From f0d49c0eb816c958e4fa6bf4a073eb6ac592efad Mon Sep 17 00:00:00 2001
From: Adam Tkac <atkac@redhat.com>
Date: Thu, 26 Apr 2012 13:48:21 +0200
Subject: [PATCH 1/5] Link ldap.so with relro, now and noexecstack linker
parameters.
Signed-off-by: Adam Tkac <atkac@redhat.com>
---
src/Makefile.am | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/Makefile.am b/src/Makefile.am
index 84c774b..b7b4240 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -38,4 +38,4 @@ ldap_la_SOURCES = \
ldap_la_CFLAGS = -Wall -Wextra -std=gnu99 -O2
-ldap_la_LDFLAGS = -module -avoid-version
+ldap_la_LDFLAGS = -module -avoid-version -Wl,-z,relro,-z,now,-z,noexecstack
--
1.7.10.2
From 481e350f5848cf01da6743f259a6f12419fc4177 Mon Sep 17 00:00:00 2001
From: Petr Spacek <pspacek@redhat.com>
Date: Tue, 24 Apr 2012 15:09:32 +0200
Subject: [PATCH 2/5] Add simple semaphore deadlock detection logic.
Signed-off-by: Petr Spacek <pspacek@redhat.com>
---
src/ldap_helper.c | 78 ++++++++++++++++++++++++++++++++---------------------
src/semaphore.c | 26 +++++++++++++++---
src/semaphore.h | 6 ++++-
3 files changed, 74 insertions(+), 36 deletions(-)
diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 6ebe4c0..5965d30 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -295,9 +295,10 @@ ldap_delete_zone2(ldap_instance_t *inst, dns_name_t *name, isc_boolean_t lock);
static isc_result_t ldap_pool_create(isc_mem_t *mctx, unsigned int connections,
ldap_pool_t **poolp);
static void ldap_pool_destroy(ldap_pool_t **poolp);
-static ldap_connection_t * ldap_pool_getconnection(ldap_pool_t *pool);
+static isc_result_t ldap_pool_getconnection(ldap_pool_t *pool,
+ ldap_connection_t ** conn);
static void ldap_pool_putconnection(ldap_pool_t *pool,
- ldap_connection_t *ldap_conn);
+ ldap_connection_t ** conn);
static isc_result_t ldap_pool_connect(ldap_pool_t *pool,
ldap_instance_t *ldap_inst);
@@ -401,6 +402,10 @@ new_ldap_instance(isc_mem_t *mctx, const char *db_name,
ldap_settings[i++].target = &ldap_inst->dyn_update;
CHECK(set_settings(ldap_settings, argv));
+ /* Set timer for deadlock detection inside semaphore_wait_timed . */
+ if (semaphore_wait_timeout.seconds < ldap_inst->timeout*SEM_WAIT_TIMEOUT_MUL)
+ semaphore_wait_timeout.seconds = ldap_inst->timeout*SEM_WAIT_TIMEOUT_MUL;
+
/* Validate and check settings. */
str_toupper(ldap_inst->sasl_mech);
if (ldap_inst->connections < 1) {
@@ -1088,7 +1093,7 @@ isc_result_t
refresh_zones_from_ldap(ldap_instance_t *ldap_inst)
{
isc_result_t result = ISC_R_SUCCESS;
- ldap_connection_t *ldap_conn;
+ ldap_connection_t *ldap_conn = NULL;
int zone_count = 0;
ldap_entry_t *entry;
dns_rbt_t *rbt = NULL;
@@ -1113,7 +1118,7 @@ refresh_zones_from_ldap(ldap_instance_t *ldap_inst)
log_debug(2, "refreshing list of zones for %s", ldap_inst->db_name);
- ldap_conn = ldap_pool_getconnection(ldap_inst->pool);
+ CHECK(ldap_pool_getconnection(ldap_inst->pool, &ldap_conn));
CHECK(ldap_query(ldap_inst, ldap_conn, str_buf(ldap_inst->base),
LDAP_SCOPE_SUBTREE, config_attrs, 0,
@@ -1226,7 +1231,7 @@ cleanup:
if (invalidate_nodechain)
dns_rbtnodechain_invalidate(&chain);
- ldap_pool_putconnection(ldap_inst->pool, ldap_conn);
+ ldap_pool_putconnection(ldap_inst->pool, &ldap_conn);
log_debug(2, "finished refreshing list of zones");
@@ -1380,7 +1385,7 @@ ldapdb_nodelist_get(isc_mem_t *mctx, ldap_instance_t *ldap_inst, dns_name_t *nam
dns_name_t *origin, ldapdb_nodelist_t *nodelist)
{
isc_result_t result;
- ldap_connection_t *ldap_conn;
+ ldap_connection_t *ldap_conn = NULL;
ldap_entry_t *entry;
ld_string_t *string = NULL;
ldapdb_node_t *node;
@@ -1391,7 +1396,7 @@ ldapdb_nodelist_get(isc_mem_t *mctx, ldap_instance_t *ldap_inst, dns_name_t *nam
REQUIRE(nodelist != NULL);
/* RRs aren't in the cache, perform ordinary LDAP query */
- ldap_conn = ldap_pool_getconnection(ldap_inst->pool);
+ CHECK(ldap_pool_getconnection(ldap_inst->pool, &ldap_conn));
INIT_LIST(*nodelist);
CHECK(str_new(mctx, &string));
@@ -1438,7 +1443,7 @@ ldapdb_nodelist_get(isc_mem_t *mctx, ldap_instance_t *ldap_inst, dns_name_t *nam
result = ISC_R_SUCCESS;
cleanup:
- ldap_pool_putconnection(ldap_inst->pool, ldap_conn);
+ ldap_pool_putconnection(ldap_inst->pool, &ldap_conn);
str_destroy(&string);
return result;
@@ -1449,7 +1454,7 @@ ldapdb_rdatalist_get(isc_mem_t *mctx, ldap_instance_t *ldap_inst, dns_name_t *na
dns_name_t *origin, ldapdb_rdatalist_t *rdatalist)
{
isc_result_t result;
- ldap_connection_t *ldap_conn;
+ ldap_connection_t *ldap_conn = NULL;
ldap_entry_t *entry;
ld_string_t *string = NULL;
ldap_cache_t *cache;
@@ -1467,12 +1472,11 @@ ldapdb_rdatalist_get(isc_mem_t *mctx, ldap_instance_t *ldap_inst, dns_name_t *na
return result;
/* RRs aren't in the cache, perform ordinary LDAP query */
- ldap_conn = ldap_pool_getconnection(ldap_inst->pool);
-
INIT_LIST(*rdatalist);
CHECK(str_new(mctx, &string));
CHECK(dnsname_to_dn(ldap_inst->zone_register, name, string));
+ CHECK(ldap_pool_getconnection(ldap_inst->pool, &ldap_conn));
CHECK(ldap_query(ldap_inst, ldap_conn, str_buf(string),
LDAP_SCOPE_BASE, NULL, 0, "(objectClass=idnsRecord)"));
@@ -1499,7 +1503,7 @@ ldapdb_rdatalist_get(isc_mem_t *mctx, ldap_instance_t *ldap_inst, dns_name_t *na
result = ISC_R_NOTFOUND;
cleanup:
- ldap_pool_putconnection(ldap_inst->pool, ldap_conn);
+ ldap_pool_putconnection(ldap_inst->pool, &ldap_conn);
str_destroy(&string);
if (result != ISC_R_SUCCESS)
@@ -2258,7 +2262,7 @@ modify_ldap_common(dns_name_t *owner, ldap_instance_t *ldap_inst,
zone_dn += 1; /* skip whitespace */
}
- ldap_conn = ldap_pool_getconnection(ldap_inst->pool);
+ CHECK(ldap_pool_getconnection(ldap_inst->pool, &ldap_conn));
CHECK(ldap_query(ldap_inst, ldap_conn, zone_dn,
LDAP_SCOPE_BASE, attrs, 0,
"(&(objectClass=idnsZone)(idnsZoneActive=TRUE))"));
@@ -2489,9 +2493,7 @@ modify_ldap_common(dns_name_t *owner, ldap_instance_t *ldap_inst,
}
cleanup:
- if (ldap_conn != NULL)
- ldap_pool_putconnection(ldap_inst->pool, ldap_conn);
-
+ ldap_pool_putconnection(ldap_inst->pool, &ldap_conn);
str_destroy(&owner_dn_ptr);
str_destroy(&owner_dn);
free_ldapmod(mctx, &change[0]);
@@ -2573,15 +2575,18 @@ ldap_pool_destroy(ldap_pool_t **poolp)
MEM_PUT_AND_DETACH(pool);
}
-static ldap_connection_t *
-ldap_pool_getconnection(ldap_pool_t *pool)
+static isc_result_t
+ldap_pool_getconnection(ldap_pool_t *pool, ldap_connection_t ** conn)
{
ldap_connection_t *ldap_conn = NULL;
unsigned int i;
+ isc_result_t result;
REQUIRE(pool != NULL);
+ REQUIRE(conn != NULL && *conn == NULL);
+ ldap_conn = *conn;
- semaphore_wait(&pool->conn_semaphore);
+ CHECK(semaphore_wait_timed(&pool->conn_semaphore));
for (i = 0; i < pool->connections; i++) {
ldap_conn = pool->conns[i];
if (isc_mutex_trylock(&ldap_conn->lock) == ISC_R_SUCCESS)
@@ -2591,16 +2596,30 @@ ldap_pool_getconnection(ldap_pool_t *pool)
RUNTIME_CHECK(ldap_conn != NULL);
INIT_LIST(ldap_conn->ldap_entries);
+ *conn = ldap_conn;
- return ldap_conn;
+cleanup:
+ if (result != ISC_R_SUCCESS) {
+ log_error("timeout in ldap_pool_getconnection(): try to raise "
+ "'connections' parameter; potential deadlock?");
+ }
+ return result;
}
static void
-ldap_pool_putconnection(ldap_pool_t *pool, ldap_connection_t *ldap_conn)
+ldap_pool_putconnection(ldap_pool_t *pool, ldap_connection_t **conn)
{
+ REQUIRE(conn != NULL);
+ ldap_connection_t *ldap_conn = *conn;
+
+ if (ldap_conn == NULL)
+ return;
+
ldap_query_free(ldap_conn);
UNLOCK(&ldap_conn->lock);
semaphore_signal(&pool->conn_semaphore);
+
+ *conn = NULL;
}
static isc_result_t
@@ -2727,7 +2746,7 @@ update_action(isc_task_t *task, isc_event_t *event)
ldap_psearchevent_t *pevent = (ldap_psearchevent_t *)event;
isc_result_t result ;
ldap_instance_t *inst = NULL;
- ldap_connection_t *conn;
+ ldap_connection_t *conn = NULL;
ldap_entry_t *entry;
isc_boolean_t delete = ISC_TRUE;
isc_mem_t *mctx;
@@ -2744,7 +2763,7 @@ update_action(isc_task_t *task, isc_event_t *event)
if (result != ISC_R_SUCCESS)
goto cleanup;
- conn = ldap_pool_getconnection(inst->pool);
+ CHECK(ldap_pool_getconnection(inst->pool, &conn));
CHECK(ldap_query(inst, conn, pevent->dn,
LDAP_SCOPE_BASE, attrs, 0,
@@ -2762,14 +2781,13 @@ update_action(isc_task_t *task, isc_event_t *event)
if (delete)
CHECK(ldap_delete_zone(inst, pevent->dn, ISC_TRUE));
- ldap_pool_putconnection(inst->pool, conn);
-
cleanup:
if (result != ISC_R_SUCCESS)
log_error("update_action (psearch) failed for %s. "
"Zones can be outdated, run `rndc reload`",
pevent->dn);
+ ldap_pool_putconnection(inst->pool, &conn);
isc_mem_free(mctx, pevent->dbname);
isc_mem_free(mctx, pevent->dn);
isc_mem_detach(&mctx);
@@ -2798,7 +2816,7 @@ update_config(isc_task_t *task, isc_event_t *event)
if (result != ISC_R_SUCCESS)
goto cleanup;
- conn = ldap_pool_getconnection(inst->pool);
+ CHECK(ldap_pool_getconnection(inst->pool, &conn));
CHECK(ldap_query(inst, conn, pevent->dn,
LDAP_SCOPE_BASE, attrs, 0,
@@ -2817,14 +2835,12 @@ update_config(isc_task_t *task, isc_event_t *event)
cleanup:
- if (conn != NULL)
- ldap_pool_putconnection(inst->pool, conn);
-
if (result != ISC_R_SUCCESS)
log_error("update_config (psearch) failed for %s. "
"Configuration can be outdated, run `rndc reload`",
pevent->dn);
+ ldap_pool_putconnection(inst->pool, &conn);
isc_mem_free(mctx, pevent->dbname);
isc_mem_free(mctx, pevent->dn);
isc_mem_detach(&mctx);
@@ -3087,7 +3103,7 @@ ldap_psearch_watcher(isc_threadarg_t arg)
tv.tv_usec = 0;
/* Pick connection, one is reserved purely for this thread */
- conn = ldap_pool_getconnection(inst->pool);
+ CHECK(ldap_pool_getconnection(inst->pool, &conn));
/* Try to connect. */
while (conn->handle == NULL) {
@@ -3195,7 +3211,7 @@ soft_err:
log_debug(1, "Ending ldap_psearch_watcher");
cleanup:
- ldap_pool_putconnection(inst->pool, conn);
+ ldap_pool_putconnection(inst->pool, &conn);
return (isc_threadresult_t)0;
}
diff --git a/src/semaphore.c b/src/semaphore.c
index 41d6a30..352219f 100644
--- a/src/semaphore.c
+++ b/src/semaphore.c
@@ -27,8 +27,19 @@
#include <isc/condition.h>
#include <isc/result.h>
#include <isc/util.h>
+#include <isc/time.h>
#include "semaphore.h"
+#include "util.h"
+
+/*
+ * Timer setting for deadlock detection. Format: seconds, nanoseconds.
+ * These values will be overwriten during initialization
+ * from set_settings() with max(setting+SEM_WAIT_TIMEOUT_ADD, curr_value).
+ *
+ * Initial value can be useful in early phases of initialization.
+ */
+isc_interval_t semaphore_wait_timeout = { 3, 0 };
/*
* Initialize a semaphore.
@@ -74,20 +85,27 @@ semaphore_destroy(semaphore_t *sem)
/*
* Wait on semaphore. This operation will try to acquire a lock on the
* semaphore. If the semaphore is already acquired as many times at it allows,
- * the function will block until someone releases the lock.
+ * the function will block until someone releases the lock OR timeout expire.
+ *
+ * @return ISC_R_SUCCESS or ISC_R_TIMEDOUT or other errors from ISC libs
*/
-void
-semaphore_wait(semaphore_t *sem)
+isc_result_t
+semaphore_wait_timed(semaphore_t *sem)
{
+ isc_result_t result;
+ isc_time_t abs_timeout;
REQUIRE(sem != NULL);
+ CHECK(isc_time_nowplusinterval(&abs_timeout, &semaphore_wait_timeout));
LOCK(&sem->mutex);
while (sem->value <= 0)
- WAIT(&sem->cond, &sem->mutex);
+ CHECK(WAITUNTIL(&sem->cond, &sem->mutex, &abs_timeout));
sem->value--;
+cleanup:
UNLOCK(&sem->mutex);
+ return result;
}
/*
diff --git a/src/semaphore.h b/src/semaphore.h
index 4ca4f65..1367747 100644
--- a/src/semaphore.h
+++ b/src/semaphore.h
@@ -24,6 +24,10 @@
#include <isc/condition.h>
#include <isc/mutex.h>
+/* Multiplier for to user-defined connection parameter 'timeout'. */
+#define SEM_WAIT_TIMEOUT_MUL 6 /* times */
+extern isc_interval_t semaphore_wait_timeout;
+
/*
* Semaphore can be "acquired" multiple times. However, it has a maximum
* number of times someone can acquire him. If a semaphore is already acquired
@@ -40,7 +44,7 @@ typedef struct semaphore semaphore_t;
/* Public functions. */
isc_result_t semaphore_init(semaphore_t *sem, int value);
void semaphore_destroy(semaphore_t *sem);
-void semaphore_wait(semaphore_t *sem);
+isc_result_t semaphore_wait_timed(semaphore_t *sem);
void semaphore_signal(semaphore_t *sem);
#endif /* !_LD_SEMAPHORE_H_ */
--
1.7.10.2
From 3d43fd66aa68ef275855391a94e47e9d2f30309d Mon Sep 17 00:00:00 2001
From: Petr Spacek <pspacek@redhat.com>
Date: Mon, 23 Apr 2012 11:38:43 +0200
Subject: [PATCH 3/5] Add proper DN escaping before LDAP library calls.
Signed-off-by: Petr Spacek <pspacek@redhat.com>
---
src/ldap_convert.c | 105 ++++++++++++++++++++++++++++++++++++++++++++++++---
src/zone_register.c | 7 ++++
src/zone_register.h | 3 ++
3 files changed, 110 insertions(+), 5 deletions(-)
diff --git a/src/ldap_convert.c b/src/ldap_convert.c
index 6405a98..6b4e321 100644
--- a/src/ldap_convert.c
+++ b/src/ldap_convert.c
@@ -21,6 +21,7 @@
#include <isc/buffer.h>
#include <isc/mem.h>
#include <isc/util.h>
+#include <isc/string.h>
#include <dns/name.h>
#include <dns/rdatatype.h>
@@ -32,6 +33,7 @@
#include <errno.h>
#include <strings.h>
+#include <ctype.h>
#include "str.h"
#include "ldap_convert.h"
@@ -189,6 +191,92 @@ cleanup:
return result;
}
+/**
+ * Convert a string from DNS escaping to LDAP escaping.
+ * The Input string dns_str is expected to be the result of dns_name_tostring().
+ * The DNS label can contain any binary data as described in
+ * http://tools.ietf.org/html/rfc2181#section-11 .
+ *
+ * DNS escaping uses form "\123" = ASCII value 123 (decimal)
+ * LDAP escaping users form "\7b" = ASCII value 7b (hexadecimal)
+ *
+ * Input (DNS escaped) example : _aaa,bbb\255\000ccc.555.ddd-eee
+ * Output (LDAP escaped) example: _aaa\2cbbb\ff\00ccc.555.ddd-eee
+ *
+ * The DNS to text functions from ISC libraries do not convert certain
+ * characters (e.g. ","). This function converts \123 form to \7b form in all
+ * cases. Other characters (not escaped by ISC libraries) will be additionally
+ * converted to the LDAP escape form.
+ * Input characters [a-zA-Z0-9._-] are left in raw ASCII form.
+ *
+ * If dns_str consists only of the characters in the [a-zA-Z0-9._-] set, it
+ * will be checked & copied to the output buffer, without any additional escaping.
+ */
+isc_result_t
+dns_to_ldap_dn_escape(isc_mem_t *mctx, const char const * dns_str, char ** ldap_name) {
+ isc_result_t result = ISC_R_FAILURE;
+ char * esc_name = NULL;
+ int idx_symb_first = -1; /* index of first "nice" printable symbol in dns_str */
+ int dns_idx = 0;
+ int esc_idx = 0;
+
+ REQUIRE(dns_str != NULL);
+ REQUIRE(ldap_name != NULL && *ldap_name == NULL);
+
+ int dns_str_len = strlen(dns_str);
+
+ /**
+ * In worst case each symbol from DNS dns_str will be represented
+ * as "\xy" in ldap_name. (xy are hexadecimal digits)
+ */
+ CHECKED_MEM_ALLOCATE(mctx, *ldap_name, 3 * dns_str_len + 1);
+ esc_name = *ldap_name;
+
+ for (dns_idx = 0; dns_idx < dns_str_len; dns_idx++) {
+ if (isalnum(dns_str[dns_idx]) || dns_str[dns_idx] == '.'
+ || dns_str[dns_idx] == '-' || dns_str[dns_idx] == '_' ) {
+ if (idx_symb_first == -1)
+ idx_symb_first = dns_idx;
+ continue;
+ } else { /* some not very nice symbols */
+ int ascii_val;
+ if (idx_symb_first != -1) { /* copy previous nice part */
+ int length_ok = dns_idx - idx_symb_first;
+ memcpy(esc_name + esc_idx, dns_str + idx_symb_first, length_ok);
+ esc_idx += length_ok;
+ idx_symb_first = -1;
+ }
+ if (dns_str[dns_idx] != '\\') { /* not nice raw value, e.g. ',' */
+ ascii_val = dns_str[dns_idx];
+ } else { /* not nice value in DNS \123 decimal format */
+ /* check if input length <= expected size */
+ REQUIRE (dns_str_len > dns_idx + 3); /* this problem should never happen */
+ ascii_val = 100 * (dns_str[dns_idx + 1] - '0')
+ + 10 * (dns_str[dns_idx + 2] - '0')
+ + (dns_str[dns_idx + 3] - '0');
+ dns_idx += 3;
+ }
+ /* LDAP uses \xy escaping. "xy" represent two hexadecimal digits.*/
+ /* TODO: optimize to bit mask & rotate & dec->hex table? */
+ CHECK(isc_string_printf(esc_name + esc_idx, 4, "\\%02x", ascii_val));
+ esc_idx += 3; /* isc_string_printf wrote 4 bytes including '\0' */
+ }
+ }
+ if (idx_symb_first != -1) { /* copy last nice part */
+ int length_ok = dns_idx - idx_symb_first;
+ memcpy(esc_name + esc_idx, dns_str + idx_symb_first, dns_idx - idx_symb_first);
+ esc_idx += length_ok;
+ idx_symb_first = -1;
+ }
+ esc_name[esc_idx] = '\0';
+ return ISC_R_SUCCESS;
+
+cleanup:
+ if (*ldap_name)
+ isc_mem_free(mctx, *ldap_name);
+ return result;
+}
+
static isc_result_t
explode_dn(const char *dn, char ***explodedp, int notypes)
{
@@ -243,11 +331,15 @@ dnsname_to_dn(zone_register_t *zr, dns_name_t *name, ld_string_t *target)
isc_result_t result;
int label_count;
const char *zone_dn = NULL;
+ char *dns_str = NULL;
+ char *escaped_name = NULL;
REQUIRE(zr != NULL);
REQUIRE(name != NULL);
REQUIRE(target != NULL);
+ isc_mem_t * mctx = zr_get_mctx(zr);
+
/* Find the DN of the zone we belong to. */
{
DECLARE_BUFFERED_NAME(zone);
@@ -264,17 +356,15 @@ dnsname_to_dn(zone_register_t *zr, dns_name_t *name, ld_string_t *target)
str_clear(target);
if (label_count > 0) {
- DECLARE_BUFFER(buffer, DNS_NAME_MAXTEXT);
dns_name_t labels;
- INIT_BUFFER(buffer);
dns_name_init(&labels, NULL);
-
dns_name_getlabelsequence(name, 0, label_count, &labels);
- CHECK(dns_name_totext(&labels, ISC_TRUE, &buffer));
+ CHECK(dns_name_tostring(&labels, &dns_str, mctx));
+ CHECK(dns_to_ldap_dn_escape(mctx, dns_str, &escaped_name));
CHECK(str_cat_char(target, "idnsName="));
- CHECK(str_cat_isc_buffer(target, &buffer));
+ CHECK(str_cat_char(target, escaped_name));
/*
* Modification of following line can affect modify_ldap_common().
* See line with: char *zone_dn = strstr(str_buf(owner_dn),", ") + 1;
@@ -284,6 +374,10 @@ dnsname_to_dn(zone_register_t *zr, dns_name_t *name, ld_string_t *target)
CHECK(str_cat_char(target, zone_dn));
cleanup:
+ if (dns_str)
+ isc_mem_free(mctx, dns_str);
+ if (escaped_name)
+ isc_mem_free(mctx, escaped_name);
return result;
}
@@ -328,3 +422,4 @@ rdatatype_to_ldap_attribute(dns_rdatatype_t rdtype, const char **target)
return ISC_R_SUCCESS;
}
+
diff --git a/src/zone_register.c b/src/zone_register.c
index fc6dc07..81d208f 100644
--- a/src/zone_register.c
+++ b/src/zone_register.c
@@ -61,6 +61,13 @@ zr_get_rbt(zone_register_t *zr)
return zr->rbt;
}
+isc_mem_t *
+zr_get_mctx(zone_register_t *zr) {
+ REQUIRE(zr);
+
+ return zr->mctx;
+}
+
/*
* Create a new zone register.
*/
diff --git a/src/zone_register.h b/src/zone_register.h
index e2408cb..fa8ef25 100644
--- a/src/zone_register.h
+++ b/src/zone_register.h
@@ -45,4 +45,7 @@ zr_get_zone_ptr(zone_register_t *zr, dns_name_t *name, dns_zone_t **zonep);
dns_rbt_t *
zr_get_rbt(zone_register_t *zr);
+isc_mem_t *
+zr_get_mctx(zone_register_t *zr);
+
#endif /* !_LD_ZONE_REGISTER_H_ */
--
1.7.10.2
From 0744209bc4461bf2f4d83b0a8e3f7051132ddef3 Mon Sep 17 00:00:00 2001
From: Petr Spacek <pspacek@redhat.com>
Date: Thu, 7 Jun 2012 14:42:40 +0200
Subject: [PATCH 4/5] Fix crash during BIND reload with persistent search
enabled.
https://fedorahosted.org/bind-dyndb-ldap/ticket/78
Signed-off-by: Petr Spacek <pspacek@redhat.com>
Signed-off-by: Adam Tkac <atkac@redhat.com>
---
src/ldap_helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 5965d30..dc4fdf5 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -3078,7 +3078,7 @@ static isc_threadresult_t
ldap_psearch_watcher(isc_threadarg_t arg)
{
ldap_instance_t *inst = (ldap_instance_t *)arg;
- ldap_connection_t *conn;
+ ldap_connection_t *conn = NULL;
struct timeval tv;
int ret, cnt;
isc_result_t result;
--
1.7.10.2
From 0dccccec9cede75bd254f723bc9a49592c24a44b Mon Sep 17 00:00:00 2001
From: Petr Spacek <pspacek@redhat.com>
Date: Thu, 7 Jun 2012 15:27:27 +0200
Subject: [PATCH 5/5] Fix crash during zone unload when NS is not resolvable.
https://fedorahosted.org/bind-dyndb-ldap/ticket/77
Signed-off-by: Petr Spacek <pspacek@redhat.com>
Signed-off-by: Adam Tkac <atkac@redhat.com>
---
src/ldap_helper.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index dc4fdf5..09c1f7d 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -30,6 +30,7 @@
#include <dns/ttl.h>
#include <dns/view.h>
#include <dns/zone.h>
+#include <dns/db.h>
#include <dns/zt.h>
#include <dns/byaddr.h>
#include <dns/forward.h>
@@ -788,7 +789,12 @@ ldap_delete_zone2(ldap_instance_t *inst, dns_name_t *name, isc_boolean_t lock)
freeze = ISC_TRUE;
}
- dns_zone_unload(zone);
+ /* Do not unload partially loaded zones, they have incomplete structures. */
+ dns_db_t *dbp = NULL;
+ if (dns_zone_getdb(zone, &dbp) != DNS_R_NOTLOADED) {
+ dns_db_detach(&dbp); /* dns_zone_getdb() attaches DB implicitly */
+ dns_zone_unload(zone);
+ }
CHECK(dns_zt_unmount(inst->view->zonetable, zone));
CHECK(zr_del_zone(inst->zone_register, name));
dns_zonemgr_releasezone(inst->zmgr, zone);
@@ -1013,7 +1019,7 @@ ldap_parse_zoneentry(ldap_entry_t *entry, ldap_instance_t *inst)
/* Check if we are already serving given zone */
result = zr_get_zone_ptr(inst->zone_register, &name, &zone);
- if (result != ISC_R_SUCCESS) {
+ if (result != ISC_R_SUCCESS) { /* TODO: What about other errors? */
CHECK(create_zone(inst, &name, &zone));
CHECK(zr_add_zone(inst->zone_register, zone, dn));
publish = ISC_TRUE;
@@ -2760,6 +2766,7 @@ update_action(isc_task_t *task, isc_event_t *event)
mctx = pevent->mctx;
result = manager_get_ldap_instance(pevent->dbname, &inst);
+ /* TODO: Can it happen? */
if (result != ISC_R_SUCCESS)
goto cleanup;
--
1.7.10.2