Changes to 'refs/tags/389-admin-1.1.43'
by Noriko Hosoi
Changes since 389-admin-1.1.11:
Endi S. Dewata (3):
Bug 573889 - Migration does not remove deprecated schema
Bug 644929 - FDS to 389 DS migration results in both Fedora and 389 entries
Bug 470576 - Migration could do addition checks before commiting actions
Ludwig (1):
Ticket 47563 - cannot restart directory server from console
Mark Reynolds (17):
Ticket #286 - compilation fixes for 'format-security'
Ticket 401 - Console login fails with anonymous access disabled
Ticket 400 - BIND operation result not checked properly in admin server
Ticket 47665 - Create new instance results in setting wrong ACI for the "cn=config" entry
Ticket 47495 - admin express: wrong instance creation time
Ticket 47497 - Admin Express - remove "Security Level"
Ticket 47850 - "nsslapd-allow-anonymous-access: rootdse" makes login as "admin" fail at the first time
Ticket 47300 - Update man page for remove-ds-admin.pl
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain
Ticket 47548 - register-ds-admin does not register into remote config ds
Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot
Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c
Ticket 201 - nCipher HSM cannot be configured via the console
Ticket 47929 - Admin Server - disable SSLv3 by default
Ticket 47548 - register-ds-admin.pl fails to set local bind DN and password
Ticket 47548 - register-ds-admin - silent file incorrectly processed
Nathan Kinder (49):
Bug 648949 - Merge selinux policy into base OS
Regenerated autoconf files
Bug 638511 - dirsrv-admin crashes at startup with SELinux enabled
Bug 668950 - Add posix group support to Console
Bug 672468 - Don't use empty path elements in LD_LIBRARY_PATH
Bug 618897 - Wrong permissions when creating instance from Console
Bug 493424 - remove unneeded modules for admin server apache config
Bug 614690 - Don't use exec to call genrb
Bug 699815 - (cov#10859) Add missing braces in mod_admserv code
Bug 699815 - (cov#10858) getenv() called twice in viewlog cgi
Bug 699815 - (cov#10849,10851) Remove unused variables
Bug 699907 - (cov#10844) Uninitialized time struct
Bug 699907 - (cov#10843) Use of uninitialized variable in logging code
Bug 699907 - (cov#10840) Use of uninitialized buffer in security cgi
Bug 699907 - (cov#10836) Use of uninitialized var in http conn code
Bug 699907 - (cov#10833) Use of uninitialized vars in SNMP code
Bug 700532 - (cov#10832) Incorrect if condition in dsalib
Bug 700875 - (cov#10778) Cleanup ds_bring_up_server_install() in dsalib
Bug 700890 - (cov#10812) Check return value of open() properly in libadmin
Bug 700948 - (cov#10846) - Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10845) Use of uninitialized variable in mod_admserv
Bug 700948 - (cov#10839) Use of uninitialized variable in security cgi
Bug 700948 - (cov#10837) Use of uninitialized variable in monreplication
Bug 700948 - (cov#10835) Use of unitialized pointer in config cgi
Bug 700948 - (cov#10813) dynamic overrun possibility in ds_listdb cgi
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 700948 - (cov#10842) Use of unintialized variable in statusping
Bug 702150 - (cov#10823) File descriptors leaked in help cgi
Bug 702150 - (cov#10822,10821) file descriptor leaks in config cgi
Bug 702150 - (cov#10820,10819) file descriptor leaks in readlog cgi
Bug 702150 - leak of config array in dsalib
Bug 702150 - (cov#10816) file descriptor leak in dsalib
Bug 702150 - (cov#10817) Leak of string in libdsa
Bug 702150 - Resouce leaks in htmladmin.c
Bug 702705 - (cov#10830) NULL pointer dereference in htmladmin
Bug 702705 - NULL pointer dereferences in viewlog cgi
Bug 702705 - (cov#10803) NULL pointer dereference in security cgi
Bug 702705 - (cov#10785) NULL pointer dereference in ds_snmpctrl
Bug 702705 - (cov#10784,10783) NULL pointer dereferences in dsalib
Bug 719056 - migrate-ds-admin.pl needs to update SELinux policy
Bug 724808 - startup CGIs write temp file to /
Bug 730079 - Update SELinux policy during upgrades
Ticket #329 - Port modules to httpd 2.4
Ticket #47333 - Relabel lockfile when starting Admin Server
Ticket #47334 - Avoid quoting all settings in console.conf
Ticket 47468 - Change security password validation error is out of order
Ticket 47466 - Importing CA cert with existing name crashes security CGI
Ticket 362 - Directory Console generates insufficient key strength
Ticket 47467 - Improve CRL import error messages
Noriko Hosoi (41):
Bug 151705 - Need to update Console Cipher Preferences with new ciphers
start-ds-admin.in -- replaced "return 1" with "exit 1"
Bug 616260 - libds-admin-serv linking fails due to unresolved link-time dependencies
Bug 618858 - move start-ds-admin env file into main admin server
Bug 387981 - plain files can be chosen on the Restore Directory dialog
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 604881 - admin server log files have incorrect permissions/ownerships
Bug 245278 - Changing to a password with a single quote does not work
Bug 211296 - Clean up all HTML pages (Admin Express, Repl Monitor, etc)
Bug 158926 - Unable to install CA certificate when using
Bug 476925 - Admin Server: Do not allow 8-bit passwords for the admin user
Bug 476925 - Admin Server: Do not allow 8-bit passwords for
Trac Ticket #307 - htmladmin keeps segfaulting
If htmladmin fails to connect to the server, the cgi could crash.
Ticket #293 - remove-ds-admin.pl does not remove everything
Ticket #476 - 389 ds do not start on F18 due to missing modules
bump version to 1.1.31
Ticket #567 - Restart of Admin server from console fails on segfault
bump version to 1.1.32
bump version to 1.1.33
bump version to 1.1.34
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.36
Ticket 47891 - Admin Server reconfig breaks SSL config
Ticket #47995 - Admin Server: source code cleaning
bump version to 1.1.37
Ticket #48024 - repl-monitor invoked from adminserver cgi fails
bump version to 1.1.38
Ticket #48153 - [adminserver] support NSS 3.18
bump version to 1.1.39
Ticket #48171 - remove-ds-admin.pl removes files in the rpm
Ticket #47467 - Improve Add CRL/CKL dialog and errors
bump version to 1.1.40
Ticket #48186 - register-ds-admin.pl script prints clear text password in the terminal
Ticket #47493 - Configuration Tab does not work with FIPS mode enabled
bump version to 1.1.41
bump version to 1.1.42
Ticket #48409 - RHDS upgrade change Ownership of certificate files upon upgrade.
Ticket #48410 - 389-admin - Unable to remove / unregister a DS instance from admin server
Ticket #48429 - running remove-ds-admin.pl multiple times will make it so you cannot install DS
bump version to 1.1.43
Rich Megginson (66):
bump version to 1.1.12.a1
initial support for openldap
add selinux policy for dsgw
skip LD_PRELOAD if using openldap
add more log information if nss init fails
add even more nss debugging
Bug 618454 - mod_admserv should only clear NSS caches and shutdown if NSS is initialized
bump version to 1.1.12.a2
fix building with mozldap
bump version to 1.1.12.a3
fix autotool build issues with properties files
setup-ds-admin.pl -u exits with ServerAdminID and as_uid related error
Bug 656441 - Missing library path entry causes LD_PRELOAD error
bump version to 1.1.13
bump version to 1.1.14.a1
Bug 664671 - Admin server segfault when full SSL access (http+ldap+console) required
bump version to 1.1.14
bump version to 1.1.15
bump version to 1.1.16
Bug 703990 - Support upgrade from Red Hat Directory Server
bump version to 1.1.17
add support for different skins
skip rebranding current brand
bump version to 1.1.18
look for separate openldap ldif library
bump version to 1.1.19
Bug 710372 - Not able to open the Manage Certificate from DS-console
better NSS error handling - reduce memory leaks
fix typo in NSS_Shutdown warning message
added tests for the security cgi
Bug 713000 - Migration stops if old admin server cannot be stopped
Bug 718079 - Perl errors when running migrate-ds-admin.pl
Bug 718285 - AdminServer should use "service" command instead of start/stop/restart scripts
bump version to 1.1.20
bump version to 1.1.21
handle binary upgrade
add man pages for ds_removal and ds_unregister
bump version to 1.1.22
fix binary paths
bump version to 1.1.23
bump version to 1.1.24
Bug 695741 - Providing native systemd file for upcoming F16 Feature Systemd
Bug 740959 - 389-console put CA certificates into wrong database
bump version to 1.1.25
Bug 767823 - selinux: need to allow admin server to connect to ldap port
bump version to 1.1.26
Ticket #161 - Review and address latest Coverity issues
Ticket #281 - TLS not working with latest openldap
bump version to 1.1.27
bump version to 1.1.28
bump version to 1.1.29
bump version to 1.1.30
ignore files generated by Eclipse
Ticket #47486 compiler warnings in adminutil, admin, dsgw
Ticket #47465 problem with 389-adminutil detection in m4/adminutil.m4 in 389-admin and 389-dsgw
add more debugging for SSL connection problems
Ticket #47413 389-admin fails to build with latest httpd
compiler warning - ldif_read_record lineno type depends on openldap version
add Eclipse and patch files
bump version to 1.1.35
Ticket #47498 Error Message for Failed to create the configuration directory server
Ticket #418 Error with register-ds-admin.pl
Ticket #222 Admin Express issues "Internal Server Error" when the Config DS is down.
Ticket #434 admin-serv logs filling with "admserv_host_ip_check: ap_get_remote_host could not resolve <ip address>"
Ticket #47300 [RFE] remove-ds-admin.pl: redesign the behaviour
Ticket #47478 No groups file? error restarting Admin server
Wes Hardin (1):
fix for bug 377 - Unchecked use of SELinux command
William Brown (1):
Ticket 47840 - Fix setup-ds-admin.pl to create adm.conf with sbin scripts
noriko (1):
Ticket #47298 - remove-ds-admin.pl does not stop the admin server
---
.gitignore | 4
Makefile.am | 109
Makefile.in | 1767 -
VERSION.sh | 4
aclocal.m4 | 7258 ----
admserv/cfgstuff/console.conf.in | 2
admserv/cfgstuff/httpd-2.2.conf.in | 13
admserv/cfgstuff/httpd-2.4.conf.in | 742
admserv/cfgstuff/httpd.conf.in | 2
admserv/cfgstuff/initconfig.in | 5
admserv/cfgstuff/start-ds-admin.in | 83
admserv/cgi-ds/ds_listdb.c | 26
admserv/cgi-ds/ds_snmpctrl.c | 5
admserv/cgi-src40/ReadLog.c | 18
admserv/cgi-src40/admlib.mk | 119
admserv/cgi-src40/admpw.c | 79
admserv/cgi-src40/cgicommon.h | 1
admserv/cgi-src40/cgicommon.properties | 3
admserv/cgi-src40/config.c | 47
admserv/cgi-src40/dllglue.c | 42
admserv/cgi-src40/ds_create.in | 18
admserv/cgi-src40/ds_remove.in | 6
admserv/cgi-src40/dsconfig.c | 10
admserv/cgi-src40/head.html | 1
admserv/cgi-src40/help.c | 15
admserv/cgi-src40/htmladmin.c | 810
admserv/cgi-src40/htmladmin.properties | 42
admserv/cgi-src40/monreplication.c | 7
admserv/cgi-src40/repl-monitor-cgi.pl.in | 30
admserv/cgi-src40/restartsrv.c | 9
admserv/cgi-src40/sec-activate.c | 163
admserv/cgi-src40/security.c | 348
admserv/cgi-src40/security.properties | 8
admserv/cgi-src40/start_config_ds.c | 11
admserv/cgi-src40/statpingserv.c | 82
admserv/cgi-src40/stopsrv.c | 10
admserv/cgi-src40/ugdsconfig.c | 39
admserv/cgi-src40/viewdata.c | 264
admserv/cgi-src40/viewdata.properties | 2
admserv/cgi-src40/viewlog.c | 75
admserv/cgi-src40/viewlog.properties | 6
admserv/genrb_wrapper.sh | 2
admserv/html/admserv.html.in | 11
admserv/html/htmladmin.html.in | 13
admserv/html/monreplication.html | 20
admserv/html/viewdata.html | 6
admserv/html/viewlog.html | 14
admserv/makeUpgradeTar.sh | 30
admserv/newinst/src/25changefedorato389.pl | 250
admserv/newinst/src/25rebrand.pl.in | 413
admserv/newinst/src/30updateglobalpref.pl.in | 9
admserv/newinst/src/AdminMigration.pm.in | 79
admserv/newinst/src/AdminServer.pm.in | 282
admserv/newinst/src/AdminUtil.pm.in | 91
admserv/newinst/src/ConfigDSDialogs.pm | 42
admserv/newinst/src/dirserver.map.in | 1
admserv/newinst/src/register-ds-admin.pl.in | 719
admserv/newinst/src/register-ds-admin.res.in | 38
admserv/newinst/src/register_param.map.in | 4
admserv/newinst/src/register_server.pl.in | 6
admserv/newinst/src/remove-ds-admin.pl.in | 8
admserv/newinst/src/setup-ds-admin.pl.in | 6
admserv/newinst/src/setup-ds-admin.res.in | 20
admserv/schema/ldif/02globalpreferences.ldif.tmpl | 49
admserv/schema/ldif/10dsdata.ldif.tmpl | 39
compile | 240
config.guess | 529
config.h.in | 33
config.sub | 379
configure |38698 +++++++++-------------
configure.ac | 111
depcomp | 343
include/base/file.h | 3
include/base/util.h | 3
include/libadmin/dbtlibadmin.h | 2
include/libadmin/libadmin.h | 92
include/libdsa/dsalib.h | 15
install-sh | 538
lib/base/file.cpp | 30
lib/base/nscputil.cpp | 51
lib/libadmin/dllglue.c | 77
lib/libadmin/httpcon.c | 5
lib/libadmin/referer.c | 4
lib/libadmin/template.c | 29
lib/libadmin/util.c | 973
lib/libdsa/dsalib_conf.c | 37
lib/libdsa/dsalib_confs.c | 93
lib/libdsa/dsalib_location.c | 56
lib/libdsa/dsalib_tailf.c | 1
lib/libdsa/dsalib_updown.c | 118
lib/libdsa/dsalib_util.c | 56
ltmain.sh |14878 +++++---
m4/adminutil.m4 | 4
m4/httpd.m4 | 3
m4/mozldap.m4 | 116
m4/openldap.m4 | 138
m4/selinux.m4 | 3
man/man8/ds_removal.8 | 54
man/man8/ds_unregister.8 | 48
man/man8/register-ds-admin.pl.8 | 139
man/man8/remove-ds-admin.pl.8 | 10
man/man8/restart-ds-admin.8 | 10
man/man8/start-ds-admin.8 | 10
man/man8/stop-ds-admin.8 | 10
missing | 234
mod_admserv/mod_admserv.c | 564
mod_admserv/mod_admserv.h | 15
mod_restartd/mod_restartd-2.2.c | 22
selinux/dirsrv-admin.fc.in | 5
selinux/dirsrv-admin.te | 2
tests/ds_create/testget.1 | 2
tests/htmladmin/testget.2 | 2
tests/htmladmin/testget.3 | 2
tests/htmladmin/testget.4 | 2
tests/htmladmin/testget.5 | 2
tests/htmladmin/testget.6 | 2
tests/htmladmin/testget.7 | 2
tests/htmladmin/testget.8 | 2
tests/security/testpost.1 | 1
tests/security/testpost.10 | 1
tests/security/testpost.11 | 1
tests/security/testpost.12 | 1
tests/security/testpost.13 | 1
tests/security/testpost.14 | 1
tests/security/testpost.15 | 1
tests/security/testpost.16 | 1
tests/security/testpost.17 | 1
tests/security/testpost.18 | 1
tests/security/testpost.19 | 1
tests/security/testpost.2 | 1
tests/security/testpost.20 | 1
tests/security/testpost.21 | 1
tests/security/testpost.3 | 1
tests/security/testpost.4 | 1
tests/security/testpost.5 | 1
tests/security/testpost.6 | 1
tests/security/testpost.7 | 1
tests/security/testpost.8 | 1
tests/security/testpost.9 | 1
tests/setup.sh | 250
tests/ugdsconfig/testget.10 | 2
tests/viewdata/testget.2 | 2
tests/viewdata/testget.3 | 2
tests/viewdata/testget.4 | 2
tests/viewlog/testget.3 | 2
tests/viewlog/testget.4 | 2
wrappers/initscript.in | 3
wrappers/systemd.service.in | 24
148 files changed, 35327 insertions(+), 38217 deletions(-)
---
7 years, 7 months
- 1
- 0
Branch '389-ds-base-1.2.11' - ldap/servers
by Mark Reynolds
ldap/servers/slapd/modify.c | 8 ++++----
ldap/servers/slapd/pw.c | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit 840cfbfc7d6473338cd4ef167bf4a0d8867be80b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 14:25:15 2016 -0400
Ticket 48975- Disabling CLEAR password storage scheme will
crash server when setting a password
Bug Description: If the CLEAR password storage scheme plugin is disabled, and a
userpassword is set, the server crashes. This is because we
expect this plugin to be enabled when working with the unhashed
password.
Fix Description: Always check if the password scheme, returned by pw_val2scheme(),
is NULL before dereferencing it. If it is NULL treat it as a
clear text password.
Valgrind: Passed
https://fedorahosted.org/389/ticket/48975
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 52230585a1191bf1e747780b592f291d652e26dd)
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 4bcc827..ed08885 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -847,7 +847,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
for ( i = 0; pw_mod->mod_bvalues != NULL && pw_mod->mod_bvalues[i] != NULL; i++ ) {
char *password = slapi_ch_strdup(pw_mod->mod_bvalues[i]->bv_val);
pwsp = pw_val2scheme( password, &valpwd, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
/*
* CLEAR password
*
@@ -871,7 +871,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
const char *userpwd = slapi_value_get_string(present_values[ii]);
pass_scheme = pw_val2scheme( (char *)userpwd, &pval, 1 );
- if(strcmp(pass_scheme->pws_name,"CLEAR")){
+ if(pass_scheme && strcmp(pass_scheme->pws_name,"CLEAR")){
/* its encoded, so compare it */
if((*(pass_scheme->pws_cmp))( valpwd, pval ) == 0 ){
/*
@@ -931,7 +931,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
* provided by the client.
