%global pkgname   dirsrv

# for a pre-release, define the prerel field e.g. .a1 .rc2 - comment out for official release

# also remove the space between % and global - this space is needed because

# fedpkg verrel stupidly ignores comment lines

#% global prerel .rc3

# also need the relprefix field for a pre-release e.g. .0 - also comment out for official release

#% global relprefix 0.

# If perl-Socket-2.000 or newer is available, set 0 to use_Socket6.

%global use_Socket6 0

# This is used in certain builds to help us know if it has extra features.

%global variant base

%global use_asan 0

%if %{use_asan}

%global use_tcmalloc 0

%global variant base-asan

%else

%if %{_arch} != "s390x" && %{_arch} != "s390"

%global use_tcmalloc 1

%else

%global use_tcmalloc 0

%endif

%endif

# fedora 15 and later uses tmpfiles.d

# otherwise, comment this out

%{!?with_tmpfiles_d: %global with_tmpfiles_d %{_sysconfdir}/tmpfiles.d}

# systemd support

%global groupname %{pkgname}.target

# set PIE flag

%global _hardened_build 1

Summary:          389 Directory Server (%{variant})

Name:             389-ds-base

Version:          1.3.8.4

Release:          %{?relprefix}25%{?prerel}.1%{?dist}

License:          GPLv3+

URL:              https://www.port389.org/

Group:            System Environment/Daemons

BuildRoot:        %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Conflicts:        selinux-policy-base < 3.9.8

Requires:         %{name}-libs = %{version}-%{release}

Provides:         ldif2ldbm >= 0

BuildRequires:    nspr-devel

BuildRequires:    nss-devel >= 3.34

BuildRequires:    svrcore-devel >= 4.1.3

BuildRequires:    openldap-devel

BuildRequires:    libdb-devel

BuildRequires:    cyrus-sasl-devel

BuildRequires:    icu

BuildRequires:    libicu-devel

BuildRequires:    pcre-devel

BuildRequires:    gcc-c++

# The following are needed to build the snmp ldap-agent

BuildRequires:    net-snmp

BuildRequires:    net-snmp-devel

%ifnarch sparc sparc64 ppc ppc64 s390 s390x

BuildRequires:    lm_sensors-devel

%endif

BuildRequires:    bzip2-devel

BuildRequires:    zlib-devel

BuildRequires:    openssl-devel

BuildRequires:    tcp_wrappers

# the following is for the pam passthru auth plug-in

BuildRequires:    pam-devel

BuildRequires:    systemd-units

BuildRequires:    systemd-devel

%if %{use_asan}

BuildRequires:    libasan

%endif

# Needed to support regeneration of the autotool artifacts.

BuildRequires:    autoconf

BuildRequires:    automake

BuildRequires:    libtool

BuildRequires:    libevent-devel

BuildRequires:    libtalloc-devel

BuildRequires:    libtevent-devel

# For tests!

BuildRequires:    libcmocka-devel

BuildRequires:    doxygen

# this is needed for using semanage from our setup scripts

Requires:         policycoreutils-python

Requires:         /usr/sbin/semanage

Requires:         libsemanage-python 

Requires:         selinux-policy >= 3.13.1-137

# the following are needed for some of our scripts

Requires:         openldap-clients

# use_openldap assumes perl-Mozilla-LDAP is built with openldap support

Requires:         perl-Mozilla-LDAP

# this is needed to setup SSL if you are not using the

# administration server package

Requires:         nss-tools

Requires:         nss >= 3.34

# these are not found by the auto-dependency method

# they are required to support the mandatory LDAP SASL mechs

Requires:         cyrus-sasl-gssapi

Requires:         cyrus-sasl-md5

Requires:         cyrus-sasl-plain

# this is needed for verify-db.pl

Requires:         libdb-utils

# This picks up libperl.so as a Requires, so we add this versioned one

Requires:         perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))

# for the init script

Requires(post):   systemd-units

Requires(preun):  systemd-units

Requires(postun): systemd-units

# for setup-ds.pl

Requires:         bind-utils

# for setup-ds.pl to support ipv6 

%if %{use_Socket6}

Requires:         perl-Socket6

%else 

Requires:         perl-Socket

%endif

Requires:         perl-NetAddr-IP

Requires:         systemd-libs

Requires:         svrcore >= 4.1.3

Requires:         python-ldap

Obsoletes:        %{name} <= 1.3.7.10

%if %{use_tcmalloc}

BuildRequires:    gperftools-devel

Requires:         gperftools-libs

%endif

Source0:          https://releases.pagure.org/389-ds-base/%{name}-%{version}%{?prerel}.tar.bz2

# 389-ds-git.sh should be used to generate the source tarball from git

Source1:          %{name}-git.sh

Source2:          %{name}-devel.README

Patch00:          0000-Ticket-49830-Import-fails-if-backend-name-is-default.patch

Patch01:          0001-Ticket-48818-For-a-replica-bindDNGroup-should-be-fet.patch

Patch02:          0002-Ticket-49546-Fix-issues-with-MIB-file.patch

Patch03:          0003-Ticket-49840-ds-replcheck-command-returns-traceback-.patch

Patch04:          0004-Ticket-49893-disable-nunc-stans-by-default.patch

Patch05:          0005-Ticket-49890-ldapsearch-with-server-side-sort-crashe.patch

Patch06:          0006-Bug-1614820-Crash-in-vslapd_log_emergency_error.patch

Patch07:          0007-Ticket-49932-Crash-in-delete_passwdPolicy-when-persi.patch

Patch08:          0008-Bug-1624004-potential-denial-of-service-attack.patch

Patch09:          0009-Bug-1624004-fix-regression-in-empty-attribute-list.patch

Patch10:          0010-Ticket-49968-Confusing-CRITICAL-message-list_candida.patch

Patch11:          0011-Ticket-49967-entry-cache-corruption-after-failed-MOD.patch

Patch12:          0012-Ticket-49958-extended-search-fail-to-match-entries.patch

Patch13:          0013-Ticket-49915-Master-ns-slapd-had-100-CPU-usage-after.patch

Patch14:          0014-Ticket-49950-PassSync-not-setting-pwdLastSet-attribu.patch

Patch15:          0015-Ticket-49915-fix-compiler-warnings.patch

Patch16:          0016-Ticket-49915-fix-compiler-warnings-2nd.patch

Patch17:          0017-Ticket-49618-Increase-cachememsize-and-dncachememsize.patch

Patch18:          0018-Ticket-50020-during-MODRDN-referential-integrity-can.patch

Patch19:          0019-Ticket-49543-fix-certmap-dn-comparison.patch

Patch20:          0020-Ticket-50117-after-certain-failed-import-operation-i.patch

Patch21:          0021-Ticket-49540-Fix-compiler-warning-in-ldif2ldbm.patch

Patch22:          0022-Ticket-50078-cannot-add-cenotaph-in-read-only-consum.patch

Patch23:          0023-Ticket-50177-import-task-should-not-be-deleted-too-r.patch

Patch24:          0024-Ticket-50396-Crash-in-PAM-plugin-when-user-does-not-.patch

Patch26:          0026-Ticket-50329-2nd-Possible-Security-Issue-DOS-due-to-.patch

Patch25:          0025-Issue-50426-nsSSL3Ciphers-is-limited-to-1024-charact.patch

Patch27:          0027-BZ1518320-entry-cache-crash-fix.patch

Patch28:          0028-BZ1518320-entry-cache-crash-fix.patch

Patch29:          0029-BZ1518320-entry-cache-crash-fix-cherry-pick-error.patch

%description

389 Directory Server is an LDAPv3 compliant server.  The base package includes

the LDAP server and command line utilities for server administration.

%package          libs

Summary:          Core libraries for 389 Directory Server

Group:            System Environment/Daemons

BuildRequires:    nspr-devel

BuildRequires:    nss-devel >= 3.34

BuildRequires:    svrcore-devel >= 4.1.3

BuildRequires:    openldap-devel

BuildRequires:    libdb-devel

BuildRequires:    cyrus-sasl-devel

BuildRequires:    libicu-devel

BuildRequires:    pcre-devel

BuildRequires:    libtalloc-devel

BuildRequires:    libevent-devel

BuildRequires:    libtevent-devel

BuildRequires:    systemd-devel

%if %{use_asan}

Requires:    libasan

Requires:    llvm

%endif

%description      libs

Core libraries for the 389 Directory Server base package.  These libraries

are used by the main package and the -devel package.  This allows the -devel

package to be installed with just the -libs package and without the main package.

%package          devel

Summary:          Development libraries for 389 Directory Server

Group:            Development/Libraries

Requires:         %{name}-libs = %{version}-%{release}

Requires:         pkgconfig

Requires:         nspr-devel

Requires:         nss-devel >= 3.34

Requires:         svrcore-devel >= 4.1.3

Requires:         openldap-devel

Requires:         libtalloc

Requires:         libevent

Requires:         libtevent

Requires:         systemd-libs

%description      devel

Development Libraries and headers for the 389 Directory Server base package.

%package          snmp

Summary:          SNMP Agent for 389 Directory Server

Group:            System Environment/Daemons

Requires:         %{name} = %{version}-%{release}

Obsoletes:        %{name} <= 1.3.7.10

%description      snmp

SNMP Agent for the 389 Directory Server base package.

%package          tests

Summary:          The lib389 Continuous Integration Tests

Group:            Development/Libraries

Requires:         python-lib389

BuildArch:        noarch

%description      tests

The lib389 CI tests that can be run against the Directory Server.

%prep

%autosetup -p1 -n %{name}-%{version}%{?prerel}

cp %{SOURCE2} README.devel

%build

OPENLDAP_FLAG="--with-openldap"

%{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}

# hack hack hack https://bugzilla.redhat.com/show_bug.cgi?id=833529

NSSARGS="--with-svrcore-inc=%{_includedir} --with-svrcore-lib=%{_libdir} --with-nss-lib=%{_libdir} --with-nss-inc=%{_includedir}/nss3"

%if %{use_tcmalloc}

TCMALLOC_FLAGS="--enable-tcmalloc"

%endif

%if %{use_asan}

ASAN_FLAGS="--enable-asan --enable-debug"

%endif

# Rebuild the autotool artifacts now.

autoreconf -fiv

%configure --enable-autobind --with-selinux $OPENLDAP_FLAG $TMPFILES_FLAG \

           --with-systemdsystemunitdir=%{_unitdir} \

           --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \

           --with-perldir=/usr/bin \

           --with-systemdgroupname=%{groupname} $NSSARGS \

           --with-systemd --enable-cmocka $TCMALLOC_FLAGS $ASAN_FLAGS

# Generate symbolic info for debuggers

export XCFLAGS=$RPM_OPT_FLAGS

%ifarch x86_64 ppc64 ia64 s390x sparc64

export USE_64=1

%endif

make %{?_smp_mflags}

%install

rm -rf $RPM_BUILD_ROOT

make DESTDIR="$RPM_BUILD_ROOT" install

# Copy in our docs from doxygen.

cp -r %{_builddir}/%{name}-%{version}%{?prerel}/man/man3 $RPM_BUILD_ROOT/%{_mandir}/man3

mkdir -p $RPM_BUILD_ROOT/var/log/%{pkgname}

mkdir -p $RPM_BUILD_ROOT/var/lib/%{pkgname}

mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname}

# for systemd

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/%{groupname}.wants

#remove libtool archives and static libs

find %{buildroot} -type f -name "*.la" -delete

find %{buildroot} -type f -name "*.a" -delete

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.a

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.la

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.a

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.la

# Why are we not making this a proper python package?

pushd ../%{name}-%{version}%{?prerel}

cp -r dirsrvtests $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}

find $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}/dirsrvtests -type f -name '*.pyc' -delete

find $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}/dirsrvtests -type f -name '*.pyo' -delete

find $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}/dirsrvtests -type d -name '__pycache__' -delete

popd

# make sure perl scripts have a proper shebang

sed -i -e 's|#{{PERL-EXEC}}|#!/usr/bin/perl|' $RPM_BUILD_ROOT%{_datadir}/%{pkgname}/script-templates/template-*.pl

# exclude 32-bit platforms from running tests

%if %{_arch} != "s390x" && %{_arch} != "s390" && %{_arch} != "i386" && %{_arch} != "ppc"

%check

# This checks the code, if it fails it prints why, then re-raises the fail to shortcircuit the rpm build.

if ! make DESTDIR="$RPM_BUILD_ROOT" check; then cat ./test-suite.log && false; fi

%endif

%clean

rm -rf $RPM_BUILD_ROOT

%post

output=/dev/null

output2=/dev/null

# reload to pick up any changes to systemd files

/bin/systemctl daemon-reload >$output 2>&1 || :

# find all instances

instances="" # instances that require a restart after upgrade

ninst=0 # number of instances found in total

if [ -n "$DEBUGPOSTTRANS" ] ; then

   output=$DEBUGPOSTTRANS

   output2=${DEBUGPOSTTRANS}.upgrade

fi

# Create dirsrv user and group (if needed)

USERNAME="dirsrv"

GROUPNAME="dirsrv"

HOMEDIR="/usr/share/dirsrv"

if ! getent group $GROUPNAME >/dev/null ; then

    /usr/sbin/groupadd -f -r $GROUPNAME

fi

if ! getent passwd $USERNAME >/dev/null ; then

    /usr/sbin/useradd -r -g $GROUPNAME -d $HOMEDIR -s /sbin/nologin -c "user for 389-ds-base" $USERNAME

fi

# Reload our sysctl before we restart (if we can)

sysctl --system &> $output; true

echo looking for instances in %{_sysconfdir}/%{pkgname} > $output 2>&1 || :

instbase="%{_sysconfdir}/%{pkgname}"

for dir in $instbase/slapd-* ; do

    echo dir = $dir >> $output 2>&1 || :

    if [ ! -d "$dir" ] ; then continue ; fi

    case "$dir" in *.removed) continue ;; esac

    basename=`basename $dir`

    inst="%{pkgname}@`echo $basename | sed -e 's/slapd-//g'`"

    echo found instance $inst - getting status  >> $output 2>&1 || :

    if /bin/systemctl -q is-active $inst ; then

       echo instance $inst is running >> $output 2>&1 || :

       instances="$instances $inst"

    else

       echo instance $inst is not running >> $output 2>&1 || :

    fi

    ninst=`expr $ninst + 1`

done

if [ $ninst -eq 0 ] ; then

    echo no instances to upgrade >> $output 2>&1 || :

    exit 0 # have no instances to upgrade - just skip the rest

fi

# shutdown all instances

echo shutting down all instances . . . >> $output 2>&1 || :

for inst in $instances ; do

    echo stopping instance $inst >> $output 2>&1 || :

    /bin/systemctl stop $inst >> $output 2>&1 || :

done

echo remove pid files . . . >> $output 2>&1 || :

/bin/rm -f /var/run/%{pkgname}*.pid /var/run/%{pkgname}*.startpid

# do the upgrade

echo upgrading instances . . . >> $output 2>&1 || :

DEBUGPOSTSETUPOPT=`/usr/bin/echo $DEBUGPOSTSETUP | /usr/bin/sed -e "s/[^d]//g"`

if [ -n "$DEBUGPOSTSETUPOPT" ] ; then

    %{_sbindir}/setup-ds.pl -l $output2 -$DEBUGPOSTSETUPOPT -u -s General.UpdateMode=offline >> $output 2>&1 || :

else

    %{_sbindir}/setup-ds.pl -l $output2 -u -s General.UpdateMode=offline >> $output 2>&1 || :

fi

# restart instances that require it

for inst in $instances ; do

    echo restarting instance $inst >> $output 2>&1 || :

    /bin/systemctl start $inst >> $output 2>&1 || :

done

exit 0

%preun

if [ $1 -eq 0 ]; then # Final removal

    # remove instance specific service files/links

    rm -rf %{_sysconfdir}/systemd/system/%{groupname}.wants/* > /dev/null 2>&1 || :

fi

%postun

if [ $1 = 0 ]; then # Final removal

    rm -rf /var/run/%{pkgname}

fi

%post snmp

%systemd_post %{pkgname}-snmp.service

%preun snmp

%systemd_preun %{pkgname}-snmp.service %{groupname}

%postun snmp

%systemd_postun_with_restart %{pkgname}-snmp.service

%files

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl

%dir %{_sysconfdir}/%{pkgname}

%dir %{_sysconfdir}/%{pkgname}/schema

%config(noreplace)%{_sysconfdir}/%{pkgname}/schema/*.ldif

%dir %{_sysconfdir}/%{pkgname}/config

%dir %{_sysconfdir}/systemd/system/%{groupname}.wants

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/slapd-collations.conf

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/certmap.conf

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/template-initconfig

%config(noreplace)%{_sysconfdir}/sysconfig/%{pkgname}

%config(noreplace)%{_sysconfdir}/sysconfig/%{pkgname}.systemd

%{_datadir}/%{pkgname}

%{_datadir}/gdb/auto-load/*

%{_unitdir}

%{_bindir}/*

# We have to seperate this from being a glob to ensure the caps are applied.

%{_sbindir}/ns-slapd

%{_sbindir}/bak2db

%{_sbindir}/bak2db.pl

%{_sbindir}/cleanallruv.pl

%{_sbindir}/db2bak

%{_sbindir}/db2bak.pl

%{_sbindir}/db2index

%{_sbindir}/db2index.pl

%{_sbindir}/db2ldif

%{_sbindir}/db2ldif.pl

%{_sbindir}/dbmon.sh

%{_sbindir}/dbverify

%{_sbindir}/dn2rdn

%{_sbindir}/ds_selinux_enabled

%{_sbindir}/ds_selinux_port_query

%{_sbindir}/ds_systemd_ask_password_acl

%{_sbindir}/fixup-linkedattrs.pl

%{_sbindir}/fixup-memberof.pl

%{_sbindir}/ldif2db

%{_sbindir}/ldif2db.pl

%{_sbindir}/ldif2ldap

%{_sbindir}/migrate-ds.pl

%{_sbindir}/monitor

%{_sbindir}/ns-accountstatus.pl

%{_sbindir}/ns-activate.pl

%{_sbindir}/ns-inactivate.pl

%{_sbindir}/ns-newpwpolicy.pl

%{_sbindir}/remove-ds.pl

%{_sbindir}/restart-dirsrv

%{_sbindir}/restoreconfig

%{_sbindir}/saveconfig

%{_sbindir}/schema-reload.pl

%{_sbindir}/setup-ds.pl

%{_sbindir}/start-dirsrv

%{_sbindir}/status-dirsrv

%{_sbindir}/stop-dirsrv

%{_sbindir}/suffix2instance

%{_sbindir}/syntax-validate.pl

%{_sbindir}/upgradedb

%{_sbindir}/upgradednformat

%{_sbindir}/usn-tombstone-cleanup.pl

%{_sbindir}/verify-db.pl

%{_sbindir}/vlvindex

%{_libdir}/%{pkgname}/perl

%{_libdir}/%{pkgname}/python

%dir %{_libdir}/%{pkgname}/plugins

%{_libdir}/%{pkgname}/plugins/*.so

%{_prefix}/lib/sysctl.d/*

%dir %{_localstatedir}/lib/%{pkgname}

%dir %{_localstatedir}/log/%{pkgname}

%ghost %dir %{_localstatedir}/lock/%{pkgname}

%{_mandir}/man1/*

%{_mandir}/man8/*

%exclude %{_sbindir}/ldap-agent*

%exclude %{_mandir}/man1/ldap-agent.1.gz

%exclude %{_unitdir}/%{pkgname}-snmp.service

%files devel

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel

%{_includedir}/%{pkgname}

%{_libdir}/%{pkgname}/libslapd.so

%{_libdir}/%{pkgname}/libns-dshttpd.so

%{_mandir}/man3/*

%{_libdir}/%{pkgname}/libnunc-stans.so

%{_libdir}/%{pkgname}/libsds.so

%{_libdir}/%{pkgname}/libldaputil.so

%{_libdir}/pkgconfig/*

%files libs

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel

%dir %{_libdir}/%{pkgname}

%{_libdir}/%{pkgname}/libslapd.so.*

%{_libdir}/%{pkgname}/libns-dshttpd-*.so

%{_libdir}/%{pkgname}/libnunc-stans.so.*

%{_libdir}/%{pkgname}/libsds.so.*

%{_libdir}/%{pkgname}/libldaputil.so.*

%files snmp

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/ldap-agent.conf

%{_sbindir}/ldap-agent*

%{_mandir}/man1/ldap-agent.1.gz

%{_unitdir}/%{pkgname}-snmp.service

%files tests

%doc LICENSE LICENSE.GPLv3+

%{_sysconfdir}/%{pkgname}/dirsrvtests

%changelog

* Wed Jul 3 2019 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-25.1

- Bump version to 1.3.8.4-25.1

- Resolves: Bug 1718689 - dse.ldif strip-off string after 1023 character (missing patch file)

* Fri Jun 21 2019 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-25

- Bump version to 1.3.8.4-25

- Resolves: Bug 1722828 - referint update should discard any changes if mep update fails

- Resolves: Bug 1718689 - dse.ldif strip-off string after 1023 character

- Resolves: Bug 1719720 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections

* Wed Jun 19 2019 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-24

- Bump version to 1.3.8.4-24

- Resolves: Bug 1718184 - segfault when using pam passthru and addn plugins together

* Wed Feb 6 2019 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-23

- Bump version to 1.3.8.4-23

- Resolves: Bug 1672173 - import task should not be deleted after import finishes to be able to query the status

- Resolves: Bug 1672177 - after certain failed import operation, impossible to replay an import operation.

- Resolves: Bug 1672179 - cannot add cenotaph in read only consumer 

* Mon Dec 17 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-22

- Bump version to 1.3.8.4-22

- Resolves: Bug 1660120 - certmap fails when Issuer DN has comma in name

* Mon Dec 17 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-21

- Bump version to 1.3.8.4-21

- Resolves: Bug 1659510 - during MODRDN referential integrity can fail erronously while updating large groups

- Resolves: Bug 1659936 - After RHEL 7.6 HTB update, unable to set nsslapd-cachememsize (RHDS 10) to custom value

* Tue Dec 4 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-20

- Bump version to 1.3.8.4-20

- Resolves: Bug 1645197 - Fix compiler warnings

* Tue Dec 4 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-19

- Bump version to 1.3.8.4-19

- Resolves: Bug 1653820 - PassSync not setting pwdLastSet attribute in Active Directory after Pw update from LDAP sync for normal user

- Resolves: Bug 1645197 - on-line re-initialization hangs

* Mon Oct 29 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-18

- Bump version to 1.3.8.4-18

- Resolves: Bug 1638516 - CRIT - list_candidates - NULL idl was recieved from filter_candidates_ex

* Mon Oct 29 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-17

- Bump version to 1.3.8.4-17

- Resolves: Bug 1643875 - ns-slapd: crash in entrycache_add_int

* Tue Oct 16 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-16

- Bump version to 1.3.8.4-16

- Resolves: Bug 1638513 - Message: "CRIT - list_candidates - NULL idl was recieved from filter_candidates_ext." should not be critical

* Wed Sep 19 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-15

- Bump version to 1.3.8.4-15

- Resolves: Bug 1624004 - Fix regression in last patch

* Tue Sep 18 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-14

- Bump version to 1.3.8.4-14

- Resolves: Bug 1624004 - potential denial of service attack

* Fri Aug 31 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-13

- Bump version to 1.3.8.4-13

- Resolves: Bug 1623949 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly

* Thu Aug 23 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-12

- Bump version to 1.3.8.4-12

- Resolves: Bug 1616412 - filter optimization fix causes regression(fix reverted)

* Thu Aug 23 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-11

- Bump version to 1.3.8.4-11

- Resolves: Bug 1614820 - Server crash through modify command with large DN

* Fri Aug 10 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-10

- Bump verison to 1.3.8.4-10

- Resolves: Bug 1614501 - Disable nunc-stans by default

- Resolves: Bug 1607078 - ldapsearch with server side sort crashes the ldap server

* Tue Jul 24 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-9

- Bump version to 1.3.8.4-9

- Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.

* Mon Jul 23 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-8

- Bump version to 1.3.8.4-8

- Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.

* Mon Jul 16 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-7

- Bump version to 1.3.8.4-7

- Resolves: Bug 1595766 - backout this fix for now because it breaks FreeIPA (removed patch file all together)

* Mon Jul 16 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-6

- Bump version to 1.3.8.4-6

- Resolves: Bug 1595766 - backout this fix for now because it breaks FreeIPA

* Mon Jul 16 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-5

- Bump version to 1.3.8.4-5

- Resolves: Bug 1595766 - CVE-2018-10871 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default

* Mon Jul 16 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-4

- Bump version to 1.3.8.4-4

- Resolves: Bug 1597384 - Async operations can hang when the server is running nunc-stans

- Resolves: Bug 1598186 - A search with the scope "one" returns a non-matching entry

- Resolves: Bug 1598718 - import fails if backend name is "default" 

- Resolves: Bug 1598478 - If a replica is created with a bindDNGroup, this group is taken into account only after bindDNGroupCheckInterval seconds

- Resolves: Bug 1525256 - Invalid SNMP MIB for 389 DS

- Resolves: Bug 1597518 - ds-replcheck command returns traceback errors against ldif files having garbage content when run in offline mode

* Mon Jun 25 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-3

- Bump version to 1.3.8.4-3

- Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.

* Mon Jun 25 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-2

- Bump version to 1.3.8.4-2

- Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.

* Thu Jun 21 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-1

- Bump version to 1.3.8.4-1

- Resolves: Bug 1560653 - Rebase 389-ds-base in RHEL 7.6 to 1.3.8

* Thu May 24 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.8.2-1

- Bump version to 1.3.8.2-1

- Resolves: Bug 1560653 - Rebase 389-ds-base in RHEL 7.6 to 1.3.8

* Mon Feb 12 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-18

- Bump version to 1.3.7.5-18

- Resolves: Bug 1539082 - Fix memory leak

* Mon Feb 12 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5.17

- Bump version to 1.3.7.5.17

- Resolves: Bug 1539082 - Child entry cenotaphs should not prevent the deletion of the parent

- Resolves: Bug 1540106 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 

- Resolves: Bug 1535538 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp 

* Tue Feb 6 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-16

- Bump version to 1.3.7.5-16

- Resolves: Bug 1542645 - Outgoing secure connection is failing with recent OpenLDAP

* Tue Feb 6 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-15

- Bump version to 1.3.7.5-15

- Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry

- Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy

- Resolves: Bug 1541108 - Allow CRL handling to be configurable for outgoing connections

* Fri Jan 26 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-14

- Bump version to 1.3.7.5-14

- Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7 (fix regression in -13)

* Thu Jan 18 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-13

- Bump version to 1.3.7.5-13

- Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry

- Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7

- Resolves: Bug 1534379 - CVE-2017-15134: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c 

- Resolves: Bug 1533571 - memberof: schema violation error message is confusing as memberof will likely repair target entry

- Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy

* Fri Jan 12 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-12

- Bump version to 1.3.7.5-12

- Resolves: Bug 1459946 - GetEffectiveRights gives false-negative with ACIs containing targetfilter

- Resolves: Bug 1507194 - cleanallruv could break replication if anchor csn in ruv originated in deleted replica

- Resolves: Bug 1517788 - password policy: minimum token length fails when the token length is equal to attribute length

- Resolves: Bug 1518287 - heap-use-after-free in csn_as

- Resolves: Bug 1531153 - Indexing of internationalized matching rules is failing

- Resolves: Bug 1517383 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired

- Resolves: Bug 1523183 - search with CoS attribute is getting slower after modifying/adding CosTemplate

- Resolves: Bug 1457315 - cmocka tests are not executed during rpm build

- Resolves: Bug 1516309 - After cleanALLruv, replication is looping on keep alive DEL

* Fri Dec 8 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-11

- Bump version to 1.3.7.5-11

- Resolves: Bug 1518069 - heap-buffer-overflow in ss_unescape

- Resolves: Bug 1516676 - gssapi authentication fails after upgrading 389-ds-base

- Resolves: Bug 1511885 - Automatically load /usr/lib/sysctl.d/70-dirsrv.conf after installing 389-ds-base

- Resolves: Bug 1517980 - stack-buffer-overflow in slapi_pblock_get

* Thu Nov 16 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-10

- Bump version to 1.3.7.5-10

- Resolves: Bug 1464463 - Replication fails to start with CBCA (Certificate-Based Client Authentication) while FIPS mode is enabled.

- Resolves: Bug 1465383 - Segmentation fault in valueset_array_to_sorted_quick

- Resolves: Bug 1510865 - python-ldap is not a dependency of 389-ds-base

- Resolves: Bug 1513467 - IPA upgrade fails for latest ipa package

- Resolves: Bug 1192099 - IPA server replication broken, after DS stop-start, due to changelog reset

- Resolves: Bug 1445188 - Misleading error message - Incoming BER Element was 3 bytes 

- Resolves: Bug 1498980 - heap corruption during import

- Resolves: Bug 1511462 - scope one searches give incorrect results

- Resolves: Bug 1514033 - opened connection are hanging, no longer poll

* Fri Nov 3 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-9

- Bump version to 1.3.7.5-9

- Resolves: Bug 1271208 - Fix copy and paste error

* Fri Nov 3 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-8

- Bump version to 1.3.7.5-8

- Resolves: Bug 1509016 - cleanallruv task is not logging any information

* Fri Nov 3 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-7

- Bump version to 1.3.7.5-7

- Resolves: Bug 1474100 - Use of uninitialized value in string ne at /usr/bin/logconv.pl