openldap-bugs

openldap-bugs@openldap.org

1 participants
21001 discussions

Re: (ITS#6540) test022-ppolicy is flawed, masks serious stability issue
by masarati＠aero.polimi.it 29 Apr '10

29 Apr '10

Let me first explain one thing. If you have one problem and you don't have time to rebuild from source, then it's very likely you'll have to live with your problem. The only difference between you and me is that if I find a solution, I can commit the fix. For the rest, your time is valuable exactly as mine, and I probably get paid less than you get paid, but to fix my problems, not yours. It just happened that tracking someone's issue, upgrading just solved it (ITS#6537, which ended up being a duplicate of another, already solved issue). In order to save the very scarce, unpaid manpower we can dedicate to fixing others' issues, our policy is to avoid tracking issues in old releases, because we don't backport fixes so, in the best case, the issue will be solved in the next one, and you'll have to upgrade anyway. After this lengthy preamble, thanks to your prompt response I already figured out myself how to reproduce the issue you're having, so you don't need to rebuild yet. You'll have to as soon as the issue is fixed. p. > It is also bears mentioning that test022-ppolicy has not changed at all > since 2.4.18, and so would never detect this > problem, even using the most recent stable version. As I mentioned, > ldapsearch does not trigger any errors - only > slapcat does (and of course, starting slapd, which fails as is detailed > above). > > > If you really want to test this, you must restart the server on which the > chaining configuration from test022-ppolicy > has been added, and then run slapcat. I am not the only one to run in to > this; for example, this individual has the > exact same issue, with no resolution: > http://www.openldap.org/lists/openldap-software/200907/msg00118.html > > > I'd be more than happy to patch the source, if such a patch existed. But > since nothing seems to have changed in the > relevant bits of code that would affect this behavior, and no > corresponding ITS exists, that would lead me to believe it > is thusly undocumented, except for similar on-list complaints. If you can > show me where in the back-ldap code you > believe I've missed said patch or refactoring, I've got no problem > admitting I missed it, but I don't see any such > modification(s). > > > I'm sure not everybody has the time to build from completely new source > every time a bug is unearthed, and while I do > not object to doing that as soon as I can, right now I have a slapd server > that is down because of this, so top priority > is to evaluate the code to figure out where this bug is stemming from and > fix it so I can restart slapd. Next priority > is building and testing new packages. I mean no disrespect by this, but > dropping everything to do this and work out any > new issues, bugs, and compatibility problems and separate those from this > pre-existing buggy behavior, seems hasty at > best, especially when there's no concretely identified reason for doing so > (i.e., this revision had change X, which > fixes problem Y). > > > I'm still reviewing the relevant code (which AFAICT hasn't changed) to > figure out what's going on here and put out the > immediate fire so that I can at least restore services, at which point I > will obviously have to make the time to > completely upgrade it all. > > Thanks > > > >

1 0

Re: (ITS#6540) test022-ppolicy is flawed, masks serious stability issue
by ryans＠aweber.com 28 Apr '10

28 Apr '10

It is also bears mentioning that test022-ppolicy has not changed at all since 2.4.18, and so would never detect this problem, even using the most recent stable version. As I mentioned, ldapsearch does not trigger any errors - only slapcat does (and of course, starting slapd, which fails as is detailed above). If you really want to test this, you must restart the server on which the chaining configuration from test022-ppolicy has been added, and then run slapcat. I am not the only one to run in to this; for example, this individual has the exact same issue, with no resolution: http://www.openldap.org/lists/openldap-software/200907/msg00118.html I'd be more than happy to patch the source, if such a patch existed. But since nothing seems to have changed in the relevant bits of code that would affect this behavior, and no corresponding ITS exists, that would lead me to believe it is thusly undocumented, except for similar on-list complaints. If you can show me where in the back-ldap code you believe I've missed said patch or refactoring, I've got no problem admitting I missed it, but I don't see any such modification(s). I'm sure not everybody has the time to build from completely new source every time a bug is unearthed, and while I do not object to doing that as soon as I can, right now I have a slapd server that is down because of this, so top priority is to evaluate the code to figure out where this bug is stemming from and fix it so I can restart slapd. Next priority is building and testing new packages. I mean no disrespect by this, but dropping everything to do this and work out any new issues, bugs, and compatibility problems and separate those from this pre-existing buggy behavior, seems hasty at best, especially when there's no concretely identified reason for doing so (i.e., this revision had change X, which fixes problem Y). I'm still reviewing the relevant code (which AFAICT hasn't changed) to figure out what's going on here and put out the immediate fire so that I can at least restore services, at which point I will obviously have to make the time to completely upgrade it all. Thanks

1 0

Re: (ITS#6540) test022-ppolicy is flawed, masks serious stability issue
by ryans＠aweber.com 28 Apr '10

28 Apr '10

> Date: Wed, 28 Apr 2010 21:20:38 +0200 (CEST) > Subject: ITS#6540 > From: masarati(a)aero.polimi.it > To: ryans(a)aweber.com > Cc: openldap-its(a)openldap.org > > Please do not report issues related to old releases. Current is 2.4.22. > Please test and report whether the issue persists. > > p. I checked my version of back-ldap/chain.c and back-ldap/config.c, and there have been no changes that in any way apply to or address the serious problem I've encountered. For reference, my chain.c is version 1.52.2.10, and config.c is version 1.115.2.14

1 0

Re: (ITS#6540) test022-ppolicy is flawed, masks serious stability issue
by ryans＠aweber.com 28 Apr '10

28 Apr '10

The other thing I should note is initially, everything seemed to work, but became prevalent the very first time I restarted slapd after adding the chaining configurations from test022-ppolicy. That's when all the errors started with slapcat. The second time I restarted it (to try and fix the issue), slapd would not start at all, as described above.

1 0

ITS#6540
by masarati＠aero.polimi.it 28 Apr '10

28 Apr '10

Please do not report issues related to old releases. Current is 2.4.22. Please test and report whether the issue persists. p.

1 0

Re: (ITS#6540) test022-ppolicy is flawed, masks serious stability issue
by ryans＠aweber.com 28 Apr '10

28 Apr '10

I should also note that a slapcat of the config database fails too in the exact same manner. I'm guessing this is somehow related to the fact that the chain module/overlay is located within the back_ldap module, but I'm not sure how to work around the issue yet, so at this time slapd will not start on the slave server on which slapd was stopped after adding the chaining configuration as is documented in test022-ppolicy.

1 0

(ITS#6540) test022-ppolicy is flawed, masks serious stability issue
by ryans＠aweber.com 28 Apr '10

28 Apr '10

Full_Name: Ryan Steele Version: 2.4.18 OS: Ubuntu Server URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (207.106.239.81) When the chaining configuration for cn=config is added, as is done in test022-ppolicy, the process of adding the module and overlay succeed, but subsequent slapcat operations will fail with: root@nebula:~# slapcat -n1 slapd-chain: first underlying database "olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config" cannot contain attribute "olcDbURI". config error processing olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config: slapcat: bad configuration file! Additionally, if slapd is stopped after adding the configuration in test022-ppolicy, the server will not start again, and on the foreground shows: slapd-chain: first underlying database "olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config" cannot contain attribute "olcDbURI". : config_add_internal: DN="olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config" no structural objectClass add function config error processing olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config: send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=65 matched="" text="" slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. The reason test022-ppolicy does not catch this is because an ldapsearch will still work. In fact, the chaining operations still succeed (writes are ferried off to the upstream server). But, this is a very grave problem, as it can cause the slapd server to stop functioning completely.

1 0

RE: (ITS#6537) arl[authority revocation list] issue during opneldap upgrade
by masarati＠aero.polimi.it 28 Apr '10

28 Apr '10

> Hi, > > I upgraded the version to openldap 2.4.22 and now I could add the ldif > file with the arl in with slapcat command > > Previously the same was not working, so I guess the bug in 2.4.21 is fixed > in 2.4.22 version > > You may treat the call as closed and thanks for your prompt response Probably a dup of ITS#6466. Closed, thanks. p.

1 0

RE: (ITS#6537) arl[authority revocation list] issue during opneldap upgrade
by mmishra＠isabel.eu 28 Apr '10

