December 2014 - openldap-bugs

(ITS#8004) Simple Paged Control: Set 'size' in return control value to number of search results

by michael＠stroeder.com

Full_Name: Version: OS: URL: Submission from: (NULL) (79.227.182.177) Feature request: http://tools.ietf.org/html/rfc2696#section-3 In the control returned to the client, the size MAY be set to the server's estimate of the total number of entries in the entire result set. So a client could evaluate this size value whether it's greater than 0 and take this as indication how many search results would be returned (and e.g. display it to the user). I'm asking myself whether slapo-noopsrch would be the right place for handling this. The no-op search control returns two distinct values for search results and search continuations though.

8 years, 5 months

1
0
0 / 0

Re: (ITS#8003) segault with jpegPhoto > ~27KB and audit overlay

by hyc＠symas.com

public(a)raffaelsahli.com wrote: > Full_Name: Raffael Sahli > Version: 2.4.40 > OS: Ubuntu LTS 12.04 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (46.245.145.146) > > > slapd will crash if a database has the audit overlay enabled and the attribute > jpegPhoto will be modified or added with data bigger than ~27KB. > > `/usr/local/libexec/slapd': free(): invalid next size (normal) > > Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and bdb/mdb. > > Remove the audit overlay or migrate back to 2.4.39 solves the problem. > > Please provide a sample slapd config that demonstrates the problem. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

(ITS#8003) segault with jpegPhoto > ~27KB and audit overlay

by public＠raffaelsahli.com

Full_Name: Raffael Sahli Version: 2.4.40 OS: Ubuntu LTS 12.04 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (46.245.145.146) slapd will crash if a database has the audit overlay enabled and the attribute jpegPhoto will be modified or added with data bigger than ~27KB. `/usr/local/libexec/slapd': free(): invalid next size (normal) Verified with custom builds on Ubuntu lts 12.04/14.04/Mint 14 and bdb/mdb. Remove the audit overlay or migrate back to 2.4.39 solves the problem.

8 years, 5 months

1
0
0 / 0

(ITS#8002) SSL fails with olcTLSVerifyClient=allow when ITS 7979 patch is applied

by rik.theys＠esat.kuleuven.be

Full_Name: Rik Theys Version: 2.4.40 OS: Fedora 21 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (134.58.253.57) Hi, After upgrading from Fedora 20 to 21 my client machine could no longer connect to our LDAP server. Fedora links openldap with nss for TLS. It throws the following error: TLS: certdb config: configDir='/etc/openldap/cacerts' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly TLS: cannot open certdb '/etc/openldap/cacerts', error -8018:Unknown PKCS #11 error. TLS: loaded CA certificate file /etc/openldap/cacerts/a9b3780c.0 from CA certificate directory /etc/openldap/cacerts. TLS: loaded CA certificate file /etc/openldap/cacerts/f4033bb2.0 from CA certificate directory /etc/openldap/cacerts. TLS: skipping 'cacert.pem' - filename does not have expected format (certificate hash with numeric suffix) TLS: skipping 'esat.pem' - filename does not have expected format (certificate hash with numeric suffix) TLS: certificate [CN=wheezy-test.esat.kuleuven.be,OU=ESAT,O=KU Leuven,ST=Leuven,C=BE] is valid TLS: error: connect - force handshake failure: errno 0 - moznss error -12256 TLS: can't connect: TLS error -12256:SSL received a malformed Certificate Request handshake message.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) I downgraded to fedora package 2.4.40-1.fc21 which did not have this bug. The only difference between 2.4.40-1.fc21 and 2.4.40-2.fc21 is a backported patch for ITS #7979 which adds TLS 1+ support. I tried to reproduce this on a test machine and was initially unable to reproduce it there. Comparing the config of the test machine with our failing LDAP servers only showed a difference for the olcTLSVerifyClient setting. When the LDAP server does not have 'olcTLSVerifyClient: allow' in its configuration, it works. Once I set this parameter in the server configuration, the error above appears and LDAP connections are broken. The patch looks OK so maybe there's something wrong when openldap uses a higher TLS version and the bug it to be found there? I've also filed this bug in the fedora bug tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1172638 Regards, Rik

8 years, 5 months

1
0
0 / 0

Re: (ITS#7977) Supported PBKDF2-SHA256 and PBKDF2-SHA512

by luca.bruno＠rocket-internet.de

> with a corresponding IPR statement as outlined in > our Contributors guidelines. I was (wrongly) assuming that the explicit "Signed-off-by" line in each patch was enough to express this from my side. Just to be more explicit, here is the IPR statement for my part of the patch: """ The attached patch is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Luca Bruno, on behalf of "Rocket Internet AG". By virtue of my employment agreement with "Rocket Internet AG", I have assigned my rights and interest in this work to "Rocket Internet AG". "Rocket Internet AG" has not assigned rights and/or interest in this work to any party. I, Luca Bruno am authorized by "Rocket Internet AG", my employer, to release this work under the following terms. "Rocket Internet AG" hereby places the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. """ Cheers, Luca PS. I would suggest to explicitly CC third-parties when you are missing IPR info, as I was not aware that this ticket was waiting for input on my side. -- Luca Bruno (kaeso) Security Engineer Rocket Internet AG -> GPG Key ID: 0x4F3BBEBF

8 years, 5 months

1
0
0 / 0

Re: (ITS#8001) Segmentation Fault in ldap_sync_*

by hyc＠symas.com

alexey(a)kireyev.name wrote: > Full_Name: Alexey Kireyev > Version: 2.4.40 > OS: Ubuntu 14.04 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (98.118.88.65) > > > If not all fields in ldap_sync_t manually set after ldap_sync_initialize, then > any following calls might (and most probably will) ends in segmentation fault. > > Reason: ldap_sync_initialize doesn't zeroed newly allocated structure (it does > it for pre-existing, though, which is wrong by itself in my view) Thanks, you're right. fixed in master. > > > > > -------------------------------------------------------------------------------------------------------- > > >>From 01149a2eba9f463261d88e5a1ce43e19c4a323cf Mon Sep 17 00:00:00 2001 > From: Alexey Kireyev <alexey(a)kireyev.name> > Date: Wed, 10 Dec 2014 14:37:16 -0500 > Subject: [PATCH] Newly allocated ldap_sync_t has to be zero out > > --- > libraries/libldap/ldap_sync.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/libraries/libldap/ldap_sync.c b/libraries/libldap/ldap_sync.c > index e573c3b..e79153f 100644 > --- a/libraries/libldap/ldap_sync.c > +++ b/libraries/libldap/ldap_sync.c > @@ -64,11 +64,10 @@ ldap_sync_initialize( ldap_sync_t *ls_in )D%D > if ( ls == NULL ) { > return NULL; > } > - > - } else { > - memset( ls, 0, sizeof( ldap_sync_t ) ); > } > > + memset( ls, 0, sizeof( ldap_sync_t ) ); > + > ls->ls_scope = LDAP_SCOPE_SUBTREE; > ls->ls_timeout = -1; > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

Re: (ITS#7998) no-return-in-nonvoid-function noopsrch.c:145

by michael＠stroeder.com

hyc(a)symas.com wrote: > michael(a)stroeder.com wrote: >> As I read noopsrch_response there's a else {} clause missing. >> But I'm not sure. > > Yes, but not important. Unfortunately the build is blocked on openSUSE build system because of this. There may be a way to work around it but I don't know how. Ciao, Michael.

8 years, 5 months

1
0
0 / 0

Re: (ITS#8000) Warnings building contrib overlay passwd/sha2

by hyc＠symas.com

michael(a)stroeder.com wrote: > Full_Name: > Version: RE24 > OS: > URL: > Submission from: (NULL) (79.227.174.182) > > > HI! > > I'm trying to package passwd/sha2 for openSUSE. > The default compiler options in their build system results in these warnings: Fixed in master. The note about compilers breaking this code is spurious. Any compiler that failed to properly compile the previous code would itself be broken. > > [ 193s] + CFLAGS='-fomit-frame-pointer -fmessage-length=0 -grecord-gcc-switches > -fstack-protector -O2 -Wall -D_FORTIFY_SOURCE=2 -funwind-tables > -fasynchronous-unwind-tables -g -Wno-format-extra-args -fno-strict-aliasing' > [ 193s] + make -j4 sysconfdir=/etc/openldap libdir=/usr/lib > libexecdir=/usr/lib > [ 193s] ../../../../libtool --mode=compile gcc -g -O2 -Wall > -I..%2.%./../../include -I../../../../include -I../../../../servers/slapd -c > slapd-sha2.c > [ 193s] ../../../../libtool --mode=compile gcc -g -O2 -Wall > -I../../../../include -I../../../../include -I../../../../servers/slapd -c > sha2.c > [ 193s] mkdir .libs > [ 193s] mkdir .libs > [ 193s] mkdir: cannot create directory '.libs': File exists > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c sha2.c -fPIC -DPIC -o .libs/sha2.o > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c slapd-sha2.c -fPIC -DPIC -o .libs/slapd-sha2.o > [ 193s] sha2.c: In function 'SHA256_Final': > [ 193s] sha2.c:608:3: warning: dereferencing type-punned pointer will break > strict-aliasing rules [-Wstrict-aliasing] > [ 193s] *(sha2_word64*)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = > context->bitcount; > [ 193s] ^ > [ 193s] sha2.c: In function 'SHA512_Last': > [ 193s] sha2.c:925:2: warning: dereferencing type-punned pointer will break > strict-aliasing rules [-Wstrict-aliasing] > [ 193s] *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = > context->bitcount[1]; > [ 193s] ^ > [ 193s] sha2.c:926:2: warning: dereferencing type-punned pointer will break > strict-aliasing rules [-Wstrict-aliasing] > [ 193s] *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = > context->bitcount[0]; > [ 193s] ^ > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c slapd-sha2.c -o slapd-sha2.o >/dev/null > 2>&1 > [ 193s] gcc -g -O2 -Wall -I../../../../include -I../../../../include > -I../../../../servers/slapd -c sha2.c -o sha2.o >/dev/null 2>&1 > [ 194s] ../../../../libtool --mode=link gcc -g -O2 -Wall -version-info 0:0:0 \ > [ 194s] -rpath /usr/lib/openldap -module -o pw-sha2.la slapd-sha2.lo sha2.lo > ../../../../libraries/libldap_r/libldap_r.la > ../../../../libraries/liblber/liblber.la > [ 194s] cc -shared .libs/slapd-sha2.o .libs/sha2.o -Wl,--rpath > -Wl,/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/libldap_r/.libs > -Wl,--rpath -Wl,/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/liblber/.libs > -L/home/abuild/rpmbuild/BUILD/openldap-2.4.40/libraries/liblber/.libs > ../../../../libraries/libldap_r/.libs/libldap_r.so > ../../../../libraries/liblber/.libs/liblber.so -Wl,-soname -Wl,pw-sha2.so.0 -o > .libs/pw-sha2.so.0.0.0 > [ 194s] (cd .libs && rm -f pw-sha2.so.0 && ln -s > pw-sha2.so.0.0.0 pw-sha2.so.0) > [ 194s] (cd .libs && rm -f pw-sha2.so && ln -s pw-sha2.so.0.0.0 > pw-sha2.so) > [ 194s] ar cru .libs/pw-sha2.a slapd-sha2.o sha2.o > [ 194s] ranlib .libs/pw-sha2.a > [ 194s] creating pw-sha2.la > > > Overall RPM build fails with: > > [ 262s] I: Program is likely to break with new gcc. Try -fno-strict-aliasing. > [ 262s] W: openldap2 strict-aliasing-punning sha2.c:608, 925, 926 > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

Re: (ITS#7998) no-return-in-nonvoid-function noopsrch.c:145

by hyc＠symas.com

michael(a)stroeder.com wrote: > As I read noopsrch_response there's a else {} clause missing. > But I'm not sure. Yes, but not important. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

Re: (ITS#7998) no-return-in-nonvoid-function noopsrch.c:145

by hyc＠symas.com

michael(a)stroeder.com wrote: > Full_Name: > Version: RE24 > OS: > URL: > Submission from: (NULL) (79.227.174.182) > > > Building slapo- (contrib/) with strict warnings results in: > > no-return-in-nonvoid-function noopsrch.c:145 > > Fixed in master -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

8 years, 5 months

1
0
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs December 2014