openldap-bugs

openldap-bugs@openldap.org

1 participants
20967 discussions

Re: (ITS#5189) slapadd -q breaks db_stat -c
by hyc＠symas.com 22 Oct '07

22 Oct '07

h.b.furuseth(a)usit.uio.no wrote: > I wrote: >> Just reproduced it. Out of locks (so of course configure more), then >> "Accessing a corrupted shared library". Will file a separate ITS, it >> doesn't sound like slapadd in a clean directory should need 1000+ locks. > > ...yes it should, it was a case of writing an entry with many values > in an indexed attribute - after the index was big enough that presumably > few of the new values' hashes ended up on the same DB page. So, it's > just a spurious scary error message afterwards from BerkeleyDB. > The "Accessing a corrupted shared library" message occurs on Linux because it's logging an LDAP result code (80, LDAP_OTHER) as a system errno code. Probably ought to change that... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5189) slapadd -q breaks db_stat -c
by h.b.furuseth＠usit.uio.no 22 Oct '07

22 Oct '07

I wrote: > Just reproduced it. Out of locks (so of course configure more), then > "Accessing a corrupted shared library". Will file a separate ITS, it > doesn't sound like slapadd in a clean directory should need 1000+ locks. ...yes it should, it was a case of writing an entry with many values in an indexed attribute - after the index was big enough that presumably few of the new values' hashes ended up on the same DB page. So, it's just a spurious scary error message afterwards from BerkeleyDB. -- Regards, Hallvard

1 0

Re: (ITS#5189) slapadd -q breaks db_stat -c
by h.b.furuseth＠usit.uio.no 22 Oct '07

22 Oct '07

hyc(a)symas.com writes: > These are backend-specific considerations. Feel free to file an ITS > against the slapd-bdb(5) manpage if you wish. Might as well be this one. "Need to document what you are explaining here." Probably mostly in the Admin Guide with a few notes in the manpage. > Any operation will acquire a lock for every single DB page it > touches. (...) I don't think that can be quite right. A search which traverses the database would need an awful lot of locks. Unless for the entries it acquires and then releases the locks for one entry at a time. > The more work that an operation needs to do, the more pages > it will touch, the more locks it will need. (...) Another item would be entries needed to evaluate access controls, I assume. >> Sleepycat messages can be scary. I came from the slapadd "wrong dynamic >> library" or message or whatever it was which the mailinglist says is >> cured with more locks & lockers, so I increased those and just got >> another error message (this ITs). So apparently, something still wrong. > > I'm not familiar with that message or advice. Just reproduced it. Out of locks (so of course configure more), then "Accessing a corrupted shared library". Will file a separate ITS, it doesn't sound like slapadd in a clean directory should need 1000+ locks. http://www.openldap.org/lists/openldap-software/200607/msg00305.html >> "Not configured for the locking subsystem" sounded like a permanent >> problem with the database build, not that it would get "reconfigured" >> to support locking when needed. Hence this report. Oh well. > > The message said The Environment is not configured for locking. It > didn't say the BDB library. Yes, that's what I meant. The database, with its enviroment, I just built with slapadd. > Really there's nothing mystical or spooky here, and if you've actually > read the BDB documentation you'll know what The Environment refers > to. If you're using back-[bh]db without having read the BDB > documentation, despite all the recommendations to do so, you deserve > to be scared. I've read it. -- Regards, Hallvard

1 0

(ITS#5196) Documentation should indicate that slurpd is deprecated
by bgmilne＠staff.telkomsa.net 22 Oct '07

22 Oct '07

Full_Name: Buchan Milne Version: REL_ENG_2_3 (post-2.3.38) OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (196.15.129.131) It is well known that slurpd is deprecated, and it has been removed from 2.4. However, many questions arise in various support fora (case in point, #ldap on irc.freenode.net) about setting up slurpd, and the documentation still covers slurpd, without noting that it is deprecated (which probably contributes to continued use of slurpd, even on 2.3). A notice should be placed at least in the following places to this effect: -slurpd(8) -Admin guide chapter 14 -replica section of slapd.conf(5) -slapd.replog(5)

