openldap-bugs November 2023

openldap-bugs@openldap.org

1 participants
149 discussions

[Issue 8957] Handling of TLS in async mode
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=8957 Ondřej Kuzník <ondra(a)mistotebe.net> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9244 -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 8968] Async connect mode does not work on Solaris
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=8968 Ondřej Kuzník <ondra(a)mistotebe.net> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9244 -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 8980] Async mode and TLS Non-Blocking Issue
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=8980 Ondřej Kuzník <ondra(a)mistotebe.net> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9244 -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Bug 9229] New: Make liblutil usable by libldap
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=9229 Bug ID: 9229 Summary: Make liblutil usable by libldap Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: build Assignee: bugs(a)openldap.org Reporter: ryan(a)openldap.org Target Milestone: --- liblutil is a static library (non-PIC) and so cannot be linked into shared objects, however we have several use cases for reusing its code in libldap. Some options: - moving more code from liblutil to libldap - just merge the whole thing? - are there components that link liblutil but _not_ libldap? - build liblutil as PIC (take a minor performance hit when linked into programs?) - build liblutil twice (liblutil.a and liblutil_pic.a) - symlink liblutil sources into libldap build dir, like libldap_r does with libldap - both of these last options require checking whether executables can call the PIC symbols safely (if some symbols are used by both library and program code) Nice-to-have for 2.5, I'd say more likely for 2.6 at this point. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Issue 9009] 2.7: Switch to LMDB v1.0
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=9009 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |9225 Referenced Issues: https://bugs.openldap.org/show_bug.cgi?id=9225 [Issue 9225] back-mdb: Add support for PREPARE/2-phase commit -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Bug 9221] New: Move all replication consumer code into its own overlay
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=9221 Bug ID: 9221 Summary: Move all replication consumer code into its own overlay Product: OpenLDAP Version: 2.5 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- (In relation to a discussion about slapo-chain) <hyc> anyway, the nicer ting to fix would be in 2.5, push all of the repl consumer code into its own overlay <hyc> in that case, updateref would be processed wherever the overlay was configured <hyc> so no longer tied to the frontend <hyc> it would also make it more feasible to have multiple different consumer configs in a single DB, each with their own provider URL (and thus their own updateref) <hyc> I would think we can get rid of the update ref directive entirely, just point all writes to that consumer's provider. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 9218] New: Revist entry_release handling in slapo-pache, slapo-translucent
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=9218 Bug ID: 9218 Summary: Revist entry_release handling in slapo-pache, slapo-translucent Product: OpenLDAP Version: 2.5 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- From a past discussion with hyc on 2.5 items: [13:57] <hyc> there's a nagging problem though, pcache's entry_release function needs to distinguish between its backend actually freeing the entry, or being a no-op [13:57] <hyc> so it can decide whether to return success or continue [13:58] <hyc> the patch to translucent sidesteps the question, by avoiding other overlays [13:58] <hyc> but we need to revisit this in 2.5 -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 9217] New: Audit all schema definitions to have official non-experimental OIDs where possible
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=9217 Bug ID: 9217 Summary: Audit all schema definitions to have official non-experimental OIDs where possible Product: OpenLDAP Version: 2.5 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- From a past discussion with hyc on 2.5 requirements: [09:27] <hyc> we also need to audit all of these schema defs [09:27] <hyc> we're supposed to have official, non-experimental OIDs for released schema [09:28] <hyc> accesslog is still using 666, experimental arc [09:29] <hyc> I think this means we should polish up the logschema draft, Informational status, and publish it again as final -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 9216] New: Port autoca to gnutls
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=9216 Bug ID: 9216 Summary: Port autoca to gnutls Product: OpenLDAP Version: 2.5 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: ryan(a)openldap.org Target Milestone: --- For 2.5, support building and running the autoca overlay with GnuTLS. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Issue 10126] New: Openldap 2.5.16 Segmentation fault during start
by openldap-its＠openldap.org 07 Nov '23

07 Nov '23

https://bugs.openldap.org/show_bug.cgi?id=10126 Issue ID: 10126 Summary: Openldap 2.5.16 Segmentation fault during start Product: OpenLDAP Version: 2.5.16 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: bogdan.siara(a)gmail.com Target Milestone: --- Created attachment 987 --> https://bugs.openldap.org/attachment.cgi?id=987&action=edit gdb stacktrace Hi, I have openldap cluster with 2 nodes. Openldap is compiled in docker debian:bookworm-slim with options: ./configure --prefix=${LDAP_HOME}/openldap \ --enable-debug \ --enable-dynamic \ --enable-syslog \ --enable-ipv6 \ --enable-local \ --enable-slapd \ --enable-dynacl \ --enable-cleartext \ --enable-crypt \ --enable-spasswd \ --enable-modules \ --enable-slapi \ --enable-wrappers \ --enable-dnssrv=mod \ --enable-ldap=mod \ --enable-mdb=mod \ --enable-meta=mod \ --enable-asyncmeta=mod \ --enable-relay=mod \ --enable-overlays=mod \ --enable-argon2=yes \ --enable-balancer=mod \ --with-cyrus-sasl \ --with-threads \ --with-argon2=auto \ --without-systemd \ --with-tls=openssl make depend make make install cd contrib/slapd-modules/smbk5pwd sed -i "s|prefix=/usr/local|prefix=${LDAP_HOME}/openldap|g" Makefile sed -i "s|SSL_LIB = -lcrypto|SSL_LIB = -lnettle|g" Makefile sed -i "s|HEIMDAL_INC = -I/usr/heimdal/include|HEIMDAL_INC = \$(shell krb5-config.heimdal --cflags krb5 kadm-server)|g" Makefile sed -i "s|HEIMDAL_LIB = -L/usr/heimdal/lib -lkrb5 -lkadm5srv|HEIMDAL_LIB = \$(shell krb5-config.heimdal --libs krb5 kadm-server)|g" Makefile sed -i "s|LIBS = \$(LDAP_LIB) \$(HEIMDAL_LIB) \$(SSL_LIB)|LIBS = \$(HEIMDAL_LIB) \$(LDAP_LIB) \$(SSL_LIB)|g" Makefile make make install cd ../passwd/pbkdf2 sed -i "s|prefix=/usr/local|prefix=${LDAP_HOME}/openldap|g" Makefile sed -i "s|SSL_LIB = -lcrypto|SSL_LIB = -lnettle|g" Makefile make make install cd ../sha2 sed -i "s|prefix=/usr/local|prefix=${LDAP_HOME}/openldap|g" Makefile make make install cd ../../ppm sed -i "s|prefix=/usr/local|prefix=${LDAP_HOME}/openldap|g" Makefile make make install When I start openldap: slapd -h 'ldap://0.0.0.0:10389 ldaps://0.0.0.0:10536 ldapi://%2Fopt%2Fldap%2Fldapi' -F /opt/ldap//openldap/etc/openldap/slapd.d I get error: @(#) $OpenLDAP: slapd 2.5.16 (Nov 3 2023 07:51:03) $#012#011@f3068170494c:\/opt\/ldap\/openldap-2.5.16\/servers\/slapd /opt\/ldap\/openldap\/etc\/openldap\/slapd.d: line 1: rootdn is always granted unlimited privileges. Segmentation fault (core dumped) and in syslog: Nov 6 08:48:17 openldap-1 kernel: [44480681.935173] slapd[3775972]: segfault at 7f049da0375f ip 00007f049d75fc12 sp 00007fff24e77dd0 error 7 in libcrypto.so.3[7f049d60a000+279000] Nov 6 08:48:17 openldap-1 kernel: [44480681.935183] Code: 64 f9 ff ff eb a8 e8 ed 23 eb ff 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 85 ff 0f 84 a7 00 00 00 53 b8 ff ff ff ff 48 89 fb <f0> 0f c1 47 30 83 e8 01 85 c0 74 12 7e 10 5b 31 c0 31 d2 31 f6 31 Next start with gdb: ldap@openldap-1:~$ gdb --args /opt/ldap/openldap/libexec/slapd -d 0 -h ldap://0.0.0.0:10389 -F /opt/ldap//openldap/etc/openldap/slapd.d GNU gdb (Debian 13.1-3) 13.1 Copyright (C) 2023 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /opt/ldap/openldap/libexec/slapd... (No debugging symbols found in /opt/ldap/openldap/libexec/slapd) (gdb) run Starting program: /opt/ldap/openldap/libexec/slapd -d 0 -h ldap://0.0.0.0:10389 -F /opt/ldap//openldap/etc/openldap/slapd.d [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x00007ffff79bfc12 in EVP_PKEY_free () from /lib/x86_64-linux-gnu/libcrypto.so.3 (gdb) bt full #0 0x00007ffff79bfc12 in EVP_PKEY_free () from /lib/x86_64-linux-gnu/libcrypto.so.3 No symbol table info available. #1 0x00007ffff79fa393 in ?? () from /lib/x86_64-linux-gnu/libcrypto.so.3 No symbol table info available. #2 0x00007ffff79fa8cd in PEM_read_bio_Parameters_ex () from /lib/x86_64-linux-gnu/libcrypto.so.3 No symbol table info available. #3 0x00007ffff7fa1b38 in tlso_ctx_init (lo=0x5555556fd550, lt=0x7fffffffe280, is_server=1) at tls_o.c:546 dh = 0x7ffff7c6372f <SSL_CTX_new_ex+815> bio = 0x5555558afab0 ctx = 0x55555586b760 i = <optimized out> #4 0x00007ffff7f9de08 in ldap_int_tls_init_ctx (lo=0x5555556fd550, is_server=1) at tls2.c:264 rc = 0 ti = <optimized out> lts = {lt_certfile = 0x555555773350 "/opt/ldap/openldap/etc/openldap/certs/ldap.crt", lt_keyfile = 0x555555773390 "/opt/ldap/openldap/etc/openldap/certs/ldap.key", lt_dhfile = 0x555555773470 "/opt/ldap/openldap/etc/openldap/certs/dhparam", lt_cacertfile = 0x555555773310 "/opt/ldap/openldap/etc/openldap/certs/ca.crt", lt_cacertdir = 0x0, lt_ciphersuite = 0x5555557733d0 "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM", lt_crlfile = 0x0, lt_randfile = 0x0, lt_ecname = 0x0, lt_protocol_min = 771, lt_protocol_max = 0, lt_cacert = {bv_len = 0, bv_val = 0x0}, lt_cert = {bv_len = 0, bv_val = 0x0}, lt_key = { bv_len = 0, bv_val = 0x0}} #5 0x00005555555759e7 in main () No symbol table info available. (gdb) thread apply all bt Thread 1 (Thread 0x7ffff75ce7c0 (LWP 64) "slapd"): #0 0x00007ffff79bfc12 in EVP_PKEY_free () from /lib/x86_64-linux-gnu/libcrypto.so.3 #1 0x00007ffff79fa393 in ?? () from /lib/x86_64-linux-gnu/libcrypto.so.3 #2 0x00007ffff79fa8cd in PEM_read_bio_Parameters_ex () from /lib/x86_64-linux-gnu/libcrypto.so.3 #3 0x00007ffff7fa1b38 in tlso_ctx_init (lo=0x5555556fd550, lt=0x7fffffffe280, is_server=1) at tls_o.c:546 #4 0x00007ffff7f9de08 in ldap_int_tls_init_ctx (lo=0x5555556fd550, is_server=1) at tls2.c:264 #5 0x00005555555759e7 in main () Next I rebuild openldap adding flags to configure step: ./configure CFLAGS=-g When I run slapd in new image: slapd -h 'ldap://0.0.0.0:10389 ldaps://0.0.0.0:10536 ldapi://%2Fopt%2Fldap%2Fldapi' -F /opt/ldap//openldap/etc/openldap/slapd.d all working well and I didn't get segementation fault. Can someone tell me what I'm doing wrong and how to investigate the problem? Regards BS -- You are receiving this mail because: You are on the CC list for the issue.

1 3

← Newer
1
...
9
10
11
12
13
14
15
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs November 2023