import slapi-nis-0.56.5-4.module+el8.3.0+8222+c1bff54a

SOURCES/slapi-nis-fix-valgrind-issues.patch

@@ -0,0 +1,61 @@
+From dbe1e300171e04cc328a4f31d0bffcac056e7cfa Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Mon, 31 Aug 2020 16:53:47 +0300
+Subject: [PATCH] idviews: clear intermediate target DN in all cases
+
+When processing a search request, slapi-nis attempts to detect an ID
+View lookup. A target DN is modified by extracting an ID view name. This
+temporary string is freed in the successful case but left unotouched if
+ID View wasn't requested. As a result, small leaks on each search
+request accumulate and a memory can get lost.
+
+Resolves: rhbz#1866113
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ src/back-sch.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/src/back-sch.c b/src/back-sch.c
+index 03abbeb..f8b04a3 100644
+--- a/src/back-sch.c
++++ b/src/back-sch.c
+@@ -1767,6 +1767,7 @@ backend_search_cb(Slapi_PBlock *pb)
+ 			/* Perform another check, now for rewritten DN */
+ 			cbdata.target_dn = slapi_sdn_new_dn_byval(target);
+ 			map_data_foreach_domain(cbdata.state, backend_search_find_set_dn_cb, &cbdata);
++
+ 			/* Rewritten DN might still be outside of our trees */
+ 			if (cbdata.answer == TRUE) {
+ 				slapi_log_error(SLAPI_LOG_PLUGIN, cbdata.state->plugin_desc->spd_id,
+@@ -1774,19 +1775,21 @@ backend_search_cb(Slapi_PBlock *pb)
+ 						"for \"%s\" with scope %d%s. Filter may get overridden later.\n",
+ 						cbdata.idview, target, cbdata.strfilter, cbdata.scope,
+ 						backend_sch_scope_as_string(cbdata.scope));
+-			} else {
+-				slapi_sdn_free(&cbdata.target_dn);
+-				slapi_ch_free_string(&target);
+-				slapi_ch_free_string(&cbdata.idview);
++			}
++
++			slapi_sdn_free(&cbdata.target_dn);
++			slapi_ch_free_string(&cbdata.idview);
++
++			if (cbdata.answer == FALSE) {
+ 				slapi_log_error(SLAPI_LOG_PLUGIN,
+ 						cbdata.state->plugin_desc->spd_id,
+ 						"The search base didn't match any of the containers, "
+ 						"ignoring search\n");
++				slapi_ch_free_string(&target);
+ 				return 0;
+ 			}
+-		} else {
+-			slapi_ch_free_string(&target);
+ 		}
++		slapi_ch_free_string(&target);
+ 	}
+ 	cbdata.answer = FALSE;
+ #endif
+-- 
+2.26.2
+

SOURCES/slapi-nis-ignore-unmatched-searches.patch

@@ -0,0 +1,53 @@
+From 61ea8f6a104da25329e301a8f56944f860de8177 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sat, 12 Sep 2020 12:00:22 +0300
+Subject: [PATCH] Ignore searches that do not match any of configured tree
+
+Resolves: rhbz#1874015
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ slapi-nis.spec | 5 ++++-
+ src/back-sch.c | 4 ++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/slapi-nis.spec b/slapi-nis.spec
+index 3eb3e37..8bde325 100644
+--- a/slapi-nis.spec
++++ b/slapi-nis.spec
+@@ -11,7 +11,7 @@
+ 
+ Name:		slapi-nis
+ Version:	0.56.5
+-Release:	1%{?dist}
++Release:	3%{?dist}
+ Summary:	NIS Server and Schema Compatibility plugins for Directory Server
+ License:	GPLv2
+ URL:		http://pagure.io/slapi-nis/
+@@ -81,6 +81,9 @@ make check
+ %{_sbindir}/nisserver-plugin-defs
+ 
+ %changelog
++* Sat Sep 12 2020 Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-3
++- Ignore searches which don't match any configured map
++
+ * Mon May 04 2020 Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
+ - New upstream release
+ - Resolves: rhbz#1751295: (2) When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
+diff --git a/src/back-sch.c b/src/back-sch.c
+index f8b04a3..a5e4c04 100644
+--- a/src/back-sch.c
++++ b/src/back-sch.c
+@@ -1790,6 +1790,10 @@ backend_search_cb(Slapi_PBlock *pb)
+ 			}
+ 		}
+ 		slapi_ch_free_string(&target);
++		if (cbdata.answer == FALSE) {
++			/* None of the configured trees in the sets matched the target at all, ignore search */
++			return 0;
++		}
+ 	}
+ 	cbdata.answer = FALSE;
+ #endif
+-- 
+2.26.2
+

SPECS/slapi-nis.spec

@@ -11,7 +11,7 @@
 
 Name:		slapi-nis
 Version:	0.56.5
-Release:	2%{?dist}
+Release:	4%{?dist}
 Summary:	NIS Server and Schema Compatibility plugins for Directory Server
 Group:		System Environment/Daemons
 License:	GPLv2
@@ -19,6 +19,8 @@ URL:		http://pagure.io/slapi-nis/
 Source0:	https://releases.pagure.org/slapi-nis/slapi-nis-%{version}.tar.gz
 Source1:	https://releases.pagure.org/slapi-nis/slapi-nis-%{version}.tar.gz.asc
 Patch1:		slapi-nis-bz1832331.patch
+Patch2:         slapi-nis-fix-valgrind-issues.patch
+Patch3: 	slapi-nis-ignore-unmatched-searches.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -58,6 +60,8 @@ for attributes from multiple entries in the tree.
 %prep
 %setup -q
 %patch1 -p1
+%patch2 -p1
+%patch3 -p1
 
 %build
 autoconf --force
@@ -86,6 +90,14 @@ make check
 %{_sbindir}/nisserver-plugin-defs
 
 %changelog
+* Mon Sep 14 2020 Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
+- Ignore unmatched searches
+- Resolves: rhbz#1874015
+
+* Thu Sep 10 2020 Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-3
+- Fix memory leaks in ID views processing
+- Resolves: rhbz#1875348
+
 * Wed May 06 2020 Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-2
 - Initialize map lock in NIS plugin
 - Resolves: rhbz#1832331