Commits on Source (27)
-
Mark Reynolds authored
Description: Update jemalloc from 5.1.0 to 5.2.0 https://github.com/jemalloc/jemalloc/releases/tag/5.2.0 Refers: https://pagure.io/389-ds-base/issue/50486 Reviewed by: mhonek(Thanks!) -
William Brown authored
Bug Description: In testing a production deployment of 389-ds-base from the source tree, a new dockerfile was added to handle the release build and proper image cleanups. Additionally, some issues with sigchld handling were noted. Fix Description: * Add a .release dockerfile for the suse base image which cleans up after itself correctly. * Catch extra arguments to the sigchld handler * Create directories in /data with more open permissions to account for id changes. https://pagure.io/389-ds-base/pull-request/50484 Author: William Brown <william@blackhats.net.au> Review by: mhonek (Thank you!)
-
William Brown authored
Bug Description: To allow nunc-stans to share the same lock as c_mutex we need to change conn to use a pthread_mutex instead. Fix Description: Change c_mutex to pthread https://pagure.io/389-ds-base/issue/50459 Author: William Brown <william@blackhats.net.au> Review by: tbordaz, mreynolds (Thank you!)
-
Simon Pichugin authored
Description: 50 high vulnerabilities were found during audit. Fix them. It updates the Patternfly version to 3.59.3 version. Package jquery is no longer an issue, remove it from the whitelist. https://pagure.io/389-ds-base/issue/50499 Reviewed by: mreynolds (Thanks!)
-
William Brown authored
Bug Description: While adding the connection state, due to a misunderstanding on my part, it was possible that a connection was more likely to fail to allocate causing the server to exit(1) incorrectly. Fix Description: Fix the state handler to correctly account for connection structure reuse. https://pagure.io/389-ds-base/issue/50459 Author: William Brown <william@blackhats.net.au> Review by: tbordaz (Thanks!)
-
William Brown authored
Bug Description: Due to the nature of the connection table being single threaded, in connection_is_free, we would iterate over the CT attempting to lock and check connection free states. However, because this required the lock, if the connection was currently in io, or other operations, the ct would delay behind the c_mutex until it was released, then we would check the free state. Fix Description: Change the connection_is_free to use trylock instead of lock - this means if the connection is locked it's probably inuse and we can skip over it directly. We also change the fn to iterate over the ct twice to check for possible connections incase something frees up. https://pagure.io/389-ds-base/pull-request/50493 Author: William Brown <william@blackhats.net.au> Review by: tbordaz (Thanks!)
-
Emanuel Rietveld authored
Bug Description: Improve security of accounts by upgrading their password hashes on login when we have the plaintext password available. Fix Description: Implement the upgrade on bind function and provide it to bind.c https://pagure.io/389-ds-base/issue/49421 Author: Emanuel Rietveld <erietveld@dearnova.nl> Review by: William Brown
-
William Brown authored
Bug Description: As time goes on, password hash mechanisms change and need to become more resistant to brute force and other attacks. However long lived, and service passwords do not change frequently - and in fact, frequent password changes is a security anti-pattern which is now discouraged. As a result, it's important to be able to improve the cryptographic strength and resitance of our passwords for users as time goes on. Fix Description: We can implement this because during a bind operation we have short amount of access to the plaintext password - we then use that to upgrade the content of the hash. This builds on Emanuel's proof of concept to improve the testing of the feature, as well as to avoid updating clear/crypt due to potential application integrations. https://pagure.io/389-ds-base/issue/49421 Author: Emanuel Rietveld <https://pagure.io/user/codehotter> William Brown <william@blackhats.net.au> Review by: mreynolds, mhonek (Thanks!)
-
Thierry Bordaz authored
Bug Description: By default, unhashed#user#password is recorded into changelog database. It is a specific use when some plugin need to know the clear text password on update. This should be disabled ('off') by default Fix Description: Switch the default value from 'on' to 'off' https://pagure.io/389-ds-base/issue/49789 Reviewed by: Viktor Ashirov, Simon Pichugi, Mark Reynolds Platforms tested: F28 Flag Day: no Doc impact: no -
Mark Reynolds authored
Description: This updates the CLI and UI to handle a majority of the security configuration. It also adds support for PF dual list selection even though I ended up not using it. Relates: https://pagure.io/389-ds-base/issue/50325 Reviewed by: spichugi, and mhonek (Thanks!!) Fixed Simon's issues Fix issue with listing certs with spaces in the name Fix npm vulnerabilities Fix selinux port labeling, and add 'saving' spinners Use a regex for parsing certutil output -
Mark Reynolds authored
Description: Add the jemalloc back to the systemd dropin file which was accidentally removed from a previous change regarding systemd Relates: https://pagure.io/389-ds-base/issue/50425 Reviewed by: mhonek(Thanks!) -
Matus Honek authored
The previous fix (7466be33) for jemalloc inclusion stopped installing template-initconfig rendering ds-setup.pl unusable. This fix moves the template-initconfig into -legacy-tools to make it available only when necessary. Relates: https://pagure.io/389-ds-base/issue/50425 Reviewed by: Viktor, Ludwig, Thierry, Mark (thanks!)
-
Ludwig Krispenz authored
Bug: The patch for 50417 did break start-dirsrv and stop-dirsrv. Some paths were not correctly set Fix: use path variable like in other legacy scripts, eg @sbindir@ Reviewed by: Mark, thanks
-
Anuj Borah authored
Bug Description: Investigate and port TET matching rules filter tests(Final) Relates: https://pagure.io/389-ds-base/issue/48851 Author: aborah Reviewed by: Simon Pichugin
-
Simon Pichugin authored
Bug Description: We're going to deprecate all Perl scripts in 389-ds so cl-dump.pl should be ported as soon as possible. Fix Description: Put the tool to dsconf replication dump-changelog. Preserve all the functionality and output format. Depricate ChangelogLegacy object. Move Changelog5 object to replica.py so we can avoid import loops. Also it makes more sense to have it there because it is part of Replication. Add ChangelogLDIF object. Add process_and_dump_changelog() method to Replicas object. https://pagure.io/389-ds-base/issue/50497 Reviewed by: mreynolds, mhonek, wibrown (Thanks!)
-
Mark Reynolds authored
Bug Description: Setting the sslVersionMin or SSLVersionMax was not correctly applied and the NSS default min and max became the valid range. Fix Description: Do not attempt to reset the requested range based off of hardcoded limits. Also removed obsolete SSL3 code, and fixed a minor memory leak in main.c found during ASAN testing. Relates: https://pagure.io/389-ds-base/issue/50355 ASAN approved Reviewed by: tbordaz(Thanks!) -
Mark Reynolds authored
-
Timo Aaltonen authored
-
Timo Aaltonen authored
-
Timo Aaltonen authored
-
Timo Aaltonen authored
-
Timo Aaltonen authored
use-bash-instead-of-sh.diff, rename-online-scripts.diff, perl-use- move-instead-of-rename.diff: Dropped, obsolete.
-
Timo Aaltonen authored
-
Timo Aaltonen authored
-
Timo Aaltonen authored
-
Timo Aaltonen authored
-
Timo Aaltonen authored
debian/patches/drop-old-man.diff
0 → 100644