On Thu, 20 Jan 2011, Howard Chu wrote:
> timo.aaltonen(a)aalto.fi wrote:
>> Hi
>>
>> Here's some information that Stephen asked would be of use. There is
>> one forest, one domain, but three sites in the layout. The functional
>> level of the forest and the domain is W2008, but the servers have 2008R2.
>>
>> And the full backtrace of the hung process:
>
>> #3 0x00007f8f652f3bcb in ldap_pvt_thread_mutex_lock
>> (mutex=…
[View More]0x7f8f6553fc80)
>> at /tmp/buildd/openldap-2.4.23/libraries/libldap_r/thr_posix.c:296
>> No locals.
>> #4 0x00007f8f653010bf in ldap_sasl_interactive_bind_s (ld=0x2117c20,
>> dn=0x0,
>> mechs=0x210d530 "GSSAPI", serverControls=0x0, clientControls=0x0,
>> flags=2,
>> interact=0x7f8f61405120<sdap_sasl_interact>, defaults=0x2124a50) at
>> sasl.c:426
>> rc = -1921681294
>> smechs = 0x0
>
> This particular mutex seems kind of bogus to me; the code is from rev 1.31 in
> June 2001. Perhaps back then it was unsafe to have multiple SASL operations
> outstanding at once; I would expect that was only an issue in the Cyrus 1.5
> days and it should be safe now with Cyrus 2.x. We should probably just delete
> this mutex.
Ok, so by doing this:
--- openldap-2.4.23.orig/libraries/libldap/sasl.c
+++ openldap-2.4.23/libraries/libldap/sasl.c
@@ -421,10 +421,11 @@
{
int rc;
char *smechs = NULL;
-
+/*
#if defined( LDAP_R_COMPILE ) && defined( HAVE_CYRUS_SASL )
ldap_pvt_thread_mutex_lock( &ldap_int_sasl_mutex );
#endif
+*/
#ifdef LDAP_CONNECTIONLESS
if( LDAP_IS_UDP(ld) ) {
/* Just force it to simple bind, silly to make the user
--
.. the process doesn't hang anymore. But it still doesn't do what it's
supposed to, but that could be a bug in SSSD. I'll investigate further.
Thanks!
--
Timo Aaltonen
Systems Specialist, Aalto IT
[View Less]
hyc(a)symas.com wrote:
> timo.aaltonen(a)aalto.fi wrote:
>> Hi
>>
>> Here's some information that Stephen asked would be of use. There is
>> one forest, one domain, but three sites in the layout. The functional
>> level of the forest and the domain is W2008, but the servers have 2008R2.
>>
>> And the full backtrace of the hung process:
>
>> #3 0x00007f8f652f3bcb in ldap_pvt_thread_mutex_lock
>> (mutex=0x7f8f6553fc80)
>> …
[View More] at /tmp/buildd/openldap-2.4.23/libraries/libldap_r/thr_posix.c:296
>> No locals.
>> #4 0x00007f8f653010bf in ldap_sasl_interactive_bind_s (ld=0x2117c20,
>> dn=0x0,
>> mechs=0x210d530 "GSSAPI", serverControls=0x0, clientControls=0x0,
>> flags=2,
>> interact=0x7f8f61405120<sdap_sasl_interact>, defaults=0x2124a50) at
>> sasl.c:426
>> rc = -1921681294
>> smechs = 0x0
>
> This particular mutex seems kind of bogus to me; the code is from rev 1.31 in
> June 2001. Perhaps back then it was unsafe to have multiple SASL operations
> outstanding at once; I would expect that was only an issue in the Cyrus 1.5
> days and it should be safe now with Cyrus 2.x. We should probably just delete
> this mutex.
>
Although googling for "Cyrus sasl reentrancy" does not leave me with
warm/fuzzy feelings.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
[View Less]
timo.aaltonen(a)aalto.fi wrote:
> Hi
>
> Here's some information that Stephen asked would be of use. There is
> one forest, one domain, but three sites in the layout. The functional
> level of the forest and the domain is W2008, but the servers have 2008R2.
>
> And the full backtrace of the hung process:
> #3 0x00007f8f652f3bcb in ldap_pvt_thread_mutex_lock
> (mutex=0x7f8f6553fc80)
> at /tmp/buildd/openldap-2.4.23/libraries/libldap_r/thr_posix.c:296
…
[View More]> No locals.
> #4 0x00007f8f653010bf in ldap_sasl_interactive_bind_s (ld=0x2117c20,
> dn=0x0,
> mechs=0x210d530 "GSSAPI", serverControls=0x0, clientControls=0x0,
> flags=2,
> interact=0x7f8f61405120<sdap_sasl_interact>, defaults=0x2124a50) at
> sasl.c:426
> rc = -1921681294
> smechs = 0x0
This particular mutex seems kind of bogus to me; the code is from rev 1.31 in
June 2001. Perhaps back then it was unsafe to have multiple SASL operations
outstanding at once; I would expect that was only an issue in the Cyrus 1.5
days and it should be safe now with Cyrus 2.x. We should probably just delete
this mutex.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
[View Less]
On Thu, 20 Jan 2011, Howard Chu wrote:
> timo.aaltonen(a)aalto.fi wrote:
>> Hi
>>
>> Here's some information that Stephen asked would be of use. There is
>> one forest, one domain, but three sites in the layout. The functional
>> level of the forest and the domain is W2008, but the servers have 2008R2.
>>
>> And the full backtrace of the hung process:
>
> Thanks, but this trace is from 2.4.21, which is obsolete. Please use the
> …
[View More]current release (2.4.23) since the relevant code has changed. There is no
> point in us spending time tracking down issues in non-existent code.
Not true, I backported 2.4.23 from natty, and made it build in lucid
pbuilder.
nexus6 sssd # apt-cache policy libldap-2.4-2
libldap-2.4-2:
Installed: 2.4.23-6ubuntu4aalto1
Candidate: 2.4.23-6ubuntu4aalto1
Version table:
*** 2.4.23-6ubuntu4aalto1 0
100 /var/lib/dpkg/status
2.4.21-0ubuntu5.3 0
500 http://ubuntu.hut.fi/ubuntu/ lucid-updates/main Packages
2.4.21-0ubuntu5.2 0
500 http://ubuntu.hut.fi/ubuntu/ lucid-security/main Packages
2.4.21-0ubuntu5 0
500 http://ubuntu.hut.fi/ubuntu/ lucid/main Packages
I believe there is no reason to rebuild sssd against that, since they are
ABI compatible?
--
Timo Aaltonen
Systems Specialist, Aalto IT
[View Less]
hyc(a)symas.com wrote:
> timo.aaltonen(a)aalto.fi wrote:
>> Hi
>>
>> Here's some information that Stephen asked would be of use. There is
>> one forest, one domain, but three sites in the layout. The functional
>> level of the forest and the domain is W2008, but the servers have 2008R2.
>>
>> And the full backtrace of the hung process:
>
> Thanks, but this trace is from 2.4.21, which is obsolete. Please use the
> current release (2.…
[View More]4.23) since the relevant code has changed. There is no
> point in us spending time tracking down issues in non-existent code.
And, one more time: please use a debug build, like I asked in my first reply.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
[View Less]
timo.aaltonen(a)aalto.fi wrote:
> Hi
>
> Here's some information that Stephen asked would be of use. There is
> one forest, one domain, but three sites in the layout. The functional
> level of the forest and the domain is W2008, but the servers have 2008R2.
>
> And the full backtrace of the hung process:
Thanks, but this trace is from 2.4.21, which is obsolete. Please use the
current release (2.4.23) since the relevant code has changed. There is no
point in us …
[View More]spending time tracking down issues in non-existent code.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
[View Less]
jorge.perez.burgos(a)ericsson.com wrote:
> Full_Name: Jorge Perez Burgos
> Version: 2.4.21
> OS: linux
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (195.235.15.243)
>
>
> I'd suggest to introduce a "subtree-include" directive, mutually exclusive with
> "subtree-exclude", with different syntaxes, like:
>
> "[dn[.<style>]:]<pattern>"
>
> where <style> can be "subtree" or "regex" (other styles like "exact",
> "…
[View More]onelevel", "subordinate" could make sense but would be of limited usefulness);
> so, for example
>
> "dn.subtree:<dn>" ("dn.subtree" implicit for backward compatibility)
> "dn.regex:<pattern>"
>
> The "dn.<style>:" prefix is consistent with other features like ACLs, limits and
> so. There's ITS#5877 open about making this uniform across slapd for all
> features.
>
> Multiple patterns could be defined; the first that matches would stop execution.
> If configured as "subtree-exclude", a match would qualify the target as
> "non-candidate" (current behavior for "subtree-exclude"). If configured as
> "subtree-include", a match would qualify the target as "candidate".
Jorge and I discussed this off-line; suggestions are welcome, otherwise
I'd implement it this way right now with ad-hoc code, and eventually
turn it into a generally useful feature that could be reused in ACLs,
limits, authz, and in other to-be-defined features.
p.
[View Less]
hyc(a)symas.com writes:
> Looks like libldap needs to be changed to actually record the tag of the
> outgoing requests. (It ought to do so anyway, and probably should return a
> ProtocolError result if it receives a response message whose tag doesn't match
> its request type.)
Yes. OpenLDAP is too trunsting of incoming PDUs to be valid.
...as an option, if this would be noticeable for a lot of users. Users
who Just Want Their Programs To Work without OpenLDAP breaking them, …
[View More]and
won't be interested in "finger-pointing" against someone else's servers.
--
Hallvard
[View Less]
Full_Name: Jorge Perez Burgos
Version: 2.4.21
OS: linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (195.235.15.243)
I'd suggest to introduce a "subtree-include" directive, mutually exclusive with
"subtree-exclude", with different syntaxes, like:
"[dn[.<style>]:]<pattern>"
where <style> can be "subtree" or "regex" (other styles like "exact",
"onelevel", "subordinate" could make sense but would be of limited usefulness);
so, for example
"dn.subtree:<dn…
[View More]>" ("dn.subtree" implicit for backward compatibility)
"dn.regex:<pattern>"
The "dn.<style>:" prefix is consistent with other features like ACLs, limits and
so. There's ITS#5877 open about making this uniform across slapd for all
features.
Multiple patterns could be defined; the first that matches would stop execution.
If configured as "subtree-exclude", a match would qualify the target as
"non-candidate" (current behavior for "subtree-exclude"). If configured as
"subtree-include", a match would qualify the target as "candidate".
[View Less]