ldap/schema/01core389.ldif | 13 +++++++++++ ldap/servers/slapd/libglobs.c | 46 +++++++++++++++++++++++++++++++++++++++- ldap/servers/slapd/proto-slap.h | 2 + ldap/servers/slapd/saslbind.c | 2 - ldap/servers/slapd/slap.h | 2 + 5 files changed, 63 insertions(+), 2 deletions(-)
New commits: commit 00463a1b23d970837e73a38a82fd34424ab13782 Author: Mark Reynolds mreynolds@redhat.com Date: Fri Mar 22 13:18:28 2013 -0400
Ticket 632 - 389-ds-base cannot handle Kerberos tickets with PAC
Bug Description: When FreeIPA is configured with AD trust support, Kerberos tickets may also contain PAC which makes them bigger than usually expected (bigger than 2048 B)
Fix Description: Make the default 64k(65536), and allow it to be configurable using: nsslapd-sasl-max-buffer-size
https://fedorahosted.org/389/ticket/632
Reviewed by: nkinder(Thanks!)
diff --git a/ldap/schema/01core389.ldif b/ldap/schema/01core389.ldif index fb707d3..ad5b555 100644 --- a/ldap/schema/01core389.ldif +++ b/ldap/schema/01core389.ldif @@ -139,6 +139,19 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2136 NAME 'nsds5ReplicaCleanRUVNotified' attributeTypes: ( 2.16.840.1.113730.3.1.2137 NAME 'nsds5ReplicaAbortCleanRUV' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2111 NAME 'tombstoneNumSubordinates' DESC 'count of immediate subordinates for tombstone entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN '389 directory server' ) attributeTypes: ( 2.16.840.1.113730.3.1.2138 NAME 'nsslapd-readonly' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2143 NAME 'nsslapd-sasl-mapping-fallback' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2144 NAME 'rootdn-open-time' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2145 NAME 'rootdn-close-time' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2146 NAME 'rootdn-days-allowed' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2147 NAME 'rootdn-allow-host' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2148 NAME 'rootdn-deny-host' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2149 NAME 'rootdn-allow-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2150 NAME 'rootdn-deny-ip' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2151 NAME 'nsslapd-plugin-depends-on-type' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2152 NAME 'nsds5ReplicaProtocolTimeout' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2154 NAME 'nsds5ReplicaBackoffMin' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2155 NAME 'nsds5ReplicaBackoffMax' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) +attributeTypes: ( 2.16.840.1.113730.3.1.2156 NAME 'nsslapd-sasl-max-buffer-size' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' ) # # objectclasses # diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index ab366fc..a5c1067 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -175,6 +175,8 @@ static int config_set_schemareplace ( const char *attrname, char *value, #define DEFAULT_PW_RESETFAILURECOUNT "600" #define DEFAULT_PW_LOCKDURATION "3600" #define DEFAULT_NDN_SIZE "20971520" +#define DEFAULT_SASL_MAXBUFSIZE "65536" +#define SLAPD_DEFAULT_SASL_MAXBUFSIZE 65536 #ifdef MEMPOOL_EXPERIMENTAL #define DEFAULT_MEMPOOL_MAXFREELIST "1024" #endif @@ -1010,6 +1012,11 @@ static struct config_get_and_set { NULL, 0, (void**)&global_slapdFrontendConfig.allowed_sasl_mechs, CONFIG_STRING, (ConfigGetFunc)config_get_allowed_sasl_mechs, DEFAULT_ALLOWED_TO_DELETE_ATTRS}, + {CONFIG_SASL_MAXBUFSIZE, config_set_sasl_maxbufsize, + NULL, 0, + (void**)&global_slapdFrontendConfig.sasl_max_bufsize, + CONFIG_INT, (ConfigGetFunc)config_get_sasl_maxbufsize, + DEFAULT_SASL_MAXBUFSIZE}, #ifdef MEMPOOL_EXPERIMENTAL ,{CONFIG_MEMPOOL_SWITCH_ATTRIBUTE, config_set_mempool_switch, NULL, 0, @@ -1436,6 +1443,7 @@ FrontendConfig_init () { init_disk_logging_critical = cfg->disk_logging_critical = LDAP_OFF; init_ndn_cache_enabled = cfg->ndn_cache_enabled = LDAP_OFF; cfg->ndn_cache_max_size = NDN_DEFAULT_SIZE; + cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE;
#ifdef MEMPOOL_EXPERIMENTAL init_mempool_switch = cfg->mempool_switch = LDAP_ON; @@ -1669,8 +1677,8 @@ int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int apply ) { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); - long size; int retVal = LDAP_SUCCESS; + long size;
size = atol(value); if(size < 0){ @@ -1690,6 +1698,29 @@ config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, return retVal; }
+int +config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply ) +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal = LDAP_SUCCESS; + int default_size = atoi(DEFAULT_SASL_MAXBUFSIZE); + int size; + + size = atoi(value); + if(size < default_size){ + PR_snprintf ( errorbuf, SLAPI_DSE_RETURNTEXT_SIZE, "nsslapd-sasl-max-buffer-size is too low (%d), " + "setting to default value (%d).\n",size, default_size); + size = default_size; + } + if(apply){ + CFG_LOCK_WRITE(slapdFrontendConfig); + slapdFrontendConfig->sasl_max_bufsize = size; + CFG_UNLOCK_WRITE(slapdFrontendConfig); + } + + return retVal; +} + int config_set_port( const char *attrname, char *port, char *errorbuf, int apply ) { long nPort; @@ -4128,6 +4159,19 @@ config_get_port(){ }
int +config_get_sasl_maxbufsize() +{ + slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); + int retVal; + + CFG_LOCK_READ(slapdFrontendConfig); + retVal = slapdFrontendConfig->sasl_max_bufsize; + CFG_UNLOCK_READ(slapdFrontendConfig); + + return retVal; +} + +int config_get_disk_monitoring(){ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); int retVal; diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 6d7a1ad..e947248 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -392,6 +392,7 @@ int config_set_disk_logging_critical( const char *attrname, char *value, char *e int config_set_auditlog_unhashed_pw(const char *attrname, char *value, char *errorbuf, int apply); int config_set_ndn_cache_enabled(const char *attrname, char *value, char *errorbuf, int apply); int config_set_ndn_cache_max_size(const char *attrname, char *value, char *errorbuf, int apply); +int config_set_sasl_maxbufsize(const char *attrname, char *value, char *errorbuf, int apply );
#if !defined(_WIN32) && !defined(AIX) int config_set_maxdescriptors( const char *attrname, char *value, char *errorbuf, int apply ); @@ -553,6 +554,7 @@ int config_get_ndn_cache_enabled(); char *config_get_allowed_sasl_mechs(); int config_set_allowed_sasl_mechs(const char *attrname, char *value, char *errorbuf, int apply); int config_get_schemamod(); +int config_get_sasl_maxbufsize();
PLHashNumber hashNocaseString(const void *key); PRIntn hashNocaseCompare(const void *v1, const void *v2); diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c index f9ddbfc..51c0a4e 100644 --- a/ldap/servers/slapd/saslbind.c +++ b/ldap/servers/slapd/saslbind.c @@ -661,7 +661,7 @@ void ids_sasl_server_new(Connection *conn) }
/* Enable security for this connection */ - secprops.maxbufsize = 2048; /* DBDB: hack */ + secprops.maxbufsize = config_get_sasl_maxbufsize(); secprops.max_ssf = 0xffffffff; secprops.min_ssf = config_get_minssf(); /* If anonymous access is disabled, set the appropriate flag */ diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 4e70aff..7e27a78 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -2052,6 +2052,7 @@ typedef struct _slapdEntryPoints { #define CONFIG_NDN_CACHE "nsslapd-ndn-cache-enabled" #define CONFIG_NDN_CACHE_SIZE "nsslapd-ndn-cache-max-size" #define CONFIG_ALLOWED_SASL_MECHS "nsslapd-allowed-sasl-mechanisms" +#define CONFIG_SASL_MAXBUFSIZE "nsslapd-sasl-max-buffer-size"
#ifdef MEMPOOL_EXPERIMENTAL #define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool" @@ -2263,6 +2264,7 @@ typedef struct _slapdFrontendConfig { int pagedsizelimit; char *default_naming_context; /* Default naming context (normalized) */ char *allowed_sasl_mechs; /* comma/space separated list of allowed sasl mechs */ + int sasl_max_bufsize; /* The max receive buffer size for SASL */
/* disk monitoring */ int disk_monitoring;
389-commits@lists.fedoraproject.org
-
Mark Reynolds