*/
unhashed_pwsp = pw_val2scheme( (char *)unhashed_pwd, NULL, 1 );
- if(strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
+ if(unhashed_pwsp == NULL || strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
if((*(pwsp->pws_cmp))((char *)unhashed_pwd , valpwd) == 0 ){
/* match, add the delete mod for this particular unhashed userpassword */
if (SLAPD_UNHASHED_PW_OFF != config_get_unhashed_pw_switch()) {
@@ -1457,7 +1457,7 @@ valuearray_init_bervalarray_unhashed_only(struct berval **bvals, Slapi_Value ***
*cvals = (Slapi_Value **) slapi_ch_malloc((n + 1) * sizeof(Slapi_Value *));
for(i = 0, p = 0; i < n; i++){
pwsp = pw_val2scheme( bvals[i]->bv_val, NULL, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
(*cvals)[p++] = slapi_value_new_berval(bvals[i]);
}
free_pw_scheme( pwsp );
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 2785bd7..d0d8570 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -266,8 +266,8 @@ void free_pw_scheme(struct pw_scheme *pwsp)
{
if ( pwsp != NULL )
{
- slapi_ch_free( (void**)&pwsp->pws_name );
- slapi_ch_free( (void**)&pwsp );
+ slapi_ch_free_string(&pwsp->pws_name);
+ slapi_ch_free((void**)&pwsp);
}
}
7 years, 7 months
- 1
- 0
Branch '389-ds-base-1.3.2' - ldap/servers
by Mark Reynolds
ldap/servers/slapd/modify.c | 8 ++++----
ldap/servers/slapd/pw.c | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit 3cc75cd105e98198edf476d431d40f316ec46fd7
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 14:25:15 2016 -0400
Ticket 48975- Disabling CLEAR password storage scheme will
crash server when setting a password
Bug Description: If the CLEAR password storage scheme plugin is disabled, and a
userpassword is set, the server crashes. This is because we
expect this plugin to be enabled when working with the unhashed
password.
Fix Description: Always check if the password scheme, returned by pw_val2scheme(),
is NULL before dereferencing it. If it is NULL treat it as a
clear text password.
Valgrind: Passed
https://fedorahosted.org/389/ticket/48975
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 52230585a1191bf1e747780b592f291d652e26dd)
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 8a1aa4f..beeb23a 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -858,7 +858,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
for ( i = 0; pw_mod->mod_bvalues != NULL && pw_mod->mod_bvalues[i] != NULL; i++ ) {
password = slapi_ch_strdup(pw_mod->mod_bvalues[i]->bv_val);
pwsp = pw_val2scheme( password, &valpwd, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
/*
* CLEAR password
*
@@ -882,7 +882,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
const char *userpwd = slapi_value_get_string(present_values[ii]);
pass_scheme = pw_val2scheme( (char *)userpwd, &pval, 1 );
- if(strcmp(pass_scheme->pws_name,"CLEAR")){
+ if(pass_scheme && strcmp(pass_scheme->pws_name,"CLEAR")){
/* its encoded, so compare it */
if((*(pass_scheme->pws_cmp))( valpwd, pval ) == 0 ){
/*
@@ -943,7 +943,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
* provided by the client.
*/
unhashed_pwsp = pw_val2scheme( (char *)unhashed_pwd, NULL, 1 );
- if(strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
+ if(unhashed_pwsp == NULL || strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
if((*(pwsp->pws_cmp))((char *)unhashed_pwd , valpwd) == 0 ){
/* match, add the delete mod for this particular unhashed userpassword */
if (SLAPD_UNHASHED_PW_OFF != config_get_unhashed_pw_switch()) {
@@ -1182,7 +1182,7 @@ valuearray_init_bervalarray_unhashed_only(struct berval **bvals, Slapi_Value ***
*cvals = (Slapi_Value **) slapi_ch_malloc((n + 1) * sizeof(Slapi_Value *));
for(i=0,p=0;i<n;i++){
pwsp = pw_val2scheme( bvals[i]->bv_val, NULL, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
(*cvals)[p++] = slapi_value_new_berval(bvals[i]);
}
free_pw_scheme( pwsp );
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 792ef17..28cfd18 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -266,8 +266,8 @@ void free_pw_scheme(struct pw_scheme *pwsp)
{
if ( pwsp != NULL )
{
- slapi_ch_free( (void**)&pwsp->pws_name );
- slapi_ch_free( (void**)&pwsp );
+ slapi_ch_free_string(&pwsp->pws_name);
+ slapi_ch_free((void**)&pwsp);
}
}
7 years, 7 months
- 1
- 0
Branch '389-ds-base-1.3.3' - ldap/servers
by Mark Reynolds
ldap/servers/slapd/modify.c | 8 ++++----
ldap/servers/slapd/pw.c | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit 509b29605c4d60a0ae7fa6217347aefe2501ef2e
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 14:25:15 2016 -0400
Ticket 48975- Disabling CLEAR password storage scheme will
crash server when setting a password
Bug Description: If the CLEAR password storage scheme plugin is disabled, and a
userpassword is set, the server crashes. This is because we
expect this plugin to be enabled when working with the unhashed
password.
Fix Description: Always check if the password scheme, returned by pw_val2scheme(),
is NULL before dereferencing it. If it is NULL treat it as a
clear text password.
Valgrind: Passed
https://fedorahosted.org/389/ticket/48975
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 52230585a1191bf1e747780b592f291d652e26dd)
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 823cdeb..e77a315 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -858,7 +858,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
for ( i = 0; pw_mod->mod_bvalues != NULL && pw_mod->mod_bvalues[i] != NULL; i++ ) {
password = slapi_ch_strdup(pw_mod->mod_bvalues[i]->bv_val);
pwsp = pw_val2scheme( password, &valpwd, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
/*
* CLEAR password
*
@@ -882,7 +882,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
const char *userpwd = slapi_value_get_string(present_values[ii]);
pass_scheme = pw_val2scheme( (char *)userpwd, &pval, 1 );
- if(strcmp(pass_scheme->pws_name,"CLEAR")){
+ if(pass_scheme && strcmp(pass_scheme->pws_name,"CLEAR")){
/* its encoded, so compare it */
if((*(pass_scheme->pws_cmp))( valpwd, pval ) == 0 ){
/*
@@ -943,7 +943,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
* provided by the client.
*/
unhashed_pwsp = pw_val2scheme( (char *)unhashed_pwd, NULL, 1 );
- if(strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
+ if(unhashed_pwsp == NULL || strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
if((*(pwsp->pws_cmp))((char *)unhashed_pwd , valpwd) == 0 ){
/* match, add the delete mod for this particular unhashed userpassword */
if (SLAPD_UNHASHED_PW_OFF != config_get_unhashed_pw_switch()) {
@@ -1182,7 +1182,7 @@ valuearray_init_bervalarray_unhashed_only(struct berval **bvals, Slapi_Value ***
*cvals = (Slapi_Value **) slapi_ch_malloc((n + 1) * sizeof(Slapi_Value *));
for(i=0,p=0;i<n;i++){
pwsp = pw_val2scheme( bvals[i]->bv_val, NULL, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
(*cvals)[p++] = slapi_value_new_berval(bvals[i]);
}
free_pw_scheme( pwsp );
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 8232c60..6d8ee5e 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -270,8 +270,8 @@ void free_pw_scheme(struct pw_scheme *pwsp)
{
if ( pwsp != NULL )
{
- slapi_ch_free( (void**)&pwsp->pws_name );
- slapi_ch_free( (void**)&pwsp );
+ slapi_ch_free_string(&pwsp->pws_name);
+ slapi_ch_free((void**)&pwsp);
}
}
7 years, 7 months
- 1
- 0
Branch '389-ds-base-1.3.4' - ldap/servers
by Mark Reynolds
ldap/servers/slapd/modify.c | 8 ++++----
ldap/servers/slapd/pw.c | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit e2f2d741912e3441a598395ea6b63bc839a7d34b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 14:25:15 2016 -0400
Ticket 48975- Disabling CLEAR password storage scheme will
crash server when setting a password
Bug Description: If the CLEAR password storage scheme plugin is disabled, and a
userpassword is set, the server crashes. This is because we
expect this plugin to be enabled when working with the unhashed
password.
Fix Description: Always check if the password scheme, returned by pw_val2scheme(),
is NULL before dereferencing it. If it is NULL treat it as a
clear text password.
Valgrind: Passed
https://fedorahosted.org/389/ticket/48975
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 52230585a1191bf1e747780b592f291d652e26dd)
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index c1d0cff..b655ecc 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -826,7 +826,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
for ( i = 0; pw_mod->mod_bvalues != NULL && pw_mod->mod_bvalues[i] != NULL; i++ ) {
password = slapi_ch_strdup(pw_mod->mod_bvalues[i]->bv_val);
pwsp = pw_val2scheme( password, &valpwd, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
/*
* CLEAR password
*
@@ -850,7 +850,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
const char *userpwd = slapi_value_get_string(present_values[ii]);
pass_scheme = pw_val2scheme( (char *)userpwd, &pval, 1 );
- if(strcmp(pass_scheme->pws_name,"CLEAR")){
+ if(pass_scheme && strcmp(pass_scheme->pws_name,"CLEAR")){
/* its encoded, so compare it */
if((*(pass_scheme->pws_cmp))( valpwd, pval ) == 0 ){
/*
@@ -911,7 +911,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
* provided by the client.
*/
unhashed_pwsp = pw_val2scheme( (char *)unhashed_pwd, NULL, 1 );
- if(strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
+ if(unhashed_pwsp == NULL || strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
if((*(pwsp->pws_cmp))((char *)unhashed_pwd , valpwd) == 0 ){
/* match, add the delete mod for this particular unhashed userpassword */
if (SLAPD_UNHASHED_PW_OFF != config_get_unhashed_pw_switch()) {
@@ -1150,7 +1150,7 @@ valuearray_init_bervalarray_unhashed_only(struct berval **bvals, Slapi_Value ***
*cvals = (Slapi_Value **) slapi_ch_malloc((n + 1) * sizeof(Slapi_Value *));
for(i=0,p=0;i<n;i++){
pwsp = pw_val2scheme( bvals[i]->bv_val, NULL, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
(*cvals)[p++] = slapi_value_new_berval(bvals[i]);
}
free_pw_scheme( pwsp );
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 95ff13d..64c841f 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -234,8 +234,8 @@ void free_pw_scheme(struct pw_scheme *pwsp)
{
if ( pwsp != NULL )
{
- slapi_ch_free( (void**)&pwsp->pws_name );
- slapi_ch_free( (void**)&pwsp );
+ slapi_ch_free_string(&pwsp->pws_name);
+ slapi_ch_free((void**)&pwsp);
}
}
7 years, 7 months
- 1
- 0
ldap/servers
by Mark Reynolds
ldap/servers/slapd/modify.c | 8 ++++----
ldap/servers/slapd/pw.c | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
New commits:
commit 52230585a1191bf1e747780b592f291d652e26dd
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 14:25:15 2016 -0400
Ticket 48975- Disabling CLEAR password storage scheme will
crash server when setting a password
Bug Description: If the CLEAR password storage scheme plugin is disabled, and a
userpassword is set, the server crashes. This is because we
expect this plugin to be enabled when working with the unhashed
password.
Fix Description: Always check if the password scheme, returned by pw_val2scheme(),
is NULL before dereferencing it. If it is NULL treat it as a
clear text password.
Valgrind: Passed
https://fedorahosted.org/389/ticket/48975
Reviewed by: nhosoi(Thanks!)
diff --git a/ldap/servers/slapd/modify.c b/ldap/servers/slapd/modify.c
index 4a5faa0..72f2db4 100644
--- a/ldap/servers/slapd/modify.c
+++ b/ldap/servers/slapd/modify.c
@@ -827,7 +827,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
for ( i = 0; pw_mod->mod_bvalues != NULL && pw_mod->mod_bvalues[i] != NULL; i++ ) {
password = slapi_ch_strdup(pw_mod->mod_bvalues[i]->bv_val);
pwsp = pw_val2scheme( password, &valpwd, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
/*
* CLEAR password
*
@@ -851,7 +851,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
const char *userpwd = slapi_value_get_string(present_values[ii]);
pass_scheme = pw_val2scheme( (char *)userpwd, &pval, 1 );
- if(strcmp(pass_scheme->pws_name,"CLEAR")){
+ if(pass_scheme && strcmp(pass_scheme->pws_name,"CLEAR")){
/* its encoded, so compare it */
if((*(pass_scheme->pws_cmp))( valpwd, pval ) == 0 ){
/*
@@ -912,7 +912,7 @@ static void op_shared_modify (Slapi_PBlock *pb, int pw_change, char *old_pw)
* provided by the client.
*/
unhashed_pwsp = pw_val2scheme( (char *)unhashed_pwd, NULL, 1 );
- if(strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
+ if(unhashed_pwsp == NULL || strcmp(unhashed_pwsp->pws_name, "CLEAR") == 0){
if((*(pwsp->pws_cmp))((char *)unhashed_pwd , valpwd) == 0 ){
/* match, add the delete mod for this particular unhashed userpassword */
if (SLAPD_UNHASHED_PW_OFF != config_get_unhashed_pw_switch()) {
@@ -1156,7 +1156,7 @@ valuearray_init_bervalarray_unhashed_only(struct berval **bvals, Slapi_Value ***
*cvals = (Slapi_Value **) slapi_ch_malloc((n + 1) * sizeof(Slapi_Value *));
for(i=0,p=0;i<n;i++){
pwsp = pw_val2scheme( bvals[i]->bv_val, NULL, 1 );
- if(strcmp(pwsp->pws_name, "CLEAR") == 0){
+ if(pwsp == NULL || strcmp(pwsp->pws_name, "CLEAR") == 0){
(*cvals)[p++] = slapi_value_new_berval(bvals[i]);
}
free_pw_scheme( pwsp );
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 3f2cdb0..6f02f90 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -234,8 +234,8 @@ void free_pw_scheme(struct pw_scheme *pwsp)
{
if ( pwsp != NULL )
{
- slapi_ch_free( (void**)&pwsp->pws_name );
- slapi_ch_free( (void**)&pwsp );
+ slapi_ch_free_string(&pwsp->pws_name);
+ slapi_ch_free((void**)&pwsp);
}
}
7 years, 7 months
- 1
- 0
dirsrvtests/tests
by Simon Pichugin
dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py | 559 ++++++++++++
dirsrvtests/tests/tickets/ticket48369_test.py | 124 --
2 files changed, 559 insertions(+), 124 deletions(-)
New commits:
commit 4cbde48a73db91a49ccacf95a6ffcd5134c57cbe
Author: Simon Pichugin <spichugi(a)redhat.com>
Date: Tue Aug 30 10:13:50 2016 +0200
Ticket 48369 - Add CI test suite
Description: Add test suite to the Password test suite and remove old
test case from the Tickets dir.
Author: Punit Kundal <pkundal(a)redhat.com>
Refactored by: Simon Pichugin <spichugi(a)redhat.com>
Reviewed by: mreynolds (Thanks!)
diff --git a/dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py b/dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py
new file mode 100644
index 0000000..d064783
--- /dev/null
+++ b/dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py
@@ -0,0 +1,559 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+import subprocess
+from lib389 import DirSrv, Entry, tools, tasks
+from ldap.controls.ppolicy import PasswordPolicyControl
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+
+DEBUGGING = False
+CONFIG_ATTR = 'passwordSendExpiringTime'
+USER_DN = 'uid=tuser,{:s}'.format(DEFAULT_SUFFIX)
+USER_PASSWD = 'secret123'
+
+if DEBUGGING:
+ logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+ logging.getLogger(__name__).setLevel(logging.INFO)
+
+log = logging.getLogger(__name__)
+
+
+class TopologyStandalone(object):
+ """The DS Topology Class"""
+ def __init__(self, standalone):
+ """Init"""
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ """Create DS Deployment"""
+
+ # Creating standalone instance ...
+ if DEBUGGING:
+ standalone = DirSrv(verbose=True)
+ else:
+ standalone = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ standalone.delete()
+ standalone.create()
+ standalone.open()
+
+ def fin():
+ """If we are debugging just stop the instances, otherwise remove
+ them
+ """
+
+ if DEBUGGING:
+ standalone.stop()
+ else:
+ standalone.delete()
+
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ standalone.clearTmpDir(__file__)
+
+ return TopologyStandalone(standalone)
+
+
+(a)pytest.fixture
+def global_policy(topology, request):
+ """Sets the required global
+ password policy attributes under
+ cn=config entry
+ """
+
+ attrs = {'passwordExp': '',
+ 'passwordMaxAge': '',
+ 'passwordWarning': '',
+ CONFIG_ATTR: ''}
+ try:
+ log.info('Get the default values')
+ entry = topology.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE,
+ '(objectClass=*)', attrs.keys())
+
+ for key in attrs.keys():
+ attrs[key] = entry.getValue(key)
+
+ log.info('Set the new values')
+ topology.standalone.modify_s(DN_CONFIG, [
+ (ldap.MOD_REPLACE, 'passwordExp', 'on'),
+ (ldap.MOD_REPLACE, 'passwordMaxAge', '172800'),
+ (ldap.MOD_REPLACE, 'passwordWarning', '86400'),
+ (ldap.MOD_REPLACE, CONFIG_ATTR, 'on')])
+
+ except ldap.LDAPError as ex:
+ log.error("Failed to set global password policy, error:{:s}"\
+ .format(ex.message['desc']))
+ raise ex
+
+ def fin():
+ """Resets the defaults"""
+
+ try:
+ log.info('Reset the defaults')
+ for key in attrs.keys():
+ topology.standalone.modify_s(DN_CONFIG, [
+ (ldap.MOD_REPLACE, key, attrs[key])])
+ except ldap.LDAPError as ex:
+ log.error("Failed to set defaults, error:{:s}".format(ex.message['desc']))
+ raise ex
+ request.addfinalizer(fin)
+
+ # A short sleep is required after the modifying password policy or cn=config
+ time.sleep(0.5)
+
+
+(a)pytest.fixture
+def global_policy_default(topology, request):
+ """Sets the required global password policy
+ attributes for testing the default behavior
+ of password expiry warning time
+ """
+
+ attrs = {'passwordExp': '',
+ 'passwordMaxAge': '',
+ 'passwordWarning': '',
+ CONFIG_ATTR : ''}
+ try:
+ log.info('Get the default values')
+ entry = topology.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE,
+ '(objectClass=*)', attrs.keys())
+ for key in attrs.keys():
+ attrs[key] = entry.getValue(key)
+
+ log.info('Set the new values')
+ topology.standalone.modify_s(DN_CONFIG, [
+ (ldap.MOD_REPLACE, 'passwordExp', 'on'),
+ (ldap.MOD_REPLACE, 'passwordMaxAge', '86400'),
+ (ldap.MOD_REPLACE, 'passwordWarning', '86400'),
+ (ldap.MOD_REPLACE, CONFIG_ATTR, 'off')])
+ except ldap.LDAPError as ex:
+ log.error("Failed to set global password policy, error:{:s}"\
+ .format(ex.message['desc']))
+ raise ex
+
+ def fin():
+ """Resets the defaults"""
+
+ log.info('Reset the defaults')
+ try:
+ for key in attrs.keys():
+ topology.standalone.modify_s(DN_CONFIG, [
+ (ldap.MOD_REPLACE, key, attrs[key])
+ ])
+ except ldap.LDAPError as ex:
+ log.error("Failed to reset defaults, error:{:s}"\
+ .format(ex.message['desc']))
+ raise ex
+ request.addfinalizer(fin)
+
+ # A short sleep is required after modifying password policy or cn=config
+ time.sleep(0.5)
+
+
+(a)pytest.fixture
+def add_user(topology, request):
+ """Adds a user for binding"""
+
+ user_data = {'objectClass': 'top person inetOrgPerson'.split(),
+ 'uid': 'tuser',
+ 'cn': 'test user',
+ 'sn': 'user',
+ 'userPassword': USER_PASSWD}
+
+ log.info('Add the user')
+ try:
+ topology.standalone.add_s(Entry((USER_DN, user_data)))
+ except ldap.LDAPError as ex:
+ log.error("Failed to add user, error:{:s}".format(ex.message['desc']))
+ raise ex
+
+ def fin():
+ """Removes the user entry"""
+
+ log.info('Remove the user entry')
+ try:
+ topology.standalone.delete_s(USER_DN)
+ except ldap.LDAPError as ex:
+ log.error("Failed to remove user, error:{:s}"\
+ .format(ex.message['desc']))
+ raise ex
+ request.addfinalizer(fin)
+
+
+(a)pytest.fixture
+def local_policy(topology, add_user):
+ """Sets fine grained policy for user entry"""
+
+ log.info("Setting fine grained policy for user ({:s})".format(USER_DN))
+ try:
+ subprocess.call(['/usr/sbin/ns-newpwpolicy.pl', '-D', DN_DM,
+ '-w', PASSWORD, '-h', HOST_STANDALONE,
+ '-p', str(PORT_STANDALONE), '-U', USER_DN,
+ '-Z', SERVERID_STANDALONE])
+ except subprocess.CalledProcessError as ex:
+ log.error("Failed to set fine grained policy, error:{:s}"\
+ .format(str(ex)))
+ raise ex
+
+ # A short sleep is required after modifying password policy
+ time.sleep(0.5)
+
+
+def get_password_warning(topology):
+ """Gets the password expiry warning time for the user"""
+
+ res_type = res_data = res_msgid = res_ctrls = None
+ result_id = ''
+
+ log.info('Bind with the user and request the password expiry warning time')
+ try:
+ result_id = topology.standalone.simple_bind(USER_DN, USER_PASSWD,
+ serverctrls = [PasswordPolicyControl()])
+ res_type, res_data, res_msgid, res_ctrls =\
+ topology.standalone.result3(result_id)
+
+ # This exception will be thrown when the user's password has expired
+ except ldap.INVALID_CREDENTIALS as ex:
+ raise ex
+ except ldap.LDAPError as ex:
+ log.error("Failed to get password expiry warning time, error:{:s}"\
+ .format(ex.message['desc']))
+ raise ex
+
+ # Return the control
+ return res_ctrls
+
+
+def set_conf_attr(topology, attr, val):
+ """Sets the value of a given attribute under cn=config"""
+
+ log.info("Setting {:s} to {:s}".format(attr, val))
+ try:
+ topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, attr, val)])
+ except ldap.LDAPError as ex:
+ log.error("Failed to set {:s} to {:s} error:{:s}"\
+ .format(attr, val, ex.message['desc']))
+ raise ex
+
+ # A short sleep is required after modifying cn=config
+ time.sleep(0.5)
+
+
+def get_conf_attr(topology, attr):
+ """Gets the value of a given
+ attribute under cn=config entry
+ """
+
+ try:
+ entry = topology.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE,
+ '(objectClass=*)', [attr])
+ val = entry.getValue(attr)
+ except ldap.LDAPError as ex:
+ log.error("Failed to get the value of {:s}, error:{:s}"\
+ .format(attr, ex.message['desc']))
+ raise ex
+
+ # Return the value if no exeception is raised
+ return val
+
+
+(a)pytest.mark.parametrize("value", (' ' , 'junk123', 'on', 'off'))
+def test_different_values(topology, value):
+ """Try to set passwordSendExpiringTime attribute
+ to various values both valid and invalid
+
+ :Feature: Password Expiry Warning Time
+
+ :Setup: Standalone DS instance
+
+ :Steps: 1. Try to set valid and invalid values
+ for passwordSendExpiringTime attribute
+ under cn=config entry
+ 2. Run the search command to check the
+ value of passwordSendExpiringTime attribute
+
+ :Assert: 1. Invalid values should be rejected with
+ an OPERATIONS_ERROR
+ 2. Valid values should be accepted and saved
+ """
+
+ log.info('Get the default value')
+ defval = get_conf_attr(topology, CONFIG_ATTR)
+
+ if value not in ('on', 'off'):
+ log.info('An invalid value is being tested')
+ with pytest.raises(ldap.OPERATIONS_ERROR):
+ set_conf_attr(topology, CONFIG_ATTR, value)
+
+ log.info('Now check the value is unchanged')
+ assert get_conf_attr(topology, CONFIG_ATTR) == defval
+
+ log.info("Invalid value {:s} was rejected correctly".format(value))
+ else:
+ log.info('A valid value is being tested')
+ set_conf_attr(topology, CONFIG_ATTR, value)
+
+ log.info('Now check that the value has been changed')
+ assert get_conf_attr(topology, CONFIG_ATTR) == value
+
+ log.info("{:s} is now set to {:s}".format(CONFIG_ATTR, value))
+
+ log.info('Set passwordSendExpiringTime back to the default value')
+ set_conf_attr(topology, CONFIG_ATTR, defval)
+
+
+def test_expiry_time(topology, global_policy, add_user):
+ """Test whether the password expiry warning
+ time for a user is returned appropriately
+
+ :Feature: Pasword Expiry Warning Time
+
+ :Setup: Standalone DS instance with,
+ 1. Global password policy configured as below:
+ passwordExp: on
+ passwordMaxAge: 172800
+ passwordWarning: 86400
+ passwordSendExpiringTime: on
+ 2. User entry for binding
+
+ :Steps: 1. Bind as the user
+ 2. Request the control for the user
+
+ :Assert: The password expiry warning time for the user should be
+ returned
+ """
+
+ res_ctrls = None
+ try:
+ log.info('Get the password expiry warning time')
+ log.info("Binding with ({:s}) and requesting the password expiry warning time"\
+ .format(USER_DN))
+ res_ctrls = get_password_warning(topology)
+
+ log.info('Check whether the time is returned')
+ assert res_ctrls
+
+ log.info("user's password will expire in {:d} seconds"\
+ .format(res_ctrls[0].timeBeforeExpiration))
+ finally:
+ log.info("Rebinding as DM")
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+
+(a)pytest.mark.parametrize("attr,val",[(CONFIG_ATTR, 'off'),
+ ('passwordWarning', '3600')])
+def test_password_warning(topology, global_policy, add_user, attr, val):
+ """Test password expiry warning time by
+ setting passwordSendExpiringTime to off
+ and setting passwordWarning to a short value
+
+ :Feature: Password Expiry Warning Time
+
+ :Setup: Standalone DS instance with,
+ 1. Global password policy configures as below:
+ passwordExp: on
+ passwordMaxAge: 172800
+ passwordWarning: 86400
+ passwordSendExpiringTime: on
+ 2. User entry for binding
+
+ :Steps: 1. Set passwordSendExpiringTime attribute to off
+ 2. Bind as the user
+ 3. Request the control for the user
+
+ :Assert: Password expiry warning time should not be returned
+
+ :Steps: 1. Set passwordWarning to a small value
+ (for eg: 3600 seconds)
+ 2. Bind with the user and request the password expiry warning
+ time
+
+ :Assert: Password expiry warning time should be returned
+ """
+
+ try:
+ log.info('Set configuration parameter')
+ set_conf_attr(topology, attr, val)
+
+ log.info("Binding with ({:s}) and requesting password expiry warning time"\
+ .format(USER_DN))
+ res_ctrls = get_password_warning(topology)
+
+ log.info('Check the state of the control')
+ if not res_ctrls:
+ log.info("Password Expiry warning time is not returned as {:s} is set to {:s}"\
+ .format(attr, val))
+ else:
+ log.info("({:s}) password will expire in {:d} seconds"\
+ .format(USER_DN, res_ctrls[0].timeBeforeExpiration))
+ finally:
+ log.info("Rebinding as DM")
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+
+def test_with_different_password_states(topology, global_policy, add_user):
+ """Test the control with different password states
+
+ :Feature: Password Expiry Warning Time
+
+ :Setup: Standalone DS instance with,
+ 1. Global password policy configured as below:
+ passwordExp: on
+ passwordMaxAge: 172800
+ passwordWarning: 86400
+ passwordSendExpiringTime: on
+ 2. User entry for binding to the server
+
+ :Steps: 1. Expire user's password by setting the system
+ date past the valid period for the password
+ 2. Try to bind to the server with the user entry
+ 3. Set the system date to the current day
+ 4. Try to bind with the user entry and request
+ the control
+
+ :Assert: 1. In the first try, the bind should fail with an
+ INVALID_CREDENTIALS error
+ 2. In the second try, the bind should be successful
+ and the password expiry warning time should be
+ returned
+ """
+
+ res_ctrls = None
+ try:
+ log.info("Expiring user's password by moving the"\
+ " system date past the valid period")
+ subprocess.check_call(['/usr/bin/date', '-s', 'next month'])
+
+ log.info('Wait for the server to pick up new date')
+ time.sleep(5)
+
+ log.info("Attempting to bind with user {:s} and retrive the password"\
+ " expiry warning time".format(USER_DN))
+ with pytest.raises(ldap.INVALID_CREDENTIALS) as ex:
+ res_ctrls = get_password_warning(topology)
+
+ log.info("Bind Failed, error: {:s}".format(str(ex)))
+
+ log.info("Resetting the system date")
+ subprocess.check_call(['/usr/bin/date', '-s', 'last month'])
+
+ log.info('Wait for the server to pick up new date')
+ time.sleep(5)
+
+ log.info("Rebinding with {:s} and retrieving the password"\
+ " expiry warning time".format(USER_DN))
+ res_ctrls = get_password_warning(topology)
+
+ log.info('Check that the control is returned')
+ assert res_ctrls
+
+ log.info("user's password will expire in {:d} seconds"\
+ .format(res_ctrls[0].timeBeforeExpiration))
+ finally:
+ log.info("Rebinding as DM")
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+
+def test_default_behavior(topology, global_policy_default, add_user):
+ """Test the default behavior of password
+ expiry warning time
+
+ :Feature: Password Expiry Warning Time
+
+ :Setup: Standalone DS instance with,
+ 1. Global password policy configured as follows,
+ passwordExp: on
+ passwordMaxAge: 86400
+ passwordWarning: 86400
+ passwordSendExpiringTime: off
+ 2. User entry for binding to the server
+
+ :Steps: 1. Bind as the user
+ 2. Request the control for the user
+
+ :Assert: Password expiry warning time should be returned by the
+ server by the server since passwordMaxAge and
+ passwordWarning are set to the same value
+ """
+
+ res_ctrls = None
+ try:
+ log.info("Binding with {:s} and requesting the password expiry warning time"\
+ .format(USER_DN))
+ res_ctrls = get_password_warning(topology)
+
+ log.info('Check that control is returned even'
+ 'if passwordSendExpiringTime is set to off')
+ assert res_ctrls
+
+ log.info("user's password will expire in {:d} seconds"\
+ .format(res_ctrls[0].timeBeforeExpiration))
+ finally:
+ log.info("Rebinding as DM")
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+
+def test_with_local_policy(topology, global_policy, local_policy):
+ """Test the attribute with fine grained policy
+ set for the user
+
+ :Feature: Password Expiry Warning Time
+
+ :Setup: Standalone DS instance with,
+ 1. Global password policy configured as below,
+ passwordExp: on
+ passwordMaxAge: 172800
+ passwordWarning: 86400
+ passwordSendExpiringTime: on
+ 2. User entry for binding to the server
+ 3. Configure fine grained password policy for the user
+ as below:
+ ns-newpwpolicy.pl -D 'cn=Directory Manager' -w secret123
+ -h localhost -p 389 -U 'uid=tuser,dc=example,dc=com'
+
+ :Steps: 1. Bind as the user
+ 2. Request the control for the user
+
+ :Assert: Password expiry warning time should not be returned for the
+ user
+ """
+
+ res_ctrls = None
+ try:
+ log.info("Attempting to get password expiry warning time for"\
+ " user {:s}".format(USER_DN))
+ res_ctrls = get_password_warning(topology)
+
+ log.info('Check that the control is not returned')
+ assert not res_ctrls
+
+ log.info("Password expiry warning time is not returned")
+ finally:
+ log.info("Rebinding as DM")
+ topology.standalone.simple_bind_s(DN_DM, PASSWORD)
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
diff --git a/dirsrvtests/tests/tickets/ticket48369_test.py b/dirsrvtests/tests/tickets/ticket48369_test.py
deleted file mode 100644
index 37f4272..0000000
--- a/dirsrvtests/tests/tickets/ticket48369_test.py
+++ /dev/null
@@ -1,124 +0,0 @@
-import os
-import time
-import ldap
-import logging
-import pytest
-from lib389 import DirSrv, Entry
-from lib389._constants import *
-from lib389.properties import *
-from lib389.tasks import *
-from lib389.utils import *
-from ldap.controls.ppolicy import PasswordPolicyControl
-
-
-logging.getLogger(__name__).setLevel(logging.DEBUG)
-log = logging.getLogger(__name__)
-
-installation1_prefix = None
-
-
-class TopologyStandalone(object):
- def __init__(self, standalone):
- standalone.open()
- self.standalone = standalone
-
-
-(a)pytest.fixture(scope="module")
-def topology(request):
- global installation1_prefix
- if installation1_prefix:
- args_instance[SER_DEPLOYED_DIR] = installation1_prefix
-
- # Creating standalone instance ...
- standalone = DirSrv(verbose=False)
- args_instance[SER_HOST] = HOST_STANDALONE
- args_instance[SER_PORT] = PORT_STANDALONE
- args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
- args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
- args_standalone = args_instance.copy()
- standalone.allocate(args_standalone)
- instance_standalone = standalone.exists()
- if instance_standalone:
- standalone.delete()
- standalone.create()
- standalone.open()
-
- # Delete each instance in the end
- def fin():
- standalone.delete()
-
- request.addfinalizer(fin)
-
- # Clear out the tmp dir
- standalone.clearTmpDir(__file__)
-
- return TopologyStandalone(standalone)
-
-
-def test_ticket48369(topology):
- """
- Test RFE 48369 - return password policy controls by default without needing
- to be requested.
- """
-
- DN = 'uid=test,' + DEFAULT_SUFFIX
-
- #
- # Setup password policy
- #
- try:
- topology.standalone.modify_s('cn=config', [(ldap.MOD_REPLACE,
- 'passwordExp',
- 'on'),
- (ldap.MOD_REPLACE,
- 'passwordMaxAge',
- '864000'),
- (ldap.MOD_REPLACE,
- 'passwordSendExpiringTime',
- 'on')])
- except ldap.LDAPError as e:
- log.fatal('Failed to set config: %s' % str(e))
- assert False
-
- #
- # Add entry
- #
- try:
- topology.standalone.add_s(Entry((DN,
- {'objectclass': 'top extensibleObject'.split(),
- 'uid': 'test',
- 'userpassword': 'password'})))
- except ldap.LDAPError as e:
- log.fatal('Failed to add user entry: %s' % str(e))
- assert False
- time.sleep(1)
-
- #
- # Bind as the new user, and request the control
- #
- try:
- msgid = topology.standalone.simple_bind(DN, "password",
- serverctrls=[PasswordPolicyControl()])
- res_type, res_data, res_msgid, res_ctrls = \
- topology.standalone.result3(msgid)
- except ldap.LDAPError as e:
- log.fatal('Failed to bind: %s: Error %s' % (ctl_resp, str(e)))
- assert False
-
- if res_ctrls[0].controlType == PasswordPolicyControl.controlType:
- ppolicy_ctrl = res_ctrls[0]
- else:
- log.fatal('Control not found')
- assert False
-
- log.info('Time until expiration (%s)' %
- repr(ppolicy_ctrl.timeBeforeExpiration))
-
- log.info('Test complete')
-
-
-if __name__ == '__main__':
- # Run isolated
- # -s for DEBUG mode
- CURRENT_FILE = os.path.realpath(__file__)
- pytest.main("-s %s" % CURRENT_FILE)
7 years, 7 months
- 1
- 0
Branch '389-ds-base-1.2.11' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/collation/collate.c | 14 +++----
ldap/servers/plugins/collation/orfilter.c | 55 +++++++++++++++++-------------
ldap/servers/slapd/back-ldbm/sort.c | 12 ++----
3 files changed, 43 insertions(+), 38 deletions(-)
New commits:
commit dba6ff0c2fc12881179beaeb1d62c97c8d487c5b
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 10:32:45 2016 -0400
Ticket 48970 - Serverside sorting crashes the server
Bug Description: When using a matching rule and server side sorting
the server does a double-free on the matching rule
keys which crashes the server.
Fix Description: Set the pblock pointer to NULL after the keys are
freed. This prevents the double free.
Also fixed some complier warnings/indentation.
Valgrind: passed
https://fedorahosted.org/389/ticket/48970
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 43997fa8782ca93e20595ae10e303d85e5b765f4)
diff --git a/ldap/servers/plugins/collation/collate.c b/ldap/servers/plugins/collation/collate.c
index 2a73ee1..6d293f7 100644
--- a/ldap/servers/plugins/collation/collate.c
+++ b/ldap/servers/plugins/collation/collate.c
@@ -376,23 +376,23 @@ collation_index (indexer_t* ix, struct berval** bvec, struct berval** prefixes)
return keys;
}
+/* The destructor function for a collation-based indexer. */
static void
collation_indexer_destroy (indexer_t* ix)
- /* The destructor function for a collation-based indexer. */
{
collation_indexer_t* etc = (collation_indexer_t*) ix->ix_etc;
if (etc->converter) {
- ucnv_close(etc->converter);
- etc->converter = NULL;
+ ucnv_close(etc->converter);
+ etc->converter = NULL;
}
if (etc->collator) {
- ucol_close(etc->collator);
- etc->collator = NULL;
+ ucol_close(etc->collator);
+ etc->collator = NULL;
}
if (etc->ix_keys != NULL) {
- ber_bvecfree (etc->ix_keys);
- etc->ix_keys = NULL;
+ ber_bvecfree (etc->ix_keys);
+ etc->ix_keys = NULL;
}
slapi_ch_free((void**)&ix->ix_etc);
ix->ix_etc = NULL; /* just for hygiene */
diff --git a/ldap/servers/plugins/collation/orfilter.c b/ldap/servers/plugins/collation/orfilter.c
index 2293baf..bf1ccf8 100644
--- a/ldap/servers/plugins/collation/orfilter.c
+++ b/ldap/servers/plugins/collation/orfilter.c
@@ -63,7 +63,7 @@ static void
indexer_free (indexer_t* ix)
{
if (ix->ix_destroy != NULL) {
- ix->ix_destroy (ix);
+ ix->ix_destroy (ix);
}
slapi_ch_free((void**)&ix);
}
@@ -250,23 +250,28 @@ op_filter_match (or_filter_t* or, struct berval** vals)
auto indexer_t* ix = or->or_indexer;
auto struct berval** v = ix->ix_index (ix, vals, NULL);
if (v != NULL) for (; *v; ++v) {
- auto struct berval** k = or->or_match_keys;
- if (k != NULL) for (; *k; ++k) {
- switch (or->or_op) {
- case SLAPI_OP_LESS:
- if (slapi_berval_cmp (*v, *k) < 0) return 0; break;
- case SLAPI_OP_LESS_OR_EQUAL:
- if (slapi_berval_cmp (*v, *k) <= 0) return 0; break;
- case SLAPI_OP_EQUAL:
- if (SLAPI_BERVAL_EQ (*v, *k)) return 0; break;
- case SLAPI_OP_GREATER_OR_EQUAL:
- if (slapi_berval_cmp (*v, *k) >= 0) return 0; break;
- case SLAPI_OP_GREATER:
- if (slapi_berval_cmp (*v, *k) > 0) return 0; break;
- default:
- break;
- }
- }
+ auto struct berval** k = or->or_match_keys;
+ if (k != NULL) for (; *k; ++k) {
+ switch (or->or_op) {
+ case SLAPI_OP_LESS:
+ if (slapi_berval_cmp (*v, *k) < 0) return 0;
+ break;
+ case SLAPI_OP_LESS_OR_EQUAL:
+ if (slapi_berval_cmp (*v, *k) <= 0) return 0;
+ break;
+ case SLAPI_OP_EQUAL:
+ if (SLAPI_BERVAL_EQ (*v, *k)) return 0;
+ break;
+ case SLAPI_OP_GREATER_OR_EQUAL:
+ if (slapi_berval_cmp (*v, *k) >= 0) return 0;
+ break;
+ case SLAPI_OP_GREATER:
+ if (slapi_berval_cmp (*v, *k) > 0) return 0;
+ break;
+ default:
+ break;
+ }
+ }
}
return -1;
}
@@ -599,7 +604,9 @@ op_indexer_destroy (Slapi_PBlock* pb)
auto indexer_t* ix = op_indexer_get (pb);
LDAPDebug (LDAP_DEBUG_FILTER, "op_indexer_destroy(%p)\n", (void*)ix, 0, 0);
if (ix != NULL) {
- indexer_free (ix);
+ indexer_free (ix);
+ /* The keys were freed, but we need to reset the pblock pointer */
+ slapi_pblock_set(pb, SLAPI_PLUGIN_MR_KEYS, NULL);
}
return 0;
}
@@ -652,10 +659,10 @@ typedef struct ss_indexer_t {
static void
ss_indexer_free (ss_indexer_t* ss)
{
- slapi_ch_free((void**)&ss->ss_oid);
+ slapi_ch_free_string(&ss->ss_oid);
if (ss->ss_indexer != NULL) {
- indexer_free (ss->ss_indexer);
- ss->ss_indexer = NULL;
+ indexer_free (ss->ss_indexer);
+ ss->ss_indexer = NULL;
}
slapi_ch_free((void**)&ss);
}
@@ -676,7 +683,9 @@ ss_indexer_destroy (Slapi_PBlock* pb)
auto ss_indexer_t* ss = ss_indexer_get (pb);
LDAPDebug (LDAP_DEBUG_FILTER, "ss_indexer_destroy(%p)\n", (void*)ss, 0, 0);
if (ss) {
- ss_indexer_free (ss);
+ ss_indexer_free(ss);
+ /* The keys were freed, but we need to reset the pblock pointer */
+ slapi_pblock_set(pb, SLAPI_PLUGIN_MR_KEYS, NULL);
}
}
diff --git a/ldap/servers/slapd/back-ldbm/sort.c b/ldap/servers/slapd/back-ldbm/sort.c
index 4164147..004b45c 100644
--- a/ldap/servers/slapd/back-ldbm/sort.c
+++ b/ldap/servers/slapd/back-ldbm/sort.c
@@ -61,15 +61,11 @@ static int print_out_sort_spec(char* buffer,sort_spec *s,int *size);
static void sort_spec_thing_free(sort_spec_thing *s)
{
- if (NULL != s->type) {
- slapi_ch_free((void **)&s->type);
- }
- if (NULL != s->matchrule) {
- slapi_ch_free( (void**)&s->matchrule);
- }
+ slapi_ch_free_string(&s->type);
+ slapi_ch_free_string(&s->matchrule);
if (NULL != s->mr_pb) {
destroy_matchrule_indexer(s->mr_pb);
- slapi_pblock_destroy (s->mr_pb);
+ slapi_pblock_destroy (s->mr_pb);
}
attr_done(&s->sattr);
slapi_ch_free( (void**)&s);
@@ -145,7 +141,7 @@ void sort_log_access(Slapi_PBlock *pb,sort_spec_thing *s,IDList *candidates)
/* Now output it */
ldbm_log_access_message(pb,buffer);
if (buffer != stack_buffer) {
- slapi_ch_free( (void**)&buffer);
+ slapi_ch_free_string(&buffer);
}
}
7 years, 7 months
- 1
- 0
Branch '389-ds-base-1.3.3' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/collation/collate.c | 14 +++----
ldap/servers/plugins/collation/orfilter.c | 55 +++++++++++++++++-------------
ldap/servers/slapd/back-ldbm/sort.c | 12 ++----
3 files changed, 43 insertions(+), 38 deletions(-)
New commits:
commit 30ecd3cb74a6f6d03ae37e7d39e7175820209103
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 10:32:45 2016 -0400
Ticket 48970 - Serverside sorting crashes the server
Bug Description: When using a matching rule and server side sorting
the server does a double-free on the matching rule
keys which crashes the server.
Fix Description: Set the pblock pointer to NULL after the keys are
freed. This prevents the double free.
Also fixed some complier warnings/indentation.
Valgrind: passed
https://fedorahosted.org/389/ticket/48970
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 43997fa8782ca93e20595ae10e303d85e5b765f4)
diff --git a/ldap/servers/plugins/collation/collate.c b/ldap/servers/plugins/collation/collate.c
index a02040f..885142c 100644
--- a/ldap/servers/plugins/collation/collate.c
+++ b/ldap/servers/plugins/collation/collate.c
@@ -376,23 +376,23 @@ collation_index (indexer_t* ix, struct berval** bvec, struct berval** prefixes)
return keys;
}
+/* The destructor function for a collation-based indexer. */
static void
collation_indexer_destroy (indexer_t* ix)
- /* The destructor function for a collation-based indexer. */
{
collation_indexer_t* etc = (collation_indexer_t*) ix->ix_etc;
if (etc->converter) {
- ucnv_close(etc->converter);
- etc->converter = NULL;
+ ucnv_close(etc->converter);
+ etc->converter = NULL;
}
if (etc->collator) {
- ucol_close(etc->collator);
- etc->collator = NULL;
+ ucol_close(etc->collator);
+ etc->collator = NULL;
}
if (etc->ix_keys != NULL) {
- ber_bvecfree (etc->ix_keys);
- etc->ix_keys = NULL;
+ ber_bvecfree (etc->ix_keys);
+ etc->ix_keys = NULL;
}
slapi_ch_free((void**)&ix->ix_etc);
ix->ix_etc = NULL; /* just for hygiene */
diff --git a/ldap/servers/plugins/collation/orfilter.c b/ldap/servers/plugins/collation/orfilter.c
index 2293baf..bf1ccf8 100644
--- a/ldap/servers/plugins/collation/orfilter.c
+++ b/ldap/servers/plugins/collation/orfilter.c
@@ -63,7 +63,7 @@ static void
indexer_free (indexer_t* ix)
{
if (ix->ix_destroy != NULL) {
- ix->ix_destroy (ix);
+ ix->ix_destroy (ix);
}
slapi_ch_free((void**)&ix);
}
@@ -250,23 +250,28 @@ op_filter_match (or_filter_t* or, struct berval** vals)
auto indexer_t* ix = or->or_indexer;
auto struct berval** v = ix->ix_index (ix, vals, NULL);
if (v != NULL) for (; *v; ++v) {
- auto struct berval** k = or->or_match_keys;
- if (k != NULL) for (; *k; ++k) {
- switch (or->or_op) {
- case SLAPI_OP_LESS:
- if (slapi_berval_cmp (*v, *k) < 0) return 0; break;
- case SLAPI_OP_LESS_OR_EQUAL:
- if (slapi_berval_cmp (*v, *k) <= 0) return 0; break;
- case SLAPI_OP_EQUAL:
- if (SLAPI_BERVAL_EQ (*v, *k)) return 0; break;
- case SLAPI_OP_GREATER_OR_EQUAL:
- if (slapi_berval_cmp (*v, *k) >= 0) return 0; break;
- case SLAPI_OP_GREATER:
- if (slapi_berval_cmp (*v, *k) > 0) return 0; break;
- default:
- break;
- }
- }
+ auto struct berval** k = or->or_match_keys;
+ if (k != NULL) for (; *k; ++k) {
+ switch (or->or_op) {
+ case SLAPI_OP_LESS:
+ if (slapi_berval_cmp (*v, *k) < 0) return 0;
+ break;
+ case SLAPI_OP_LESS_OR_EQUAL:
+ if (slapi_berval_cmp (*v, *k) <= 0) return 0;
+ break;
+ case SLAPI_OP_EQUAL:
+ if (SLAPI_BERVAL_EQ (*v, *k)) return 0;
+ break;
+ case SLAPI_OP_GREATER_OR_EQUAL:
+ if (slapi_berval_cmp (*v, *k) >= 0) return 0;
+ break;
+ case SLAPI_OP_GREATER:
+ if (slapi_berval_cmp (*v, *k) > 0) return 0;
+ break;
+ default:
+ break;
+ }
+ }
}
return -1;
}
@@ -599,7 +604,9 @@ op_indexer_destroy (Slapi_PBlock* pb)
auto indexer_t* ix = op_indexer_get (pb);
LDAPDebug (LDAP_DEBUG_FILTER, "op_indexer_destroy(%p)\n", (void*)ix, 0, 0);
if (ix != NULL) {
- indexer_free (ix);
+ indexer_free (ix);
+ /* The keys were freed, but we need to reset the pblock pointer */
+ slapi_pblock_set(pb, SLAPI_PLUGIN_MR_KEYS, NULL);
}
return 0;
}
@@ -652,10 +659,10 @@ typedef struct ss_indexer_t {
static void
ss_indexer_free (ss_indexer_t* ss)
{
- slapi_ch_free((void**)&ss->ss_oid);
+ slapi_ch_free_string(&ss->ss_oid);
if (ss->ss_indexer != NULL) {
- indexer_free (ss->ss_indexer);
- ss->ss_indexer = NULL;
+ indexer_free (ss->ss_indexer);
+ ss->ss_indexer = NULL;
}
slapi_ch_free((void**)&ss);
}
@@ -676,7 +683,9 @@ ss_indexer_destroy (Slapi_PBlock* pb)
auto ss_indexer_t* ss = ss_indexer_get (pb);
LDAPDebug (LDAP_DEBUG_FILTER, "ss_indexer_destroy(%p)\n", (void*)ss, 0, 0);
if (ss) {
- ss_indexer_free (ss);
+ ss_indexer_free(ss);
+ /* The keys were freed, but we need to reset the pblock pointer */
+ slapi_pblock_set(pb, SLAPI_PLUGIN_MR_KEYS, NULL);
}
}
diff --git a/ldap/servers/slapd/back-ldbm/sort.c b/ldap/servers/slapd/back-ldbm/sort.c
index 4164147..004b45c 100644
--- a/ldap/servers/slapd/back-ldbm/sort.c
+++ b/ldap/servers/slapd/back-ldbm/sort.c
@@ -61,15 +61,11 @@ static int print_out_sort_spec(char* buffer,sort_spec *s,int *size);
static void sort_spec_thing_free(sort_spec_thing *s)
{
- if (NULL != s->type) {
- slapi_ch_free((void **)&s->type);
- }
- if (NULL != s->matchrule) {
- slapi_ch_free( (void**)&s->matchrule);
- }
+ slapi_ch_free_string(&s->type);
+ slapi_ch_free_string(&s->matchrule);
if (NULL != s->mr_pb) {
destroy_matchrule_indexer(s->mr_pb);
- slapi_pblock_destroy (s->mr_pb);
+ slapi_pblock_destroy (s->mr_pb);
}
attr_done(&s->sattr);
slapi_ch_free( (void**)&s);
@@ -145,7 +141,7 @@ void sort_log_access(Slapi_PBlock *pb,sort_spec_thing *s,IDList *candidates)
/* Now output it */
ldbm_log_access_message(pb,buffer);
if (buffer != stack_buffer) {
- slapi_ch_free( (void**)&buffer);
+ slapi_ch_free_string(&buffer);
}
}
7 years, 7 months
- 1
- 0
Branch '389-ds-base-1.3.4' - ldap/servers
by Mark Reynolds
ldap/servers/plugins/collation/collate.c | 14 +++----
ldap/servers/plugins/collation/orfilter.c | 55 +++++++++++++++++-------------
ldap/servers/slapd/back-ldbm/sort.c | 12 ++----
3 files changed, 43 insertions(+), 38 deletions(-)
New commits:
commit c9dc1547b9c96967539b5f3caf7aedfbff3d475a
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Aug 30 10:32:45 2016 -0400
Ticket 48970 - Serverside sorting crashes the server
Bug Description: When using a matching rule and server side sorting
the server does a double-free on the matching rule
keys which crashes the server.
