9:34 p.m.
This is an automated email from the git hooks/post-receive script.
firstyear pushed a change to branch master
in repository 389-ds-base.
from ccfc3c3 Issue 48226 - Fix CI test
new 37fc947 Ticket 49138 - Increase systemd timout
new 1dc6f5a Ticket 49137 - Add sasl plain test - ds
new 1c790df Ticket 49086 - SDN premangaling broken after SASL change
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "adds" were already present in the repository and have only
been added to this reference.
Summary of changes:
dirsrvtests/tests/suites/sasl/plain.py | 76 +++++++++++++++++++++++++++++++
ldap/servers/slapd/bind.c | 9 ++++
rpm/389-ds-base.spec.in | 2 +
wrappers/systemd.template.asan.service.in | 3 ++
wrappers/systemd.template.service.in | 3 ++
wrappers/systemd.template.sysconfig | 2 -
6 files changed, 93 insertions(+), 2 deletions(-)
create mode 100644 dirsrvtests/tests/suites/sasl/plain.py
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
9:34 p.m.
New subject: [389-ds-base] 01/03: Ticket 49138 - Increase systemd timout
This is an automated email from the git hooks/post-receive script.
firstyear pushed a commit to branch master
in repository 389-ds-base.
commit 37fc94768f83ce5c77a47a150952a60ea0cdc3ef
Author: William Brown <firstyear(a)redhat.com>
Date: Tue Feb 21 12:39:34 2017 +1000
Ticket 49138 - Increase systemd timout
Bug Description: We encountered a case where the system timeout
was too aggresive during encrypted changelog replay. This would
cause DB corruption as systemd killed us.
Fix Description: Make the timeout infinite to prevent systemd
killing us.
https://pagure.io/389-ds-base/issue/49138
Author: wibrown
Review by: mreynolds (Thanks!)
---
wrappers/systemd.template.asan.service.in | 3 +++
wrappers/systemd.template.service.in | 3 +++
wrappers/systemd.template.sysconfig | 2 --
3 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/wrappers/systemd.template.asan.service.in
b/wrappers/systemd.template.asan.service.in
index cfde3b5..0fe0bad 100644
--- a/wrappers/systemd.template.asan.service.in
+++ b/wrappers/systemd.template.asan.service.in
@@ -19,6 +19,9 @@ After=chronyd.service ntpd.service network-online.target syslog.target
[Service]
Type=notify
+NotifyAccess=all
+TimeoutStartSec=0
+TimeoutStopSec=600
EnvironmentFile=@initconfigdir@/@package_name@
EnvironmentFile=@initconfigdir@/@package_name@-%i
PIDFile=@localstatedir@/run/@package_name(a)/slapd-%i.pid
diff --git a/wrappers/systemd.template.service.in b/wrappers/systemd.template.service.in
index 6f096b7..75a1c75 100644
--- a/wrappers/systemd.template.service.in
+++ b/wrappers/systemd.template.service.in
@@ -19,6 +19,9 @@ After=chronyd.service ntpd.service network-online.target syslog.target
[Service]
Type=notify
+NotifyAccess=all
+TimeoutStartSec=0
+TimeoutStopSec=600
EnvironmentFile=@initconfigdir@/@package_name@
EnvironmentFile=@initconfigdir@/@package_name@-%i
PIDFile=@localstatedir@/run/@package_name(a)/slapd-%i.pid
diff --git a/wrappers/systemd.template.sysconfig b/wrappers/systemd.template.sysconfig
index e653c86..d78cc06 100644
--- a/wrappers/systemd.template.sysconfig
+++ b/wrappers/systemd.template.sysconfig
@@ -1,6 +1,4 @@
[Service]
-TimeoutStartSec=10m
-NotifyAccess=all
# uncomment this line to raise the file descriptor limit
# LimitNOFILE=8192
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
9:34 p.m.
New subject: [389-ds-base] 02/03: Ticket 49137 - Add sasl plain test - ds
This is an automated email from the git hooks/post-receive script.
firstyear pushed a commit to branch master
in repository 389-ds-base.
commit 1dc6f5ab2aa13275de5a367730116ac1fcf1ba9c
Author: William Brown <firstyear(a)redhat.com>
Date: Mon Feb 20 15:11:12 2017 +1000
Ticket 49137 - Add sasl plain test - ds
Bug Description: We should check that SASL plain works correctly
Fix Description: We add a test that verifies that SASL plain only
works with a TLS connection, that it works with correct and incorrect
passwords.
https://pagure.io/389-ds-base/issue/49137
Author: wibrown
Review by: mreynolds (Thanks!)
---
dirsrvtests/tests/suites/sasl/plain.py | 76 ++++++++++++++++++++++++++++++++++
rpm/389-ds-base.spec.in | 2 +
2 files changed, 78 insertions(+)
diff --git a/dirsrvtests/tests/suites/sasl/plain.py
b/dirsrvtests/tests/suites/sasl/plain.py
new file mode 100644
index 0000000..91ccb02
--- /dev/null
+++ b/dirsrvtests/tests/suites/sasl/plain.py
@@ -0,0 +1,76 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2017 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+#
+
+import pytest
+import ldap
+
+from lib389.topologies import topology_st
+# This pulls in logging I think
+from lib389.utils import *
+from lib389.sasl import PlainSASL
+from lib389.idm.services import ServiceAccounts
+
+log = logging.getLogger(__name__)
+
+def test_sasl_plain(topology_st):
+
+ standalone = topology_st.standalone
+
+ # SETUP TLS
+ standalone.stop()
+ # Prepare SSL but don't enable it.
+ for f in ('key3.db', 'cert8.db', 'key4.db',
'cert9.db', 'secmod.db', 'pkcs11.txt'):
+ try:
+ os.remove("%s/%s" % (standalone.confdir, f))
+ except:
+ pass
+ assert(standalone.nss_ssl.reinit() is True)
+ assert(standalone.nss_ssl.create_rsa_ca() is True)
+ assert(standalone.nss_ssl.create_rsa_key_and_cert() is True)
+ # Start again
+ standalone.start()
+ standalone.rsa.create()
+ # Set the secure port and nsslapd-security
+ # Could this fail with selinux?
+ standalone.config.set('nsslapd-secureport', '%s' %
SECUREPORT_STANDALONE1 )
+ standalone.config.set('nsslapd-security', 'on')
+ # Do we need to restart to allow starttls?
+ standalone.restart()
+
+ # Create a user
+ sas = ServiceAccounts(standalone, DEFAULT_SUFFIX)
+ sas._basedn = DEFAULT_SUFFIX
+ sa = sas.create(properties={'cn': 'testaccount',
'userPassword': 'password'})
+ # Check we can bind. This will raise exceptions if it fails.
+ sa.bind('password')
+
+ # Check that PLAIN is listed in supported mechns.
+ assert(standalone.rootdse.supports_sasl_plain())
+
+ # The sasl parameters don't change, so set them up now.
+ # Do we need the sasl map dn:?
+ auth_tokens = PlainSASL("dn:%s" % sa.dn, 'password')
+
+ # Check that it fails without TLS
+ with pytest.raises(ldap.AUTH_UNKNOWN):
+ standalone.openConnection(saslmethod='PLAIN', sasltoken=auth_tokens,
starttls=False, connOnly=True)
+
+ # We *have* to use REQCERT NEVER here because python ldap fails cert verification for
.... some reason that even
+ # I can not solve. I think it's leaking state across connections in start_tls_s?
+
+ # Check that it works with TLS
+ conn = standalone.openConnection(saslmethod='PLAIN', sasltoken=auth_tokens,
starttls=True, connOnly=True, certdir=standalone.get_cert_dir(),
reqcert=ldap.OPT_X_TLS_NEVER)
+ conn.close()
+
+ # Check that it correct fails our bind if we don't have the password.
+ auth_tokens = PlainSASL("dn:%s" % sa.dn, 'password-wrong')
+ with pytest.raises(ldap.INVALID_CREDENTIALS):
+ standalone.openConnection(saslmethod='PLAIN', sasltoken=auth_tokens,
starttls=False, connOnly=True, certdir=standalone.get_cert_dir(),
reqcert=ldap.OPT_X_TLS_NEVER)
+
+ # Done!
diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in
index 4aad5b2..f1358af 100644
--- a/rpm/389-ds-base.spec.in
+++ b/rpm/389-ds-base.spec.in
@@ -115,6 +115,8 @@ Requires: nss-tools
# they are required to support the mandatory LDAP SASL mechs
Requires: cyrus-sasl-gssapi
Requires: cyrus-sasl-md5
+# This is optionally supported by us, as we use it in our tests
+Requires: cyrus-sasl-plain
# this is needed for verify-db.pl
%if %{use_db4}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
9:34 p.m.
New subject: [389-ds-base] 03/03: Ticket 49086 - SDN premangaling broken after SASL change
This is an automated email from the git hooks/post-receive script.
firstyear pushed a commit to branch master
in repository 389-ds-base.
commit 1c790df928ec3b0644584b3a6ad9ae737e1678b0
Author: William Brown <firstyear(a)redhat.com>
Date: Fri Feb 17 16:28:53 2017 +1000
Ticket 49086 - SDN premangaling broken after SASL change
Bug Description: SDN premangaling is broken after pw_verify change.
This was because we move the verification code to pw_verify, that
requires a target_address *and* a target_spec to look up what backend
we are about to select.
Fix Description: After a pre_bind, reset the target spec.
https://pagure.io/389-ds-base/issue/49086
Author: wibrown
Review by: mreynolds (Thanks!)
---
ldap/servers/slapd/bind.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
index d8811d5..b4bb363 100644
--- a/ldap/servers/slapd/bind.c
+++ b/ldap/servers/slapd/bind.c
@@ -626,6 +626,7 @@ do_bind( Slapi_PBlock *pb )
rc = 0;
/* Check if a pre_bind plugin mapped the DN to another backend */
+ Slapi_DN *target_spec_sdn = operation_get_target_spec(pb->pb_op);
Slapi_DN *pb_sdn;
slapi_pblock_get(pb, SLAPI_BIND_TARGET_SDN, &pb_sdn);
if (!pb_sdn) {
@@ -644,6 +645,14 @@ do_bind( Slapi_PBlock *pb )
goto free_and_return;
}
+ /* pagure 49086, it's too hard to actually try and merge the two SDN values
+ * without corrupting them. As a result, we need to update the target spec
instead.
+ *
+ * It's really important that when we start to rethink pblock, that we kill
this with fire.
+ */
+ slapi_sdn_free(&target_spec_sdn);
+ operation_set_target_spec(pb->pb_op, pb_sdn);
+
/* We could be serving multiple database backends. Select the appropriate one
*/
/* pw_verify_be_dn will select the backend we need for us. */
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
2621
days inactive
2621
days old
389-commits@lists.fedoraproject.org
3 comments
1 participants
participants (1)
-
git repository hosting