From 968185ed4f675cbd0e9ec6aa32930ce97446a648 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Thu, 24 Sep 2020 06:12:33 +0000 Subject: [PATCH] import slapi-nis-0.56.5-4.module+el8.3.0+8222+c1bff54a --- SOURCES/slapi-nis-fix-valgrind-issues.patch | 61 +++++++++++++++++++ .../slapi-nis-ignore-unmatched-searches.patch | 53 ++++++++++++++++ SPECS/slapi-nis.spec | 14 ++++- 3 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 SOURCES/slapi-nis-fix-valgrind-issues.patch create mode 100644 SOURCES/slapi-nis-ignore-unmatched-searches.patch diff --git a/SOURCES/slapi-nis-fix-valgrind-issues.patch b/SOURCES/slapi-nis-fix-valgrind-issues.patch new file mode 100644 index 0000000..d268f6e --- /dev/null +++ b/SOURCES/slapi-nis-fix-valgrind-issues.patch @@ -0,0 +1,61 @@ +From dbe1e300171e04cc328a4f31d0bffcac056e7cfa Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 31 Aug 2020 16:53:47 +0300 +Subject: [PATCH] idviews: clear intermediate target DN in all cases + +When processing a search request, slapi-nis attempts to detect an ID +View lookup. A target DN is modified by extracting an ID view name. This +temporary string is freed in the successful case but left unotouched if +ID View wasn't requested. As a result, small leaks on each search +request accumulate and a memory can get lost. + +Resolves: rhbz#1866113 + +Signed-off-by: Alexander Bokovoy +--- + src/back-sch.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/src/back-sch.c b/src/back-sch.c +index 03abbeb..f8b04a3 100644 +--- a/src/back-sch.c ++++ b/src/back-sch.c +@@ -1767,6 +1767,7 @@ backend_search_cb(Slapi_PBlock *pb) + /* Perform another check, now for rewritten DN */ + cbdata.target_dn = slapi_sdn_new_dn_byval(target); + map_data_foreach_domain(cbdata.state, backend_search_find_set_dn_cb, &cbdata); ++ + /* Rewritten DN might still be outside of our trees */ + if (cbdata.answer == TRUE) { + slapi_log_error(SLAPI_LOG_PLUGIN, cbdata.state->plugin_desc->spd_id, +@@ -1774,19 +1775,21 @@ backend_search_cb(Slapi_PBlock *pb) + "for \"%s\" with scope %d%s. Filter may get overridden later.\n", + cbdata.idview, target, cbdata.strfilter, cbdata.scope, + backend_sch_scope_as_string(cbdata.scope)); +- } else { +- slapi_sdn_free(&cbdata.target_dn); +- slapi_ch_free_string(&target); +- slapi_ch_free_string(&cbdata.idview); ++ } ++ ++ slapi_sdn_free(&cbdata.target_dn); ++ slapi_ch_free_string(&cbdata.idview); ++ ++ if (cbdata.answer == FALSE) { + slapi_log_error(SLAPI_LOG_PLUGIN, + cbdata.state->plugin_desc->spd_id, + "The search base didn't match any of the containers, " + "ignoring search\n"); ++ slapi_ch_free_string(&target); + return 0; + } +- } else { +- slapi_ch_free_string(&target); + } ++ slapi_ch_free_string(&target); + } + cbdata.answer = FALSE; + #endif +-- +2.26.2 + diff --git a/SOURCES/slapi-nis-ignore-unmatched-searches.patch b/SOURCES/slapi-nis-ignore-unmatched-searches.patch new file mode 100644 index 0000000..fbe02a2 --- /dev/null +++ b/SOURCES/slapi-nis-ignore-unmatched-searches.patch @@ -0,0 +1,53 @@ +From 61ea8f6a104da25329e301a8f56944f860de8177 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sat, 12 Sep 2020 12:00:22 +0300 +Subject: [PATCH] Ignore searches that do not match any of configured tree + +Resolves: rhbz#1874015 +Signed-off-by: Alexander Bokovoy +--- + slapi-nis.spec | 5 ++++- + src/back-sch.c | 4 ++++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/slapi-nis.spec b/slapi-nis.spec +index 3eb3e37..8bde325 100644 +--- a/slapi-nis.spec ++++ b/slapi-nis.spec +@@ -11,7 +11,7 @@ + + Name: slapi-nis + Version: 0.56.5 +-Release: 1%{?dist} ++Release: 3%{?dist} + Summary: NIS Server and Schema Compatibility plugins for Directory Server + License: GPLv2 + URL: http://pagure.io/slapi-nis/ +@@ -81,6 +81,9 @@ make check + %{_sbindir}/nisserver-plugin-defs + + %changelog ++* Sat Sep 12 2020 Alexander Bokovoy - 0.56.5-3 ++- Ignore searches which don't match any configured map ++ + * Mon May 04 2020 Alexander Bokovoy - 0.56.5-1 + - New upstream release + - Resolves: rhbz#1751295: (2) When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming +diff --git a/src/back-sch.c b/src/back-sch.c +index f8b04a3..a5e4c04 100644 +--- a/src/back-sch.c ++++ b/src/back-sch.c +@@ -1790,6 +1790,10 @@ backend_search_cb(Slapi_PBlock *pb) + } + } + slapi_ch_free_string(&target); ++ if (cbdata.answer == FALSE) { ++ /* None of the configured trees in the sets matched the target at all, ignore search */ ++ return 0; ++ } + } + cbdata.answer = FALSE; + #endif +-- +2.26.2 + diff --git a/SPECS/slapi-nis.spec b/SPECS/slapi-nis.spec index 4f0fbca..6aabe19 100644 --- a/SPECS/slapi-nis.spec +++ b/SPECS/slapi-nis.spec @@ -11,7 +11,7 @@ Name: slapi-nis Version: 0.56.5 -Release: 2%{?dist} +Release: 4%{?dist} Summary: NIS Server and Schema Compatibility plugins for Directory Server Group: System Environment/Daemons License: GPLv2 @@ -19,6 +19,8 @@ URL: http://pagure.io/slapi-nis/ Source0: https://releases.pagure.org/slapi-nis/slapi-nis-%{version}.tar.gz Source1: https://releases.pagure.org/slapi-nis/slapi-nis-%{version}.tar.gz.asc Patch1: slapi-nis-bz1832331.patch +Patch2: slapi-nis-fix-valgrind-issues.patch +Patch3: slapi-nis-ignore-unmatched-searches.patch BuildRequires: autoconf BuildRequires: automake @@ -58,6 +60,8 @@ for attributes from multiple entries in the tree. %prep %setup -q %patch1 -p1 +%patch2 -p1 +%patch3 -p1 %build autoconf --force @@ -86,6 +90,14 @@ make check %{_sbindir}/nisserver-plugin-defs %changelog +* Mon Sep 14 2020 Alexander Bokovoy - 0.56.5-4 +- Ignore unmatched searches +- Resolves: rhbz#1874015 + +* Thu Sep 10 2020 Alexander Bokovoy - 0.56.5-3 +- Fix memory leaks in ID views processing +- Resolves: rhbz#1875348 + * Wed May 06 2020 Alexander Bokovoy - 0.56.5-2 - Initialize map lock in NIS plugin - Resolves: rhbz#1832331