From dbbf718f9d471b94b524629943a666924a044f4b Mon Sep 17 00:00:00 2001 From: William Brown Date: Tue, 14 Nov 2017 16:50:43 +1000 Subject: [PATCH 5/9] Ticket 49218 - Certmap - inplace upgrade mechanism Bug Description: This adds support for pluggable certificate mapping libraries. To achieve this, this replaces the existing baked in certificate mapping code. Fix Description: Add an inplace upgrae mechanism that is docker compatible. This is important as we can not rely on the ability of setup-ds.pl -u or other external tool to have been run, this MUST be internal to the server at start up. https://pagure.io/389-ds-base/issue/49218 https://pagure.io/lib389/issue/95 https://pagure.io/lib389/issue/84 Author: wibrown Review by: ??? --- ldap/servers/slapd/upgrade.c | 60 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 ldap/servers/slapd/upgrade.c diff --git a/ldap/servers/slapd/upgrade.c b/ldap/servers/slapd/upgrade.c new file mode 100644 index 0000000..ed80090 --- /dev/null +++ b/ldap/servers/slapd/upgrade.c @@ -0,0 +1,60 @@ +/* BEGIN COPYRIGHT BLOCK + * Copyright (C) 2017 Red Hat, Inc. + * All rights reserved. + * + * License: GPL (version 3 or any later version). + * See LICENSE for details. + * END COPYRIGHT BLOCK */ + +#include + +/* + * This is called on server startup *before* plugins start + * but after config dse is read for operations. This allows + * us to make internal assertions about the state of the configuration + * at start up, enable plugins, and more. + */ + +static char *modifier_name = "cn=upgrade internal,cn=config"; + +/* + * Ensure that the certmap plugin object exists. If not, + * create and enable it. If it exists and is disabled, + * ignore it. + */ +static upgrade_status +upgrade_137_certmap_exists(void) { + /* Does it exist? */ + char *certmap = strdup("dn: cn=certmap plugin,cn=plugins,cn=config\n" + "objectClass: top\n" + "objectClass: nsDylibPlugin4\n" + "cn: certmap plugin\n" + "nsslapd-pluginpath: libcertmap\n" + "nsslapd-plugininitfunc: certmap_init_fn\n" + "nsslapd-pluginenabled: on"); + + slapi_v4_dn *base_sdn = slapi_v4_sdn_new_from_char_dn("cn=certmap plugin,cn=plugins,cn=config"); + /* If not, create it. */ + slapi_v4_plugin_result *result = slapi_v4_entry_exists_or_create(base_sdn, "(cn=certmap plugin)", certmap, modifier_name); + upgrade_status uresult = UPGRADE_SUCCESS; + + if (result->result != SLAPI_V4_PLUGIN_SUCCESS) { + slapi_log_error(SLAPI_LOG_FATAL, "upgrade_137_certmap_exists", "Failed to create certmap entry: %"PRId32": %s\n", result->ldap_code, result->msg); + uresult = UPGRADE_FAILURE; + } + spal_free(certmap); + slapi_v4_sdn_free(base_sdn); + slapi_v4_plugin_result_destroy(result); + return uresult; +} + +upgrade_status +upgrade_server(void) { + /* Could this iterate over an array of function pointers? */ + if (upgrade_137_certmap_exists() != UPGRADE_SUCCESS) { + return UPGRADE_FAILURE; + } + return UPGRADE_SUCCESS; +} + + -- 1.8.3.1