November 2017 - openldap-bugs

(ITS#8781) "connection_read(248): no connection!" on 2.4.44
by mramitsingh85＠gmail.com 30 Nov '17

30 Nov '17

Full_Name: Amit kumar singh Version: 2.4.44 OS: CentOS release 6.9 (Final) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (14.141.104.38) Issue on replication and get below error. Nov 30 17:03:55 host slapd[709]: connection_read(346): no connection! Nov 30 17:03:55 host slapd[709]: connection_read(346): no connection! Nov 30 17:03:55 host[709]: connection_read(362): no connection! I was searching issue and found that fixed ref: ITS#6548 on 2.4.27. But strange thing is that it comes up again in 2.4.44. Not sure If I am correct but need your help to look into it.

1 0

(ITS#8780) Plug a socket leak in ldap_new_connection made by unsuccessful connection attempts
by hguo＠suse.com 30 Nov '17

30 Nov '17

Full_Name: Houzuo Guo Version: master OS: URL: ftp://ftp.openldap.org/incoming/houzuo-guo-171130.patch Submission from: (NULL) (195.135.221.2) In case that ldap connection is attempted on failed URLs prior to establishing a successful connection, the failed connection sockets are never freed. This patch plugs the socket descriptor leak.

1 0

Re: (ITS#8779) slapo-seqmod missing manpage
by hyc＠symas.com 28 Nov '17

28 Nov '17

quanah(a)openldap.org wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.4.45 > OS: N/A > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (47.208.148.239) > > > The seqmod overlay is missing a man page. This should be fixed. > Pretty sure we've discussed this many times before. No. The seqmod overlay is not meant to be executed and used by anyone. It is meant to be a model for overlay authors to read and learn from. Close this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8779) slapo-seqmod missing manpage
by quanah＠openldap.org 27 Nov '17

27 Nov '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) The seqmod overlay is missing a man page. This should be fixed.

1 0

Re: (ITS#8777) [LMDB] Closing read cursor uses already freed transaction (MDB_VL32)
by hyc＠symas.com 26 Nov '17

26 Nov '17

Markus Junginger wrote: > Thanks for the report. Unfortunately your suggested fix means the rpage > test will always be skipped on read-only cursors, which will break the > rpage tracking if the txn is still alive. > > > Could you maybe explain a bit about rpages? Why does mdb_cursor_close need to > unref pages, but not mdb_cursor_renew? If closing a transaction does not clean > up rpages, I would have expected mdb_cursor_renew would have to do. And why > does setting MDB_VL32 affect rpages in the first place? To my understanding, > MDB_VL32 is about using 64 bits also on 32 bit CPUs, so a differences on page > handling seem surprising at first sight. Think about how LMDB works. LMDB was originally written for use on 64bit CPUs, with 64bit virtual address spaces. It expects to map an entire DB into virtual memory using a single mmap call. Obviously this cannot be done when trying to use a DB larger than 2GB on a machine with only a 32bit virtual address space. When using MDB_VL32 to access a 64bit DB on a 32bit CPU, the DB cannot fit into a single mmap. It must be mapped in chunks, and the chunks must be mapped, unmapped, and remapped on demand. The rpages thus need to be tracked, to know which are currently mapped. None of this rpage tracking exists in the native non-VL32 build because it's completely unnecessary. Also note that the MDB_VL32 feature is not officially released. You're free to use it if you want, but there is no expectation that it is suitable for general use. When you use unreleased features, you're expected to know how to support yourself. When you use LMDB at all, you're expected to know how virtual addresses work. Ideally, you should quit using obsolete 32bit CPUs. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8777) [LMDB] Closing read cursor uses already freed transaction (MDB_VL32)
by hyc＠symas.com 26 Nov '17

26 Nov '17

Markus Junginger wrote: > Thanks for your fast response. > >> Thanks for the report. Unfortunately your suggested fix means >> the rpage test will always be skipped on read-only cursors, which >> will break the rpage tracking if the txn is still alive. > > Does that mean it's not trivial to fix and will take some time? Correct. And I'm still on holiday this week, won't be looking deeper into this for a while. > It's a last outstanding issue for a release, so I guess we have to find a > work around until it's properly fixed? Yes. Best is to use mdb_txn_reset/renew instead of txn_abort. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8777) [LMDB] Closing read cursor uses already freed transaction (MDB_VL32)
by markus＠greenrobot.de 26 Nov '17

26 Nov '17

--94eb2c123fa4650778055ee78f61 Content-Type: text/plain; charset="UTF-8" > > Thanks for the report. Unfortunately your suggested fix means the rpage > test will always be skipped on read-only cursors, which will break the > rpage tracking if the txn is still alive. Could you maybe explain a bit about rpages? Why does mdb_cursor_close need to unref pages, but not mdb_cursor_renew? If closing a transaction does not clean up rpages, I would have expected mdb_cursor_renew would have to do. And why does setting MDB_VL32 affect rpages in the first place? To my understanding, MDB_VL32 is about using 64 bits also on 32 bit CPUs, so a differences on page handling seem surprising at first sight. Thanks, Markus --94eb2c123fa4650778055ee78f61 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote"><blo= ckquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left= :1px solid rgb(204,204,204);padding-left:1ex">Thanks for the report. Unfort= unately your suggested fix means the rpage test will always be skipped on r= ead-only cursors, which will break the rpage tracking if the txn is still a= live.</blockquote><div><br></div><div>Could you maybe explain a bit about r= pages? Why does=C2=A0<span style=3D"font-size:12.8px">mdb_cursor_close=C2= =A0</span>need to unref pages, but not mdb_cursor_renew? If closing a trans= action does not clean up rpages, I would have expected mdb_cursor_renew wou= ld have to do. And why does setting MDB_VL32 affect rpages in the first pla= ce? To my understanding, MDB_VL32=C2=A0 is about using 64 bits also on 32 b= it CPUs, so a differences on page handling seem surprising at first sight.<= /div><div><br></div><div>Thanks,</div><div>Markus</div><div><br></div></div= ></div></div> --94eb2c123fa4650778055ee78f61--

1 0

(ITS#8778) Phone numbers "-" and " " fail normalization
by h.b.furuseth＠usit.uio.no 26 Nov '17

26 Nov '17

Full_Name: Hallvard B Furuseth Version: 2.4.45, master OS: Linux x86_64 URL: Submission from: (NULL) (193.90.52.167) Submitted by: hallvard telephoneNumberNormalize() fails for a non-empty value of only spaces+hyphens. The validate function, printableStringValidate(), succeeds. They should agree. I'll make Normalize return one space. That seems the minimal change.

1 0

Re: (ITS#8777) [LMDB] Closing read cursor uses already freed transaction (MDB_VL32)
by markus＠greenrobot.de 26 Nov '17

26 Nov '17

Thanks for your fast response. > Thanks for the report. Unfortunately your suggested fix means > the rpage test will always be skipped on read-only cursors, which > will break the rpage tracking if the txn is still alive. Does that mean it's not trivial to fix and will take some time? It's a last outstanding issue for a release, so I guess we have to find a work around until it's properly fixed? Thanks, Markus

1 0

Re: (ITS#8777) [LMDB] Closing read cursor uses already freed transaction (MDB_VL32)
by hyc＠symas.com 26 Nov '17

26 Nov '17

markus(a)greenrobot.de wrote: > Full_Name: Markus Junginger > Version: mdb.master > OS: Ubuntu > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (77.190.230.93) > > > Read cursors may outlive a transaction to be renewed with another. Thus, cursors > should be correctly closed even after their last transaction was aborted. But > they access the (already freed) transaction during closing when MDB_VL32 is used > (mdb.master branch). > > ASan captures this like this: > ==19722==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100001b140 > at pc 0x000000ea2387 bp 0x7ffd36e3cd20 sp 0x7ffd36e3cd18 > READ of size 8 at 0x61100001b140 thread T0 > #0 0xea2386 in mdb_cursor_unref mdb.c:2082:18 > #1 0xec577b in mdb_cursor_close mdb.c:8538:3 > > 0x61100001b140 is located 128 bytes inside of 250-byte region > [0x61100001b0c0,0x61100001b1ba) > freed by thread T0 here: > #0 0x74f840 in __interceptor_cfree.localalias.0 (...) > #1 0xe8ea98 in mdb_txn_end mdb.c:3380:3 > #2 0xe8ecc5 in mdb_txn_abort mdb.c:3405:2 > > > Possible fix for line mdb.c:2082 (applying what I found in mdb_cursor_close): > - if (mc->mc_txn->mt_rpages[0].mid) { > + if ((mc->mc_flags & C_UNTRACK) && mc->mc_txn->mt_rpages[0].mid) { > > > Code to reproduce using MDB_VL32: > err = mdb_txn_begin(env, nullptr, MDB_RDONLY, &tx); > err = mdb_cursor_open(tx, dbi, &cursor); > // We must have data so get will set C_INITIALIZED > err = mdb_cursor_get(cursor, &key, &value, MDB_SET_KEY); > mdb_txn_abort(tx); > mdb_cursor_close(cursor); // <- still uses tx Thanks for the report. Unfortunately your suggested fix means the rpage test will always be skipped on read-only cursors, which will break the rpage tracking if the txn is still alive. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8777) [LMDB] Closing read cursor uses already freed transaction (MDB_VL32)
by markus＠greenrobot.de 26 Nov '17

26 Nov '17

Full_Name: Markus Junginger Version: mdb.master OS: Ubuntu URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (77.190.230.93) Read cursors may outlive a transaction to be renewed with another. Thus, cursors should be correctly closed even after their last transaction was aborted. But they access the (already freed) transaction during closing when MDB_VL32 is used (mdb.master branch). ASan captures this like this: ==19722==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100001b140 at pc 0x000000ea2387 bp 0x7ffd36e3cd20 sp 0x7ffd36e3cd18 READ of size 8 at 0x61100001b140 thread T0 #0 0xea2386 in mdb_cursor_unref mdb.c:2082:18 #1 0xec577b in mdb_cursor_close mdb.c:8538:3 0x61100001b140 is located 128 bytes inside of 250-byte region [0x61100001b0c0,0x61100001b1ba) freed by thread T0 here: #0 0x74f840 in __interceptor_cfree.localalias.0 (...) #1 0xe8ea98 in mdb_txn_end mdb.c:3380:3 #2 0xe8ecc5 in mdb_txn_abort mdb.c:3405:2 Possible fix for line mdb.c:2082 (applying what I found in mdb_cursor_close): - if (mc->mc_txn->mt_rpages[0].mid) { + if ((mc->mc_flags & C_UNTRACK) && mc->mc_txn->mt_rpages[0].mid) { Code to reproduce using MDB_VL32: err = mdb_txn_begin(env, nullptr, MDB_RDONLY, &tx); err = mdb_cursor_open(tx, dbi, &cursor); // We must have data so get will set C_INITIALIZED err = mdb_cursor_get(cursor, &key, &value, MDB_SET_KEY); mdb_txn_abort(tx); mdb_cursor_close(cursor); // <- still uses tx

1 0

Re: (ITS#8776) lessOrEqual does not work as expected
by kristianmccolm＠hotmail.com 23 Nov '17

23 Nov '17

--_000_BN6PR04MB08825B65B73F5FF9B6674966DD210BN6PR04MB0882namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello Michael, The lessOrEqual does work as expected now after shutting down the directory= and running slapindex. Thanks Kristian ________________________________ From: Michael Str=F6der <michael(a)stroeder.com> Sent: November 23, 2017 15:19 To: kristianmccolm(a)hotmail.com; openldap-its(a)OpenLDAP.org Subject: Re: (ITS#8776) lessOrEqual does not work as expected kristianmccolm(a)hotmail.com wrote: > Full_Name: Kristian McColm > Version: slapd 2.4.40 Did you also test with a newer release? > With an attribute type defined in the schema and index as per the below, = and the > value of the attribute set to 0, the lessOrEqual filter does not work as > expected. It works for me. Example filter (aeStatus<=3D1) also finds entries with (aeStatus=3D0): https://demo.ae-dir.com/web2ldap?ldapi://%2Fopt%2Fae-dir%2Frun%2Fslapd%2Fld= api/cn=3Dtest,ou=3Dae-dir??sub?(aeStatus<=3D1)?bindname=3Duid%3Dzots%2Ccn%3= Dtest%2Cou%3Dae-dir,X-BINDPW=3DCorrectHorseBatteryStaple (This is an OpenLDAP 2.4.45 server but this worked for me with older releases too.) > Schema attribute: > olcAttributeTypes: {1} ( <oid> NAME 'num' DESC 'Numeric Attribute' SYNTAX > 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' EQUALITY integerMat= ch > ORDERING integerOrderingMatch ) Did you use <oid> as a placeholder or is that value really literally in your schema? If you used it as a placeholder herein which OID did you really use? Did you eventually changed index-related schema config without re-indexing? Ciao, Michael. --_000_BN6PR04MB08825B65B73F5FF9B6674966DD210BN6PR04MB0882namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <style type=3D"text/css" style=3D"display:none;"></style> </head> <body dir=3D"ltr"> <div id=3D"divtagdefaultwrapper" style=3D"font-size:12pt;color:#000000;font= -family:Calibri,Helvetica,sans-serif;" dir=3D"ltr"> <p style=3D"margin-top:0;margin-bottom:0">Hello Michael,</p> <p style=3D"margin-top:0;margin-bottom:0"><br> </p> <p style=3D"margin-top:0;margin-bottom:0">The lessOrEqual does work as expe= cted now after shutting down the directory and running slapindex. <br> </p> <p style=3D"margin-top:0;margin-bottom:0"><br> </p> <p style=3D"margin-top:0;margin-bottom:0">Thanks <br> </p> <p style=3D"margin-top:0;margin-bottom:0">Kristian</p> <br> <br> <div style=3D"color: rgb(0, 0, 0);"> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font style=3D"font-size:11pt" face= =3D"Calibri, sans-serif" color=3D"#000000"><b>From:</b> Michael Str=F6der &= lt;michael(a)stroeder.com><br> <b>Sent:</b> November 23, 2017 15:19<br> <b>To:</b> kristianmccolm(a)hotmail.com; openldap-its(a)OpenLDAP.org<br> <b>Subject:</b> Re: (ITS#8776) lessOrEqual does not work as expected</font> <div> </div> </div> <div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:10pt;= "> <div class=3D"PlainText">kristianmccolm(a)hotmail.com wrote:<br> > Full_Name: Kristian McColm<br> > Version: slapd 2.4.40<br> <br> Did you also test with a newer release?<br> <br> > With an attribute type defined in the schema and index as per the belo= w, and the<br> > value of the attribute set to 0, the lessOrEqual filter does not work = as<br> > expected.<br> <br> It works for me.<br> <br> Example filter (aeStatus<=3D1) also finds entries with (aeStatus=3D0):<b= r> <br> <a href=3D"https://demo.ae-dir.com/web2ldap?ldapi://%2Fopt%2Fae-dir%2Frun%2= Fslapd%2Fldapi/cn=3Dtest,ou=3Dae-dir??sub?(aeStatus<=3D1)?bindname=3Duid= %3Dzots%2Ccn%3Dtest%2Cou%3Dae-dir,X-BINDPW=3DCorrectHorseBatteryStaple">htt= ps://demo.ae-dir.com/web2ldap?ldapi://%2Fopt%2Fae-dir%2Frun%2Fslapd%2Fldapi= /cn=3Dtest,ou=3Dae-dir??sub?(aeStatus<=3D1)?bindname=3Duid%3Dzots%2Ccn%3= Dtest%2Cou%3Dae-dir,X-BINDPW=3DCorrectHorseBatteryStaple</a><br> <br> (This is an OpenLDAP 2.4.45 server but this worked for me with older<br> releases too.)<br> <br> > Schema attribute:<br> > olcAttributeTypes: {1} ( <oid> NAME 'num' DESC 'Numeric Attribut= e' SYNTAX<br> > 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' EQUALITY integer= Match<br> > ORDERING integerOrderingMatch )<br> <br> Did you use <oid> as a placeholder or is that value really literally = in<br> your schema? If you used it as a placeholder herein which OID did you<br> really use?<br> <br> Did you eventually changed index-related schema config without re-indexing?= <br> <br> Ciao, Michael.<br> <br> </div> </span></font></div> </div> </div> </body> </html> --_000_BN6PR04MB08825B65B73F5FF9B6674966DD210BN6PR04MB0882namp_--

1 0

Re: (ITS#8776) lessOrEqual does not work as expected
by michael＠stroeder.com 23 Nov '17

23 Nov '17

This is a cryptographically signed message in MIME format. --------------ms080105080402020204000104 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable kristianmccolm(a)hotmail.com wrote: > Full_Name: Kristian McColm > Version: slapd 2.4.40 Did you also test with a newer release? > With an attribute type defined in the schema and index as per the below= , and the > value of the attribute set to 0, the lessOrEqual filter does not work a= s > expected. It works for me. Example filter (aeStatus<=3D1) also finds entries with (aeStatus=3D0): https://demo.ae-dir.com/web2ldap?ldapi://%2Fopt%2Fae-dir%2Frun%2Fslapd%2F= ldapi/cn=3Dtest,ou=3Dae-dir??sub?(aeStatus<=3D1)?bindname=3Duid%3Dzots%2C= cn%3Dtest%2Cou%3Dae-dir,X-BINDPW=3DCorrectHorseBatteryStaple (This is an OpenLDAP 2.4.45 server but this worked for me with older releases too.) > Schema attribute: > olcAttributeTypes: {1} ( <oid> NAME 'num' DESC 'Numeric Attribute' SYNT= AX > 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' EQUALITY integerM= atch > ORDERING integerOrderingMatch ) Did you use <oid> as a placeholder or is that value really literally in your schema? If you used it as a placeholder herein which OID did you really use? Did you eventually changed index-related schema config without re-indexin= g? Ciao, Michael. --------------ms080105080402020204000104 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CucwggT9MIID5aADAgECAhBFRleVrRF8X5GwbV0tcLCgMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwOTE2MDcxNjUxWhcNMTkxMjE2MDcxNjUxWjBEMR0wGwYDVQQDDBRtaWNo YWVsQHN0cm9lZGVyLmNvbTEjMCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20w ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChMBt5jtuLXsNQ5U7rBbZit8sknIwz hfaousT3d/fssQ6qZwe9l1yklILSXVMqI7/bxbiqcd3zrz+imdSlZPrFBHGfh04DZHCfss2F RwSswGejqP1qE3hPvZi96wFfOMqenpN+pSXqNJ1OPBCJ8a+8ZEioFKoEj3HkCCXjbmezAgms FuA7aFE9BfjJ2eQKw8B9G8X1FjvOTinYSZ2F+qHpKgywl4HTx0dMnYy+Pwu4DDIHkEaVH+uj K1/ed76WUEH51mX9m2Xu0onfQlSM3me6EvAAZiIDsCEbF9WttRuJbpfCFo0m2uW7BBugS7EG Jro1nRSQVnpJyTFgHb5EGMVVAgMBAAGjggG4MIIBtDAOBgNVHQ8BAf8EBAMCBLAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFh1801TSuxT Nltnv9rOjrZzUUgNMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUF BwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUF BzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYD VR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3Js MB8GA1UdEQQYMBaBFG1pY2hhZWxAc3Ryb2VkZXIuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tLzBHBgNVHSAEQDA+MDwGCysGAQQBgbU3AQIFMC0wKwYIKwYBBQUH AgEWH2h0dHBzOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggEB AKiJ9wpjJeHdEzHDZyqmhn4cHcRj9Ag7ZQK0meq1N3oQ9M1YeVge6vZe20LXojgXsNUQGLSt 1lW2s7fABkL9CF+/RtWznHxlp4YpWX/RgbHBo3uXKNA5JUOjbxQ2+1b1jaTp/FUrSIISAxgd RpeYAODJ0db1x8Q+l66DtIVjj7ktWISdJWE2Opn4QnaRwdj6n35Rul4S2ikUsmxtGrHLpjRR XJqbsGa0RZdJyUKlZ2ZRAoRz4jKHOogQcig937sR5Ut2pGOhrScEhgARY2c8Gs2olRTL3pue mE4vjY0g1Nwr9RzeFwMuasiFh4yD34i6jIRfoNzuLPgydjsJ0grw0akwggXiMIIDyqADAgEC AhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAklMMRYwFAYD VQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0 ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17Ake fMyUGwrQdvwObhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzL A84J6Ws5T4NfXZ0qn4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmC S+kICslYYWgXOMt2xlsSslxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6my Su8j8BWWHpChNNeTrFuhVfrOAyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR 9t4APXGzAgMBAAGjggFkMIIBYDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0 cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEF BQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDAGCCsGAQUFBzAChiRodHRwOi8vYWlh LnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0OBBYEFCSBbDlhvkkPj7cbRivJKLUn SG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMD8GA1UdIAQ4MDYwNAYEVR0g ADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZI hvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh2NCXTq7im61g7F1L IiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw5kG3DN8pd1hS EUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07v29MdhaP v3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Yklue /quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6 UpVDo/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHM zcwk3EV2B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuK KwHNL8F4GGp6jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ 8j6y6S9p0xE/Ga0peVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMYIDzDCCA8gCAQEwgYkw dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx IENsaWVudCBDQQIQRUZXla0RfF+RsG1dLXCwoDANBglghkgBZQMEAgEFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcxMTIzMjAxOTA1WjAvBgkq hkiG9w0BCQQxIgQggLNdtpY0mPV/KXlnxaApGLsiY4jM5Sciqt5v2UgVidMwbAYJKoZIhvcN AQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3 DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBmgYJKwYB BAGCNxAEMYGMMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkw JwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3Rh cnRDb20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwgZwGCyqGSIb3DQEJ EAILMYGMoIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYD VQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRD b20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwDQYJKoZIhvcNAQEBBQAE ggEAWGyJAmdDrMntsX8zdI09M0xOfYtzmvyfwI2/66v0JXT01gaXeyulOdSGFJNfBsjNYhUn inuoMsqCohSo+nuzctIePo1ejbrGTMTSb4lWgs1ZdEDDO5pP8uOe1c3m3wTCVwaFyaRM5FMn eRtZIwdnHpMr43f99ridT8dEz15Nm/Vko+FS0lpI8xIGsN1ViqEnadK2L2tWjokA9MAbeU/J N1ZiJGRNXCkhAT02I9xgJQ3gTNR5hVyXachauBB3sCaDlWDfOx7k7NyVP1/NTYx9GxuTiR+s fprm+Y8lbNmzzcYLp82wwVRccFrzG9etnGuhNlA3SdxLNkKmdGwraIylJQAAAAAAAA== --------------ms080105080402020204000104--

1 0

(ITS#8776) lessOrEqual does not work as expected
by kristianmccolm＠hotmail.com 23 Nov '17

23 Nov '17

Full_Name: Kristian McColm Version: slapd 2.4.40 OS: RHEL 6.8 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (162.208.80.0) With an attribute type defined in the schema and index as per the below, and the value of the attribute set to 0, the lessOrEqual filter does not work as expected. Schema attribute: olcAttributeTypes: {1} ( <oid> NAME 'num' DESC 'Numeric Attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' EQUALITY integerMatch ORDERING integerOrderingMatch ) Index attribute: olcDbIndex: num eq,pres Less or Equal does not work: $ ldapsearch -x -h localhost -p 389 -b "uid=bob,dc=test,dc=com" '(num<=1)' # extended LDIF # # LDAPv3 # base <uid=bob,dc=test,dc=com> with scope subtree # filter: (num<=1) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Equality match works however: $ ldapsearch -x -h localhost -p 389 -b "uid=bob,dc=test,dc=com" '(num=0)' # extended LDIF # # LDAPv3 # base <uid=bob,dc=test,dc=com> with scope subtree # filter: (num=0) # requesting: ALL # dn: uid=bob,dc=test,dc=com objectClass: top objectClass: testObjectClass uid: bob num: 0 # numResponses: 2 # numEntries: 1 And with a non-zero value for 'num' lessOrEqual works as expected: $ ldapsearch -x -h localhost -p 389 -b "uid=bob,dc=test,dc=com" '(num<=10)' # extended LDIF # # LDAPv3 # base <uid=bob,dc=test,dc=com> with scope subtree # filter: (num<=10) # requesting: ALL # dn: uid=bob,dc=test,dc=com objectClass: top objectClass: testObjectClass uid: bob num: 1 # numResponses: 2 # numEntries: 1

1 0

(ITS#8775) PASSMOD exop fails with RWM and tight ACLs
by quinot＠adacore.com 22 Nov '17

22 Nov '17

Full_Name: Thomas Quinot Version: slapd 2.X (Nov 22 2017 11:39:03) OS: Linux URL: ftp://ftp.openldap.org/incoming/quinot-171122.diff Submission from: (NULL) (2a02:2ab8:224:1:36e6:d7ff:fe09:66dd) If a tight ACL is globally defined for userPassword: access to attrs=userPassword by dn="cn=Manager,o=Local" write by self write by anonymous auth and there is a virtual naming context implemented using a relay backend with rwm overlay: database @BACKEND@ suffix "dc=example,dc=com" [...] database relay suffix o=OtherExample,c=US relay dc=example,dc=com overlay rwm rwm-suffixmassage "dc=example,dc=com" then an end-user's attempt to update her own password will fail with: err=53 text=unwilling to verify old password because at some point we attempt to apply the above ACL to the original (virtual) DN, but considering the resolved (real) DN for the user: 5a1553ea => acl_mask: access to entry "cn=Ursula Hampster,ou=Alumni Association,ou=People,o=OtherExample,c=US", attr "userPassword" requested 5a1553ea => acl_mask: to value by "cn=ursula hampster,ou=alumni association,ou=people,dc=example,dc=com", (=0)

1 0

Re: (ITS#8767) Binddn issue with a comma in the DN
by michael＠stroeder.com 21 Nov '17

21 Nov '17

clement.oudot(a)savoirfairelinux.com wrote: > I confirm there is no bug, but the escaping is a little weird, as we need two \\ to escape the , character. IMHO it's not weird because for escaping the comma in DN string representation you need the first back-slash which you have to escape once more for config syntax. Ciao, Michael.

1 0

Re: (ITS#8767) Binddn issue with a comma in the DN
by clement.oudot＠savoirfairelinux.com 21 Nov '17

21 Nov '17

Hello, I confirm there is no bug, but the escaping is a little weird, as we need two \\ to escape the , character. Config sample: uri ldap://127.0.0.1/dc=test,dc=example,dc=com idassert-bind bindmethod="simple" binddn="cn=OUDOT\\, Clement,ou=users,dc=example,dc=com" credentials="secret" mode="legacy" flags="non-prescriptive" Thanks a lot to Michael Stroeder for his help. Clement.

1 0

Re: (ITS#8774) [PATCH] EVP_MD_CTX_create and EVP_MD_CTX_destroy have been replaced by EVP_MD_CTX_new and EVP_MD_CTX_free in openssl v1.1 and above.
by quanah＠symas.com 17 Nov '17

17 Nov '17

--On Thursday, November 16, 2017 4:47 PM +0000 minfrin(a)sharp.fm wrote: > Full_Name: Graham Leggett > Version: git master > OS: CentOS7 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (2001:470:18b1:1:c920:9f6:b546:7826) > > > The addition of 8e34ed8c on the 7th of November broke the build for > openssl < 1.1, as the patch used the newer versions of these functions. Thanks for the report! This issue has now been fixed in openldap head without the necessity of a configure check. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8774) [PATCH] EVP_MD_CTX_create and EVP_MD_CTX_destroy have been replaced by EVP_MD_CTX_new and EVP_MD_CTX_free in openssl v1.1 and above.
by minfrin＠sharp.fm 16 Nov '17

16 Nov '17

Full_Name: Graham Leggett Version: git master OS: CentOS7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:470:18b1:1:c920:9f6:b546:7826) The addition of 8e34ed8c on the 7th of November broke the build for openssl < 1.1, as the patch used the newer versions of these functions. The following patch adds the associated autoconf stuff to fix this: >From e111db878300d60acdc295eec08e008a831f9895 Mon Sep 17 00:00:00 2001 From: Graham Leggett <minfrin(a)sharp.fm> Date: Sat, 23 Sep 2017 02:10:36 +0000 Subject: [PATCH] EVP_MD_CTX_create and EVP_MD_CTX_destroy have been replaced by EVP_MD_CTX_new and EVP_MD_CTX_free in openssl v1.1 and above. --- configure.in | 5 +++++ libraries/libldap/tls_o.c | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/configure.in b/configure.in index 46e5e8c..b3da5f1 100644 --- a/configure.in +++ b/configure.in @@ -1223,6 +1223,11 @@ if test $ol_with_tls = openssl || test $ol_with_tls = auto ; then TLS_LIBS="-lssl -lcrypto" fi + save_LIBS="$LIBS" + LIBS="$LIBS $TLS_LIBS" + AC_CHECK_FUNCS(EVP_MD_CTX_create EVP_MD_CTX_destroy) + LIBS="$save_LIBS" + OL_SSL_COMPAT if test $ol_cv_ssl_crl_compat = yes ; then AC_DEFINE(HAVE_OPENSSL_CRL, 1, diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c index d3b6ceb..14dffbd 100644 --- a/libraries/libldap/tls_o.c +++ b/libraries/libldap/tls_o.c @@ -867,7 +867,11 @@ tlso_session_pinning( LDAP *ld, tls_session *sess, char *hashalg, struct berval goto done; } +#ifdef HAVE_EVP_MD_CTX_CREATE + mdctx = EVP_MD_CTX_create(); +#else mdctx = EVP_MD_CTX_new(); +#endif if ( !mdctx ) { rc = -1; goto done; @@ -877,7 +881,11 @@ tlso_session_pinning( LDAP *ld, tls_session *sess, char *hashalg, struct berval EVP_DigestUpdate( mdctx, key.bv_val, key.bv_len ); EVP_DigestFinal_ex( mdctx, (unsigned char *)keyhash.bv_val, &len ); keyhash.bv_len = len; +#ifdef HAVE_EVP_MD_CTX_DESTROY + EVP_MD_CTX_destroy( mdctx ); +#else EVP_MD_CTX_free( mdctx ); +#endif } else { keyhash = key; } -- 1.8.3.1

1 0

(ITS#8773) slapo-deref: man page and test suite needed
by quanah＠openldap.org 16 Nov '17

16 Nov '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) The slapo-deref overlay is missing a man page and a corresponding test in the test suite. These should be added to the project.

1 0

(ITS#8772) Build fail: thr_posix.c:329:16: error: only weak aliases are supported on darwin
by minfrin＠sharp.fm 15 Nov '17

15 Nov '17

Full_Name: Graham Leggett Version: git master OS: MacOS Sierra URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (5.56.169.82) Hi all, I am seeing a build failure when trying to build openldap master on MacOS Sierra: cc -g -O2 -I../../include -I../../include -DLDAP_R_COMPILE -I./../libldap -DLDAP_LIBRARY -c thr_posix.c -fno-common -DPIC -o .libs/thr_posix.o thr_posix.c:329:16: error: only weak aliases are supported on darwin LDAP_GCCATTR((alias("ldap_pvt_thread_mutex_destroy"))); ^ thr_posix.c:331:16: error: only weak aliases are supported on darwin LDAP_GCCATTR((alias("ldap_pvt_thread_mutex_lock"))); ^ thr_posix.c:333:16: error: only weak aliases are supported on darwin LDAP_GCCATTR((alias("ldap_pvt_thread_mutex_trylock"))); ^ thr_posix.c:335:16: error: only weak aliases are supported on darwin LDAP_GCCATTR((alias("ldap_pvt_thread_mutex_unlock"))); ^ 4 errors generated. make[2]: *** [thr_posix.lo] Error 1 make[1]: *** [all-common] Error 1 make: *** [all-common] Error 1 Regards, Graham --

1 0

Re: (ITS#8767) Binddn issue with a comma in the DN
by clement.oudot＠savoirfairelinux.com 12 Nov '17

12 Nov '17

Le 02/11/2017 =C3=A0 07:26, clement.oudot(a)savoirfairelinux.com a =C3=A9cr= it : > Le 31/10/2017 =3DC3=3DA0 17:39, michael(a)stroeder.com a =3DC3=3DA9crit : >> The ITS is only for reporting bugs. >> This is not a bug. It's a usage question. >> >> You should post such questions to openldap-technical mailing list afte= r >> subscribing to it: >> >> https://www.openldap.org/lists/mm/listinfo/openldap-technical >> >> A short hint about escaping, e.g. a comma in DN string representation: >> >> https://tools.ietf.org/html/rfc4514#section-2.4 >> >> Note that depending on your client config system more escaping might b= e >> needed because of the config syntax. > > > > Hello Michael, > > it seems to be a bug, as if I escape the comma in slapd.conf, I still=3D= 20 > have the error. > > =3D3D=3D3D slapd.conf =3D3D=3D3D > idassert-bind bindmethod=3D3D"simple" binddn=3D3D"cn=3D3DLastname\,=3D2= 0 > Firstname,ou=3D3Dusers,dc=3D3Dexample,dc=3D3Dcom" credentials=3D3D"secr= et" mode=3D3D=3D > "legacy"=3D20 > flags=3D3D"non-prescriptive" > > =3D3D=3D3D slaptest -f slapd.conf =3D3D=3D3D > 59faba5e invalid bind config value binddn=3D3Dcn=3D3DLastname,=3D20 > Firstname,ou=3D3Dusers,dc=3D3Dexample,dc=3D3Dcom > 59faba5e slapd.conf: line 31: "idassert-bind <args>": unable to parse=3D= 20 > field "binddn=3D3Dcn=3D3DLastname, Firstname,ou=3D3Dusers,dc=3D3Dexampl= e,dc=3D3Dcom=3D > ". > slaptest: bad configuration file! > > > Seems the escaping is not taken into account. Hello, can someone confirm this is not a bug? In this case; how should we=20 escape the value? I tried several things, without success. Cl=C3=A9ment.

1 0

(ITS#8771) slapd.backends(5) needs updating
by quanah＠openldap.org 08 Nov '17

08 Nov '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) The man page for slapd.backends(5) says that back-hdb is the "recommended primary backend". This needs to be updated to note that back-mdb is the "recommended primary backend" and the text for the bdb & hdb backends updated along the same lines.

1 0

Re: (ITS#8461) Unable to import LDIF from back-hdb DB to back-mdb db
by quanah＠symas.com 08 Nov '17

08 Nov '17

--On Friday, July 08, 2016 5:33 PM +0000 quanah(a)openldap.org wrote: > In moving off of back-hdb, encountered a scenario where importing the = LDIF > exported via slapcat failed when loading into back-mdb via slapadd. > There is nothing technically wrong with the entry. Will provide the > problematic entry elsewhere, as it contains PII. To note, the problematic entry has an RDN value > 512 characters.=20 Anonymizing the problem DN, we have: dn=3D"zimbraSignatureName=3Dxxxxx xxxxxxxxxxxxx xxxxxx xx xxxx x xxxx! = ..xxxxxx=20 xx xxxxxxxx xxx'x xxxx xxxxx xxxxx xxxxxx=E2=80=A6 & xxxx xx x xxxxx xx xx = xxxx=20 xxxx xxxxx!?! =E2=80=A6x xxxx xxxxx xx xxxxxxxxxx xxxxxxxxx xxxxxxxxx = xxxxxxx:=20 xxxxxx & xxxxxxxx & xxxxxx xxxxx x xxxxxx xx xxx xxxxxx=20 xxxxxxx.,uid=3Dxxxxxxxxxxxx,ou=3Dpeople,dc=3Dxxxx,dc=3Dxx" = (line=3D89392876):=20 txn_aborted! MDB_BAD_VALSIZE: Too big key/data, key is empty, or wrong=20 DUPFIXED size (-30781) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8753) Public key pinning support in libldap
by ondra＠mistotebe.net 07 Nov '17

07 Nov '17

On Tue, Oct 10, 2017 at 10:43:42AM +0000, ondra(a)openldap.org wrote: > URL: https://github.com/mistotebe/openldap/tree/its8753 > > A new libldap option LDAP_OPT_X_TLS_PEERKEY_HASH that accepts a string > 'hashname/base64_hash_of_public_key'. If a TLS session is already present on the > main connection, it is also checked immediately. > > It introduces a dependency on liblutil by depending on the symbol > lutil_b64_pton. Somehow, this breaks the build for the ldap* tools, not sure why > or how to fix that yet. A new version is now at the same place (see above), it moves the ldif.c in-place base64 decoding into a separate function and reuses that. Other changes: - pin hash algorithm separator changes to ':' - pin can now be set from the environment - can now better deal with connection freeing and/or changes to the global ldap options -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs November 2017