Jan Vcelak authored 12 years ago and Howard Chu committed 12 years ago

The buffer allocated for reading password file has to be initialized
with zeros, or we need to append zero at the end of the file. Otherwise
we might read unitialized memory and consider it to be a password.

SATOH Fumiyasu authored 12 years ago and Howard Chu committed 12 years ago

Add "-o module-path=<pathspec>" and "-o module-load=<filename>"
options to load a dynamically loadable password hash module
(e.g., slapd-sha2).

Jan Vcelak authored 12 years ago and Howard Chu committed 12 years ago

Prior to this patch, if TLS_CACERTDIR was set to Mozilla NSS certificate
database and TLS_CACERT was set to a PEM bundle file with CA
certificates, the PEM file content was not loaded.

With this patch and the same settings, OpenLDAP can verify certificates
which are signed by CAs stored both in certdb and PEM bundle file.

Frederik Deweerdt authored 12 years ago and Howard Chu committed 12 years ago

Not protecting the accesses to ldap_int_hostname could lead to a double
free.

If slapadd'ing a config DB and tool-threads is set in the config LDIF,
the checks for slap_tool_thread_max will be invalid.

SATOH Fumiyasu authored 12 years ago and Howard Chu committed 12 years ago

Support {SSHA256}, {SSHA384} and {SSHA512} hash schemes

SATOH Fumiyasu authored 12 years ago and Howard Chu committed 12 years ago

Remove sha*_hex_hash() and replace chk_sha*() with
libraries/liblutil/passwd.c:chk_sha1() implementation to
avoid a race condition.

SATOH Fumiyasu authored 12 years ago and Howard Chu committed 12 years ago

contrib/slapd-modules/passwd/sha2/sha2.[ch] need portable.h and
some macros to be portable source.

contrib/slapd-modules/passwd/sha2/slapd-sha2.c:hash_sha*() must
declare "struct berval digest" before a statement for K&R C,
and must replace C++ "// foo"-style comments with C style.

Ondrej Kuznik authored 12 years ago and Howard Chu committed 12 years ago

Some databases might want to register their subsystems under the dn
allocated for them by monitor_register_databas. It requires that the
deferred database registration callback be called *before* the
subsystem's.