openldap-bugs April 2017

openldap-bugs@openldap.org

25 participants
116 discussions

Re: (ITS#8629) slapauth segfault with GSSAPI + olcAuthzRegexp using internal LDAP search + ppolicy overlay
by clement.oudot＠savoirfairelinux.com 06 Apr '17

06 Apr '17

Hello, I would like to know if some of you have an idea on how to fix this bug? I am able to test a patch if you can provide one. Regards, Cl=E9ment.

1 0

Re: (ITS#8444) Out-of-sync issue with memberOf overlay, Delta-syncrepl MMR and >2 nodes
by henson＠acm.org 05 Apr '17

05 Apr '17

On Mon, Apr 03, 2017 at 11:15:17AM -0700, Quanah Gibson-Mount wrote: > Looks like this has actually been reported before: > <http://www.openldap.org/its/index.cgi/?findid=7400> Yikes, from 2012, and never resolved 8-/. I'm curious though why Howard says the work has to be distributed to all the replicas locally as it wouldn't scale otherwise? For adding or removing a user from a group, replicating the memberOf attribute on the user in addition to the member attribute on the group only doubles the replication load which doesn't seem excessive. I suppose if you delete a group with a large membership that would result in updating a large number of users, but that's no different than if a delete a single user from a large number of groups, which doesn't seem to cause any issues. Unless I'm misunderstanding something? In any case, I suppose this ITS can be closed now too, with the same resolution that the memberof overlay is no longer supported in a replicated configuration and to switch to the dynlist implementation...

1 0

Re: (ITS#8609) segfault in mods.c - modify_add_values
by henson＠acm.org 05 Apr '17

05 Apr '17

On Mon, Apr 03, 2017 at 02:44:48PM +0100, Howard Chu wrote: > You should probably switch to a non-optimized build. The backtrace you > posted initially had most parameters optimized out, which also makes > things harder to trace. Ok, I installed binaries built with -O0 on the master server that's been failing; I'll post a new backtrace the next time it crashes, thanks.

1 0

Re: (ITS#8533) Support OpenSSL-1.1.0c
by quanah＠symas.com 05 Apr '17

05 Apr '17

--On Thursday, April 06, 2017 2:02 AM +0100 Howard Chu <hyc(a)symas.com> wrote: >> +#if OPENSSL_VERSION_NUMBER < 0x10100000 > > Are you sure about exactly when these functions were removed? The title > of this ITS is for 1.1.0c, and the earlier patches were for 1.1.0a. For > version 1.1.0c we should be comparing to 0x1010003f, not 0x10100000. Yes, I checked against OpenSSL 1.1.0 (released before 1.1.0a). The OpenSSL shipped headers are clear on this as well, for example: #if OPENSSL_API_COMPAT < 0x10100000L # define SSL_library_init() OPENSSL_init_ssl(0, NULL) #endif #if OPENSSL_API_COMPAT < 0x10100000L # define SSL_load_error_strings() \ OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS \ | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL) #endif etc -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8533) Support OpenSSL-1.1.0c
by hyc＠symas.com 05 Apr '17

05 Apr '17

quanah(a)symas.com wrote: > --On Wednesday, April 05, 2017 11:12 PM +0000 quanah(a)symas.com wrote: > >>> The following 5 function calls are problematic: >>> >>> ./.libs/libldap.so: undefined reference to `OpenSSL_add_all_digests' >>> ./.libs/libldap.so: undefined reference to `SSL_load_error_strings' >>> ./.libs/libldap.so: undefined reference to `ERR_free_strings' >>> ./.libs/libldap.so: undefined reference to `EVP_cleanup' >>> ./.libs/libldap.so: undefined reference to `SSL_library_init' > > The above can be fixed with the following patch: > > build@u12build:~/git/symas-packages/thirdparty/openldap/build/UBUNTU12_64/symas-openldap/libraries/libldap$ > diff -u tls_o.c.orig tls_o.c > --- tls_o.c.orig 2017-04-05 14:40:02.849559862 -0700 > +++ tls_o.c 2017-04-05 15:13:09.371718493 -0700 > @@ -154,9 +154,16 @@ > (void) tlso_seed_PRNG( lo->ldo_tls_randfile ); > #endif > > +#if OPENSSL_VERSION_NUMBER < 0x10100000 Are you sure about exactly when these functions were removed? The title of this ITS is for 1.1.0c, and the earlier patches were for 1.1.0a. For version 1.1.0c we should be comparing to 0x1010003f, not 0x10100000. > SSL_load_error_strings(); > SSL_library_init(); > OpenSSL_add_all_digests(); > +#else > + OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS \ > + | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); > + OPENSSL_init_ssl(0, NULL); > + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_DIGESTS, NULL); > +#endif > > /* FIXME: mod_ssl does this */ > X509V3_add_standard_extensions(); > @@ -172,6 +179,7 @@ > { > struct ldapoptions *lo = LDAP_INT_GLOBAL_OPT(); > > +#if OPENSSL_VERSION_NUMBER < 0x10100000 > EVP_cleanup(); > #if OPENSSL_VERSION_NUMBER < 0x10000000 > ERR_remove_state(0); > @@ -179,6 +187,9 @@ > ERR_remove_thread_state(NULL); > #endif > ERR_free_strings(); > +#else > + ERR_remove_thread_state(NULL); > +#endif > > if ( lo->ldo_tls_randfile ) { > LDAP_FREE( lo->ldo_tls_randfile ); > > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8533) Support OpenSSL-1.1.0c
by hyc＠symas.com 05 Apr '17

05 Apr '17

quanah(a)symas.com wrote: > --On Wednesday, April 05, 2017 10:38 PM +0000 quanah(a)symas.com wrote: > >> --On Wednesday, April 05, 2017 7:58 PM +0000 quanah(a)symas.com wrote: >> >>> If openssl 1.1.0 is built with the option "no-deprecated" the build will >>> fail, as portions of the code still use the pre 1.1 API. This needs >>> fixing before release. >> >> The following 5 function calls are problematic: >> >> ./.libs/libldap.so: undefined reference to `OpenSSL_add_all_digests' >> ./.libs/libldap.so: undefined reference to `SSL_load_error_strings' >> ./.libs/libldap.so: undefined reference to `ERR_free_strings' >> ./.libs/libldap.so: undefined reference to `EVP_cleanup' >> ./.libs/libldap.so: undefined reference to `SSL_library_init' >> >> >> Looking at the best way in which to fix. > > These also need fixing, as they don't exist in 1.1 when the old API is > disabled. > > CRYPTO_num_locks() > CRYPTO_LOCK > CRYPTO_set_locking_callback() > CRYPTO_set_id_callback() These only exist because OpenSSL's support for threading was mostly nonexistent in the past. They should just be #ifdef'd away for 1.1. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8533) Support OpenSSL-1.1.0c
by quanah＠symas.com 05 Apr '17

05 Apr '17

--On Wednesday, April 05, 2017 11:12 PM +0000 quanah(a)symas.com wrote: >> The following 5 function calls are problematic: >> >> ./.libs/libldap.so: undefined reference to `OpenSSL_add_all_digests' >> ./.libs/libldap.so: undefined reference to `SSL_load_error_strings' >> ./.libs/libldap.so: undefined reference to `ERR_free_strings' >> ./.libs/libldap.so: undefined reference to `EVP_cleanup' >> ./.libs/libldap.so: undefined reference to `SSL_library_init' The above can be fixed with the following patch: build@u12build:~/git/symas-packages/thirdparty/openldap/build/UBUNTU12_64/symas-openldap/libraries/libldap$ diff -u tls_o.c.orig tls_o.c --- tls_o.c.orig 2017-04-05 14:40:02.849559862 -0700 +++ tls_o.c 2017-04-05 15:13:09.371718493 -0700 @@ -154,9 +154,16 @@ (void) tlso_seed_PRNG( lo->ldo_tls_randfile ); #endif +#if OPENSSL_VERSION_NUMBER < 0x10100000 SSL_load_error_strings(); SSL_library_init(); OpenSSL_add_all_digests(); +#else + OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS \ + | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); + OPENSSL_init_ssl(0, NULL); + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_DIGESTS, NULL); +#endif /* FIXME: mod_ssl does this */ X509V3_add_standard_extensions(); @@ -172,6 +179,7 @@ { struct ldapoptions *lo = LDAP_INT_GLOBAL_OPT(); +#if OPENSSL_VERSION_NUMBER < 0x10100000 EVP_cleanup(); #if OPENSSL_VERSION_NUMBER < 0x10000000 ERR_remove_state(0); @@ -179,6 +187,9 @@ ERR_remove_thread_state(NULL); #endif ERR_free_strings(); +#else + ERR_remove_thread_state(NULL); +#endif if ( lo->ldo_tls_randfile ) { LDAP_FREE( lo->ldo_tls_randfile ); --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8533) Support OpenSSL-1.1.0c
by quanah＠symas.com 05 Apr '17

05 Apr '17

--On Wednesday, April 05, 2017 10:38 PM +0000 quanah(a)symas.com wrote: > --On Wednesday, April 05, 2017 7:58 PM +0000 quanah(a)symas.com wrote: > >> If openssl 1.1.0 is built with the option "no-deprecated" the build will >> fail, as portions of the code still use the pre 1.1 API. This needs >> fixing before release. > > The following 5 function calls are problematic: > > ./.libs/libldap.so: undefined reference to `OpenSSL_add_all_digests' > ./.libs/libldap.so: undefined reference to `SSL_load_error_strings' > ./.libs/libldap.so: undefined reference to `ERR_free_strings' > ./.libs/libldap.so: undefined reference to `EVP_cleanup' > ./.libs/libldap.so: undefined reference to `SSL_library_init' > > > Looking at the best way in which to fix. These also need fixing, as they don't exist in 1.1 when the old API is disabled. CRYPTO_num_locks() CRYPTO_LOCK CRYPTO_set_locking_callback() CRYPTO_set_id_callback() --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8533) Support OpenSSL-1.1.0c
by quanah＠symas.com 05 Apr '17

05 Apr '17

--On Wednesday, April 05, 2017 7:58 PM +0000 quanah(a)symas.com wrote: > If openssl 1.1.0 is built with the option "no-deprecated" the build will > fail, as portions of the code still use the pre 1.1 API. This needs > fixing before release. The following 5 function calls are problematic: ./.libs/libldap.so: undefined reference to `OpenSSL_add_all_digests' ./.libs/libldap.so: undefined reference to `SSL_load_error_strings' ./.libs/libldap.so: undefined reference to `ERR_free_strings' ./.libs/libldap.so: undefined reference to `EVP_cleanup' ./.libs/libldap.so: undefined reference to `SSL_library_init' Looking at the best way in which to fix. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8533) Support OpenSSL-1.1.0c
by quanah＠symas.com 05 Apr '17

05 Apr '17

If openssl 1.1.0 is built with the option "no-deprecated" the build will fail, as portions of the code still use the pre 1.1 API. This needs fixing before release. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs April 2017