openldap-bugs

openldap-bugs@openldap.org

1 participants
21001 discussions

Re: (ITS#7279) Apparently mdb "approx" index generation failure for mdb_add for syncrepl consumer
by brandon.hume＠dal.ca 24 May '12

24 May '12

On 05/24/12 02:08 PM, Michael Ströder wrote: > Are these the exact logs lines? I'm asking because $DN sounds to me like a > variable name used in a configuration template. Can cou please check that? No, that was me editing the line. Sorry, I should have labeled it as such.

1 0

Re: (ITS#7278) [PATCH] SHA-2: Add support salted SHA-2 password hashes
by michael＠stroeder.com 24 May '12

24 May '12

This is a cryptographically signed message in MIME format. --------------ms080105030301050607030109 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable fumiyas(a)osstech.co.jp wrote: > Full_Name: SATOH Fumiyasu > Version: master > OS:=20 > URL: ftp://ftp.openldap.org/incoming/openldap-2.4.31-sha2-salted-hash.p= atch > Submission from: (NULL) (220.100.28.128) >=20 >=20 > This patch adds support {SSHA256}, {SSHA384} and {SSHA512} hash schemes= > to slapd-sha2 module. >=20 > This patch depends on > ftp://ftp.openldap.org/incoming/openldap-2.4.31-sha2-multithread.patch > (http://www.openldap.org/its/index.cgi?findid=3D7269). I've not tested the patch yet. But I'd appreciate if SHA-2 support would = be available in the main source and not only under contrib/. Any objections against extending libraries/liblutil/passwd.c? Ciao, Michael. --------------ms080105030301050607030109 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIFOzCC BTcwggMfoAMCAQICAwl4kDANBgkqhkiG9w0BAQUFADB5MRAwDgYDVQQKEwdSb290IENBMR4w HAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNBIENlcnQgU2lnbmlu ZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZzAeFw0xMDEx MTcxNTQzMzFaFw0xMjExMTYxNTQzMzFaMD8xGDAWBgNVBAMUD01pY2hhZWwgU3Ry9mRlcjEj MCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDo2SKth5GhtaDrCyfGtyUG+/hAAa/J52L0NFN4SSRvTtdGf9HfWwwd NCtgae0TVGWk2lKDbXA9d5vmyIiRhuwxd90H6FLErhRBeB9G67qtw87E8WUoXt2DwPQEUTWV hqHpPadlmgFw3+i3TGQQTe3O3W9MMMd4GJNhObem2VGRuCD37OXnzBksTcq0FPJgcWAhe3d/ 0ItOkNWBqgq8Mf3p7WFBhaQ0a27BC/mKtH8fI3kPcS305imPRja69Msq3EwUZBc9ToVp6FRQ NYKjfOBybDUzVkmRZl3H8xutQP2w8Zxb8m5f7Q1BfLLrIFScfYvIDgOERxTCd4lab8+/09XH AgMBAAGjggEAMIH9MAwGA1UdEwEB/wQCMAAwVgYJYIZIAYb4QgENBEkWR1RvIGdldCB5b3Vy IG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSBoZWFkIG92ZXIgdG8gaHR0cDovL3d3dy5DQWNl cnQub3JnMEAGA1UdJQQ5MDcGCCsGAQUFBwMEBggrBgEFBQcDAgYKKwYBBAGCNwoDBAYKKwYB BAGCNwoDAwYJYIZIAYb4QgQBMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDov L29jc3AuY2FjZXJ0Lm9yZzAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkq hkiG9w0BAQUFAAOCAgEANPf/aLF41eQlvN5dEg3CFnlN//qQK7+EPIXLnHprNWLb4nBwgdPj /E+qa1umT7px4Py3VS0UTKqLmMdWftwid8MOMHWalZwrfx0Z8U3He+EdJhOSnn9vdd/ug7Xd dI/hRjLaBSq9ZhCczEUgL6vTxCYPlIoHF56y/oxSJw59vRBjvRFKXvpBZWseeRkcGACQduNH SNdWC1IqHAbQlgOS9VWQUYlm//BdaLkezRxqnQp5+KJMAcZzHpdNJ3G4SqCJ02Z3n4kk8IKZ AjgiWxisDFNsfXKDb9Ng5ntnnH2ouxrgPoNnW445tgkz50VKHstylx9s5O3G7uUTtg0J+z63 TA8xbN6kzRx7RgAUkEXhl6WEdW+3EVj5tYY38Uy8vleP+gYZfphKEmQJgIQqy9D2+gesbolT QdWYgbUYY2AHJOshskMW7pahYnFX2pZmn/ayaPc+JFJlCEqO0+DcYQjYuv6sntQgZGkok7yZ R4xMbyCp61pTrfGWOufZs/FiScJZg1IWY5qb4URH4VZZjLNMR2pFMRuE4LvgkkMRasbUv7Yv n3Lzv34lTfJKUqYW6nx//L2NS4rN63o0taPwRygnuBK4kp7EYEcwtLeanJhQoIu4b6If9rwy D7CFAp51wIewV9VtZ1Is0irNBcMVyhJogIcuIn+VWY1ff1RxySD/djMxggOUMIIDkAIBATCB gDB5MRAwDgYDVQQKEwdSb290IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcx IjAgBgNVBAMTGUNBIENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1 cHBvcnRAY2FjZXJ0Lm9yZwIDCXiQMAkGBSsOAwIaBQCgggHoMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEyMDUyNDE4MDEzOFowIwYJKoZIhvcNAQkEMRYE FBBgedro2DSLuBwkyOrjr9ML7MbLMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoG CCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggq hkiG9w0DAgIBKDCBkQYJKwYBBAGCNxAEMYGDMIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAc BgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5n IEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMJeJAwgZMG CyqGSIb3DQEJEAILMYGDoIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6 Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEh MB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMJeJAwDQYJKoZIhvcNAQEBBQAE ggEAV8R0Hvk9iikbkpo4qm7yXeMwCsMbrDGhTWapYclEgt0tOJNJ945Zejk4slxyhECYfRDf 0BSn5GX8RKSzas408ybxgWfCeviPhHZhjB5+akya8OcFmyQ/eoGHFeK0uZNlG2PPs42dNgf9 Zi6P0vrfF/L+Nn9PsurDrKIkV5HOMwbm7tAJdpfkOVsmW1S50Wx18PjgjSs2DujKh8HYq211 BsdE19cU3IfMZPOdVW+GTSZmpJdzr4Zl8H9jtoyNiH4JHoSqI2eXlIQGqP+2x2Koj6F/il0r BXIxhEMN88wcp0QhX2TERg32wqKhLUK2kns2n75NyKEFh1sbo5v+SAQndQAAAAAAAA== --------------ms080105030301050607030109--

1 0

Re: (ITS#7279) Apparently mdb "approx" index generation failure for mdb_add for syncrepl consumer
by michael＠stroeder.com 24 May '12

24 May '12

This is a cryptographically signed message in MIME format. --------------ms060600050204060402060803 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable brandon.hume(a)dal.ca wrote: > May 24 11:50:41 node2 slapd[25282]: null_callback : error code 0x50 > May 24 11:50:41 node2 slapd[25282]: syncrepl_entry: rid=3D001 be_add $D= N failed > (80) Are these the exact logs lines? I'm asking because $DN sounds to me like = a variable name used in a configuration template. Can cou please check that= ? Ciao, Michael. --------------ms060600050204060402060803 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIFOzCC BTcwggMfoAMCAQICAwl4kDANBgkqhkiG9w0BAQUFADB5MRAwDgYDVQQKEwdSb290IENBMR4w HAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNBIENlcnQgU2lnbmlu ZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZzAeFw0xMDEx MTcxNTQzMzFaFw0xMjExMTYxNTQzMzFaMD8xGDAWBgNVBAMUD01pY2hhZWwgU3Ry9mRlcjEj MCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDo2SKth5GhtaDrCyfGtyUG+/hAAa/J52L0NFN4SSRvTtdGf9HfWwwd NCtgae0TVGWk2lKDbXA9d5vmyIiRhuwxd90H6FLErhRBeB9G67qtw87E8WUoXt2DwPQEUTWV hqHpPadlmgFw3+i3TGQQTe3O3W9MMMd4GJNhObem2VGRuCD37OXnzBksTcq0FPJgcWAhe3d/ 0ItOkNWBqgq8Mf3p7WFBhaQ0a27BC/mKtH8fI3kPcS305imPRja69Msq3EwUZBc9ToVp6FRQ NYKjfOBybDUzVkmRZl3H8xutQP2w8Zxb8m5f7Q1BfLLrIFScfYvIDgOERxTCd4lab8+/09XH AgMBAAGjggEAMIH9MAwGA1UdEwEB/wQCMAAwVgYJYIZIAYb4QgENBEkWR1RvIGdldCB5b3Vy IG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSBoZWFkIG92ZXIgdG8gaHR0cDovL3d3dy5DQWNl cnQub3JnMEAGA1UdJQQ5MDcGCCsGAQUFBwMEBggrBgEFBQcDAgYKKwYBBAGCNwoDBAYKKwYB BAGCNwoDAwYJYIZIAYb4QgQBMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDov L29jc3AuY2FjZXJ0Lm9yZzAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkq hkiG9w0BAQUFAAOCAgEANPf/aLF41eQlvN5dEg3CFnlN//qQK7+EPIXLnHprNWLb4nBwgdPj /E+qa1umT7px4Py3VS0UTKqLmMdWftwid8MOMHWalZwrfx0Z8U3He+EdJhOSnn9vdd/ug7Xd dI/hRjLaBSq9ZhCczEUgL6vTxCYPlIoHF56y/oxSJw59vRBjvRFKXvpBZWseeRkcGACQduNH SNdWC1IqHAbQlgOS9VWQUYlm//BdaLkezRxqnQp5+KJMAcZzHpdNJ3G4SqCJ02Z3n4kk8IKZ AjgiWxisDFNsfXKDb9Ng5ntnnH2ouxrgPoNnW445tgkz50VKHstylx9s5O3G7uUTtg0J+z63 TA8xbN6kzRx7RgAUkEXhl6WEdW+3EVj5tYY38Uy8vleP+gYZfphKEmQJgIQqy9D2+gesbolT QdWYgbUYY2AHJOshskMW7pahYnFX2pZmn/ayaPc+JFJlCEqO0+DcYQjYuv6sntQgZGkok7yZ R4xMbyCp61pTrfGWOufZs/FiScJZg1IWY5qb4URH4VZZjLNMR2pFMRuE4LvgkkMRasbUv7Yv n3Lzv34lTfJKUqYW6nx//L2NS4rN63o0taPwRygnuBK4kp7EYEcwtLeanJhQoIu4b6If9rwy D7CFAp51wIewV9VtZ1Is0irNBcMVyhJogIcuIn+VWY1ff1RxySD/djMxggOUMIIDkAIBATCB gDB5MRAwDgYDVQQKEwdSb290IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcx IjAgBgNVBAMTGUNBIENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1 cHBvcnRAY2FjZXJ0Lm9yZwIDCXiQMAkGBSsOAwIaBQCgggHoMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEyMDUyNDE3MDgyNVowIwYJKoZIhvcNAQkEMRYE FAiOlD00zt7MfnmG7hCZfrsEL7koMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoG CCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggq hkiG9w0DAgIBKDCBkQYJKwYBBAGCNxAEMYGDMIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAc BgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5n IEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMJeJAwgZMG CyqGSIb3DQEJEAILMYGDoIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6 Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEh MB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMJeJAwDQYJKoZIhvcNAQEBBQAE ggEAQKcLJh/AADvbF4KTIcbr8XbQ/WRU+LfEJf3+n70z//r4/LIvlyCVT7Wld9rfI/14pmzS UOvfchywdnHEV4n4WCCOsBp0aqJQZUv3CA6n7mAqTHPYvORyjJ+YpNiLZj5u5W1qCXXn1Vwy 1pF+Lorl4t4yY3kC2v7wFHVV2KGaz/EMATMdoCeRSHW8x1gq8KMrblcKr2TzCT0HJkY+5ZJ8 qZRYlC8rjZIToht1dYIK5ZfHvMsLN7nz/ltPM4s5yuu7VGZFNCo3m5MIamZlKvSflK/0cHIQ VolbZgmDoogion7BSeeTp7pHsHuIlKuXLJXCIvnhvnDb8rgUBDEMLM80hgAAAAAAAA== --------------ms060600050204060402060803--

1 0

(ITS#7279) Apparently mdb "approx" index generation failure for mdb_add for syncrepl consumer
by brandon.hume＠dal.ca 24 May '12

24 May '12

Full_Name: Brandon Hume Version: 2.4.31 OS: RHEL EL6.1, kernel 2.6.32-131.12.1.el6.x86_64 URL: http://den.bofh.ca/~hume/mdb_approx_indexfail.tar Submission from: (NULL) (2001:410:a010:2:223:aeff:fe74:400e) An empty syncrepl consumer using mdb backend will suffer index generator failures when populating its database from the provider and using "approx" index options. The failure manifests in syslog (with olcLogLevel=Stats) as the following: May 24 11:50:41 node2 slapd[25282]: null_callback : error code 0x50 May 24 11:50:41 node2 slapd[25282]: syncrepl_entry: rid=001 be_add $DN failed (80) These problems don't seem to occur when populating the provider using slapadd. The problem only seems to manifest when the new entry arrives via syncrepl. Playing with gdb, it seems like indexer() ends up being called with { bv_len = 0, bv_val = "" } when indexing "givenName". Could be because "givenName" on the troublesome entry is only one character? A minimalist DIT and config are provided in the tarfile in the link. The two nodes are running in mirrormode, and I'm not sure if that makes a difference. To reproduce: - On provider: slapadd -b cn=config -l mdb_approx_indexfail_config.ldif - On provider: slapadd -b dc=dal,dc=ca -l mdb_approx_indexfail_dit.ldif - On consumer: slapadd -b cn=config -l mdb_approx_indexfail_config.ldif - Start provider, confirm no errors - Start consumer, null_callback errors should appear immediately.

1 0

(ITS#7278) [PATCH] SHA-2: Add support salted SHA-2 password hashes
by fumiyas＠osstech.co.jp 23 May '12

23 May '12

Full_Name: SATOH Fumiyasu Version: master OS: URL: ftp://ftp.openldap.org/incoming/openldap-2.4.31-sha2-salted-hash.patch Submission from: (NULL) (220.100.28.128) This patch adds support {SSHA256}, {SSHA384} and {SSHA512} hash schemes to slapd-sha2 module. This patch depends on ftp://ftp.openldap.org/incoming/openldap-2.4.31-sha2-multithread.patch (http://www.openldap.org/its/index.cgi?findid=7269).

1 0

Re: (ITS#7277) Slapadd segfaults if binddn contains ou or dc statements
by o.loch＠gmx.net 21 May '12

21 May '12

--Apple-Mail=_E91EDB34-885C-4527-B3A7-0CF927EAA88D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 Hello, thanks for the reply. I followed your advice and played a bit with it = and now it's working. It's interesting that you always have to include the core.schema even if = you use a replicated config. Sorry for the wrong bug report and thanks again! KR, Oliver=20 Am 21.05.2012 um 01:46 schrieb Howard Chu: >> I played with it a bit and as soon as one adds "ou=3D..." or "dc=3D..."= to the >> binddn it raises an error. In this example config and in the "real = world". >>=20 >> Imho there aren't any limitations to the binddn option? >=20 > No, there are no limitations on binddn. Your example is invalid since = you have not loaded any schema to define the "ou" or "dc" attributes. = The error message from slapadd is correct. >=20 > --=20 > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >=20 >=20 --Apple-Mail=_E91EDB34-885C-4527-B3A7-0CF927EAA88D Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINRDCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIHCDCCBfCg AwIBAgIDA6CuMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTIwMTI5MTQ0MTM3WhcNMTMwMTI5MjE0MTE4WjBTMRkwFwYDVQQNExB6N0V1VjY4Q0xvemRSRHkx MRcwFQYDVQQDDA5vLmxvY2hAZ214Lm5ldDEdMBsGCSqGSIb3DQEJARYOby5sb2NoQGdteC5uZXQw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmfq20gcAUPUePSPavAqfHQTuq75yNv9dj TkYkP1kWeohKxHnznc1so0WuaMo1Azt/01Z1zdMZ3m5Ix3Q1UxuVRh+ciRockHJZ36uWWesMLdwh /cdvgEeR+wqfceYuuW4Du8MDh9/+z4NCBJ6kvYQUXKZibthLaLssazBoHmvVDiwvmvDk2bLim+sC ywRelWWFAnlVDGFTsHN9DKe1jXljLDnNwcHRzJroSx01Dh4AhMMkz8ZUQtx3GInhZLjErRCdZ3Oj HDmZ8U2ABo1W7Hccux1U/70y6fOVOrQW7hkv1jPpGp1+713ONg4wc8PiGOHZHnIENBGBKOCGjd70 7zU9AgMBAAGjggOpMIIDpTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEF BQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFBF4b2lWP7cPi3uyf1fhXOfHBuA7MB8GA1UdIwQYMBaA FFNy7ZKc4NrLAVx8fpY1TvLUuFGCMBkGA1UdEQQSMBCBDm8ubG9jaEBnbXgubmV0MIICIQYDVR0g BIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0dHA6Ly93d3cuc3Rh cnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29t L2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENlcnRpZmljYXRp b24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQgYWNjb3JkaW5n IHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBTdGFydENvbSBD QSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3NlIGluIGNvbXBs aWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMIGcBggrBgEFBQcCAjCBjzAn FiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgECGmRMaWFiaWxpdHkgYW5kIHdh cnJhbnRpZXMgYXJlIGxpbWl0ZWQhIFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGltaXRhdGlvbnMi IG9mIHRoZSBTdGFydENvbSBDQSBwb2xpY3kuMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwu c3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGG LWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MxL2NsaWVudC9jYTBCBggrBgEFBQcw AoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMS5jbGllbnQuY2EuY3J0 MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0BAQUFAAOCAQEA aFgkPDQLgfzA2OCcUUaavf3yBb0JX83kkHtqpPJPs8AM7MEHgSwPtvDPfrArLZRVleQ5rE42QDrl UJQ1FBrSaRaGERjihOvbXy3UglGk23zZfpV+tG3FM/K6r3aoOTghqldly/nnXptgUiV+Xc8GVZgZ 3v9M8bqx4ypL4VTxZ9FrIKQ6IoLyuxCFRUutk/UaN9bT4bVjLrlC3E5jltmtdjFPcQOGsZ3B5IeC A8wWWiUrClvj1WJvBvgJ7o48F6mjdJYWZqzAQkQVkA0GmPsEb9YdWEyqygCnb1/oHmPYLzd7GZMS 8Yr0BFbSWB4vFdCI+eQg+xwBLD+bp8s4M+DodTGCA28wggNrAgEBMIGUMIGMMQswCQYDVQQGEwJJ TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVk aWF0ZSBDbGllbnQgQ0ECAwOgrjAJBgUrDgMCGgUAoIIBrzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN AQcBMBwGCSqGSIb3DQEJBTEPFw0xMjA1MjExNzI3MDFaMCMGCSqGSIb3DQEJBDEWBBR7+zXEwhx2 T0J+cWFbzao725HBOjCBpQYJKwYBBAGCNxAEMYGXMIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGll bnQgQ0ECAwOgrjCBpwYLKoZIhvcNAQkQAgsxgZeggZQwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu aW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVu dCBDQQIDA6CuMA0GCSqGSIb3DQEBAQUABIIBACE6nneTvZzl9cCgd7q/2Ee65O3vXs3BzLCeXlCC iS1yOOvo9udFSZlwY8tpSo8fKX6YDHAmRVliE/X+dUOPtIboyYJPIx+pJM66sULMDya194rYd9He VeHA0//o0hTeGBzVBoWto3+qH3fmQKNCrHd1mZOhfVgkWAn0W9K2YayJGV0sFDJaTYQ+2jlgrZHM AC1vhQltCcdOh5qF1X6YaOueFupm86bVo3YKuwY42VxkCAl9fAanwKR61pmXcH0wvACPgjO0d81w oUwhlNJ7aTJ2/yMrAh13qn06nwLMxjjUE1HzYH78zHLLoSZVmo0p49ykzLYVVRQzZVMtBpmMy7UA AAAAAAA= --Apple-Mail=_E91EDB34-885C-4527-B3A7-0CF927EAA88D--

1 0

Re: (ITS#7248) Cast to string in back-sql when upper_needs_cast is declared in slapd.conf
by rene.snajder＠i-med.ac.at 21 May '12

21 May '12

Dear OpenLDAP Devs, I would like to ask if there is anything else I can do to speed up the inclusion of my patch?

1 0

Re: (ITS#7277) Slapadd segfaults if binddn contains ou or dc statements
by hyc＠symas.com 20 May '12

20 May '12

> I played with it a bit and as soon as one adds "ou=..." or "dc=..." to the > binddn it raises an error. In this example config and in the "real world". > > Imho there aren't any limitations to the binddn option? No, there are no limitations on binddn. Your example is invalid since you have not loaded any schema to define the "ou" or "dc" attributes. The error message from slapadd is correct. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7277) Slapadd segfaults if binddn contains ou or dc statements
by o.loch＠gmx.net 19 May '12

19 May '12

Full_Name: Oliver Loch Version: 2.4.31 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (88.134.36.68) Hello, first of all some basic information: OpenLDAP Version: [root@ls1 slapd.d]# slapd -V @(#) $OpenLDAP: slapd 2.4.31 (Apr 24 2012 01:06:25) $ nobody@ovide:/build/src/openldap-2.4.31/servers/slapd [root@ls1 slapd.d]# OS: Linux ls1 3.3.6-1-ARCH #1 SMP PREEMPT Sun May 13 10:52:32 CEST 2012 x86_64 GNU/Linux Distribution: ArchLinux What I'm doing: I have a Master/Master setup with actually two masters. To roll out the second master I created a small configuration that is added to the OpenLDAP database via slapadd. The config: ======>8========SNIP======================== dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 ldap://server1.foo.bar olcServerID: 2 ldap://server2.foo.bar dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}back_bdb.la olcModuleLoad: {1}back_hdb.la olcModuleLoad: {2}accesslog olcModuleLoad: {3}memberof olcModuleLoad: {4}refint olcModuleLoad: {5}unique olcModuleLoad: {6}syncprov olcModulePath: /usr/lib/openldap dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=master,cn=config olcRootPW: {SSHA}5e/wtWWZVQPCNf+92o8jYiO56wvh5cRQ olcSyncrepl: rid=001 provider=ldap://server1.foo.bar bindmethod=simple timeout=0 network-timeout=0 binddn="cn=syncer1,ou=users,cn=foo,cn=bar" credentials="supersecret" keepalive=0:0:0 starttls=no searchbase="cn=config" scope=sub schemachecking=off type=refreshAndPersist retry="5 +" olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov ===========SNAP========8<==================== When adding the configuration to the - empty - slapd.d configuration directory via: slapadd -F /etc/openldap/slapd.d -n 0 -l /root/base.ldif "slapadd" segfaults as soon as the "binddn" parameter inside the olcSyncrepl attribute contains things like "ou" or "dc". So using "cn=syncer1,ou=users,dc=foo,dc=bar" as binddn is not possible: =========SNIP=======>8======================= [root@ls1 slapd.d]# slapadd -F /etc/openldap/slapd.d/ -n 0 -l /root/base.ldif 4fb89a89 invalid bind config value binddn=cn=syncer1,ou=users,dc=foo,dc=bar 4fb89a89 olcSyncrepl: value #0: Error: parse_syncrepl_line: unable to parse "binddn=cn=syncer1,ou=users,dc=foo,dc=bar" . 4fb89a89 failed to add syncinfo slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=19): _################# 86.13% eta none elapsed none spd 313.2 k/s Closing DB...Segmentation fault [root@ls1 slapd.d]# ===========SNAP========8<==================== But using "cn=syncer1,cn=users,cn=foo,cn=bar" is: ========>8==================SNIP============== [root@ls1 slapd.d]# slapadd -F /etc/openldap/slapd.d/ -n 0 -l /root/base.ldif _#################### 100.00% eta none elapsed none fast! Closing DB... [root@ls1 slapd.d]# ======SNAP================8<================= I played with it a bit and as soon as one adds "ou=..." or "dc=..." to the binddn it raises an error. In this example config and in the "real world". Imho there aren't any limitations to the binddn option? If you need further information feel free to contact me. Thanks! Kr, Oliver Loch

1 0

(ITS#7276) [PATCH] MozNSS: allow CA certdb together with PEM CA bundle file
by jvcelak＠redhat.com 18 May '12

18 May '12

Full_Name: Jan Vcelak Version: master OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-20120518-update-nss-allow-ca-certdb… Submission from: (NULL) (209.132.186.34) With Mozilla NSS crypto backend: Prior to this patch, if TLS_CACERTDIR was set to Mozilla NSS certificate database and TLS_CACERT was set to a PEM bundle file with CA certificates, the PEM file content was not loaded. With this patch and the same settings, OpenLDAP can verify certificates which are signed by CAs stored both in certdb and PEM bundle file. This problem was found with FreeIPA which is setting CA PEM bundle using ldap_set_option(&ld, LDAP_OPT_X_TLS_CACERTFILE, ...), while TLS_CACERTDIR with certdb is set in system ldap.conf file. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs