openldap-bugs September 2017

openldap-bugs@openldap.org

35 participants
128 discussions

(ITS#8743) slaptest segfault with invalid back-meta configuration
by quanah＠openldap.org 27 Sep '17

27 Sep '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) When converting a slapd.conf file to cn=config, where the back-meta backend has an invalid configuration for the "filter" directive, slaptest will segfault. It would be better to detect an error and exit accordingly. This is trivial to reproduce by using the following directive: filter "(objectClass=*)" as per slapd-meta(5), the "filter" directive takes a regex(5) rather than an LDAP filter. Still, it should not cause a segfault. ;)

1 0

(ITS#8742) slapd.conf/slapd-config divergence
by quanah＠openldap.org 26 Sep '17

26 Sep '17

Full_Name: Quanah Gibson-Mount Version: HEAD OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) The slapd.conf(5) and slapd-config(5) man pages have some significant divergence that need fixing. Examples: slapd.conf(5): Used by the authentication framework to convert simple user names, such as provided by SASL subsystem, or extracted from certificates in case of cert-based SASL EXTERNAL, or provided within the RFC 4370 "proxied authorization" control, to an LDAP DN used for authorization purposes. Note that the resulting DN need not refer to an existing entry to be considered valid. When an authorization request is received from the SASL subsystem, the SASL slapd-config(5): Used by the authentication framework to convert simple user names, such as provided by SASL subsystem, to an LDAP DN used for authorization purposes. Note that the resultant DN need not refer to an existing entry to be considered valid. When an authorization request is received from the SASL subsystem, the SASL slapd.conf(5): .B concurrency <integer> Specify a desired level of concurrency. Provided to the underlying thread system as a hint. The default is not to provide any hint. slapd-config(5): .B olcConcurrency: <integer> Specify a desired level of concurrency. Provided to the underlying thread system as a hint. The default is not to provide any hint. This setting is only meaningful on some platforms where there is not a one to one correspondence between user threads and kernel threads. slapd.conf(5) .B proxy_authz_non_critical disables acceptance of the proxied authorization control (RFC4370) when criticality is FALSE. .B dontusecopy_non_critical disables acceptance of the dontUseCopy control (a work in progress) when criticality is FALSE. slapd-config(5): These options are not listed slapd.conf(5) and slapd-config(5) have index_substr_if_minlen/index_substr_if_maxlen in opposite order in the man page slapd.conf(5): .B ldapsyntax "(\ <oid>\ [DESC\ <description>]\ [X\-SUBST <substitute-syntax>]\ )" .RS Specify an LDAP syntax using the LDAPv3 syntax defined in RFC 4512. The slapd parser extends the RFC 4512 definition by allowing string forms as well as numeric OIDs to be used for the syntax OID. (See the .B objectidentifier description.) The slapd parser also honors the .B X\-SUBST extension (an OpenLDAP-specific extension), which allows one to use the .B ldapsyntax statement to define a non-implemented syntax along with another syntax, the extension value .IR substitute-syntax , as its temporary replacement. The .I substitute-syntax must be defined. This allows one to define attribute types that make use of non-implemented syntaxes using the correct syntax OID. Unless .B X\-SUBST is used, this configuration statement would result in an error, since no handlers would be associated to the resulting syntax structure. .RE slapd-config(5): Section missing

1 0

Re: (ITS#8741) libldap ignoring timeout value
by Sean.Haugh＠vertivco.com 26 Sep '17

26 Sep '17

On Tue, Sep 26, 2017 at 06:06:23PM +0000, Hallvard Breien Furuseth wrote: > Try again without the "_" after "LDAP", like the ldap.conf manpage says. > That's unintuitive, but rather late to change at this point. This is using the LDAP C API. I have also used ldap_get_option calls to verify that the values are set correctly.=

1 0

Re: (ITS#8741) libldap ignoring timeout value
by h.b.furuseth＠usit.uio.no 26 Sep '17

26 Sep '17

On 26. sep. 2017 19:54, sean.haugh(a)vertivco.com wrote: > I have tried setting the LDAP_OPT_TIMEOUT, LDAP_OPT_NETWORK_TIMEOUT, > LDAP_OPT_TIMELIMIT values with ldap_simple_bind_s, and the call returns after > ~65 seconds rather than the 10-20 seconds I expect. Try again without the "_" after "LDAP", like the ldap.conf manpage says. That's unintuitive, but rather late to change at this point. -- Hallvard

1 0

(ITS#8741) libldap ignoring timeout value
by sean.haugh＠vertivco.com 26 Sep '17

26 Sep '17

Full_Name: Sean Haugh Version: 2.4.42 OS: Linux URL: Submission from: (NULL) (143.166.81.254) I have tried setting the LDAP_OPT_TIMEOUT, LDAP_OPT_NETWORK_TIMEOUT, LDAP_OPT_TIMELIMIT values with ldap_simple_bind_s, and the call returns after ~65 seconds rather than the 10-20 seconds I expect. The same is seen with ldap_result and ldap_simple_bind--regardless of the value of `timeout` that is set, whether explicit or NULL, the call blocks for ~65 seconds.

1 0

(ITS#8740) libldap ignoring timeout value
by sean.haugh＠vertivco.com 26 Sep '17

26 Sep '17

1 0

Re: (ITS#8732) LDAP_CIRCLEQ improvements
by okuznik＠symas.com 26 Sep '17

26 Sep '17

On Tue, Sep 26, 2017 at 02:00:40PM +0100, Howard Chu wrote: > Nothing in this patch says "rotate" anywhere. Please add some more > descriptive comments describing the purpose of each new macro. A version with the circular queue description extended to cover the rotation macros is available here: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170926-LDAP_CIRCLEQ.patch --=20 Ond=C5=99ej Kuzn=C3=ADk Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#8638) Recursive mutex in libldap_r
by hyc＠symas.com 26 Sep '17

26 Sep '17

hyc(a)symas.com wrote: > ondra(a)mistotebe.net wrote: >>> IMO using recursive mutexes means your code is broken. We introduced these for >>> accesslog.c but in fact we could avoid them at zero cost. Also I don't see the >>> relevance of libevent to this discussion. We use our own event mechanism and >>> it is more efficient than libevent. >> >> libevent is a dependency for the load balancer that I intend to propose >> for integration into the project after all the relevant dependencies >> have come in. >> >> There is a new version of this patch that provides an implementation on >> each platform or defers to the existing one (as per each platform's >> documentation). Untested except on POSIX and most of them seem pretty >> arcane anyway. >> >> ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170918-ITS8638-libldap_r-re… >> > It looks like glibc still doesn't define PTHREAD_MUTEX_RECURSIVE by default, > it requires compiling with either -D_GNU_SOURCE or -D_XOPEN_SOURCE. The > feature itself appears to be part of UNIX98. It's likely that all pthread > implementations available today support it, but it still seems a bit iffy. > OK, I see that current glibc defaults to _POSIX_C_SOURCE=200809 which includes __XOPEN_2K8. All of this came later than our rmutex.c which was written in 2006, so that explains where the need arose from. We should be safe pushing this in, go ahead. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8732) LDAP_CIRCLEQ improvements
by hyc＠symas.com 26 Sep '17

26 Sep '17

ondra(a)openldap.org wrote: > Full_Name: Ondrej Kuznik > Version: master > OS: > URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170913-LDAP_CIRCLEQ.patch > Submission from: (NULL) (82.10.24.68) > > > The CIRCLEQ macros are incomplete and not very useful on their > own, but when providing a few more that allow rotating it, they > are. Patch to that effect is attached. > > They could probably be made a bit more efficient as well, though. Nothing in this patch says "rotate" anywhere. Please add some more descriptive comments describing the purpose of each new macro. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8661) Fix warnings issued by Autoconf 2.68+
by hyc＠symas.com 26 Sep '17

26 Sep '17

okuznik(a)symas.com wrote: > Full_Name: Ondrej Kuznik > Version: master > OS: Linux > URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170524-Fix-warnings-issued-… > Submission from: (NULL) (2a02:c7f:2247:ec00:a3e:8eff:fe52:dac5) > > > Running aclocal/autoconf is quite noisy. The attached patch against master > follows the recommendations by the autoconf project > https://autotools.io/forwardporting/autoconf.html > > Looks fine, go ahead and merge. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs September 2017