openldap-bugs

openldap-bugs@openldap.org

1 participants
20963 discussions

(ITS#5803) Incorrect filters (e.g. substrings) may trigger "disconnect"
by ando＠sys-net.it 11 Nov '08

11 Nov '08

Full_Name: Pierangelo Masarati Version: HEAD OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.72.89.40) Submitted by: ando When a malformed filter is encountered, ber decoding may stop before the specific element has been parsed. This results in a decoding error later, that triggers a "disconnect" response. To reproduce: search with "(objectClass=foo*bar)". The correct behavior would consist in parsing the whole filter anyway and identify it as COMPUTED UNDEFINED. p.

1 0

Re: (ITS#5796) back-sql intermittently failing
by ando＠sys-net.it 11 Nov '08

11 Nov '08

Robert Brooks wrote: > Pierangelo Masarati wrote: >> I have no possibility to setup a back-sql with mysql right now. Can >> you post your configuration? Can you post some (verbose) logs of >> operations affecting back-sql (e.g. with BACKSQL_TRACE manually >> #defined in back-sql/back-sql.h)? Can you step thru a search into >> backsql_search() and see if it gets called and why it doesn't get to >> contacting the rdbms? > > I'm compiling with BACKSQL_TRACE defined right now. > > After further prodding I have discovered... > > ejabberd (a jabber daemon) makes connections to ldap, which it keeps > open indefinitely. It appears mysql's odbc connector will time out an > idle mysql connection after 8 hours. Since this is the slave system it's > entirely possible for it not touch mysql connections for at least 8 hours. > > If we restart mysql some ldap queries fail on back-sql portion until we > kill ejabberd (to close it's ldap connections). > > I'll give you logs with tracing enabled asap, but this looks like a big > clue as to what is happening. OK, this makes sense. In fact, back-sql does not seem to specifically handle broken connections to the odbc. It appears it would need something similar to idle-timeout as in back-ldap and back-meta. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5796) back-sql intermittently failing
by robb＠wtg.cw.com 11 Nov '08

11 Nov '08

Pierangelo Masarati wrote: > I have no possibility to setup a back-sql with mysql right now. Can you > post your configuration? Can you post some (verbose) logs of operations > affecting back-sql (e.g. with BACKSQL_TRACE manually #defined in > back-sql/back-sql.h)? Can you step thru a search into backsql_search() > and see if it gets called and why it doesn't get to contacting the rdbms? I'm compiling with BACKSQL_TRACE defined right now. After further prodding I have discovered... ejabberd (a jabber daemon) makes connections to ldap, which it keeps open indefinitely. It appears mysql's odbc connector will time out an idle mysql connection after 8 hours. Since this is the slave system it's entirely possible for it not touch mysql connections for at least 8 hours. If we restart mysql some ldap queries fail on back-sql portion until we kill ejabberd (to close it's ldap connections). I'll give you logs with tracing enabled asap, but this looks like a big clue as to what is happening.

1 0

Re: (ITS#5796) back-sql intermittently failing
by ando＠sys-net.it 11 Nov '08

11 Nov '08

robb(a)wtg.cw.com wrote: > Full_Name: Robert Brooks > Version: 2 > OS: 2.4.12 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (62.49.19.14) > > > Set up is a pair of centos 4 hosts, one acts as primary, the other is a syncrepl > consumer and mysql slave. Apart from syncrepl config/myqsl slave all config and > software versions are the same. Mysql queries on both hosts are to localhost via > socket. > > After a period of operation (24-48 hours) the slave host drops the back-sql part > of directory for some queries (same query will suceed some times). Using strace > it can been seen that the ldap searches are not resulting in queries to mysql. > Back-sql is a subordinate db and results from hdb backed part of directory are > returned. > > Restarting slapd fixes the problem, but start-up reports the shutdown was > unclean on hdb db. Operation of primary is reliable. I have no possibility to setup a back-sql with mysql right now. Can you post your configuration? Can you post some (verbose) logs of operations affecting back-sql (e.g. with BACKSQL_TRACE manually #defined in back-sql/back-sql.h)? Can you step thru a search into backsql_search() and see if it gets called and why it doesn't get to contacting the rdbms? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

[Fwd: ITS#4556 ACLs for new entries]
by hyc＠symas.com 11 Nov '08

11 Nov '08

For completeness' sake... ACL checking for Added entries is available in RE24/HEAD. See the add_content_acl / olcAddContentAcl setting in slapd.conf/slapd.d. The default for most DBs is off, for backward compatibility. It is ON by default for cn=config. -------- Original Message -------- Subject: ITS#4556 ACLs for new entries Date: Fri, 21 Sep 2007 09:00:37 -0700 From: Howard Chu <hyc(a)symas.com> To: OpenLDAP Devel <openldap-devel(a)openldap.org> Revisiting this topic - DITStructureRules are not a solution to this problem. E.g. in cn=config, now that you can grant write access to arbitrary users, it becomes pretty critical to be able to prevent certain users from creating certain types of objects. E.g., I may want to allow someone to be able to create one type of child object under cn=config (e.g., databases) but not some other type (e.g., modules). So at the very least we need to be able to use ACL filters on new entries. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5796)
by robb＠webtechnologygroup.co.uk 11 Nov '08

11 Nov '08

can re-create this problem by restarting mysql. Following a restart about one in five queries fails on back-sql portion of directory.

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by quanah＠zimbra.com 10 Nov '08

10 Nov '08

--On Tuesday, November 11, 2008 3:52 AM +0000 abartlet(a)samba.org wrote: > > --=-nSmbtQnR20QHrM5OsFp5 > Content-Type: text/plain > Content-Transfer-Encoding: quoted-printable > > On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: >> A tentative implementation is in HEAD, please test. You need to: > > I just wanted to say thankyou very much for doing this. The Samba side > of things has taken far longer than I ever imagined, but I hope to look > at the OpenLDAP integration this or next week. It was added to RE24 today, for inclusion in 2.4.13, so getting feedback would be great. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by abartlet＠samba.org 10 Nov '08

10 Nov '08

--=-nSmbtQnR20QHrM5OsFp5 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: > A tentative implementation is in HEAD, please test. You need to: I just wanted to say thankyou very much for doing this. The Samba side of things has taken far longer than I ever imagined, but I hope to look at the OpenLDAP integration this or next week. Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com --=-nSmbtQnR20QHrM5OsFp5 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBJGQF+z4A8Wyi0NrsRAnpXAJ9c4Lx4uVyadLTvaTaAm7rvTWKC+QCgrK9p Vhadna7DXcJs0h11JPmkg8c= =HgJ+ -----END PGP SIGNATURE----- --=-nSmbtQnR20QHrM5OsFp5--

1 0

Re: (ITS#5797) build failed
by hyc＠symas.com 10 Nov '08

10 Nov '08

cycwj(a)163.com wrote: > Full_Name: bluewind > Version: 2.4.12 > OS: ubunt server 8 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (219.133.134.8) > > > try to build on ubutnu server 8, use install manaul from www.openldap.org > > #./configure (ok) > #make depen (ok) > #make (ok) > > but,when execution > > #make test > > the system stop on "Running slapadd to build slapd database...", no any > response > > after about 1 hour I think what Ando was trying to say very subtly is that your bug report does not contain much useful information, and you should have searched the ITS for similar issues before posting. This is a known bug in BerkeleyDB 4.7.25. We have to guess that this is the version of BDB that you're using because you didn't provide this info in your report. ITS#5707 already contains the details of this bug and the official patch from Oracle. The patch is also present in the OpenLDAP CVS. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5799) smbk5pwd update to work with heimdal 1.2 API
by hyc＠symas.com 10 Nov '08

10 Nov '08

admin(a)dmarkey.com wrote: > Full_Name: David Markey > Version: 2.4 > OS: Solaris/AIX/Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (79.97.241.103) > > > Update smbk5pwd to work with the heimdal 1.2 API. Work has been done on the > mailing list but the patches have not been applied to the release. I don't see any patches in your report. Patches that are to be considered for inclusion into the codebase must be submitted to the ITS by their authors, with any Rights statement as needed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs