openldap-bugs

openldap-bugs@openldap.org

1 participants
21001 discussions

Re: (ITS#6702) slappasswd prompts missing
by d＠delphij.net 12 Nov '10

12 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 11/11/10 20:51, David Gessel wrote: > Excellent. > > Xin Li had a partial patch earlier tonight that got the prompts directed properly to console. Thanks. To Howard, I think getpassphrase(3) is Solaris specific interface and not part of standard. On FreeBSD, getpass(3) returns a buffer pointer that contains at most 128 (_PASSWORD_LEN) characters, which should fulfill the need of OpenBSD but shorter than Solaris[1] which have 256, not counting the terminating nul character. Note that FreeBSD do have a readpassphrase(3) extension which provide more flexibility. I am not sure, however, whether we should implement the Solaris behavior for getpassphrase(3), as it's not a standard defined interface? Is there any other operating system that provide getpassphrase(3) and have the same behavior? If it's desirable we could have it implemented on FreeBSD this way: ================= char * getpassrase(const char *prompt) { static char buf[256 + 1]; return(readpassphrase(prompt, buf, sizeof(buf), RPP_ECHO_OFF)); } ================= Please advise, thanks! [1] http://docs.sun.com/app/docs/doc/816-5168/getpassphrase-3c?l=en&n=1&a=view > -------- Original Message -------- > Subject: Re: (ITS#6702) slappasswd prompts missing > From: Howard Chu <hyc(a)symas.com> > To: gessel(a)blackrosetech.com > Date: Thu Nov 11 2010 19:18:29 GMT-0800 (Pacific Standard Time) > >> Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a >> replacement in the OpenLDAP code is used instead. The OpenLDAP code is now >> fixed in HEAD. >> - -- Xin LI <delphij(a)delphij.net> http://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (FreeBSD) iQEcBAEBCAAGBQJM3YW3AAoJEATO+BI/yjfB2jsIANUBBR2Cu/uhd7w8SDmfWJkL UcibY5xL4i1gg2CM2DR/SgVqUYF/SHnGmMECgmu7CVRvXRNPn7Zp7TzhfYJgM7SJ lYqE5+uajyGUt3N3z7bB4BT9GF6PTyXhWUDsdxc1IHcQ2Dvpq/3Ih7vuCQmAimCv NJ9CXQYJPLflRo8RAMmNtiYeiZjMWK9PjrfC7CuAYKPvhKGFMQ5o7NXBZ8T+16WC Igbw7DKALAPBZmV2hXbwMQAYJ8hBUkDlph2U8k7zBTfIkWSqx+DDeY/CaOmUnb9A puUTm3WEYI2MxwlOVLnvy7QRNFsXejFvXkZN5ZTPoDbBT7MZRFrOn9gKQRGF4D8= =9iQc -----END PGP SIGNATURE-----

1 0

Re: (ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 12 Nov '10

12 Nov '10

Excellent. Xin Li had a partial patch earlier tonight that got the prompts directed properly to console. -------- Original Message -------- Subject: Re: (ITS#6702) slappasswd prompts missing From: Howard Chu <hyc(a)symas.com> To: gessel(a)blackrosetech.com Date: Thu Nov 11 2010 19:18:29 GMT-0800 (Pacific Standard Time) > gessel(a)blackrosetech.com wrote: >> Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: >> "rootpw New password:" >> "Re-enter new password:" >> >> >> > Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a > replacement in the OpenLDAP code is used instead. The OpenLDAP code is now > fixed in HEAD. >

1 0

Re: (ITS#6702) slappasswd prompts missing
by hyc＠symas.com 12 Nov '10

12 Nov '10

gessel(a)blackrosetech.com wrote: > Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: > "rootpw New password:" > "Re-enter new password:" > > > Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a replacement in the OpenLDAP code is used instead. The OpenLDAP code is now fixed in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6701) Update to man8 slappasswd: English usage
by hyc＠symas.com 12 Nov '10

12 Nov '10

diver06(a)gmx.net wrote: > Full_Name: Simon Wright > Version: 2.4.23 > OS: FreeBSD > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.98.32.54) > > > The man page for slappasswd says that encryption scheme names need to be > protected due to "{". This is wrong usage: scheme names may need to be protected > *by* "{" Wrong. The manpage text is correct. The '{' and '}' are part of the scheme names. Since these are also meta-characters in common command shells, they may need to be protected from expansion. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: "rootpw New password:" "Re-enter new password:"

1 0

(ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Full_Name: David Gessel Version: openldap-sasl-server-2.4.23 OS: FreeBSD 8.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.93.181.141) Attempting to insert a hash of the root pw into slapd.conf with the command: # slappasswd >> slapd.conf yields a blank prompt, that is there is no feedback to prompt the user along the lines of: "Enter root password" and "Verify root password" But entering the root password twice with no feedback (and blank characters for security, so completely blind) gets through the command successfully.

1 0

(ITS#6701) Update to man8 slappasswd: English usage
by diver06＠gmx.net 11 Nov '10

11 Nov '10

Full_Name: Simon Wright Version: 2.4.23 OS: FreeBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.98.32.54) The man page for slappasswd says that encryption scheme names need to be protected due to "{". This is wrong usage: scheme names may need to be protected *by* "{" Patch: --- openldap-2.4.23/doc/man/man8/slappasswd.8 2010-04-13 22:22:46.000000000 +0200 +++ slappasswd.8 2010-11-11 16:36:28.000000000 +0100 @@ -100,7 +100,7 @@ The default is .BR {SSHA} . -Note that scheme names may need to be protected, due to +Note that scheme names may need to be protected by .B { and .BR } ,

1 0

Re: (ITS#6698) Please add BDB 5.x support for SLAPD
by hyc＠symas.com 11 Nov '10

11 Nov '10

faessler(a)was.ch wrote: > Full_Name: Dominik Fässler > Version: 2.4.23 > OS: FreeBSD (8.1-RELEASE) > URL: > Submission from: (NULL) (62.2.101.221) > > > We know that for the moment only BDB versions 4.4 - 4.8 are supported as backend > for SLAPD. > We would be happy, if you could include support for BDB versions 5.x as well. > (For now we are using 5.1) > Thanx. > Added to configure script in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6700) memberOf overlay does not handle MODRDN correctly
by raphael.ouazana＠linagora.com 10 Nov '10

10 Nov '10

Full_Name: Raphael Ouazana Version: 2.4.23 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.41.232.151) Hi, When using memberOf overlay, a MODRDN request on a member does not update correctly the matching group, even if the memberof-refint option is set to true. In my little understanding, memberof_value_modify calls op->o_bd->be_modify which calls back the overlay code, and finally never reach the backend. Regards, Raphaël Ouazana.

1 0

RE: (ITS#6683) DDS fails with expired branches
by Petteri.Stenius＠ubisecure.com 10 Nov '10

10 Nov '10

Hi, Thank you for your reply. My knowledge about the bdb internals is limited. I have reproduced this issue and reduced it to a small amount of data (see below). I think I have done everything right with regards to setting up and preparing the database and indexes. I've used both ldapmodify and slapadd/slapindex to prepare the db. If you think my indexes are corrupt then can you please give me pointers how to verify? I don't think there exist test cases for operators LE "<=3D" or GE = ">=3D" in the source codes. Thanks, Petteri -----Original Message----- From: Howard Chu [mailto:hyc@symas.com]=20 Sent: Tuesday, November 09, 2010 10:45 AM To: Petteri Stenius Cc: openldap-its(a)openldap.org Subject: Re: (ITS#6683) DDS fails with expired branches Petteri.Stenius(a)ubisecure.com wrote: > Hello, > > Further investigation shows this issue is caused by operator LE search > failing with indexed attributes. Also this indexed search issue is NOT > limited to DDS.=3D20 > > I have reproduced the issue with integerOrderingMatch and > generalizedTimeOrderingMatch.=3D20 > > The piece of code I find suspicious is in servers/back-bdb/idl.c, > somewhere in the middle it reads > > /* skip presence key on range inequality lookups */ > while (rc =3D3D=3D3D 0&& kptr->size !=3D3D len) { > rc =3D3D cursor->c_get( cursor, kptr,&data, flags | > DB_NEXT_NODUP ); > } > > If I remove this block then LE search works as expected with indexed > attributes. The key here seems to be the DB_NEXT_NODUP flag. This flag > causes the iterator block a few lines below to return partial matches. That implies that there's something else corrupt in the index, because the=20 presence key will never be the same size as an equality key. > > Thanks, > Petteri > > -----Original Message----- > From: openldap-bugs-bounces(a)OpenLDAP.org > [mailto:openldap-bugs-bounces@OpenLDAP.org] On Behalf Of > petteri.stenius(a)ubisecure.com > Sent: Monday, October 25, 2010 1:35 PM > To: openldap-its(a)openldap.org > Subject: (ITS#6683) DDS fails with expired branches > > Full_Name:=3D20 > Version: 2.4.23 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.197.205.34) > > > Hello, > > I have a directory with branches of dynamicObject entries. It looks like > if the > entryExpireTimestamp value is the same on objects within a branch then > DDS > search for expired objects will only find the top-most object. This > results in > remove failing with message > > DDS dn=3D3D"cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest" is non-leaf; = deferring. > > > To reproduce > > OpenLDAP 2.4.23, Berkeley DB 4.6.21 > > Use slapadd to prepare directory with following > > dn: cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: applicationProcess > cn: Root > > dn: cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: top > > dn: cn=3D3Dleaf1,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: leaf1 > > dn: cn=3D3Dleaf2,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: leaf2 > > dn: cn=3D3Dleaf3,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > objectClass: top > objectClass: device > objectClass: dynamicObject > entryTTL: 60 > entryExpireTimestamp: 20101024113626Z > cn: leaf3 > > > Relevant slapd.conf entries > > database bdb > suffix "cn=3D3DRoot,dc=3D3Dtest" > rootdn "cn=3D3DRoot,dc=3D3Dtest" > rootpw "password" > > overlay dds > dds-default-ttl 3600 > dds-min-ttl 60 > dds-interval 60 > dds-state true > index entryExpireTimestamp eq,pres > > access to dn.subtree=3D3D"cn=3D3DRoot,dc=3D3Dtest" > by users write > by * read > > > Running "slapd -d 1 -d 256" produces following > > put_filter: > "(&(objectClass=3D3DdynamicObject)(entryExpireTimestamp<=3D3D201010250824= 46Z )=3D > )" > put_filter: AND > put_filter_list > "(objectClass=3D3DdynamicObject)(entryExpireTimestamp<=3D3D20101025082446= Z)" > put_filter: "(objectClass=3D3DdynamicObject)" > put_filter: simple > put_simple_filter: "objectClass=3D3DdynamicObject" > put_filter: "(entryExpireTimestamp<=3D3D20101025082446Z)" > put_filter: simple > put_simple_filter: "entryExpireTimestamp<=3D3D20101025082446Z" > ber_scanf fmt ({mm}) ber: > ber_scanf fmt ({mm}) ber: > =3D3D> bdb_search > bdb_dn2entry("cn=3D3Droot,dc=3D3Dtest") > =3D3D> bdb_dn2id("cn=3D3Droot,dc=3D3Dtest") > <=3D3D bdb_dn2id: got id=3D3D0x1 > entry_decode: "cn=3D3DRoot,dc=3D3Dtest" > <=3D3D entry_decode(cn=3D3DRoot,dc=3D3Dtest) > search_candidates: base=3D3D"cn=3D3Droot,dc=3D3Dtest" (0x00000001) = scope=3D3D2 > =3D3D> bdb_dn2idl("cn=3D3Droot,dc=3D3Dtest") > =3D3D> bdb_equality_candidates (objectClass) > =3D3D> key_read > <=3D3D bdb_index_read: failed (-30989) > <=3D3D bdb_equality_candidates: id=3D3D0, first=3D3D0, last=3D3D0 > =3D3D> bdb_equality_candidates (objectClass) > =3D3D> key_read > <=3D3D bdb_index_read 4 candidates > <=3D3D bdb_equality_candidates: id=3D3D4, first=3D3D2, last=3D3D5 > =3D3D> bdb_inequality_candidates (entryExpireTimestamp) > =3D3D> key_read > <=3D3D bdb_index_read 1 candidates > =3D3D> key_read > <=3D3D bdb_index_read: failed (-30989) > <=3D3D bdb_inequality_candidates: id=3D3D1, first=3D3D2, last=3D3D2 > bdb_search_candidates: id=3D3D1 first=3D3D2 last=3D3D2 > entry_decode: "cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest" > <=3D3D entry_decode(cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest) > =3D3D> bdb_dn2id("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest") > <=3D3D bdb_dn2id: got id=3D3D0x2 > send_ldap_result: conn=3D3D-1 op=3D3D0 p=3D3D0 > bdb_dn2entry("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest") > =3D3D> bdb_dn2id_children("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest") > <=3D3D bdb_dn2id_children("cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest"): (0) > send_ldap_result: conn=3D3D-1 op=3D3D0 p=3D3D0 > DDS dn=3D3D"cn=3D3Dtop,cn=3D3Droot,dc=3D3Dtest" is non-leaf; = deferring. > DDS expired=3D3D0 > > > ldapsearch "(entryExpireTimestamp=3D3D*)" produces > > dn: cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > dn: cn=3D3Dleaf1,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > dn: cn=3D3Dleaf2,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > dn: cn=3D3Dleaf3,cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > > where ldapsearch "(entryExpireTimestamp<=3D3D20101024113626Z)" only finds > > dn: cn=3D3Dtop,cn=3D3DRoot,dc=3D3Dtest > entryExpireTimestamp: 20101024113626Z > > > If I change all timestamps to distinct values then expiration of > complete > branches works as expected. > > > Thanks, > Petteri > > > --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs