[389-ds-base] branch 389-ds-base-1.4.2 updated: Issue 50850 - Fix dsctl healthcheck for python36
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new 36e706f Issue 50850 - Fix dsctl healthcheck for python36
36e706f is described below
commit 36e706f6384051729f36d66b083d3894896a2b78
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Jan 23 12:22:21 2020 -0500
Issue 50850 - Fix dsctl healthcheck for python36
Description: dsctl health check, specifically the certificate expiring
checks, were using python37 specific functions, but these
do not work on python36. Needed to replace fromisoformat()
with something more portable.
relates: https://pagure.io/389-ds-base/issue/50850
Reviewed by: firstyear(Thanks!)
---
src/lib389/lib389/nss_ssl.py | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/lib389/lib389/nss_ssl.py b/src/lib389/lib389/nss_ssl.py
index 7c985d5..b1af141 100644
--- a/src/lib389/lib389/nss_ssl.py
+++ b/src/lib389/lib389/nss_ssl.py
@@ -79,13 +79,15 @@ class NssSsl(object):
cert_list.append(self.get_cert_details(cert[0]))
for cert in cert_list:
- if date.fromisoformat(cert[3].split()[0]) - date.today() < timedelta(days=0):
+ cert_date = cert[3].split()[0]
+ diff_date = datetime.strptime(cert_date, '%Y-%m-%d').date() - datetime.today().date()
+ if diff_date < timedelta(days=0):
# Expired
report = copy.deepcopy(DSCERTLE0002)
report['detail'] = report['detail'].replace('CERT', cert[0])
yield report
- elif date.fromisoformat(cert[3].split()[0]) - date.today() < timedelta(days=30):
- # Expiring
+ elif diff_date < timedelta(days=30):
+ # Expiring within 30 days
report = copy.deepcopy(DSCERTLE0001)
report['detail'] = report['detail'].replace('CERT', cert[0])
yield report
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] branch 389-ds-base-1.4.1 updated: Issue 49990 - Need to enforce a hard maximum limit for file descriptors
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.1 by this push:
new 25ba648 Issue 49990 - Need to enforce a hard maximum limit for file descriptors
25ba648 is described below
commit 25ba648553c7f0ae88d9fc05ca35659d7d7d29eb
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Jan 23 14:38:13 2020 -0500
Issue 49990 - Need to enforce a hard maximum limit for file descriptors
Description: on some platforms the maximum FD limit is high it can cause
a OOM at server startup. So we need to add a hard maximum
limit.
relates: https://pagure.io/389-ds-base/issue/49990
Reviewed by: firstyear & tbordaz (Thanks!!)
---
ldap/servers/slapd/libglobs.c | 10 +++++++---
ldap/servers/slapd/slap.h | 4 ++--
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 3d9b226..848e088 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -1549,7 +1549,9 @@ FrontendConfig_init(void)
#endif
/* Default the maximum fd's to the maximum allowed */
if (getrlimit(RLIMIT_NOFILE, &rlp) == 0) {
- maxdescriptors = (int64_t)rlp.rlim_max;
+ if ((int64_t)rlp.rlim_max < SLAPD_DEFAULT_MAXDESCRIPTORS) {
+ maxdescriptors = (int64_t)rlp.rlim_max;
+ }
}
/* Take the lock to make sure we barrier correctly. */
@@ -4314,7 +4316,7 @@ config_set_maxdescriptors(const char *attrname, char *value, char *errorbuf, int
{
int32_t retVal = LDAP_SUCCESS;
int64_t nValue = 0;
- int64_t maxVal = 524288;
+ int64_t maxVal = SLAPD_DEFAULT_MAXDESCRIPTORS;
struct rlimit rlp;
char *endp = NULL;
@@ -4325,7 +4327,9 @@ config_set_maxdescriptors(const char *attrname, char *value, char *errorbuf, int
}
if (0 == getrlimit(RLIMIT_NOFILE, &rlp)) {
- maxVal = (int)rlp.rlim_max;
+ if ((int64_t)rlp.rlim_max < maxVal) {
+ maxVal = (int64_t)rlp.rlim_max;
+ }
}
errno = 0;
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index fcf2f1a..b24f9cb 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -350,8 +350,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */
#define SLAPD_DEFAULT_PAGEDSIZELIMIT 0
#define SLAPD_DEFAULT_PAGEDSIZELIMIT_STR "0"
-#define SLAPD_DEFAULT_MAXDESCRIPTORS 8192
-#define SLAPD_DEFAULT_MAXDESCRIPTORS_STR "8192"
+#define SLAPD_DEFAULT_MAXDESCRIPTORS 1048576
+#define SLAPD_DEFAULT_MAXDESCRIPTORS_STR "1048576"
#define SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL 40
#define SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL_STR "40"
#define SLAPD_DEFAULT_GROUPEVALNESTLEVEL 0
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] branch 389-ds-base-1.4.2 updated: Issue 49990 - Need to enforce a hard maximum limit for file descriptors
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new f361de4 Issue 49990 - Need to enforce a hard maximum limit for file descriptors
f361de4 is described below
commit f361de4b73c3f9ab2ff917c317b4e16367cad115
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Jan 23 14:38:13 2020 -0500
Issue 49990 - Need to enforce a hard maximum limit for file descriptors
Description: on some platforms the maximum FD limit is high it can cause
a OOM at server startup. So we need to add a hard maximum
limit.
relates: https://pagure.io/389-ds-base/issue/49990
Reviewed by: firstyear & tbordaz (Thanks!!)
---
ldap/servers/slapd/libglobs.c | 10 +++++++---
ldap/servers/slapd/slap.h | 4 ++--
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 90c1e3d..2a58232 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -1559,7 +1559,9 @@ FrontendConfig_init(void)
#endif
/* Default the maximum fd's to the maximum allowed */
if (getrlimit(RLIMIT_NOFILE, &rlp) == 0) {
- maxdescriptors = (int64_t)rlp.rlim_max;
+ if ((int64_t)rlp.rlim_max < SLAPD_DEFAULT_MAXDESCRIPTORS) {
+ maxdescriptors = (int64_t)rlp.rlim_max;
+ }
}
/* Take the lock to make sure we barrier correctly. */
@@ -4324,7 +4326,7 @@ config_set_maxdescriptors(const char *attrname, char *value, char *errorbuf, int
{
int32_t retVal = LDAP_SUCCESS;
int64_t nValue = 0;
- int64_t maxVal = 524288;
+ int64_t maxVal = SLAPD_DEFAULT_MAXDESCRIPTORS;
struct rlimit rlp;
char *endp = NULL;
@@ -4335,7 +4337,9 @@ config_set_maxdescriptors(const char *attrname, char *value, char *errorbuf, int
}
if (0 == getrlimit(RLIMIT_NOFILE, &rlp)) {
- maxVal = (int)rlp.rlim_max;
+ if ((int64_t)rlp.rlim_max < maxVal) {
+ maxVal = (int64_t)rlp.rlim_max;
+ }
}
errno = 0;
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 44f6be9..96ce7d4 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -348,8 +348,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */
#define SLAPD_DEFAULT_PAGEDSIZELIMIT 0
#define SLAPD_DEFAULT_PAGEDSIZELIMIT_STR "0"
-#define SLAPD_DEFAULT_MAXDESCRIPTORS 8192
-#define SLAPD_DEFAULT_MAXDESCRIPTORS_STR "8192"
+#define SLAPD_DEFAULT_MAXDESCRIPTORS 1048576
+#define SLAPD_DEFAULT_MAXDESCRIPTORS_STR "1048576"
#define SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL 40
#define SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL_STR "40"
#define SLAPD_DEFAULT_GROUPEVALNESTLEVEL 0
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] 02/02: Bump version to 1.4.1.14
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
commit 10f7d40d3fd54abcb1b61dac6da09e709e24e0e4
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Jan 23 17:04:59 2020 -0500
Bump version to 1.4.1.14
---
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/VERSION.sh b/VERSION.sh
index 26b4ee3..b529f21 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=4
-VERSION_MAINT=1.13
+VERSION_MAINT=1.14
# NOTE: VERSION_PREREL is automatically set for builds made out of a git tree
VERSION_PREREL=
VERSION_DATE=$(date -u +%Y%m%d)
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] 01/02: Ticket 50727 - correct mistaken options in filter validation patch
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
commit 3b2b6dde7163820c9500479b070ffb5a63fbbdb9
Author: William Brown <william(a)blackhats.net.au>
AuthorDate: Fri Dec 6 14:04:45 2019 +1000
Ticket 50727 - correct mistaken options in filter validation patch
Bug Description: Because William of the past missed (forgot) to make
some agreed upon changes, we shipped the feature for filter validation
in a state that was a bit unclear for users.
Fix Description: Fix the options to now be clearer in what is
expected/demaned from admins. We now have 4 possible states for
the value of the config:
* reject-invalid (prev on)
* process-safe (prev warn)
* warn-invalid (new!)
* off (prev off)
These behave as:
* reject-invalid - reject queries that contain unknown attributes
* process-safe - log a notes=F that an attr is missing, and idl_alloc(0)
the missing attribute for RFC4511 compliance.
* warn-invalid - log a notes=F that an attr is missing, and process
as ALLIDS (the legacy behaviour)
* off - process as ALLIDs (the legacy behaviour)
The default is "process-safe".
https://pagure.io/389-ds-base/issue/50727
Author: William Brown <william(a)blackhats.net.au>
Review by: tbordaz, lkrispen (thanks)
---
.../tests/suites/filter/schema_validation_test.py | 112 +++++++++++++++++++--
ldap/servers/slapd/back-ldbm/filterindex.c | 28 ++++--
ldap/servers/slapd/libglobs.c | 83 +++++++++------
ldap/servers/slapd/schema.c | 26 +++--
ldap/servers/slapd/slap.h | 21 ++--
ldap/servers/slapd/slapi-plugin.h | 1 +
ldap/servers/slapd/slapi-private.h | 3 +-
src/lib389/lib389/extensibleobject.py | 53 ++++++++++
8 files changed, 261 insertions(+), 66 deletions(-)
diff --git a/dirsrvtests/tests/suites/filter/schema_validation_test.py b/dirsrvtests/tests/suites/filter/schema_validation_test.py
index 4ac9fa8..d0d67ca 100644
--- a/dirsrvtests/tests/suites/filter/schema_validation_test.py
+++ b/dirsrvtests/tests/suites/filter/schema_validation_test.py
@@ -9,14 +9,29 @@
import pytest
import ldap
-from lib389.topologies import topology_st
+from lib389.topologies import topology_st as topology_st_pre
from lib389.dirsrv_log import DirsrvAccessLog
from lib389._mapped_object import DSLdapObjects
from lib389._constants import DEFAULT_SUFFIX
+from lib389.extensibleobject import UnsafeExtensibleObjects
-def _check_value(inst_cfg, value):
+def _check_value(inst_cfg, value, exvalue=None):
+ if exvalue is None:
+ exvalue = value
inst_cfg.set('nsslapd-verify-filter-schema', value)
- assert(inst_cfg.get_attr_val_utf8('nsslapd-verify-filter-schema') == value)
+ assert(inst_cfg.get_attr_val_utf8('nsslapd-verify-filter-schema') == exvalue)
+
+(a)pytest.fixture(scope="module")
+def topology_st(topology_st_pre):
+ raw_objects = UnsafeExtensibleObjects(topology_st_pre.standalone, basedn=DEFAULT_SUFFIX)
+ # Add an object that won't be able to be queried due to invalid attrs.
+ raw_objects.create(properties = {
+ "cn": "test_obj",
+ "a": "a",
+ "b": "b",
+ "uid": "foo"
+ })
+ return topology_st_pre
@pytest.mark.ds50349
@@ -51,8 +66,14 @@ def test_filter_validation_config(topology_st):
initial_value = inst_cfg.get_attr_val_utf8('nsslapd-verify-filter-schema')
- _check_value(inst_cfg, "on")
- _check_value(inst_cfg, "warn")
+ # Check legacy values that may have been set
+ _check_value(inst_cfg, "on", "reject-invalid")
+ _check_value(inst_cfg, "warn", "process-safe")
+ _check_value(inst_cfg, "off")
+ # Check the more descriptive values
+ _check_value(inst_cfg, "reject-invalid")
+ _check_value(inst_cfg, "process-safe")
+ _check_value(inst_cfg, "warn-invalid")
_check_value(inst_cfg, "off")
# This should fail
@@ -85,7 +106,7 @@ def test_filter_validation_enabled(topology_st):
inst = topology_st.standalone
# In case the default has changed, we set the value to warn.
- inst.config.set("nsslapd-verify-filter-schema", "on")
+ inst.config.set("nsslapd-verify-filter-schema", "reject-invalid")
raw_objects = DSLdapObjects(inst, basedn=DEFAULT_SUFFIX)
# Check a good query has no errors.
@@ -104,9 +125,9 @@ def test_filter_validation_enabled(topology_st):
@pytest.mark.ds50349
-def test_filter_validation_warning(topology_st):
+def test_filter_validation_warn_safe(topology_st):
"""Test that queries which are invalid, are correctly marked as "notes=F" in
- the access log.
+ the access log, and return no entries or partial sets.
:id: 8b2b23fe-d878-435c-bc84-8c298be4ca1f
:setup: Standalone instance
@@ -122,7 +143,7 @@ def test_filter_validation_warning(topology_st):
inst = topology_st.standalone
# In case the default has changed, we set the value to warn.
- inst.config.set("nsslapd-verify-filter-schema", "warn")
+ inst.config.set("nsslapd-verify-filter-schema", "process-safe")
# Set the access log to un-buffered so we get it immediately.
inst.config.set("nsslapd-accesslog-logbuffering", "off")
@@ -139,20 +160,93 @@ def test_filter_validation_warning(topology_st):
# Check a good query has no warnings.
r = raw_objects.filter("(objectClass=*)")
+ assert(len(r) > 0)
r_s1 = access_log.match(".*notes=F.*")
# Should be the same number of log lines IE 0.
assert(len(r_init) == len(r_s1))
# Check a bad one DOES emit a warning.
r = raw_objects.filter("(a=a)")
+ assert(len(r) == 0)
r_s2 = access_log.match(".*notes=F.*")
# Should be the greate number of log lines IE +1
assert(len(r_init) + 1 == len(r_s2))
# Check a bad complex one does emit a warning.
r = raw_objects.filter("(&(a=a)(b=b)(objectClass=*))")
+ assert(len(r) == 0)
r_s3 = access_log.match(".*notes=F.*")
# Should be the greate number of log lines IE +2
assert(len(r_init) + 2 == len(r_s3))
+ # Check that we can still get things when partial
+ r = raw_objects.filter("(|(a=a)(b=b)(uid=foo))")
+ assert(len(r) == 1)
+ r_s4 = access_log.match(".*notes=F.*")
+ # Should be the greate number of log lines IE +2
+ assert(len(r_init) + 3 == len(r_s4))
+
+
+(a)pytest.mark.ds50349
+def test_filter_validation_warn_unsafe(topology_st):
+ """Test that queries which are invalid, are correctly marked as "notes=F" in
+ the access log, and uses the legacy query behaviour to return unsafe sets.
+
+ :id: 8b2b23fe-d878-435c-bc84-8c298be4ca1f
+ :setup: Standalone instance
+ :steps:
+ 1. Search a well formed query
+ 2. Search a poorly formed query
+ 3. Search a poorly formed complex (and/or) query
+ :expectedresults:
+ 1. No warnings
+ 2. notes=F is present
+ 3. notes=F is present
+ """
+ inst = topology_st.standalone
+
+ # In case the default has changed, we set the value to warn.
+ inst.config.set("nsslapd-verify-filter-schema", "warn-invalid")
+ # Set the access log to un-buffered so we get it immediately.
+ inst.config.set("nsslapd-accesslog-logbuffering", "off")
+
+ # Setup the query object.
+ # Now we don't care if there are any results, we only care about good/bad queries.
+ # To do this we have to bypass some of the lib389 magic, and just emit raw queries
+ # to check them. Turns out lib389 is well designed and this just works as expected
+ # if you use a single DSLdapObjects and filter. :)
+ raw_objects = DSLdapObjects(inst, basedn=DEFAULT_SUFFIX)
+
+ # Find any initial notes=F
+ access_log = DirsrvAccessLog(inst)
+ r_init = access_log.match(".*notes=(U,)?F.*")
+
+ # Check a good query has no warnings.
+ r = raw_objects.filter("(objectClass=*)")
+ assert(len(r) > 0)
+ r_s1 = access_log.match(".*notes=(U,)?F.*")
+ # Should be the same number of log lines IE 0.
+ assert(len(r_init) == len(r_s1))
+
+ # Check a bad one DOES emit a warning.
+ r = raw_objects.filter("(a=a)")
+ assert(len(r) == 1)
+ # NOTE: Unlike warn-process-safely, these become UNINDEXED and show in the logs.
+ r_s2 = access_log.match(".*notes=(U,)?F.*")
+ # Should be the greate number of log lines IE +1
+ assert(len(r_init) + 1 == len(r_s2))
+
+ # Check a bad complex one does emit a warning.
+ r = raw_objects.filter("(&(a=a)(b=b)(objectClass=*))")
+ assert(len(r) == 1)
+ r_s3 = access_log.match(".*notes=(U,)?F.*")
+ # Should be the greate number of log lines IE +2
+ assert(len(r_init) + 2 == len(r_s3))
+
+ # Check that we can still get things when partial
+ r = raw_objects.filter("(|(a=a)(b=b)(uid=foo))")
+ assert(len(r) == 1)
+ r_s4 = access_log.match(".*notes=(U,)?F.*")
+ # Should be the greate number of log lines IE +2
+ assert(len(r_init) + 3 == len(r_s4))
diff --git a/ldap/servers/slapd/back-ldbm/filterindex.c b/ldap/servers/slapd/back-ldbm/filterindex.c
index 7e65f73..8a79848 100644
--- a/ldap/servers/slapd/back-ldbm/filterindex.c
+++ b/ldap/servers/slapd/back-ldbm/filterindex.c
@@ -223,13 +223,15 @@ ava_candidates(
switch (ftype) {
case LDAP_FILTER_GE:
- if (f->f_flags & SLAPI_FILTER_INVALID_ATTR) {
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_WARN) {
/*
* REMEMBER: this flag is only set on WARN levels. If the filter verify
* is on strict, we reject in search.c, if we ar off, the flag will NOT
* be set on the filter at all!
*/
slapi_pblock_set_flag_operation_notes(pb, SLAPI_OP_NOTE_FILTER_INVALID);
+ }
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_UNDEFINE) {
idl = idl_alloc(0);
} else {
idl = range_candidates(pb, be, type, bval, NULL, err, &sattr, allidslimit);
@@ -239,13 +241,15 @@ ava_candidates(
goto done;
break;
case LDAP_FILTER_LE:
- if (f->f_flags & SLAPI_FILTER_INVALID_ATTR) {
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_WARN) {
/*
* REMEMBER: this flag is only set on WARN levels. If the filter verify
* is on strict, we reject in search.c, if we ar off, the flag will NOT
* be set on the filter at all!
*/
slapi_pblock_set_flag_operation_notes(pb, SLAPI_OP_NOTE_FILTER_INVALID);
+ }
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_UNDEFINE) {
idl = idl_alloc(0);
} else {
idl = range_candidates(pb, be, type, NULL, bval, err, &sattr, allidslimit);
@@ -293,13 +297,15 @@ ava_candidates(
ptr[1] = NULL;
ivals = ptr;
- if (f->f_flags & SLAPI_FILTER_INVALID_ATTR) {
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_WARN) {
/*
* REMEMBER: this flag is only set on WARN levels. If the filter verify
* is on strict, we reject in search.c, if we ar off, the flag will NOT
* be set on the filter at all!
*/
slapi_pblock_set_flag_operation_notes(pb, SLAPI_OP_NOTE_FILTER_INVALID);
+ }
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_UNDEFINE) {
idl = idl_alloc(0);
} else {
slapi_attr_assertion2keys_ava_sv(&sattr, &tmp, (Slapi_Value ***)&ivals, LDAP_FILTER_EQUALITY_FAST);
@@ -326,13 +332,15 @@ ava_candidates(
slapi_ch_free((void **)&ivals);
}
} else {
- if (f->f_flags & SLAPI_FILTER_INVALID_ATTR) {
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_WARN) {
/*
* REMEMBER: this flag is only set on WARN levels. If the filter verify
* is on strict, we reject in search.c, if we ar off, the flag will NOT
* be set on the filter at all!
*/
slapi_pblock_set_flag_operation_notes(pb, SLAPI_OP_NOTE_FILTER_INVALID);
+ }
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_UNDEFINE) {
idl = idl_alloc(0);
} else {
slapi_value_init_berval(&sv, bval);
@@ -382,13 +390,15 @@ presence_candidates(
}
slapi_pblock_get(pb, SLAPI_TXN, &txn.back_txn_txn);
- if (f->f_flags & SLAPI_FILTER_INVALID_ATTR) {
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_WARN) {
/*
* REMEMBER: this flag is only set on WARN levels. If the filter verify
* is on strict, we reject in search.c, if we ar off, the flag will NOT
* be set on the filter at all!
*/
slapi_pblock_set_flag_operation_notes(pb, SLAPI_OP_NOTE_FILTER_INVALID);
+ }
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_UNDEFINE) {
idl = idl_alloc(0);
} else {
idl = index_read_ext_allids(pb, be, type, indextype_PRESENCE,
@@ -485,13 +495,15 @@ extensible_candidates(
slapi_pblock_get(pb, SLAPI_PLUGIN_MR_KEYS, &keys)) {
/* something went wrong. bail. */
break;
- } else if (f->f_flags & SLAPI_FILTER_INVALID_ATTR) {
+ } else if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_WARN) {
/*
* REMEMBER: this flag is only set on WARN levels. If the filter verify
* is on strict, we reject in search.c, if we ar off, the flag will NOT
* be set on the filter at all!
*/
slapi_pblock_set_flag_operation_notes(pb, SLAPI_OP_NOTE_FILTER_INVALID);
+ }
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_UNDEFINE) {
idl = idl_alloc(0);
} else if (keys == NULL || keys[0] == NULL) {
/* no keys */
@@ -986,13 +998,15 @@ substring_candidates(
* look up each key in the index, ANDing the resulting
* IDLists together.
*/
- if (f->f_flags & SLAPI_FILTER_INVALID_ATTR) {
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_WARN) {
/*
* REMEMBER: this flag is only set on WARN levels. If the filter verify
* is on strict, we reject in search.c, if we ar off, the flag will NOT
* be set on the filter at all!
