diff --git a/0037-Issue-7271-implement-a-pre-close-plugin-function.patch b/0037-Issue-7271-implement-a-pre-close-plugin-function.patch new file mode 100644 index 0000000..cda832c --- /dev/null +++ b/0037-Issue-7271-implement-a-pre-close-plugin-function.patch @@ -0,0 +1,262 @@ +From c6bb96c95dcbff0052fc2decab7020b0f833f313 Mon Sep 17 00:00:00 2001 +From: Mark Reynolds +Date: Mon, 2 Mar 2026 14:31:29 -0500 +Subject: [PATCH] Issue 7271 - implement a pre-close plugin function + +Description: + +replication protocol could benefit from being notifioed the shutdown process +has started before calling the "close" plugin function. This would allow the +replication protocol to wake up and adjust its active thread count to prevent +a hang during shutdown. + +relates: https://github.com/389ds/389-ds-base/issues/7271 + +Reviewed by: progier, spichugi, and vashirov(Thanks!!!) +--- + ldap/servers/plugins/replication/repl5_init.c | 19 ++++++++---- + ldap/servers/slapd/daemon.c | 6 +++- + ldap/servers/slapd/pblock.c | 30 +++++++++++++------ + ldap/servers/slapd/plugin.c | 24 ++++++++++++++- + ldap/servers/slapd/proto-slap.h | 3 +- + ldap/servers/slapd/slap.h | 3 +- + ldap/servers/slapd/slapi-plugin.h | 3 +- + 7 files changed, 69 insertions(+), 19 deletions(-) + +diff --git a/ldap/servers/plugins/replication/repl5_init.c b/ldap/servers/plugins/replication/repl5_init.c +index 5047fb8dc..395744db8 100644 +--- a/ldap/servers/plugins/replication/repl5_init.c ++++ b/ldap/servers/plugins/replication/repl5_init.c +@@ -1,6 +1,6 @@ + /** BEGIN COPYRIGHT BLOCK + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. +- * Copyright (C) 2005 Red Hat, Inc. ++ * Copyright (C) 2026 Red Hat, Inc. + * All rights reserved. + * + * License: GPL (version 3 or any later version). +@@ -122,6 +122,8 @@ static PRUintn thread_private_agmtname; /* thread private index for logging*/ + static PRUintn thread_private_cache; + static PRUintn thread_primary_csn; + ++static int multisupplier_pre_stop(Slapi_PBlock *pb __attribute__((unused))); ++ + char * + get_thread_private_agmtname() + { +@@ -836,10 +838,6 @@ multisupplier_stop(Slapi_PBlock *pb __attribute__((unused))) + int rc = 0; /* OK */ + + if (!multisupplier_stopped_flag) { +- if (!is_ldif_dump) { +- /* Shut down replication agreements */ +- agmtlist_shutdown(); +- } + /* if we are cleaning a ruv, stop */ + stop_ruv_cleaning(); + /* unregister backend state change notification */ +@@ -853,6 +851,16 @@ multisupplier_stop(Slapi_PBlock *pb __attribute__((unused))) + return rc; + } + ++static int ++multisupplier_pre_stop(Slapi_PBlock *pb __attribute__((unused))) ++{ ++ if (!multisupplier_stopped_flag) { ++ /* Shut down replication agreements which will stop all the ++ * replication protocol threads */ ++ agmtlist_shutdown(); ++ } ++ return 0; ++} + + PRBool + multisupplier_started() +@@ -900,6 +908,7 @@ replication_multisupplier_plugin_init(Slapi_PBlock *pb) + rc = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&multisupplierdesc); + rc = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, (void *)multisupplier_start); + rc = slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN, (void *)multisupplier_stop); ++ rc = slapi_pblock_set(pb, SLAPI_PLUGIN_PRE_CLOSE_FN, (void *)multisupplier_pre_stop); + + /* Register the plugin interfaces we implement */ + /* preop acquires csn generator handle */ +diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c +index d6911f03c..7fc1a16f1 100644 +--- a/ldap/servers/slapd/daemon.c ++++ b/ldap/servers/slapd/daemon.c +@@ -1,6 +1,6 @@ + /** BEGIN COPYRIGHT BLOCK + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. +- * Copyright (C) 2021 Red Hat, Inc. ++ * Copyright (C) 2026 Red Hat, Inc. + * All rights reserved. + * + * License: GPL (version 3 or any later version). +@@ -1216,6 +1216,10 @@ slapd_daemon(daemon_ports_t *ports) + task_cancel_all(); + } + ++ /* Call plugin pre close functions */ ++ plugin_pre_closeall(); ++ ++ /* Now wait for active threads to terminate */ + threads = g_get_active_threadcnt(); + if (threads > 0) { + slapi_log_err(SLAPI_LOG_INFO, "slapd_daemon", +diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c +index 76e26cb86..90114dee1 100644 +--- a/ldap/servers/slapd/pblock.c ++++ b/ldap/servers/slapd/pblock.c +@@ -1,12 +1,12 @@ +-/** BEGIN COPYRIGHT BLOCK +- * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. +- * Copyright (C) 2005-2025 Red Hat, Inc. +- * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. +- * All rights reserved. +- * +- * License: GPL (version 3 or any later version). +- * See LICENSE for details. +- * END COPYRIGHT BLOCK **/ ++ /** BEGIN COPYRIGHT BLOCK ++ * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. ++ * Copyright (C) 2026 Red Hat, Inc. ++ * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. ++ * All rights reserved. ++ * ++ * License: GPL (version 3 or any later version). ++ * See LICENSE for details. ++ * END COPYRIGHT BLOCK **/ + + #ifdef HAVE_CONFIG_H + #include +@@ -2524,6 +2524,14 @@ slapi_pblock_get(Slapi_PBlock *pblock, int arg, void *value) + } + break; + ++ case SLAPI_PLUGIN_PRE_CLOSE_FN: ++ if (pblock->pb_plugin != NULL) { ++ (*(IFP *)value) = pblock->pb_plugin->plg_pre_close; ++ } else { ++ (*(IFP *)value) = NULL; ++ } ++ break; ++ + default: + slapi_log_err(SLAPI_LOG_ERR, "slapi_pblock_get", "Unknown parameter block argument %d\n", arg); + PR_ASSERT(0); +@@ -4209,6 +4217,10 @@ slapi_pblock_set(Slapi_PBlock *pblock, int arg, void *value) + pblock->pb_misc->pb_aci_target_check = *((int *)value); + break; + ++ case SLAPI_PLUGIN_PRE_CLOSE_FN: ++ pblock->pb_plugin->plg_pre_close = (IFP)value; ++ break; ++ + default: + slapi_log_err(SLAPI_LOG_ERR, "slapi_pblock_set", + "Unknown parameter block argument %d\n", arg); +diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c +index 52d25e19e..95b8de894 100644 +--- a/ldap/servers/slapd/plugin.c ++++ b/ldap/servers/slapd/plugin.c +@@ -1,6 +1,6 @@ + /** BEGIN COPYRIGHT BLOCK + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. +- * Copyright (C) 2021 Red Hat, Inc. ++ * Copyright (C) 2026 Red Hat, Inc. + * All rights reserved. + * + * License: GPL (version 3 or any later version). +@@ -1847,6 +1847,28 @@ plugin_dependency_closeall(void) + } + } + ++/* Call the pre close functions of all the plugins */ ++void ++plugin_pre_closeall(void) ++{ ++ Slapi_PBlock *pb = NULL; ++ int plugins_pre_closed = 0; ++ int index = 0; ++ ++ while (plugins_pre_closed < global_plugins_started) { ++ if (global_plugin_shutdown_order[index].name) { ++ if (!global_plugin_shutdown_order[index].removed) { ++ pb = slapi_pblock_new(); ++ plugin_call_one(global_plugin_shutdown_order[index].plugin, ++ SLAPI_PLUGIN_PRE_CLOSE_FN, pb); ++ slapi_pblock_destroy(pb); ++ } ++ plugins_pre_closed++; ++ } ++ index++; ++ } ++} ++ + void + plugin_freeall(void) + { +diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h +index 742e3ee14..fd5bc6e71 100644 +--- a/ldap/servers/slapd/proto-slap.h ++++ b/ldap/servers/slapd/proto-slap.h +@@ -1,6 +1,6 @@ + /** BEGIN COPYRIGHT BLOCK + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. +- * Copyright (C) 2021-2025 Red Hat, Inc. ++ * Copyright (C) 2026 Red Hat, Inc. + * All rights reserved. + * + * License: GPL (version 3 or any later version). +@@ -982,6 +982,7 @@ int plugin_call_exop_plugins(Slapi_PBlock *pb, struct slapdplugin *p); + Slapi_Backend *plugin_extended_op_getbackend(Slapi_PBlock *pb, struct slapdplugin *p); + const char *plugin_extended_op_oid2string(const char *oid); + void plugin_closeall(int close_backends, int close_globals); ++void plugin_pre_closeall(void); + void plugin_dependency_freeall(void); + void plugin_startall(int argc, char **argv, char **plugin_list); + void plugin_get_plugin_dependencies(char *plugin_name, char ***names); +diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h +index fee5a6ab5..64f9f465b 100644 +--- a/ldap/servers/slapd/slap.h ++++ b/ldap/servers/slapd/slap.h +@@ -1,7 +1,7 @@ + /** BEGIN COPYRIGHT BLOCK + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. + * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. +- * Copyright (C) 2009-2025 Red Hat, Inc. ++ * Copyright (C) 2026 Red Hat, Inc. + * All rights reserved. + * + * Contributors: +@@ -1035,6 +1035,7 @@ struct slapdplugin + char *plg_libpath; /* library path for dll/so */ + char *plg_initfunc; /* init symbol */ + IFP plg_close; /* close function */ ++ IFP plg_pre_close; /* pre close function */ + Slapi_PluginDesc plg_desc; /* vendor's info */ + char *plg_name; /* used for plugin rdn in cn=config */ + struct slapdplugin *plg_next; /* for plugin lists */ +diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h +index 5d9ef289d..4661d2cf0 100644 +--- a/ldap/servers/slapd/slapi-plugin.h ++++ b/ldap/servers/slapd/slapi-plugin.h +@@ -1,6 +1,6 @@ + /* BEGIN COPYRIGHT BLOCK + * Copyright (C) 2001 Sun Microsystems, Inc. Used by permission. +- * Copyright (C) 2021 Red Hat, Inc. ++ * Copyright (C) 2026 Red Hat, Inc. + * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. + * All rights reserved. + * +@@ -7082,6 +7082,7 @@ typedef struct slapi_plugindesc + + /* miscellaneous plugin functions */ + #define SLAPI_PLUGIN_CLOSE_FN 210 ++#define SLAPI_PLUGIN_PRE_CLOSE_FN 211 + #define SLAPI_PLUGIN_START_FN 212 + #define SLAPI_PLUGIN_CLEANUP_FN 232 + #define SLAPI_PLUGIN_POSTSTART_FN 233 +-- +2.53.0 + diff --git a/0038-Issue-7271-Add-new-plugin-pre-close-function-check-t.patch b/0038-Issue-7271-Add-new-plugin-pre-close-function-check-t.patch new file mode 100644 index 0000000..e3f43c0 --- /dev/null +++ b/0038-Issue-7271-Add-new-plugin-pre-close-function-check-t.patch @@ -0,0 +1,34 @@ +From 21b9e00264437dff3b6b81355cd159485bfdaf37 Mon Sep 17 00:00:00 2001 +From: Mark Reynolds +Date: Wed, 4 Mar 2026 14:47:01 -0500 +Subject: [PATCH] Issue 7271 - Add new plugin pre-close function check to + plugin_invoke_plugin_pb + +Description: + +In plugin_invoke_plugin_pb we were not checking for the new pre-close function +which led to an error in the logs: pb_op is NULL. In a debug build this leads +to an assertion error at shutdown. + +relates: https://github.com/389ds/389-ds-base/issues/7271 + +Reviewed by: vashirov(Thanks!) +--- + ldap/servers/slapd/plugin.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/ldap/servers/slapd/plugin.c b/ldap/servers/slapd/plugin.c +index 95b8de894..c1b0571eb 100644 +--- a/ldap/servers/slapd/plugin.c ++++ b/ldap/servers/slapd/plugin.c +@@ -3647,6 +3647,7 @@ plugin_invoke_plugin_pb(struct slapdplugin *plugin, int operation, Slapi_PBlock + if (operation == SLAPI_PLUGIN_START_FN || + operation == SLAPI_PLUGIN_POSTSTART_FN || + operation == SLAPI_PLUGIN_CLOSE_FN || ++ operation == SLAPI_PLUGIN_PRE_CLOSE_FN || + operation == SLAPI_PLUGIN_CLEANUP_FN || + operation == SLAPI_PLUGIN_BE_PRE_CLOSE_FN || + operation == SLAPI_PLUGIN_BE_POST_OPEN_FN || +-- +2.53.0 + diff --git a/389-ds-base.spec b/389-ds-base.spec index 17df614..fead9da 100644 --- a/389-ds-base.spec +++ b/389-ds-base.spec @@ -47,7 +47,7 @@ ExcludeArch: i686 Summary: 389 Directory Server (base) Name: 389-ds-base Version: 2.8.0 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-3.0-or-later WITH GPL-3.0-389-ds-base-exception AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0) AND Unicode-3.0 AND (MIT OR Unlicense) AND Apache-2.0 AND MIT AND MPL-2.0 AND Zlib URL: https://www.port389.org Conflicts: selinux-policy-base < 3.9.8 @@ -307,6 +307,8 @@ Patch: 0033-Issue-7053-Remove-memberof_del_dn_from_groups-from-M.patc Patch: 0034-Issue-5853-Update-concread-to-0.5.10.patch Patch: 0035-Issue-7271-plugins-that-create-threads-need-to-updat.patch Patch: 0036-Security-fix-for-CVE-2025-14905.patch +Patch: 0037-Issue-7271-implement-a-pre-close-plugin-function.patch +Patch: 0038-Issue-7271-Add-new-plugin-pre-close-function-check-t.patch %description 389 Directory Server is an LDAPv3 compliant server. The base package includes @@ -584,7 +586,7 @@ fi # Reload our sysctl before we restart (if we can) sysctl --system &> $output; true -# Gather running instances, stop them, run index-check, then restart +# Gather running instances, stop them, then restart instbase="%{_sysconfdir}/%{pkgname}" instances="" ninst=0 @@ -756,6 +758,9 @@ exit 0 %endif %changelog +* Thu Mar 05 2026 Viktor Ashirov - 2.8.0-6 +- Resolves: RHEL-152335 - Crash in trim_changelog() during the Retro Changelog trimming. [rhel-9.8] + * Fri Feb 27 2026 Viktor Ashirov - 2.8.0-5 - Resolves: RHEL-137084 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-9.8] - Resolves: RHEL-152335 - Crash in trim_changelog() during the Retro Changelog trimming. [rhel-9.8]