openldap-bugs August 2018

openldap-bugs@openldap.org

27 participants
50 discussions

Re: (ITS#8650) EAGAIN from gnutls_handshake not respected
by subbarao＠computer.org 03 Aug '18

03 Aug '18

On 08/03/2018 12:09 PM, Ryan Tandy wrote: > Thanks for letting me know about this. This patch is running on quite > a few systems by now, I'm sorry the problem wasn't caught sooner. :/ No worries, thanks for responding so quickly on this! >> I'm wondering if there is a better way to handle EAGAIN returned from >> gnutls_handshake(), instead of doing a busywait as in ITS#8650, or my >> simplistic attempt at inserting a sleep() call which doesn't really >> seem to help. I'm wondering how the GnuTLS developers intend for >> people to use gnutls_handshake() properly, so as to gracefully handle >> sessions that involve long packets on the one hand, without opening >> up a vulnerability to chew up lots of system resources on the other >> hand. > > Right. I mean, this is how GnuTLS' own example shows to do it: > > https://gitlab.com/gnutls/gnutls/blob/master/doc/examples/ex-client-dtls.c#… > Hmm, that's a head-scratcher. It doesn't seem very effective to have a non-blocking I/O interface and then recommend wrapping it in a busywait loop :-) > We could place a limit on the number of iterations, though any such > limit would have to be arbitrary. > > There might be an asynchronous GnuTLS API that could be used to avoid > tying up slapd while this is going on. > > I will look at how some other GnuTLS servers deal with this... Cool, thanks Ryan. Regards, -Kartik

1 0

Re: (ITS#8650) EAGAIN from gnutls_handshake not respected
by ryan＠nardis.ca 03 Aug '18

03 Aug '18

Hi Kartik, On Fri, Aug 03, 2018 at 11:19:06AM -0400, Kartik Subbarao wrote: >I'm running into a problem with slapd 2.4.46 hanging on Ubuntu 18.04, >which seems to be a side effect of the ITS#8650 patch: > >https://github.com/openldap/openldap/commit/7b5181da8cdd47a13041f9ee36fa959… > >slapd will run fine for a while, but during some periods of >high-traffic, it'll hang. It'll peg the CPU at 100% and won't respond >to any new LDAP connections. After some time, it'll resume working >again, but overall it's fairly unreliable. Thanks for letting me know about this. This patch is running on quite a few systems by now, I'm sorry the problem wasn't caught sooner. :/ >I'm wondering if there is a better way to handle EAGAIN returned from >gnutls_handshake(), instead of doing a busywait as in ITS#8650, or my >simplistic attempt at inserting a sleep() call which doesn't really >seem to help. I'm wondering how the GnuTLS developers intend for >people to use gnutls_handshake() properly, so as to gracefully handle >sessions that involve long packets on the one hand, without opening up >a vulnerability to chew up lots of system resources on the other hand. Right. I mean, this is how GnuTLS' own example shows to do it: https://gitlab.com/gnutls/gnutls/blob/master/doc/examples/ex-client-dtls.c#… We could place a limit on the number of iterations, though any such limit would have to be arbitrary. There might be an asynchronous GnuTLS API that could be used to avoid tying up slapd while this is going on. I will look at how some other GnuTLS servers deal with this...

1 0

Re: (ITS#8650) EAGAIN from gnutls_handshake not respected
by subbarao＠computer.org 03 Aug '18

03 Aug '18

Hi Ryan, I'm running into a problem with slapd 2.4.46 hanging on Ubuntu 18.04, which seems to be a side effect of the ITS#8650 patch: https://github.com/openldap/openldap/commit/7b5181da8cdd47a13041f9ee36fa959… slapd will run fine for a while, but during some periods of high-traffic, it'll hang. It'll peg the CPU at 100% and won't respond to any new LDAP connections. After some time, it'll resume working again, but overall it's fairly unreliable. strace on slapd during the hang shows that it's constantly making read() calls that return EAGAIN. After doing a gdb stack trace on slapd, I realized that these read() calls are happening as part of the busywait for loop in tlsg_session_accept() that repeatedly calls gnutls_handshake() when it gets EAGAIN. When slapd recovers from this hang state, the first message it prints is a TLS negotiation failure error on the culprit file descriptor. If I back out the ITS#8650 patch, the problem goes away. If I insert sleep(1) in the for loop, slapd no longer pegs the CPU at 100%, but it still becomes unresponsive during these high-traffic periods. I don't know what's happening during these high-traffic periods that causes the TLS negotiation to go astray. Unfortunately it's not easy to reproduce this problem outside of this production environment, given the diversity of clients running different OSes with various versions of SSL libraries. I'm wondering if there is a better way to handle EAGAIN returned from gnutls_handshake(), instead of doing a busywait as in ITS#8650, or my simplistic attempt at inserting a sleep() call which doesn't really seem to help. I'm wondering how the GnuTLS developers intend for people to use gnutls_handshake() properly, so as to gracefully handle sessions that involve long packets on the one hand, without opening up a vulnerability to chew up lots of system resources on the other hand. Regards, -Kartik

1 0

Re: (ITS#8890) Bug fix patches unbreaking the build on x32 systems
by tg＠debian.org 01 Aug '18

01 Aug '18

Hi, > Thanks. Most of these look OK, but the unconditional use of "long > long" instead of "long" will break on machines where "long long" is > not 64 bits. 64 bits is not the requirement for all those, but size of time_t. Each of these instances was changed from outputting a time_t with %ld (without cast to long) to outputting a time_t with %lld after being cast to long long. As long long is either the same size or greater than long, this cannot break any existing scenario. It merely fixes the scenario in which time_t is larger than long but fits into long long. (It also fixes the case where time_t is smaller than long, incidentally, as it was not cast, prior.) Actual bit sizes are of no import here due to the explicit casts, given that time_t can be of various sizes and, in constrast to e.g. size_t with its %zu specifier, does not have a printf specifier of its own. Fixing this is already common practice for me, as MirBSD/i386 is also a platform with 32-bit long and 64-bit time_t, and has been for 14 years and about five weeks or so. bye, //mirabilos -- When he found out that the m68k port was in a pretty bad shape, he did not, like many before him, shrug and move on; instead, he took it upon himself to start compiling things, just so he could compile his shell. How's that for dedication. -- Wouter, about my Debian/m68k revival

1 0

Re: (ITS#8890) Bug fix patches unbreaking the build on x32 systems
by hyc＠symas.com 01 Aug '18

01 Aug '18

tg(a)debian.org wrote: > Full_Name: mirabilos > Version: 2.4.46 > OS: Debian > URL: > Submission from: (NULL) (2a01:4f8:150:946c::42:3) >=20 >=20 > I=C3=A2=E2=82=AC=E2=84=A2ve just managed to unbreak the build of openld= ap on x32 > (basically amd64ilp32: a 64-bit x86 architecture using 32-bit > =C3=A2=E2=82=AC=C5=93long=C3=A2=E2=82=AC=C2=9D and pointers) by fixing = a couple of simple GCC warnings. Thanks. Most of these look OK, but the unconditional use of "long long" i= nstead of "long" will break on machines where "long long" is not 64 bits. >=20 > Original bugreport: https://bugs.debian.org/905237 >=20 > Please find the attached patches (pretty machinal, so not > copyright-relevant) and include them in your next release. > Thanks! >=20 > --- a/clients/tools/common.c > +++ b/clients/tools/common.c > @@ -2326,7 +2326,7 @@ void tool_print_ctrls( > /* known controls */ > for ( j =3D 0; tool_ctrl_response[j].oid !=3D NULL; j++ ) { > if ( strcmp( tool_ctrl_response[j].oid, ctrls[i]->ldctl_oid ) =3D=3D= 0 ) { > - if ( !tool_ctrl_response[j].mask & tool_type ) { > + if ( !(tool_ctrl_response[j].mask & tool_type) ) { > /* this control should not appear > * with this tool; warning? */ > } > --- a/servers/slapd/backend.c > +++ b/servers/slapd/backend.c > @@ -1500,7 +1500,7 @@ fe_acl_group( > * or if filter parsing fails. > * In the latter case, > * we should give up. */ > - if ( ludp->lud_filter !=3D NULL && ludp->lud_filter !=3D '\0') { > + if ( ludp->lud_filter !=3D NULL && ludp->lud_filter[0] !=3D '\0')= { > filter =3D str2filter_x( op, ludp->lud_filter ); > if ( filter =3D=3D NULL ) { > /* give up... */ > --- a/servers/slapd/overlays/constraint.c > +++ b/servers/slapd/overlays/constraint.c > @@ -446,7 +446,7 @@ constraint_cf_gen( ConfigArgs *c ) > } > =20 > if ( ap.restrict_lud->lud_attrs !=3D NULL ) { > - if ( ap.restrict_lud->lud_attrs[0] !=3D '\0' ) { > + if ( ap.restrict_lud->lud_attrs[0] !=3D NULL ) { > snprintf( c->cr_msg, sizeof( c->cr_msg ), > "%s %s: attrs not allowed in restrict URI %s\n", > c->argv[0], c->argv[1], arg); > --- a/servers/slapd/syntax.c > +++ b/servers/slapd/syntax.c > @@ -219,8 +219,8 @@ syn_add( > } > =20 > assert( (*lsei)->lsei_values !=3D NULL ); > - if ( (*lsei)->lsei_values[0] =3D=3D '\0' > - || (*lsei)->lsei_values[1] !=3D '\0' ) > + if ( (*lsei)->lsei_values[0] =3D=3D NULL > + || (*lsei)->lsei_values[1] !=3D NULL ) > { > Debug( LDAP_DEBUG_ANY, "syn_add(%s): exactly one substitute synta= x must be > present\n", > ssyn->ssyn_syn.syn_oid, 0, 0 ); > --- a/tests/progs/slapd-addel.c > +++ b/tests/progs/slapd-addel.c > @@ -173,7 +173,7 @@ main( int argc, char **argv ) > =20 > } > =20 > - if (( attrs =3D=3D NULL ) || ( *attrs =3D=3D '\0' )) { > + if (( attrs =3D=3D NULL ) || ( *attrs =3D=3D NULL )) { > =20 > fprintf( stderr, "%s: invalid attrs in file \"%s\".\n", > argv[0], filename ); > --- a/contrib/slapd-modules/smbk5pwd/smbk5pwd.c > +++ b/contrib/slapd-modules/smbk5pwd/smbk5pwd.c > @@ -605,7 +605,7 @@ static int smbk5pwd_exop_passwd( > keys[0].bv_val =3D ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); > keys[0].bv_len =3D snprintf(keys[0].bv_val, > LDAP_PVT_INTTYPE_CHARS(long), > - "%ld", slap_get_time()); > + "%lld", (long long)slap_get_time()); > BER_BVZERO( &keys[1] ); > =09 > ml->sml_desc =3D ad_sambaPwdLastSet; > @@ -627,7 +627,7 @@ static int smbk5pwd_exop_passwd( > keys[0].bv_val =3D ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); > keys[0].bv_len =3D snprintf(keys[0].bv_val, > LDAP_PVT_INTTYPE_CHARS(long), > - "%ld", slap_get_time() + pi->smb_must_change); > + "%lld", (long long)slap_get_time() + (long long)pi->smb_must_chan= ge); > BER_BVZERO( &keys[1] ); > =20 > ml->sml_desc =3D ad_sambaPwdMustChange; > @@ -650,7 +650,7 @@ static int smbk5pwd_exop_passwd( > keys[0].bv_val =3D ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); > keys[0].bv_len =3D snprintf(keys[0].bv_val, > LDAP_PVT_INTTYPE_CHARS(long), > - "%ld", slap_get_time() + pi->smb_can_change); > + "%lld", (long long)slap_get_time() + (long long)pi->smb_can_chang= e); > BER_BVZERO( &keys[1] ); > =20 > ml->sml_desc =3D ad_sambaPwdCanChange; > --- a/libraries/libldap/os-ip.c > +++ b/libraries/libldap/os-ip.c > @@ -282,8 +282,8 @@ ldap_int_poll( > int rc; > =09 > =20 > - osip_debug(ld, "ldap_int_poll: fd: %d tm: %ld\n", > - s, tvp ? tvp->tv_sec : -1L, 0); > + osip_debug(ld, "ldap_int_poll: fd: %d tm: %lld\n", > + s, tvp ? (long long)tvp->tv_sec : -1LL, 0); > =20 > #ifdef HAVE_POLL > { > @@ -432,8 +432,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t > opt_tv =3D &tv; > } > =20 > - osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %ld async: %d\n", > - s, opt_tv ? tv.tv_sec : -1L, async); > + osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %lld async: %d\n", > + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); > =20 > if ( opt_tv && ldap_pvt_ndelay_on(ld, s) =3D=3D -1 ) > return ( -1 ); > --- a/libraries/libldap/os-local.c > +++ b/libraries/libldap/os-local.c > @@ -176,8 +176,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t > opt_tv =3D &tv; > } > =20 > - oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %ld async: %d\n", > - s, opt_tv ? tv.tv_sec : -1L, async); > + oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %lld async: %d\n"= , > + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); > =20 > if ( ldap_pvt_ndelay_on(ld, s) =3D=3D -1 ) return -1; > =20 > --- a/libraries/libldap/result.c > +++ b/libraries/libldap/result.c > @@ -264,8 +264,8 @@ wait4msg( > Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (infinite timeout= )\n", > (void *)ld, msgid, 0 ); > } else { > - Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %ld usec)= \n", > - (void *)ld, msgid, (long)timeout->tv_sec * 1000000 + timeout->tv_us= ec ); > + Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %lld usec= )\n", > + (void *)ld, msgid, (long long)timeout->tv_sec * 1000000LL + timeout= ->tv_usec > ); > } > #endif /* LDAP_DEBUG */ > =20 > --- a/servers/slapd/back-ldap/bind.c > +++ b/servers/slapd/back-ldap/bind.c > @@ -3008,14 +3008,14 @@ ldap_back_conn2str( const ldapconn_base_ > } > =20 > if ( lc->lcb_create_time !=3D 0 ) { > - len =3D snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_create_time ); > + len =3D snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_cre= ate_time > ); > if ( ptr + sizeof(" created=3D") + len >=3D end ) return -1; > ptr =3D lutil_strcopy( ptr, " created=3D" ); > ptr =3D lutil_strcopy( ptr, tbuf ); > } > =20 > if ( lc->lcb_time !=3D 0 ) { > - len =3D snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_time ); > + len =3D snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_tim= e ); > if ( ptr + sizeof(" modified=3D") + len >=3D end ) return -1; > ptr =3D lutil_strcopy( ptr, " modified=3D" ); > ptr =3D lutil_strcopy( ptr, tbuf ); > --- a/servers/slapd/back-meta/config.c > +++ b/servers/slapd/back-meta/config.c > @@ -1277,8 +1277,8 @@ meta_back_cf_gen( ConfigArgs *c ) > if ( mc->mc_network_timeout =3D=3D 0 ) { > return 1; > } > - bv.bv_len =3D snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld", > - mc->mc_network_timeout ); > + bv.bv_len =3D snprintf( c->cr_msg, sizeof(c->cr_msg), "%lld", > + (long long)mc->mc_network_timeout ); > bv.bv_val =3D c->cr_msg; > value_add_one( &c->rvalue_vals, &bv ); > break; > --- a/servers/slapd/overlays/dds.c > +++ b/servers/slapd/overlays/dds.c > @@ -417,7 +417,7 @@ dds_op_add( Operation *op, SlapReply *rs > assert( ttl <=3D DDS_RF2589_MAX_TTL ); > =20 > bv.bv_val =3D ttlbuf; > - bv.bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl ); > + bv.bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long= )ttl ); > assert( bv.bv_len < sizeof( ttlbuf ) ); > =20 > /* FIXME: apparently, values in op->ora_e are malloc'ed > @@ -695,7 +695,7 @@ dds_op_modify( Operation *op, SlapReply > goto done; > } > =20 > - bv_entryTtl.bv_len =3D snprintf( textbuf, sizeof( textbuf ), "%ld"= , entryTtl > ); > + bv_entryTtl.bv_len =3D snprintf( textbuf, sizeof( textbuf ), "%lld= ", (long > long)entryTtl ); > break; > =20 > default: > @@ -917,7 +917,7 @@ dds_response( Operation *op, SlapReply * > ttl =3D (ttl < 0) ? 0 : ttl; > assert( ttl <=3D DDS_RF2589_MAX_TTL ); > =20 > - len =3D snprintf( ttlbuf, sizeof(ttlbuf), "%ld", ttl ); > + len =3D snprintf( ttlbuf, sizeof(ttlbuf), "%lld", (long long)ttl ); > if ( len < 0 ) > { > goto done; > @@ -1177,7 +1177,7 @@ dds_op_extended( Operation *op, SlapRepl > ttlmod.sml_values =3D ttlvalues; > ttlmod.sml_numvals =3D 1; > ttlvalues[ 0 ].bv_val =3D ttlbuf; > - ttlvalues[ 0 ].bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%ld",= ttl ); > + ttlvalues[ 0 ].bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%lld"= , (long > long)ttl ); > BER_BVZERO( &ttlvalues[ 1 ] ); > =20 > /* the entryExpireTimestamp is added by modify */ > @@ -1205,8 +1205,8 @@ dds_op_extended( Operation *op, SlapRepl > rs->sr_rspoid =3D ch_strdup( slap_EXOP_REFRESH.bv_val ); > =20 > Log3( LDAP_DEBUG_TRACE, LDAP_LEVEL_INFO, > - "%s REFRESH dn=3D\"%s\" TTL=3D%ld\n", > - op->o_log_prefix, op->o_req_ndn.bv_val, ttl ); > + "%s REFRESH dn=3D\"%s\" TTL=3D%lld\n", > + op->o_log_prefix, op->o_req_ndn.bv_val, (long long)ttl ); > } > =20 > ber_free_buf( ber ); > --- a/servers/slapd/overlays/pcache.c > +++ b/servers/slapd/overlays/pcache.c > @@ -2728,8 +2728,8 @@ pc_bind_search( Operation *op, SlapReply > pbi->bi_flags |=3D BI_HASHED; > } else { > Debug( pcache_debug, "pc_bind_search: cache is stale, " > - "reftime: %ld, current time: %ld\n", > - pbi->bi_cq->bindref_time, op->o_time, 0 ); > + "reftime: %lld, current time: %lld\n", > + (long long)pbi->bi_cq->bindref_time, (long long)op->o_time, 0 ); > } > } else if ( pbi->bi_si ) { > /* This search result is going into the cache */ > @@ -3831,9 +3831,9 @@ pc_cf_gen( ConfigArgs *c ) > struct berval bv; > switch( c->type ) { > case PC_MAIN: > - bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %= d %ld", > + bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %= d %lld", > cm->db.bd_info->bi_type, cm->max_entries, cm->numattrsets, > - cm->num_entries_limit, cm->cc_period ); > + cm->num_entries_limit, (long long)cm->cc_period ); > bv.bv_val =3D c->cr_msg; > value_add_one( &c->rvalue_vals, &bv ); > break; > @@ -3875,12 +3875,12 @@ pc_cf_gen( ConfigArgs *c ) > /* HEADS-UP: always print all; > * if optional =3D=3D 0, ignore */ > bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), > - " %d %ld %ld %ld %ld", > + " %d %lld %lld %lld %lld", > temp->attr_set_index, > - temp->ttl, > - temp->negttl, > - temp->limitttl, > - temp->ttr ); > + (long long)temp->ttl, > + (long long)temp->negttl, > + (long long)temp->limitttl, > + (long long)temp->ttr ); > bv.bv_len +=3D temp->querystr.bv_len + 2; > bv.bv_val =3D ch_malloc( bv.bv_len+1 ); > ptr =3D bv.bv_val; > @@ -3897,9 +3897,9 @@ pc_cf_gen( ConfigArgs *c ) > for (temp=3Dqm->templates; temp; temp=3Dtemp->qmnext) { > if ( !temp->bindttr ) continue; > bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), > - " %d %ld %s ", > + " %d %lld %s ", > temp->attr_set_index, > - temp->bindttr, > + (long long)temp->bindttr, > ldap_pvt_scope2str( temp->bindscope )); > bv.bv_len +=3D temp->bindbase.bv_len + temp->bindftemp.bv_len + 4= ; > bv.bv_val =3D ch_malloc( bv.bv_len + 1 ); > --- a/servers/slapd/syncrepl.c > +++ b/servers/slapd/syncrepl.c > @@ -2395,8 +2395,8 @@ syncrepl_message_to_op( > op->o_callback =3D &cb; > slap_op_time( &op->o_time, &op->o_tincr ); > =20 > - Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %x\n", > - si->si_ridtxt, op->o_tid, 0 ); > + Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %lx\n", > + si->si_ridtxt, (unsigned long)op->o_tid, 0 ); > =20 > switch( op->o_tag ) { > case LDAP_REQ_ADD: > @@ -2905,8 +2905,8 @@ syncrepl_entry( > int freecsn =3D 1; > =20 > Debug( LDAP_DEBUG_SYNC, > - "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %x\n", > - si->si_ridtxt, syncrepl_state2str( syncstate ), op->o_tid ); > + "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %lx\n", > + si->si_ridtxt, syncrepl_state2str( syncstate ), (unsigned long)op->o= _tid ); > =20 > if (( syncstate =3D=3D LDAP_SYNC_PRESENT || syncstate =3D=3D LDAP_SY= NC_ADD ) ) { > if ( !si->si_refreshPresent && !si->si_refreshDone ) { >=20 >=20 --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8890) Bug fix patches unbreaking the build on x32 systems
by tg＠debian.org 01 Aug '18

01 Aug '18

Full_Name: mirabilos Version: 2.4.46 OS: Debian URL: Submission from: (NULL) (2a01:4f8:150:946c::42:3) I’ve just managed to unbreak the build of openldap on x32 (basically amd64ilp32: a 64-bit x86 architecture using 32-bit “long” and pointers) by fixing a couple of simple GCC warnings. Original bugreport: https://bugs.debian.org/905237 Please find the attached patches (pretty machinal, so not copyright-relevant) and include them in your next release. Thanks! --- a/clients/tools/common.c +++ b/clients/tools/common.c @@ -2326,7 +2326,7 @@ void tool_print_ctrls( /* known controls */ for ( j = 0; tool_ctrl_response[j].oid != NULL; j++ ) { if ( strcmp( tool_ctrl_response[j].oid, ctrls[i]->ldctl_oid ) == 0 ) { - if ( !tool_ctrl_response[j].mask & tool_type ) { + if ( !(tool_ctrl_response[j].mask & tool_type) ) { /* this control should not appear * with this tool; warning? */ } --- a/servers/slapd/backend.c +++ b/servers/slapd/backend.c @@ -1500,7 +1500,7 @@ fe_acl_group( * or if filter parsing fails. * In the latter case, * we should give up. */ - if ( ludp->lud_filter != NULL && ludp->lud_filter != '\0') { + if ( ludp->lud_filter != NULL && ludp->lud_filter[0] != '\0') { filter = str2filter_x( op, ludp->lud_filter ); if ( filter == NULL ) { /* give up... */ --- a/servers/slapd/overlays/constraint.c +++ b/servers/slapd/overlays/constraint.c @@ -446,7 +446,7 @@ constraint_cf_gen( ConfigArgs *c ) } if ( ap.restrict_lud->lud_attrs != NULL ) { - if ( ap.restrict_lud->lud_attrs[0] != '\0' ) { + if ( ap.restrict_lud->lud_attrs[0] != NULL ) { snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %s: attrs not allowed in restrict URI %s\n", c->argv[0], c->argv[1], arg); --- a/servers/slapd/syntax.c +++ b/servers/slapd/syntax.c @@ -219,8 +219,8 @@ syn_add( } assert( (*lsei)->lsei_values != NULL ); - if ( (*lsei)->lsei_values[0] == '\0' - || (*lsei)->lsei_values[1] != '\0' ) + if ( (*lsei)->lsei_values[0] == NULL + || (*lsei)->lsei_values[1] != NULL ) { Debug( LDAP_DEBUG_ANY, "syn_add(%s): exactly one substitute syntax must be present\n", ssyn->ssyn_syn.syn_oid, 0, 0 ); --- a/tests/progs/slapd-addel.c +++ b/tests/progs/slapd-addel.c @@ -173,7 +173,7 @@ main( int argc, char **argv ) } - if (( attrs == NULL ) || ( *attrs == '\0' )) { + if (( attrs == NULL ) || ( *attrs == NULL )) { fprintf( stderr, "%s: invalid attrs in file \"%s\".\n", argv[0], filename ); --- a/contrib/slapd-modules/smbk5pwd/smbk5pwd.c +++ b/contrib/slapd-modules/smbk5pwd/smbk5pwd.c @@ -605,7 +605,7 @@ static int smbk5pwd_exop_passwd( keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); keys[0].bv_len = snprintf(keys[0].bv_val, LDAP_PVT_INTTYPE_CHARS(long), - "%ld", slap_get_time()); + "%lld", (long long)slap_get_time()); BER_BVZERO( &keys[1] ); ml->sml_desc = ad_sambaPwdLastSet; @@ -627,7 +627,7 @@ static int smbk5pwd_exop_passwd( keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); keys[0].bv_len = snprintf(keys[0].bv_val, LDAP_PVT_INTTYPE_CHARS(long), - "%ld", slap_get_time() + pi->smb_must_change); + "%lld", (long long)slap_get_time() + (long long)pi->smb_must_change); BER_BVZERO( &keys[1] ); ml->sml_desc = ad_sambaPwdMustChange; @@ -650,7 +650,7 @@ static int smbk5pwd_exop_passwd( keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); keys[0].bv_len = snprintf(keys[0].bv_val, LDAP_PVT_INTTYPE_CHARS(long), - "%ld", slap_get_time() + pi->smb_can_change); + "%lld", (long long)slap_get_time() + (long long)pi->smb_can_change); BER_BVZERO( &keys[1] ); ml->sml_desc = ad_sambaPwdCanChange; --- a/libraries/libldap/os-ip.c +++ b/libraries/libldap/os-ip.c @@ -282,8 +282,8 @@ ldap_int_poll( int rc; - osip_debug(ld, "ldap_int_poll: fd: %d tm: %ld\n", - s, tvp ? tvp->tv_sec : -1L, 0); + osip_debug(ld, "ldap_int_poll: fd: %d tm: %lld\n", + s, tvp ? (long long)tvp->tv_sec : -1LL, 0); #ifdef HAVE_POLL { @@ -432,8 +432,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t opt_tv = &tv; } - osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %ld async: %d\n", - s, opt_tv ? tv.tv_sec : -1L, async); + osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %lld async: %d\n", + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); if ( opt_tv && ldap_pvt_ndelay_on(ld, s) == -1 ) return ( -1 ); --- a/libraries/libldap/os-local.c +++ b/libraries/libldap/os-local.c @@ -176,8 +176,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t opt_tv = &tv; } - oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %ld async: %d\n", - s, opt_tv ? tv.tv_sec : -1L, async); + oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %lld async: %d\n", + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); if ( ldap_pvt_ndelay_on(ld, s) == -1 ) return -1; --- a/libraries/libldap/result.c +++ b/libraries/libldap/result.c @@ -264,8 +264,8 @@ wait4msg( Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (infinite timeout)\n", (void *)ld, msgid, 0 ); } else { - Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %ld usec)\n", - (void *)ld, msgid, (long)timeout->tv_sec * 1000000 + timeout->tv_usec ); + Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %lld usec)\n", + (void *)ld, msgid, (long long)timeout->tv_sec * 1000000LL + timeout->tv_usec ); } #endif /* LDAP_DEBUG */ --- a/servers/slapd/back-ldap/bind.c +++ b/servers/slapd/back-ldap/bind.c @@ -3008,14 +3008,14 @@ ldap_back_conn2str( const ldapconn_base_ } if ( lc->lcb_create_time != 0 ) { - len = snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_create_time ); + len = snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_create_time ); if ( ptr + sizeof(" created=") + len >= end ) return -1; ptr = lutil_strcopy( ptr, " created=" ); ptr = lutil_strcopy( ptr, tbuf ); } if ( lc->lcb_time != 0 ) { - len = snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_time ); + len = snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_time ); if ( ptr + sizeof(" modified=") + len >= end ) return -1; ptr = lutil_strcopy( ptr, " modified=" ); ptr = lutil_strcopy( ptr, tbuf ); --- a/servers/slapd/back-meta/config.c +++ b/servers/slapd/back-meta/config.c @@ -1277,8 +1277,8 @@ meta_back_cf_gen( ConfigArgs *c ) if ( mc->mc_network_timeout == 0 ) { return 1; } - bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld", - mc->mc_network_timeout ); + bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%lld", + (long long)mc->mc_network_timeout ); bv.bv_val = c->cr_msg; value_add_one( &c->rvalue_vals, &bv ); break; --- a/servers/slapd/overlays/dds.c +++ b/servers/slapd/overlays/dds.c @@ -417,7 +417,7 @@ dds_op_add( Operation *op, SlapReply *rs assert( ttl <= DDS_RF2589_MAX_TTL ); bv.bv_val = ttlbuf; - bv.bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl ); + bv.bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long)ttl ); assert( bv.bv_len < sizeof( ttlbuf ) ); /* FIXME: apparently, values in op->ora_e are malloc'ed @@ -695,7 +695,7 @@ dds_op_modify( Operation *op, SlapReply goto done; } - bv_entryTtl.bv_len = snprintf( textbuf, sizeof( textbuf ), "%ld", entryTtl ); + bv_entryTtl.bv_len = snprintf( textbuf, sizeof( textbuf ), "%lld", (long long)entryTtl ); break; default: @@ -917,7 +917,7 @@ dds_response( Operation *op, SlapReply * ttl = (ttl < 0) ? 0 : ttl; assert( ttl <= DDS_RF2589_MAX_TTL ); - len = snprintf( ttlbuf, sizeof(ttlbuf), "%ld", ttl ); + len = snprintf( ttlbuf, sizeof(ttlbuf), "%lld", (long long)ttl ); if ( len < 0 ) { goto done; @@ -1177,7 +1177,7 @@ dds_op_extended( Operation *op, SlapRepl ttlmod.sml_values = ttlvalues; ttlmod.sml_numvals = 1; ttlvalues[ 0 ].bv_val = ttlbuf; - ttlvalues[ 0 ].bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl ); + ttlvalues[ 0 ].bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long)ttl ); BER_BVZERO( &ttlvalues[ 1 ] ); /* the entryExpireTimestamp is added by modify */ @@ -1205,8 +1205,8 @@ dds_op_extended( Operation *op, SlapRepl rs->sr_rspoid = ch_strdup( slap_EXOP_REFRESH.bv_val ); Log3( LDAP_DEBUG_TRACE, LDAP_LEVEL_INFO, - "%s REFRESH dn=\"%s\" TTL=%ld\n", - op->o_log_prefix, op->o_req_ndn.bv_val, ttl ); + "%s REFRESH dn=\"%s\" TTL=%lld\n", + op->o_log_prefix, op->o_req_ndn.bv_val, (long long)ttl ); } ber_free_buf( ber ); --- a/servers/slapd/overlays/pcache.c +++ b/servers/slapd/overlays/pcache.c @@ -2728,8 +2728,8 @@ pc_bind_search( Operation *op, SlapReply pbi->bi_flags |= BI_HASHED; } else { Debug( pcache_debug, "pc_bind_search: cache is stale, " - "reftime: %ld, current time: %ld\n", - pbi->bi_cq->bindref_time, op->o_time, 0 ); + "reftime: %lld, current time: %lld\n", + (long long)pbi->bi_cq->bindref_time, (long long)op->o_time, 0 ); } } else if ( pbi->bi_si ) { /* This search result is going into the cache */ @@ -3831,9 +3831,9 @@ pc_cf_gen( ConfigArgs *c ) struct berval bv; switch( c->type ) { case PC_MAIN: - bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %d %ld", + bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %d %lld", cm->db.bd_info->bi_type, cm->max_entries, cm->numattrsets, - cm->num_entries_limit, cm->cc_period ); + cm->num_entries_limit, (long long)cm->cc_period ); bv.bv_val = c->cr_msg; value_add_one( &c->rvalue_vals, &bv ); break; @@ -3875,12 +3875,12 @@ pc_cf_gen( ConfigArgs *c ) /* HEADS-UP: always print all; * if optional == 0, ignore */ bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), - " %d %ld %ld %ld %ld", + " %d %lld %lld %lld %lld", temp->attr_set_index, - temp->ttl, - temp->negttl, - temp->limitttl, - temp->ttr ); + (long long)temp->ttl, + (long long)temp->negttl, + (long long)temp->limitttl, + (long long)temp->ttr ); bv.bv_len += temp->querystr.bv_len + 2; bv.bv_val = ch_malloc( bv.bv_len+1 ); ptr = bv.bv_val; @@ -3897,9 +3897,9 @@ pc_cf_gen( ConfigArgs *c ) for (temp=qm->templates; temp; temp=temp->qmnext) { if ( !temp->bindttr ) continue; bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), - " %d %ld %s ", + " %d %lld %s ", temp->attr_set_index, - temp->bindttr, + (long long)temp->bindttr, ldap_pvt_scope2str( temp->bindscope )); bv.bv_len += temp->bindbase.bv_len + temp->bindftemp.bv_len + 4; bv.bv_val = ch_malloc( bv.bv_len + 1 ); --- a/servers/slapd/syncrepl.c +++ b/servers/slapd/syncrepl.c @@ -2395,8 +2395,8 @@ syncrepl_message_to_op( op->o_callback = &cb; slap_op_time( &op->o_time, &op->o_tincr ); - Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %x\n", - si->si_ridtxt, op->o_tid, 0 ); + Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %lx\n", + si->si_ridtxt, (unsigned long)op->o_tid, 0 ); switch( op->o_tag ) { case LDAP_REQ_ADD: @@ -2905,8 +2905,8 @@ syncrepl_entry( int freecsn = 1; Debug( LDAP_DEBUG_SYNC, - "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %x\n", - si->si_ridtxt, syncrepl_state2str( syncstate ), op->o_tid ); + "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %lx\n", + si->si_ridtxt, syncrepl_state2str( syncstate ), (unsigned long)op->o_tid ); if (( syncstate == LDAP_SYNC_PRESENT || syncstate == LDAP_SYNC_ADD ) ) { if ( !si->si_refreshPresent && !si->si_refreshDone ) {

1 0

RE: (ITS#8847) New LDAP URL syntax to support binding to specific IP address at client side
by sudhir.singam＠nokia.com 31 Jul '18

31 Jul '18

Hi, >From NOKIA, we are picking up this patch -> to add new ldap option, to be a= ble to set specific IPv4/IPv6 bind address. We will come back with design d= etails soon. Regards, Sudhir Singam DELIVERING BEST-IN-CLASS PLATFORM is our vision -----Original Message----- From: Ryan Tandy <ryan(a)openldap.org>=20 Sent: Sunday, May 06, 2018 10:25 PM To: openldap-its(a)OpenLDAP.org; Singam, Sudhir (Nokia - IN/Bangalore) <sudhi= r.singam(a)nokia.com> Cc: arekkusu(a)r42.ch Subject: Re: (ITS#8847) New LDAP URL syntax to support binding to specific = IP address at client side On Sun, May 06, 2018 at 01:50:23PM +0000, arekkusu(a)r42.ch wrote: >Adding a source IP to an URI feels wrong to it. > >I have not read RFC dealing with URI, however having a quick look [1] seem= s to >indicate that using the at sign in this way is non-standard. I agree. @ in URIs is already defined as separating credentials (or just=20 username) from the host. I don't recall whether OpenLDAP supports that=20 usage but in any case we shouldn't re-define it. I believe ITS#8654 is about the same feature? That one implemented this=20 by copying a Microsoft option, LDAP_OPT_SOCKET_BIND_ADDRESSES. I would=20 think that's probably a better approach. Maybe you could pick up where=20 the author of that one left off? He disappeared after posting his patch=20 for review... thanks Ryan

1 0

(ITS#8889) debugging/logging
by dpa-bugs＠aegee.org 31 Jul '18

31 Jul '18

Full_Name: &#1044;&#1080;&#1083;&#1103;&#1085; &#1055;&#1072;&#1083;&#1072;&#1091;&#1079;&#1086;&#1074; Version: 2.4 OS: Linux URL: Submission from: (NULL) (103.252.202.53) Debugging and logging are different things: logging is more used to avoid problems, that could have happened in the past, while debugging is for reproducing problems in order to resolve them. https://www.openldap.org/doc/admin24/runningslapd.html#Command-Line%20Optio… says -d sets the debug level, and 'Note: slapd must have been compiled with --enable-debug defined for any debugging information beyond the two stats levels to be available (the default).' Is --enable-debug passed by default, unless one calls --disable-debug, or are the two stats levels combined as 256 | 512 the default debug level? https://www.openldap.org/doc/admin24/troubleshooting.html#Debugging%20{{sla… that 256 is a good firstlevel, not stating whether this is the default or needs to be set explicitly. https://www.openldap.org/doc/admin24/tuning.html#Logging says the default log level is 256, but does not state how to change it. https://www.openldap.org/doc/admin24/slapdconfig.html#Global%20Directives presents the same table, as the first link I mentioned here, but calls it 'logging debugging statements' and while the directive is 'loglevel', the table is called 'debugging levels'. It says further: Default: loglevel stats Basic stats logging is configured by default. However, if no loglevel is defined, no logging occurs (equivalent to a 0 level). - Does this mean, that no logging occurs, when the loglevel directive is missing, and when it is present without value, the value is stats/256? Likewise for https://www.openldap.org/doc/admin24/slapdconf2.html#cn=config . - Please clarify on every place, where loglevel is mentioned, that the default is 256/stats. - Either use only the term debugging in the whole documentation, or only the term logging, or if both terms are used, clarify the difference between them

1 0

(ITS#8888) doc: sdf number disorder
by dpa-bugs＠aegee.org 31 Jul '18

31 Jul '18

Full_Name: &#1044;&#1080;&#1083;&#1103;&#1085; &#1055;&#1072;&#1083;&#1072;&#1091;&#1079;&#1086;&#1074; Version: 2.4 OS: Linux URL: Submission from: (NULL) (103.252.202.53) https://www.openldap.org/doc/admin24/overlays.html#Dynamic%20List%20Configu… says: In slapd.conf(5): include /path/to/dyngroup.schema ... overlay dynlist dynlist-attrset groupOfURLs labeledURI member 1. 2. Note: We must include the dyngroup.schema file that defines the 3. groupOfURLs objectClass used in this example. This isn't rendered very good in https://www.openldap.org/doc/admin24/OpenLDAP-Admin-Guide.pdf on page 111-113: Before Note is shows overlapping digits 1 and 2. Remove the numbering before 'Note:'.

1 0

(ITS#8887) doc/guide/admin/backends.sdf: is is
by dpa-bugs＠aegee.org 31 Jul '18

31 Jul '18

Full_Name: &#1044;&#1080;&#1083;&#1103;&#1085; &#1055;&#1072;&#1083;&#1072;&#1091;&#1079;&#1086;&#1074; Version: 2.4 documentation OS: Linux URL: Submission from: (NULL) (103.252.202.53) Consider this change (remove doubled " is is " diff --git a/doc/guide/admin/backends.sdf b/doc/guide/admin/backends.sdf --- a/doc/guide/admin/backends.sdf +++ b/doc/guide/admin/backends.sdf @@ -444,7 +444,7 @@ a new Perl object that handles all the requests for that particular instance of The Shell backend to {{slapd}}(8) executes external programs to implement operations, and is designed to make it easy to tie an existing database to the -slapd front-end. This backend is is primarily intended to be used in prototypes. +slapd front-end. This backend is primarily intended to be used in prototypes. H3: back-perl/back-shell Configuration

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs August 2018