summaryrefslogtreecommitdiff
path: root/usr.sbin/ldapd
AgeCommit message (Collapse)Author
2017-08-2865535 is a valid port to listen on.Florian Obser
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT gmail, thanks! chris@ pointed out that more than httpd(8) is effected. OK gilles@
2017-07-28One negation is enough; pointed out by clang.Florian Obser
OK gsoares who says that he forgot about the same diff for months and that millert@ had OK'ed it.
2017-07-04It does not make sense to use ioctl(FIONREAD) with TLS as libtlsAlexander Bluhm
has already read the buffer from kernel to user land. I have blindly copied this code from libevent for syslogd(8) TLS, remove it together with the bug. It caused hangs in ldapd(8). report, analysis, testing, OK Seiya Kawashima, Robert Klein, gsoares@
2017-05-28Fix checks for seconds and timezones in generalized times.Jonathan Matthew
Fixing the CHECK_RANGE macro in r1.4 revealed that the seconds check accidentally relied on the macro being broken. While looking into this I noticed that the timezone check was also wrong, treating the timezone as optional for generalized times. investigation and diff mostly by Seiya Kawashima.
2017-05-26Don't overflow uint16 when the filesystem block size is >32K.Stuart Henderson
Reported and initial diagnosis from Allan Streib, help/ok millert deraadt
2017-04-13multi-statement CHECK_RANGE() macro isn't safe for all placements, andTheo de Raadt
needs to use "do {} while 0" idiom; all callers need repair also. Discovered by jsg
2017-04-06use memset() instead of bzero()Gleydson Soares
OK jmatthew
2017-03-21From a syslog perspective it does not make sense to log fatal andAlexander Bluhm
warn with the same severity. Switch log_warn() to LOG_ERR and keep fatal() at LOG_CRIT. OK reyk@ florian@
2017-03-03Internally libssl uses 16k buffer, the libevent TLS wrapper usesAlexander Bluhm
4k read buffer. This can hang ldapd(8). Setting both to 16k improves the situation. report Seiya Kawashima; feedback Robert Klein; test and OK gsoares@
2017-03-01add missing rcsidGleydson Soares
2017-03-01move up getpid() and getpwnam(LDAP USER) checksGleydson Soares
to fail earlier and also make them consistent with other daemons. while here: - fix getpwnam(LDAPD_USER) errx() - no need to skip_chroot ok jmatthew@
2017-02-24Implement fork+exec modelGleydson Soares
OK jmatthew@
2017-02-22print a formatted errx() string instead of segfault,Gleydson Soares
by checking argc correctly. ok guenther@
2017-02-11Correct handling of requests to delete individual attribute values.Philip Guenther
reported by ZHANG Huangbin (zhb (at) iredmail.org) fix by Robert Klein (roklein (at) roklein.de)
2017-01-20unbreak treeSebastian Benoit
2017-01-20work on making log.c similar in all daemons:Sebastian Benoit
move daemon-local functions into new logmsg.c, and reduce the (mostly whitespace) differences so that log.c's can be diffed easily. ok krw@ jmatthew@
2017-01-20Correctly list all libraries required.Theo de Raadt
2017-01-17Nuke some whitespace that keeps poking me in the eye as I try toKenneth R Westerback
steal code.
2017-01-09Replace hand-rolled for(;;) traversal of ctl_conns TAILQ withKenneth R Westerback
TAILQ_FOREACH(). No intentional functional change. ok reyk@
2017-01-05Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with moreKenneth R Westerback
modern TAILQ_FOREACH_SAFE(). No intentional functional change. ok millert@ bluhm@ gilles@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-12-02Fix leaks by freeing 'path' and 'lru_queue' in btree_close().Jonathan Matthew
From Jon Mayo, via Tim Kuijsten ok mikeb@
2016-11-30Check return value of tls_config_set_protocols(3) and bail out in case ofRicardo Mestre
failure Feedback and OK jsing@
2016-10-17Tweak /etc/ldap/certs/ FILES entry.Jeremie Courreges-Anglas
2016-10-17In FILES mention /etc/ldapd.conf first, then /etc/ldap/ entriesJeremie Courreges-Anglas
2016-10-17Fix a few mistakes and add a FILES entry for /etc/ldap/certsJeremie Courreges-Anglas
From Rob Pierce, help & ok jmc@
2016-08-27Pull in <sys/time.h> for gettimeofday()Philip Guenther
ok deraadt@
2016-07-13Adjust existing tls_config_set_cipher() callers for TLS cipher groupJoel Sing
changes - map the previous configuration to the equivalent in the new groups. This will be revisited post release. Discussed with beck@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2016-05-01convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tlsJonathan Matthew
code from syslogd. ok beck@ benno@
2016-03-20Currently we have about a 50/50 split over fcntl(n, F_GETFL [,0])Kenneth R Westerback
idioms. Adopt the more concise fcntl(n, F_GETFL) over fcntl(n, F_GETFL, 0) where it is obvious further investigation will not yield and even better way. Obviousness evaluation and ok guenther@
2016-02-04Minor ldapd -r tweaksJeremie Courreges-Anglas
- fix style - the string pointed to by datadir shouldn't be modified, use const - initialize datadir at compile time - in namespace.c, move the extern datadir decl above local decls
2016-02-02use stat(2) instead of chdir(2) to check if given the directory is valid.Gleydson Soares
OK landry@ jca@
2016-02-01some -r fixes;Jason McIntyre
2016-02-01Add -r argument to ldapd, to specify an alternative directory toLandry Breuil
store/read the database, still defaulting to /var/db/ldap. This will allow running totally separate instances, to be used by an upcoming regress suite for example. With a tweak from gsoares@ to check that the directory exists. ok dlg@ semarie@ jca@
2016-01-17Properly remove unix sockets (control & listening) upon exit of theLandry Breuil
parent process. Child process was killed by pledge because it tried to remove the control socket and didnt have cpath - anyway it couldnt remove it since it had chrooted.. ok jmatthew@ deraadt@
2015-12-30SSL_CTX_free() and SSL_free() check for null so dont do it in ldapdSebastian Benoit
ok jung@ tedu@ deraadt@
2015-12-24bzero -> memset. No binary change.mmcc
2015-12-24use strndup instead of malloc/strncpy/nulmmcc
ok krw@
2015-12-22commiting -> committingmmcc
2015-12-10Remove NULL-checks before free(). ok tb@mmcc
2015-12-05#include <string.h> not strings.hClaudio Jeker
2015-11-02use SOCK_NONBLOCK instead of fcntlJonathan Matthew
ok dlg@
2015-11-02Both ldapd processes need "stdio" to talk to clients and each other.Jonathan Matthew
The parent process opens database files ("rpath wpath cpath"), sends fds to the child ("sendfd"), and does bsd auth on behalf of the child ("getpw proc exec"). The child process accepts client connections ("inet unix"), receives fds from the parent ("recvfd") and locks database files ("flock"). ok deraadt@
2015-10-11The <ctype.h> is*() interfaces expect EOF or an unsigned char; cast toPhilip Guenther
(unsigned char) as required found by Michael McConville (mmcconv1 (at) sccs.swarthmore.edu) w/Coccinelle
2015-06-03Do not assume that asprintf() clears the pointer on failure, whichTodd C. Miller
is non-portable. Also add missing asprintf() return value checks. OK deraadt@ guenther@ doug@
2015-02-12ber_printf_elements should return NULL if any of its parts fail.Martin Pelikan
Leave the error handling up to its callers. ok reyk
2015-02-11initialize a variable in case "goto done" makes us compare itMartin Pelikan
found by clang, ok henning
2015-01-28Remove ssl_by_mem_ctrl() and x509_mem_lookup to unbreak the build. ItReyk Floeter
caused a conflict with a new function in LibreSSL but wasn't even used by ldapd. No functional change. OK deraadt@
2015-01-16change to <limits.h> universe. The only changes in the binary are dueTheo de Raadt
to the heavy use of assert. ok millert
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 03:41:29 +0000