openldap-bugs

openldap-bugs@openldap.org

1 participants
20959 discussions

(ITS#6094) test054 doesn't replicate an entry
by dieter＠dkluenter.de 05 May '09

05 May '09

Full_Name: Dieter Kluenter Version: 2.4.16 OS: Linux x86_64 URL: http://dkluenter.de/download/dkluenter_test054.tgz Submission from: (NULL) (87.154.44.82) test054 doesn't replicate the entry dn: ou=Information Technolgy Devision,ou=people,dc=example,dc=com A tar archive containing the files server1.flt, server2.flt, server1.log, server4.log can be downloaded from the below URL -Dieter

1 0

Re: (ITS#6092) correct string problem in guess_service_principal()
by mikbec＠web.de 04 May '09

04 May '09

Hallvard B Furuseth wrote: > mikbec(a)web.de writes: >> When GSSAPI option GSSAPI_ALLOW_REMOTE_PRINCIPAL is switched on then >> string provided by "givenstr" will be used as principal name. But >> length of string counted in "svc_principal_size" is one letter to >> less. > > svc_principal_size looks correct in that case, but the snprintf is > wrong. I can't test, but it should work to pass svc_principal_size > instead of svc_principal_size-1. Except snprintf seems pointless here, > since we already make sure to allocate enough memory to avoid overflow. Your code looks OK to me ... so there is no need for any code that relates to "svc_principal_size" any more. > > I'll take the opportunity to get rid of a gcc -Wformat warning - it > can't verify the format argument since that is not a string literal. > > Like this. What's a good name for my new "prefix" variable below? I > don't know Kerberos/GSSAPI terminology. Hmmm ... its a good question. The problem is here the hostname is the instance and "ldap/" is the service we are looking for on that host. So "prefix" is really the "service" and "dnsHostName" or "host" are the service instances .... I think if we call it "spn_instance_prefix" or simply "svc_prefix" then this will be a good choice. Please have a look at: http://www.gnu.org/software/shishi/manual/html_node/Realm-and-Principal-Nam… section 4.3.2 Principal Names. This is a summary of RFC 1510 chapter 7.2 "Principal names". The princial name type we are using here is mostly NT-SRV-HST. > > const char *prefix; > ... > if (allow_remote && givenstr) { > prefix = ""; > str = givenstr; > } else { > prefix = "ldap/"; > str = (allow_remote && dnsHostName) ? dnsHostName : host; > } > > svc_principal = (char*) ldap_memalloc(strlen(prefix) + strlen(str) + 1); > if ( svc_principal == NULL ) { > ld->ld_errno = LDAP_NO_MEMORY; > return ld->ld_errno; > } > sprintf( svc_principal, "%s%s", prefix, str); >

1 0

Re: (ITS#6092) correct string problem in guess_service_principal()
by h.b.furuseth＠usit.uio.no 04 May '09

04 May '09

mikbec(a)web.de writes: > When GSSAPI option GSSAPI_ALLOW_REMOTE_PRINCIPAL is switched on then > string provided by "givenstr" will be used as principal name. But > length of string counted in "svc_principal_size" is one letter to > less. svc_principal_size looks correct in that case, but the snprintf is wrong. I can't test, but it should work to pass svc_principal_size instead of svc_principal_size-1. Except snprintf seems pointless here, since we already make sure to allocate enough memory to avoid overflow. I'll take the opportunity to get rid of a gcc -Wformat warning - it can't verify the format argument since that is not a string literal. Like this. What's a good name for my new "prefix" variable below? I don't know Kerberos/GSSAPI terminology. const char *prefix; ... if (allow_remote && givenstr) { prefix = ""; str = givenstr; } else { prefix = "ldap/"; str = (allow_remote && dnsHostName) ? dnsHostName : host; } svc_principal = (char*) ldap_memalloc(strlen(prefix) + strlen(str) + 1); if ( svc_principal == NULL ) { ld->ld_errno = LDAP_NO_MEMORY; return ld->ld_errno; } sprintf( svc_principal, "%s%s", prefix, str); -- Hallvard

1 0

(ITS#6093) correct hostname resolving problem in guess_service_principal()
by mikbec＠web.de 04 May '09

04 May '09

Full_Name: Mike Becher Version: HEAD of 2.4 OS: Linux URL: ftp://ftp.openldap.org/incoming/mike-becher-090504.libraries-libldap.patch Submission from: (NULL) (84.150.168.64) patch file name: mike-becher-090504.libraries-libldap.patch patch subject: correct hostname resolving problem in guess_service_principal() patch description: In AD (Active Directory) enviroment this patch removes the problem with potentially invalid hostname "DomainDnsZones.MY.DOMAIN" which might be given in the "host" string. Instead (if possible) hostname of AD-DC will be tried first to which the caller is connected to. It uses function ldap_host_connected_to() provided in os-ip.c to do a reverse lookup on the address to get the official hostname of connected host. This is necessary for kerberos to work right, since the official hostname is used as the kerberos instance.

1 0

(ITS#6092) correct string problem in guess_service_principal()
by mikbec＠web.de 04 May '09

04 May '09

Full_Name: Mike Becher Version: HEAD of 2.4 OS: Linux URL: ftp://ftp.openldap.org/incoming/mike-becher-090504.libraries-libldap-gssapi… Submission from: (NULL) (84.150.168.64) patch file name: mike-becher-090504.libraries-libldap-gssapi.2.patch patch subject: correct string problem in guess_service_principal() patch description: When GSSAPI option GSSAPI_ALLOW_REMOTE_PRINCIPAL is switched on then string provided by "givenstr" will be used as principal name. But length of string counted in "svc_principal_size" is one letter to less. This patch corrects this problem, allocates memory for one more character to get space for '\0' and sets it.

1 0

(ITS#6091) missing implementation of "switch off" functionality of GSSAPI OPTIONS
by mikbec＠web.de 04 May '09

04 May '09

Full_Name: Mike Becher Version: HEAD of 2.4 OS: Linux URL: ftp://ftp.openldap.org/incoming/mike-becher-090504.libraries-libldap-gssapi… Submission from: (NULL) (84.150.168.64) patch file name: mike-becher-090504.libraries-libldap-gssapi.1.patch patch subject: missing implementation of "switch off" functionality of GSSAPI OPTIONS patch description: Like manual pages of "ldap.conf (5)" describe in section GSSAPI OPTIONS it should be able to activate and/or deactivate options GSSAPI_SIGN, GSSAPI_ENCRYPT, and GSSAPI_ALLOW_REMOTE_PRINCIPAL. But functionality to switch off such a feature is not implemented. This patch adds the "switch off" functionality.

1 0

Re: (ITS#6084) ppolicy should allow scheduled password expiration
by Guillaume.Rousse＠inria.fr 04 May '09

04 May '09

Howard Chu a écrit : > Since the ppolicy module's behavior is dictated by the Behera draft, any > suggestions for changes in this area should probably first be raised on > the ietf-ldapext mailing list. Right, but openldap implementation already have extension, such pwdCheckModule. Additional extension could be implemented, before getting standardized. Also, the ietf-ldapext seems to be an highly-technical list, and I don't feel confortable enough to post this kind of request directly there. Discussing various limitations of ppolicy among openldap users first would probably allow openldap core team to suggest a more polished extension request themselves. -- BOFH excuse #287: Telecommunications is downshifting.

1 0

Re: (ITS#6090) slapd locks up; all slapd worker threads blocking on mutex acquisition in bdb_cache_lru_link()
by jwm＠horde.net 04 May '09

04 May '09

On Fri, 01 May 2009 15:10:46 -0700, Howard Chu wrote: > It seems you may need to recompile BerkeleyDB with debugging enabled (and > with -fno-omit-frame-pointer) to get a useful trace from this. This is > looking more like a BDB locking issue than an OpenLDAP issue. Done. Now we wait. > If you still have the environment, db_stat -CA would be helpful. slapd has been restarted since, so the lock statistics won't be useful. I've modified our harness to get them automatically with the backtrace. john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

1 0

Re: (ITS#6074) SEGV in pthread_mutex_lock()
by richton＠nbcs.rutgers.edu 03 May '09

03 May '09

On Sun, 3 May 2009, Howard Chu wrote: >> data is null, p is null. > > And the trace shows data = 0x12cd3e0f0. What are you looking at? Sorry about that...despite appearances, I actually know that NULL != "". Guess this is what I get for writing an e-mail on the way to the airport. Let's try: (dbx) print data data = 0x12cd3e0f0 (dbx) print *data *data = (void) (dbx) print p p = (nil) so dereferencing p->avl_data was the no go. Hopefully this is more sane...

1 0

Re: (ITS#6087) The LDAP server refused to perform the operation
by quanah＠zimbra.com 03 May '09

03 May '09

--On Friday, May 01, 2009 11:13 AM +0000 damariris(a)gmail.com wrote: > Full_Name: Damaris > Version: 2.2.20 > OS: ubuntu > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (83.38.79.241) Usage questions should be sent to openldap-software(a)openldap.org. I see no bug here. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs