[Pkg-fedora-ds-maintainers] 389-ds-base: Changes to 'upstream-unstable'
Timo Aaltonen
tjaalton-guest at alioth.debian.org
Thu Sep 26 18:57:53 UTC 2013
VERSION.sh | 2 -
ldap/admin/src/scripts/start-dirsrv.in | 18 +++++++++++---
ldap/admin/src/scripts/stop-dirsrv.in | 29 ++++++++++++++++++++---
ldap/servers/plugins/acl/acllas.c | 34 +++++++++++++--------------
ldap/servers/plugins/acl/aclparse.c | 34 +++++++++++++++++++++++----
ldap/servers/plugins/acl/aclutil.c | 6 ++--
ldap/servers/plugins/automember/automember.c | 2 -
ldap/servers/plugins/replication/cl5_api.c | 2 -
ldap/servers/slapd/slapi-private.h | 5 +++
ldap/servers/slapd/valueset.c | 13 +++++++---
10 files changed, 107 insertions(+), 38 deletions(-)
New commits:
commit c769b4eaa3b9a178533fb86e2e91b7f6c840f2db
Author: Noriko Hosoi <nhosoi at redhat.com>
Date: Fri Sep 13 11:38:45 2013 -0700
bump version to 1.3.1.9
diff --git a/VERSION.sh b/VERSION.sh
index 81cd911..d92eb09 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=3
-VERSION_MAINT=1.8
+VERSION_MAINT=1.9
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
commit ac8aad8260d3e5ed403e2d4a9967447a97925ba7
Author: Thierry bordaz (tbordaz) <tbordaz at redhat.com>
Date: Wed Sep 11 11:08:58 2013 +0200
Ticket 47489 - Under specific values of nsDS5ReplicaName, replication may get broken or updates missing
Bug Description:
If the 'nsDS5ReplicaName' (of a replica), contains the database suffix (e.g. 'db', 'db3' or 'db4).
Then replication plugin fails to open the changelog. It could conduct to changelog being recreated or some
last updates to be corrupted.
A consequence that I can reproduce, is that some updates may be removed from the changelog and missing
updates on consumers.
This could conduct to replication break, if for example an entry created is not replicated and then later updated.
Fix Description:
The fix consist to use 'PL_strrstr' rather than 'strstr' to check the database suffix is valid
https://fedorahosted.org/389/ticket/47489
Reviewed by: Rich Megginson (thanks Rich !)
Platforms tested: Fedora 17
Flag Day: no
Doc impact: no
(cherry picked from commit 7a7609d88caf9c0971e694d7eeb78f30aea7fec9)
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
index 0a70d6b..7bedc2c 100644
--- a/ldap/servers/plugins/replication/cl5_api.c
+++ b/ldap/servers/plugins/replication/cl5_api.c
@@ -6161,7 +6161,7 @@ static int _cl5FileEndsWith(const char *filename, const char *ext)
{
return 0;
}
- p = strstr(filename, ext);
+ p = PL_strrstr(filename, ext);
if (NULL == p)
{
return 0;
commit a7e9f7b2f4df38d81b1cbf6bc53c79d0d56bc36c
Author: Nathan Kinder <nkinder at redhat.com>
Date: Wed Sep 11 18:23:14 2013 -0700
Ticket 449 - Allow macro aci keywords to be case-insensitive
This allows the macro aci keywords ($attr and $dn) to be
case-insensitive. We were allowing the keywords to be set
regardless of case, but we were only processing them properly
if they were lowercase. This patch makes the processing
case-insensitive as well.
I also added validation of the attribute name that is appended
to the $attr keyword. We previously performed no validation. The
patch ensures that the attribute name is legal per RFC 4512, but
we don't check if it is defined in the schema. This will allow an
aci to be set prior to adding the attribute to the schema. It
also allows attributes that are used in an extensibleObject entry
to work properly with macro acis.
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 5bcb482..ee113bc 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -584,9 +584,9 @@ DS_LASUserDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* URL format */
- if ((strstr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( s_user, &lasinfo,
ACL_EVAL_USER);
@@ -856,9 +856,9 @@ DS_LASGroupDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
"Group not evaluated(%s)\n", groupName);
break;
} else {
- if ((strstr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( groupName, &lasinfo,
ACL_EVAL_GROUP);
slapi_log_error ( SLAPI_LOG_ACL, plugin_name,
@@ -1075,9 +1075,9 @@ DS_LASRoleDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* Take care of param strings */
- if ((strstr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( role, &lasinfo,
ACL_EVAL_ROLE);
@@ -2598,9 +2598,9 @@ DS_LASGroupDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
/* In this case "grppupdnattr="ldap:///base??attr" */
- if ((strstr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( attrName, &lasinfo,
ACL_EVAL_GROUPDNATTR);
@@ -4157,12 +4157,12 @@ acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) {
int has_macro_levels = 0;
/* Determine what the rule's got once */
- if ( strstr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
+ if ( strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
/* ($dn) exists */
has_macro_dn = 1;
}
- if ( strstr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
+ if ( strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
/* [$dn] exists */
has_macro_levels = 1;
}
@@ -4266,7 +4266,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
int l;
Slapi_Attr *attr = NULL;
- str = strstr(rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
if ( str == NULL ) {
charray_add(&a, slapi_ch_strdup(rule));
@@ -4275,7 +4275,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
} else {
working_rule = slapi_ch_strdup(rule);
- str = strstr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
charray_add(&working_list, working_rule );
while( str != NULL) {
@@ -4373,7 +4373,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
slapi_ch_free_string(¯o_str);
slapi_ch_free_string(¯o_attr_name);
- str = strstr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
}/* while */
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index cabc39f..29203da 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -276,8 +276,8 @@ __aclp__parse_aci(char *str, aci_t *aci_item, char **errbuf)
* have a target and it must have a macro.
*/
- if ((strstr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
+ if ((strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
/* Must have a targetmacro */
if ( !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) {
@@ -497,15 +497,41 @@ __aclp__sanity_check_acltxt (aci_t *aci_item, char *str)
return ACL_INCORRECT_ACI_VERSION;
}
} else if ((s = strstr(word, "($")) || (s = strstr(word, "[$"))) {
+ int attr_macro = -1;
+
+ /* See if this is a valid macro keyword. */
if ((0 != strncasecmp(s, ACL_RULE_MACRO_DN_KEY,
sizeof(ACL_RULE_MACRO_DN_KEY) - 1)) &&
(0 != strncasecmp(s, ACL_RULE_MACRO_DN_LEVELS_KEY,
sizeof(ACL_RULE_MACRO_DN_LEVELS_KEY) - 1)) &&
- (0 != strncasecmp(s, ACL_RULE_MACRO_ATTR_KEY,
- sizeof(ACL_RULE_MACRO_ATTR_KEY) - 1))) {
+ (0 != (attr_macro = strncasecmp(s, ACL_RULE_MACRO_ATTR_KEY,
+ sizeof(ACL_RULE_MACRO_ATTR_KEY) - 1)))) {
slapi_ch_free ( (void **) &newstr );
return ACL_SYNTAX_ERR;
}
+
+ /* For the $attr macro, validate that the attribute name is
+ * legal per RFC 4512. */
+ if (attr_macro == 0) {
+ int start = 1;
+ char *p = NULL;
+
+ for (p = s + sizeof(ACL_RULE_MACRO_ATTR_KEY) - 1;
+ p && *p && *p != ')'; p++) {
+ if (start) {
+ if (!isalpha(*p)) {
+ slapi_ch_free ( (void **) &newstr );
+ return ACL_SYNTAX_ERR;
+ }
+ start = 0;
+ } else {
+ if (!(isalnum(*p) || (*p == '-'))) {
+ slapi_ch_free ( (void **) &newstr );
+ return ACL_SYNTAX_ERR;
+ }
+ }
+ }
+ }
}
}
slapi_ch_free ( (void **) &newstr );
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index f33b11e..1b8bc12 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -1247,7 +1247,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
char *working_s, *suffix, *prefix, *patched;
int replace_with_len, substr_len, prefix_len, suffix_len;
- if (strstr(s, substr) == NULL) {
+ if (strcasestr(s, substr) == NULL) {
return(slapi_ch_strdup(s));
} else {
@@ -1257,7 +1257,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = slapi_ch_strdup(s);
prefix = working_s;
- str = strstr(prefix, substr);
+ str = strcasestr(prefix, substr);
while (str != NULL) {
@@ -1284,7 +1284,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = patched;
prefix = working_s;
- str = strstr(prefix, substr);
+ str = strcasestr(prefix, substr);
}
commit 6bdc635caffe8bc031cbc1d7dba1a43f292249a8
Author: Mark Reynolds <mreynolds at redhat.com>
Date: Tue Sep 10 15:39:22 2013 -0400
Ticket 47507 - automember rebuild task not working as expected
Bug Description: If the basedn specified in the task is not beneath the automember scope,
the entry is skipped.
Example:
automember scope: ou=people,dc=example,dc=com
task basedn: dc=example,dc=com --> using this dn will cause
all the candidate entries
to be skipped.
Fix Description: Regardless what the task basedn is, the candidate entry dn needs to be
checked against the scope of the autommeber config.
https://fedorahosted.org/389/ticket/47507
Revewied by: nhosoi(Thanks!!)
(cherry picked from commit d2637ddddc73f66f8ad874a511b4880884d36950)
diff --git a/ldap/servers/plugins/automember/automember.c b/ldap/servers/plugins/automember/automember.c
index 2ba3314..02dcc0d 100644
--- a/ldap/servers/plugins/automember/automember.c
+++ b/ldap/servers/plugins/automember/automember.c
@@ -2192,7 +2192,7 @@ void automember_rebuild_task_thread(void *arg){
while (list != g_automember_config) {
config = (struct configEntry *)list;
/* Does the entry meet scope and filter requirements? */
- if (slapi_dn_issuffix(slapi_sdn_get_dn(td->base_dn), config->scope) &&
+ if (slapi_dn_issuffix(slapi_entry_get_dn(entries[i]), config->scope) &&
(slapi_filter_test_simple(entries[i], config->filter) == 0))
{
automember_update_membership(config, entries[i], NULL);
commit f3227885e64cef94eb8c4a7b2aad6f69dddff034
Author: Rich Megginson <rmeggins at redhat.com>
Date: Fri Sep 6 10:14:43 2013 -0600
bump version to 1.3.1.8
diff --git a/VERSION.sh b/VERSION.sh
index 3a45057..81cd911 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=3
-VERSION_MAINT=1.7
+VERSION_MAINT=1.8
# if this is a PRERELEASE, set VERSION_PREREL
# otherwise, comment it out
# be sure to include the dot prefix in the prerel
commit 6357ced2e4380def053966e849eac45e44009662
Author: Rich Megginson <rmeggins at redhat.com>
Date: Thu Sep 5 19:45:44 2013 -0600
Ticket #47455 - valgrind - value mem leaks, uninit mem usage
https://fedorahosted.org/389/ticket/47455
Reviewed by: nkinder (Thanks!)
Branch: 389-ds-base-1.3.1
Fix Description: The problem was that slapi_valueset_add_attr_valuearray_ext
was assuming the caller was going to free the entire given vs upon failure.
This is fine for the value replace case but not for the add 1 value case.
Callers of slapi_valueset_add_attr_valuearray_ext must provide
the dup_index parameter if using SLAPI_VALUE_FLAG_PASSIN and
SLAPI_VALUE_FLAG_DUPCHECK, and if there is more than one value. The caller
needs to know which of the values from addvals is in vs to properly clean up
with no memory leaks.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 3adc242bcc8c6d0d05d5d9773f32b4f81afb6e6d)
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index b2364ab..194f3fd 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -846,6 +846,11 @@ void valuearray_add_valuearray_fast( Slapi_Value ***vals, Slapi_Value **addvals,
Slapi_Value * valueset_find_sorted (const Slapi_Attr *a, const Slapi_ValueSet *vs, const Slapi_Value *v, int *index);
int valueset_insert_value_to_sorted(const Slapi_Attr *a, Slapi_ValueSet *vs, Slapi_Value *vi, int dupcheck);
void valueset_array_to_sorted (const Slapi_Attr *a, Slapi_ValueSet *vs);
+/* NOTE: if the flags include SLAPI_VALUE_FLAG_PASSIN and SLAPI_VALUE_FLAG_DUPCHECK
+ * THE CALLER MUST PROVIDE THE dup_index PARAMETER in order to know where in addval
+ * the un-copied values start e.g. to free them for cleanup
+ * see valueset_replace_valuearray_ext() for an example
+ */
int slapi_valueset_add_attr_valuearray_ext(const Slapi_Attr *a, Slapi_ValueSet *vs, Slapi_Value **addval, int nvals, unsigned long flags, int *dup_index);
int valuearray_find(const Slapi_Attr *a, Slapi_Value **va, const Slapi_Value *v);
int valuearray_dn_normalize_value(Slapi_Value **vals);
diff --git a/ldap/servers/slapd/valueset.c b/ldap/servers/slapd/valueset.c
index 85d2274..8a4bd03 100644
--- a/ldap/servers/slapd/valueset.c
+++ b/ldap/servers/slapd/valueset.c
@@ -1134,8 +1134,9 @@ slapi_valueset_add_attr_valuearray_ext(const Slapi_Attr *a, Slapi_ValueSet *vs,
rc = LDAP_TYPE_OR_VALUE_EXISTS;
if (dup_index) *dup_index = i;
if (passin) {
- /* we have to NULL out the first value so valuearray_free won't delete values in addvals */
- (vs->va)[0] = NULL;
+ PR_ASSERT((i == 0) || dup_index);
+ /* caller must provide dup_index to know how far we got in addvals */
+ (vs->va)[vs->num] = NULL;
} else {
slapi_value_free(&(vs->va)[vs->num]);
}
@@ -1379,8 +1380,9 @@ valueset_replace_valuearray_ext(Slapi_Attr *a, Slapi_ValueSet *vs, Slapi_Value *
} else {
/* verify the given values are not duplicated. */
unsigned long flags = SLAPI_VALUE_FLAG_PASSIN|SLAPI_VALUE_FLAG_DUPCHECK;
+ int dupindex = 0;
Slapi_ValueSet *vs_new = slapi_valueset_new();
- rc = slapi_valueset_add_attr_valuearray_ext (a, vs_new, valstoreplace, vals_count, flags, NULL);
+ rc = slapi_valueset_add_attr_valuearray_ext (a, vs_new, valstoreplace, vals_count, flags, &dupindex);
if ( rc == LDAP_SUCCESS )
{
@@ -1408,8 +1410,11 @@ valueset_replace_valuearray_ext(Slapi_Attr *a, Slapi_ValueSet *vs, Slapi_Value *
{
/* caller expects us to own valstoreplace - since we cannot
use them, just delete them */
+ /* using PASSIN, some of the Slapi_Value* are in vs_new, and the rest
+ * after dupindex are in valstoreplace
+ */
slapi_valueset_free(vs_new);
- valuearray_free(&valstoreplace);
+ valuearray_free_ext(&valstoreplace, dupindex);
PR_ASSERT((vs->sorted == NULL) || (vs->num == 0) || ((vs->sorted[0] >= 0) && (vs->sorted[0] < vs->num)));
}
}
commit 060c05c1d89ee92e17c797aa27d4a87a9f4789de
Author: Mark Reynolds <mreynolds at redhat.com>
Date: Wed Sep 4 11:43:22 2013 -0400
Ticket 47500 - start-dirsrv/restart-dirsrv/stop-disrv do not register with systemd correctly
Description: If "systemctl" is available on the system, and the user is root, then
use systemctl to start & stop the server.
https://fedorahosted.org/389/ticket/47500
Reviewed by: richm(Thanks!)
(cherry picked from commit ba00d4885b93f8cc8d6eb1460bd0b5019e4d2fc2)
diff --git a/ldap/admin/src/scripts/start-dirsrv.in b/ldap/admin/src/scripts/start-dirsrv.in
index a163cef..481797d 100755
--- a/ldap/admin/src/scripts/start-dirsrv.in
+++ b/ldap/admin/src/scripts/start-dirsrv.in
@@ -60,11 +60,21 @@ start_instance() {
rm -f $PIDFILE
fi
fi
- cd $SERVERBIN_DIR; ./ns-slapd -D $CONFIG_DIR -i $PIDFILE -w $STARTPIDFILE "$@"
- if [ $? -ne 0 ]; then
- return 1
+ #
+ # Use systemctl if available and running as root,
+ # otherwise start the instance the old way.
+ #
+ if [ -d "@systemdsystemunitdir@" ] && [ "$(id -u)" == "0" ];then
+ @bindir@/systemctl start @package_name@@$SERV_ID.service
+ if [ $? -ne 0 ]; then
+ return 1
+ fi
+ else
+ cd $SERVERBIN_DIR; ./ns-slapd -D $CONFIG_DIR -i $PIDFILE -w $STARTPIDFILE "$@"
+ if [ $? -ne 0 ]; then
+ return 1
+ fi
fi
-
loop_counter=1
# wait for 10 seconds for the start pid file to appear
max_count=${STARTPID_TIME:-10}
diff --git a/ldap/admin/src/scripts/stop-dirsrv.in b/ldap/admin/src/scripts/stop-dirsrv.in
index bc38134..3f02e78 100755
--- a/ldap/admin/src/scripts/stop-dirsrv.in
+++ b/ldap/admin/src/scripts/stop-dirsrv.in
@@ -35,10 +35,33 @@ stop_instance() {
fi
return 2
}
- # server is running - kill it
- kill $PID
- loop_counter=1
+
+ #
+ # use systemctl if running as root
+ #
+ if [ -d "@systemdsystemunitdir@" ] && [ "$(id -u)" == "0" ];then
+ #
+ # Now, check if systemctl is aware of this running instance
+ #
+ @bindir@/systemctl is-active @package_name@@$SERV_ID.service > /dev/null 2>&1
+ if [ $? -eq 0 ]; then
+ #
+ # systemctl sees the running process, so stop it correctly
+ #
+ @bindir@/systemctl stop @package_name@@$SERV_ID.service
+ else
+ #
+ # Have to kill it since systemctl doesn't think it's running
+ #
+ kill $PID
+ fi
+ else
+ # server is running - kill it
+ kill $PID
+ fi
+
# wait for 10 minutes (600 times 1 second)
+ loop_counter=1
max_count=600
while test $loop_counter -le $max_count; do
loop_counter=`expr $loop_counter + 1`
More information about the Pkg-fedora-ds-maintainers
mailing list