openldap-bugs July 2012

openldap-bugs@openldap.org

19 participants
47 discussions

(ITS#7331) [PATCH] MozNSS: ignore untrusted issuer error when verifying server certificate
by jvcelak＠redhat.com 21 Jul '12

21 Jul '12

Full_Name: Jan Vcelak Version: git master OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-20120721-moznss-ignore-untrusted-is… Submission from: (NULL) (193.165.79.10) If a self-issued certificate in PEM format is used as a server certificate, the TLS context initialization can fail with SEC_ERROR_UNTRUSTED_ISSUER error. Unfortunately we cannot set trust flags of the server certificate loaded by MozNSS PEM module. This patch allows to ignore this error code. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7330) slapd mmr failure due to tls cert name mismatch
by openldap＠stormcloud9.net 20 Jul '12

20 Jul '12

I've come up with a few more critical details while trying to solve the issue. 1) If the other master is started first, when the local slapd starts, syncrepl connects and works fine. It only fails if the other master is started after the local slapd is running. 2) If I delete the specific olcSyncrepl attribute for one that is failing, and then add it back, syncrepl starts working fine. 3) After deleting and re-adding the olcSyncrepl attribute to make syncrepl work, if I stop and start the other master slapd, syncrepl starts failing again.

1 0

(ITS#7330) slapd mmr failure due to tls cert name mismatch
by openldap＠stormcloud9.net 20 Jul '12

20 Jul '12

Full_Name: Patrick Hemmer Version: 2.4.31 OS: RHEL 6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.238.31.70) I have 2 servers (version 2.4.31) in multi-master-replication behind a single IP. Whenever replication tries to start, it fails because the cert name does not match the hostname. ---- TLS: hostname (per5-unity-ldap02.mbox.net) does not match common name in certificate (unity-ldap.mbox.net). 5009c52e slap_client_connect: URI=ldap://per5-unity-ldap02.mbox.net Error, ldap_start_tls failed (-11) 5009c52e do_syncrepl: rid=523 rc -11 retrying (5 retries left) ---- However in the slapd configuration, I have the olcSyncrepl tls_reqcert parameter set to 'never' ---- dn: olcDatabase={3}hdb,cn=config olcSyncrepl: {0}rid=513 provider="ldap://per5-unity-ldap01.mbox.net" network-timeout=2 retry="1 10 10 60 60 +" keepalive="60:3:60" starttls=critical tls_reqcert=never bindmethod=simple timeout=2 binddn="uid=foo,cn=bar" credentials="baz" type=refreshAndPersist searchbase="dc=my,dc=domain" olcSyncrepl: {1}rid=523 provider="ldap://per5-unity-ldap02.mbox.net" network-timeout=2 retry="1 10 10 60 60 +" keepalive="60:3:60" starttls=critical tls_reqcert=never bindmethod=simple timeout=2 binddn="uid=foo,cn=bar" credentials="baz" type=refreshAndPersist searchbase="dc=my,dc=domain" ---- I have also tried tls_reqcert=allow with the same result. And in a desperate attempt, I also tried setting tls_cacert=/dev/null in the hope that if it couldn't verify the cert it wouldnt check the hostname against the cert subject, but this failed as well.

1 0

(ITS#7329) Bottleneck adding a single value to indexed multi-valued attribute
by mhardin＠symas.com 20 Jul '12

20 Jul '12

Full_Name: Matthew Hardin Version: 2.4.31 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (69.43.206.100) Opening at Howard Chu's request: When adding a single value to a multi-valued attribute that is indexed, slapd re-adds index entries for every value in the attribute. This is a bottleneck and the code to do this (per Howard) should be reworked.

1 0

(ITS#7328) slapcat fails silently with back-hdb/bdb
by quanah＠OpenLDAP.org 19 Jul '12

19 Jul '12

Full_Name: Quanah Gibson-Mount Version: 2.4 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.108.184.39) As reported in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673038, putting slapcat into a loop shows that it periodically fails to correctly dump an active database in full. We have also seen this at customer sites, when nightly backups are run. At the least, slapcat should return an error, so that failure can be caught and a new slapcat run.

1 0

(ITS#7327) [PATCH] smbk5pwd: error if crypto backend unsupported
by jvcelak＠redhat.com 19 Jul '12

19 Jul '12

Full_Name: Jan Vcelak Version: git master OS: Linux URL: ftp://ftp.openldap.org/incoming/jvcelak-20120719-smbk5pwd-error-if-crypto-b… Submission from: (NULL) (209.132.186.34) smbk5pwd overlay source code does not expect crypto backend other than OpenSSL or GnuTLS. When OpenLDAP si compiled with Mozilla NSS, Samba password hashes are not computed and the overlay returns uninitialized memory as the hash. This simple patch does not allow the smbk5pwd overlay to be compiled without OpenSSL or GnuTLS. Unfortunately we cannot add support for MozNSS, because MozNSS does not (and will not) implement MD4. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7325) Panic issue with slapd-perl
by aescanero＠gmail.com 19 Jul '12

19 Jul '12

If I reverse the commit f6b8103b789ae40234b0cb7574c1a9da4e5a1b21 only in add.c then the module runs perfecty. Thanks. 2012/7/19 Alejandro <aescanero(a)gmail.com>: > More information: > Test Module is: > package replicadorTEST; > > use strict; > use warnings; > use POSIX; > > sub new { > my $class = shift; > > my $this = {}; > bless $this, $class; > return $this; > } > > sub bind { > return 0; > } > > sub init { > return 0; > } > > sub search { > return 0; > } > > sub compare { > return 0; > } > > sub modify { > return 0; > } > > sub add { > return 0; > > } > > sub modrdn { > return 0; > } > > sub delete { > return 0; > } > > sub config { > return 0; > } > > 1; > > Try to add this (The problem only appear when try to add a DN): > dn: uid=test,o=XXXX,o=XXXX,c=XX > mailLocalAddress: test(a)test.es > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: inetLocalMailRecipient > objectClass: posixAccount > uid: test > mail: test(a)test.es > uidNumber: 600 > o: ceic > gidNumber: 600 > displayName: TEST > sn: TEST > cn: TEST > homeDirectory: /home/test > > And then I get: > 5007ee79 >>> dnPrettyNormal: <uid=test,o=XXXX,o=XXXX,c=XX> > => ldap_bv2dn(uid=test,o=XXXX,o=XXXX,c=XX,0) > <= ldap_bv2dn(uid=test,o=XXXX,o=XXXX,c=XX)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(uid=test,o=XXXX,o=XXXX,c=XX)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(uid=test,o=XXXX,o=XXXX,c=XX)=0 > 5007ee79 <<< dnPrettyNormal: <uid=test,o=XXXX,o=XXXX,c=XX>, > <uid=test,o=XXXX,o=XXXX,c=XX> > 5007ee79 conn=1000 op=1 ADD dn="uid=test,o=XXXX,o=XXXX,c=XX" > panic: sv_setpvn called with negative strlen. > > Thanks > > 2012/7/19 Alejandro <aescanero(a)gmail.com>: >> My main problem now is: >> How I can check the bad line of code if perl-slapd don't give me any >> usable error in 2.4.31 release? >> >> Thanks >> >> 2012/7/19 Howard Chu <hyc(a)symas.com>: >>> aescanero(a)gmail.com wrote: >>>> The problem was in the perl module with a uninitialized value, in >>>> 2.4.21 give the error Use of uninitialized value in concatenation (.) >>>> or string at /etc/openldap24/replicador.pm line 109, <DATA> line 275 >>>> but in 2.4.31 give me a panic. >>> >>> Sounds like a bug in your module then, and not an OpenLDAP software issue. >>> >>> -- >>> -- Howard Chu >>> CTO, Symas Corp. http://www.symas.com >>> Director, Highland Sun http://highlandsun.com/hyc/ >>> Chief Architect, OpenLDAP http://www.openldap.org/project/ >> >> >> >> -- >> Alejandro Escanero Blanco >> Consultor de sistemas basados en fuentes abiertas >> Desarrollador de FusionDirectory (http://www.fusiondirectory.org) >> Blog: http://www.disasterproject.com >> Jabber: blainett(a)jabberes.com > > > > -- > Alejandro Escanero Blanco > Consultor de sistemas basados en fuentes abiertas > Desarrollador de FusionDirectory (http://www.fusiondirectory.org) > Blog: http://www.disasterproject.com > Jabber: blainett(a)jabberes.com -- Alejandro Escanero Blanco Consultor de sistemas basados en fuentes abiertas Desarrollador de FusionDirectory (http://www.fusiondirectory.org) Blog: http://www.disasterproject.com Jabber: blainett(a)jabberes.com

1 0

Re: (ITS#7325) Panic issue with slapd-perl
by aescanero＠gmail.com 19 Jul '12

19 Jul '12

More information: Test Module is: package replicadorTEST; use strict; use warnings; use POSIX; sub new { my $class = shift; my $this = {}; bless $this, $class; return $this; } sub bind { return 0; } sub init { return 0; } sub search { return 0; } sub compare { return 0; } sub modify { return 0; } sub add { return 0; } sub modrdn { return 0; } sub delete { return 0; } sub config { return 0; } 1; Try to add this (The problem only appear when try to add a DN): dn: uid=test,o=XXXX,o=XXXX,c=XX mailLocalAddress: test(a)test.es objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: inetLocalMailRecipient objectClass: posixAccount uid: test mail: test(a)test.es uidNumber: 600 o: ceic gidNumber: 600 displayName: TEST sn: TEST cn: TEST homeDirectory: /home/test And then I get: 5007ee79 >>> dnPrettyNormal: <uid=test,o=XXXX,o=XXXX,c=XX> => ldap_bv2dn(uid=test,o=XXXX,o=XXXX,c=XX,0) <= ldap_bv2dn(uid=test,o=XXXX,o=XXXX,c=XX)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=test,o=XXXX,o=XXXX,c=XX)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=test,o=XXXX,o=XXXX,c=XX)=0 5007ee79 <<< dnPrettyNormal: <uid=test,o=XXXX,o=XXXX,c=XX>, <uid=test,o=XXXX,o=XXXX,c=XX> 5007ee79 conn=1000 op=1 ADD dn="uid=test,o=XXXX,o=XXXX,c=XX" panic: sv_setpvn called with negative strlen. Thanks 2012/7/19 Alejandro <aescanero(a)gmail.com>: > My main problem now is: > How I can check the bad line of code if perl-slapd don't give me any > usable error in 2.4.31 release? > > Thanks > > 2012/7/19 Howard Chu <hyc(a)symas.com>: >> aescanero(a)gmail.com wrote: >>> The problem was in the perl module with a uninitialized value, in >>> 2.4.21 give the error Use of uninitialized value in concatenation (.) >>> or string at /etc/openldap24/replicador.pm line 109, <DATA> line 275 >>> but in 2.4.31 give me a panic. >> >> Sounds like a bug in your module then, and not an OpenLDAP software issue. >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ > > > > -- > Alejandro Escanero Blanco > Consultor de sistemas basados en fuentes abiertas > Desarrollador de FusionDirectory (http://www.fusiondirectory.org) > Blog: http://www.disasterproject.com > Jabber: blainett(a)jabberes.com -- Alejandro Escanero Blanco Consultor de sistemas basados en fuentes abiertas Desarrollador de FusionDirectory (http://www.fusiondirectory.org) Blog: http://www.disasterproject.com Jabber: blainett(a)jabberes.com

1 0

Re: (ITS#7325) Panic issue with slapd-perl
by aescanero＠gmail.com 19 Jul '12

19 Jul '12

My main problem now is: How I can check the bad line of code if perl-slapd don't give me any usable error in 2.4.31 release? Thanks 2012/7/19 Howard Chu <hyc(a)symas.com>: > aescanero(a)gmail.com wrote: >> The problem was in the perl module with a uninitialized value, in >> 2.4.21 give the error Use of uninitialized value in concatenation (.) >> or string at /etc/openldap24/replicador.pm line 109, <DATA> line 275 >> but in 2.4.31 give me a panic. > > Sounds like a bug in your module then, and not an OpenLDAP software issue. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ -- Alejandro Escanero Blanco Consultor de sistemas basados en fuentes abiertas Desarrollador de FusionDirectory (http://www.fusiondirectory.org) Blog: http://www.disasterproject.com Jabber: blainett(a)jabberes.com

1 0

Re: (ITS#7325) Panic issue with slapd-perl
by hyc＠symas.com 19 Jul '12

19 Jul '12

aescanero(a)gmail.com wrote: > The problem was in the perl module with a uninitialized value, in > 2.4.21 give the error Use of uninitialized value in concatenation (.) > or string at /etc/openldap24/replicador.pm line 109, <DATA> line 275 > but in 2.4.31 give me a panic. Sounds like a bug in your module then, and not an OpenLDAP software issue. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs July 2012