openldap-bugs

openldap-bugs@openldap.org

1 participants
21000 discussions

Re: (ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Excellent. Xin Li had a partial patch earlier tonight that got the prompts directed properly to console. -------- Original Message -------- Subject: Re: (ITS#6702) slappasswd prompts missing From: Howard Chu <hyc(a)symas.com> To: gessel(a)blackrosetech.com Date: Thu Nov 11 2010 19:18:29 GMT-0800 (Pacific Standard Time) > gessel(a)blackrosetech.com wrote: >> Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: >> "rootpw New password:" >> "Re-enter new password:" >> >> >> > Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a > replacement in the OpenLDAP code is used instead. The OpenLDAP code is now > fixed in HEAD. >

1 0

Re: (ITS#6702) slappasswd prompts missing
by hyc＠symas.com 11 Nov '10

11 Nov '10

gessel(a)blackrosetech.com wrote: > Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: > "rootpw New password:" > "Re-enter new password:" > > > Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a replacement in the OpenLDAP code is used instead. The OpenLDAP code is now fixed in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6701) Update to man8 slappasswd: English usage
by hyc＠symas.com 11 Nov '10

11 Nov '10

diver06(a)gmx.net wrote: > Full_Name: Simon Wright > Version: 2.4.23 > OS: FreeBSD > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.98.32.54) > > > The man page for slappasswd says that encryption scheme names need to be > protected due to "{". This is wrong usage: scheme names may need to be protected > *by* "{" Wrong. The manpage text is correct. The '{' and '}' are part of the scheme names. Since these are also meta-characters in common command shells, they may need to be protected from expansion. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: "rootpw New password:" "Re-enter new password:"

1 0

(ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Full_Name: David Gessel Version: openldap-sasl-server-2.4.23 OS: FreeBSD 8.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.93.181.141) Attempting to insert a hash of the root pw into slapd.conf with the command: # slappasswd >> slapd.conf yields a blank prompt, that is there is no feedback to prompt the user along the lines of: "Enter root password" and "Verify root password" But entering the root password twice with no feedback (and blank characters for security, so completely blind) gets through the command successfully.

1 0

(ITS#6701) Update to man8 slappasswd: English usage
by diver06＠gmx.net 11 Nov '10

11 Nov '10

Full_Name: Simon Wright Version: 2.4.23 OS: FreeBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.98.32.54) The man page for slappasswd says that encryption scheme names need to be protected due to "{". This is wrong usage: scheme names may need to be protected *by* "{" Patch: --- openldap-2.4.23/doc/man/man8/slappasswd.8 2010-04-13 22:22:46.000000000 +0200 +++ slappasswd.8 2010-11-11 16:36:28.000000000 +0100 @@ -100,7 +100,7 @@ The default is .BR {SSHA} . -Note that scheme names may need to be protected, due to +Note that scheme names may need to be protected by .B { and .BR } ,

1 0

Re: (ITS#6698) Please add BDB 5.x support for SLAPD
by hyc＠symas.com 11 Nov '10

11 Nov '10

faessler(a)was.ch wrote: > Full_Name: Dominik Fässler > Version: 2.4.23 > OS: FreeBSD (8.1-RELEASE) > URL: > Submission from: (NULL) (62.2.101.221) > > > We know that for the moment only BDB versions 4.4 - 4.8 are supported as backend > for SLAPD. > We would be happy, if you could include support for BDB versions 5.x as well. > (For now we are using 5.1) > Thanx. > Added to configure script in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6700) memberOf overlay does not handle MODRDN correctly
by raphael.ouazana＠linagora.com 10 Nov '10

10 Nov '10

Full_Name: Raphael Ouazana Version: 2.4.23 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.41.232.151) Hi, When using memberOf overlay, a MODRDN request on a member does not update correctly the matching group, even if the memberof-refint option is set to true. In my little understanding, memberof_value_modify calls op->o_bd->be_modify which calls back the overlay code, and finally never reach the backend. Regards, Raphaël Ouazana.

1 0

RE: (ITS#6683) DDS fails with expired branches
by Petteri.Stenius＠ubisecure.com 10 Nov '10

10 Nov '10

Hi, Thank you for your reply. My knowledge about the bdb internals is limited. I have reproduced this issue and reduced it to a small amount of data (see below). I think I have done everything right with regards to setting up and preparing the database and indexes. I've used both ldapmodify and slapadd/slapindex to prepare the db. If you think my indexes are corrupt then can you please give me pointers how to verify? I don't think there exist test cases for operators LE "<=3D" or GE = ">=3D" in the source codes. Thanks, Petteri -----Original Message----- From: Howard Chu [mailto:hyc@symas.com]=20 Sent: Tuesday, November 09, 2010 10:45 AM To: Petteri Stenius Cc: openldap-its(a)openldap.org Subject: Re: (ITS#6683) DDS fails with expired branches Petteri.Stenius(a)ubisecure.com wrote: > Hello, > > Further investigation shows this issue is caused by operator LE search > failing with indexed attributes. Also this indexed search issue is NOT > limited to DDS.=3D20 > > I have reproduced the issue with integerOrderingMatch and > generalizedTimeOrderingMatch.=3D20 > > The piece of code I find suspicious is in servers/back-bdb/idl.c, > somewhere in the middle it reads > > /* skip presence key on range inequality lookups */ > while (rc =3D3D=3D3D 0&& kptr->size !=3D3D len) { > rc =3D3D cursor->c_get( cursor, kptr,&data, flags | > DB_NEXT_NODUP ); > } > > If I remove this block then LE search works as expected with indexed > attributes. The key here seems to be the DB_NEXT_NODUP flag. This flag > causes the iterator block a few lines below to return partial matches. That implies that there's something else corrupt in the index, because the=20 presence key will never be the same size as an equality key. > > Thanks, > Petteri > > -----Original Message----- > From: openldap-bugs-bounces(a)OpenLDAP.org > [mailto:openldap-bugs-bounces@OpenLDAP.org] On Behalf Of > petteri.stenius(a)ubisecure.com > Sent: Monday, October 25, 2010 1:35 PM > To: openldap-its(a)openldap.org > Subject: (ITS#6683) DDS fails with expired branches > > Full_Name:=3D20 > Version: 2.4.23 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.197.205.34) > > > Hello, > > I have a directory with branches of dynamicObject entries. It looks like > if the > entryExpireTimestamp value is the same on objects within a branch then > DDS > search for expired objects will only find the top-most object. This > results in > remove failing with message > > DDS dn=3D3D"cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest" is non-leaf; = deferring. > > > To reproduce > > OpenLDAP 2.4.23, Berkeley DB 4.6.21 > > Use slapadd to prepare directory with following > > dn: cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: applicationProcess > cn: Root > > dn: cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: top > > dn: cn=3D3Dleaf1,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: leaf1 > > dn: cn=3D3Dleaf2,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: leaf2 > > dn: cn=3D3Dleaf3,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: leaf3 > > > Relevant slapd.conf entries > > database bdb > suffix "cn=3D3DRoot,dc=3D3Dtest" > rootdn "cn=3D3DRoot,dc=3D3Dtest" > rootpw "password" > > overlay dds > dds-default-ttl 3600 > dds-min-ttl 60 > dds-interval 60 > dds-state true > index entryExpireTimestamp eq,pres > > access to dn.subtree=3D3D"cn=3D3DRoot,dc=3D3Dtest" > by users write > by * read > > > Running "slapd -d 1 -d 256" produces following > > put_filter: > "(&(objectClass=3D3DdynamicObject)(entryExpireTimestamp<=3D3D201010250824= 46Z )=3D > )" > put_filter: AND > put_filter_list > "(objectClass=3D3DdynamicObject)(entryExpireTimestamp<=3D3D20101025082446= Z)" > put_filter: "(objectClass=3D3DdynamicObject)" > put_filter: simple > put_simple_filter: "objectClass=3D3DdynamicObject" > put_filter: "(entryExpireTimestamp<=3D3D20101025082446Z)" > put_filter: simple > put_simple_filter: "entryExpireTimestamp<=3D3D20101025082446Z" > ber_scanf fmt ({mm}) ber: > ber_scanf fmt ({mm}) ber: > =3D3D> bdb_search > bdb_dn2entry("cn=3D3Droot,dc=3D3Dtest") > =3D3D> bdb_dn2id("cn=3D3Droot,dc=3D3Dtest") > <=3D3D bdb_dn2id: got id=3D3D0x1 > entry_decode: "cn=3D3DRoot,dc=3D3Dtest" > <=3D3D entry_decode(cn=3D3DRoot,dc=3D3Dtest) > search_candidates: base=3D3D"cn=3D3Droot,dc=3D3Dtest" (0x00000001) = scope=3D3D2 > =3D3D> bdb_dn2idl("cn=3D3Droot,dc=3D3Dtest") > =3D3D> bdb_equality_candidates (objectClass) > =3D3D> key_read > <=3D3D bdb_index_read: failed (-30989) > <=3D3D bdb_equality_candidates: id=3D3D0, first=3D3D0, last=3D3D0 > =3D3D> bdb_equality_candidates (objectClass) > =3D3D> key_read > <=3D3D bdb_index_read 4 candidates > <=3D3D bdb_equality_candidates: id=3D3D4, first=3D3D2, last=3D3D5 > =3D3D> bdb_inequality_candidates (entryExpireTimestamp) > =3D3D> key_read > <=3D3D bdb_index_read 1 candidates > =3D3D> key_read > <=3D3D bdb_index_read: failed (-30989) > <=3D3D bdb_inequality_candidates: id=3D3D1, first=3D3D2, last=3D3D2 > bdb_search_candidates: id=3D3D1 first=3D3D2 last=3D3D2 > entry_decode: "cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest" > <=3D3D entry_decode(cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest) > =3D3D> bdb_dn2id("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest") > <=3D3D bdb_dn2id: got id=3D3D0x2 > send_ldap_result: conn=3D3D-1 op=3D3D0 p=3D3D0 > bdb_dn2entry("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest") > =3D3D> bdb_dn2id_children("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest") > <=3D3D bdb_dn2id_children("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest"): (0) > send_ldap_result: conn=3D3D-1 op=3D3D0 p=3D3D0 > DDS dn=3D3D"cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest" is non-leaf; = deferring. > DDS expired=3D3D0 > > > ldapsearch "(entryExpireTimestamp=3D3D*)" produces > > dn: cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > dn: cn=3D3Dleaf1,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > dn: cn=3D3Dleaf2,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > dn: cn=3D3Dleaf3,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > > where ldapsearch "(entryExpireTimestamp<=3D3D20101024113626Z)" only finds > > dn: cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > > If I change all timestamps to distinct values then expiration of > complete > branches works as expected. > > > Thanks, > Petteri > > > --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6698) Please add BDB 5.x support for SLAPD
by faessler＠was.ch 10 Nov '10

10 Nov '10

Full_Name: Dominik Fässler Version: 2.4.23 OS: FreeBSD (8.1-RELEASE) URL: Submission from: (NULL) (62.2.101.221) We know that for the moment only BDB versions 4.4 - 4.8 are supported as backend for SLAPD. We would be happy, if you could include support for BDB versions 5.x as well. (For now we are using 5.1) Thanx.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs