(ITS#5585) GnuTLS SSF strength conversion issue
by quanah＠OpenLDAP.org
Full_Name: Quanah Gibson-Mount
Version: 2.4.10/HEAD
OS: NA
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (75.111.29.239)
When using GnuTLS rather than OpenSSL for OpenLDAP, the SSF reported when using
startTLS is incorrect. This is because GnuTLS reports the strength in bytes,
while the OpenLDAP code expects the strength in bits. Code needs to be updated
to adjust the SSF value when linked against GnuTLS to our expected result.
15 years, 3 months
Re: (ITS#5355) back-meta calls back-ldap directly
by vorlon＠debian.org
On Mon, Jun 30, 2008 at 10:09:59AM +0200, Pierangelo Masarati wrote:
> vorlon(a)debian.org wrote:
>> So meta_back_db_config() seems to be getting called before
>> meta_back_db_open() ?
> This is now fixed in HEAD; however, despite solving the sigsegv issue,
> the test still fails because ldap_first_message(3) is not available.
> This sounds odd, can anyone explain why it is not getting loaded?
Thanks, applied this latest patch and I confirm that it fixes the segfault.
I also don't see any problems resolving the ldap_first_message symbol.
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
slangasek(a)ubuntu.com vorlon(a)debian.org
15 years, 3 months
Re: (ITS#5583) slapadd core dumps
by rhafer＠suse.de
On Sonntag, 29. Juni 2008, you wrote:
> Pierangelo Masarati <ando(a)sys-net.it> writes:
> > Dieter Kluenter wrote:
> >> Pierangelo Masarati <ando(a)sys-net.it> writes:
> >>> dieter(a)dkluenter.de wrote:
> >>>> Sorry, forgot it,
> >>>
> >>> Should be fixed in HEAD, please test. I infer you're using
> >>> multiple instances of slapo-dynlist(5) in your slapd.conf, aren't
> >>> you?
> >>
> >> No, just one instance.
> >
> > Sounds odd, because the error was related to executing
> > slapo-dynlist's db_open() function while the static vars holding
> > the dgIdentity (and the dgAuthz) attrs being already initialized.
> > Can you test the fix to overlays/dynlist.c 1.51->1.52? It is for
> > HEAD, but should apply straightforwardly to 2.4.
>
> I just compiled HEAD and slapadd added the ldif file as expected. But
> a second error occured, test failed with test001
Is this on openSUSE 11.0? Then you might have hit
http://sourceware.org/bugzilla/show_bug.cgi?id=4980 (or ITS#5251). We
have patched around that glibc bug in our openldap packages. A possible
workaround that doesn't require patching is to remove the "localhost"
entry from the "::1" line in /etc/hosts.
> , but I will check
> this tomorrow, same as the dynlist patch.
--
Ralf
15 years, 3 months
Re: (ITS#5574) Attribute type 'auditContext' not available in subschema
by ando＠sys-net.it
michael(a)stroeder.com wrote:
> I can't see it with RE24 (at the moment 2.4.10).
> Which version are you looking at?
>
> On my system slapo-accesslog is built and actively used.
> BTW: Other schema elements of slapo-accesslog are not available either:
> object class auditModify, attribute type reqAuthzID etc.
HEAD. I checked the code to see if the HIDE flag was being set, and I
didn't notice it was (it's being added right before registering the
schema item, rather than when defining it, that's why I overlooked it).
Of course you can't see it with 2.4. I think its publication as
non-experimental is pending Howard's completion of the related I.D.
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Email: ando(a)sys-net.it
-----------------------------------
15 years, 3 months
Re: (ITS#5574) Attribute type 'auditContext' not available in subschema
by michael＠stroeder.com
Pierangelo Masarati wrote:
> michael(a)stroeder.com wrote:
>> Full_Name: Michael Ströder
>> Version: RE24
>> OS: OpenSUSE Linux 10.2
>> URL: ftp://ftp.openldap.org/incoming/
>> Submission from: (NULL) (84.163.82.89)
>>
>>
>> Please add attribute type 'auditContext' to subschema.
>
> It is registered by slapo-accesslog(5). I can see it when
> slapo-accesslog(5) is built.
I can't see it with RE24 (at the moment 2.4.10).
Which version are you looking at?
On my system slapo-accesslog is built and actively used.
BTW: Other schema elements of slapo-accesslog are not available either:
object class auditModify, attribute type reqAuthzID etc.
Ciao, Michael.
15 years, 3 months
Re: (ITS#5355) back-meta calls back-ldap directly
by ando＠sys-net.it
vorlon(a)debian.org wrote:
> So meta_back_db_config() seems to be getting called before
> meta_back_db_open() ?
This is now fixed in HEAD; however, despite solving the sigsegv issue,
the test still fails because ldap_first_message(3) is not available.
This sounds odd, can anyone explain why it is not getting loaded?
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Email: ando(a)sys-net.it
-----------------------------------
15 years, 3 months
Re: (ITS#5355) back-meta calls back-ldap directly
by ando＠sys-net.it
vorlon(a)debian.org wrote:
> So meta_back_db_config() seems to be getting called before
> meta_back_db_open() ?
... which is correct. A fix is coming.
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Email: ando(a)sys-net.it
-----------------------------------
15 years, 3 months
Re: (ITS#5355) back-meta calls back-ldap directly
by vorlon＠debian.org
On Sun, Jun 29, 2008 at 11:29:58PM -0700, Steve Langasek wrote:
> Are you seeing this as well, or is this somehow specific to Debian? (It
> doesn't seem like it should be related to libltdl in any way, and we don't
> have any other patches that touch the meta backend; and I saw this segfault
> both with the version of the patch I sent, and the one extracted from CVS.)
> Unfortunately, running these tests under gdb seems to be pretty awkward. :/
Well, here's the backtrace:
0x00007f9d6a45ef60 in meta_back_db_config (be=0xa7bbb0,
fname=0x9f1040 "/home/devel/openldap/build-area/openldap2.3-2.4.10/debian/build/tests/testrun/slapd.3.conf", lineno=65, argc=6, argv=0xa3d230)
at /home/devel/openldap/build-area/openldap2.3-2.4.10/servers/slapd/back-meta/config.c:1162
1162 return mi->mi_ldap_extra->idassert_parse_cf( fname, lineno, argc, argv, &mi->mi_targets[ mi->mi_ntargets - 1 ]->mt_idassert );
#0 0x00007f9d6a45ef60 in meta_back_db_config (be=0xa7bbb0,
fname=0x9f1040 "/home/devel/openldap/build-area/openldap2.3-2.4.10/debian/build/tests/testrun/slapd.3.conf", lineno=65, argc=6, argv=0xa3d230)
at /home/devel/openldap/build-area/openldap2.3-2.4.10/servers/slapd/back-meta/config.c:1162
#1 0x000000000042ab13 in read_config_file (fname=<value optimized out>,
depth=<value optimized out>, cf=0x0, cft=0x71e0e0)
at /home/devel/openldap/build-area/openldap2.3-2.4.10/servers/slapd/config.c:786
#2 0x000000000042692d in read_config (
fname=0x9f1040 "/home/devel/openldap/build-area/openldap2.3-2.4.10/debian/build/tests/testrun/slapd.3.conf", dir=0x0)
at /home/devel/openldap/build-area/openldap2.3-2.4.10/servers/slapd/bconfig.c:3461
#3 0x0000000000419f3b in main (argc=8, argv=0x7fff77dc3e88)
at /home/devel/openldap/build-area/openldap2.3-2.4.10/servers/slapd/main.c:754
$1 = (ldap_extra_t *) 0x0
So meta_back_db_config() seems to be getting called before
meta_back_db_open() ?
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
slangasek(a)ubuntu.com vorlon(a)debian.org
15 years, 3 months
Re: (ITS#5355) back-meta calls back-ldap directly
by ando＠sys-net.it
vorlon(a)debian.org wrote:
> On Sun, Jun 29, 2008 at 05:23:57PM -0700, Howard Chu wrote:
>> Steve Langasek wrote:
>>> Is the correct fix to add
>>> this function to the ldap_extra_t struct, as in the attached patch?
>
>> Pretty much. There are a few other functions that need to be added as
>> well. All of them are provided in current CVS HEAD, just grab the
>> relevant changes from there.
>
> Ok. With the patch from CVS HEAD applied, I'm seeing a segfault in make
> test (specifically, the meta backend test):
>
> >>>>> Starting test035-meta ...
> running defines.sh
>
> Starting slapd on TCP/IP port 9011...
> Using ldapsearch to check that slapd is running...
> Using ldapadd to populate the database...
> Starting slapd on TCP/IP port 9012...
> Using ldapsearch to check that slapd is running...
> Using ldapadd to populate the database...
> Starting slapd on TCP/IP port 9013...
> /home/devel/openldap/build-area/openldap2.3-2.4.10/tests/scripts/test035-meta: line 118: 22990 Segmentation fault $SLAPD -f $CONF3 -h $URI3 -d $LVL /$TIMING > $LOG3 2>&1
I'm not seeing anything like that, but I don't build back-meta as a
module. It would be helpful if you provide at least a stack backtrace
for that sigsegv, to help understand where and why it occurred.
> Are you seeing this as well, or is this somehow specific to Debian? (It
> doesn't seem like it should be related to libltdl in any way, and we don't
> have any other patches that touch the meta backend; and I saw this segfault
> both with the version of the patch I sent, and the one extracted from CVS.)
> Unfortunately, running these tests under gdb seems to be pretty awkward. :/
One thing that is still missing from that test is that if you build
back-ldap as a module, you need to load it before opening a back-meta
database, in order load the requested symbols. I'm fixing this right now.
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Email: ando(a)sys-net.it
-----------------------------------
15 years, 3 months
