December 2014 - openldap-bugs

(ITS#8006) Inconsistent autogroup results

by hyc＠openldap.org

Full_Name: Howard Chu Version: 2.4.39 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc It looks like autogroup runs all its internal modifications using the same identity as the original op that triggered it. It should be using the rootDN, since the original user may not have permissions to search or modify all of the affected entries.

8 years, 5 months

1
0
0 / 0

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining

by hyc＠symas.com

khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: > On 12/15/2014 12:09 PM, Howard Chu wrote: >> khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: >>> Full_Name: K. Ebrahimpour >>> Version: RE24 (commit dbc6741750de79b852ec9f728abb8b1425b6f03f) >>> OS: Ubuntu 14.04.1 >>> URL: https://gist.github.com/khosrow/cc6640cad9275a2cd041 >>> Submission from: (NULL) (205.211.133.128) >> >>> Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also >>> able to >>> replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. >> >> The current release is 2.4.40. For such old releases you should >> contact Ubuntu for support. >> > I may not have been clear enough on which versions I have tested. Please > see the *VERSION* field in the ITS submission form for the correct version. > > To clarify, I have tested and reproduced the bug on the following versions: > > * 2.4.28 on Ubuntu 12.04 (official Ubuntu package) > * 2.4.31 on Ubuntu 14.04 (official Ubuntu package) > * RE24 commit #dbc6741750de79b852ec9f728abb8b1425b6f03f on Ubuntu 14.04 > (from OpenLDAP git repo) > > I understand the two first instances are old releases, I simply tested > the bug on progressively newer versions of the software. Are you saying > that the third tested version is also old? That commit ID is a few months old, from before 2.4.40 was released. We are currently preparing to release 2.4.41, so yes, it's old. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining

by quanah＠zimbra.com

--On Monday, December 15, 2014 6:07 PM +0000 khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: > * RE24 commit #dbc6741750de79b852ec9f728abb8b1425b6f03f on Ubuntu 14.04 > (from OpenLDAP git repo) That commit is from last September, and predates the 2.4.40 release. Again, please test against current RE24. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

8 years, 5 months

1
0
0 / 0

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining

by khosrow.ebrahimpour＠ssc-spc.gc.ca

On 12/15/2014 12:09 PM, Howard Chu wrote: > khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: >> Full_Name: K. Ebrahimpour >> Version: RE24 (commit dbc6741750de79b852ec9f728abb8b1425b6f03f) >> OS: Ubuntu 14.04.1 >> URL: https://gist.github.com/khosrow/cc6640cad9275a2cd041 >> Submission from: (NULL) (205.211.133.128) > >> Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also >> able to >> replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. > > The current release is 2.4.40. For such old releases you should > contact Ubuntu for support. > I may not have been clear enough on which versions I have tested. Please see the *VERSION* field in the ITS submission form for the correct version. To clarify, I have tested and reproduced the bug on the following versions: * 2.4.28 on Ubuntu 12.04 (official Ubuntu package) * 2.4.31 on Ubuntu 14.04 (official Ubuntu package) * RE24 commit #dbc6741750de79b852ec9f728abb8b1425b6f03f on Ubuntu 14.04 (from OpenLDAP git repo) I understand the two first instances are old releases, I simply tested the bug on progressively newer versions of the software. Are you saying that the third tested version is also old? Thanks, -- Khosrow

8 years, 5 months

1
0
0 / 0

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining

by hyc＠symas.com

khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: > Full_Name: K. Ebrahimpour > Version: RE24 (commit dbc6741750de79b852ec9f728abb8b1425b6f03f) > OS: Ubuntu 14.04.1 > URL: https://gist.github.com/khosrow/cc6640cad9275a2cd041 > Submission from: (NULL) (205.211.133.128) > Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able to > replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. The current release is 2.4.40. For such old releases you should contact Ubuntu for support. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

Re: (ITS#8005) crash when multiple olcDbURI are defined for chaining

by quanah＠zimbra.com

--On Monday, December 15, 2014 4:58 PM +0000 khosrow.ebrahimpour(a)ssc-spc.gc.ca wrote: > Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able > to replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. Both of those are years old, and known to have multitudes of issues. Please test using current RE24 code. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

8 years, 5 months

1
0
0 / 0

(ITS#8005) crash when multiple olcDbURI are defined for chaining

by khosrow.ebrahimpour＠ssc-spc.gc.ca

Full_Name: K. Ebrahimpour Version: RE24 (commit dbc6741750de79b852ec9f728abb8b1425b6f03f) OS: Ubuntu 14.04.1 URL: https://gist.github.com/khosrow/cc6640cad9275a2cd041 Submission from: (NULL) (205.211.133.128) While trying to setup referral chaining in a multi-master setup, I can setup chaining to one of the masters without any problems. And I can perform a MOD operation that is then referral chased and performed on the master. However, when I define both masters the replica crashes when I do a MOD operation. Snippet of cn=config from the working example: dn: olcDatabase={1}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {1}ldap olcDbStartTLS: start starttls=yes olcDbIDAssertAuthzFrom: {0}* olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbURI: ldap://ldap-m1.example.com olcDbIDAssertBind: mode=self flags=prescriptive,proxauauthz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=com" credentials="secret" keepalive=0:0:0 starttls=yes tls_reqcert=allow If I change olcDbURI to either of the entries below, the replica server crashes * olcDbURI: "ldap://ldap-m1.example.com,ldap://ldap-m2.example.com" * olcDbURI: "ldap://ldap-m1.example.com ldap://ldap-m2.example.com" According to slapd-ldap(5), the URI list can be comma or space separated. I've turned on "args" and "trace" debugging to troubleshoot, but never get any errors in the logs. I only see an attempt to chase the referral followed by an immediate crash (see log snippet at the end of email). Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able to replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise.

8 years, 5 months

1
0
0 / 0

Re: (ITS#8003) segault with jpegPhoto > ~27KB and audit overlay

by hyc＠symas.com

Raffael Sahli wrote: > On 12.12.2014 09:08, Howard Chu wrote: >> public(a)raffaelsahli.com wrote: >>> Full_Name: Raffael Sahli >>> Version: 2.4.40 >>> OS: Ubuntu LTS 12.04 >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (46.245.145.146) >>> >>> >>> slapd will crash if a database has the audit overlay enabled and the >>> attribute >>> jpegPhoto will be modified or added with data bigger than ~27KB. >>> >>> `/usr/local/libexec/slapd': free(): invalid next size (normal) >>> >>> Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and >>> bdb/mdb. >>> >>> Remove the audit overlay or migrate back to 2.4.39 solves the problem. Thanks, fixed now in master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

Re: (ITS#8003) segault with jpegPhoto > ~27KB and audit overlay

by public＠raffaelsahli.com

On 12.12.2014 09:08, Howard Chu wrote: > public(a)raffaelsahli.com wrote: >> Full_Name: Raffael Sahli >> Version: 2.4.40 >> OS: Ubuntu LTS 12.04 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (46.245.145.146) >> >> >> slapd will crash if a database has the audit overlay enabled and the >> attribute >> jpegPhoto will be modified or added with data bigger than ~27KB. >> >> `/usr/local/libexec/slapd': free(): invalid next size (normal) >> >> Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and >> bdb/mdb. >> >> Remove the audit overlay or migrate back to 2.4.39 solves the problem. >> >> > Please provide a sample slapd config that demonstrates the problem. > include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database mdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" rootpw secret directory /usr/local/var/openldap-data index objectClass eq overlay auditlog auditlog /var/log/audit_slapd.log -- Raffael Sahli

8 years, 5 months

1
0
0 / 0

Re: (ITS#8004) Simple Paged Control: Set 'size' in return control value to number of search results

by hyc＠symas.com

michael(a)stroeder.com wrote: > Full_Name: > Version: > OS: > URL: > Submission from: (NULL) (79.227.182.177) > > > Feature request: > > http://tools.ietf.org/html/rfc2696#section-3 > > In the control returned to the client, the > size MAY be set to the server's estimate of the total number of > entries in the entire result set. > > So a client could evaluate this size value whether it's greater than 0 and take > this as indication how many search results would be returned (and e.g. display > it to the user). slapd doesn't know in advance how many results can be returned. It knows how many potential candidates were generated by index lookups, but this number may be much larger than the actual result set. In particular, the result set may be much smaller due to ACLs, as well as actual filter comparisons. It would be a security violation to disclose the existence of entries that the user is not permitted to see. Rejecting this request. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 6 months

1
0
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs December 2014