openldap-bugs July 2012

openldap-bugs@openldap.org

19 participants
47 discussions

Re: (ITS#7225) back-monitor/ldap crash in test020-proxycache
by ondrej.kuznik＠acision.com 25 Jul '12

25 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have noticed the ITS has not been updated after Pierangelo commited ce54dabb1b69c5b310cfc4ff689bc339f3256e22 and still lists this ITS as broken. Currently back-ldap in master is buildable and passes the relevant tests in the test suite and my manual tests. - -- Ondrej Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlAQFJIACgkQ9GWxeeH+cXtjgACcDdbtxso5VaK6OjwZ2CsQETTf kR8AniMzHr3uCExS5JugvmRCI5F14RCi =EloX -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.

1 0

Re: (ITS#7182) back-ldap monitoring improvements
by ondrej.kuznik＠acision.com 25 Jul '12

25 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/07/2012 12:52 PM, h.b.furuseth(a)usit.uio.no wrote: > Howard Chu wrote: >> Also, you're using monitor_entry_stub() directly in the back-ldap >> code. It is forbidden for modules to directly reference each >> other's symbols. If you need this function, add it to >> monitor_extra_t first and call it through there. > > Thus, currently './configure --enable-ldap --disable-monitor' does > not compile in master. I have noticed the ITS has not been updated after Pierangelo commited 11acc75e9ff31ae52b3b8c94b63189b51a764c01 and still lists this ITS as broken. Currently back-ldap in master is buildable and passes the relevant tests in the test suite and my manual tests. - -- Ondrej Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlAQFCAACgkQ9GWxeeH+cXshQwCdHRGaMyIOCKQk1jVhZ+S40b9R Hl8Ani1snr8svKOInMCEWL69l6EzNRHW =1RuS -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.

1 0

Re: (ITS#7336) Ldapmodify crashes slapd when updating olcTLSVerifyClient attribute via TLS authentication
by quanah＠zimbra.com 25 Jul '12

25 Jul '12

--On Wednesday, July 25, 2012 12:26 PM +0000 martin.bozic(a)gmail.com wrote: > Full_Name: Martin Bozic > Version: 2.4.23 > OS: CentOS 6.3 > URL: http://pastebin.com/hkPEcBgw > Submission from: (NULL) (2001:1470:f800::370) When filing a bug report, please use the latest version of OpenLDAP, otherwise your report is likely to be ignored. Particularly in this case, given the antiquity of 2.4.23. I would note that there have been numerous, significant fixes to the MozNSS support in OpenLDAP, which is what RHEL chose to link OpenLDAP to instead of the more stable OpenSSL. You may want to look at using saner packages, such as <http://ltb-project.org/wiki/download> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7336) Ldapmodify crashes slapd when updating olcTLSVerifyClient attribute via TLS authentication
by martin.bozic＠gmail.com 25 Jul '12

25 Jul '12

Full_Name: Martin Bozic Version: 2.4.23 OS: CentOS 6.3 URL: http://pastebin.com/hkPEcBgw Submission from: (NULL) (2001:1470:f800::370) Hello, I've come across a bug that it's not critical but bug none the less. When I'm trying to modify olcTLSVerifyClient via ldapmodify slapd crashes (segmentation fault). Via EXTERNAL everything works without a hitch: ldapmodify -Y EXTERNAL -H ldapi:/// << EOF dn: cn=config changetype: modify replace: olcTLSVerifyClient olcTLSVerifyClient: demand EOF Via TLS connection slapd crashes: ldapmodify -x -H ldaps://ldap.test.com -D cn=admin,cn=config -W << EOF dn: cn=config changetype: modify replace: olcTLSVerifyClient olcTLSVerifyClient: never EOF Configuration in cn=config: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/share/openldap-servers/slapd.conf.obsolete olcConfigDir: /etc/openldap/slapd.d/ olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcDisallows: bind_anon olcGentleHUP: FALSE olcIdleTimeout: 30 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 128 olcLogLevel: config stats shell filter olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noanonymous,noplain olcSecurity: ssf=128 olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificateFile: /etc/openldap/cacerts/ca.crt olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: /etc/openldap/cacerts/slapd.crt olcTLSCertificateKeyFile: /etc/openldap/cacerts/slapd.key olcTLSCipherSuite: HIGH:MEDIUM:-SSLv2 olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 The slapd debug log is pasted in the URL below. Regards, Martin Bozic

1 0

(ITS#7335) Error in slapo-refint man page
by riggs＠umn.edu 24 Jul '12

24 Jul '12

Full_Name: Benjamin Riggs Version: 2.4.23 OS: http://ftp.scientificlinux.org/linux/scientific/6x/i386/os/Packages/openlda… URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (128.101.155.71) The slapo-refint man page has only documentation for slapd.conf, not slapd-config. Normally this wouldn't be a problem, but the configuration keywords are not the usual map of simply adding 'olc': refint_attributes is changed to olcRefintAttribute (no 's'!) refint_nothing is changed to olcRefintNothing refint_modifiersname is changed to olcRefintModifiersName

1 0

Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch
by openldap＠stormcloud9.net 24 Jul '12

24 Jul '12

Sent: Tue Jul 24 2012 12:15:27 GMT-0400 (EDT) From: quanah(a)zimbra.com To: openldap-its(a)openldap.org Subject: Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch > Which of the three TLS software packages is your openldap build linked to? > > OpenSSL > MozNSS > GnuTLS > > Thanks, > Quanah > OpenSSL

1 0

Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch
by quanah＠zimbra.com 24 Jul '12

24 Jul '12

--On Friday, July 20, 2012 10:06 PM +0000 openldap(a)stormcloud9.net wrote: > I have also tried tls_reqcert=allow with the same result. And in a > desperate attempt, I also tried setting tls_cacert=/dev/null in the hope > that if it couldn't verify the cert it wouldnt check the hostname against > the cert subject, but this failed as well. Which of the three TLS software packages is your openldap build linked to? OpenSSL MozNSS GnuTLS Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7332) Patch to build using Microsoft Visual Studio
by hyc＠symas.com 23 Jul '12

23 Jul '12

Thanks for the patch, applied to git master. mbooth(a)apache.org wrote: > Full_Name: Mat Booth > Version: 2.4.31 > OS: Windows XP > URL: http://people.apache.org/~mbooth/0001-Changes-required-to-build-with-Micros… > Submission from: (NULL) (77.86.30.139) > > > The provided patch makes three changes that were necessary for me to build > liblber and libldap on Windows using Microsoft Visual Studio. > > > * include/ac/socket.h > The type socklen_t is defined in ws2tcpip.h on the Windows platform, so include > this header when including winsock2.h > > * libraries/libldap/ldap-int.h > The struct timeval is defined in winsock.h or winsock2.h on the Windows platform > so include ac/socket.h when _WIN32 is defined (The comment in winsock2.h > literary says "taken from the BSD file sys/time.h") > > * libraries/libldap/util-int.c > The error code EAI_SYSTEM is not defined at all on the Windows platform, so only > use it if it's defined. > > > > The attached patch file is derived from OpenLDAP Software. All of the > modifications to OpenLDAP Software represented in the following patch(es) were > developed by Mat Booth <mbooth(a)apache.org>. I have not assigned rights and/or > interest in this work to any party. > > I, Mat Booth, hereby place the following modifications to OpenLDAP Software (and > only these modifications) into the public domain. Hence, these modifications may > be freely used and/or redistributed for any purpose with or without attribution > and/or other notice. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7332) Patch to build using Microsoft Visual Studio
by mbooth＠apache.org 23 Jul '12

23 Jul '12

Full_Name: Mat Booth Version: 2.4.31 OS: Windows XP URL: http://people.apache.org/~mbooth/0001-Changes-required-to-build-with-Micros… Submission from: (NULL) (77.86.30.139) The provided patch makes three changes that were necessary for me to build liblber and libldap on Windows using Microsoft Visual Studio. * include/ac/socket.h The type socklen_t is defined in ws2tcpip.h on the Windows platform, so include this header when including winsock2.h * libraries/libldap/ldap-int.h The struct timeval is defined in winsock.h or winsock2.h on the Windows platform so include ac/socket.h when _WIN32 is defined (The comment in winsock2.h literary says "taken from the BSD file sys/time.h") * libraries/libldap/util-int.c The error code EAI_SYSTEM is not defined at all on the Windows platform, so only use it if it's defined. The attached patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Mat Booth <mbooth(a)apache.org>. I have not assigned rights and/or interest in this work to any party. I, Mat Booth, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7331) [PATCH] MozNSS: ignore untrusted issuer error when verifying server certificate
by jvcelak＠redhat.com 21 Jul '12

21 Jul '12

I forgot to add: The patch deals only with a local certificate validation. It does not have any effect on a remote peer's certificate verification.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs July 2012