Fix Description: Set the pblock pointer to NULL after the keys are
freed. This prevents the double free.
Also fixed some complier warnings/indentation.
Valgrind: passed
https://fedorahosted.org/389/ticket/48970
Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 43997fa8782ca93e20595ae10e303d85e5b765f4)
diff --git a/ldap/servers/plugins/collation/collate.c b/ldap/servers/plugins/collation/collate.c
index 0480280..483a132 100644
--- a/ldap/servers/plugins/collation/collate.c
+++ b/ldap/servers/plugins/collation/collate.c
@@ -347,23 +347,23 @@ collation_index (indexer_t* ix, struct berval** bvec, struct berval** prefixes)
return keys;
}
+/* The destructor function for a collation-based indexer. */
static void
collation_indexer_destroy (indexer_t* ix)
- /* The destructor function for a collation-based indexer. */
{
collation_indexer_t* etc = (collation_indexer_t*) ix->ix_etc;
if (etc->converter) {
- ucnv_close(etc->converter);
- etc->converter = NULL;
+ ucnv_close(etc->converter);
+ etc->converter = NULL;
}
if (etc->collator) {
- ucol_close(etc->collator);
- etc->collator = NULL;
+ ucol_close(etc->collator);
+ etc->collator = NULL;
}
if (etc->ix_keys != NULL) {
- ber_bvecfree (etc->ix_keys);
- etc->ix_keys = NULL;
+ ber_bvecfree (etc->ix_keys);
+ etc->ix_keys = NULL;
}
slapi_ch_free((void**)&ix->ix_etc);
ix->ix_etc = NULL; /* just for hygiene */
diff --git a/ldap/servers/plugins/collation/orfilter.c b/ldap/servers/plugins/collation/orfilter.c
index 8dc4246..084fdf6 100644
--- a/ldap/servers/plugins/collation/orfilter.c
+++ b/ldap/servers/plugins/collation/orfilter.c
@@ -34,7 +34,7 @@ static void
indexer_free (indexer_t* ix)
{
if (ix->ix_destroy != NULL) {
- ix->ix_destroy (ix);
+ ix->ix_destroy (ix);
}
slapi_ch_free((void**)&ix);
}
@@ -221,23 +221,28 @@ op_filter_match (or_filter_t* or, struct berval** vals)
auto indexer_t* ix = or->or_indexer;
auto struct berval** v = ix->ix_index (ix, vals, NULL);
if (v != NULL) for (; *v; ++v) {
- auto struct berval** k = or->or_match_keys;
- if (k != NULL) for (; *k; ++k) {
- switch (or->or_op) {
- case SLAPI_OP_LESS:
- if (slapi_berval_cmp (*v, *k) < 0) return 0; break;
- case SLAPI_OP_LESS_OR_EQUAL:
- if (slapi_berval_cmp (*v, *k) <= 0) return 0; break;
- case SLAPI_OP_EQUAL:
- if (SLAPI_BERVAL_EQ (*v, *k)) return 0; break;
- case SLAPI_OP_GREATER_OR_EQUAL:
- if (slapi_berval_cmp (*v, *k) >= 0) return 0; break;
- case SLAPI_OP_GREATER:
- if (slapi_berval_cmp (*v, *k) > 0) return 0; break;
- default:
- break;
- }
- }
+ auto struct berval** k = or->or_match_keys;
+ if (k != NULL) for (; *k; ++k) {
+ switch (or->or_op) {
+ case SLAPI_OP_LESS:
+ if (slapi_berval_cmp (*v, *k) < 0) return 0;
+ break;
+ case SLAPI_OP_LESS_OR_EQUAL:
+ if (slapi_berval_cmp (*v, *k) <= 0) return 0;
+ break;
+ case SLAPI_OP_EQUAL:
+ if (SLAPI_BERVAL_EQ (*v, *k)) return 0;
+ break;
+ case SLAPI_OP_GREATER_OR_EQUAL:
+ if (slapi_berval_cmp (*v, *k) >= 0) return 0;
+ break;
+ case SLAPI_OP_GREATER:
+ if (slapi_berval_cmp (*v, *k) > 0) return 0;
+ break;
+ default:
+ break;
+ }
+ }
}
return -1;
}
@@ -570,7 +575,9 @@ op_indexer_destroy (Slapi_PBlock* pb)
auto indexer_t* ix = op_indexer_get (pb);
LDAPDebug (LDAP_DEBUG_FILTER, "op_indexer_destroy(%p)\n", (void*)ix, 0, 0);
if (ix != NULL) {
- indexer_free (ix);
+ indexer_free (ix);
+ /* The keys were freed, but we need to reset the pblock pointer */
+ slapi_pblock_set(pb, SLAPI_PLUGIN_MR_KEYS, NULL);
}
return 0;
}
@@ -623,10 +630,10 @@ typedef struct ss_indexer_t {
static void
ss_indexer_free (ss_indexer_t* ss)
{
- slapi_ch_free((void**)&ss->ss_oid);
+ slapi_ch_free_string(&ss->ss_oid);
if (ss->ss_indexer != NULL) {
- indexer_free (ss->ss_indexer);
- ss->ss_indexer = NULL;
+ indexer_free (ss->ss_indexer);
+ ss->ss_indexer = NULL;
}
slapi_ch_free((void**)&ss);
}
@@ -647,7 +654,9 @@ ss_indexer_destroy (Slapi_PBlock* pb)
auto ss_indexer_t* ss = ss_indexer_get (pb);
LDAPDebug (LDAP_DEBUG_FILTER, "ss_indexer_destroy(%p)\n", (void*)ss, 0, 0);
if (ss) {
- ss_indexer_free (ss);
+ ss_indexer_free(ss);
+ /* The keys were freed, but we need to reset the pblock pointer */
+ slapi_pblock_set(pb, SLAPI_PLUGIN_MR_KEYS, NULL);
}
}
diff --git a/ldap/servers/slapd/back-ldbm/sort.c b/ldap/servers/slapd/back-ldbm/sort.c
index 69fe659..46f2dbd 100644
--- a/ldap/servers/slapd/back-ldbm/sort.c
+++ b/ldap/servers/slapd/back-ldbm/sort.c
@@ -32,15 +32,11 @@ static int print_out_sort_spec(char* buffer,sort_spec *s,int *size);
static void sort_spec_thing_free(sort_spec_thing *s)
{
- if (NULL != s->type) {
- slapi_ch_free((void **)&s->type);
- }
- if (NULL != s->matchrule) {
- slapi_ch_free( (void**)&s->matchrule);
- }
+ slapi_ch_free_string(&s->type);
+ slapi_ch_free_string(&s->matchrule);
if (NULL != s->mr_pb) {
destroy_matchrule_indexer(s->mr_pb);
- slapi_pblock_destroy (s->mr_pb);
+ slapi_pblock_destroy (s->mr_pb);
}
attr_done(&s->sattr);
slapi_ch_free( (void**)&s);
@@ -116,7 +112,7 @@ void sort_log_access(Slapi_PBlock *pb,sort_spec_thing *s,IDList *candidates)
/* Now output it */
ldbm_log_access_message(pb,buffer);
if (buffer != stack_buffer) {
- slapi_ch_free( (void**)&buffer);
+ slapi_ch_free_string(&buffer);
}
}
7 years, 7 months
- 1
- 0