openldap-bugs

openldap-bugs@openldap.org

1 participants
20967 discussions

(ITS#6607) forwarded bind failure messages cause success
by mbackes＠symas.com 27 Jul '10

27 Jul '10

Full_Name: Matthew Backes Version: RE24 OS: URL: Submission from: (NULL) (76.88.107.46) As noted in http://www.openldap.org/lists/openldap-technical/201004/msg00247.html setting up a chain overlay on the frontend and then configuring ppolicy with ppolicy_forward_updates causes BIND operations with invalid credentials to return success, apparently from the result of the chain operation. This is independent of the value of chain-return-error. WHOAMI reports anonymous after these "successful" BINDs with invalid passwords, so there is no security compromise within the directory itself, however this has (as noted in the above email) catastrophic results for external apps trying to authenticate with BIND.

1 0

(ITS#6606) syncrepl search reply for post-dated cookie
by mbackes＠symas.com 27 Jul '10

27 Jul '10

Full_Name: Matthew Backes Version: RE24 OS: URL: Submission from: (NULL) (76.88.107.46) When replicas try to connect to their provider and supply a cookie generated from a CSN beyond what the provider has, the provider returns success and does nothing. It'd be better to return unwilling-to-perform and squirt out an error indicating that the cookie is in the future. This can happen when the replica is actively receiving changes from the current ppolicy setup or other bug-like situations.

1 0

Re: (ITS#6605) Webmin LDAP User Module Don't Work
by masarati＠aero.polimi.it 27 Jul '10

27 Jul '10

> Full_Name: Andrea Minardi > Version: 2.3.27 > OS: RedHat 5 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (88.40.179.242) > > > Webmin's LDAP Users and Groups module stopped working after upgrading from > Webmin 1.400 to webmin 1.510 > > I have been using Webmin's LDAP Users and Groups module on my company's > server > to administer users. It was working fine on Webmin 1.400, but after > upgrading I > get the error: > > "Webmin has connected to the LDAP server, but failed to fetch the schema. > Make > sure that access has not been denied in the LDAP Server module." It is not clear what this issue has to do with OpenLDAP software, since the problem appears after upgrading a third party software. Software interoperation issues can be discussed on openldap-technical. This ITS will be closed. p.

1 0

Re: (ITS#6600) pcache overlay should ignore invalid attributes in search requests
by masarati＠aero.polimi.it 27 Jul '10

27 Jul '10

> Indeed, looking at it with your comments, definitely overkill. I meant > to ask about this approach in the bug description but forgot, sorry. > > Here is a simpler patch which works the same for my tests: > ftp://ftp.openldap.org/incoming/jonathan-clarke-pcache-100727.patch Hi. Your patch still looks a bit problematic to me. I'm not sure I understood the issue, since it doesn't work for me without further modifications to the code. Suppose I'm searching with a filter that is related to the pcache attrset "cn uid", and my search lists the attributes cn uid undefined what you're trying to accomplish is that this search behaves as if one only requested cn uid right? Well, in this case (at least in HEAD code, I didn't check in re24 yet) it does not work, because all the tests you add work fine, but later the expected attrset will not be matched because the attribute name "undefined" will still be looked for inside the attribute set. You need to add a check that does not look for attributes for which no an_desc was found. However, this case also matches wildcards '*', '+', '1.1'. Tentatively, the "right" patch would be like this <ftp://ftp.openldap.org/incoming/pierangelo-masarati-its6600.1.patch> Please test and report. p.

1 0

Re: (ITS#6599) slapd not responding
by quanah＠zimbra.com 27 Jul '10

27 Jul '10

--On Tuesday, July 27, 2010 7:04 PM +0530 Binoy Joseph <binoy(a)cordys.com> wrote: > > Hi Quanah, > > > Thanks a lot for your reply. > Looks like the issue does not appear with OpenLDAP 2.4.23 and BDB in > Linux. > But somehow the issue still occurs in Windows. > Can you mention which file/issue you are talking about regarding the > locking behavior you mentioned? > Thanks and regards, > Binoy Joseph ITS#6577 --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6600) pcache overlay should ignore invalid attributes in search requests
by jonathan＠phillipoux.net 27 Jul '10

27 Jul '10

On 27/07/2010 01:08, masarati(a)aero.polimi.it wrote: >> Full_Name: Jonathan CLARKE >> Version: RE24 >> OS: >> URL: ftp://ftp.openldap.org/incoming/jonathan-clarke-pcache-100723.patch >> Submission from: (NULL) (80.13.86.63) >> >> >> While checking it's configuration, the pcache overlay verifies each >> configured >> attribute set (pcacheAttrset), to ensure that all attributes in the set >> are >> defined, via slap_str2ad. Given an attribute set with a non-existant >> attribute, >> an error is logged and slapd refuses to start (as expected): >> >> line 117 (pcacheAttrset 0 nonexistantAttr) >> /etc/ldap/slapd.conf: line 117: attribute type undefined. >> >> However, when a search request comes in, the requested attributes list is >> not >> checked by the pcache overlay to ensure that attributes are properly >> defined. In >> effect, slapd just ignores the non-existant attributes, and returns other >> attributes (or behaves as if 1.1 was requested if all requested attributes >> are >> invalid). >> >> This causes pcache's attribute set matching to fail for some requests, >> since it >> counts invalid attributes. If it were to ignore them, configured attribute >> sets >> might match, and successfully cache the search. The patch above implements >> this >> behaviour. Would you consider it for inclusion in OpenLDAP? >> >> I realize this may be considered "repairing bad requests", but sometimes >> one >> can't (easily) control what clients are requesting. Furthermore, it seems >> to >> make sense to have matching behavior all over (since slapd ignores invalid >> requested attributes, pcache should too, IMHO). > > Yours looks like a good catch; however, your patch looks a bit like an > overkill, since the an_desc field of the attribute list that is passed to > get_attr_set() should already be set if the attribute was recognized by > slapd, so you don't need to go through slap_bv2ad() once more. Thanks for your feedback. Indeed, looking at it with your comments, definitely overkill. I meant to ask about this approach in the bug description but forgot, sorry. Here is a simpler patch which works the same for my tests: ftp://ftp.openldap.org/incoming/jonathan-clarke-pcache-100727.patch Jonathan -- -------------------------------------------------------------- Jonathan Clarke - jonathan(a)phillipoux.net -------------------------------------------------------------- Ldap Synchronization Connector (LSC) - http://lsc-project.org --------------------------------------------------------------

1 0

Re: (ITS#6599) slapd not responding
by binoy＠cordys.com 27 Jul '10

27 Jul '10

--00163628368141a7d5048c5e92b6 Content-Type: text/plain; charset=ISO-8859-1 Hi Quanah, Thanks a lot for your reply. Looks like the issue does not appear with OpenLDAP 2.4.23 and BDB in Linux. But somehow the issue still occurs in Windows. Can you mention which file/issue you are talking about regarding the locking behavior you mentioned? Thanks and regards, Binoy Joseph On Mon, Jul 26, 2010 at 9:18 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, July 23, 2010 1:13 PM +0000 binoy(a)cordys.com wrote: > > Full_Name: Binoy Joseph >> Version: 2.4.21 >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (210.210.79.19) >> > > Can you reproduce this with OpenLDAP 2.4.23? There was a change in locking > behavior introduced in 2.4.21 that was backed out in 2.4.23. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > --00163628368141a7d5048c5e92b6 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div>Hi Quanah,</div><div><br></div><div>Thanks a lot for your reply.</div>= <div>Looks like the issue does not appear with OpenLDAP 2.4.23 and BDB in L= inux.</div><div>But somehow the issue still occurs in Windows.</div><div> Can you mention which file/issue you are talking about regarding the lockin= g behavior you mentioned?</div><br clear=3D"all">Thanks and regards,<div>Bi= noy Joseph<br> <br><br><div class=3D"gmail_quote">On Mon, Jul 26, 2010 at 9:18 PM, Quanah = Gibson-Mount <span dir=3D"ltr"><<a href=3D"mailto:quanah@zimbra.com">qua= nah(a)zimbra.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" s= tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"> --On Friday, July 23, 2010 1:13 PM +0000 <a href=3D"mailto:binoy@cordys.com= " target=3D"_blank">binoy(a)cordys.com</a> wrote:<br> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> Full_Name: Binoy Joseph<br> Version: 2.4.21<br> OS: Linux<br> URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_blank">ftp://f= tp.openldap.org/incoming/</a><br> Submission from: (NULL) (210.210.79.19)<br> </blockquote> <br> Can you reproduce this with OpenLDAP 2.4.23? =A0There was a change in locki= ng behavior introduced in 2.4.21 that was backed out in 2.4.23.<br> <br> --Quanah<br><font color=3D"#888888"> <br> <br> --<br> <br> Quanah Gibson-Mount<br> Principal Software Engineer<br> Zimbra, Inc<br> --------------------<br> Zimbra :: =A0the leader in open source messaging and collaboration<br> </font></blockquote></div><br></div> --00163628368141a7d5048c5e92b6--

1 0

(ITS#6605) Webmin LDAP User Module Don't Work
by andrea.minardi＠port.ravenna.it 27 Jul '10

27 Jul '10

Full_Name: Andrea Minardi Version: 2.3.27 OS: RedHat 5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (88.40.179.242) Webmin's LDAP Users and Groups module stopped working after upgrading from Webmin 1.400 to webmin 1.510 I have been using Webmin's LDAP Users and Groups module on my company's server to administer users. It was working fine on Webmin 1.400, but after upgrading I get the error: "Webmin has connected to the LDAP server, but failed to fetch the schema. Make sure that access has not been denied in the LDAP Server module."

1 0

(ITS#6604) nssov build error
by mhardin＠symas.com 26 Jul '10

26 Jul '10

Full_Name: Matt Hardin Version: 2.4.23 OS: Solaris 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (184.11.32.102) nssov.c doesn't compile correctly on systems that don't have a getpeereid function because it doesn't use the LUTIL_GETPEEREID macro. The following patch corrects this. --- nssov.c.orig Mon Jul 26 19:50:47 2010 +++ nssov.c Mon Jul 26 19:32:15 2010 @@ -260,9 +260,15 @@ uid_t uid; gid_t gid; char authid[sizeof("gidNumber=4294967295+uidNumber=424967295,cn=peercred,cn=external,cn=auth")]; +#ifdef LDAP_PF_LOCAL_SENDMSG + char peerbuf[8]; + struct berval peerbv = BER_BVNULL; + peerbv.bv_val = peerbuf; + peerbv.bv_len = sizeof( peerbuf ); +#endif /* log connection */ - if (lutil_getpeereid(sock,&uid,&gid)) + if( LUTIL_GETPEEREID( sock, &uid, &gid, &peerbv )) Debug( LDAP_DEBUG_TRACE,"nssov: connection from unknown client: %s\n",strerror(errno),0,0); else Debug( LDAP_DEBUG_TRACE,"nssov: connection from uid=%d gid=%d\n",

1 0

(ITS#6603) EAGAIN, EWOULDBLOCK occasionally used without checking #ifdef
by masarati＠aero.polimi.it 26 Jul '10

26 Jul '10

Full_Name: Pierangelo Masarati Version: irrelevant OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (129.72.165.243) Submitted by: ando At least in libldap and liblber EAGAIN and EWOULDBLOCK are occasionally used without checking whether they are defined or not. Either the checks should be removed, counting on the fact that these error codes are always defined, or they should be used consistently.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs