openldap-bugs

openldap-bugs@openldap.org

1 participants
20963 discussions

(ITS#5861) Assert control on Add request fails
by h.b.furuseth＠usit.uio.no 16 Dec '08

16 Dec '08

Full_Name: Hallvard B Furuseth Version: HEAD OS: Linux URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard RFC 4528 says the Assert control is appropriate for Add. Slapd disagrees: $ ldapadd -xhlocalhost:3890 -e\!assert='(objectClass=organization)' <test.ldif adding new entry "o=test" ldap_add: Critical extension is unavailable (12) additional info: critical extension is unavailable back-bdb and back-sql do not apply the assert control to Add. The message comes from slapd/controls.c. Don't fix that before fixing Add in the backends, otherwise critical controls can be ignored. Another strangeness: overlays/syncprov.c applies the Assert control to Compare but not other operations. I don't know why, there are no comments about it.

1 0

(ITS#5860) slapd memeory leak under openldap 2.4
by rlvcosta＠yahoo.com 15 Dec '08

15 Dec '08

Full_Name: Rodrigo Costa Version: 2.4.11 OS: RHEL4 U4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (201.82.161.220) Opeldap dev team, I'm facing an issue and after many tentatives I believe this is really a bug that maybe could be identified and solved by openldap community. I tried to include dmalloc into openldap 2.4.11 code but even I could compile with it any tentative to execute the code generated "Segmentation Fault" so I could not use dmalloc to identify where the memory leak is happening. I compiled both Berkeley DB 4.6.21 with its patches from source and then compiled openldap 2.4.11 also from source. I download both from links provided at Oracle and Openldap so I think the code is ok. For reference I compiled Berkeley DB with the following configuration : env CFLAGS="-march=pentium4 -O3 -pipe -fomit-frame-pointer" \ ../dist/configure --enable-largefiles --enable-java --prefix=/usr It compiled without problems. The openldap is compiled with the following configuration : env CFLAGS="-march=pentium4 -O3 -pipe -fomit-frame-pointer" ./configure --with-tls --enable-crypt --enable-syslog --enable-modules --enable-bdb=mod --enable-monitor=mod --enable-shared --with-gnu-ld --enable-overlays=mod --sysconfdir=/etc --prefix=/usr It identifies correctly bdb libraries and compile without any problem. The CHANGES file make reference for ITS#5557 which I saw as possible candidate for the problem I'm having. Even with it looks like there is memory leak. My system is a HP DL380-G3 32 bits with 12GB of memory. The OS is Red Hat Enterprise Linux 4 Update 4. I have actually an old version of OpenLdap(version 2.1.30 with bdb 4.2.52) running in a similar machine without any problem. The specific details are "Linux brtldp11 2.6.9-42.ELsmp #1 SMP Wed Jul 12 23:27:17 EDT 2006 i686 i686 i386 GNU/Linux". I made several slapd.conf files trying to control cache and see this could be a configuration problem. I put into debug 64 and the file is read correctly without any problem. Please see output below : all schema stuff... line 23 (pidfile /var/run/slapd.pid) line 24 (argsfile /var/run/slapd.args) line 26 (allow bind_v2) line 28 (sizelimit 10000) line 29 (timelimit 5400) line 31 (loglevel 0) line 34 (modulepath /usr/libexec/openldap) line 35 (moduleload back_bdb.la) loaded module back_bdb.la module back_bdb.la: null module registered line 36 (moduleload back_monitor.la) loaded module back_monitor.la module back_monitor.la: null module registered line 78 (database bdb) line 79 (suffix "ou=CONTENT,o=alcatel,c=fr") line 80 (rootdn "cn=admin,ou=CONTENT,o=alcatel,c=fr") line 84 (rootpw ***) line 87 (directory /var/openldap-data/bdb1) line 90 (index userid,pnnumber,submxid,maillogin,abookaliasid eq,pres) index uid 0x0006 index pnnumber 0x0006 index submxid 0x0006 index maillogin 0x0006 index abookaliasid 0x0006 line 91 (index objectClass eq) index objectClass 0x0004 line 93 (cachesize 45000) line 94 (dncachesize 45000) line 95 (idlcachesize 45000) line 96 (cachefree 9000) line 104 (database bdb) line 105 (suffix "ou=INDEXES,o=alcatel,c=fr") line 106 (rootdn "cn=admin,ou=INDEXES,o=alcatel,c=fr") line 110 (rootpw ***) line 113 (directory /var/openldap-data/bdb2) line 116 (index weblogin,maillogin,mail,pnnumber eq,pres) index weblogin 0x0006 index maillogin 0x0006 index mail 0x0006 index pnnumber 0x0006 line 117 (index profileid,loginname eq,pres) index profileid 0x0006 index loginname 0x0006 line 118 (index objectClass eq) index objectClass 0x0004 line 120 (cachesize 45000) line 121 (dncachesize 45000) line 122 (idlcachesize 45000) line 123 (cachefree 9000) line 131 (database monitor) slapd starting My DB has around 4 million entrances and the bdb DB file size is around 15GB. The DB itself is not big since the entrances are not soo big. By openLDAP documents a DB with 4million entrances should be supported correctly into a 32 bits system. The issue becomes clear when I try to make a ldapsearch in these DBs(bdb1 and bdb2). If I do it the memory usage by slapd start to increase until all possible memory be allocated and system start to paging. After sometime slapd cannot allocate anymore memory using malloc and slapd crashes. After I put the cache this behavior is taking a little longer but not much longer. It ends memory in around 1 hour. Even if I stop the ldapsearch the memory previously allocated by slad isn't released and the process can be seen in the machine top with a lot of allocated memory. The only way to release this memory is to stop slapd process manually. I beleive there is a memory leakage but I could not identify where. My tentatives to used dmalloc were not successful and then I would like to report this bug. Your expertise identifying if the correct patches are really applied into the openldap2.4.11 is really important to solve this issue. Please let me know if you need more information. Regards, Rodrigo Costa.

1 0

Re: (ITS#5856) adauth overlay contribution
by andrew.findlay＠skills-1st.co.uk 15 Dec '08

15 Dec '08

On Fri, Dec 12, 2008 at 07:31:47PM +0000, kartik_subbarao(a)hp.com wrote: > As discussed with Howard Chu, HP is contributing the code for an Active > Directory Authentication overlay (written by Neil Dunbar) to OpenLDAP. > > The adauth overlay provides passthrough authentication to Active Directory for > LDAP simple bind operations. The local LDAP entry referenced in the bind > operation is mapped to its counterpart in the Active Directory, an LDAP bind > operation is performed against Active Directory, and results are returned based > on the results of that remote operation. If a local userPassword attribute is > populated for the entry, it is used instead of the AD authentication. This is very good news, as it deals with a common requirement without having to configure saslauthd. One suggestion following a very quick scan of the code: I think it would be worth bringing the warning about turning off TLS checks into the manual page. It is worth noting that this overlay raises issues similar to those raised by the contributed adpwc/extpwc module - see ITS#5042. In this case the access to AD is via LDAP rather than Kerberos, but most of the arguments are similar. In particular, there is no reason for this to be AD-specific and it should be easy to adapt it to authenticate against any [collection of] remote LDAP servers. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Re: (ITS#5859) back-hdb entrycache problem
by quanah＠OpenLDAP.org 15 Dec '08

15 Dec '08

--On Monday, December 15, 2008 4:16 PM +0000 openldap-its(a)OpenLDAP.org wrote: Appears to be broken in 2.4.13 as well. Search prior to adding zimbra-3 entry: [zimbra@freelancer ~]$ ldapsearch -x -h freelancer -b "cn=zimbra" -D "uid=zimbra,cn=admins,cn=zimbra" -W # com_zimbra_license, zimlets, zimbra dn: cn=com_zimbra_license,cn=zimlets,cn=zimbra zimbraZimletTarget: admin-main zimbraZimletDescription: License Management for Admin UI zimbraZimletVersion: 5.2 objectClass: zimbraZimletEntry zimbraZimletIndexingEnabled: TRUE zimbraZimletKeyword: com_zimbra_license cn: com_zimbra_license zimbraZimletIsExtension: TRUE zimbraZimletPriority: 1 zimbraZimletEnabled: TRUE # zimbra-2, zimlets, zimbra dn: cn=zimbra-2,cn=zimlets,cn=zimbra cn: zimbra-2 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # search result search: 2 result: 0 Success # numResponses: 46 # numEntries: 45 Then we add the new entry: [zimbra@freelancer ~]$ ldapadd -f /tmp/test.ldif -x -h freelancer -D "uid=zimbra,cn=admins,cn=zimbra" -W Enter LDAP Password: adding new entry "cn=zimbra-3,cn=zimlets,cn=zimbra" Now we search again: # com_zimbra_license, zimlets, zimbra dn: cn=com_zimbra_license,cn=zimlets,cn=zimbra zimbraZimletTarget: admin-main zimbraZimletDescription: License Management for Admin UI zimbraZimletVersion: 5.2 objectClass: zimbraZimletEntry zimbraZimletIndexingEnabled: TRUE zimbraZimletKeyword: com_zimbra_license cn: com_zimbra_license zimbraZimletIsExtension: TRUE zimbraZimletPriority: 1 zimbraZimletEnabled: TRUE # zimbra-2, zimlets, zimbra dn: cn=zimbra-2,cn=zimlets,cn=zimbra cn: zimbra-2 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # search result search: 2 result: 0 Success # numResponses: 46 # numEntries: 45 Same result, this is bad. Now we stop/restart slapd: [zimbra@freelancer ~]$ ldap stop Killing slapd with pid 15613 done. [zimbra@freelancer ~]$ ldap start Started slapd: pid 20224 search again: # zimbra-2, zimlets, zimbra dn: cn=zimbra-2,cn=zimlets,cn=zimbra cn: zimbra-2 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # zimbra-3, zimlets, zimbra dn: cn=zimbra-3,cn=zimlets,cn=zimbra cn: zimbra-3 objectClass: zimbraZimletEntry zimbraZimletVersion: 1.0 zimbraZimletEnabled: TRUE # search result search: 2 result: 0 Success # numResponses: 46 # numEntries: 45 And there is our missing entry. --Quanah -- Quanah Gibson-Mount Release and QA Engineer <http://www.openldap.org>

1 0

(ITS#5859) back-hdb entrycache problem
by quanah＠OpenLDAP.org 15 Dec '08

15 Dec '08

Full_Name: Quanah Gibson-Mount Version: 2.4.13+patches OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.29.239) In using 2.4.13 + the slapadd fix from Ralf, ITS#5841, ITS#5842,ITS#5849,ITS#5850, ITS#5854, I found the following: Create an database with back-hdb with a few subtrees, with several entries under that subtree (My database is rooted at "". I have a "cn=zimbra" tree, with "cn=zimlets,cn=zimbra" underneath it). Now, create a brand new entry under one of those subtrees. The new entry will not be returned in queries rooted at the upper level ("cn=zimbra"). It will show up at its level ("cn=zimlets,cn=zimbra"). If you stop/restart slapd to flush the entry/idl cache, things work correctly.

1 0

Re: (ITS#5858) Segfault with overlay ppolicy
by maniac＠maniac.nl 15 Dec '08

15 Dec '08

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_server11-3551-1229353986-0001-2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline I spoke too soon, both on Solaris and on Linux I still get reproducable segfaults with 2.4.13 as soon as I use a ppolicy overlay in my configuration and query the directory. I have a public shellbox available which has the config loaded Mark --=_server11-3551-1229353986-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFJRnQBb6urvDV9IXgRAt7aAKCC3GveYtw6mHaWWi/EkStXn6YtFwCeIKNx mFaCqgogqL0dkjGJQ6mul4s= =ADsB -----END PGP SIGNATURE----- --=_server11-3551-1229353986-0001-2--

1 0

Re: (ITS#5858) Segfault with overlay ppolicy
by maniac＠maniac.nl 15 Dec '08

15 Dec '08

This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_server11-2243-1229351458-0001-2 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I can reproduce this problem also on Linux/amd64 (Debian Testing) with OpenLDAP 2.4.11. I can confirm that it is FIXED on OpenLDAP 2.4.13 on Linux (and am now compiling it on Solaris) Mark --=_server11-2243-1229351458-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEABECAAYFAklGaiIACgkQb6urvDV9IXiCRQCgoNI6qsFg+gORmzPaYtWLSmmE higAoI2Cq0G0HQevFuC6Q7y1L/62geES =FKcN -----END PGP SIGNATURE----- --=_server11-2243-1229351458-0001-2--

1 0

(ITS#5858) Segfault with overlay ppolicy
by maniac-openldap＠maniac.nl 15 Dec '08

15 Dec '08

Full_Name: Mark Janssen Version: 2.4.11 OS: Solaris 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.64.241.2) Program received signal SIGSEGV, Segmentation fault. [Switching to LWP 3] over_entry_get_rw (op=0x403648, dn=0x403664, oc=0x0, ad=0x0, rw=0, e=0xfd3ff4d4) at backover.c:394 394 return overlay_entry_get_ov( op, dn, oc, ad, rw, e, on ); (gdb) bt full #0 over_entry_get_rw (op=0x403648, dn=0x403664, oc=0x0, ad=0x0, rw=0, e=0xfd3ff4d4) at backover.c:394 oi = (slap_overinfo *) 0x293788 on = (slap_overinst *) 0x275148 #1 0x0009b8a8 in fe_entry_get_rw (op=Cannot access memory at address 0xfcfffec0 ) at frontend.c:62 bd = Cannot access memory at address 0xfcfffe88 (gdb) info threads 4 LWP 4 0xfe3c4a9c in __lwp_park () from /lib/libc.so.1 * 3 LWP 3 over_entry_get_rw (op=0x403648, dn=0x403664, oc=0x0, ad=0x0, rw=0, e=0xfd3ff4d4) at backover.c:394 2 LWP 2 0xfe3c57c8 in __pollsys () from /lib/libc.so.1 1 LWP 1 0xfe3c5c1c in __lwp_wait () from /lib/libc.so.1 (gdb) As soon as I enable 'ppolicy' I get a segfault when I login (with lbe) to the ldap server. Repeatable 100% (goes away when I remove ppolicy overlay from slapd.conf) Config snippet: overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=domain,dc=tld" ppolicy_hash_cleartext

1 0

(ITS#5856) adauth overlay contribution
by kartik_subbarao＠hp.com 12 Dec '08

12 Dec '08

Full_Name: Kartik Subbarao Version: 2.4 OS: Red Hat Enterprise Linux URL: ftp://ftp.openldap.org/incoming/adauth.tar.gz Submission from: (NULL) (76.99.180.78) As discussed with Howard Chu, HP is contributing the code for an Active Directory Authentication overlay (written by Neil Dunbar) to OpenLDAP. The adauth overlay provides passthrough authentication to Active Directory for LDAP simple bind operations. The local LDAP entry referenced in the bind operation is mapped to its counterpart in the Active Directory, an LDAP bind operation is performed against Active Directory, and results are returned based on the results of that remote operation. If a local userPassword attribute is populated for the entry, it is used instead of the AD authentication.

1 0

(ITS#5855) slapd crash at hang or shutdown
by carlcarl＠comcast.net 12 Dec '08

12 Dec '08

Full_Name: Carl Traub Version: all ? OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (141.202.248.52) On Windows,I have found that by simply starting slapd, waiting a few minutes for it to get fully loaded, and then hitting Ctrl-C, slapd will often hang and not terminate properly. It occasionally crashed, and that may been related. The problem is that in slapd_daemon_destroy(), tcp_close() was being called for both wake_sds[1] and wake_sds[0], and the 2 values were always the same. This meant that Windows was being asked to close a connection that had already been closed and was no longer valid. A coworker stated that on Windows, these 2 values are always the same, but he thought that on Unix they would always be different. I uploaded the diff file "carlTraub-121208.diff". I wasn't clear on using the diff tool. Below is the diff. --- P:\temp\daemon.c_bef Fri Dec 12 10:05:38 2008 +++ P:\temp\daemon.c_after Fri Dec 12 10:24:30 2008 @@ -1645,14 +1645,10 @@ slapd_daemon_destroy( void ) { connections_destroy(); + // If the 2 connections are actually the same, closing it twice can cause bad things, like hangs or crashes. + // It may be that they are always the same on Windows, always different on Unix. + if (wake_sds[1] != wake_sds[0] ) { #ifdef HAVE_WINSOCK + if ( wake_sds[1] != INVALID_SOCKET ) - if ( wake_sds[1] != INVALID_SOCKET ) #endif /* HAVE_WINSOCK */ + tcp_close( SLAP_FD2SOCK(wake_sds[1]) ); + } - tcp_close( SLAP_FD2SOCK(wake_sds[1]) ); #ifdef HAVE_WINSOCK if ( wake_sds[0] != INVALID_SOCKET ) #endif /* HAVE_WINSOCK */

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs