…ests.

Change-Id: I345ecb97906ab3fa3d01d2691c2a00117684f0e5

Change-Id: I3119129d84a33523b1faf96e7247574ffed4b834

This change allows the orgunit for a computer account to be
specified in DN format, for example:
     OU=project,OU=tenant,OU=node
Note that this a partial DN within the OU=Computers container.

Change-Id: If99cc186794e6d8dbfb3a283c14cf0919073b722

…PR 1817458)

Change-Id: If5ac4c277a258cde8208a130a49d8a57791bd360

Change-Id: Ie76ef5e11505a6b83853a1cce7b83073a0bfcc32

Change-Id: I12ef38f81d69733d69edaff4b41891ec7cc6149e

Change-Id: I8cf44c71de464e209ed09ac662b580f58615bfee

Change-Id: I59ba09a5cbe74f9f138b3dba60cde4afed0e6ff1

Change-Id: Ia39bb2abd5faeb4413b5c2ed063bc367d895a771

Change-Id: Ibc05b7584bc3aeaa8fa20a63d0374aced2ff393c

Change-Id: I6d0e046885c6ae3fe84fc6a5ff9f6006e3026b61

sample curl REST API test output - https://bugzilla.eng.vmware.com/show_bug.cgi?id=1883274#c1

Change-Id: I1b6d546cb0b2a5148273d9fd56ad8d58b99acca8

Change-Id: If34a0dc048a7871156503f1d05289084a4be12aa

Change-Id: I9c27aa66db59eb7bd9ca974c6ceb86a136c60e3b

Change-Id: I6a706e9e88ddb48e0cd1042f66af77fdeb62a7ff

Change-Id: Ib446baf2cb45e15227c5fb52ec905fc775132e3a

Change-Id: Ie98913985bb3aeafd615385af33c633fc1888ef5

Change-Id: I2f9ab9ab97859acb4442e2d1af8760309b9cbe4c

Change-Id: Ib5eafa8cc65a21298cc475ace2ab1c0e478b1b30

…rd is running (PR 1881585)

Change-Id: If10001060650eecdce06b2447fa8201daaeffb73

…ird is running (PR 1881585)

Change-Id: I8184cff3d4985d6c14d7ac6f87e75c9f00efdbd7

Change-Id: Ia4307efaa123b282522e5e6d27997395c5ab27ae

Change-Id: I82860039929cfa01d872d3ffc8bd88692dc71b20

…rtAvailability + add tcp_close in cleanup

Change-Id: I8b9eb1a69a80ab4796ceefa46b27b0b195eebfed

Change-Id: I4fd968a1a213b73f34525a0f0bef0d3cac2beba8

This change fixes the top-level photon OS build.  The directory
vmidentity/ssoclients is now built prior to lwraft and vmdir projects
to satisfy library dependencies when REST is enabled.

Change-Id: I3214901cc1e20596cd539de775ad89f3bf96c58b

Change-Id: I7ac528417fdcc1367db82eb75d3a812eb4b7cfb7

…ing m4 files

Change-Id: I4e0e65e67a259684001f4ec73350279139f2ed59

…tion tests

Change-Id: I6cfb9c92ec7cc84969dccc9b7fa973d6803246d4

root@lw-t3 [ /home/admin/workspaces/LW-5 ]# /opt/vmware/bin/lwraft-cli help
Usage: lwraft-cli { arguments }

Arguments:

	node list    --server-name      <host name>

	node state   --server-name      <host name>
	             --login            <user@domain>
	             --password         <password>

	node promote --password         <password>
	            [--host-name        <host name> preferred Lightwave Raft host name, can be FQDN or IP]
	            [--domain-name      <domain name> | --partner-name    <host of partner> ]

	node demote  --server-name      <host name>
	             --login            <user@domain>
	             --password         <password>
	             --demote-host-name <host to demote>]

	help

* Promote can specify any node in the cluster as partner. It will find the leader and does the join eventually.
* also, retire lwraftleavefed.
* will retire lwraftpromo later after.

* address comments from Kyoung

Change-Id: I9d0b62e24811b40946251da2a3204ab5fa972ac1

Change-Id: I85df8c4704b66d1eba9e818dacef52d72d01f208

* Contentrule should use Modify OP

* Fix file parsing error to pick up last defintion correctly.
  We use to skip last def is there is no extra empty line at the end

Change-Id: I8943020ef22dafe1fb029c9c8a9091d29b2c2ee6

Change-Id: Id3d0cbee385ef633e8257da704c711d6367809cd

Solve for infra node only SRP deadlock which lwraft uncovered.
Pending: more general solution to solve all SRP traffic (MxN).
Reverting accidental change to --enable-raft in spec file.
dev branch vs master

Address lopstad and sruo review comments.

Fix SRP memory leaks found with valgrind.

Address brownj review comments.

Change-Id: Ie3c00777b240938947ba5eebecf0f295e76398d5

…onseGetError

Change-Id: Id17b593d5e89cabd106045df70bb94dbfdf17565

Change-Id: Ie69b3bc2079324613aa32678431975941cf42e69

Change-Id: I66332ec1db7c254c4ece565e9ac29bd6ba58927e

1884128 don't block client when the leader cannot commit when quorum cannot be reached
 instead, set to leader to follower role to avoid reusing log index/term.
PR 1862068 add a reg-key (RaftQuorumOverride) to override Raft consensus requirement to
 be able to commit transaction locally.

Change-Id: Ia4ddefbbfbc8ef46db036079a76da0259f7a98df

Change-Id: Ib0a8eda3001f004cac5c4e43a01a88d2fe15a933

…mdns-cli list-zone' before promoting the instance

Change-Id: I22f413afe60f69724e7ae022843fc51659235cee

Change-Id: I9e68595c519752e0bdfc1ee25106d1b857e7c56c

Change-Id: I0fea782226fb70019eac19b5627b5450115826e1

Installing vmware-sts emits the below error:
  lwregshell (error = 40709 - LWREG_ERROR_KEYNAME_EXIST)
Creation of the desired subkey path tries to create all imtermediate
subkeys, one of which already exists. This change fixes this issue.

Applied same change to lightwave.spec file, as per brownj comment.

Change-Id: I61a8a1acd9fb1184fb74c33a5e376c5e53385615

Change-Id: I3f0e99ad67170b686ba52e389a1f093d1d9cad63

Change-Id: Iedd67c18ccfc8c2cbd2c45cef9f629658822529f

…er use caes

Change-Id: I0b8e63fa50c5a7594d3bbc58f1b4599ec46f2a0d

Change-Id: Ifaa4a34ac9795f87cda133490ac6ebfc18d4621b

Current vmdir has 65k multi-value attibute limit.
It also not tuned to handle big size group membership.

Here is no use case in Lightwave to maintain a group for all computers.
Hence disable its usage.

Change-Id: I6179cf3b878601cebe73cb293c1f281d7104bcc0

Change-Id: Ic7eaecd75d9eda8287062cd3890dd4af754c4f70

Change-Id: I9706ad61cd1685dfe0b0d3edcae53a51b926c003

…rsing audience claim which might be a single string or an array of strings.

Change-Id: I575b0a540aa30f79f52f1a0591798909b2511551

Change-Id: I054bf809ce3ebde32dec780d975ac85e0bea1b2f

Do not register a service's RPC interfaces with dcerpcd.
All lightwave services use well-known ports. dcerpcd
is a portmapper, i.e. return the IP:[port] for an
RPC interface specification. Because of firewall rules
it is not possible to use ephemerial RPC ports, so no
component queries dcerpcd for a service for an RPC
interface. Since one deployment environment has revealed a
latent bug in either dcerpcd or libdcerpcd.so, don't register
with dcerpcd.

Comment out calls to VmXXXRpcEpRegister as well from server.c,
as per brownj comment.

Change-Id: Ibdf77eb65123afe11c0c19b525f7a3da25374ce1

Change-Id: I6a72c35e1f48ac27f493df8b8cedb2fe075b9a42

Change-Id: I77f94ac2bae737c572146fefe6dcc762cfe79f33

…returned by server.

if server returns error response (which contains error and error_description), we should parse that and translate the error code into the corresponding SSOERRROR.
we will not propagate error_description string as that would require an extra out parameter (similar to AcquireTokens API's).

Change-Id: Ib4316e423ba5f804d18ebdbb3ace65a64de4f942

Change-Id: Ia99c36cc1fcbbe29bbec2cb34fe0abdbc395a7ec

Change-Id: I6c6e2fa41478973e2c6bedffa2769f042fdd1aac

Change-Id: Ibc983c33df4b1b23e2f0e2a3db34d0fa1303b164

Change-Id: I31010a83129c7696d8b8991daa22c3cd1dbe4f72

This change adds a new REST api to query metrics data in json
format.  Initially it returns the existing LDAP operation
statistics. This will be further enhanced to provide many
other types of metrics data.  Also made a few changes to
fix build failures when compiling with the -g debug flag.

Change-Id: I12c3155440bf474b33f907dff4f225906257bdc0

Change-Id: Ic02f0cb130d42e9314fab8a3a341c9fb2f94af3b

…files correctly (PR 1903809)

Change-Id: Ic1f4e20e082cf7ae267941221e7e8461b4b45b40

… files correctly (PR 1903809)

Change-Id: I6ac801fcd218435e4acdd870c7814d534aede791

Change-Id: I3a2a167c97e4d704b34c174640570b21719ee6f1

Change-Id: If7cf5837e515dfe8b6bf6d26b771f2a046c44fc8

Change-Id: Icc6ea534b04d561a9695db9086990a840a592ace

JSON output format is changed to a more structured format.
Also, created a new function to get total time and
display it in json output instead of the average time.

Change-Id: Id62709a612f9fb5912b48d07eedc8bf984e72156

Before, the domain name used to build LDAP DNs was hardcoded as
vsphere.local.  In the case where the domain is not that, LDAP commands
would fail due to an incorrect DN.  These failing LDAP commands caused
the VmDnsCacheRefreshThread to fail and exit immediately after the first
run.  After this failure, VmDnsCacheRefreshThread would not be running
and the cache will not be synchronized with the directory.

This fix obtains the domain name from the directory when building LDAP
DNs and eliminates hardcoded domain names in LDAP DNs.  Having correct
DNs when making  LDAP commands prevents the VmDnsCacheRefreshThread from
failing.  Now, since VmDnsCacheRefreshThread does not fail and continuously
runs, the cache is synchronized with the directory every 5 seconds.

This addresses bug [1818509](https://bugzilla.eng.vmware.com/show_bug.cgi?id=1818509).

Changes made:
  - Removed hardcoded domain names from LDAP DNs in defines.h
  - Provided new function to assist in building LDAP DNs
  - Provided new function to build LDAP DNs to access Deleted Objects
  - Updated functions that relied on hardcoded DNs to use new functions

Test plan:
  - Created two domain controllers (dc01 and dc02) where dc02 was
partner of dc01
  - Added an A record to dc01 and saw it appear in dc02's cache
  - Updated the record by deleting and then adding it with a modified IP
  - Ran list-record and query-record to see if the updated A record
appeared
    + It did appear, but only after 5 seconds (the time interval for
VmDnsCacheRefreshThread)
  - Created a zone on dc01 and then waited to see if it appeared on dc02
    + It did appear, but only after 5 seconds (the time interval for
VmDnsCacheRefreshThread)

Change-Id: Ic74545ff7f8f29c5f4addbcd6498e26472a237ea

…(PR 1905019)

- Based on https://reviewboard.eng.vmware.com/r/1154088/
- Grant authenticated users permission to read CA container

Change-Id: If04f19778a4a1617bbedbab08430fafbc75a9518

It introduces a no-op for leader change, as the paper proposed in section 8.
This eliminate depending on Raft Ping to replicate logs in older terms for new leader.
It also removed backend call that explicitly persists a new term.
When server restarts, the lasted term observed by the server can be obtained from the last raft log.
It fixes a few potential race conditions between the update threads and RPC handling procedures.
This amend adds a timeout on ldap client who makes anonymous bind for getting a server's Raft state,
otherwise the the search for DSE root would get blocked when the host (VM) is down.
Update the LwRaft paper for documentation.
Additional change on mdb.c fixes PR 1905356, lwraft crash in AWS deployment K8S cluster

Change-Id: Ic7bf2d4f98923a225f7bd64a90f7e03ae71388cf

Faced the above mentioned issue while configuring the rest end point for
vmdns.
Changes made:
- Modified the function names in the vmsock library to resolve the name
  conflict with functions in c-rest-engine

Change-Id: I132749f1db62450eb60194f3bac4d183d6b2601f

Change-Id: Ibfeccef7a6cb6abb67200834e66a49818b8a033d

configurable via registry key, e.g. to use default LDAP protocol ports, have following keys.
[\services\lwraft\parameters\]
+  "LdapPort"                    REG_DWORD       0x00000185 (389)
+  "LdapsPort"                   REG_DWORD       0x0000027c (636)

Change-Id: I22bf2a62f36bbe036d936960235bbb031b24cc00

Change-Id: Ifc20b5c7d03f85c5967003e75828badf8eb9df05

The photon RPM packaging did not have the correct package
dependencies. This change makes "make package" work, and
is somewhat more portable because it uses pkgconfig in the
RPM spec file where possible.  Also do not clean the
stage directory after building RPMS.
PR#1913517

Change-Id: Id2fb0589c40de288049eda7cc3295123208e9514

- Based on vmdir change (http://code.pslabs.eng.vmware.com:8082/#/c/782/)
- Lwraft doesn't use this new SID during initialization yet

Change-Id: Ib59d0d5f6c7f166a2275e70e5addaadb6a03cacd

I accidently remove REST PORT default value in prior checkin. Put it back.

Change-Id: Ib8443201d38c396178be94c1798128d4d7ebda79

Added user capability to create a reverse zone and add,query and
delete records from the same. Previous implementation did not allow
the user to create a reverse zone.

Default reverse zones in-addr.arpa and ip6.arpa are created at
initialization.

Tested the code for adding, querying and deleting PTR records for ip4
and ip6 in both the default reverse zones and user-created reverse
zones. The tests were successful on both RPC port as well as DNS port
(port 53) verified through cli commands and tools like nslookup, dig
respectively.

Unit testing was done for the code by adding, querying and deleting a
PTR record. The file is included in the test directory in vmdns as TestPtr.c

The scripts under vmdns/test/scripts have been included for testing and
debugging purposes. They include both positive as well as negative tests
for the user to gain an understanding of reverse zones and their lookups

Change-Id: Id0be8f06e6e5cdda6a2c34fc6b6f284e2a8ebdcf

Before, the VMDNS init process set the service state to READY when the
cache was able to load initial zone data from the directory.  The point
where the state was set caused some timing conflicts with other services
that relied upon VMDNS to be ready.  Also, the VMDNS cache refresh
thread was not that reslient - it would exit if a function call resulted
in an error.  When the cache refresh thread died, the cache would cease
to synchronize causing it to have improper data unless a manual refresh
was done.

This change updates the VMDNS init process such that the initialization
function waits until the VMDNS state is set to READY before finishing.
It will repeatedly, there is a timeout of five attempts,  signal the
cache refresh thread so it can attempt to propogate initial data and
set the VMDNS state to ready.

This change also prevents the cache refresh thread from bailing when a
function call fails.  Instead, all errors are logged and the cache
refresh thread tries again to synchronize data.  The only instance that
the cache refresh thread can fail is when the timed wait fails.

Changes made:

  - Replaced all, but one, BAILs from VmDnsCacheRefreshThread with error logging
statements
  - Added a loop and a condition signal to VmDnsSrvInitDomain to run
VmDnsCacheRefreshThread to propogate initial data from the directory and
set the VMDNS state to READY
  - Removed hacky solution to circumvent this issue in VMAFD DNS Init
sequence

Test plan:

  - With changes from
(781)[http://code.pslabs.eng.vmware.com:8082/#/c/781/], VMAFD was not
able to initialize reverse DNS zones due to a timing mismatch bewteen
VMAFD's thread and the VMDNS cache thread setting the service state to
READY
    + Adding this change mitigates the failure and VMAFD is able to
initialize reverse DNS zones
  - Before, cache refresh thread would exit if the server state was not
ready and its function calls would fail
    + Adding this change does not cause the cache refresh thread to
exit, instead, it logs errors and retries

Change-Id: I4e949685264133d5329611c894aab8c4e76d6a40

This change removes the folder pscsetup and also the invocation of the 
related files from configure-lightwave-server

Testing Done:  Deployed lightwave and made sure that configure-lightwave-server works as expected.
               The BVTs also passed

Reviewed by:   Suresh Chellappan, Balaji, Lars Opstad, Wei Fu
Approved by:   Suresh Chellappan
Documentation: None. 

Change-Id: I659843a9d720392f6e10f5a84108115469233813

Bugs Addressed in this commit:
https://bugzilla.eng.vmware.com/show_bug.cgi?id=1909816
Reviewed by: Suresh Chellappan, Wei Fu, Abhiram
Approved by: Suresh Chellappan
Tests done : Basic deploy and test the heartbeat table

Change-Id: Ibe7a39e9c2e0d669a3c56a7655e37e12d5bb0693

Before, when a PSC was demoted, its DNS entries were _not_ removed from
the directory.  Demotion seemed to have worked successfully, but it did
not.  When VMAFD called the VMDNS API to unconfigure the VMDNS service, it
supplied an improperly formatted domain name and server name.  These
names were used to build queries to find and delete the proper DNS
record corresponding to the demoting PSC.  Since they were improperly
formatted, the queries failed, the PSC's records were not found, and
VMDNS was not cleaned up properly.

This change assures that the PSC's server name and domain name are in
the correct format that VMDNS requires - FQDN format.  This change also
cleans up the VMAFD DNS interface a little to make (un)configuring VMDNS
during (pro/de)motion uniform.

This resolves bug
(1831273)[https://bugzilla.eng.vmware.com/show_bug.cgi?id=1831273].

Changes made:

  - Ensure VMAFD converts domain and server name to FQDN form before
calling VMDNS APIs
  - Cleanup and consolidate VMAFD DNS interface to make API calls
consistent

Test plan:

  - Promoted DC01 in standalone mode
  - Listed DNS records to verify DC01's records
  - Demoted DC01
  - Checked logs and DNS records to verify no errors and that DC01's
records are no longer present
  - Promoted DC01
  - Promoted DC02 in partner mode
  - Listed DNS records to verify DC01 and DC02's records are present
  - Demoted DC02
  - Checked logs and DNS records in DC02 and DC01 that to verify no
errors and that DC02's DNS records are not present in either

Change-Id: If486c9a3aaf357212942ebc2b9c63cbca276625a

unnecessary heartbeat entries from VMAFD

Change-Id: If0e55f31d93808850659dac8e58d87be513495e9

Why this change is needed:
   Rest end point to collect metrics from vmdns to send it to the wavefront.
Changes made :
 - Added rest-head library and statically linked to vmdnsd.
 - Rest head specification includes only the GET method without the support for parameters.
 - Added opstatic.c inside vmdns/server/common/ to get/update the counter values
   for the vmdns metrics.
 - The following metrics have been addressed
   -dns_query_count
   -forwarder_query_count
Comments :
 - Rest end point uses port 7677

Change-Id: I556a7630f627868900970f9eb89ae715839e9fb4

name of the daemon: postd
name of the service: post

name of the RPM:
    vmware-post-1.3.0-3.x86_64.rpm
    vmware-post-client-1.3.0-3.x86_64.rpm
    vmware-post-client-devel-1.3.0-3.x86_64.rpm
    vmware-post-debuginfo-1.3.0-3.x86_64.rpm

name of the meta RPM:
    vmware-objectstore-1.3.0-3.x86_64.rpm

LWIS registry service name: post

Tools name prefix - post:
    post-cli,postschema,postadmintool,..etc.

Correct IDL file naming

Change-Id: I116124e7a25001682bd82baf202fc74987bd4c22

Change-Id: I6b760b3afb1a7c6f59d6ac31c5035238c673900e

Implemented the CNAME resolution for A and AAAA queries. In the previous
implementation, queries like A and AAAA made for a name containing only
a CNAME record resulted in error.

In this implementation, the problem mentioned above is resolved and
queries are made using the target name of the CNAME record present for
the rr type of the query. Hence multiple levels of indirections through
CNAME can be done before the record matching the type of query can be
obtained. We have currently limited the number of indirections to 5;
this can be changed as per required.

Also added error checks and bails for the condition that CNAME record
should not co-exist with any other record type. The changes are
reflected in VmDnsIsUpdatePermitted function.

Changes made:
- Edited the VmDnsSrvQueryRecords function to handle CNAME records
- Moved the functionality to get a record from the cache or the store to
  another function named VmDnsSrvGetRecords
- Created VmDnsGetLinkedRecords function which handles the queries
  needed to be made for CNAME records
- Modified the VmDnsIsUpdatePermitted function for proper error checks.

Testing:
The testing was done to check if A and AAAA queries for records containing
only the CNAME record were successful. Both of them resulted in success
on RPC as well as DNS ports. Negative tests were also done to make sure
that CNAME record could co-exist with any other record. Testing was also
done to ensure that upto 5 levels of indirections are supported
currently, and the code fails with "ERROR_NOT_SUPPORTED" for higher
number of indirections, thereby keeping a cap on the maximum response
time for a query.

Change-Id: Ibc5e1e51822d8f72ea939e064b0269fb954d6705

Moved the curl_global_init to init stage and added curl_global_cleanup in vmca shutdown logic.

Change-Id: Id72ffc6c8d6e22f2f0816e66c1802d39094424b3

code was commented as part of "change: If9e6683f559a153558681918ec207cbdaccebc8c", VmDir REST head implementation (excluded from build + removed curl dependency)
now since the issue is fixed, enabled OidcClientGlobalInit and OidcClientGlobalCleanup in vmdir.

Testing: starting and stopping multiple times to ensure init and cleanup is not causing any errors.
Changes were approved by Sung Ruo.

Change-Id: I56402dc51405df1a73f3b2640ed8dd35f9e92e4d

Change-Id: Ic6fa25c9db8d246715318842e4f805d06eb3aa4b

before the change
root@lw-t2 [ /home/admin/workspaces/LW-3/lwraft ]# curl --user [email protected]:vmware 'http://lw-t2:7577/v1/post/ldap?dn=cn%3Ddse%20root&scope=base&filter=objectclass%3D*&attrs=vmwRaftLeader,vmwRftMember,vmwRaftFollower'
{
    "result": [
        {
            "dn": "cn=DSE Root",
            "attributes": [
                {
                    "type": "vmwRaftLeader",
                    "value": [
                        "lw-t2"
                    ]
                }
            ]
        }
    ],
    "result_count": 1
}

after the change
root@lw-t2 [ /home/admin/workspaces/LW-3/lwraft ]# curl --user [email protected]:vmware 'http://lw-t1:7577/v1/post/ldap?dn=cn%3Ddse%20root&scope=base&filter=objectclass%3D*&attrs=vmwRaftLeader,vmwRftMember,vmwRaftFollower'
{"result":[{"dn":"cn=DSE Root","attributes":[{"type":"vmwRaftLeader","value":["lw-t1"]}]}],"result_count":1}

Change-Id: I240ae567462ece596c852f7ec0a5fa076e342923

…up before accepting traffic (PR-1901106)

Enabling OidcClientGlobalInit and OidcClientGlobalCleanup during init process, since issues faced with OidcClientGlobalInit (wrapper for curl_global_init) was resolved.

Change-Id: Ieeec9dba3e6f8ef438e265617498f5e3c7bd858d

change "Id72ffc6c8d6e22f2f0816e66c1802d39094424b3" broke the build in ubuntu platform. Oidc client related libraries were included only if rest services are enabled. In Photon REST services are by default enabeld. Fixed it by including OidcClientGlobalInit and OidcClientGlobalCleanup only if REST services are enabled.

Change-Id: I53fac58c4308e2c330ecd17748bc9b0786429b6a

…rityDescriptor that can be applied per domain (PR 1861840, 1905019)

- Generate SID with domain template when building defaultSecurityDesciptor
- Replace the template with authenticated domain SID when creating object SD from defaultSecurityDescriptor
- New defaultSecurityDescriptors for computer, group, and vmwcertificationauthority classes that grant read permission to all authenticated users

Change-Id: Ic8a2d953b5aac7bc9cfb03bcd396c3412852f3f3

Change-Id: I488095e4c595180f2f41ef1914dacfdfb21adc2b

Updated build to accomodate newer versions.

Bumped uaa to 6493af37b

Change-Id: I69d266eabb8641271cd243c394d3e7d3e7b8207d

This change gets the FQDN of the host to configure lightwave
PNID instead of using the result of gethostname() which is
typically just the short name of the host.

PR#1911810

Change-Id: Ie3feff04aa54e832cf3f166516ba316bd9953837