Full_Name: Howard Chu
Version: HEAD/RE24
OS:
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (37.19.96.193)
Submitted by: hyc
If a search request has derefSearching set in the alias deref option, the
search_aliases() function walks thru a (potentially) large number of entries
checking to see if they are aliases, even if the objectclass index shows there
are no alias entries in the database. It should exit early instead.
The bug is also present to a lesser degree in back-mdb; the back-mdb version of
search_aliases() would only do a single unneeded entry lookup.
--On Tuesday, June 12, 2012 11:25 AM -0700 Howard Chu <hyc(a)symas.com> wrote:
> quanah(a)OpenLDAP.org wrote:
>> Full_Name: Quanah Gibson-Mount
>> Version: 2.4.31
>> OS:
>> URL: ftp://ftp.openldap.org/incoming/
>> Submission from: (NULL) (75.108.184.39)
>>
>>
>> LDAP URI handling via SRV records is not in the library. In
>> particular, an OpenLDAP library client that specifies a
>> (correctly formed or otherwise) LDAP URI of the form:
>>
>> ldap:///dc=example,dc=com/
>>
>> will not be connected to the LDAP servers found in the SRV records
>> for _ldap._tcp.example.com. That code is only in the ldapsearch(1)
>> and related tools.
>>
>> The existence of the low-level support functions in the library is
>> of no help to users who want to specify URIs that resolve to the
>> underlying LDAP servers via SRV records.
>
> Tough luck. Currently ldap:/// means localhost. Changing the library
> behavior here would be a pretty drastic incompatible change and would
> break pretty much all existing software. This has been discussed and shot
> down before, and rejecting this request is the only correct outcome for
> this ITS.
What about an ldap_set_option() parameter for enabling it?
>> Also, the SRV -> host:port list lookup code that is in the library
>> (but not tied to the libraries connection establishment code) is
>> broken, it ignores the weight and priority which is not a good
>> idea, the published SRV priorities and weights must not be ignored.
>
> priorities/weights are already the subject of ITS#7027.
Ok, so will 7027 be committed, since there is a patch already provided? ;)
The discussion around this started at
<http://archives.neohapsis.com/archives/postfix/2012-06/0183.html>
--Quanah
--
Quanah Gibson-Mount
Sr. Member of Technical Staff
Zimbra, Inc
A Division of VMware, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
quanah(a)OpenLDAP.org wrote:
> Full_Name: Quanah Gibson-Mount
> Version: 2.4.31
> OS:
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (75.108.184.39)
>
>
> LDAP URI handling via SRV records is not in the library. In
> particular, an OpenLDAP library client that specifies a
> (correctly formed or otherwise) LDAP URI of the form:
>
> ldap:///dc=example,dc=com/
>
> will not be connected to the LDAP servers found in the SRV records
> for _ldap._tcp.example.com. That code is only in the ldapsearch(1)
> and related tools.
>
> The existence of the low-level support functions in the library is
> of no help to users who want to specify URIs that resolve to the
> underlying LDAP servers via SRV records.
Tough luck. Currently ldap:/// means localhost. Changing the library behavior
here would be a pretty drastic incompatible change and would break pretty much
all existing software. This has been discussed and shot down before, and
rejecting this request is the only correct outcome for this ITS.
> Also, the SRV -> host:port list lookup code that is in the library
> (but not tied to the libraries connection establishment code) is
> broken, it ignores the weight and priority which is not a good
> idea, the published SRV priorities and weights must not be ignored.
priorities/weights are already the subject of ITS#7027.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
--On Tuesday, June 12, 2012 6:09 PM +0000 quanah(a)OpenLDAP.org wrote:
> Full_Name: Quanah Gibson-Mount
> Version: 2.4.31
> OS:
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (75.108.184.39)
Note: Filed on behalf of the Postfix authors.
--Quanah
--
Quanah Gibson-Mount
Sr. Member of Technical Staff
Zimbra, Inc
A Division of VMware, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
Full_Name: Quanah Gibson-Mount
Version: 2.4.31
OS:
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (75.108.184.39)
LDAP URI handling via SRV records is not in the library. In
particular, an OpenLDAP library client that specifies a
(correctly formed or otherwise) LDAP URI of the form:
ldap:///dc=example,dc=com/
will not be connected to the LDAP servers found in the SRV records
for _ldap._tcp.example.com. That code is only in the ldapsearch(1)
and related tools.
The existence of the low-level support functions in the library is
of no help to users who want to specify URIs that resolve to the
underlying LDAP servers via SRV records.
Also, the SRV -> host:port list lookup code that is in the library
(but not tied to the libraries connection establishment code) is
broken, it ignores the weight and priority which is not a good
idea, the published SRV priorities and weights must not be ignored.
--On Tuesday, June 12, 2012 5:57 PM +0000 andre.cardinal(a)bell.ca wrote:
> Full_Name: Andre Cardinal
> Version: 2.4.30
> OS: Red Hat 5
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (206.47.249.246)
This is not a bug report. This ITS will be closed.
If you have usage questions, please use the openldap-technical(a)openldap.org
mailing list.
--Quanah
--
Quanah Gibson-Mount
Sr. Member of Technical Staff
Zimbra, Inc
A Division of VMware, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
Full_Name: Andre Cardinal
Version: 2.4.30
OS: Red Hat 5
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (206.47.249.246)
I have the following ACL set up in slapd.conf
access to dn.base=""
by * read
access to attrs=GCSRAAllow,GCSRAGroup,GCSRASubjectdn,userpassword
by dn="cn=ProvAdmin,ou=GCSRAAdmin,o=gc,c=ca" write
by dn="cn=gateAdmin1,ou=GCSRAAdmin,o=gc,c=ca" read
by dn="cn=gateAdmin2,ou=GCSRAAdmin,o=gc,c=ca" read
slapacl -f /usr/local/etc/openldap/slapd.conf -D
cn=provadmin,ou=gcsraadmin,o=gc,c=ca -b ou=gcsrausers,o=gc,c=ca gcsraallow
authcDN: "cn=provadmin,ou=gcsraadmin,o=gc,c=ca"
GCSRAAllow: write(=wrscxd)
However any modify I try returns:
modifying entry "GCSRASubjectDN=my636-test,ou=GCSRAUsers,o=gc,c=ca"
ldap_modify: Insufficient access (50)
Full_Name: Jan Synacek
Version: git (c73ec15)
OS: linux-fedora17
URL: http://jsynacek.fedorapeople.org/openldap/leak/openldap-mmr-leak.tar.gz
Submission from: (NULL) (209.132.186.34)
I'm using a 2-node mmr setup on my local machine - configuration files and
'uploader' scripts are provided in the archive.
1) I have the two nodes running.
2) Execute run.sh (only a wrapper for ldapusradm.sh) and start monitoring
slapd's memory usage.
3) After some time (at about 2k users on my system), slapd consumes a large
amount of memory which is still growing
Note that not using ldapmodify to add members to 'cn=users,dc=yes,dc=my', but
using it e.g. for modifying each user's email, does NOT result in any memory
leakage.
I have also created a massif output using valgrind's massif tool:
http://jsynacek.fedorapeople.org/openldap/leak/massif.out.17906
I found a very similar bug (#7292), but I'm not sure if it's related.
Full_Name: Ondrej Kuznik
Version: HEAD
OS: Linux
URL:
Submission from: (NULL) (62.168.56.1)
It appears that an oversight in commit f810e6ed417939ed69b388ad7fb0c696e185f593
has caused the permissive modify control[1] to be parsed as needing a value.
Negating the condition in file servers/slapd/controls.c at line 1627 fixes
that.
[1]: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366984(v=vs.85).a…