Update to 1.4.3.36

389-ds-base.spec

@@ -5,19 +5,16 @@ ExcludeArch:   i686
 
 Name:          389-ds-base
 Summary:       Base 389 Directory Server
-Version:       1.4.3.20
+Version:       1.4.3.36
-Release:       2
+Release:       1
 License:       GPLv3+
 URL:           https://www.port389.org
-Source0:       https://releases.pagure.org/389-ds-base/389-ds-base-%{version}.tar.bz2
+Source0:       https://github.com/389ds/389-ds-base/archive/refs/tags/389-ds-base-%{version}.tar.gz
 Source1:       389-ds-base-git.sh
 Source2:       389-ds-base-devel.README
 Source3:       https://github.com/jemalloc/jemalloc/releases/download/5.2.1/jemalloc-5.2.1.tar.bz2
-
+# Refer: https://github.com/389ds/389-ds-base/pull/5374
-Patch0:        CVE-2021-3652.patch
+Patch0:        fix-dsidm-posixgroup-get_dn-fails-with-search_ext.patch
-Patch1:        CVE-2021-3514.patch
-# https://github.com/389ds/389-ds-base/commit/5a18aeb49c357a16c138d37a8251d73d8ed35319
-Patch2:        Fix-attributeError-type-object-build_manpages.patch
 
 BuildRequires: nspr-devel nss-devel >= 3.34 perl-generators openldap-devel libdb-devel cyrus-sasl-devel icu
 BuildRequires: libicu-devel pcre-devel cracklib-devel gcc-c++ net-snmp-devel lm_sensors-devel bzip2-devel
@@ -29,6 +26,7 @@ BuildRequires: python%{python3_pkgversion}-pyasn1-modules python%{python3_pkgver
 BuildRequires: python%{python3_pkgversion}-argcomplete python%{python3_pkgversion}-argparse-manpage
 BuildRequires: python%{python3_pkgversion}-libselinux python%{python3_pkgversion}-policycoreutils
 BuildRequires: python%{python3_pkgversion}-packaging rsync npm nodejs libtalloc-devel libtevent-devel
+BuildRequires: python%{python3_pkgversion}-cryptography
 Requires:      389-ds-base-libs = %{version}-%{release}
 Requires:      python%{python3_pkgversion}-lib389 = %{version}-%{release}
 Requires:      policycoreutils-python-utils /usr/sbin/semanage libsemanage-python%{python3_pkgversion}
@@ -108,9 +106,9 @@ Requires:      389-ds-base = %{version}-%{release}
 Documentation for 389 Directory Server.
 
 %prep
-%autosetup -n 389-ds-base-%{version} -p1
+%autosetup -n 389-ds-base-389-ds-base-%{version} -p1
 
-%setup -n 389-ds-base-%{version} -T -D -b 3
+%setup -n 389-ds-base-389-ds-base-%{version} -T -D -b 3
 
 cp %{SOURCE2} README.devel
 
@@ -145,7 +143,7 @@ cd ./src/lib389
 %py3_build
 cd -
 for f in "dsconf.8" "dsctl.8" "dsidm.8" "dscreate.8"; do
-  sed -i  "1s/\"1\"/\"8\"/" %{_builddir}/389-ds-base-%{version}/src/lib389/man/$f
+  sed -i  "1s/\"1\"/\"8\"/" %{_builddir}/389-ds-base-389-ds-base-%{version}/src/lib389/man/$f
 done
 export XCFLAGS=$RPM_OPT_FLAGS
 %make_build
@@ -157,7 +155,7 @@ install -d %{buildroot}%{_datadir}/cockpit
 
 find %{buildroot}%{_datadir}/cockpit/389-console -type d | sed -e "s@%{buildroot}@@" | sed -e 's/^/\%dir /' > cockpit.list
 find %{buildroot}%{_datadir}/cockpit/389-console -type f | sed -e "s@%{buildroot}@@" >> cockpit.list
-cp -r %{_builddir}/389-ds-base-%{version}/man/man3 $RPM_BUILD_ROOT/%{_mandir}/man3
+cp -r %{_builddir}/389-ds-base-389-ds-base-%{version}/man/man3 $RPM_BUILD_ROOT/%{_mandir}/man3
 
 cd src/lib389
 %py3_install
@@ -175,8 +173,8 @@ sed -i -e 's|#{{PERL-EXEC}}|#!/usr/bin/perl|' $RPM_BUILD_ROOT%{_datadir}/dirsrv/
 
 cd ../jemalloc-5.2.1
 make DESTDIR="$RPM_BUILD_ROOT" install_lib install_bin
-cp -pa COPYING ../389-ds-base-%{version}/COPYING.jemalloc
+cp -pa COPYING ../389-ds-base-389-ds-base-%{version}/COPYING.jemalloc
-cp -pa README ../389-ds-base-%{version}/README.jemalloc
+cp -pa README ../389-ds-base-389-ds-base-%{version}/README.jemalloc
 cd -
 
 cd  $RPM_BUILD_ROOT/usr
@@ -188,6 +186,8 @@ cd -
 mkdir -p  $RPM_BUILD_ROOT/etc/ld.so.conf.d
 echo "%{_bindir}/%{name}" > $RPM_BUILD_ROOT/etc/ld.so.conf.d/%{name}-%{_arch}.conf
 echo "%{_libdir}/%{name}" >> $RPM_BUILD_ROOT/etc/ld.so.conf.d/%{name}-%{_arch}.conf
+echo "%{_libdir}/dirsrv/plugins" >> $RPM_BUILD_ROOT/etc/ld.so.conf.d/%{name}-%{_arch}.conf
+echo "%{_libdir}/dirsrv" >> $RPM_BUILD_ROOT/etc/ld.so.conf.d/%{name}-%{_arch}.conf
 
 %check
 if ! make DESTDIR="$RPM_BUILD_ROOT" check; then
@@ -348,7 +348,7 @@ exit 0
 %{_sbindir}/{ldif2ldap,bak2db,db2bak,db2index,db2ldif,dbverify,ldif2db,restart-dirsrv}
 %{_sbindir}/{start-dirsrv,status-dirsrv,stop-dirsrv,upgradedb,vlvindex}
 %{_sbindir}/{monitor,dbmon.sh,dn2rdn,restoreconfig,saveconfig,suffix2instance,upgradednformat}
-%{_libexecdir}/dirsrv/{ds_selinux_enabled,ds_selinux_port_query}
+%{_libexecdir}/dirsrv/{ds_selinux_enabled,ds_selinux_port_query,ds_selinux_restorecon.sh}
 %{_datadir}/dirsrv/properties/*.res
 %{_datadir}/dirsrv/script-templates
 %{_datadir}/dirsrv/updates
@@ -376,6 +376,12 @@ exit 0
 %{_mandir}/*/*
 
 %changelog
+* Tue Oct 24 2023 wangkai <13474090681@163.com> - 1.4.3.36-1
+- Update to 1.4.3.36
+- Fix dsidm user/posixgroup get_dn fails with search_ext()
+- Fix unable to add objectclass/attribute without x-origin
+- Fix execute dsconf to open pdb
+
 * Mon Aug 7 2023 panchenbo <panchenbo@kylinsec.com.cn> - 1.4.3.20-2
 - add support for sw_64 and loongarch64
 

CVE-2021-3514.patch

@@ -1,52 +0,0 @@
-From 2e5b526012612d1d6ccace46398bee679a730271 Mon Sep 17 00:00:00 2001
-From: tbordaz <tbordaz@redhat.com>
-Date: Tue, 27 Apr 2021 09:29:32 +0200
-Subject: [PATCH] Issue 4711 - SIGSEV with sync_repl (#4738)
-
-Bug description:
-	sync_repl sends back entries identified with a unique
-	identifier that is 'nsuniqueid'. If 'nsuniqueid' is
-	missing, then it may crash
-
-Fix description:
-	Check a nsuniqueid is available else returns OP_ERR
-
-relates: https://github.com/389ds/389-ds-base/issues/4711
-
-Reviewed by: Pierre Rogier, James Chapman, William Brown (Thanks!)
-
-Platforms tested:  F33
----
- ldap/servers/plugins/sync/sync_util.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/ldap/servers/plugins/sync/sync_util.c b/ldap/servers/plugins/sync/sync_util.c
-index e64d519e1a..3dacee8cad 100644
---- a/ldap/servers/plugins/sync/sync_util.c
-+++ b/ldap/servers/plugins/sync/sync_util.c
-@@ -127,8 +127,8 @@ sync_create_state_control(Slapi_Entry *e, LDAPControl **ctrlp, int type, Sync_Co
-     BerElement *ber;
-     struct berval *bvp;
-     char *uuid;
--    Slapi_Attr *attr;
--    Slapi_Value *val;
-+    Slapi_Attr *attr = NULL;
-+    Slapi_Value *val = NULL;
- 
-     if (type == LDAP_SYNC_NONE || ctrlp == NULL || (ber = der_alloc()) == NULL) {
-         return (LDAP_OPERATIONS_ERROR);
-@@ -138,6 +138,14 @@ sync_create_state_control(Slapi_Entry *e, LDAPControl **ctrlp, int type, Sync_Co
- 
-     slapi_entry_attr_find(e, SLAPI_ATTR_UNIQUEID, &attr);
-     slapi_attr_first_value(attr, &val);
-+    if ((attr == NULL) || (val == NULL)) {
-+        /* It may happen with entries in special backends
-+         * such like cn=config, cn=shema, cn=monitor...
-+         */
-+        slapi_log_err(SLAPI_LOG_ERR, SYNC_PLUGIN_SUBSYSTEM,
-+		      "sync_create_state_control - Entries are missing nsuniqueid. Unable to proceed.\n");
-+        return (LDAP_OPERATIONS_ERROR);
-+    }
-     uuid = sync_nsuniqueid2uuid(slapi_value_get_string(val));
-     if ((rc = ber_printf(ber, "{eo", type, uuid, 16)) != -1) {
-         if (cookie) {

CVE-2021-3652.patch

@@ -1,118 +0,0 @@
-From c1926dfc6591b55c4d33f9944de4d7ebe077e964 Mon Sep 17 00:00:00 2001
-From: Firstyear <william@blackhats.net.au>
-Date: Fri, 9 Jul 2021 11:53:35 +1000
-Subject: [PATCH] Issue 4817 - BUG - locked crypt accounts on import may allow
- all passwords (#4819)
-
-Bug Description: Due to mishanding of short dbpwd hashes, the
-crypt_r algorithm was misused and was only comparing salts
-in some cases, rather than checking the actual content
-of the password.
-
-Fix Description: Stricter checks on dbpwd lengths to ensure
-that content passed to crypt_r has at least 2 salt bytes and
-1 hash byte, as well as stricter checks on ct_memcmp to ensure
-that compared values are the same length, rather than potentially
-allowing overruns/short comparisons.
-
-fixes: https://github.com/389ds/389-ds-base/issues/4817
-
-Author: William Brown <william@blackhats.net.au>
-
-Review by: @mreynolds389
----
- .../password/pwd_crypt_asterisk_test.py       | 50 +++++++++++++++++++
- ldap/servers/plugins/pwdstorage/crypt_pwd.c   | 20 +++++---
- 2 files changed, 64 insertions(+), 6 deletions(-)
- create mode 100644 dirsrvtests/tests/suites/password/pwd_crypt_asterisk_test.py
-
-diff --git a/dirsrvtests/tests/suites/password/pwd_crypt_asterisk_test.py b/dirsrvtests/tests/suites/password/pwd_crypt_asterisk_test.py
-new file mode 100644
-index 0000000000..d76614db1c
---- /dev/null
-+++ b/dirsrvtests/tests/suites/password/pwd_crypt_asterisk_test.py
-@@ -0,0 +1,50 @@
-+# --- BEGIN COPYRIGHT BLOCK ---
-+# Copyright (C) 2021 William Brown <william@blackhats.net.au>
-+# All rights reserved.
-+#
-+# License: GPL (version 3 or any later version).
-+# See LICENSE for details.
-+# --- END COPYRIGHT BLOCK ---
-+#
-+import ldap
-+import pytest
-+from lib389.topologies import topology_st
-+from lib389.idm.user import UserAccounts
-+from lib389._constants import (DEFAULT_SUFFIX, PASSWORD)
-+
-+pytestmark = pytest.mark.tier1
-+
-+def test_password_crypt_asterisk_is_rejected(topology_st):
-+    """It was reported that {CRYPT}* was allowing all passwords to be
-+    valid in the bind process. This checks that we should be rejecting
-+    these as they should represent locked accounts. Similar, {CRYPT}!
-+
-+    :id: 0b8f1a6a-f3eb-4443-985e-da14d0939dc3
-+    :setup: Single instance
-+    :steps: 1. Set a password hash in with CRYPT and the content *
-+            2. Test a bind
-+            3. Set a password hash in with CRYPT and the content !
-+            4. Test a bind
-+    :expectedresults:
-+            1. Successfully set the values
-+            2. The bind fails
-+            3. Successfully set the values
-+            4. The bind fails
-+    """
-+    topology_st.standalone.config.set('nsslapd-allow-hashed-passwords', 'on')
-+    topology_st.standalone.config.set('nsslapd-enable-upgrade-hash', 'off')
-+
-+    users = UserAccounts(topology_st.standalone, DEFAULT_SUFFIX)
-+    user = users.create_test_user()
-+
-+    user.set('userPassword', "{CRYPT}*")
-+
-+    # Attempt to bind with incorrect password.
-+    with pytest.raises(ldap.INVALID_CREDENTIALS):
-+        badconn = user.bind('badpassword')
-+
-+    user.set('userPassword', "{CRYPT}!")
-+    # Attempt to bind with incorrect password.
-+    with pytest.raises(ldap.INVALID_CREDENTIALS):
-+        badconn = user.bind('badpassword')
-+
-diff --git a/ldap/servers/plugins/pwdstorage/crypt_pwd.c b/ldap/servers/plugins/pwdstorage/crypt_pwd.c
-index 9031b21996..1b37d41ede 100644
---- a/ldap/servers/plugins/pwdstorage/crypt_pwd.c
-+++ b/ldap/servers/plugins/pwdstorage/crypt_pwd.c
-@@ -48,15 +48,23 @@ static unsigned char itoa64[] = /* 0 ... 63 => ascii - 64 */
- int
- crypt_pw_cmp(const char *userpwd, const char *dbpwd)
- {
--    int rc;
--    char *cp;
-+    int rc = -1;
-+    char *cp = NULL;
-+    size_t dbpwd_len = strlen(dbpwd);
-     struct crypt_data data;
-     data.initialized = 0;
- 
--    /* we use salt (first 2 chars) of encoded password in call to crypt_r() */
--    cp = crypt_r(userpwd, dbpwd, &data);
--    if (cp) {
--        rc = slapi_ct_memcmp(dbpwd, cp, strlen(dbpwd));
-+    /*
-+     * there MUST be at least 2 chars of salt and some pw bytes, else this is INVALID and will
-+     * allow any password to bind as we then only compare SALTS.
-+     */
-+    if (dbpwd_len >= 3) {
-+        /* we use salt (first 2 chars) of encoded password in call to crypt_r() */
-+        cp = crypt_r(userpwd, dbpwd, &data);
-+    }
-+    /* If these are not the same length, we can not proceed safely with memcmp. */
-+    if (cp && dbpwd_len == strlen(cp)) {
-+        rc = slapi_ct_memcmp(dbpwd, cp, dbpwd_len);
-     } else {
-         rc = -1;
-     }

Fix-attributeError-type-object-build_manpages.patch

@@ -1,52 +0,0 @@
-From 5a18aeb49c357a16c138d37a8251d73d8ed35319 Mon Sep 17 00:00:00 2001
-From: Viktor Ashirov <vashirov@redhat.com>
-Date: Tue, 18 Jan 2022 13:24:53 +0100
-Subject: [PATCH] Issue 5115 -  AttributeError: type object 'build_manpages'
- has no attribute 'build_manpages'
-
-Bug Description:
-Starting from v2.1, argparse-manpage provides methods build_manpages,
-get_build_py_cmd and get_install_cmd in the top-level module.
-This breaks installation of lib389 on systems with the newer version
-of argparse-manpage.
-
-Fix Description:
-Update setup.py to be aware of the module version and import methods
-based on it.
-
-Fixes: https://github.com/389ds/389-ds-base/issues/5115
-
-Reviewed by: @tbordaz, @mreynolds389 (Thanks!)
----
- src/lib389/setup.py | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/src/lib389/setup.py b/src/lib389/setup.py
-index cadec25..5974d2c 100644
---- a/src/lib389/setup.py
-+++ b/src/lib389/setup.py
-@@ -14,7 +14,9 @@
- 
- from setuptools import setup, find_packages
- from os import path
--from build_manpages import build_manpages
-+import build_manpages as bm
-+if bm.__version__ < '2.1':
-+    from build_manpages import build_manpages as bm
- from setuptools.command.build_py import build_py
- 
- here = path.abspath(path.dirname(__file__))
-@@ -89,8 +91,8 @@ setup(
- 
-     cmdclass={
-         # Dynamically build man pages for cli tools
--        'build_manpages': build_manpages.build_manpages,
--        'build_py': build_manpages.get_build_py_cmd(build_py),
-+        'build_manpages': bm.build_manpages,
-+        'build_py': bm.get_build_py_cmd(build_py),
-     }
- 
- )
--- 
-2.27.0
-

fix-dsidm-posixgroup-get_dn-fails-with-search_ext.patch

@@ -0,0 +1,11 @@
+--- 389-ds-base-1.4.3.36/src/lib389/lib389/cli_idm/posixgroup.py	2023-06-14 22:32:48.000000000 +0800
++++ 389-ds-base-1.4.3.36/src/lib389/lib389/cli_idm/posixgroup.py_bak	2023-10-23 19:21:19.427980741 +0800
+@@ -38,7 +38,7 @@
+ 
+ 
+ def get_dn(inst, basedn, log, args):
+-    dn = lambda args: _get_arg( args.dn, msg="Enter dn to retrieve")
++    dn = _get_arg( args.dn, msg="Enter dn to retrieve")
+     _generic_get_dn(inst, basedn, log.getChild('_generic_get_dn'), MANY, dn, args)
+ 
+