openldap-bugs May 2009

openldap-bugs@openldap.org

42 participants
159 discussions

Re: (ITS#6103) canceled operations do not respond
by h.b.furuseth＠usit.uio.no 27 May '09

27 May '09

The send_ldap_response() fix is still incomplete: When rc == LDAP_CANCELLED, the function should not send sr_matched, sr_text, sr_ref, and sr_ctrls. Looking at how Abandon works, it seems slap_cleanup_play() should still see them if they are not sent? Note, not just when the function itself sets rc = LDAP_CANCELLED, since syncprov can set rs->sr_err = LDAP_CANCELLED too. Which also suggests the assert( rs->sr_err == LDAP_REFERRAL ) when sr_ref != NULL is rather dubious. Maybe sr_ref should just be ignored when sending something else than LDAP_REFERRAL. Also, this: rc = rs->sr_err; if ( rc == SLAPD_ABANDON && op->o_cancel ) rc = LDAP_CANCELLED; will send a negative result code (SLAPD_ABANDON) if !o_cancel. I guess it should be if ( rc == SLAPD_ABANDON ) { if ( !op->o_cancel ) goto <cleanup or clean2>; rc = LDAP_CANCELLED; } While we're at it, I suggest to generalize this to avoid sending result codes < 0. Send LDAP_OTHER instead. That's ITS#5328 again. -- Hallvard

1 0

Re: (ITS#6108) unique overlay and rootdn
by hyc＠symas.com 27 May '09

27 May '09

mfn(a)fs-etit.de wrote: > Full_Name: Christopher Dyck > Version: 2.4.11 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (130.83.183.3) > > > I found a strange behavior in the unique overlay. > > unique overlay only works, when a rootdn is specified in the slapd.conf, because > the unique_search function uses the rootdn for searching. (took me hours to > determine why my configuration didn't do it's job) > > Isn't it more reasonable to use the dn with which the add or modify is > performed? Definitely not. The user performing the write may not have sufficient access to see all of the instances of the attribute in question. > Or mention this circumstance at least in the manpage?! Probably. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#6141 published: SECURITY: Dynamic configuration perfomance issue
by openldap-its＠OpenLDAP.org 27 May '09

27 May '09

Private ITS#6141 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=6141

1 0

ITS#6143 published: SECURITY: Dynamic configuration perfomance issue
by openldap-its＠OpenLDAP.org 27 May '09

27 May '09

Private ITS#6143 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=6143

1 0

(ITS#6148) Need smbk5pwd to support MIT KDC
by hyc＠OpenLDAP.org 27 May '09

27 May '09

Full_Name: Howard Chu Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.67.104.102) Submitted by: hyc This is a reminder to me to investigate how the MIT KDC's LDAP backend works, and how to manage password synchronization there.

1 0

(ITS#6147) slapd should explicitly configure SASL auxprop
by hyc＠OpenLDAP.org 26 May '09

26 May '09

Full_Name: Howard Chu Version: 2.4.16/HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.67.104.110) Submitted by: hyc we need a config option for controlling which auxprop plugins the Cyrus SASL library uses, and it should default to just "slapd". See ITS#6056, the sasldb plugin causes problems and generally isn't useful anyway. (And yes, we probably need to investigate why those problems arise.) Also see ITS#6129, we should take more explicit steps to prevent the ldapdb auxprop from loading.

1 0

(ITS#6146) Note output format in ldapsearch man page DESCRIPTION
by rra＠stanford.edu 26 May '09

26 May '09

Full_Name: Russ Allbery Version: 2.4.11 OS: Debian URL: Submission from: (NULL) (171.66.157.16) A Debian user had some difficulty finding the output format of ldapsearch in the current man page. It's there, under -L, but it's not noted in the DESCRIPTION section. Would it be reasonable to add the sentence: The attributes are displayed using an extended version of LDIF. to the end of the DESCRIPTION section?

1 0

Re: (ITS#6145) Resource leaks shown when running cppcheck against openldap
by hyc＠symas.com 26 May '09

26 May '09

palbert1(a)yahoo.com wrote: > Full_Name: Paul Albert > Version: 2.4.16 > OS: SUSE Linux > URL: N/A > Submission from: (NULL) (198.24.6.168) > > > As part of working on a new project, I'm running cppcheck against various pieces > of code that we'll be using. I downloaded cppcheck version 1.32 and ran it > against open LDAP version 2.4.16. cppcheck reported 18 file descriptor/memory > leaks in the open LDAP code base in addition to 2 bad programming practices > (labeled as style). Visual inspection of the code verified these errors. > > The results are shown below and can be verified by running cppcheck against the > open ldap code: None of which matters, since these are all one-shot commands... > > sleepy code/openldap-2.4.16> ../cppcheck-1.32/cppcheck -q . > [./clients/tools/ldapdelete.c:230]: (error) Resource leak: fp > [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: entrydn > [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: rdn > [./clients/tools/ldapmodrdn.c:233]: (error) Resource leak: fp > [./contrib/slapd-modules/dsaschema/dsaschema.c:260]: (error) Memory leak: > saveline > [./libraries/libldap_r/thr_debug.c:575]: (error) Memory leak: t > [./libraries/liblutil/getpass.c:128]: (style) Found 'scanf'. You should use > 'fgets' instead > [./libraries/liblutil/getpass.c:153]: (style) Found 'scanf'. You should use > 'fgets' instead > [./servers/slapd/slapi/slapi_utils.c:2511]: (error) Wrong assignement of an > auto-variable to an effective parameter of a function > [./tests/progs/slapd-addel.c:192]: (error) Memory leak: manager > [./tests/progs/slapd-addel.c:192]: (error) Memory leak: filename > [./tests/progs/slapd-modify.c:194]: (error) Memory leak: manager > [./tests/progs/slapd-modify.c:194]: (error) Memory leak: entry > [./tests/progs/slapd-modrdn.c:177]: (error) Memory leak: manager > [./tests/progs/slapd-read.c:227]: (error) Memory leak: manager > [./tests/progs/slapd-read.c:227]: (error) Memory leak: entry > [./tests/progs/slapd-read.c:227]: (error) Memory leak: filter > [./tests/progs/slapd-search.c:250]: (error) Memory leak: manager > [./tests/progs/slapd-search.c:250]: (error) Memory leak: sbase > [./tests/progs/slapd-search.c:250]: (error) Memory leak: filter > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6056) Samba4 breaks OpenLDAP over ldapi
by abartlet＠samba.org 26 May '09

26 May '09

--=-Qa9s282ZNKloqhE3QHt5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2009-05-26 at 15:40 +0200, Michael Str=C3=B6der wrote: > abartlet(a)samba.org wrote: > > Samba4 always uses SASL credentials these days (trying to avoid simple > > binds). >=20 > libsasldb2.so is not required for a SASL bind with password-based > mechanism. You can store the passwords in attribute userPassword (in > clear-text). So the security consideration is more about password > storage than SASL vs. simple bind on the wire. Which we already use. Regardless, Howard's great detective work shows it still gets in the way.=20 > > Perhaps it's time to investigate EXTERNAL >=20 > That would be good anyway since in Samba4 the result of standard > provision is LDAPI access anyway. So you could directly map the Unix > user smbd is running as (root?) with authz-regexp to directory user > samba-admin. Well, we already discussed that.. ;-) We did. =20 Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com --=-Qa9s282ZNKloqhE3QHt5 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBKHJj0z4A8Wyi0NrsRAqkfAJ4jsghUdEiUTnOHsmG2Bg9njDe6agCeN4hF aNRmEnt5qtFNRw7WtnaXqto= =midd -----END PGP SIGNATURE----- --=-Qa9s282ZNKloqhE3QHt5--

1 0

(ITS#6145) Resource leaks shown when running cppcheck against openldap
by palbert1＠yahoo.com 26 May '09

26 May '09

Full_Name: Paul Albert Version: 2.4.16 OS: SUSE Linux URL: N/A Submission from: (NULL) (198.24.6.168) As part of working on a new project, I'm running cppcheck against various pieces of code that we'll be using. I downloaded cppcheck version 1.32 and ran it against open LDAP version 2.4.16. cppcheck reported 18 file descriptor/memory leaks in the open LDAP code base in addition to 2 bad programming practices (labeled as style). Visual inspection of the code verified these errors. The results are shown below and can be verified by running cppcheck against the open ldap code: sleepy code/openldap-2.4.16> ../cppcheck-1.32/cppcheck -q . [./clients/tools/ldapdelete.c:230]: (error) Resource leak: fp [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: entrydn [./clients/tools/ldapmodrdn.c:233]: (error) Memory leak: rdn [./clients/tools/ldapmodrdn.c:233]: (error) Resource leak: fp [./contrib/slapd-modules/dsaschema/dsaschema.c:260]: (error) Memory leak: saveline [./libraries/libldap_r/thr_debug.c:575]: (error) Memory leak: t [./libraries/liblutil/getpass.c:128]: (style) Found 'scanf'. You should use 'fgets' instead [./libraries/liblutil/getpass.c:153]: (style) Found 'scanf'. You should use 'fgets' instead [./servers/slapd/slapi/slapi_utils.c:2511]: (error) Wrong assignement of an auto-variable to an effective parameter of a function [./tests/progs/slapd-addel.c:192]: (error) Memory leak: manager [./tests/progs/slapd-addel.c:192]: (error) Memory leak: filename [./tests/progs/slapd-modify.c:194]: (error) Memory leak: manager [./tests/progs/slapd-modify.c:194]: (error) Memory leak: entry [./tests/progs/slapd-modrdn.c:177]: (error) Memory leak: manager [./tests/progs/slapd-read.c:227]: (error) Memory leak: manager [./tests/progs/slapd-read.c:227]: (error) Memory leak: entry [./tests/progs/slapd-read.c:227]: (error) Memory leak: filter [./tests/progs/slapd-search.c:250]: (error) Memory leak: manager [./tests/progs/slapd-search.c:250]: (error) Memory leak: sbase [./tests/progs/slapd-search.c:250]: (error) Memory leak: filter

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs May 2009