldap/servers/slapd/dl.c
index 6dc1a44..5fcb076 100644
--- a/ldap/servers/slapd/dl.c
+++ b/ldap/servers/slapd/dl.c
@@ -248,7 +248,7 @@ void *dl_delete (DataList *dl, const void *element, CMPFN cmpfn, FREEFN freefn)
if (i != dl->element_count - 1)
{
- memcpy (&dl->elements[i], &dl->elements[i+1], (dl->element_count - i - 1) * sizeof (void*));
+ memmove (&dl->elements[i], &dl->elements[i+1], (dl->element_count - i - 1) * sizeof (void*));
}
dl->element_count --;
1
0
ldap/servers/slapd/dl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit def55f11ed6fa4d0698bc05b21aa0e8ac6904532
Author: Ludwig Krispenz <lkrispen(a)redhat.com>
Date: Tue Sep 22 17:51:35 2015 +0200
Ticket 48283 - many attrlist_replace errors in connection with cleanallruv
Bug Description: attrlist_replace error messages are logged because the
list of values contains duplicate attributes
Fix Description: the duplicate values can appear because when a replica
is removed from the ruv the array is compacted, but
memcpy is used instead of memmove
https://fedorahosted.org/389/ticket/48283
Reviewed by: Rich, Thanks
diff --git a/ldap/servers/slapd/dl.c b/ldap/servers/slapd/dl.c
index 6dc1a44..5fcb076 100644
--- a/ldap/servers/slapd/dl.c
+++ b/ldap/servers/slapd/dl.c
@@ -248,7 +248,7 @@ void *dl_delete (DataList *dl, const void *element, CMPFN cmpfn, FREEFN freefn)
if (i != dl->element_count - 1)
{
- memcpy (&dl->elements[i], &dl->elements[i+1], (dl->element_count - i - 1) * sizeof (void*));
+ memmove (&dl->elements[i], &dl->elements[i+1], (dl->element_count - i - 1) * sizeof (void*));
}
dl->element_count --;
1
0