*/
slapi_pblock_set_flag_operation_notes(pb, SLAPI_OP_NOTE_FILTER_INVALID);
+ }
+ if (f->f_flags & SLAPI_FILTER_INVALID_ATTR_UNDEFINE) {
idl = idl_alloc(0);
} else {
slapi_pblock_get(pb, SLAPI_TXN, &txn.back_txn_txn);
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 5c8966d..3d9b226 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -161,7 +161,7 @@ typedef enum {
CONFIG_SPECIAL_VALIDATE_CERT_SWITCH, /* maps strings to an enumeration */
CONFIG_SPECIAL_UNHASHED_PW_SWITCH, /* unhashed pw: on/off/nolog */
CONFIG_SPECIAL_TLS_CHECK_CRL, /* maps enum tls_check_crl_t to char * */
- CONFIG_ON_OFF_WARN, /* maps to a config on/warn/off enum */
+ CONFIG_SPECIAL_FILTER_VERIFY, /* maps to a config strict/warn-strict/warn/off enum */
} ConfigVarType;
static int32_t config_set_onoff(const char *attrname, char *value, int32_t *configvalue, char *errorbuf, int apply);
@@ -251,7 +251,7 @@ slapi_int_t init_malloc_mmap_threshold;
slapi_onoff_t init_extract_pem;
slapi_onoff_t init_ignore_vattrs;
slapi_onoff_t init_enable_upgrade_hash;
-slapi_onwarnoff_t init_verify_filter_schema;
+slapi_special_filter_verify_t init_verify_filter_schema;
static int
isInt(ConfigVarType type)
@@ -1243,7 +1243,7 @@ static struct config_get_and_set
{CONFIG_VERIFY_FILTER_SCHEMA, config_set_verify_filter_schema,
NULL, 0,
(void **)&global_slapdFrontendConfig.verify_filter_schema,
- CONFIG_ON_OFF_WARN, (ConfigGetFunc)config_get_verify_filter_schema,
+ CONFIG_SPECIAL_FILTER_VERIFY, (ConfigGetFunc)config_get_verify_filter_schema,
&init_verify_filter_schema},
/* End config */
};
@@ -1773,7 +1773,7 @@ FrontendConfig_init(void)
* scheme set in cn=config
*/
init_enable_upgrade_hash = cfg->enable_upgrade_hash = LDAP_ON;
- init_verify_filter_schema = cfg->verify_filter_schema = SLAPI_WARN_UNSAFE;
+ init_verify_filter_schema = cfg->verify_filter_schema = SLAPI_WARN_SAFE;
/* Done, unlock! */
CFG_UNLOCK_WRITE(cfg);
@@ -7649,18 +7649,21 @@ config_initvalue_to_onoff(struct config_get_and_set *cgas, char *initvalbuf, siz
}
static char *
-config_initvalue_to_onwarnoff(struct config_get_and_set *cgas, char *initvalbuf, size_t initvalbufsize) {
+config_initvalue_to_special_filter_verify(struct config_get_and_set *cgas, char *initvalbuf, size_t initvalbufsize) {
char *retval = NULL;
- if (cgas->config_var_type == CONFIG_ON_OFF_WARN) {
- slapi_onwarnoff_t *value = (slapi_onwarnoff_t *)(intptr_t)cgas->initvalue;
+ if (cgas->config_var_type == CONFIG_SPECIAL_FILTER_VERIFY) {
+ slapi_special_filter_verify_t *value = (slapi_special_filter_verify_t *)(intptr_t)cgas->initvalue;
if (value != NULL) {
- if (*value == SLAPI_ON) {
- PR_snprintf(initvalbuf, initvalbufsize, "%s", "on");
+ if (*value == SLAPI_STRICT) {
+ PR_snprintf(initvalbuf, initvalbufsize, "%s", "reject-invalid");
retval = initvalbuf;
- } else if (*value == SLAPI_WARN) {
- PR_snprintf(initvalbuf, initvalbufsize, "%s", "warn");
+ } else if (*value == SLAPI_WARN_SAFE) {
+ PR_snprintf(initvalbuf, initvalbufsize, "%s", "process-safe");
retval = initvalbuf;
- } else if (*value == SLAPI_OFF) {
+ } else if (*value == SLAPI_WARN_UNSAFE) {
+ PR_snprintf(initvalbuf, initvalbufsize, "%s", "warn-invalid");
+ retval = initvalbuf;
+ } else if (*value == SLAPI_OFF_UNSAFE) {
PR_snprintf(initvalbuf, initvalbufsize, "%s", "off");
retval = initvalbuf;
}
@@ -7670,7 +7673,7 @@ config_initvalue_to_onwarnoff(struct config_get_and_set *cgas, char *initvalbuf,
}
static int32_t
-config_set_onoffwarn(slapdFrontendConfig_t *slapdFrontendConfig, slapi_onwarnoff_t *target, const char *attrname, char *value, char *errorbuf, int apply) {
+config_set_specialfilterverify(slapdFrontendConfig_t *slapdFrontendConfig, slapi_special_filter_verify_t *target, const char *attrname, char *value, char *errorbuf, int apply) {
if (target == NULL) {
return LDAP_OPERATIONS_ERROR;
}
@@ -7679,16 +7682,25 @@ config_set_onoffwarn(slapdFrontendConfig_t *slapdFrontendConfig, slapi_onwarnoff
return LDAP_OPERATIONS_ERROR;
}
- slapi_special_filter_verify_t p_val = SLAPI_WARN_UNSAFE;
+ slapi_special_filter_verify_t p_val = SLAPI_WARN_SAFE;
+
+ /* on/warn/off retained for legacy reasons due to wbrown making terrible mistakes :( :( */
if (strcasecmp(value, "on") == 0) {
- p_val = SLAPI_ON;
+ p_val = SLAPI_STRICT;
} else if (strcasecmp(value, "warn") == 0) {
- p_val = SLAPI_WARN;
+ p_val = SLAPI_WARN_SAFE;
+ /* The new fixed/descriptive names */
+ } else if (strcasecmp(value, "reject-invalid") == 0) {
+ p_val = SLAPI_STRICT;
+ } else if (strcasecmp(value, "process-safe") == 0) {
+ p_val = SLAPI_WARN_SAFE;
+ } else if (strcasecmp(value, "warn-invalid") == 0) {
+ p_val = SLAPI_WARN_UNSAFE;
} else if (strcasecmp(value, "off") == 0) {
- p_val = SLAPI_OFF;
+ p_val = SLAPI_OFF_UNSAFE;
} else {
slapi_create_errormsg(errorbuf, SLAPI_DSE_RETURNTEXT_SIZE,
- "%s: invalid value \"%s\". Valid values are \"on\", \"warn\" or \"off\".", attrname, value);
+ "%s: invalid value \"%s\". Valid values are \"reject-invalid\", \"process-safe\", \"warn-invalid\" or \"off\". If in doubt, choose \"process-safe\"", attrname, value);
return LDAP_OPERATIONS_ERROR;
}
@@ -7707,14 +7719,14 @@ config_set_onoffwarn(slapdFrontendConfig_t *slapdFrontendConfig, slapi_onwarnoff
int32_t
config_set_verify_filter_schema(const char *attrname, char *value, char *errorbuf, int apply) {
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
- slapi_onwarnoff_t *target = &(slapdFrontendConfig->verify_filter_schema);
- return config_set_onoffwarn(slapdFrontendConfig, target, attrname, value, errorbuf, apply);
+ slapi_special_filter_verify_t *target = &(slapdFrontendConfig->verify_filter_schema);
+ return config_set_specialfilterverify(slapdFrontendConfig, target, attrname, value, errorbuf, apply);
}
Slapi_Filter_Policy
config_get_verify_filter_schema()
{
- slapi_onwarnoff_t retVal;
+ slapi_special_filter_verify_t retVal;
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
CFG_LOCK_READ(slapdFrontendConfig);
retVal = slapdFrontendConfig->verify_filter_schema;
@@ -7722,10 +7734,13 @@ config_get_verify_filter_schema()
/* Now map this to a policy that the fns understand. */
switch (retVal) {
- case SLAPI_ON:
+ case SLAPI_STRICT:
return FILTER_POLICY_STRICT;
break;
- case SLAPI_WARN:
+ case SLAPI_WARN_SAFE:
+ return FILTER_POLICY_PROTECT;
+ break;
+ case SLAPI_WARN_UNSAFE:
return FILTER_POLICY_WARNING;
break;
default:
@@ -7783,8 +7798,8 @@ config_set(const char *attr, struct berval **values, char *errorbuf, int apply)
void *initval = cgas->initvalue;
if (cgas->config_var_type == CONFIG_ON_OFF) {
initval = (void *)config_initvalue_to_onoff(cgas, initvalbuf, sizeof(initvalbuf));
- } else if (cgas->config_var_type == CONFIG_ON_OFF_WARN) {
- initval = (void *)config_initvalue_to_onwarnoff(cgas, initvalbuf, sizeof(initvalbuf));
+ } else if (cgas->config_var_type == CONFIG_SPECIAL_FILTER_VERIFY) {
+ initval = (void *)config_initvalue_to_special_filter_verify(cgas, initvalbuf, sizeof(initvalbuf));
}
if (cgas->setfunc) {
retval = (cgas->setfunc)(cgas->attr_name, initval, errorbuf, apply);
@@ -8010,20 +8025,24 @@ config_set_value(
break;
- case CONFIG_ON_OFF_WARN:
+ case CONFIG_SPECIAL_FILTER_VERIFY:
/* Is this the right default here? */
if (!value) {
- slapi_entry_attr_set_charptr(e, cgas->attr_name, "off");
+ slapi_entry_attr_set_charptr(e, cgas->attr_name, "process-safe");
break;
}
- if (*((slapi_onwarnoff_t *)value) == SLAPI_ON) {
- slapi_entry_attr_set_charptr(e, cgas->attr_name, "on");
- } else if (*((slapi_onwarnoff_t *)value) == SLAPI_WARN) {
- slapi_entry_attr_set_charptr(e, cgas->attr_name, "warn");
+ if (*((slapi_special_filter_verify_t *)value) == SLAPI_STRICT) {
+ slapi_entry_attr_set_charptr(e, cgas->attr_name, "reject-invalid");
+ } else if (*((slapi_special_filter_verify_t *)value) == SLAPI_WARN_SAFE) {
+ slapi_entry_attr_set_charptr(e, cgas->attr_name, "process-safe");
+ } else if (*((slapi_special_filter_verify_t *)value) == SLAPI_WARN_UNSAFE) {
+ slapi_entry_attr_set_charptr(e, cgas->attr_name, "warn-invalid");
+ } else if (*((slapi_special_filter_verify_t *)value) == SLAPI_OFF_UNSAFE) {
+ slapi_entry_attr_set_charptr(e, cgas->attr_name, "off");
} else {
/* Default to safe warn-proccess-safely */
- slapi_entry_attr_set_charptr(e, cgas->attr_name, "warn-invalid");
+ slapi_entry_attr_set_charptr(e, cgas->attr_name, "process-safe");
}
break;
diff --git a/ldap/servers/slapd/schema.c b/ldap/servers/slapd/schema.c
index a294e67..d44b03b 100644
--- a/ldap/servers/slapd/schema.c
+++ b/ldap/servers/slapd/schema.c
@@ -698,7 +698,7 @@ out:
}
static Slapi_Filter_Result
-slapi_filter_schema_check_inner(Slapi_Filter *f) {
+slapi_filter_schema_check_inner(Slapi_Filter *f, slapi_filter_flags flags) {
/*
* Default response to Ok. If any more severe things happen we
* alter this to reflect it. IE we bubble up more severe errors
@@ -712,26 +712,26 @@ slapi_filter_schema_check_inner(Slapi_Filter *f) {
case LDAP_FILTER_LE:
case LDAP_FILTER_APPROX:
if (!attr_syntax_exist_by_name_nolock(f->f_avtype)) {
- f->f_flags |= SLAPI_FILTER_INVALID_ATTR;
+ f->f_flags |= flags;
r = FILTER_SCHEMA_WARNING;
}
break;
case LDAP_FILTER_PRESENT:
if (!attr_syntax_exist_by_name_nolock(f->f_type)) {
- f->f_flags |= SLAPI_FILTER_INVALID_ATTR;
+ f->f_flags |= flags;
r = FILTER_SCHEMA_WARNING;
}
break;
case LDAP_FILTER_SUBSTRINGS:
if (!attr_syntax_exist_by_name_nolock(f->f_sub_type)) {
- f->f_flags |= SLAPI_FILTER_INVALID_ATTR;
+ f->f_flags |= flags;
r = FILTER_SCHEMA_WARNING;
}
break;
case LDAP_FILTER_EXTENDED:
/* I don't have any examples of this, so I'm not 100% on how to check it */
if (!attr_syntax_exist_by_name_nolock(f->f_mr_type)) {
- f->f_flags |= SLAPI_FILTER_INVALID_ATTR;
+ f->f_flags |= flags;
r = FILTER_SCHEMA_WARNING;
}
break;
@@ -740,7 +740,7 @@ slapi_filter_schema_check_inner(Slapi_Filter *f) {
case LDAP_FILTER_NOT:
/* Recurse and check all elemments of the filter */
for (Slapi_Filter *f_child = f->f_list; f_child != NULL; f_child = f_child->f_next) {
- Slapi_Filter_Result ri = slapi_filter_schema_check_inner(f_child);
+ Slapi_Filter_Result ri = slapi_filter_schema_check_inner(f_child, flags);
if (ri > r) {
r = ri;
}
@@ -770,11 +770,23 @@ slapi_filter_schema_check(Slapi_PBlock *pb, Slapi_Filter *f, Slapi_Filter_Policy
}
/*
+ * There are two possible warning types - it's not up to us to warn into
+ * the logs, that's the backends job. So we have to flag a hint into the
+ * filter about what it should do. This is why there are two FILTER_INVALID
+ * types in filter_flags, one for logging it, and one for actually doing
+ * the rejection.
+ */
+ slapi_filter_flags flags = SLAPI_FILTER_INVALID_ATTR_WARN;
+ if (fp == FILTER_POLICY_PROTECT) {
+ flags |= SLAPI_FILTER_INVALID_ATTR_UNDEFINE;
+ }
+
+ /*
* Filters are nested, recursive structures, so we actually have to call an inner
* function until we have a result!
*/
attr_syntax_read_lock();
- Slapi_Filter_Result r = slapi_filter_schema_check_inner(f);
+ Slapi_Filter_Result r = slapi_filter_schema_check_inner(f, flags);
attr_syntax_unlock_read();
/* If any warning occured, ensure we fail it. */
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 1358eca..fcf2f1a 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -459,12 +459,12 @@ typedef enum _tls_check_crl_t {
TLS_CHECK_ALL = 2,
} tls_check_crl_t;
-typedef enum _slapi_onwarnoff_t {
- SLAPI_OFF = 0,
- SLAPI_WARN = 1,
- SLAPI_ON = 2,
-} slapi_onwarnoff_t;
-
+typedef enum _slapi_special_filter_verify_t {
+ SLAPI_STRICT = 0,
+ SLAPI_WARN_SAFE = 1,
+ SLAPI_WARN_UNSAFE = 2,
+ SLAPI_OFF_UNSAFE = 3,
+} slapi_special_filter_verify_t;
struct subfilt
{
@@ -2552,11 +2552,12 @@ typedef struct _slapdFrontendConfig
slapi_onoff_t enable_upgrade_hash; /* If on, upgrade hashes for PW at bind */
/*
* Do we verify the filters we recieve by schema?
- * on - yes, and reject if attribute not found
- * warn - yes, and warn that the attribute is unknown and unindexed
- * off - no, do whatever (old status-quo)
+ * reject-invalid - reject filter if there is anything invalid
+ * process-safe - allow the filter, warn about what's invalid, and then idl_alloc(0) with rfc compliance
+ * warn-invalid - allow the filter, warn about the invalid, and then do a ALLIDS (may lead to full table scan)
+ * off - don't warn, just allow anything. This is the legacy behaviour.
*/
- slapi_onwarnoff_t verify_filter_schema;
+ slapi_special_filter_verify_t verify_filter_schema;
} slapdFrontendConfig_t;
/* possible values for slapdFrontendConfig_t.schemareplace */
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
index 56fdfd4..596824c 100644
--- a/ldap/servers/slapd/slapi-plugin.h
+++ b/ldap/servers/slapd/slapi-plugin.h
@@ -1571,6 +1571,7 @@ int slapi_entry_syntax_check(Slapi_PBlock *pb, Slapi_Entry *e, int override);
typedef enum {
FILTER_POLICY_OFF,
FILTER_POLICY_WARNING,
+ FILTER_POLICY_PROTECT,
FILTER_POLICY_STRICT,
} Slapi_Filter_Policy;
diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h
index 4f3b740..0219912 100644
--- a/ldap/servers/slapd/slapi-private.h
+++ b/ldap/servers/slapd/slapi-private.h
@@ -54,7 +54,8 @@ typedef enum _slapi_filter_flags_t {
SLAPI_FILTER_RUV = 4,
SLAPI_FILTER_NORMALIZED_TYPE = 8,
SLAPI_FILTER_NORMALIZED_VALUE = 16,
- SLAPI_FILTER_INVALID_ATTR = 32,
+ SLAPI_FILTER_INVALID_ATTR_UNDEFINE = 32,
+ SLAPI_FILTER_INVALID_ATTR_WARN = 64,
} slapi_filter_flags;
#define SLAPI_ENTRY_LDAPSUBENTRY 2
diff --git a/src/lib389/lib389/extensibleobject.py b/src/lib389/lib389/extensibleobject.py
new file mode 100644
index 0000000..8fe37f9
--- /dev/null
+++ b/src/lib389/lib389/extensibleobject.py
@@ -0,0 +1,53 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2019, William Brown <william at blackhats.net.au>
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+
+from lib389._mapped_object import DSLdapObject, DSLdapObjects
+from lib389.utils import ensure_str
+
+class UnsafeExtensibleObject(DSLdapObject):
+ """A single instance of an extensible object. Extensible object by it's
+ nature is unsafe, eliminating rules around attribute checking. It may
+ cause unsafe or other unknown behaviour if not handled correctly.
+
+ :param instance: An instance
+ :type instance: lib389.DirSrv
+ :param dn: Entry DN
+ :type dn: str
+ """
+
+ def __init__(self, instance, dn=None):
+ super(UnsafeExtensibleObject, self).__init__(instance, dn)
+ self._rdn_attribute = "cn"
+ # Can I generate these from schema?
+ self._must_attributes = []
+ self._create_objectclasses = [
+ 'top',
+ 'extensibleObject',
+ ]
+ self._protected = False
+
+class UnsafeExtensibleObjects(DSLdapObjects):
+ """DSLdapObjects that represents all extensible objects. Extensible Objects
+ are unsafe in their nature, disabling many checks around schema and attribute
+ handling. You should really really REALLY not use this unless you have specific
+ needs for testing.
+
+ :param instance: An instance
+ :type instance: lib389.DirSrv
+ :param basedn: Base DN for all group entries below
+ :type basedn: str
+ """
+
+ def __init__(self, instance, basedn):
+ super(UnsafeExtensibleObjects, self).__init__(instance)
+ self._objectclasses = [
+ 'extensibleObject',
+ ]
+ self._filterattrs = ["cn"]
+ self._childobject = UnsafeExtensibleObject
+ self._basedn = ensure_str(basedn)
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] branch 389-ds-base-1.4.2 updated: Bump version to 1.4.2.7
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new 202953d Bump version to 1.4.2.7
202953d is described below
commit 202953d289cdfaf76b55eb78228a91f610144c79
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Jan 23 15:31:44 2020 -0500
Bump version to 1.4.2.7
---
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/VERSION.sh b/VERSION.sh
index 9fd3b72..7f7787f 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=4
-VERSION_MAINT=2.6
+VERSION_MAINT=2.7
# NOTE: VERSION_PREREL is automatically set for builds made out of a git tree
VERSION_PREREL=
VERSION_DATE=$(date -u +%Y%m%d)
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] branch master updated: Bump version to 1.4.3.2
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch master
in repository 389-ds-base.
The following commit(s) were added to refs/heads/master by this push:
new fda9349 Bump version to 1.4.3.2
fda9349 is described below
commit fda9349416b20636d605d60fc62a410303cc0e43
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Thu Jan 23 15:09:40 2020 -0500
Bump version to 1.4.3.2
---
VERSION.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/VERSION.sh b/VERSION.sh
index 90c0512..0983b05 100644
--- a/VERSION.sh
+++ b/VERSION.sh
@@ -10,7 +10,7 @@ vendor="389 Project"
# PACKAGE_VERSION is constructed from these
VERSION_MAJOR=1
VERSION_MINOR=4
-VERSION_MAINT=3.1
+VERSION_MAINT=3.2
# NOTE: VERSION_PREREL is automatically set for builds made out of a git tree
VERSION_PREREL=
VERSION_DATE=$(date -u +%Y%m%d)
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] branch 389-ds-base-1.4.1 updated: Ticket 50727 - change syntax validate by default in 1.4.2
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.1 by this push:
new 62432a2 Ticket 50727 - change syntax validate by default in 1.4.2
62432a2 is described below
commit 62432a29d44eddfe5109e24cb3d2d22cbd7268b7
Author: William Brown <william(a)blackhats.net.au>
AuthorDate: Wed Dec 18 13:14:24 2019 +1000
Ticket 50727 - change syntax validate by default in 1.4.2
Bug Description: The default syntax validate for 1.4.2 should be changed to
a softer introduction so that admins have time to prepare for the change
of query behaviour in 1.4.3.
Fix Description: Change default in 1.4.2 to warn-invalid, 1.4.3 will
remain as process-safe.
https://pagure.io/389-ds-base/issue/50727
Author: William Brown <william(a)blackhats.net.au>
Review by: tbordaz (Thanks)
---
ldap/servers/slapd/libglobs.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 167a3fe..5c8966d 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -1773,7 +1773,7 @@ FrontendConfig_init(void)
* scheme set in cn=config
*/
init_enable_upgrade_hash = cfg->enable_upgrade_hash = LDAP_ON;
- init_verify_filter_schema = cfg->verify_filter_schema = SLAPI_WARN;
+ init_verify_filter_schema = cfg->verify_filter_schema = SLAPI_WARN_UNSAFE;
/* Done, unlock! */
CFG_UNLOCK_WRITE(cfg);
@@ -7679,8 +7679,7 @@ config_set_onoffwarn(slapdFrontendConfig_t *slapdFrontendConfig, slapi_onwarnoff
return LDAP_OPERATIONS_ERROR;
}
- slapi_onwarnoff_t p_val = SLAPI_OFF;
-
+ slapi_special_filter_verify_t p_val = SLAPI_WARN_UNSAFE;
if (strcasecmp(value, "on") == 0) {
p_val = SLAPI_ON;
} else if (strcasecmp(value, "warn") == 0) {
@@ -8023,8 +8022,8 @@ config_set_value(
} else if (*((slapi_onwarnoff_t *)value) == SLAPI_WARN) {
slapi_entry_attr_set_charptr(e, cgas->attr_name, "warn");
} else {
- slapi_entry_attr_set_charptr(e, cgas->attr_name, "off");
- /* Default to off. */
+ /* Default to safe warn-proccess-safely */
+ slapi_entry_attr_set_charptr(e, cgas->attr_name, "warn-invalid");
}
break;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] branch 389-ds-base-1.4.1 updated: Issue 49254 - Fix compiler failures and warnings
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.1
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.1 by this push:
new 6297b13 Issue 49254 - Fix compiler failures and warnings
6297b13 is described below
commit 6297b13dcfc2f642cabe5b55926d521ad61dc3b5
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Wed Jan 22 15:10:04 2020 -0500
Issue 49254 - Fix compiler failures and warnings
Description: Fix issues with new gcc compiler flag "-fno-common",
and clean up doxygen warnings around libsds
relates: https://pagure.io/389-ds-base/issue/49254
Reviewed by: mhonek, spichugi, and tbordaz (Thanks!!!)
---
docs/slapi.doxy.in | 2 --
ldap/servers/plugins/acl/acl.c | 1 +
ldap/servers/plugins/acl/acl.h | 4 +--
ldap/servers/plugins/acl/acl_ext.c | 2 ++
ldap/servers/slapd/result.c | 8 +++--
ldap/servers/slapd/slap.h | 4 +--
ldap/servers/slapd/tools/ldclt/ldapfct.c | 2 +-
src/libsds/include/sds.h | 56 +++++++++++++++++++-------------
8 files changed, 47 insertions(+), 32 deletions(-)
diff --git a/docs/slapi.doxy.in b/docs/slapi.doxy.in
index 2cc2d5f..b1e4810 100644
--- a/docs/slapi.doxy.in
+++ b/docs/slapi.doxy.in
@@ -760,7 +760,6 @@ WARN_LOGFILE =
INPUT = src/libsds/include/sds.h \
docs/job-safety.md \
- src/nunc-stans/include/nunc-stans.h
# ldap/servers/slapd/slapi-plugin.h \
# This tag can be used to specify the character encoding of the source files
@@ -1101,7 +1100,6 @@ HTML_EXTRA_STYLESHEET = docs/custom.css
# HTML_EXTRA_FILES = docs/nunc-stans-intro.png \
# docs/nunc-stans-job-states.png
-HTML_EXTRA_FILES = docs/nunc-stans-job-states.png
# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. Doxygen
# will adjust the colors in the style sheet and background images according to
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 5680de6..41a909a 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -13,6 +13,7 @@
#include "acl.h"
+
/****************************************************************************
*
* acl.c
diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h
index 5d453d8..becc7f9 100644
--- a/ldap/servers/plugins/acl/acl.h
+++ b/ldap/servers/plugins/acl/acl.h
@@ -311,8 +311,8 @@ typedef struct aci
#define ATTR_ACLPB_MAX_SELECTED_ACLS "nsslapd-aclpb-max-selected-acls"
#define DEFAULT_ACLPB_MAX_SELECTED_ACLS 200
-int aclpb_max_selected_acls; /* initialized from plugin config entry */
-int aclpb_max_cache_results; /* initialized from plugin config entry */
+extern int aclpb_max_selected_acls; /* initialized from plugin config entry */
+extern int aclpb_max_cache_results; /* initialized from plugin config entry */
typedef struct result_cache
{
diff --git a/ldap/servers/plugins/acl/acl_ext.c b/ldap/servers/plugins/acl/acl_ext.c
index 31c61c2..797c5d2 100644
--- a/ldap/servers/plugins/acl/acl_ext.c
+++ b/ldap/servers/plugins/acl/acl_ext.c
@@ -23,6 +23,8 @@ static int acl__put_aclpb_back_to_pool(Acl_PBlock *aclpb);
static Acl_PBlock *acl__malloc_aclpb(void);
static void acl__free_aclpb(Acl_PBlock **aclpb_ptr);
+int aclpb_max_selected_acls = DEFAULT_ACLPB_MAX_SELECTED_ACLS;
+int aclpb_max_cache_results = DEFAULT_ACLPB_MAX_SELECTED_ACLS;
struct acl_pbqueue
{
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index bda44a8..7c060d3 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -1947,9 +1947,11 @@ notes2str(unsigned int notes, char *buf, size_t buflen)
*/
buflen -= len;
p += len;
- /* Put in the end quote, then back track p. */
- *p++ = '"';
- *p--;
+ /*
+ * Put in the end quote. If another snp_detail is append a comma
+ * will overwrite the quote.