1 0

Re: (ITS#5189) slapadd -q breaks db_stat -c
by hyc＠symas.com 21 Oct '07

21 Oct '07

Hallvard B Furuseth wrote: > hyc(a)symas.com writes: >> h.b.furuseth(a)usit.uio.no wrote: >>> quanah(a)zimbra.com writes: >>>> You have to run slapd at least once before using the db_stat tool >>>> after using slapadd -q. This is a known feature of using -q. >>> Ah, need doc fix in slapadd.8 then. >> What exactly are you trying to do? > > Playing around, mostly. > >> slapadd -q disables locking, > > I don't see that in the doc. It's reasonable to infer, except I have no > idea why even slapadd (without -q) needs so many. I couldn't find an > explanation of what does use locks and lockers (FAQ file 893 doesn't > say), thus not how many I will need and which of these limits is fatal > if I have too few. Can experiment to find out the latter, of course. These are backend-specific considerations. Feel free to file an ITS against the slapd-bdb(5) manpage if you wish. In back-[bh]db there are typically up to two transactions per operation, and each transaction uses a single locker. There's also a single reader locker per thread. So at most you need 3 lockers per configured server thread. The BDB default of 1000 is generally more than enough. Any operation will acquire a lock for every single DB page it touches. The more work that an operation needs to do, the more pages it will touch, the more locks it will need. If you write an entry that has many indexed attributes, or if you have substring indices on attributes with lengthy values, you will need many locks in a single operation. While the number of pages simultaneously held open will depend on the actual distribution of data in the database, an operation will generally need at least one lock per DB file. So, one for a dn2id lookup, one for an id2entry lookup, and one for each defined index. In most cases that's all, but substring indices will generally need a number of locks proportional to the length of the strings being indexed. > Sleepycat messages can be scary. I came from the slapadd "wrong dynamic > library" or message or whatever it was which the mailinglist says is > cured with more locks & lockers, so I increased those and just got > another error message (this ITs). So apparently, something still wrong. I'm not familiar with that message or advice. > "Not configured for the locking subsystem" sounded like a permanent > problem with the database build, not that it would get "reconfigured" to > support locking when needed. Hence this report. Oh well. The message said The Environment is not configured for locking. It didn't say the BDB library. Really there's nothing mystical or spooky here, and if you've actually read the BDB documentation you'll know what The Environment refers to. If you're using back-[bh]db without having read the BDB documentation, despite all the recommendations to do so, you deserve to be scared. >> so of course there's nothing for db_stat -c to report. There's no >> breakage here. > -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5189) slapadd -q breaks db_stat -c
by h.b.furuseth＠usit.uio.no 21 Oct '07

21 Oct '07

hyc(a)symas.com writes: >h.b.furuseth(a)usit.uio.no wrote: >> quanah(a)zimbra.com writes: >>> You have to run slapd at least once before using the db_stat tool >>> after using slapadd -q. This is a known feature of using -q. >> >> Ah, need doc fix in slapadd.8 then. > > What exactly are you trying to do? Playing around, mostly. > slapadd -q disables locking, I don't see that in the doc. It's reasonable to infer, except I have no idea why even slapadd (without -q) needs so many. I couldn't find an explanation of what does use locks and lockers (FAQ file 893 doesn't say), thus not how many I will need and which of these limits is fatal if I have too few. Can experiment to find out the latter, of course. Sleepycat messages can be scary. I came from the slapadd "wrong dynamic library" or message or whatever it was which the mailinglist says is cured with more locks & lockers, so I increased those and just got another error message (this ITs). So apparently, something still wrong. "Not configured for the locking subsystem" sounded like a permanent problem with the database build, not that it would get "reconfigured" to support locking when needed. Hence this report. Oh well. > so of course there's nothing for db_stat -c to report. There's no > breakage here. -- Hallvard

1 0

Re: (ITS#5195) ssf not available during sasl bind
by hyc＠symas.com 19 Oct '07

19 Oct '07

russell-openldap(a)stuart.id.au wrote: > I am trying to insist that connections during sasl auth operations are > encrypted. Ie, that this works: > > access to attrs=userPassword > by tls_ssf=128 ssf=128 anonymous auth > by * none > > It does work for a simple bind. But for a sasl bind it fails, and this telltale > appears in the log: > > slapd[26499]: <= check a_authz.sai_ssf: ACL 128 > OP 0 > > I fixed the issue using this patch, which applies to 2.4.5, 2.3.38 and 2.3.30: I suppose that may be a legitimate bug, but this isn't really the correct fix. slap_auxprop_lookup is doing an internal search, so there is no network to speak of. In SSF terms it would have an SSF of "infinity". > diff -Nur openldap2.3-2.3.30/servers/slapd/sasl.c > openldap2.3-2.3.30.new/servers/slapd/sasl.c > --- openldap2.3-2.3.30/servers/slapd/sasl.c 2007-10-19 15:27:53.000000000 > +1000 > +++ openldap2.3-2.3.30.new/servers/slapd/sasl.c 2007-10-19 15:29:18.000000000 > +1000 > @@ -384,6 +384,7 @@ > op.ors_slimit = 1; > op.ors_filter = &generic_filter; > op.ors_filterstr = generic_filterstr; > + op.o_authz = conn->c_authz; > /* FIXME: we want all attributes, right? */ > op.ors_attrs = NULL; > > > > . > -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5195) ssf not available during sasl bind
by russell-openldap＠stuart.id.au 18 Oct '07

