Full_Name: Quanah Gibson-Mount
Version: HEAD
OS: N/A
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (47.208.148.239)
In a situation where a dynamic group has been created and a compare operation is
run with a DN that doesn't exist but is within the scope of the dynamic group
URI, the ldapcompare operation will incorrectly return an error 80 instead of
error 5 (compare FALSE).
For example, if I have:
dn: cn=planning,ou=Groups,dc=example,dc=com
objectClass: groupOfURLs
cn: …
[View More]planning
memberURL: ldap:///ou=planning,dc=example,dc=com??sub?(objectClass=inetorgpers
on)
and I do an ldapcompare with:
ldapcompare -x -H ldap://anvil2.rb.symas.net -D dc=example,dc=com -w secret
cn=planning,ou=Groups,dc=example,dc=com "member:cn=Ramakant
Wolow,ou=Planning,dc=example,dc=com"
(i.e., this entry doesn't exist in the DB), I get:
Compare Result: Other (e.g., implementation specific) error (80)
UNDEFINED
This appears to be due to the fact that in this scenario, slapd attempts to find
the DN in the underlying DB and it doesn't exist, so an err=32 is returned back.
This is incorrectly interpreted as an unknown error, thus the err=80 result.
Instead it should be treated as "not a member of the group".
[View Less]
Thank you Michael, you are correct. Somehow I missed the 2.4.46 release.
This issue may be closed.
Norm Green
On 10/1/2018 2:38 AM, Michael Ströder wrote:
> On 10/1/18 6:18 AM, norm.green(a)gemtalksystems.com wrote:
>> Full_Name: Norman Green
>> Version: 2.4.45
>>
>> Unfortunately the layout of the BIO_METHOD struct changed in OpenSSL
>> 1.1.1 and the static initialization is now incorrect:
> CHANGES of release 2.4.46 contains this:
>
> --------…
[View More]------------------ snip --------------------------
> OpenLDAP 2.4.46 Release (2018/03/22)
> [..]
> Fixed libldap OpenSSL 1.1.1 compatibility with BIO_method (ITS#8791)
> -------------------------- snip --------------------------
>
> So your report might be a duplicate of this:
>
> https://www.openldap.org/its/index.cgi?findid=8791
>
> Ciao, Michael.
[View Less]
On 10/1/18 6:18 AM, norm.green(a)gemtalksystems.com wrote:
> Full_Name: Norman Green
> Version: 2.4.45
>
> Unfortunately the layout of the BIO_METHOD struct changed in OpenSSL
> 1.1.1 and the static initialization is now incorrect:
CHANGES of release 2.4.46 contains this:
-------------------------- snip --------------------------
OpenLDAP 2.4.46 Release (2018/03/22)
[..]
Fixed libldap OpenSSL 1.1.1 compatibility with BIO_method (ITS#8791)
-------------------------- snip --------…
[View More]------------------
So your report might be a duplicate of this:
https://www.openldap.org/its/index.cgi?findid=8791
Ciao, Michael.
[View Less]
Full_Name: Norman Green
Version: 2.4.45
OS: AIX
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (50.53.145.234)
in tls_o.c, the function tlso_sb_setup has this code on line 833:
bio = BIO_new( &tlso_bio_method );
which uses a statically allocated BIO_METHOD. Unfortunately the layout of the
BIO_METHOD struct changed in OpenSSL 1.1.1 and the static initialization is now
incorrect:
static BIO_METHOD tlso_bio_method =
{
( 100 | 0x400 ), /* it's a source/sink BIO */
"…
[View More]sockbuf glue",
tlso_bio_write,
tlso_bio_read,
tlso_bio_puts,
tlso_bio_gets,
tlso_bio_ctrl,
tlso_bio_create,
tlso_bio_destroy
};
In 1.1.1, this (internal) SSL struct looks like this:
struct bio_method_st {
int type;
char *name;
int (*bwrite) (BIO *, const char *, size_t, size_t *);
int (*bwrite_old) (BIO *, const char *, int);
int (*bread) (BIO *, char *, size_t, size_t *);
int (*bread_old) (BIO *, char *, int);
int (*bputs) (BIO *, const char *);
int (*bgets) (BIO *, char *, int);
long (*ctrl) (BIO *, int, long, void *);
int (*create) (BIO *);
int (*destroy) (BIO *);
long (*callback_ctrl) (BIO *, int, BIO_info_cb *);
};
[View Less]