28 Apr '10

Hi, I upgraded the version to openldap 2.4.22 and now I could add the ldif file= with the arl in with slapcat command Previously the same was not working, so I guess the bug in 2.4.21 is fixed = in 2.4.22 version You may treat the call as closed and thanks for your prompt response Regards Mayashankar Mishra -----Original Message----- From: masarati(a)aero.polimi.it [mailto:masarati@aero.polimi.it] Sent: 2010-04-27 18:13 To: Mayashankar Mishra Cc: openldap-its(a)openldap.org Subject: RE: (ITS#6537) arl[authority revocation list] issue during opnelda= p upgrade One of us is clearly doing something wrong. Can you please check if the is= sue also appears with 2.4.22? I can't rebuild 2.4.21 right now, and since = 2.4.22 works for me, it would be pointless to track any issue that was fixe= d since 2.4.21. p. > See the error when I try to add > > > [root@ldap ~]# ldapadd -x -H ldap://:389 -D <Manager DN > -W -f > aaa.ldif Enter LDAP Password: > adding new entry "cn=3Dca,l=3Disabel,l=3Dbe" > ldap_add: Invalid syntax (21) > additional info: authorityRevocationList;binary: value #0 > invalid per syntax > > [root@ldap ~]# cat aaa.ldif > dn: cn=3Dca,l=3Disabel,l=3Dbe > changetype: add > objectClass: cRLDistributionPoint > authorityRevocationList;binary:: MIIBwTCBqgIBATANBgkqhkiG9w0BAQUFADBUM > QswCQYDVQQGEwJCZTEPMA0GA1UEBxMGSXNhYmVsMQswCQYDVQQKEwJDYTEnMCUGA1UEAx > MeSXNhYmVsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5Fw0wNTEyMDIwNDAwNTRaFw0wNTE > yMDMwNDAwMDBaMACgIDAeMA8GA1UdIwQIMAaABENBMDIwCwYDVR0UBAQCAgzSMA0GCSqG > SIb3DQEBBQUAA4IBAQALWRmn79TNllOD+oOqv7r64NSFdBGo/8fCQAykbjcNMJHRjTOSq > fU0amv2hS509I68/VhwfwHw9NzNsnPEevWkb1oFWSLvZ6FuWXTNOV5n9aY/bMqJX5gPtw > lNWez/ATv99M5WbUUKPjDxpc90bd2xjMoKBhlsrykMg0DXaRkiYYREl3lXF0wr4F/FsfO > 7QS+fzkifmI09Z7zCIc2043xl2RpXvRostzrq8ncQdjBh5UdHj3qW0HQfkCaNxiIy3eZY > 4JKyCqW97nTyh9v5As1X2mvujbTtKW5i5lnXeHDtjOdufva86TbZvSyQyikxLRlpQle+Y > i5x6NWdDN7Sz9LO > > > > > > > > > Mayashankar Mishra > Consultant > E-mail : mmishra(a)isabel.eu > Tel : +32 (0)2 403.18.84 > Fax : +32 > > Isabel NV/S.A. > Keizerinlaan 13-15 Boulevard de l'Imp=E9ratrice 1000 Brussels - Belgium > RPR Bruxelles / RPM Brussel: BE 0455 530 509 > http://www.isabel.eu/ http://www.zoomit.eu/ > > Zoomit is a Registered Trademark of Isabel NV/S.A. > Disclaimer : http://www.isabel.eu/gps/en/disclaimer/mailing.php > > -----Original Message----- > From: masarati(a)aero.polimi.it [mailto:masarati@aero.polimi.it] > Sent: 2010-04-27 17:41 > To: Mayashankar Mishra > Cc: openldap-its(a)openldap.org > Subject: RE: (ITS#6537) arl[authority revocation list] issue during > opneldap upgrade > >> uploaded the arl on ftp server > > I could load it without any problem. LDIF: > > dn: cn=3Dtest,dc=3Dexample,dc=3Dcom > changetype: add > objectClass: cRLDistributionPoint > authorityRevocationList;binary:: MIIBwTCBqgIBATANBgkqhkiG9w0BAQUFADBUM > QswCQYDVQQGEwJCZTEPMA0GA1UEBxMGSXNhYmVsMQswCQYDVQQKEwJDYTEnMCUGA1UEAx > MeSXNhYmVsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5Fw0wNTEyMDIwNDAwNTRaFw0wNTE > yMDMwNDAwMDBaMACgIDAeMA8GA1UdIwQIMAaABENBMDIwCwYDVR0UBAQCAgzSMA0GCSqG > SIb3DQEBBQUAA4IBAQALWRmn79TNllOD+oOqv7r64NSFdBGo/8fCQAykbjcNMJHRjTOSq > fU0amv2hS509I68/VhwfwHw9NzNsnPEevWkb1oFWSLvZ6FuWXTNOV5n9aY/bMqJX5gPtw > lNWez/ATv99M5WbUUKPjDxpc90bd2xjMoKBhlsrykMg0DXaRkiYYREl3lXF0wr4F/FsfO > 7QS+fzkifmI09Z7zCIc2043xl2RpXvRostzrq8ncQdjBh5UdHj3qW0HQfkCaNxiIy3eZY > 4JKyCqW97nTyh9v5As1X2mvujbTtKW5i5lnXeHDtjOdufva86TbZvSyQyikxLRlpQle+Y > i5x6NWdDN7Sz9LO > > command: > > ldapadd -x -H ldap://:9011 -D <manager DN> -w <password> -f <LDIF > file> > > using HEAD and re24 (basically, 2.4.22). > > I think this ITS should definitely be closed, and you should > eventually discuss your issue on the openldap-software mailing list, > as there appears to be no software bug. > > p. > > > > > > >

1 0

RE: (ITS#6537) arl[authority revocation list] issue during opneldap upgrade
by masarati＠aero.polimi.it 27 Apr '10

27 Apr '10

One of us is clearly doing something wrong. Can you please check if the issue also appears with 2.4.22? I can't rebuild 2.4.21 right now, and since 2.4.22 works for me, it would be pointless to track any issue that was fixed since 2.4.21. p. > See the error when I try to add > > > [root@ldap ~]# ldapadd -x -H ldap://:389 -D <Manager DN > -W -f aaa.ldif > Enter LDAP Password: > adding new entry "cn=ca,l=isabel,l=be" > ldap_add: Invalid syntax (21) > additional info: authorityRevocationList;binary: value #0 invalid > per syntax > > [root@ldap ~]# cat aaa.ldif > dn: cn=ca,l=isabel,l=be > changetype: add > objectClass: cRLDistributionPoint > authorityRevocationList;binary:: MIIBwTCBqgIBATANBgkqhkiG9w0BAQUFADBUM > QswCQYDVQQGEwJCZTEPMA0GA1UEBxMGSXNhYmVsMQswCQYDVQQKEwJDYTEnMCUGA1UEAx > MeSXNhYmVsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5Fw0wNTEyMDIwNDAwNTRaFw0wNTE > yMDMwNDAwMDBaMACgIDAeMA8GA1UdIwQIMAaABENBMDIwCwYDVR0UBAQCAgzSMA0GCSqG > SIb3DQEBBQUAA4IBAQALWRmn79TNllOD+oOqv7r64NSFdBGo/8fCQAykbjcNMJHRjTOSq > fU0amv2hS509I68/VhwfwHw9NzNsnPEevWkb1oFWSLvZ6FuWXTNOV5n9aY/bMqJX5gPtw > lNWez/ATv99M5WbUUKPjDxpc90bd2xjMoKBhlsrykMg0DXaRkiYYREl3lXF0wr4F/FsfO > 7QS+fzkifmI09Z7zCIc2043xl2RpXvRostzrq8ncQdjBh5UdHj3qW0HQfkCaNxiIy3eZY > 4JKyCqW97nTyh9v5As1X2mvujbTtKW5i5lnXeHDtjOdufva86TbZvSyQyikxLRlpQle+Y > i5x6NWdDN7Sz9LO > > > > > > > > > Mayashankar Mishra > Consultant > E-mail : mmishra(a)isabel.eu > Tel : +32 (0)2 403.18.84 > Fax : +32 > > Isabel NV/S.A. > Keizerinlaan 13-15 Boulevard de l'Impératrice > 1000 Brussels - Belgium > RPR Bruxelles / RPM Brussel: BE 0455 530 509 > http://www.isabel.eu/ http://www.zoomit.eu/ > > Zoomit is a Registered Trademark of Isabel NV/S.A. > Disclaimer : http://www.isabel.eu/gps/en/disclaimer/mailing.php > > -----Original Message----- > From: masarati(a)aero.polimi.it [mailto:masarati@aero.polimi.it] > Sent: 2010-04-27 17:41 > To: Mayashankar Mishra > Cc: openldap-its(a)openldap.org > Subject: RE: (ITS#6537) arl[authority revocation list] issue during > opneldap upgrade > >> uploaded the arl on ftp server > > I could load it without any problem. LDIF: > > dn: cn=test,dc=example,dc=com > changetype: add > objectClass: cRLDistributionPoint > authorityRevocationList;binary:: MIIBwTCBqgIBATANBgkqhkiG9w0BAQUFADBUM > QswCQYDVQQGEwJCZTEPMA0GA1UEBxMGSXNhYmVsMQswCQYDVQQKEwJDYTEnMCUGA1UEAx > MeSXNhYmVsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5Fw0wNTEyMDIwNDAwNTRaFw0wNTE > yMDMwNDAwMDBaMACgIDAeMA8GA1UdIwQIMAaABENBMDIwCwYDVR0UBAQCAgzSMA0GCSqG > SIb3DQEBBQUAA4IBAQALWRmn79TNllOD+oOqv7r64NSFdBGo/8fCQAykbjcNMJHRjTOSq > fU0amv2hS509I68/VhwfwHw9NzNsnPEevWkb1oFWSLvZ6FuWXTNOV5n9aY/bMqJX5gPtw > lNWez/ATv99M5WbUUKPjDxpc90bd2xjMoKBhlsrykMg0DXaRkiYYREl3lXF0wr4F/FsfO > 7QS+fzkifmI09Z7zCIc2043xl2RpXvRostzrq8ncQdjBh5UdHj3qW0HQfkCaNxiIy3eZY > 4JKyCqW97nTyh9v5As1X2mvujbTtKW5i5lnXeHDtjOdufva86TbZvSyQyikxLRlpQle+Y > i5x6NWdDN7Sz9LO > > command: > > ldapadd -x -H ldap://:9011 -D <manager DN> -w <password> -f <LDIF file> > > using HEAD and re24 (basically, 2.4.22). > > I think this ITS should definitely be closed, and you should eventually > discuss your issue on the openldap-software mailing list, as there appears > to be no software bug. > > p. > > > > > > >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs