summaryrefslogtreecommitdiffstats
path: root/usr.sbin/ldapd (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Kill ber.c support for direct fd read/writesjca2018-02-084-40/+10
| | | | | This mechanism is already unused and annotated with lots of XXX's, no need to keep it around. ok claudio@
* 65535 is a valid port to listen on.florian2017-08-281-2/+2
| | | | | | | Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT gmail, thanks! chris@ pointed out that more than httpd(8) is effected. OK gilles@
* One negation is enough; pointed out by clang.florian2017-07-281-3/+3
| | | | | OK gsoares who says that he forgot about the same diff for months and that millert@ had OK'ed it.
* It does not make sense to use ioctl(FIONREAD) with TLS as libtlsbluhm2017-07-041-16/+1
| | | | | | | has already read the buffer from kernel to user land. I have blindly copied this code from libevent for syslogd(8) TLS, remove it together with the bug. It caused hangs in ldapd(8). report, analysis, testing, OK Seiya Kawashima, Robert Klein, gsoares@
* Fix checks for seconds and timezones in generalized times.jmatthew2017-05-281-3/+3
| | | | | | | | | Fixing the CHECK_RANGE macro in r1.4 revealed that the seconds check accidentally relied on the macro being broken. While looking into this I noticed that the timezone check was also wrong, treating the timezone as optional for generalized times. investigation and diff mostly by Seiya Kawashima.
* Don't overflow uint16 when the filesystem block size is >32K.sthen2017-05-261-3/+5
| | | | Reported and initial diagnosis from Allan Streib, help/ok millert deraadt
* multi-statement CHECK_RANGE() macro isn't safe for all placements, andderaadt2017-04-131-7/+9
| | | | | needs to use "do {} while 0" idiom; all callers need repair also. Discovered by jsg
* use memset() instead of bzero()gsoares2017-04-061-4/+4
| | | | OK jmatthew
* From a syslog perspective it does not make sense to log fatal andbluhm2017-03-211-6/+6
| | | | | | warn with the same severity. Switch log_warn() to LOG_ERR and keep fatal() at LOG_CRIT. OK reyk@ florian@
* Internally libssl uses 16k buffer, the libevent TLS wrapper usesbluhm2017-03-031-2/+2
| | | | | | 4k read buffer. This can hang ldapd(8). Setting both to 16k improves the situation. report Seiya Kawashima; feedback Robert Klein; test and OK gsoares@
* add missing rcsidgsoares2017-03-012-0/+4
|
* move up getpid() and getpwnam(LDAP USER) checksgsoares2017-03-011-11/+10
| | | | | | | | | | | to fail earlier and also make them consistent with other daemons. while here: - fix getpwnam(LDAPD_USER) errx() - no need to skip_chroot ok jmatthew@
* Implement fork+exec modelgsoares2017-02-243-28/+91
| | | | OK jmatthew@
* print a formatted errx() string instead of segfault,gsoares2017-02-221-2/+2
| | | | | | by checking argc correctly. ok guenther@
* Correct handling of requests to delete individual attribute values.guenther2017-02-114-15/+44
| | | | | reported by ZHANG Huangbin (zhb (at) iredmail.org) fix by Robert Klein (roklein (at) roklein.de)
* unbreak treebenno2017-01-201-1/+2
|
* work on making log.c similar in all daemons:benno2017-01-2020-330/+397
| | | | | | | move daemon-local functions into new logmsg.c, and reduce the (mostly whitespace) differences so that log.c's can be diffed easily. ok krw@ jmatthew@
* Correctly list all libraries required.deraadt2017-01-201-3/+3
|
* Nuke some whitespace that keeps poking me in the eye as I try tokrw2017-01-171-2/+2
| | | | steal code.
* Replace hand-rolled for(;;) traversal of ctl_conns TAILQ withkrw2017-01-091-4/+5
| | | | | | | | TAILQ_FOREACH(). No intentional functional change. ok reyk@
* Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with morekrw2017-01-051-3/+2
| | | | | | | | modern TAILQ_FOREACH_SAFE(). No intentional functional change. ok millert@ bluhm@ gilles@
* Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQkrw2017-01-051-5/+7
| | | | | | | | | | | with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
* Fix leaks by freeing 'path' and 'lru_queue' in btree_close().jmatthew2016-12-021-1/+3
| | | | | | From Jon Mayo, via Tim Kuijsten ok mikeb@
* Check return value of tls_config_set_protocols(3) and bail out in case ofmestre2016-11-301-2/+6
| | | | | | failure Feedback and OK jsing@
* Tweak /etc/ldap/certs/ FILES entry.jca2016-10-171-2/+2
|
* In FILES mention /etc/ldapd.conf first, then /etc/ldap/ entriesjca2016-10-171-3/+3
|
* Fix a few mistakes and add a FILES entry for /etc/ldap/certsjca2016-10-171-5/+7
| | | | From Rob Pierce, help & ok jmc@
* Pull in <sys/time.h> for gettimeofday()guenther2016-08-271-1/+2
| | | | ok deraadt@
* Adjust existing tls_config_set_cipher() callers for TLS cipher groupjsing2016-07-131-2/+2
| | | | | | | changes - map the previous configuration to the equivalent in the new groups. This will be revisited post release. Discussed with beck@
* do not allow whitespace in macro names, i.e. "this is" = "a variable".benno2016-06-211-1/+9
| | | | | | | | change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
* convert ldapd to use the libtls api, bringing in a copy of the evbuffer_tlsjmatthew2016-05-0110-792/+559
| | | | | | code from syslogd. ok beck@ benno@
* Currently we have about a 50/50 split over fcntl(n, F_GETFL [,0])krw2016-03-201-2/+2
| | | | | | | | | | idioms. Adopt the more concise fcntl(n, F_GETFL) over fcntl(n, F_GETFL, 0) where it is obvious further investigation will not yield and even better way. Obviousness evaluation and ok guenther@
* Minor ldapd -r tweaksjca2016-02-042-5/+5
| | | | | | | - fix style - the string pointed to by datadir shouldn't be modified, use const - initialize datadir at compile time - in namespace.c, move the extern datadir decl above local decls
* use stat(2) instead of chdir(2) to check if given the directory is valid.gsoares2016-02-021-3/+7
| | | | OK landry@ jca@
* some -r fixes;jmc2016-02-011-6/+7
|
* Add -r argument to ldapd, to specify an alternative directory tolandry2016-02-013-9/+23
| | | | | | | | | | store/read the database, still defaulting to /var/db/ldap. This will allow running totally separate instances, to be used by an upcoming regress suite for example. With a tweak from gsoares@ to check that the directory exists. ok dlg@ semarie@ jca@
* Properly remove unix sockets (control & listening) upon exit of thelandry2016-01-172-3/+25
| | | | | | | | | | parent process. Child process was killed by pledge because it tried to remove the control socket and didnt have cpath - anyway it couldnt remove it since it had chrooted.. ok jmatthew@ deraadt@
* SSL_CTX_free() and SSL_free() check for null so dont do it in ldapdbenno2015-12-301-5/+3
| | | | ok jung@ tedu@ deraadt@
* bzero -> memset. No binary change.mmcc2015-12-2412-50/+50
|
* use strndup instead of malloc/strncpy/nulmmcc2015-12-241-4/+3
| | | | ok krw@
* commiting -> committingmmcc2015-12-221-3/+3
|
* Remove NULL-checks before free(). ok tb@mmcc2015-12-102-6/+4
|
* #include <string.h> not strings.hclaudio2015-12-051-2/+2
|
* use SOCK_NONBLOCK instead of fcntljmatthew2015-11-026-33/+12
| | | | ok dlg@
* Both ldapd processes need "stdio" to talk to clients and each other.jmatthew2015-11-022-2/+9
| | | | | | | | | | | The parent process opens database files ("rpath wpath cpath"), sends fds to the child ("sendfd"), and does bsd auth on behalf of the child ("getpw proc exec"). The child process accepts client connections ("inet unix"), receives fds from the parent ("recvfd") and locks database files ("flock"). ok deraadt@
* The <ctype.h> is*() interfaces expect EOF or an unsigned char; cast toguenther2015-10-111-2/+2
| | | | | | (unsigned char) as required found by Michael McConville (mmcconv1 (at) sccs.swarthmore.edu) w/Coccinelle
* Do not assume that asprintf() clears the pointer on failure, whichmillert2015-06-034-10/+22
| | | | | is non-portable. Also add missing asprintf() return value checks. OK deraadt@ guenther@ doug@
* ber_printf_elements should return NULL if any of its parts fail.pelikan2015-02-121-14/+31
| | | | | | Leave the error handling up to its callers. ok reyk
* initialize a variable in case "goto done" makes us compare itpelikan2015-02-111-2/+3
| | | | found by clang, ok henning
* Remove ssl_by_mem_ctrl() and x509_mem_lookup to unbreak the build. Itreyk2015-01-281-60/+1
| | | | | | | caused a conflict with a new function in LibreSSL but wasn't even used by ldapd. No functional change. OK deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.