openldap-bugs February 2010

openldap-bugs@openldap.org

28 participants
69 discussions

Re: (ITS#6465) startup error after converting to slapd-config
by rhafer＠suse.de 03 Feb '10

03 Feb '10

Am Mittwoch 03 Februar 2010 13:10:04 schrieb gerard.ranke(a)kmt.hku.nl: > Hi Ralf, > > Ralf Haferkamp wrote: > > A fix is in HEAD now (servers/slapd/config.c rev 1.513) please test. > > I'm afraid I need a little guidance here. To test the fix, I replaced > the config.c from 2.4.21 with rev 1.513, but I got the errors below. > I'm guessing I'm being naive to think this would work, and that I > need to d'l the complete HEAD to compile, but how would I do that? Either that. Or you could get the diff from 1.512 to 1.153 from cvs and apply that on your 2.4.21 tree. > Cvs needs a module name, and I tried 'HEAD' and > 'OPENLDAP_REL_ENG_2_4' but these names couldn't be found. I couldn't > find anything else in the devel faq and website that seems like a > candidate for a module name, so could you please give me some > pointers? You can find instruction howto checkout OpenLDAP from cvs here: http://www.openldap.org/software/repo.html#AnonCVS Further up on that page you will also find a table listing valid modules (you want "ldap"). -- Ralf

1 0

Re: (ITS#6465) startup error after converting to slapd-config
by gerard.ranke＠kmt.hku.nl 03 Feb '10

03 Feb '10

Hi Ralf, Ralf Haferkamp wrote: > A fix is in HEAD now (servers/slapd/config.c rev 1.513) please test. I'm afraid I need a little guidance here. To test the fix, I replaced the config.c from 2.4.21 with rev 1.513, but I got the errors below. I'm guessing I'm being naive to think this would work, and that I need to d'l the complete HEAD to compile, but how would I do that? Cvs needs a module name, and I tried 'HEAD' and 'OPENLDAP_REL_ENG_2_4' but these names couldn't be found. I couldn't find anything else in the devel faq and website that seems like a candidate for a module name, so could you please give me some pointers? Many thanks in advance, gerard cc-1020 c99: ERROR File = config.c, Line = 1222 The identifier "slap_keepalive" is undefined. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1020 c99: ERROR File = config.c, Line = 1222 The identifier "sk" is undefined. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1029 c99: ERROR File = config.c, Line = 1222 An expression is expected at this point. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1065 c99: ERROR File = config.c, Line = 1222 A semicolon is expected at this point. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1020 c99: ERROR File = config.c, Line = 1238 The identifier "slap_keepalive" is undefined. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1020 c99: ERROR File = config.c, Line = 1238 The identifier "sk" is undefined. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1029 c99: ERROR File = config.c, Line = 1238 An expression is expected at this point. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1065 c99: ERROR File = config.c, Line = 1238 A semicolon is expected at this point. slap_keepalive *sk = (slap_keepalive *)bc; ^ cc-1065 c99: ERROR File = config.c, Line = 1239 A semicolon is expected at this point. slap_keepalive sk2; ^ cc-1020 c99: ERROR File = config.c, Line = 1242 The identifier "sk2" is undefined. sk2.sk_idle = 0; ^ cc-1020 c99: ERROR File = config.c, Line = 1246 The identifier "sk2" is undefined. sk2.sk_idle = strtol( s, &next, 10 ); ^ cc-1020 c99: ERROR File = config.c, Line = 1259 The identifier "sk2" is undefined. sk2.sk_probes = 0; ^ cc-1020 c99: ERROR File = config.c, Line = 1263 The identifier "sk2" is undefined. sk2.sk_probes = strtol( s, &next, 10 ); ^ cc-1020 c99: ERROR File = config.c, Line = 1276 The identifier "sk2" is undefined. sk2.sk_interval = 0; ^ cc-1020 c99: ERROR File = config.c, Line = 1280 The identifier "sk2" is undefined. sk2.sk_interval = strtol( s, &next, 10 ); ^ cc-1020 c99: ERROR File = config.c, Line = 1290 The identifier "sk2" is undefined. *sk = sk2; ^ cc-1565 c99: ERROR File = config.c, Line = 1336 The struct "slap_bindconf" has no field "sb_keepalive". { BER_BVC("keepalive="), offsetof(slap_bindconf, sb_keepalive), 'x', 0, (slap_verbmasks *)slap_keepalive_parse }, ^ ( warnings skipped... ) cc-1565 c99: ERROR File = config.c, Line = 1889 The struct "slap_bindconf" has no field "sb_keepalive". if ( sb->sb_keepalive.sk_idle ) { ^ cc-1565 c99: ERROR File = config.c, Line = 1890 The struct "slap_bindconf" has no field "sb_keepalive". ldap_set_option( ld, LDAP_OPT_X_KEEPALIVE_IDLE, &sb->sb_keepalive.sk_idle ); ^ cc-1565 c99: ERROR File = config.c, Line = 1893 The struct "slap_bindconf" has no field "sb_keepalive". if ( sb->sb_keepalive.sk_probes ) { ^ cc-1565 c99: ERROR File = config.c, Line = 1894 The struct "slap_bindconf" has no field "sb_keepalive". ldap_set_option( ld, LDAP_OPT_X_KEEPALIVE_PROBES, &sb->sb_keepalive.sk_probes ); ^ cc-1565 c99: ERROR File = config.c, Line = 1897 The struct "slap_bindconf" has no field "sb_keepalive". if ( sb->sb_keepalive.sk_interval ) { ^ cc-1565 c99: ERROR File = config.c, Line = 1898 The struct "slap_bindconf" has no field "sb_keepalive". ldap_set_option( ld, LDAP_OPT_X_KEEPALIVE_INTERVAL, &sb->sb_keepalive.sk_interval );

1 0

Re: (ITS#6469) push replication entryCSN of database suffix out of sync
by rhafer＠suse.de 03 Feb '10

03 Feb '10

Am Mittwoch 03 Februar 2010 09:39:19 schrieb hyc(a)symas.com: > rhafer(a)suse.de wrote: > > Am Dienstag 02 Februar 2010 23:30:23 schrieb hyc(a)symas.com: > >> But how did the suffix entry get created without an entryCSN in the > >> first place? The MOD that updates the contextCSN doesn't happen > >> until after the suffix entry already exists. > > > > It wasn't created without an entryCSN. It always had one. But the > > MOD to update the contextCSN (coming from the provider) doesn't > > contain one. So bdb_modify() will call slap_mods_opattrs() to add > > entryCSN to the MOD operation. The easiest fix is probably to never > > touch the opattrs if "updatedn" is doing MODs, though I am not yet > > sure if it might break something. Currently my fix (not committed > > yet) only skips the slap_mods_opattrs() step if "updatedn" it is > > doing a MOD on contextCSN. > > Ah, got it. Yes, sounds like your fix is fine. Do you think it's fine to always skip slap_mods_opattrs() if "updatedn" is writing? Or should I check for contextCSN MODs specifically? > Historically the updatedn user (e.g. slurpd) has always provided all of > the operational attributes in its updates. -- Ralf

1 0

Re: (ITS#6469) push replication entryCSN of database suffix out of sync
by hyc＠symas.com 03 Feb '10

03 Feb '10

rhafer(a)suse.de wrote: > Am Dienstag 02 Februar 2010 23:30:23 schrieb hyc(a)symas.com: >> But how did the suffix entry get created without an entryCSN in the >> first place? The MOD that updates the contextCSN doesn't happen until >> after the suffix entry already exists. > It wasn't created without an entryCSN. It always had one. But the MOD to > update the contextCSN (coming from the provider) doesn't contain one. So > bdb_modify() will call slap_mods_opattrs() to add entryCSN to the MOD > operation. The easiest fix is probably to never touch the opattrs if > "updatedn" is doing MODs, though I am not yet sure if it might break > something. Currently my fix (not committed yet) only skips the > slap_mods_opattrs() step if "updatedn" it is doing a MOD on contextCSN. Ah, got it. Yes, sounds like your fix is fine. Historically the updatedn user (e.g. slurpd) has always provided all of the operational attributes in its updates. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6469) push replication entryCSN of database suffix out of sync
by rhafer＠suse.de 03 Feb '10

03 Feb '10

Am Dienstag 02 Februar 2010 23:30:23 schrieb hyc(a)symas.com: > ralf(a)OpenLDAP.org wrote: > > Full_Name: Ralf Haferkamp > > Version: RE24, HEAD > > OS: > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (89.166.208.247) > > Submitted by: ralf > > > > > > When using push-based replication (syncrepl-proxy) the entryCSN of > > the consumer's server's suffix entry (the one that also holds the > > contextCSN Attribute) is not in sync with the value on the > > provider. (Other operational Attributes are out of sync as well) > > > > This is because the MOD Operation to update the contextCSN (sent by > > the provider) does not contain any other operational Attributes. > > That causes the consumer to add those attributes itself. > > > > I guess the problem is mostly cosmetic, but I'll submit a fix > > anyway. (not calling slap_mods_opattrs() if the updatedn modifies > > "contextCSN") > > But how did the suffix entry get created without an entryCSN in the > first place? The MOD that updates the contextCSN doesn't happen until > after the suffix entry already exists. It wasn't created without an entryCSN. It always had one. But the MOD to update the contextCSN (coming from the provider) doesn't contain one. So bdb_modify() will call slap_mods_opattrs() to add entryCSN to the MOD operation. The easiest fix is probably to never touch the opattrs if "updatedn" is doing MODs, though I am not yet sure if it might break something. Currently my fix (not committed yet) only skips the slap_mods_opattrs() step if "updatedn" it is doing a MOD on contextCSN. -- Ralf

1 0

Re: (ITS#6469) push replication entryCSN of database suffix out of sync
by hyc＠symas.com 02 Feb '10

02 Feb '10

ralf(a)OpenLDAP.org wrote: > Full_Name: Ralf Haferkamp > Version: RE24, HEAD > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (89.166.208.247) > Submitted by: ralf > > > When using push-based replication (syncrepl-proxy) the entryCSN of the > consumer's server's suffix entry (the one that also holds the contextCSN > Attribute) is not in sync with the value on the provider. (Other operational > Attributes are out of sync as well) > > This is because the MOD Operation to update the contextCSN (sent by the > provider) does not contain any other operational Attributes. That causes the > consumer to add those attributes itself. > > I guess the problem is mostly cosmetic, but I'll submit a fix anyway. (not > calling slap_mods_opattrs() if the updatedn modifies "contextCSN") > But how did the suffix entry get created without an entryCSN in the first place? The MOD that updates the contextCSN doesn't happen until after the suffix entry already exists. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6432) PATCH: MozNSS crypto (tls_m.c) - support InitContext, improved PEM support
by rmeggins＠redhat.com 02 Feb '10

02 Feb '10

New and improved patch, to address issues mentioned by Howard, and to clean up some memory leaks. ftp://ftp.openldap.org/incoming/openldap-2.4.21-tls_m_c-InitContext-PEM-201… Note: This new version depends on Mozilla NSS 3.12.6 (currently unreleased) and currently unreleased patches of PEM NSS in order to avoid a couple of memory leaks.

1 0

(ITS#6469) push replication entryCSN of database suffix out of sync
by ralf＠OpenLDAP.org 02 Feb '10

02 Feb '10

Full_Name: Ralf Haferkamp Version: RE24, HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.208.247) Submitted by: ralf When using push-based replication (syncrepl-proxy) the entryCSN of the consumer's server's suffix entry (the one that also holds the contextCSN Attribute) is not in sync with the value on the provider. (Other operational Attributes are out of sync as well) This is because the MOD Operation to update the contextCSN (sent by the provider) does not contain any other operational Attributes. That causes the consumer to add those attributes itself. I guess the problem is mostly cosmetic, but I'll submit a fix anyway. (not calling slap_mods_opattrs() if the updatedn modifies "contextCSN")

1 0

Re: (ITS#6468) ACLs in subordinate databases can be ignored
by rein＠OpenLDAP.org 02 Feb '10

02 Feb '10

On 02/02/2010 04:25 PM, Hallvard B Furuseth wrote: > Hold on. Is the current behavior self-consistent, i.e. one could call > it an undocumented feature? If so someone may have noticed this and > written their ACLs accordingly. It's not friendly to change the > meaning of existing installations' ACLs in the middle of RE24. > > OTOH if current behavior is broken even as a "feature", fix away. > E.g. if clients can choose which ACLs will apply in the subordinate > by picking a base DN inside vs outside the subordinate. From my analyzis of the problem, the subordinate ACLs are used in all cases except when syncprov desides which "live" modifications it should replicate to its consumers. Searching with the credentials used by the syncrepl consumer gives me the attributes and entries my subordinate ACLs allows, and they are replicated during the refresh phase. But access to entries and/or attributes being modified during the persistent phase are rejected. But yes, the change should be analyzed by somebody else before being included in a release. Rein

1 0

Re: (ITS#6468) ACLs in subordinate databases can be ignored
by h.b.furuseth＠usit.uio.no 02 Feb '10

02 Feb '10

Hold on. Is the current behavior self-consistent, i.e. one could call it an undocumented feature? If so someone may have noticed this and written their ACLs accordingly. It's not friendly to change the meaning of existing installations' ACLs in the middle of RE24. OTOH if current behavior is broken even as a "feature", fix away. E.g. if clients can choose which ACLs will apply in the subordinate by picking a base DN inside vs outside the subordinate. -- Hallvard

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs February 2010