https://bugs.openldap.org/show_bug.cgi?id=9283
Issue ID: 9283
Summary: Mutex leak in backend.c`backend_db_init()
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: grapvar(a)gmail.com
Target Milestone: ---
@backend_db_init:
if bi_db_init() fails, but [BackendDB *be] is not listed in [slap_be_head
backendDB] list of backends, then be->be_pcl_mutex is not destroyed.
| BackendDB *
| backend_db_init( ... )
| {
| ...
| ldap_pvt_thread_mutex_init( &be->be_pcl_mutex );
| ...
| if ( bi->bi_db_init )
| rc = bi->bi_db_init( be, cr );
|
| if ( rc != 0 ) {
| if ( !b0 ) {
| ...
| ldap_pvt_thread_mutex_destroy( &be->be_pcl_mutex );
| ch_free( be );
Additionally, it does not look like that owner of [b0] cares about destroying
this mutex.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9293
Issue ID: 9293
Summary: slapo-ppolicy stores pwdGraceUseTime only with seconds
Product: OpenLDAP
Version: 2.4.50
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: overlays
Assignee: bugs(a)openldap.org
Reporter: michael(a)stroeder.com
Target Milestone: ---
If password is expired slapo-ppolicy can return the number of grace logins for
changing own password (graceAuthNsRemaining).
slapd derives graceAuthNsRemaining from number of pwdGraceUseTime values. But
those timestamps are only stored with a granularity of a second.
Thus multiple grace logins are possible within a second without decremeting
graceAuthNsRemaining value.
This is unexpected and also leads to absurd work-arounds when writing automated
tests like this:
https://gitlab.com/ae-dir/python-ldap0/-/blob/master/tests/test_ppolicy.py#…
Either a real Integer counter should be used or fraction of seconds should be
used in pwdGraceUseTime values.
This is a similar problem like pwdFailureTime solved in ITS#7161.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9332
Issue ID: 9332
Summary: Compilation of 2.4.52 fails: "init.c", line 45: too
many initializers for scalar
Product: OpenLDAP
Version: 2.4.52
Hardware: All
OS: Solaris
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: build
Assignee: bugs(a)openldap.org
Reporter: stacey.marshall(a)gmail.com
Target Milestone: ---
The addition of integer ldo_tls_require_san to structure requires an additional
initialization digit to macro LDAP_LDO_TLS_NULLARG.
--- openldap-2.4.52/libraries/libldap/ldap-int.h 2020-08-28
09:10:00.000000000 -0700
+++ openldap-2.4.52.x/libraries/libldap/ldap-int.h 2020-09-01
10:08:44.661226154 -0700
@@ -263,7 +263,7 @@
int ldo_tls_impl;
int ldo_tls_crlcheck;
int ldo_tls_require_san;
-#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0
+#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0,0
#else
#define LDAP_LDO_TLS_NULLARG
#endif
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9381
Issue ID: 9381
Summary: librewrite warnings for unused variables
Product: OpenLDAP
Version: 2.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
There are some unused variables in librewrite that need fixing, and one case
where an rc is set but never returned which also needs addressing.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9380
Issue ID: 9380
Summary: connection_write_resume should be type void rather
than int
Product: OpenLDAP
Version: 2.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
connection_write_resume does not return anything, but is declared to return an
int. This can cause compile failure depending on the flags used during
compilation (-Werror=return-type)
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9322
Issue ID: 9322
Summary: Update admin guide to recommend OpenSSL 1.1 as a
minimum release
Product: OpenLDAP
Version: 2.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: documentation
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
For OpenLDAP 2.5, we need to update the recommended OpenSSL version to be 1.1
or later.
appendix-recommended-versions.sdf
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9205
Bug ID: 9205
Summary: Openldap 2.4.49 with overlays
syncrepl+ppolicy+chain+ldap
Product: OpenLDAP
Version: 2.4.49
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: overlays
Assignee: bugs(a)openldap.org
Reporter: frederic.poisson(a)admin.gmessaging.net
Target Milestone: ---
Created attachment 700
--> https://bugs.openldap.org/attachment.cgi?id=700&action=edit
test script copied from test022-ppolicy and modified to show the trouble
Hello,
I'm doing a OpenLDAP test with a master/slave replication configuration
including ppolicy overlay. I would like to enable password change from the
slave replica with chain overlay, in order to validate the ppolicy
olcPPolicyForwardUpdates attribute to TRUE. I'm using LDAPS from slave to
master with SASL External authentication with client certificate. The client
certificate correspond to a user DN entry with "manage" rights on the master
server (the same used for the replication). This user DN has authzTo attribute
in order to match the correct PROXYAUTHZ request from its dn to user DN.
All of this configuration works on replica when i do first a failed
authentication (err=49) on replica. The pwdFailureTime value is updated on the
DN entry from replica to slave normally. I'm also able to do after some self
entry update on some attribute such as password or others from replica to
master.
But the weird behavior is that i need to run first an failed authentication,
otherwise if i try to change attribute on the slave server, it respond an
err=80 "Error: ldap_back_is_proxy_authz returned 0, misconfigured URI?". The
only way to retrieve correct behavior is to restart slapd, and redo one failed
authentication first. It seems that the chain overlay do not connect the master
server at startup.
I've done a modification of test script test022-ppolicy to test022-policy-chain
which use the same LDIF source and show the problem of modification on the
consumer not "relayed" to the supplier if a fail operation is not done before.
Regards
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugs.openldap.org/show_bug.cgi?id=9362
Issue ID: 9362
Summary: slapd crashed with a segmentation fault in syncprov
Product: OpenLDAP
Version: 2.4.44
Hardware: All
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: simon.pichugin(a)gmail.com
Target Milestone: ---
Description of problem:
Two times on slapd crashed with segmentation faults and cores were outputted.
The following messages were outputted to /var/log/messages.
--------------------
Jun 23 19:42:51 GC001CVFC101 kernel: slapd[1985]: segfault at 2 ip
00005647e0543414 sp 00007f6c088b5de0 error 4 in slapd[5647e04df000+1c0000]
Jun 23 19:42:53 GC001CVFC101 systemd: slapd.service: main process exited,
code=killed, status=11/SEGV
Jun 23 19:42:53 GC001CVFC101 systemd: Unit slapd.service entered failed state.
Jun 23 19:42:53 GC001CVFC101 systemd: slapd.service failed.
.....
Jun 23 23:56:48 GC001CVFC101 kernel: slapd[8759]: segfault at 3 ip
000055d24efbc414 sp 00007fe9a8ffae80 error 4 in slapd[55d24ef58000+1c0000]
Jun 23 23:56:49 GC001CVFC101 systemd: slapd.service: main process exited,
code=killed, status=11/SEGV
Jun 23 23:56:50 GC001CVFC101 systemd: Unit slapd.service entered failed state.
Jun 23 23:56:50 GC001CVFC101 systemd: slapd.service failed.
--------------------
The followings are the logs that are outputted to /var/log/slapd.log-20200624
Each segmentation fault occurred during modify and delete requests for ldap
entries.
-------------
Jun 23 19:42:50 GC001CVFC101 slapd[2281]: conn=7028108 op=391 MOD
dn="uid=user,ou=users,dc=example,dc=com"
.....
Jun 23 23:56:48 GC001CVFC101 slapd[32641]: conn=1552 op=144 DEL
dn="cn=group1,ou=groups,dc=example,dc=com"
-------------
The followings are the backtraces of two cores.
1) core-slapd.2281:
--------------------
(gdb) bt
#0 test_filter (op=op@entry=0x7f6c088b6130, e=0x7f6bee9e37c8, f=0x2) at
filterentry.c:69
^^^^^*1
#1 0x00007f6cb379e598 in syncprov_matchops (op=op@entry=0x7f6be01191d0,
opc=opc@entry=0x7f6bec001710, saveit=saveit@entry=1) at syncprov.c:1334
#2 0x00007f6cb379ec63 in syncprov_op_mod (op=0x7f6be01191d0, rs=<optimized
out>) at syncprov.c:2201
#3 0x00005647e0591e8a in overlay_op_walk (op=op@entry=0x7f6be01191d0,
rs=0x7f6c088b7960, which=op_modify, oi=0x5647e1633dd0, on=0x5647e1638d00)
at backover.c:661
#4 0x00005647e0592034 in over_op_func (op=0x7f6be01191d0, rs=<optimized out>,
which=<optimized out>) at backover.c:730
#5 0x00005647e053b2f9 in fe_op_modify (op=0x7f6be01191d0, rs=0x7f6c088b7960)
at modify.c:303
#6 0x00005647e053d2ed in do_modify (op=0x7f6be01191d0, rs=0x7f6c088b7960) at
modify.c:177
#7 0x00005647e0522e7c in connection_operation (ctx=ctx@entry=0x7f6c088b7bd0,
arg_v=arg_v@entry=0x7f6be01191d0) at connection.c:1158
#8 0x00005647e05231eb in connection_read_thread (ctx=0x7f6c088b7bd0,
argv=0x67) at connection.c:1294
#9 0x00007f6cbaad82fa in ldap_int_thread_pool_wrapper () from
debug/lib64/libldap_r-2.4.so.2
#10 0x00007f6cb9d9ae25 in start_thread (arg=0x7f6c088b8700) at
pthread_create.c:308
#11 0x00007f6cb925c34d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:113
(gdb)
--------------------
2) core-slapd.32641
--------------------
(gdb) bt
#0 test_filter (op=op@entry=0x7fe9a8ffb1d0, e=0x7fe9c7ea8888, f=0x3) at
filterentry.c:69
^^^^^*1
#1 0x00007feab3f22598 in syncprov_matchops (op=op@entry=0x7fe99c000950,
opc=opc@entry=0x7fe99c001808, saveit=saveit@entry=1) at syncprov.c:1334
#2 0x00007feab3f22c63 in syncprov_op_mod (op=0x7fe99c000950, rs=<optimized
out>) at syncprov.c:2201
#3 0x000055d24f00ae8a in overlay_op_walk (op=op@entry=0x7fe99c000950,
rs=0x7fe9a8ffb960, which=op_delete, oi=0x55d250c54dd0, on=0x55d250c59d00)
at backover.c:661
#4 0x000055d24f00b034 in over_op_func (op=0x7fe99c000950, rs=<optimized out>,
which=<optimized out>) at backover.c:730
#5 0x000055d24efb6bf6 in fe_op_delete (op=0x7fe99c000950, rs=0x7fe9a8ffb960)
at delete.c:174
#6 0x000055d24efb68d6 in do_delete (op=0x7fe99c000950, rs=0x7fe9a8ffb960) at
delete.c:95
#7 0x000055d24ef9be7c in connection_operation (ctx=ctx@entry=0x7fe9a8ffbbd0,
arg_v=arg_v@entry=0x7fe99c000950) at connection.c:1158
#8 0x000055d24ef9c1eb in connection_read_thread (ctx=0x7fe9a8ffbbd0,
argv=0x3a) at connection.c:1294
#9 0x00007feabb25c2fa in ldap_int_thread_pool_wrapper () from
debug/lib64/libldap_r-2.4.so.2
#10 0x00007feaba51ee25 in start_thread (arg=0x7fe9a8ffc700) at
pthread_create.c:308
#11 0x00007feab99e034d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:113
(gdb)
--------------------
The two cores seem to be the same, only the difference between modify and
delete request.
Both are considered to cause a segmentation fault because the value of the
third parameter(*1) of test_filter is invalid.
The third parameter(*1) of test_filter should be an address, like the source
below.
Excerpt from filterentry.c:
--------------------
60 int
61 test_filter(
62 Operation *op,
63 Entry *e,
64 Filter *f )
** the third parameter of test_filter
65 {
66 int rc;
67 Debug( LDAP_DEBUG_FILTER, "=> test_filter\n", 0, 0, 0 );
68
69 if ( f->f_choice & SLAPD_FILTER_UNDEFINED ) {
** referenced here
70 Debug( LDAP_DEBUG_FILTER, " UNDEFINED\n", 0, 0, 0 );
--------------------
Version-Release number of selected component (if applicable):
How reproducible:
Two times
Steps to Reproduce:
Unknown
Actual results:
slapd crashes with a segmentation fault and a core is outputted.
Expected results:
slapd doesn't crash and a core isn't outputted.
Thanks!
Simon
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9222
Bug ID: 9222
Summary: Fix presence list to use a btree instead of an AVL
tree
Product: OpenLDAP
Version: 2.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
[23:34] <hyc> ok, so far heap profile shows that memory use during refresh is
normal
[23:35] <hyc> not wonderful, but normal. mem usage grows because we're
recording the present list while receiving entries in the refresh
[23:36] <hyc> I'm seeing for 1.2GB of data about 235MB of presentlist
[23:36] <hyc> which is pretty awful, considering presentlist is just a list of
UUIDs
[23:36] <hyc> being stored in an avl tree
[23:37] <hyc> a btree would have been better here, and we could just use an
unsorted segmented array
[23:42] <hyc> for the accumulation phase anyway. we need to be able to lookup
records during the delete pphase
[00:05] <hyc> this stuff seriously needs a rewrite
[01:13] <hyc> 2.8M records x 16 bytes per uuid so this should be no more than
48MB of overhead
[01:13] <hyc> and instead it's 3-400MB
--
You are receiving this mail because:
You are on the CC list for the bug.