Michael Ströder wrote:
> hyc(a)symas.com wrote:
>> michael(a)stroeder.com wrote:
>>> This is a multi-part message in MIME format.
>>> --------------030803020000090707060805
>>> Content-Type: text/plain; charset=UTF-8
>>> Content-Transfer-Encoding: 7bit
>>>
>>> See slapd.conf attached.
>>
>> What is init.schema? Is it required to reproduce the bug?
>
> Not required. Just a bunch of include foo.schema.
>
> …
[View More]Ciao, Michael.
>
Fixed in git master.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
[View Less]
michael(a)stroeder.com wrote:
> This is a multi-part message in MIME format.
> --------------030803020000090707060805
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 7bit
>
> See slapd.conf attached.
What is init.schema? Is it required to reproduce the bug?
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
jvcelak(a)redhat.com wrote:
> Full_Name: Jan Vcelak
> Version: git master
> OS: Linux
> URL: ftp://ftp.openldap.org/incoming/jvcelak-20120914-moznss-ignore-certdb-sql-p…
> Submission from: (NULL) (209.132.186.34)
>
>
> Mozilla NSS certificate database in newer SQL format could not be used with
> OpenLDAP, because the 'sql:' prefix is not removed while checking for the
> existence of the directory.
>
> The attached patch resolves this problem.
The patch …
[View More]looks syntactically correct. But SQL, seriously? As if TLS
handshakes weren't slow enough already, you want to slow them down even
further by looking up certs in an SQL database?
Aside from questioning the wisdom of such an inefficient approach, there are
other philosophical problems with this patch. It seems to be just the latest
in a continuing stream of one-off patches. Are we going to get yet another
special case patch from you guys when some other new certDB type comes along?
This approach is unmaintainable and does nothing to inspire confidence in the
quality of thinking going into this code.
You're working on a security library. We expect a lot better thought to go
into these things.
> Steps to reproduce are described in Red Hat bugzilla:
> https://bugzilla.redhat.com/show_bug.cgi?id=857373
>
>
> The attached file is derived from OpenLDAP Software. All of the modifications to
> OpenLDAP Software represented in the following patch(es) were developed by Red
> Hat. Red Hat has not assigned rights and/or interest in this work to any party.
> I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under
> the following terms.
>
> Red Hat hereby place the following modifications to OpenLDAP Software (and only
> these modifications) into the public domain. Hence, these modifications may be
> freely used and/or redistributed for any purpose with or without attribution
> and/or other notice.
>
>
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
[View Less]
Full_Name:
Version: 2.4.32
OS: Debian Squeeze
URL:
Submission from: (NULL) (212.227.35.94)
Config with the following lines works as expected but slapschema crashes no
matter whether slapd is running or not:
--------------------------------------------------------------------------
overlay rwm
rwm-rewriteEngine on
# rewrite map for (uid=foo) with DN of entry as result
rwm-rewriteMap slapd uid2dn "ldap:///ou=um-demail?entryDN?sub?uid="
--------------------------------------------------------…
[View More]------------------
This is self-compiled OpenLDAP 2.4.32 on Debian Squeeze linked against OpenSSL
and BDB 4.8.30.
Example config will follow. Maybe I even can reproduce on another system and
provide gdb output.
[View Less]
Full_Name: Jan Vcelak
Version: git master
OS: Linux
URL: ftp://ftp.openldap.org/incoming/jvcelak-20120914-moznss-load-certs-from-cer…
Submission from: (NULL) (209.132.186.34)
If TLS_CACERT pointed to a PEM file and TLS_CACERTDIR was set to NSS certificate
database, the backend assumed that the certificate is always located in the
certificate database. This assumption might be wrong.
This patch makes the library to try to load the certificate from NSS database
and fallback to PEM file if …
[View More]unsuccessfull.
The attached file is derived from OpenLDAP Software. All of the modifications to
OpenLDAP Software represented in the following patch(es) were developed by Red
Hat. Red Hat has not assigned rights and/or interest in this work to any party.
I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under
the following terms.
Red Hat hereby place the following modifications to OpenLDAP Software (and only
these modifications) into the public domain. Hence, these modifications may be
freely used and/or redistributed for any purpose with or without attribution
and/or other notice.
[View Less]
Full_Name: Jan Vcelak
Version: git master
OS: Linux
URL: ftp://ftp.openldap.org/incoming/jvcelak-20120914-moznss-ignore-certdb-sql-p…
Submission from: (NULL) (209.132.186.34)
Mozilla NSS certificate database in newer SQL format could not be used with
OpenLDAP, because the 'sql:' prefix is not removed while checking for the
existence of the directory.
The attached patch resolves this problem.
Steps to reproduce are described in Red Hat bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=…
[View More]857373
The attached file is derived from OpenLDAP Software. All of the modifications to
OpenLDAP Software represented in the following patch(es) were developed by Red
Hat. Red Hat has not assigned rights and/or interest in this work to any party.
I, Jan Vcelak am authorized by Red Hat, my employer, to release this work under
the following terms.
Red Hat hereby place the following modifications to OpenLDAP Software (and only
these modifications) into the public domain. Hence, these modifications may be
freely used and/or redistributed for any purpose with or without attribution
and/or other notice.
[View Less]