https://bugs.openldap.org/show_bug.cgi?id=9564
Issue ID: 9564
Summary: Race condition with freeing the spilled pages from
transaction
Product: LMDB
Version: 0.9.29
Hardware: Other
OS: Mac OS
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: kriszyp(a)gmail.com
Target Milestone: ---
Created attachment 825
--> https://bugs.openldap.org/attachment.cgi?id=825&action=edit
Free the spilled pages and dirty overflows before unlocking the write mutex
The spilled pages (a transaction's mt_spill_pgs) is freed *after* a write
transaction's mutex is unlocked (in mdb.master3). This can result in a race
condition where a second transaction can start and subsequently assign a new
mt_spill_pgs list to the transaction structure that it reuses. If this occurs
after the first transaction unlocks the mutex, but before it performs the free
operation on mt_spill_pgs, then the first transaction will end up calling a
free on the same spilled page list as the second transaction, resulting in a
double free (and crash).
It would seem to be an extremely unlikely scenario to actually happen, since
the free call is literally the next operation after the mutex is unlocked, and
the second transaction would need to make it all the way to the point of saving
the freelist before a page spill list is likely to be allocated. Consequently,
this probably has rarely happened. However, one of our users (see
https://github.com/DoctorEvidence/lmdb-store/issues/48 for the discussion) has
noticed this occurring, and it seems that it may be particularly likely to
happen on MacOS on the new M1 silicon. Perhaps there is some peculiarity to how
the threads are more likely to yield execution after a mutex unlock, I am not
sure. I was able to reproduce the issue by intentionally manipulating the
timing (sleeping before the free) to verify that the race condition is
technically feasible, and apparently this can happen "in the wild" on MacOS, at
least with an M1.
It is also worth noting that this is due to (or a regression from) the fix for
ITS#9155
(https://github.com/LMDB/lmdb/commit/cb256f409bb53efeda4ac69ee8165a0b4fc1a277)
where the free call was moved outside the conditional (for having a parent)
that had previously never been executed after the mutex is unlocked, but now is
called after the unlock.
Anyway, the solution is relatively simple, the free call simply has to be moved
above the unlock. In my patch, I also moved the free call for mt_dirty_ovs. I
am not sure what OVERFLOW_NOTYET/mt_dirty_ovs is for, but presumably it should
be handled the same. This could alternately be solved by saving the reference
to these lists before unlocking, and freeing after unlocking, which would
slightly decrease the amount of processing within the mutex guarded code. Let
me know if you prefer a patch that does that.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9563
Issue ID: 9563
Summary: OpenLDAP enable TLS1.3
Product: OpenLDAP
Version: 2.4.45
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: santhu227(a)gmail.com
Target Milestone: ---
How we can enable TLS1.3 on OopenLDAP for ubuntu 18.04.5 LTS.
Package details :
OS PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
OpenSSL 1.1.1g 21 Apr 2020.
grep -R olcTLS /etc/ldap/slapd.d/
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCRLCheck: none
/etc/ldap/slapd.d/cn=config.ldif:olcTLSProtocolMin: 3.4
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCipherSuite: NORMAL
/etc/ldap/slapd.d/cn=config.ldif:olcTLSVerifyClient: try
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCACertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile:
/etc/ldap/sasl2/ldap_server_new_13.key
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
dpkg -s slapd | grep Version
Version: 2.4.45+dfsg-1ubuntu1.10
Is there any possibility to enable TLS1.3 on slapd service(OpenLDAP server) for
above configuration.
If need to upgrade any package will it be possible to upgrade or update on
Ubuntu 18.04.5.
openssl client output where openssl is not able to connecte with TLS1.3. Same
will list ciphers for TLS1.2
openssl s_client -connect <host>:636 -tls1_3
CONNECTED(00000003)
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 215 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9562
Issue ID: 9562
Summary: Unable to setup TLS1.3
Product: OpenLDAP
Version: 2.4.45
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: santhu227(a)gmail.com
Target Milestone: ---
How we can enable TLS1.3 on OopenLDAP for ubuntu 18.04.5 LTS.
Package details :
OS PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
OpenSSL 1.1.1g 21 Apr 2020.
grep -R olcTLS /etc/ldap/slapd.d/
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCRLCheck: none
/etc/ldap/slapd.d/cn=config.ldif:olcTLSProtocolMin: 3.3
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCipherSuite: NORMAL
/etc/ldap/slapd.d/cn=config.ldif:olcTLSVerifyClient: try
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCACertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile:
/etc/ldap/sasl2/ldap_server_new_13.key
/etc/ldap/slapd.d/cn=config.ldif:olcTLSCertificateFile:
/etc/ldap/sasl2/ldap_server_new_13.crt
dpkg -s slapd | grep Version
Version: 2.4.45+dfsg-1ubuntu1.10
Is there any possibility to enable TLS1.3 on slapd service(OpenLDAP server) for
above configuration.
If need to upgrade any package will it be possible to upgrade or update on
Ubuntu 18.04.5.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9560
Issue ID: 9560
Summary: Dead images in documentation
Product: website
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: website
Assignee: bugs(a)openldap.org
Reporter: shea.ramage(a)gmail.com
Target Milestone: ---
Created attachment 823
--> https://bugs.openldap.org/attachment.cgi?id=823&action=edit
Screenshot of broken images
Documentation release 2.5 (https://www.openldap.org/doc/admin25) contains
several dead image links. One example (Figure 3.1)
https://www.openldap.org/doc/admin25/config_local.png results in a 404 not
found error, however changing the '5' in the URL to a '4' loads an image
correctly.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8882
--- Comment #10 from Matthew Hardin <mhardin(a)symas.com> ---
It appears that the source code for the module is no longer on the FTP server.
Would someone from daasi please upload it and mark the correct URL in the
comment?
Thanks,
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=6467
--- Comment #9 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
Commits:
• c216ef53
by OndÅ™ej KuznÃk at 2021-05-15T10:01:18+01:00
ITS#6467 Reset avl root after releasing the tree
• 5943a334
by OndÅ™ej KuznÃk at 2021-05-15T10:01:51+01:00
ITS#6467 Adjust log message
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=7335
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords|OL_2_5_REQ |
Target Milestone|2.5.5 |2.6.0
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8882
--- Comment #9 from tamim.ziai(a)daasi.de <tamim.ziai(a)daasi.de> ---
The attached file is derived from OpenLDAP Software. All of the modifications
to OpenLDAP Software represented in the following patch(es) were developed by
DAASI International. DAASI International has not assigned rights and/or
interest in this work to any party. I, Tamim Ziai is authorized by DAASI
International to release this work under the following terms.
The attached modifications to OpenLDAP Software are subject to the following
notice:
Copyright 2019 DAASI International
Redistribution and use in source and binary forms, with or without
modification, are permitted only as authorized by the OpenLDAP Public License.
--
You are receiving this mail because:
You are on the CC list for the issue.