Branch 'Directory_Server_8_2_Branch' - ldap/servers
by Nathan Kinder
ldap/servers/slapd/mapping_tree.c | 42 ++++++++++++++++++++++++++++++
ldap/servers/slapd/passwd_extop.c | 52 +++++++++++++++++++++++++++-----------
ldap/servers/slapd/slapi-plugin.h | 13 +++++++++
3 files changed, 92 insertions(+), 15 deletions(-)
New commits:
commit 92ca2bbfa7a3462b9e4317b0fdb6828f60612021
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Thu Apr 8 15:55:29 2010 -0700
Bug 578863 - Password modify extop needs to send referrals on replicas
The password modify extended operation was modifying the local database
on a read-only replica instead of returning a referral. The server is
designed to let the plugin ID used for updating password retry info make
local updates instead of returning a referral. This plugin ID was being
used by the password extop code, which it should not be doing.
The second issue is that we need to check if a referral needs to be sent
as early as possible when processing the extop request. We don't want
to reject the change if an entry does not exist before checking if a
referral is necessary since the server we refer to may have the target
entry present. This required adding a new helper function that allows
one to see if a write operation to a particular DN would require a
referral to be sent. The password modify extop code leverages this new
function to get the referrals and return them to the client if necessary.
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index 479909a..e9d5c3f 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -1925,6 +1925,48 @@ static int sdn_is_nulldn(const Slapi_DN *sdn){
return 0;
}
+/* Checks if a write operation for a particular DN would
+ * require a referral to be sent. */
+int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral)
+{
+ mapping_tree_node *target_node = NULL;
+ int ret = 0;
+
+ if(mapping_tree_freed){
+ /* shutdown detected */
+ goto done;
+ }
+
+ if(!mapping_tree_inited) {
+ mapping_tree_init();
+ }
+
+ if (target_sdn) {
+ mtn_lock();
+
+ /* Get the mapping tree node that is the best match for the target dn. */
+ target_node = slapi_get_mapping_tree_node_by_dn(target_sdn);
+ if (target_node == NULL) {
+ target_node = mapping_tree_root;
+ }
+
+ /* See if we need to return a referral. */
+ if ((target_node->mtn_state == MTN_REFERRAL) ||
+ (target_node->mtn_state == MTN_REFERRAL_ON_UPDATE)) {
+ *referral = (target_node->mtn_referral_entry ?
+ slapi_entry_dup(target_node->mtn_referral_entry) :
+ NULL);
+ if (*referral) {
+ ret = 1;
+ }
+ }
+
+ mtn_unlock();
+ }
+
+ done:
+ return ret;
+}
/*
* Description:
* The reason we have a mapping tree. This function selects a backend or
diff --git a/ldap/servers/slapd/passwd_extop.c b/ldap/servers/slapd/passwd_extop.c
index b5f30e0..14341f9 100644
--- a/ldap/servers/slapd/passwd_extop.c
+++ b/ldap/servers/slapd/passwd_extop.c
@@ -167,7 +167,7 @@ static int passwd_apply_mods(Slapi_PBlock *pb_orig, const char *dn, Slapi_Mods *
slapi_modify_internal_set_pb (&pb, dn,
slapi_mods_get_ldapmods_byref(mods),
req_controls_copy, NULL, /* UniqueID */
- pw_get_componentID(), /* PluginID */
+ plugin_get_default_component_id(), /* PluginID */
0); /* Flags */
/* We copy the connection from the original pblock into the
@@ -472,6 +472,8 @@ passwd_modify_extop( Slapi_PBlock *pb )
LDAPControl **req_controls = NULL;
LDAPControl **resp_controls = NULL;
passwdPolicy *pwpolicy = NULL;
+ Slapi_DN *target_sdn = NULL;
+ Slapi_Entry *referrals = NULL;
/* Slapi_DN sdn; */
LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_modify_extop\n", 0, 0, 0 );
@@ -607,19 +609,33 @@ parse_req_done:
/* LDAPDebug( LDAP_DEBUG_ARGS, "passwd: dn (%s), oldPasswd (%s) ,newPasswd (%s)\n",
dn, oldPasswd, newPasswd); */
-
- /* Get Bind DN */
- slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN );
+ /* Get Bind DN */
+ slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN );
+
+ /* Find and set the target DN. */
+ if (dn && *dn != '\0') {
+ target_sdn = slapi_sdn_new_dn_byref(dn);
+ slapi_pblock_set(pb, SLAPI_TARGET_DN, dn);
+ } else if (bindDN && *bindDN != '\0') {
+ target_sdn = slapi_sdn_new_dn_byref(bindDN);
+ slapi_pblock_set(pb, SLAPI_TARGET_DN, bindDN);
+ }
- /* If the connection is bound anonymously, we must refuse to process this operation. */
- if (bindDN == NULL || *bindDN == '\0') {
+ /* Check if we need to send any referrals. */
+ if (slapi_dn_write_needs_referral(target_sdn, &referrals)) {
+ rc = LDAP_REFERRAL;
+ goto free_and_return;
+ }
+
+ /* If the connection is bound anonymously, we must refuse to process this operation. */
+ if (bindDN == NULL || *bindDN == '\0') {
/* Refuse the operation because they're bound anonymously */
errMesg = "Anonymous Binds are not allowed.\n";
rc = LDAP_INSUFFICIENT_ACCESS;
goto free_and_return;
- }
+ }
- if (oldPasswd == NULL || *oldPasswd == '\0') {
+ if (oldPasswd == NULL || *oldPasswd == '\0') {
/* If user is authenticated, they already gave their password during
* the bind operation (or used sasl or client cert auth or OS creds) */
slapi_pblock_get(pb, SLAPI_CONN_AUTHMETHOD, &authmethod);
@@ -628,7 +644,7 @@ parse_req_done:
rc = LDAP_INSUFFICIENT_ACCESS;
goto free_and_return;
}
- }
+ }
/* Fetch the password policy. We need this in case we need to
* generate a password as well as for some policy checks. */
@@ -694,7 +710,7 @@ parse_req_done:
"Missing userIdentity in request, using the bind DN instead.\n",
0, 0, 0 );
}
-
+
slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, dn );
/* Now we have the DN, look for the entry */
@@ -807,6 +823,16 @@ parse_req_done:
/* Free anything that we allocated above */
free_and_return:
+ slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop",
+ errMesg ? errMesg : "success" );
+
+ if ((rc == LDAP_REFERRAL) && (referrals)) {
+ send_referrals_from_entry(pb, referrals);
+ } else {
+ send_ldap_result( pb, rc, NULL, errMesg, 0, NULL );
+ }
+
+ slapi_sdn_free(&target_sdn);
slapi_ch_free_string(&bindDN); /* slapi_pblock_get SLAPI_CONN_DN does strdup */
slapi_ch_free_string(&oldPasswd);
slapi_ch_free_string(&newPasswd);
@@ -821,6 +847,7 @@ free_and_return:
slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, NULL );
slapi_ch_free_string(&authmethod);
delete_passwdPolicy(&pwpolicy);
+ slapi_entry_free(referrals);
if ( targetEntry != NULL ){
slapi_entry_free (targetEntry);
@@ -831,11 +858,6 @@ free_and_return:
ber = NULL;
}
- slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop",
- errMesg ? errMesg : "success" );
- send_ldap_result( pb, rc, NULL, errMesg, 0, NULL );
-
-
/* We can free the generated password bval now */
ber_bvfree(gen_passwd);
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 2640ed1..883e966 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -2918,6 +2918,19 @@ int slapi_dn_isroot( const char *dn );
int slapi_dn_isbesuffix( Slapi_PBlock *pb, const char *dn );
/**
+ * Checks if writes to a particular DN need to send a referral.
+ *
+ * \param target_sdn The target DN that you want to check.
+ * \param referral The address of a pointer to receive a referral
+ * if one is needed.
+ * \return \c 1 if a referral needs to be sent.
+ * \return \c 0 if no referral is needed.
+ * \warning The referral entry must be freed when it is no longer
+ * being used.
+ */
+int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral);
+
+/**
* Converts the second RDN type value to the berval value.
*
* Returns the new RDN value as a berval value in \c bv. This function
14 years
ldap/servers
by Nathan Kinder
ldap/servers/slapd/mapping_tree.c | 42 ++++++++++++++++++++++++++++++
ldap/servers/slapd/passwd_extop.c | 52 +++++++++++++++++++++++++++-----------
ldap/servers/slapd/slapi-plugin.h | 13 +++++++++
3 files changed, 92 insertions(+), 15 deletions(-)
New commits:
commit c53b8b31c8655d8b387c4b213caee885778c3872
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Thu Apr 8 15:55:29 2010 -0700
Bug 578863 - Password modify extop needs to send referrals on replicas
The password modify extended operation was modifying the local database
on a read-only replica instead of returning a referral. The server is
designed to let the plugin ID used for updating password retry info make
local updates instead of returning a referral. This plugin ID was being
used by the password extop code, which it should not be doing.
The second issue is that we need to check if a referral needs to be sent
as early as possible when processing the extop request. We don't want
to reject the change if an entry does not exist before checking if a
referral is necessary since the server we refer to may have the target
entry present. This required adding a new helper function that allows
one to see if a write operation to a particular DN would require a
referral to be sent. The password modify extop code leverages this new
function to get the referrals and return them to the client if necessary.
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
index 8b4c541..645618c 100644
--- a/ldap/servers/slapd/mapping_tree.c
+++ b/ldap/servers/slapd/mapping_tree.c
@@ -1925,6 +1925,48 @@ static int sdn_is_nulldn(const Slapi_DN *sdn){
return 0;
}
+/* Checks if a write operation for a particular DN would
+ * require a referral to be sent. */
+int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral)
+{
+ mapping_tree_node *target_node = NULL;
+ int ret = 0;
+
+ if(mapping_tree_freed){
+ /* shutdown detected */
+ goto done;
+ }
+
+ if(!mapping_tree_inited) {
+ mapping_tree_init();
+ }
+
+ if (target_sdn) {
+ mtn_lock();
+
+ /* Get the mapping tree node that is the best match for the target dn. */
+ target_node = slapi_get_mapping_tree_node_by_dn(target_sdn);
+ if (target_node == NULL) {
+ target_node = mapping_tree_root;
+ }
+
+ /* See if we need to return a referral. */
+ if ((target_node->mtn_state == MTN_REFERRAL) ||
+ (target_node->mtn_state == MTN_REFERRAL_ON_UPDATE)) {
+ *referral = (target_node->mtn_referral_entry ?
+ slapi_entry_dup(target_node->mtn_referral_entry) :
+ NULL);
+ if (*referral) {
+ ret = 1;
+ }
+ }
+
+ mtn_unlock();
+ }
+
+ done:
+ return ret;
+}
/*
* Description:
* The reason we have a mapping tree. This function selects a backend or
diff --git a/ldap/servers/slapd/passwd_extop.c b/ldap/servers/slapd/passwd_extop.c
index b5f30e0..14341f9 100644
--- a/ldap/servers/slapd/passwd_extop.c
+++ b/ldap/servers/slapd/passwd_extop.c
@@ -167,7 +167,7 @@ static int passwd_apply_mods(Slapi_PBlock *pb_orig, const char *dn, Slapi_Mods *
slapi_modify_internal_set_pb (&pb, dn,
slapi_mods_get_ldapmods_byref(mods),
req_controls_copy, NULL, /* UniqueID */
- pw_get_componentID(), /* PluginID */
+ plugin_get_default_component_id(), /* PluginID */
0); /* Flags */
/* We copy the connection from the original pblock into the
@@ -472,6 +472,8 @@ passwd_modify_extop( Slapi_PBlock *pb )
LDAPControl **req_controls = NULL;
LDAPControl **resp_controls = NULL;
passwdPolicy *pwpolicy = NULL;
+ Slapi_DN *target_sdn = NULL;
+ Slapi_Entry *referrals = NULL;
/* Slapi_DN sdn; */
LDAPDebug( LDAP_DEBUG_TRACE, "=> passwd_modify_extop\n", 0, 0, 0 );
@@ -607,19 +609,33 @@ parse_req_done:
/* LDAPDebug( LDAP_DEBUG_ARGS, "passwd: dn (%s), oldPasswd (%s) ,newPasswd (%s)\n",
dn, oldPasswd, newPasswd); */
-
- /* Get Bind DN */
- slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN );
+ /* Get Bind DN */
+ slapi_pblock_get( pb, SLAPI_CONN_DN, &bindDN );
+
+ /* Find and set the target DN. */
+ if (dn && *dn != '\0') {
+ target_sdn = slapi_sdn_new_dn_byref(dn);
+ slapi_pblock_set(pb, SLAPI_TARGET_DN, dn);
+ } else if (bindDN && *bindDN != '\0') {
+ target_sdn = slapi_sdn_new_dn_byref(bindDN);
+ slapi_pblock_set(pb, SLAPI_TARGET_DN, bindDN);
+ }
- /* If the connection is bound anonymously, we must refuse to process this operation. */
- if (bindDN == NULL || *bindDN == '\0') {
+ /* Check if we need to send any referrals. */
+ if (slapi_dn_write_needs_referral(target_sdn, &referrals)) {
+ rc = LDAP_REFERRAL;
+ goto free_and_return;
+ }
+
+ /* If the connection is bound anonymously, we must refuse to process this operation. */
+ if (bindDN == NULL || *bindDN == '\0') {
/* Refuse the operation because they're bound anonymously */
errMesg = "Anonymous Binds are not allowed.\n";
rc = LDAP_INSUFFICIENT_ACCESS;
goto free_and_return;
- }
+ }
- if (oldPasswd == NULL || *oldPasswd == '\0') {
+ if (oldPasswd == NULL || *oldPasswd == '\0') {
/* If user is authenticated, they already gave their password during
* the bind operation (or used sasl or client cert auth or OS creds) */
slapi_pblock_get(pb, SLAPI_CONN_AUTHMETHOD, &authmethod);
@@ -628,7 +644,7 @@ parse_req_done:
rc = LDAP_INSUFFICIENT_ACCESS;
goto free_and_return;
}
- }
+ }
/* Fetch the password policy. We need this in case we need to
* generate a password as well as for some policy checks. */
@@ -694,7 +710,7 @@ parse_req_done:
"Missing userIdentity in request, using the bind DN instead.\n",
0, 0, 0 );
}
-
+
slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, dn );
/* Now we have the DN, look for the entry */
@@ -807,6 +823,16 @@ parse_req_done:
/* Free anything that we allocated above */
free_and_return:
+ slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop",
+ errMesg ? errMesg : "success" );
+
+ if ((rc == LDAP_REFERRAL) && (referrals)) {
+ send_referrals_from_entry(pb, referrals);
+ } else {
+ send_ldap_result( pb, rc, NULL, errMesg, 0, NULL );
+ }
+
+ slapi_sdn_free(&target_sdn);
slapi_ch_free_string(&bindDN); /* slapi_pblock_get SLAPI_CONN_DN does strdup */
slapi_ch_free_string(&oldPasswd);
slapi_ch_free_string(&newPasswd);
@@ -821,6 +847,7 @@ free_and_return:
slapi_pblock_set( pb, SLAPI_ORIGINAL_TARGET, NULL );
slapi_ch_free_string(&authmethod);
delete_passwdPolicy(&pwpolicy);
+ slapi_entry_free(referrals);
if ( targetEntry != NULL ){
slapi_entry_free (targetEntry);
@@ -831,11 +858,6 @@ free_and_return:
ber = NULL;
}
- slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_extop",
- errMesg ? errMesg : "success" );
- send_ldap_result( pb, rc, NULL, errMesg, 0, NULL );
-
-
/* We can free the generated password bval now */
ber_bvfree(gen_passwd);
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 9229ea7..f7683b5 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -3140,6 +3140,19 @@ int slapi_dn_isroot( const char *dn );
int slapi_dn_isbesuffix( Slapi_PBlock *pb, const char *dn );
/**
+ * Checks if writes to a particular DN need to send a referral.
+ *
+ * \param target_sdn The target DN that you want to check.
+ * \param referral The address of a pointer to receive a referral
+ * if one is needed.
+ * \return \c 1 if a referral needs to be sent.
+ * \return \c 0 if no referral is needed.
+ * \warning The referral entry must be freed when it is no longer
+ * being used.
+ */
+int slapi_dn_write_needs_referral(Slapi_DN *target_sdn, Slapi_Entry **referral);
+
+/**
* Converts the second RDN type value to the berval value.
*
* Returns the new RDN value as a berval value in \c bv. This function
14 years
esc/mac/coolkey_package_data/Resources Welcome, 1.1, 1.2
by Jack Magne
Author: jmagne
Update of /cvs/dirsec/esc/mac/coolkey_package_data/Resources
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv31286
Added Files:
Welcome
Log Message:
Replace missing Welcome text file for the installer.
Index: Welcome
===================================================================
RCS file: Welcome
diff -N Welcome
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ Welcome 7 Apr 2010 18:45:06 -0000 1.2
@@ -0,0 +1,13 @@
+Please remove all smart cards from the computer before proceeding.
+
+After successfully installing this package, this computer can be used to manage and use smart cards for common cryptographic operations such as secure mail and secure web site access..
+
+
+The following Smart Card related components will be installed:
+
+1. The Smart Card Manager application (ESC), used to manage smart cards.
+
+2. The CoolKey PKCS#11 driver, used to recognize CoolKey smart cards.
+
+3. The CoolKey Smart CArd "Tokend" driver, used by Apple Mail and Safari to recognize CoolKey smart cards.
+
14 years
esc/mac/coolkey_package_data/Resources Welcome, NONE, 1.1.2.1
by Jack Magne
Author: jmagne
Update of /cvs/dirsec/esc/mac/coolkey_package_data/Resources
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv31170
Added Files:
Tag: PKI_8_0_RTM_BRANCH
Welcome
Log Message:
Replace missing Welcome text file for the installer.
--- NEW FILE Welcome ---
Please remove all smart cards from the computer before proceeding.
After successfully installing this package, this computer can be used to manage and use smart cards for common cryptographic operations such as secure mail and secure web site access..
The following Smart Card related components will be installed:
1. The Smart Card Manager application (ESC), used to manage smart cards.
2. The CoolKey PKCS#11 driver, used to recognize CoolKey smart cards.
3. The CoolKey Smart CArd "Tokend" driver, used by Apple Mail and Safari to recognize CoolKey smart cards.
14 years
ldap/servers
by Richard Allen Megginson
ldap/servers/plugins/syntaxes/string.c | 6 +++---
ldap/servers/slapd/filterentry.c | 6 +++++-
ldap/servers/slapd/proto-slap.h | 2 +-
3 files changed, 9 insertions(+), 5 deletions(-)
New commits:
commit b433e4c852a2ef78558dffc1ccbaf464c1186934
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Apr 7 10:16:22 2010 -0600
Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements.
https://bugzilla.redhat.com/show_bug.cgi?id=572162
Resolves: bug 572162
Bug Description: the string "|*" within a search filter on a non-indexed attribute returns all elements.
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: PCRE interprets the '|' character as the start of
alternative branch. In the search filter, the other side of the '|' is
empty, which means match everything. The solution is to escape this and
other PCRE special chars before matching.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
diff --git a/ldap/servers/plugins/syntaxes/string.c b/ldap/servers/plugins/syntaxes/string.c
index dd44a80..9b33833 100644
--- a/ldap/servers/plugins/syntaxes/string.c
+++ b/ldap/servers/plugins/syntaxes/string.c
@@ -262,7 +262,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final,
if ( initial != NULL ) {
value_normalize( initial, syntax, 1 /* trim leading blanks */ );
*p++ = '^';
- filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_PARENS );
+ filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_RECHARS );
p = strchr( p, '\0' );
}
if ( any != NULL ) {
@@ -271,7 +271,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final,
/* ".*" + value */
*p++ = '.';
*p++ = '*';
- filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_PARENS );
+ filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_RECHARS );
p = strchr( p, '\0' );
}
}
@@ -280,7 +280,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final,
/* ".*" + value */
*p++ = '.';
*p++ = '*';
- filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_PARENS );
+ filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_RECHARS );
strcat( p, "$" );
}
diff --git a/ldap/servers/slapd/filterentry.c b/ldap/servers/slapd/filterentry.c
index f163b47..fad7362 100644
--- a/ldap/servers/slapd/filterentry.c
+++ b/ldap/servers/slapd/filterentry.c
@@ -663,7 +663,11 @@ filter_strcpy_special_ext( char *d, char *s, int flags )
break;
case '(':
case ')':
- if (flags & FILTER_STRCPY_ESCAPE_PARENS) {
+ case '}':
+ case '{':
+ case '|':
+ case '?':
+ if (flags & FILTER_STRCPY_ESCAPE_RECHARS) {
*d++ = '\\';
}
break;
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index e67cfae..68d5d48 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -595,7 +595,7 @@ void set_hash_filters(int i);
* filterentry.c
*/
void filter_strcpy_special( char *d, char *s );
-#define FILTER_STRCPY_ESCAPE_PARENS 0x01
+#define FILTER_STRCPY_ESCAPE_RECHARS 0x01
void filter_strcpy_special_ext( char *d, char *s, int flags );
14 years
Branch 'Directory_Server_8_2_Branch' - ldap/servers
by Richard Allen Megginson
ldap/servers/plugins/syntaxes/string.c | 6 +++---
ldap/servers/slapd/filterentry.c | 6 +++++-
ldap/servers/slapd/proto-slap.h | 2 +-
3 files changed, 9 insertions(+), 5 deletions(-)
New commits:
commit 7b29561a0614032f12bd7151841f5150da9d4cb0
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Wed Apr 7 10:16:22 2010 -0600
Bug 572162 - the string "|*" within a search filter on a non-indexed attribute returns all elements.
https://bugzilla.redhat.com/show_bug.cgi?id=572162
Resolves: bug 572162
Bug Description: the string "|*" within a search filter on a non-indexed attribute returns all elements.
Reviewed by: nhosoi (Thanks!)
Branch: Directory_Server_8_2_Branch
Fix Description: PCRE interprets the '|' character as the start of
alternative branch. In the search filter, the other side of the '|' is
empty, which means match everything. The solution is to escape this and
other PCRE special chars before matching.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit b433e4c852a2ef78558dffc1ccbaf464c1186934)
diff --git a/ldap/servers/plugins/syntaxes/string.c b/ldap/servers/plugins/syntaxes/string.c
index dd44a80..9b33833 100644
--- a/ldap/servers/plugins/syntaxes/string.c
+++ b/ldap/servers/plugins/syntaxes/string.c
@@ -262,7 +262,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final,
if ( initial != NULL ) {
value_normalize( initial, syntax, 1 /* trim leading blanks */ );
*p++ = '^';
- filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_PARENS );
+ filter_strcpy_special_ext( p, initial, FILTER_STRCPY_ESCAPE_RECHARS );
p = strchr( p, '\0' );
}
if ( any != NULL ) {
@@ -271,7 +271,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final,
/* ".*" + value */
*p++ = '.';
*p++ = '*';
- filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_PARENS );
+ filter_strcpy_special_ext( p, any[i], FILTER_STRCPY_ESCAPE_RECHARS );
p = strchr( p, '\0' );
}
}
@@ -280,7 +280,7 @@ string_filter_sub( Slapi_PBlock *pb, char *initial, char **any, char *final,
/* ".*" + value */
*p++ = '.';
*p++ = '*';
- filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_PARENS );
+ filter_strcpy_special_ext( p, final, FILTER_STRCPY_ESCAPE_RECHARS );
strcat( p, "$" );
}
diff --git a/ldap/servers/slapd/filterentry.c b/ldap/servers/slapd/filterentry.c
index f163b47..fad7362 100644
--- a/ldap/servers/slapd/filterentry.c
+++ b/ldap/servers/slapd/filterentry.c
@@ -663,7 +663,11 @@ filter_strcpy_special_ext( char *d, char *s, int flags )
break;
case '(':
case ')':
- if (flags & FILTER_STRCPY_ESCAPE_PARENS) {
+ case '}':
+ case '{':
+ case '|':
+ case '?':
+ if (flags & FILTER_STRCPY_ESCAPE_RECHARS) {
*d++ = '\\';
}
break;
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index d428ff9..a21380e 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -574,7 +574,7 @@ void set_hash_filters(int i);
* filterentry.c
*/
void filter_strcpy_special( char *d, char *s );
-#define FILTER_STRCPY_ESCAPE_PARENS 0x01
+#define FILTER_STRCPY_ESCAPE_RECHARS 0x01
void filter_strcpy_special_ext( char *d, char *s, int flags );
14 years
src/com
by Richard Allen Megginson
src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
New commits:
commit 50cd061a5adc99b886d78ee2bbb2f0dd1cdf47f8
Author: Endi S. Dewata <edewata(a)redhat.com>
Date: Wed Mar 31 00:32:02 2010 -0500
Bug 563513 - New replication -> No changelong configured-msg
Resolves: bug 563513
Bug Description: New replication -> No changelong configured-msg
Fix Description: The ReplicaResourceObject.actionMenuSelected() has been modified to display the proper message if the changelog is not configured.
Platforms tested: F12
Reviewed by: rmeggins (and pushed by)
diff --git a/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java b/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java
index 9d24241..aa0ce37 100644
--- a/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java
+++ b/src/com/netscape/admin/dirserv/panel/replication/ReplicaResourceObject.java
@@ -198,8 +198,7 @@ public class ReplicaResourceObject extends DSResourceObject
}
if (!logChangesExists) {
ReplicationTool.displayError(
- _model.getFrame(), "no changelong configured",
- // "replication-err-noReplicaOrChangelog",
+ _model.getFrame(), "replication-err-noReplicaOrChangelog",
"title", "msg", null);
return;
}
14 years
Branch 'Directory_Server_8_2_Branch' - ldap/admin
by Richard Allen Megginson
ldap/admin/src/scripts/start-dirsrv.in | 1 +
1 file changed, 1 insertion(+)
New commits:
commit a640bf6f589c915085be1de27e1261650ccb2528
Author: Endi S. Dewata <edewata(a)redhat.com>
Date: Tue Mar 30 08:48:44 2010 -0500
Bug 566043 - startpid file is only cleaned by initscript runs
https://bugzilla.redhat.com/show_bug.cgi?id=566043
Resolves: bug 566043
Branch: Directory_Server_8_2_Branch
Bug description: startpid file is only cleaned by initscript runs
Fix description: The start-dirsrv script has been modified to remove
the startpid file if the server starts successfully.
Reviewed by: rmeggins (and pushed by)
(cherry picked from commit 0c9d4590489066d2f8dc945c9749c429972e78a9)
diff --git a/ldap/admin/src/scripts/start-dirsrv.in b/ldap/admin/src/scripts/start-dirsrv.in
index 46c48d7..d3788be 100755
--- a/ldap/admin/src/scripts/start-dirsrv.in
+++ b/ldap/admin/src/scripts/start-dirsrv.in
@@ -83,6 +83,7 @@ start_instance() {
fi
else
PID=`cat $PIDFILE`
+ rm -f $STARTPIDFILE
return 0;
fi
done
14 years
ldap/admin
by Richard Allen Megginson
ldap/admin/src/scripts/start-dirsrv.in | 1 +
1 file changed, 1 insertion(+)
New commits:
commit 0c9d4590489066d2f8dc945c9749c429972e78a9
Author: Endi S. Dewata <edewata(a)redhat.com>
Date: Tue Mar 30 08:48:44 2010 -0500
Bug 566043 - startpid file is only cleaned by initscript runs
https://bugzilla.redhat.com/show_bug.cgi?id=566043
Resolves: bug 566043
Bug description: startpid file is only cleaned by initscript runs
Fix description: The start-dirsrv script has been modified to remove
the startpid file if the server starts successfully.
Reviewed by: rmeggins (and pushed by)
diff --git a/ldap/admin/src/scripts/start-dirsrv.in b/ldap/admin/src/scripts/start-dirsrv.in
index 4e95785..d7144d1 100755
--- a/ldap/admin/src/scripts/start-dirsrv.in
+++ b/ldap/admin/src/scripts/start-dirsrv.in
@@ -83,6 +83,7 @@ start_instance() {
fi
else
PID=`cat $PIDFILE`
+ rm -f $STARTPIDFILE
return 0;
fi
done
14 years
esc/mac/coolkey_package_data/Resources InstallationCheck, 1.1, 1.2 InstallationCheck.strings, 1.1, 1.2
by Jack Magne
Author: jmagne
Update of /cvs/dirsec/esc/mac/coolkey_package_data/Resources
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv18487
Added Files:
InstallationCheck InstallationCheck.strings
Log Message:
Improve installer for mac, bug#369031.
Index: InstallationCheck
===================================================================
RCS file: InstallationCheck
diff -N InstallationCheck
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ InstallationCheck 6 Apr 2010 23:25:57 -0000 1.2
@@ -0,0 +1,155 @@
+#!/bin/bash
+
+# BEGIN COPYRIGHT BLOCK
+ # This Program is free software; you can redistribute it and/or modify it under
+ # the terms of the GNU General Public License as published by the Free Software
+ # Foundation; version 2 of the License.
+ #
+ # This Program is distributed in the hope that it will be useful, but WITHOUT
+ # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ # FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ #
+ # You should have received a copy of the GNU General Public License along with
+ # this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ # Place, Suite 330, Boston, MA 02111-1307 USA.
+ #
+ # Copyright (C) 2005 Red Hat, Inc.
+ # All rights reserved.
+ # END COPYRIGHT BLOCK **/
+
+ESC_APP="ESC.app"
+COOLKEY_TOKEND="COOLKEY.tokend"
+PCSC_LITE="/usr/sbin/pcscd"
+LIB_COOLKEY="libcoolkeypk11.dylib"
+MIN_OS_VERSION="10.5.0"
+
+function IsRunning {
+
+if ps -A | grep -v grep | grep $1 > /dev/null
+then
+ return 1
+fi
+
+return 0
+}
+
+function IsInUse {
+
+lsof | grep $1
+
+if [ $? -eq 0 ];
+then
+ return 1
+fi
+
+return 0
+}
+
+#Assure proper OS Version
+
+function IsLegalOSVersion {
+
+# Input parameter is string of mininum legal version
+version=`sw_vers -productVersion`
+
+min_version=$1
+
+OLD_IFS="$IFS"
+IFS="."
+
+version_array=( $version )
+min_version_array=( $min_version )
+
+IFS="$OLD_IFS"
+
+#echo ${min_version_array[0]}
+#echo ${min_version_array[1]}
+#echo ${min_version_array[2]}
+
+#echo ${version_array[0]}
+#echo ${version_array[1]}
+#echo ${version_array[2]}
+
+let "major=version_array[0] + 0"
+let "min_major=min_version_array[0] + 0"
+
+let "minor=version_array[1] + 0"
+let "min_minor=min_version_array[1] + 0"
+
+let "release=version_array[2] + 0"
+let "min_release=min_version_array[2] + 0"
+
+if [ $major -ge $min_major ];
+then
+ echo "major ok"
+else
+ echo "major no ok" $major
+ return 0
+fi
+
+if [ $minor -ge $min_minor ];
+then
+ echo "minor ok"
+else
+ echo "minor no ok" $minor
+ return 0
+fi
+
+if [ $release -ge $min_release ];
+then
+ echo "release ok"
+else
+ echo "release no ok" $release
+ return 0
+fi
+
+return 1
+}
+
+#check for Leopard or above
+
+IsLegalOSVersion $MIN_OS_VERSION
+
+if [ $? -eq 0 ];
+then
+ exit 112
+fi
+
+# check esc
+
+IsRunning $ESC_APP
+
+if [ $? -eq 1 ];
+then
+ exit 113
+fi
+
+# check COOLKEY.tokend
+
+IsRunning $COOLKEY_TOKEND
+
+if [ $? -eq 1 ];
+then
+ exit 114
+fi
+
+#check pcscd
+
+IsRunning $PCSC_LITE
+
+if [ $? -eq 1 ];
+then
+ exit 115
+fi
+
+# check to see of libcooleypk11.dylib is in use
+
+IsInUse $LIB_COOLKEY
+
+if [ $? -eq 1 ];
+then
+ echo "COOLKEY PKCS#11 module in use."
+ exit 116
+fi
+
+exit 0
Index: InstallationCheck.strings
===================================================================
RCS file: InstallationCheck.strings
diff -N InstallationCheck.strings
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ InstallationCheck.strings 6 Apr 2010 23:25:57 -0000 1.2
@@ -0,0 +1,6 @@
+"16" = "Mac OS X, version 10.5 or later is required for this software.";
+"17" = "Please close any running instances of the ESC SmartCardManager and try again.";
+"18" = "Please make sure all COOLKEY smart cards are removed from the computer and try again.";
+"19" = "Please make sure all smart cards are removed from the computer and try again.";
+"20" = "Please close all Mozilla browsers and mail clients that may be using the COOLKEY PKCS#11 module and try again.";
+
14 years