+ */
+ *(p + 1) = '"';
}
}
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index 485fcab..1358eca 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -937,7 +937,7 @@ enum
};
/* DataList definition */
-struct datalist
+typedef struct datalist
{
void **elements; /* array of elements */
int element_count; /* number of elements in the array */
@@ -1744,7 +1744,7 @@ typedef struct conn
* * Online tasks interface (to support import, export, etc)
* * After some cleanup, we could consider making these public.
* */
-struct slapi_task
+typedef struct slapi_task
{
struct slapi_task *next;
char *task_dn;
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index ca0912d..dbfc553 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -698,7 +698,7 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
}
if (mode & VERY_VERBOSE)
printf("ldclt[%d]: T%03d: Before ldap_simple_bind_s (%s, %s)\n",
- mctx.pid, thrdNum, binddn,
+ mctx.pid, thrdNum, binddn ? binddn : "Anonymous",
passwd ? passwd : "NO PASSWORD PROVIDED");
ret = ldap_sasl_bind_s(ld, binddn,
LDAP_SASL_SIMPLE, &cred, NULL, NULL, &servercredp); /*JLS 05-01-01*/
diff --git a/src/libsds/include/sds.h b/src/libsds/include/sds.h
index c649c03..3f0dd86 100644
--- a/src/libsds/include/sds.h
+++ b/src/libsds/include/sds.h
@@ -221,13 +221,13 @@ void sds_free(void *ptr);
* sds_crc32c uses the crc32c algorithm to create a verification checksum of data.
* This checksum is for data verification, not cryptographic purposes. It is used
* largely in debugging to find cases when bytes in structures are updated incorrectly,
- * or to find memory bit flips during operation. If avaliable, this will use the
+ * or to find memory bit flips during operation. If available, this will use the
* intel sse4 crc32c hardware acceleration.
*
* \param crc The running CRC value. Initially should be 0. If in doubt, use 0.
* \param data Pointer to the data to checksum.
* \param length number of bytes to validate.
- * \retval crc The crc of this data. May be re-used in subsequent sds_crc32c calls
+ * \retval rcrc The crc of this data. May be re-used in subsequent sds_crc32c calls
* for certain datatypes.
*/
uint32_t sds_crc32c(uint32_t crc, const unsigned char *data, size_t length);
@@ -1356,48 +1356,60 @@ typedef enum _sds_ht_slot_state {
SDS_HT_BRANCH = 2,
} sds_ht_slot_state;
+/**
+ * ht values
+ */
typedef struct _sds_ht_value
{
- uint32_t checksum;
- void *key;
- void *value;
+ uint32_t checksum; /**< the checksum */
+ void *key; /**< the key */
+ void *value; /**< the key value */
// may make this a LL of values later for collisions
} sds_ht_value;
+/**
+ * ht slot
+ */
typedef struct _sds_ht_slot
{
- sds_ht_slot_state state;
+ sds_ht_slot_state state; /**< the checksum */
union
{
sds_ht_value *value;
struct _sds_ht_node *node;
- } slot;
+ } slot; /**< slot union */
} sds_ht_slot;
+/**
+ * ht node
+ */
typedef struct _sds_ht_node
{
- uint32_t checksum;
- uint64_t txn_id;
- uint_fast32_t count;
+ uint32_t checksum; /**< the checksum */
+ uint64_t txn_id; /**< transaction id */
+ uint_fast32_t count; /**< the count */
#ifdef SDS_DEBUG
uint64_t depth;
#endif
- struct _sds_ht_node *parent;
- size_t parent_slot;
- sds_ht_slot slots[HT_SLOTS];
+ struct _sds_ht_node *parent; /**< the parent */
+ size_t parent_slot; /**< the parent slot */
+ sds_ht_slot slots[HT_SLOTS]; /**< the slots */
} sds_ht_node;
+/**
+ * ht instance
+ */
typedef struct _sds_ht_instance
{
- uint32_t checksum;
- char hkey[16];
- sds_ht_node *root;
- int64_t (*key_cmp_fn)(void *a, void *b);
- uint64_t (*key_size_fn)(void *key);
- void *(*key_dup_fn)(void *key);
- void (*key_free_fn)(void *key);
- void *(*value_dup_fn)(void *value);
- void (*value_free_fn)(void *value);
+ uint32_t checksum; /**< the checksum */
+ char hkey[16]; /**< the key */
+ sds_ht_node *root; /**< the root */
+ int64_t (*key_cmp_fn)(void *a, void *b); /**< the keycompare function */
+ uint64_t (*key_size_fn)(void *key); /**< the key size function */
+ void *(*key_dup_fn)(void *key); /**< the key dup function */
+ void (*key_free_fn)(void *key); /**< the key free function */
+ void *(*value_dup_fn)(void *value); /**< the value dup function */
+ void (*value_free_fn)(void *value); /**< the value free function */
} sds_ht_instance;
uint64_t sds_uint64_t_size(void *key);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months
[389-ds-base] branch 389-ds-base-1.4.2 updated: Issue 49254 - Fix compiler failures and warnings
by pagure＠pagure.io
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.4.2
in repository 389-ds-base.
The following commit(s) were added to refs/heads/389-ds-base-1.4.2 by this push:
new a1f75e5 Issue 49254 - Fix compiler failures and warnings
a1f75e5 is described below
commit a1f75e568006f9cca3796ebe9a44a53d19e22b97
Author: Mark Reynolds <mreynolds(a)redhat.com>
AuthorDate: Wed Jan 22 15:10:04 2020 -0500
Issue 49254 - Fix compiler failures and warnings
Description: Fix issues with new gcc compiler flag "-fno-common",
and clean up doxygen warnings around libsds
relates: https://pagure.io/389-ds-base/issue/49254
Reviewed by: mhonek, spichugi, and tbordaz (Thanks!!!)
---
docs/slapi.doxy.in | 2 --
ldap/servers/plugins/acl/acl.c | 1 +
ldap/servers/plugins/acl/acl.h | 4 +--
ldap/servers/plugins/acl/acl_ext.c | 2 ++
ldap/servers/slapd/result.c | 8 +++--
ldap/servers/slapd/slap.h | 4 +--
ldap/servers/slapd/tools/ldclt/ldapfct.c | 2 +-
src/libsds/include/sds.h | 56 +++++++++++++++++++-------------
8 files changed, 47 insertions(+), 32 deletions(-)
diff --git a/docs/slapi.doxy.in b/docs/slapi.doxy.in
index 2cc2d5f..b1e4810 100644
--- a/docs/slapi.doxy.in
+++ b/docs/slapi.doxy.in
@@ -760,7 +760,6 @@ WARN_LOGFILE =
INPUT = src/libsds/include/sds.h \
docs/job-safety.md \
- src/nunc-stans/include/nunc-stans.h
# ldap/servers/slapd/slapi-plugin.h \
# This tag can be used to specify the character encoding of the source files
@@ -1101,7 +1100,6 @@ HTML_EXTRA_STYLESHEET = docs/custom.css
# HTML_EXTRA_FILES = docs/nunc-stans-intro.png \
# docs/nunc-stans-job-states.png
-HTML_EXTRA_FILES = docs/nunc-stans-job-states.png
# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. Doxygen
# will adjust the colors in the style sheet and background images according to
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index 5680de6..41a909a 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -13,6 +13,7 @@
#include "acl.h"
+
/****************************************************************************
*
* acl.c
diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h
index 5d453d8..becc7f9 100644
--- a/ldap/servers/plugins/acl/acl.h
+++ b/ldap/servers/plugins/acl/acl.h
@@ -311,8 +311,8 @@ typedef struct aci
#define ATTR_ACLPB_MAX_SELECTED_ACLS "nsslapd-aclpb-max-selected-acls"
#define DEFAULT_ACLPB_MAX_SELECTED_ACLS 200
-int aclpb_max_selected_acls; /* initialized from plugin config entry */
-int aclpb_max_cache_results; /* initialized from plugin config entry */
+extern int aclpb_max_selected_acls; /* initialized from plugin config entry */
+extern int aclpb_max_cache_results; /* initialized from plugin config entry */
typedef struct result_cache
{
diff --git a/ldap/servers/plugins/acl/acl_ext.c b/ldap/servers/plugins/acl/acl_ext.c
index 31c61c2..797c5d2 100644
--- a/ldap/servers/plugins/acl/acl_ext.c
+++ b/ldap/servers/plugins/acl/acl_ext.c
@@ -23,6 +23,8 @@ static int acl__put_aclpb_back_to_pool(Acl_PBlock *aclpb);
static Acl_PBlock *acl__malloc_aclpb(void);
static void acl__free_aclpb(Acl_PBlock **aclpb_ptr);
+int aclpb_max_selected_acls = DEFAULT_ACLPB_MAX_SELECTED_ACLS;
+int aclpb_max_cache_results = DEFAULT_ACLPB_MAX_SELECTED_ACLS;
struct acl_pbqueue
{
diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c
index 89f7767..0b13c30 100644
--- a/ldap/servers/slapd/result.c
+++ b/ldap/servers/slapd/result.c
@@ -1954,9 +1954,11 @@ notes2str(unsigned int notes, char *buf, size_t buflen)
*/
buflen -= len;
p += len;
- /* Put in the end quote, then back track p. */
- *p++ = '"';
- *p--;
+ /*
+ * Put in the end quote. If another snp_detail is append a comma
+ * will overwrite the quote.
+ */
+ *(p + 1) = '"';
}
}
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index d73e9aa..44f6be9 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -935,7 +935,7 @@ enum
};
/* DataList definition */
-struct datalist
+typedef struct datalist
{
void **elements; /* array of elements */
int element_count; /* number of elements in the array */
@@ -1737,7 +1737,7 @@ typedef struct conn
* * Online tasks interface (to support import, export, etc)
* * After some cleanup, we could consider making these public.
* */
-struct slapi_task
+typedef struct slapi_task
{
struct slapi_task *next;
char *task_dn;
diff --git a/ldap/servers/slapd/tools/ldclt/ldapfct.c b/ldap/servers/slapd/tools/ldclt/ldapfct.c
index ca0912d..dbfc553 100644
--- a/ldap/servers/slapd/tools/ldclt/ldapfct.c
+++ b/ldap/servers/slapd/tools/ldclt/ldapfct.c
@@ -698,7 +698,7 @@ connectToLDAP(thread_context *tttctx, const char *bufBindDN, const char *bufPass
}
if (mode & VERY_VERBOSE)
printf("ldclt[%d]: T%03d: Before ldap_simple_bind_s (%s, %s)\n",
- mctx.pid, thrdNum, binddn,
+ mctx.pid, thrdNum, binddn ? binddn : "Anonymous",
passwd ? passwd : "NO PASSWORD PROVIDED");
ret = ldap_sasl_bind_s(ld, binddn,
LDAP_SASL_SIMPLE, &cred, NULL, NULL, &servercredp); /*JLS 05-01-01*/
diff --git a/src/libsds/include/sds.h b/src/libsds/include/sds.h
index c649c03..3f0dd86 100644
--- a/src/libsds/include/sds.h
+++ b/src/libsds/include/sds.h
@@ -221,13 +221,13 @@ void sds_free(void *ptr);
* sds_crc32c uses the crc32c algorithm to create a verification checksum of data.
* This checksum is for data verification, not cryptographic purposes. It is used
* largely in debugging to find cases when bytes in structures are updated incorrectly,
- * or to find memory bit flips during operation. If avaliable, this will use the
+ * or to find memory bit flips during operation. If available, this will use the
* intel sse4 crc32c hardware acceleration.
*
* \param crc The running CRC value. Initially should be 0. If in doubt, use 0.
* \param data Pointer to the data to checksum.
* \param length number of bytes to validate.
- * \retval crc The crc of this data. May be re-used in subsequent sds_crc32c calls
+ * \retval rcrc The crc of this data. May be re-used in subsequent sds_crc32c calls
* for certain datatypes.
*/
uint32_t sds_crc32c(uint32_t crc, const unsigned char *data, size_t length);
@@ -1356,48 +1356,60 @@ typedef enum _sds_ht_slot_state {
SDS_HT_BRANCH = 2,
} sds_ht_slot_state;
+/**
+ * ht values
+ */
typedef struct _sds_ht_value
{
- uint32_t checksum;
- void *key;
- void *value;
+ uint32_t checksum; /**< the checksum */
+ void *key; /**< the key */
+ void *value; /**< the key value */
// may make this a LL of values later for collisions
} sds_ht_value;
+/**
+ * ht slot
+ */
typedef struct _sds_ht_slot
{
- sds_ht_slot_state state;
+ sds_ht_slot_state state; /**< the checksum */
union
{
sds_ht_value *value;
struct _sds_ht_node *node;
- } slot;
+ } slot; /**< slot union */
} sds_ht_slot;
+/**
+ * ht node
+ */
typedef struct _sds_ht_node
{
- uint32_t checksum;
- uint64_t txn_id;
- uint_fast32_t count;
+ uint32_t checksum; /**< the checksum */
+ uint64_t txn_id; /**< transaction id */
+ uint_fast32_t count; /**< the count */
#ifdef SDS_DEBUG
uint64_t depth;
#endif
- struct _sds_ht_node *parent;
- size_t parent_slot;
- sds_ht_slot slots[HT_SLOTS];
+ struct _sds_ht_node *parent; /**< the parent */
+ size_t parent_slot; /**< the parent slot */
+ sds_ht_slot slots[HT_SLOTS]; /**< the slots */
} sds_ht_node;
+/**
+ * ht instance
+ */
typedef struct _sds_ht_instance
{
- uint32_t checksum;
- char hkey[16];
- sds_ht_node *root;
- int64_t (*key_cmp_fn)(void *a, void *b);
- uint64_t (*key_size_fn)(void *key);
- void *(*key_dup_fn)(void *key);
- void (*key_free_fn)(void *key);
- void *(*value_dup_fn)(void *value);
- void (*value_free_fn)(void *value);
+ uint32_t checksum; /**< the checksum */
+ char hkey[16]; /**< the key */
+ sds_ht_node *root; /**< the root */
+ int64_t (*key_cmp_fn)(void *a, void *b); /**< the keycompare function */
+ uint64_t (*key_size_fn)(void *key); /**< the key size function */
+ void *(*key_dup_fn)(void *key); /**< the key dup function */
+ void (*key_free_fn)(void *key); /**< the key free function */
+ void *(*value_dup_fn)(void *value); /**< the value dup function */
+ void (*value_free_fn)(void *value); /**< the value free function */
} sds_ht_instance;
uint64_t sds_uint64_t_size(void *key);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
4 years, 2 months