18 Oct '07

Full_Name: Russell Stuart Version: 2.3.30 OS: Debian Etch URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (210.15.201.110) I am trying to insist that connections during sasl auth operations are encrypted. Ie, that this works: access to attrs=userPassword by tls_ssf=128 ssf=128 anonymous auth by * none It does work for a simple bind. But for a sasl bind it fails, and this telltale appears in the log: slapd[26499]: <= check a_authz.sai_ssf: ACL 128 > OP 0 I fixed the issue using this patch, which applies to 2.4.5, 2.3.38 and 2.3.30: diff -Nur openldap2.3-2.3.30/servers/slapd/sasl.c openldap2.3-2.3.30.new/servers/slapd/sasl.c --- openldap2.3-2.3.30/servers/slapd/sasl.c 2007-10-19 15:27:53.000000000 +1000 +++ openldap2.3-2.3.30.new/servers/slapd/sasl.c 2007-10-19 15:29:18.000000000 +1000 @@ -384,6 +384,7 @@ op.ors_slimit = 1; op.ors_filter = &generic_filter; op.ors_filterstr = generic_filterstr; + op.o_authz = conn->c_authz; /* FIXME: we want all attributes, right? */ op.ors_attrs = NULL;

1 0

(ITS#5194) tpool lockup in RE_24
by quanah＠zimbra.com 18 Oct '07

18 Oct '07

Full_Name: Quanah Gibson-Mount Version: RE24 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (71.202.148.128) Using latest RE_24, test050 locked up on me. slapd backtrace shows: (gdb) info threads 1 Thread 46912516103168 (LWP 8947) 0x00000038dcc0c758 in __lll_mutex_lock_wait () from /lib64/libpthread.so.0 (gdb) bt #0 0x00000038dcc0c758 in __lll_mutex_lock_wait () from /lib64/libpthread.so.0 #1 0x00000038dcc087c4 in _L_mutex_lock_107 () from /lib64/libpthread.so.0 #2 0x00000038dcc08263 in pthread_mutex_lock () from /lib64/libpthread.so.0 #3 0x00002aaaaaabc72e in ldap_pvt_thread_pool_resume (tpool=<value optimized out>) at tpool.c:703 #4 0x000000000041d8d5 in config_back_modify (op=0x7fffeb28cc50, rs=0x7fffeb28cdc0) at bconfig.c:4710 #5 0x00002aaaac3d5944 in syncprov_checkpoint (op=0x7fffeb28cec0, rs=<value optimized out>, on=0x1b8df9d0) at syncprov.c:1318 #6 0x00002aaaac3d5f02 in syncprov_db_close (be=0x1b7a6440, cr=<value optimized out>) at syncprov.c:2660 #7 0x0000000000485578 in over_back_response (op=0x1b7c57c0, rs=0x1b7c57c0) at backover.c:234 #8 0x0000000000000000 in ?? () (gdb) frame 3 #3 0x00002aaaaaabc72e in ldap_pvt_thread_pool_resume (tpool=<value optimized out>) at tpool.c:703 703 ldap_pvt_thread_mutex_lock(&pool->ltp_mutex); (gdb) l 698 pool = *tpool; 699 700 if (pool == NULL) 701 return(0); 702 703 ldap_pvt_thread_mutex_lock(&pool->ltp_mutex); 704 pool->ltp_pause = 0; 705 if (pool->ltp_state == LDAP_INT_THREAD_POOL_RUNNING) 706 ldap_pvt_thread_cond_broadcast(&pool->ltp_cond); 707 ldap_pvt_thread_mutex_unlock(&pool->ltp_mutex);

1 0

Re: (ITS#5193) defines.sh error
by hyc＠symas.com 17 Oct '07

17 Oct '07

quanah(a)zimbra.com wrote: > Full_Name: Quanah Gibson-Mount > Version: RE24 > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (71.202.148.128) > > > make[2]: Entering directory `/usr/local/build/ldap-rel-eng-2-4/tests' > Initiating LDAP tests for BDB... > ./scripts/defines.sh: line 55: cd: ./schema: No such file or directory > Running ./scripts/all... >>>>>> Executing all LDAP tests for bdb > > > SCHEMADIR=${USER_SCHEMADIR-./schema} > ABS_SCHEMADIR=`(cd $SCHEMADIR; pwd)` > > Should that be ../schema? Why do we need to cd to it? Nothing is failing so > far by not doing so. That'll only happen the first time. We cd into it so that pwd will tell us the absolute path. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs