rpms/fedora-ds-base/devel bug439829.patch, NONE, 1.1 fedora-ds-base.spec, 1.14, 1.15
Richard Allen Megginson (rmeggins)
fedora-extras-commits at redhat.com
Wed Apr 16 18:11:51 UTC 2008
Author: rmeggins
Update of /cvs/extras/rpms/fedora-ds-base/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv22636
Modified Files:
fedora-ds-base.spec
Added Files:
bug439829.patch
Log Message:
fix bugzilla 439829 - patch to allow working with NSS 3.11.99 and later
bug439829.patch:
--- NEW FILE bug439829.patch ---
Index: ldap/servers/slapd/detach.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/detach.c,v
retrieving revision 1.6
diff -u -8 -r1.6 detach.c
--- ldap/servers/slapd/detach.c 10 Nov 2006 23:45:40 -0000 1.6
+++ ldap/servers/slapd/detach.c 2 Apr 2008 23:32:27 -0000
@@ -71,17 +71,18 @@
#include "slap.h"
#include "fe.h"
#if defined(USE_SYSCONF) || defined(LINUX)
#include <unistd.h>
#endif /* USE_SYSCONF */
void
-detach()
+detach( int slapd_exemode, int importexport_encrypt,
+ int s_port, daemon_ports_t *ports_info )
{
#ifndef _WIN32
int i, sd;
char *workingdir = 0;
char *errorlog = 0;
char *ptr = 0;
char errorbuf[BUFSIZ];
extern char *config_get_errorlog(void);
@@ -103,16 +104,22 @@
break;
default:
_exit( 0 );
}
break;
}
+ /* call this right after the fork, but before closing stdin */
+ if (slapd_do_all_nss_ssl_init(slapd_exemode, importexport_encrypt,
+ s_port, ports_info)) {
+ exit(1);
+ }
+
workingdir = config_get_workingdir();
if ( NULL == workingdir ) {
errorlog = config_get_errorlog();
if ( NULL == errorlog ) {
(void) chdir( "/" );
} else {
if ((ptr = strrchr(errorlog, '/')) ||
(ptr = strrchr(errorlog, '\\'))) {
@@ -145,17 +152,22 @@
#else /* USE_SETSID */
if ( (sd = open( "/dev/tty", O_RDWR )) != -1 ) {
(void) ioctl( sd, TIOCNOTTY, NULL );
(void) close( sd );
}
#endif /* USE_SETSID */
g_set_detached(1);
- }
+ } else { /* not detaching - call nss/ssl init */
+ if (slapd_do_all_nss_ssl_init(slapd_exemode, importexport_encrypt,
+ s_port, ports_info)) {
+ exit(1);
+ }
+ }
(void) SIGNAL( SIGPIPE, SIG_IGN );
#endif /* _WIN32 */
}
#ifndef _WIN32
/*
Index: ldap/servers/slapd/main.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/main.c,v
retrieving revision 1.22
diff -u -8 -r1.22 main.c
--- ldap/servers/slapd/main.c 18 Oct 2007 00:08:34 -0000 1.22
+++ ldap/servers/slapd/main.c 2 Apr 2008 23:32:28 -0000
@@ -896,58 +896,24 @@
return_value = main_setuid(slapdFrontendConfig->localuser);
if (0 != return_value) {
LDAPDebug( LDAP_DEBUG_ANY, "Failed to change user and group identity to that of %s\n",
slapdFrontendConfig->localuser, 0, 0 );
exit(1);
}
#endif
- /*
- * Initialise NSS once for the whole slapd process, whether SSL
- * is enabled or not. We use NSS for random number generation and
- * other things even if we are not going to accept SSL connections.
- * We also need NSS for attribute encryption/decryption on import and export.
- */
- init_ssl = ( (slapd_exemode == SLAPD_EXEMODE_SLAPD) || importexport_encrypt)
- && config_get_security()
- && (0 != s_port) && (s_port <= LDAP_PORT_MAX);
- /* As of DS 6.1, always do a full initialization so that other
- * modules can assume NSS is available
- */
- if ( slapd_nss_init((slapd_exemode == SLAPD_EXEMODE_SLAPD),
- (slapd_exemode != SLAPD_EXEMODE_REFERRAL) /* have config? */ )) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "ERROR: NSS Initialization Failed.\n", 0, 0, 0);
- exit (1);
- }
-
- if (slapd_exemode == SLAPD_EXEMODE_SLAPD) {
- client_auth_init();
- }
-
- if ( init_ssl && ( 0 != slapd_ssl_init())) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "ERROR: SSL Initialization Failed.\n", 0, 0, 0 );
- exit( 1 );
- }
-
- if ((slapd_exemode == SLAPD_EXEMODE_SLAPD) ||
- (slapd_exemode == SLAPD_EXEMODE_REFERRAL)) {
- if ( init_ssl ) {
- PRFileDesc **sock;
- for (sock = ports_info.s_socket; sock && *sock; sock++) {
- if ( 0 != slapd_ssl_init2(sock, 0) ) {
- LDAPDebug(LDAP_DEBUG_ANY,
- "ERROR: SSL Initialization phase 2 Failed.\n", 0, 0, 0 );
- exit( 1 );
- }
- }
- }
- }
+ /* Do NSS and/or SSL init for those modes other than listening modes */
+ if ((slapd_exemode != SLAPD_EXEMODE_REFERRAL) &&
+ (slapd_exemode != SLAPD_EXEMODE_SLAPD)) {
+ if (slapd_do_all_nss_ssl_init(slapd_exemode, importexport_encrypt,
+ s_port, &ports_info)) {
+ return 1;
+ }
+ }
/*
* if we were called upon to do special database stuff, do it and be
* done.
*/
switch ( slapd_exemode ) {
case SLAPD_EXEMODE_LDIF2DB:
return slapd_exemode_ldif2db();
@@ -997,17 +963,18 @@
/*
* Detach ourselves from the terminal (unless running in debug mode).
* We must detach before we start any threads since detach forks() on
* UNIX.
* Have to detach after ssl_init - the user may be prompted for the PIN
* on the terminal, so it must be open.
*/
- detach();
+ detach(slapd_exemode, importexport_encrypt,
+ s_port, &ports_info);
/*
* Now write our PID to the startup PID file.
* This is used by the start up script to determine our PID quickly
* after we fork, without needing to wait for the 'real' pid file to be
* written. That could take minutes. And the start script will wait
* that long looking for it. With this new 'early pid' file, it can avoid
* doing that, by detecting the pid and watching for the process exiting.
@@ -2880,8 +2847,72 @@
"values with a + character, e.g., all of the following"
" have the same effect:\n"
" -d connections+filters\n"
" -d 8+32\n"
" -d 40\n" );
}
#endif /* LDAP_DEBUG */
+/*
+ This function does all NSS and SSL related initialization
+ required during startup. We use this function rather
+ than just call this code from main because we must perform
+ all of this initialization after the fork() but before
+ we detach from the controlling terminal. This is because
+ the NSS softokn requires that NSS_Init is called after the
+ fork - this was always the case, but it is a hard error in
+ NSS 3.11.99 and later. We also have to call NSS_Init before
+ doing the detach because NSS may prompt the user for the
+ token (h/w or softokn) password on stdin. So we use this
+ function that we can call from detach() if running in
+ regular slapd exemode or from main() if running in other
+ modes (or just not detaching).
+*/
+int
+slapd_do_all_nss_ssl_init(int slapd_exemode, int importexport_encrypt,
+ int s_port, daemon_ports_t *ports_info)
+{
+ /*
+ * Initialise NSS once for the whole slapd process, whether SSL
+ * is enabled or not. We use NSS for random number generation and
+ * other things even if we are not going to accept SSL connections.
+ * We also need NSS for attribute encryption/decryption on import and export.
+ */
+ int init_ssl = ( (slapd_exemode == SLAPD_EXEMODE_SLAPD) || importexport_encrypt)
+ && config_get_security()
+ && (0 != s_port) && (s_port <= LDAP_PORT_MAX);
+ /* As of DS 6.1, always do a full initialization so that other
+ * modules can assume NSS is available
+ */
+ if ( slapd_nss_init((slapd_exemode == SLAPD_EXEMODE_SLAPD),
+ (slapd_exemode != SLAPD_EXEMODE_REFERRAL) /* have config? */ )) {
+ LDAPDebug(LDAP_DEBUG_ANY,
+ "ERROR: NSS Initialization Failed.\n", 0, 0, 0);
+ exit (1);
+ }
+
+ if (slapd_exemode == SLAPD_EXEMODE_SLAPD) {
+ client_auth_init();
+ }
+
+ if ( init_ssl && ( 0 != slapd_ssl_init())) {
+ LDAPDebug(LDAP_DEBUG_ANY,
+ "ERROR: SSL Initialization Failed.\n", 0, 0, 0 );
+ exit( 1 );
+ }
+
+ if ((slapd_exemode == SLAPD_EXEMODE_SLAPD) ||
+ (slapd_exemode == SLAPD_EXEMODE_REFERRAL)) {
+ if ( init_ssl ) {
+ PRFileDesc **sock;
+ for (sock = ports_info->s_socket; sock && *sock; sock++) {
+ if ( 0 != slapd_ssl_init2(sock, 0) ) {
+ LDAPDebug(LDAP_DEBUG_ANY,
+ "ERROR: SSL Initialization phase 2 Failed.\n", 0, 0, 0 );
+ exit( 1 );
+ }
+ }
+ }
+ }
+
+ return 0;
+}
Index: ldap/servers/slapd/proto-slap.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/proto-slap.h,v
retrieving revision 1.31
diff -u -8 -r1.31 proto-slap.h
--- ldap/servers/slapd/proto-slap.h 18 Oct 2007 01:22:29 -0000 1.31
+++ ldap/servers/slapd/proto-slap.h 2 Apr 2008 23:32:28 -0000
@@ -478,17 +478,18 @@
* delete.c
*/
void do_delete( Slapi_PBlock *pb );
/*
* detach.c
*/
-void detach( void );
+void detach( int slapd_exemode, int importexport_encrypt,
+ int s_port, daemon_ports_t *ports_info );
#ifndef _WIN32
void close_all_files( void );
#endif
void raise_process_limits( void );
/*
* dn.c
@@ -874,17 +875,16 @@
int slapd_sasl_ext_client_bind( LDAP* ld, int **msgid);
int slapd_nss_init(int init_ssl, int config_available);
int slapd_ssl_init();
int slapd_ssl_init2(PRFileDesc **fd, int startTLS);
int slapd_security_library_is_initialized();
int slapd_ssl_listener_is_initialized();
int sasl_io_cleanup(Connection *c);
-
/*
* security_wrappers.c
*/
int slapd_ssl_handshakeCallback(PRFileDesc *fd, void * callback, void * client_data);
int slapd_ssl_badCertHook(PRFileDesc *fd, void * callback, void * client_data);
CERTCertificate * slapd_ssl_peerCertificate(PRFileDesc *fd);
SECStatus slapd_ssl_getChannelInfo(PRFileDesc *fd, SSLChannelInfo *sinfo, PRUintn len);
SECStatus slapd_ssl_getCipherSuiteInfo(PRUint16 ciphersuite, SSLCipherSuiteInfo *cinfo, PRUintn len);
@@ -1272,9 +1272,12 @@
#endif
/*
* main.c
*/
#if ( defined( hpux ) || defined( irix ))
void signal2sigaction( int s, void *a );
#endif
+int slapd_do_all_nss_ssl_init(int slapd_exemode, int importexport_encrypt,
+ int s_port, daemon_ports_t *ports_info);
+
#endif /* _PROTO_SLAP */
Index: fedora-ds-base.spec
===================================================================
RCS file: /cvs/extras/rpms/fedora-ds-base/devel/fedora-ds-base.spec,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- fedora-ds-base.spec 18 Mar 2008 15:50:25 -0000 1.14
+++ fedora-ds-base.spec 16 Apr 2008 18:11:01 -0000 1.15
@@ -5,7 +5,7 @@
Summary: Fedora Directory Server (base)
Name: fedora-ds-base
Version: 1.1.0.1
-Release: 3%{?dist}
+Release: 4%{?dist}
License: GPLv2 with exceptions
URL: http://directory.fedoraproject.org/
Group: System Environment/Daemons
@@ -57,6 +57,7 @@
# fedora-ds-cvs.sh should be used to generate the source tarball from CVS
Source1: %{name}-cvs.sh
Source2: %{name}-devel.README
+Patch0: bug439829.patch
%description
Fedora Directory Server is an LDAPv3 compliant server. The base package includes
@@ -74,6 +75,7 @@
%prep
%setup -q -n %{name}-%{version}
cp %{SOURCE2} README.devel
+%patch0
%build
%configure
@@ -154,6 +156,13 @@
%{_libdir}/%{pkgname}/*.so
%changelog
+* Wed Apr 16 2008 Rich Megginson <rmeggins at redhat.com> - 1.1.0.1-4
+- fix bugzilla 439829 - patch to allow working with NSS 3.11.99 and later
+
+* Tue Mar 18 2008 Tom "spot" Callaway <tcallawa at redhat.com> - 1.1.0.1-3
+- add patch to allow server to work with NSS 3.11.99 and later
+- do NSS_Init after fork but before detaching from console
+
* Tue Mar 18 2008 Tom "spot" Callaway <tcallawa at redhat.com> - 1.1.0.1-3
- add Requires for versioned perl (libperl.so)
More information about the fedora-extras-commits
mailing list