%global pkgname   dirsrv

# for a pre-release, define the prerel field e.g. .a1 .rc2 - comment out for official release

# also remove the space between % and global - this space is needed because

# fedpkg verrel stupidly ignores comment lines

#% global prerel .rc3

# also need the relprefix field for a pre-release e.g. .0 - also comment out for official release

#% global relprefix 0.

%global use_openldap 1

%global use_db4 0

# If perl-Socket-2.000 or newer is available, set 0 to use_Socket6.

%global use_Socket6 0

# fedora 15 and later uses tmpfiles.d

# otherwise, comment this out

%{!?with_tmpfiles_d: %global with_tmpfiles_d %{_sysconfdir}/tmpfiles.d}

# systemd support

%global groupname %{pkgname}.target

# set PIE flag

%global _hardened_build 1

Summary:          389 Directory Server (base)

Name:             389-ds-base

Version:          1.3.3.1

Release:          %{?relprefix}23%{?prerel}%{?dist}

License:          GPLv2 with exceptions

URL:              http://port389.org/

Group:            System Environment/Daemons

BuildRoot:        %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Obsoletes:        %{name}-selinux

Conflicts:        selinux-policy-base < 3.9.8

Requires:         %{name}-libs = %{version}-%{release}

Provides:         ldif2ldbm 

BuildRequires:    nspr-devel

BuildRequires:    nss-devel

BuildRequires:    svrcore-devel

%if %{use_openldap}

BuildRequires:    openldap-devel

%else

BuildRequires:    mozldap-devel

%endif

%if %{use_db4}

BuildRequires:    db4-devel

%else

BuildRequires:    libdb-devel

%endif

BuildRequires:    cyrus-sasl-devel

BuildRequires:    icu

BuildRequires:    libicu-devel

BuildRequires:    pcre-devel

BuildRequires:    gcc-c++

# The following are needed to build the snmp ldap-agent

BuildRequires:    net-snmp-devel

%ifnarch sparc sparc64 ppc ppc64 s390 s390x

BuildRequires:    lm_sensors-devel

%endif

BuildRequires:    bzip2-devel

BuildRequires:    zlib-devel

BuildRequires:    openssl-devel

BuildRequires:    tcp_wrappers

# the following is for the pam passthru auth plug-in

BuildRequires:    pam-devel

BuildRequires:    systemd-units

# this is needed for using semanage from our setup scripts

Requires:         policycoreutils-python

# the following are needed for some of our scripts

%if %{use_openldap}

Requires:         openldap-clients

%else

Requires:         mozldap-tools

%endif

# use_openldap assumes perl-Mozilla-LDAP is built with openldap support

Requires:         perl-Mozilla-LDAP

# this is needed to setup SSL if you are not using the

# administration server package

Requires:         nss-tools

# these are not found by the auto-dependency method

# they are required to support the mandatory LDAP SASL mechs

Requires:         cyrus-sasl-gssapi

Requires:         cyrus-sasl-md5

# this is needed for verify-db.pl

%if %{use_db4}

Requires:         db4-utils

%else

Requires:         libdb-utils

%endif

# This picks up libperl.so as a Requires, so we add this versioned one

Requires:         perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))

# for the init script

Requires(post):   systemd-units

Requires(preun):  systemd-units

Requires(postun): systemd-units

# for setup-ds.pl to support ipv6 

%if %{use_Socket6}

Requires:         perl-Socket6

%else

Requires:         perl-Socket

%endif

Requires:         perl-NetAddr-IP

Source0:          http://port389.org/sources/%{name}-%{version}%{?prerel}.tar.bz2

# 389-ds-git.sh should be used to generate the source tarball from git

Source1:          %{name}-git.sh

Source2:          %{name}-devel.README

Patch0:           0000-Ticket-47748-Simultaneous-adding-a-user-and-binding-.patch

Patch1:           0001-Ticket-47834-Tombstone_to_glue-if-parents-are-also-c.patch

Patch2:           0002-Ticket-47890-minor-memory-leaks-in-utilities.patch

Patch3:           0003-fix-for-47885-did-not-always-return-a-response-contr.patch

Patch4:           0004-Ticket-47838-harden-the-list-of-ciphers-available-by.patch

Patch5:           0005-Ticket-47838-47895-CI-test-add-test-cases-for-ticket.patch

Patch6:           0006-Ticket-47895-If-no-effective-ciphers-are-available-d.patch

Patch7:           0007-Ticket-47889-DS-crashed-during-ipa-server-install-on.patch

Patch8:           0008-Ticket-47892-coverity-defects-found-in-1.3.3.1.patch

Patch9:           0009-Ticket-47750-Creating-a-glue-fails-if-one-above-leve.patch

Patch10:          0010-Ticket-47908-389-ds-1.3.3.0-does-not-adjust-cipher-s.patch

Patch11:          0011-Ticket-47838-harden-the-list-of-ciphers-available-by.patch

Patch12:          0012-Ticket-47838-CI-test-adjusted-test-cases-based-on-th.patch

Patch13:          0013-Ticket-47880-provide-enabled-ciphers-as-search-resul.patch

Patch14:          0014-Ticket-47880-CI-test-added-test-cases-for-ticket-478.patch

Patch15:          0015-Ticket-47892-coverity-defects-found-in-1.3.3.x.patch

Patch16:          0016-Ticket-47918-result-of-dna_dn_is_shared_config-is-in.patch

Patch17:          0017-Ticket-47892-Fix-remaining-compiler-warnings.patch

Patch18:          0018-Ticket-47919-ldbm_back_modify-SLAPI_PLUGIN_BE_PRE_MO.patch

Patch19:          0019-Ticket-47920-Encoding-of-SearchResultEntry-is-missin.patch

Patch20:          0020-Ticket-47897-Need-to-move-slapi_pblock_set-pb-SLAPI_.patch

Patch21:          0021-Ticket-47922-dynamically-added-macro-aci-is-not-eval.patch

Patch22:          0022-Ticket-47928-Disable-SSL-v3-by-default.patch

Patch23:          0023-Ticket-47928-CI-test-added-test-cases-for-ticket-479.patch

Patch24:          0024-Ticket-47937-Crash-in-entry_add_present_values_wsi_m.patch

Patch25:          0025-Ticket-47928-Disable-SSL-v3-by-default.patch

Patch26:          0026-Ticket-47939-Malformed-cookie-for-LDAP-Sync-makes-DS.patch

Patch27:          0027-Ticket-47945-Add-SSL-TLS-version-info-to-the-access-.patch

Patch28:          0028-Ticket-47948-ldap_sasl_bind-fails-assertion-ld-NULL-.patch

Patch29:          0029-Ticket-47953-Should-not-check-aci-syntax-when-deleti.patch

Patch30:          0030-Ticket-47928-Disable-SSL-v3-by-default.patch

Patch31:          0031-Fix-for-CVE-2014-8112.patch

Patch32:          0032-Ticket-47942-DS-hangs-during-online-total-update.patch

Patch33:          0033-Fix-for-CVE-2014-8105.patch

Patch34:          0034-Additional-fix-for-ticket-47526-v3.patch

Patch35:          0035-fix-jenkins-warning.patch

Patch36:          0036-Ticket-47950-Bind-DN-tracking-unable-to-write-to-int.patch

Patch37:          0037-Ticket-47949-logconv.pl-support-parsing-showing-repo.patch

Patch38:          0038-Ticket-47947-start-dirsrv-after-chrony-on-RHEL7-and-.patch

Patch39:          0039-Ticket-47967-cos_cache_build_definition_list-does-no.patch

Patch40:          0040-Ticket-47969-COS-memory-leak-when-rebuilding-the-cac.patch

Patch41:          0041-Ticket-47969-Fix-coverity-issue.patch

Patch42:          0042-Ticket-47970-Account-lockout-attributes-incorrectly-.patch

Patch43:          0043-Ticket-47970-add-lib389-testcase.patch

Patch44:          0044-Ticket-47960-cookie_change_info-returns-random-negat.patch

Patch45:          0045-Ticket-47960-cookie_change_info-returns-random-negat.patch

Patch46:          0046-Ticket-47636-Error-log-levels-not-displayed-correctl.patch

Patch47:          0047-Ticket-47722-Using-the-filter-file-does-not-work.patch

Patch48:          0048-Ticket-47451-Need-to-unregister-tasks-created-by-plu.patch

Patch49:          0049-Ticket-47451-Running-a-plugin-task-can-crash-the-ser.patch

Patch50:          0050-Ticket-47451-Dynamic-Plugin-various-fixes.patch

Patch51:          0051-Ticket-47451-Fix-jenkins-errors.patch

Patch52:          0052-Ticket-47451-Add-Dynamic-Plugin-CI-Suite.patch

Patch53:          0053-Ticket-47525-Crash-if-setting-invalid-plugin-config-.patch

Patch54:          0054-Ticket-47965-Fix-coverity-issues-2014-11-24.patch

Patch55:          0055-Ticket-47965-Fix-coverity-issues-2014-12-16.patch

Patch56:          0056-Ticket-47750-During-delete-operation-do-not-refresh-.patch

Patch57:          0057-Ticket-47989-Windows-Sync-accidentally-cleared-raw_e.patch

Patch58:          0058-Ticket-47991-upgrade-script-fails-if-etc-and-var-are.patch

Patch59:          0059-Ticket-47988-Schema-learning-mechanism-in-replicatio.patch

Patch60:          0060-Ticket-47988-Schema-learning-mechanism-in-replicatio.patch

Patch61:          0061-Ticket-48005-ns-slapd-crash-in-shutdown-phase.patch

Patch62:          0062-CVE-2015-1854-389ds-base-access-control-bypass-with-.patch

Patch63:          0063-Ticket-48190-idm-ipa-389-ds-base-entry-cache-converg.patch

Patch64:          0064-Ticket-48146-async-simple-paged-results-issue.patch

Patch65:          0065-Ticket-48146-async-simple-paged-results-issue-log-pr.patch

Patch66:          0066-Ticket-48146-async-simple-paged-results-issue-need-t.patch

Patch67:          0067-Ticket-48146-async-simple-paged-results-issue.patch

Patch68:          0068-Ticket-48146-async-simple-paged-results-issue.patch

Patch69:          0069-Ticket-48146-async-simple-paged-results-issue.patch

Patch70:          0070-Ticket-48192-Individual-abandoned-simple-paged-resul.patch

Patch71:          0071-Ticket-48192-Individual-abandoned-simple-paged-resul.patch

Patch72:          0072-Ticket-48192-Individual-abandoned-simple-paged-resul.patch

Patch73:          0073-Ticket-48194-nsSSL3Ciphers-preference-not-enforced-s.patch

Patch74:          0074-Ticket-48192-Individual-abandoned-simple-paged-resul.patch

Patch75:          0075-Ticket-48223-Winsync-fails-when-AD-users-have-multip.patch

Patch76:          0076-Ticket-47553-Enhance-ACIs-to-have-more-control-over-.patch

Patch77:          0077-Ticket-47553-Enhance-ACIs-to-have-more-control-over-.patch

Patch78:          0078-Ticket-48265-Complex-filter-in-a-search-request-doen.patch

Patch79:          0079-Ticket-47912-Proper-handling-of-No-original_tombston.patch

Patch80:          0080-Ticket-48208-CleanAllRUV-should-completely-purge-cha.patch

Patch81:          0081-Ticket-47931-memberOf-retrocl-deadlocks.patch

Patch82:          0082-Ticket-47931-Fix-coverity-issues.patch

Patch83:          0083-Ticket-47831-remove-debug-logging-from-retro-cl.patch

Patch84:          0084-Ticket-47831-remove-debug-logging-from-retro-cl.patch

Patch85:          0085-Ticket-48195-Slow-replication-when-deleting-large-qu.patch

Patch86:          0086-Ticket-48226-In-MMR-double-free-coould-occur-under-s.patch

Patch87:          0087-Ticket-48226-In-MMR-double-free-coould-occur-under-s.patch

%description

389 Directory Server is an LDAPv3 compliant server.  The base package includes

the LDAP server and command line utilities for server administration.

%package          libs

Summary:          Core libraries for 389 Directory Server

Group:            System Environment/Daemons

BuildRequires:    nspr-devel

BuildRequires:    nss-devel

BuildRequires:    svrcore-devel

%if %{use_openldap}

BuildRequires:    openldap-devel

%else

BuildRequires:    mozldap-devel

%endif

%if %{use_db4}

BuildRequires:    db4-devel

%else

BuildRequires:    libdb-devel

%endif

BuildRequires:    cyrus-sasl-devel

BuildRequires:    libicu-devel

BuildRequires:    pcre-devel

%description      libs

Core libraries for the 389 Directory Server base package.  These libraries

are used by the main package and the -devel package.  This allows the -devel

package to be installed with just the -libs package and without the main package.

%package          devel

Summary:          Development libraries for 389 Directory Server

Group:            Development/Libraries

Requires:         %{name}-libs = %{version}-%{release}

Requires:         pkgconfig

Requires:         nspr-devel

Requires:         nss-devel

Requires:         svrcore-devel

%if %{use_openldap}

Requires:         openldap-devel

%else

Requires:         mozldap-devel

%endif

%description      devel

Development Libraries and headers for the 389 Directory Server base package.

%prep

%setup -q -n %{name}-%{version}%{?prerel}

cp %{SOURCE2} README.devel

%patch0 -p1

%patch1 -p1

%patch2 -p1

%patch3 -p1

%patch4 -p1

%patch5 -p1

%patch6 -p1

%patch7 -p1

%patch8 -p1

%patch9 -p1

%patch10 -p1

%patch11 -p1

%patch12 -p1

%patch13 -p1

%patch14 -p1

%patch15 -p1

%patch16 -p1

%patch17 -p1

%patch18 -p1

%patch19 -p1

%patch20 -p1

%patch21 -p1

%patch22 -p1

%patch23 -p1

%patch24 -p1

%patch25 -p1

%patch26 -p1

%patch27 -p1

%patch28 -p1

%patch29 -p1

%patch30 -p1

%patch31 -p1

%patch32 -p1

%patch33 -p1

%patch34 -p1

%patch35 -p1

%patch36 -p1

%patch37 -p1

%patch38 -p1

%patch39 -p1

%patch40 -p1

%patch41 -p1

%patch42 -p1

%patch43 -p1

%patch44 -p1

%patch45 -p1

%patch46 -p1

%patch47 -p1

%patch48 -p1

%patch49 -p1

%patch50 -p1

%patch51 -p1

%patch52 -p1

%patch53 -p1

%patch54 -p1

%patch55 -p1

%patch56 -p1

%patch57 -p1

%patch58 -p1

%patch59 -p1

%patch60 -p1

%patch61 -p1

%patch62 -p1

%patch63 -p1

%patch64 -p1

%patch65 -p1

%patch66 -p1

%patch67 -p1

%patch68 -p1

%patch69 -p1

%patch70 -p1

%patch71 -p1

%patch72 -p1

%patch73 -p1

%patch74 -p1

%patch75 -p1

%patch76 -p1

%patch77 -p1

%patch78 -p1

%patch79 -p1

%patch80 -p1

%patch81 -p1

%patch82 -p1

%patch83 -p1

%patch84 -p1

%patch85 -p1

%patch86 -p1

%patch87 -p1

%build

%if %{use_openldap}

OPENLDAP_FLAG="--with-openldap"

%endif

%{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}

# hack hack hack https://bugzilla.redhat.com/show_bug.cgi?id=833529

NSSARGS="--with-svrcore-inc=%{_includedir} --with-svrcore-lib=%{_libdir} --with-nss-lib=%{_libdir} --with-nss-inc=%{_includedir}/nss3"

%configure --enable-autobind --with-selinux $OPENLDAP_FLAG $TMPFILES_FLAG \

           --with-systemdsystemunitdir=%{_unitdir} \

           --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \

           --with-systemdgroupname=%{groupname} $NSSARGS

# Generate symbolic info for debuggers

export XCFLAGS=$RPM_OPT_FLAGS

%ifarch x86_64 ppc64 ia64 s390x sparc64

export USE_64=1

%endif

make %{?_smp_mflags}

%install

rm -rf $RPM_BUILD_ROOT 

make DESTDIR="$RPM_BUILD_ROOT" install

mkdir -p $RPM_BUILD_ROOT/var/log/%{pkgname}

mkdir -p $RPM_BUILD_ROOT/var/lib/%{pkgname}

mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname}

# for systemd

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/%{groupname}.wants

#remove libtool and static libs

rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.a

rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.la

rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.a

rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.la

# make sure perl scripts have a proper shebang 

sed -i -e 's|#{{PERL-EXEC}}|#!/usr/bin/perl|' $RPM_BUILD_ROOT%{_datadir}/%{pkgname}/script-templates/template-*.pl

%clean

rm -rf $RPM_BUILD_ROOT

%post

output=/dev/null

%systemd_post %{pkgname}-snmp.service

# reload to pick up any changes to systemd files

/bin/systemctl daemon-reload >$output 2>&1 || :

# reload to pick up any shared lib changes

/sbin/ldconfig

# restart the snmp subagent if needed

/bin/systemctl try-restart %{pkgname}-snmp.service > $output 2>&1 || :

# find all instances

instances="" # instances that require a restart after upgrade

ninst=0 # number of instances found in total

if [ -n "$DEBUGPOSTTRANS" ] ; then

   output=$DEBUGPOSTTRANS

fi

echo looking for services in %{_sysconfdir}/systemd/system/%{groupname}.wants/* >> $output 2>&1 || :

for service in %{_sysconfdir}/systemd/system/%{groupname}.wants/* ; do

    if [ ! -f "$service" ] ; then continue ; fi # in case nothing matches

    inst=`echo $service | sed -e 's,%{_sysconfdir}/systemd/system/%{groupname}.wants/,,'`

    echo found instance $inst - getting status >> $output 2>&1 || :

    if /bin/systemctl -q is-active $inst ; then

       echo instance $inst is running >> $output 2>&1 || :

       instances="$instances $inst"

    else

       echo instance $inst is not running >> $output 2>&1 || :

    fi

    ninst=`expr $ninst + 1`

done

if [ $ninst -eq 0 ] ; then

    echo no instances to upgrade >> $output 2>&1 || :

    exit 0 # have no instances to upgrade - just skip the rest

fi

# shutdown all instances

echo shutting down all instances . . . >> $output 2>&1 || :

for inst in $instances ; do

    echo stopping instance $inst >> $output 2>&1 || :

    /bin/systemctl stop $inst >> $output 2>&1 || :

done

echo remove pid files . . . >> $output 2>&1 || :

/bin/rm -f /var/run/%{pkgname}*.pid /var/run/%{pkgname}*.startpid

# do the upgrade

echo upgrading instances . . . >> $output 2>&1 || :

DEBUGPOSTSETUPOPT=`/usr/bin/echo $DEBUGPOSTSETUP | /usr/bin/sed -e "s/[^d]//g"`

if [ -n "$DEBUGPOSTSETUPOPT" ] ; then

    %{_sbindir}/setup-ds.pl -l $output -$DEBUGPOSTSETUPOPT -u -s General.UpdateMode=offline >> $output 2>&1 || :

else

    %{_sbindir}/setup-ds.pl -l $output -u -s General.UpdateMode=offline >> $output 2>&1 || :

fi

# restart instances that require it

for inst in $instances ; do

    echo restarting instance $inst >> $output 2>&1 || :

    /bin/systemctl start $inst >> $output 2>&1 || :

done

exit 0

%preun

if [ $1 -eq 0 ]; then # Final removal

    # Package removal, not upgrade

    %systemd_preun %{pkgname}-snmp.service %{groupname}

    # remove instance specific service files/links

    rm -rf %{_sysconfdir}/systemd/system/%{groupname}.wants/* > /dev/null 2>&1 || :

fi

%postun

/sbin/ldconfig

if [ $1 = 0 ]; then # Final removal

    rm -rf /var/run/%{pkgname}

fi

%files

%defattr(-,root,root,-)

%doc LICENSE EXCEPTION LICENSE.GPLv2

%dir %{_sysconfdir}/%{pkgname}

%dir %{_sysconfdir}/%{pkgname}/schema

%config(noreplace)%{_sysconfdir}/%{pkgname}/schema/*.ldif

%dir %{_sysconfdir}/%{pkgname}/config

%dir %{_sysconfdir}/systemd/system/%{groupname}.wants

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/slapd-collations.conf

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/certmap.conf

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/ldap-agent.conf

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/template-initconfig

%config(noreplace)%{_sysconfdir}/sysconfig/%{pkgname}

%config(noreplace)%{_sysconfdir}/sysconfig/%{pkgname}.systemd

%{_datadir}/%{pkgname}

%{_unitdir}

%{_bindir}/*

%{_sbindir}/*

%{_libdir}/%{pkgname}/perl

%{_libdir}/%{pkgname}/python

%dir %{_libdir}/%{pkgname}/plugins

%{_libdir}/%{pkgname}/plugins/*.so

%dir %{_localstatedir}/lib/%{pkgname}

%dir %{_localstatedir}/log/%{pkgname}

%ghost %dir %{_localstatedir}/lock/%{pkgname}

%{_mandir}/man1/*

%{_mandir}/man8/*

%files devel

%defattr(-,root,root,-)

%doc LICENSE EXCEPTION LICENSE.GPLv2 README.devel

%{_includedir}/%{pkgname}

%{_libdir}/%{pkgname}/libslapd.so

%{_libdir}/pkgconfig/*

%files libs

%defattr(-,root,root,-)

%doc LICENSE EXCEPTION LICENSE.GPLv2 README.devel

%dir %{_libdir}/%{pkgname}

%{_libdir}/%{pkgname}/libslapd.so.*

%{_libdir}/%{pkgname}/libns-dshttpd.so*

%changelog

* Thu Sep 24 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-23

- release 1.3.3.1-23

- Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)

* Fri Sep 11 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-22

- release 1.3.3.1-22

- Resolves: bug 1262363 - In MMR, double free coould occur under some special condition (DS 48226)

* Tue Sep  8 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-21

- release 1.3.3.1-21

- Resolves: bug 1258318 - Deadlock with retrochangelog, memberof plugin (DS 47931)

- Resolves: bug 1259466 - Enhance ACIs to have more control over MODRDN operations (DS 47553)

- Resolves: bug 1259999 - Some filters in RHDS10 are not working fine. (DS 48265)

- Resolves: bug 1260000 - handling of "No original_tombstone for changenumber" errors (DS 47912)

- Resolves: bug 1260001 - cleanallruv should completely clean changelog (DS 48208)

* Thu Jul 16 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-20

- release 1.3.3.1-20

- Resolves: bug 1243718 - Winsync fails when AD users have multiple spaces (two)inside the value of the rdn attribute (DS 48223)

* Mon Jul  6 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-19

- release 1.3.3.1-19

- Resolves: bug 1230037 - async simple paged results issue (DS 48192)

* Tue Jun 16 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-18

- release 1.3.3.1-18

- Resolves: bug 1232100 - CVE-2015-3230 389-ds-base: nsSSL3Ciphers preference not enforced server side (DS 48194)

* Wed Jun 10 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-17

- release 1.3.3.1-17

- Resolves: bug 1230038 - idm/ipa 389-ds-base entry cache converges to 500 KB in dblayer_is_cachesize_sane (DS 48190)

- Resolves: bug 1230037 - async simple paged results issue (DS 48146, DS 48192)

* Tue Apr 21 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-16

- release 1.3.3.1-16

- Resolves: bug 1212894 - CVE-2015-1854 389ds-base: access control bypass with modrdn

* Mon Feb 23 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-15

- release 1.3.3.1-15

- Setting correct build tag 'rhel-7.1-z-candidate'

* Mon Feb 23 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-14

- release 1.3.3.1-14

- Resolves: bug 1189154 - DNS errors after IPA upgrade due to broken ReplSync (DS 48030)

            Fixes spec file to make sure all the server instances are stopped before upgrade

- Resolves: bug 1186548 - ns-slapd crash in shutdown phase (DS 48005)

* Sun Jan 25 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-13

- release 1.3.3.1-13

- Resolves: bug 1183655 - Fixed Covscan FORWARD_NULL defects (DS 47988)

* Sun Jan 25 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-12

- release 1.3.3.1-12

- Resolves: bug 1182477 - Windows Sync accidentally cleared raw_entry (DS 47989)

- Resolves: bug 1180325 - upgrade script fails if /etc and /var are on different file systems (DS 47991 )

- Resolves: bug 1183655 - Schema learning mechanism, in replication, unable to extend an existing definition (DS 47988)

* Mon Jan  5 2015 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-11

- release 1.3.3.1-11

- Resolves: bug 1080186 - During delete operation do not refresh cache entry if it is a tombstone (DS 47750)

* Wed Dec 17 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-10

- release 1.3.3.1-10

- Resolves: bug 1172731 - CVE-2014-8112 password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off 

- Resolves: bug 1166265 - DS hangs during online total update (DS 47942)

- Resolves: bug 1168151 - CVE-2014-8105 information disclosure through 'cn=changelog' subtree

- Resolves: bug 1044170 - Allow memberOf suffixes to be configurable (DS 47526)

- Resolves: bug 1171356 - Bind DN tracking unable to write to internalModifiersName without special permissions (DS 47950)

- Resolves: bug 1153737 - logconv.pl -- support parsing/showing/reporting different protocol versions (DS 47949)

- Resolves: bug 1171355 - start dirsrv after chrony on RHEL7 and Fedora (DS 47947)

- Resolves: bug 1170707 - cos_cache_build_definition_list does not stop during server shutdown (DS 47967)

- Resolves: bug 1170708 - COS memory leak when rebuilding the cache (DS - Ticket 47969)

- Resolves: bug 1170709 - Account lockout attributes incorrectly updated after failed SASL Bind (DS 47970)

- Resolves: bug 1166260 - cookie_change_info returns random negative number if there was no change in a tree (DS 47960)

- Resolves: bug 1012991 - Error log levels not displayed correctly (DS 47636)

- Resolves: bug 1108881 - rsearch filter error on any search filter (DS 47722)

- Resolves: bug 994690  - Allow dynamically adding/enabling/disabling/removing plugins without requiring a server restart (DS 47451)

- Resolves: bug 1162997 - Running a plugin task can crash the server (DS 47451)

- Resolves: bug 1166252 - RHEL7.1 ns-slapd segfault when ipa-replica-install restarts (DS 47451)

- Resolves: bug 1172597 - Crash if setting invalid plugin config area for MemberOf Plugin (DS 47525)

- Resolves: bug 1139882 - coverity defects found in 1.3.3.x (DS 47965)

* Thu Nov 13 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-9

- release 1.3.3.1-9

- Resolves: bug 1153737 - Disable SSL v3, by default. (DS 47928)

- Resolves: bug 1163461 - Should not check aci syntax when deleting an aci (DS 47953)

* Mon Nov 10 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-8

- release 1.3.3.1-8

- Resolves: bug 1156607 - Crash in entry_add_present_values_wsi_multi_valued (DS 47937)

- Resolves: bug 1153737 - Disable SSL v3, by default (DS 47928, DS 47945, DS 47948)

- Resolves: bug 1158804 - Malformed cookie for LDAP Sync makes DS crash (DS 47939)

* Thu Oct 23 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-7

- release 1.3.3.1-7

- Resolves: bug 1153737 - Disable SSL v3, by default (DS 47928)

* Fri Oct 10 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-6

- release 1.3.3.1-6

- Resolves: bug 1151287 - dynamically added macro aci is not evaluated on the fly (DS 47922)

- Resolves: bug 1080186 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten (DS 47897)

- Resolves: bug 1150694 - Encoding of SearchResultEntry is missing tag (DS 47920)

- Resolves: bug 1150695 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails. (DS 47919)

- Resolves: bug 1139882 - Fix remaining compiler warnings (DS 47892)

- Resolves: bug 1150206 - result of dna_dn_is_shared_config is incorrectly used (DS 47918)

* Wed Oct  1 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-5

- release 1.3.3.1-5

- Resolves: bug 1139882 - coverity defects found in 1.3.3.x (DS 47892)

* Wed Oct  1 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-4

- release 1.3.3.1-4

- Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing  (DS 47750)

- Resolves: bug 1145846 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server (DS 47908)

- Resolves: bug 1117979 - harden the list of ciphers available by default (phase 2) (DS 47838)

                        - provide enabled ciphers as search result (DS 47880)

* Fri Sep 12 2014 Rich Megginson <nhosoi@redhat.com> - 1.3.3.1-3

- release 1.3.3.1-3

- Resolves: bug 1139882 - coverity defects found in 1.3.3.1

* Thu Sep 11 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-2

- release 1.3.3.1-2

- Resolves: bug 1079099 - Simultaneous adding a user and binding as the user could fail in the password policy check (DS 47748)

- Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing (DS 47834)

- Resolves: bug 1139882 - coverity defects found in 1.3.3.1 (DS 47890)

- Resolves: bug 1112702 - Broken dereference control with the FreeIPA 4.0 ACIs (DS 47885 - deref plugin should not return references with noc access rights)

- Resolves: bug 1117979 - harden the list of ciphers available by default (DS 47838, DS 47895)

- Resolves: bug 1080186 - Creating a glue fails if one above level is a conflict or missing (DS 47889 - DS crashed during ipa-server-install on test_ava_filter)

* Fri Sep  5 2014 Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-1

- release 1.3.3.1-1

- Resolves: bug 746646 - RFE: easy way to configure which users and groups to sync with winsync

- Resolves: bug 881372 - nsDS5BeginReplicaRefresh attribute accepts any value and it doesn't throw any error when server restarts.

- Resolves: bug 920597 - Possible to add invalid ACI value

- Resolves: bug 921162 - Possible to add nonexistent target to ACI

- Resolves: bug 923799 - if nsslapd-cachememsize set to the number larger than the RAM available, should result in proper error message.

- Resolves: bug 924937 - Attribute "dsOnlyMemberUid" not allowed when syncing nested posix groups from AD with posixWinsync

- Resolves: bug 951754 - Self entry access ACI not working properly

- Resolves: bug 952517 - Dirsrv instance failed to start with Segmentation fault (core dump) after modifying 7-bit check plugin

- Resolves: bug 952682 - nsslapd-db-transaction-batch-val turns to -1

- Resolves: bug 966443 - Plugin library path validation

- Resolves: bug 975176 - Non-directory manager can change the individual userPassword's storage scheme

- Resolves: bug 979465 - IPA replica's - "SASL encrypted packet length exceeds maximum allowed limit"

- Resolves: bug 982597 - Some attributes in cn=config should not be multivalued

- Resolves: bug 987009 - 389-ds-base - shebang with /usr/bin/env

- Resolves: bug 994690 - RFE: Allow dynamically adding/enabling/disabling/removing plugins without requiring a server restart

- Resolves: bug 1012991 - errorlog-level 16384 is listed as 0 in cn=config

- Resolves: bug 1013736 - Enabling/Disabling DNA plug-in throws "ldap_modify: Server Unwilling to Perform (53)" error

- Resolves: bug 1014380 - setup-ds.pl doesn't lookup the "root" group correctly

- Resolves: bug 1020459 - rsa_null_sha should not be enabled by default

- Resolves: bug 1024541 - start dirsrv after ntpd

- Resolves: bug 1029959 - Managed Entries betxnpreoperation - transaction not aborted upon failure to create managed entry

- Resolves: bug 1031216 - add dbmon.sh

- Resolves: bug 1044133 - Indexed search with filter containing '&' and "!" with attribute subtypes gives wrong result

- Resolves: bug 1044134 - should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default

- Resolves: bug 1044135 - make connection buffer size adjustable

- Resolves: bug 1044137 - posix winsync should support ADD user/group entries from DS to AD

- Resolves: bug 1044138 - mep_pre_op: Unable to fetch origin entry

- Resolves: bug 1044139 - [RFE] Support RFC 4527 Read Entry Controls

- Resolves: bug 1044140 - Allow search to look up 'in memory RUV'

- Resolves: bug 1044141 - MMR stress test with dna enabled causes a deadlock

- Resolves: bug 1044142 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist

- Resolves: bug 1044143 - modrdn + NSMMReplicationPlugin - Consumer failed to replay change

- Resolves: bug 1044144 - resurrected entry is not correctly indexed

- Resolves: bug 1044146 - Add a warning message when a connection hits the max number of threads

- Resolves: bug 1044147 - 7-bit check plugin does not work for userpassword attribute

- Resolves: bug 1044148 - The backend name provided to bak2db is not validated

- Resolves: bug 1044149 - Winsync should support range retrieval

- Resolves: bug 1044150 - 7-bit checking is not necessary for userPassword

- Resolves: bug 1044151 - With SeLinux, ports can be labelled per range. setup-ds.pl or setup-ds-admin.pl fail to detect already ranged labelled ports

- Resolves: bug 1044152 - ChainOnUpdate: "cn=directory manager" can modify userRoot on consumer without changes being chained or replicated. Directory integrity compromised.

- Resolves: bug 1044153 - mods optimizer

- Resolves: bug 1044154 - multi master replication allows schema violation

- Resolves: bug 1044156 - DS crashes with some 7-bit check plugin configurations

- Resolves: bug 1044157 - Some updates of "passwordgraceusertime" are useless when updating "userpassword"

- Resolves: bug 1044159 - [RFE] Support 'Content Synchronization Operation' (SyncRepl) - RFC 4533

- Resolves: bug 1044160 - remove-ds.pl should remove /var/lock/dirsrv

- Resolves: bug 1044162 - enhance retro changelog

- Resolves: bug 1044163 - updates to ruv entry are written to retro changelog

- Resolves: bug 1044164 - Password administrators should be able to violate password policy

- Resolves: bug 1044168 - Schema replication between DS versions may overwrite newer base schema

- Resolves: bug 1044169 - ACIs do not allow attribute subtypes in targetattr keyword

- Resolves: bug 1044170 - Allow memberOf suffixes to be configurable

- Resolves: bug 1044171 - Allow referential integrity suffixes to be configurable

- Resolves: bug 1044172 - Plugin library path validation prevents intentional loading of out-of-tree modules

- Resolves: bug 1044173 - make referential integrity configuration more flexible

- Resolves: bug 1044177 - allow configuring changelog trim interval

- Resolves: bug 1044179 - objectclass may, must lists skip rest of objectclass once first is found in sup

- Resolves: bug 1044180 - memberOf on a user is converted to lowercase

- Resolves: bug 1044181 - report unindexed internal searches

- Resolves: bug 1044183 - With 1.3.04 and subtree-renaming OFF, when a user is deleted after restarting the server, the same entry can't be added

- Resolves: bug 1044185 - dbscan on entryrdn should show all matching values

- Resolves: bug 1044187 - logconv.pl - RFE - add on option for a minimum etime for unindexed search stats

- Resolves: bug 1044188 - Recognize compressed log files

- Resolves: bug 1044191 - support TLSv1.1 and TLSv1.2, if supported by NSS

- Resolves: bug 1044193 - default nsslapd-sasl-max-buffer-size should be 2MB

- Resolves: bug 1044194 - Complex filter in a search request doen't work as expected.

- Resolves: bug 1044196 - Automember plug-in should treat MODRDN operations as ADD operations

- Resolves: bug 1044198 - Replication of the schema may overwrite consumer 'attributetypes' even if consumer definition is a superset

- Resolves: bug 1044202 - db2bak.pl issue when specifying non-default directory

- Resolves: bug 1044203 - Allow referint plugin to use an alternate config area

- Resolves: bug 1044205 - Allow memberOf to use an alternate config area

- Resolves: bug 1044210 - idl switch does not work

- Resolves: bug 1044211 - make old-idl tunable

- Resolves: bug 1044212 - IDL-style can become mismatched during partial restoration

- Resolves: bug 1044213 - backend performance - introduce optimization levels

- Resolves: bug 1044215 - using transaction batchval violates durability

- Resolves: bug 1044216 - examine replication code to reduce amount of stored state information

- Resolves: bug 1048980 - 7-bit check plugin not checking MODRDN operation

- Resolves: bug 1049030 - Windows Sync group issues

- Resolves: bug 1052751 - Page control does not work if effective rights control is specified

- Resolves: bug 1052754 - Allow nsDS5ReplicaBindDN to be a group DN

- Resolves: bug 1057803 - logconv errors when search has invalid bind dn

- Resolves: bug 1060032 - [RFE] Update lastLoginTime also in Account Policy plugin if account lockout is based on passwordExpirationTime.

- Resolves: bug 1061060 - betxn: retro changelog broken after cancelled transaction

- Resolves: bug 1061572 - improve dbgen rdn generation, output and man page.