openldap-bugs

openldap-bugs@openldap.org

1 participants
20959 discussions

Re: (ITS#4757) Support for RFC 3045: Storing Vendor Information in the LDAP root DSE
by Kurt＠OpenLDAP.org 20 Nov '06

20 Nov '06

At 12:36 AM 11/20/2006, michael(a)stroeder.com wrote: >Kurt D. Zeilenga wrote: >> At 01:37 AM 11/19/2006, michael(a)stroeder.com wrote: >>> >>>I'd like to see support for RFC 3045 in slapd. >> >> The only reasonably decent use of such attributes is for >> administrators to determine whether they need to upgrade >> some software or not > >Yes, that's what I'm after. This purpose is, I think, somewhat beyond the intended purpose of the vendorName/Version attributes. These attributes appear to be intended to be used by general LDAP clients, not just administrative clients, for "limited feature discovery". The vendorName/Version you might want reported for "limited feature discovery" might be quite different than what you want reported for "need to upgrade" purposes. And for "need to upgrade" purposes, one needs to know not only the version of the protocol engine (slapd(8)), but version of backend codes, overlay codes, underlying libraries, etc.. >> We provide cn=monitor for this purpose. > >This is proprietary. Think of vendor-independent management/monitoring >software which just gives an terse overview. Generally speaking, DSA administrative interfaces are not standardized. (Which is, to some degree, why I think use of vendorName/Version for administrative purposes is beyond the intentions of these attributes.) >> While it certainly is possible for a client to abuse >> cn=monitor version information, the very fact that the >> version information is in cn=monitor, which generally >> requires special authorization to read, instead of >> the root dse, which generally is readable by most >> every client, is effective in discouraging this abuse. > >The server admin can easily define access control for vendor information >in root DSE. The sample slapd.conf could endorse this. Or another value >for configuration directive 'allow'. Yes, but... Kurt

1 0

Re: (ITS#4757) Support for RFC 3045: Storing Vendor Information in the LDAP root DSE
by michael＠stroeder.com 20 Nov '06

20 Nov '06

Kurt D. Zeilenga wrote: > At 01:37 AM 11/19/2006, michael(a)stroeder.com wrote: >> >>I'd like to see support for RFC 3045 in slapd. > > The only reasonably decent use of such attributes is for > administrators to determine whether they need to upgrade > some software or not Yes, that's what I'm after. > We provide cn=monitor for this purpose. This is proprietary. Think of vendor-independent management/monitoring software which just gives an terse overview. > While it certainly is possible for a client to abuse > cn=monitor version information, the very fact that the > version information is in cn=monitor, which generally > requires special authorization to read, instead of > the root dse, which generally is readable by most > every client, is effective in discouraging this abuse. The server admin can easily define access control for vendor information in root DSE. The sample slapd.conf could endorse this. Or another value for configuration directive 'allow'. Ciao, Michael.

1 0

Re: (ITS#4757) Support for RFC 3045: Storing Vendor Information in the LDAP root DSE
by Kurt＠OpenLDAP.org 20 Nov '06

20 Nov '06

At 01:37 AM 11/19/2006, michael(a)stroeder.com wrote: >Full_Name: Michael Ströder >Version: not relevant >OS: not relevant >URL: ftp://ftp.openldap.org/incoming/ >Submission from: (NULL) (83.124.27.203) > > >HI! > >I'd like to see support for RFC 3045 in slapd. The only reasonably decent use of such attributes is for administrators to determine whether they need to upgrade some software or not (though use of a protocol attribute for this purpose is somewhat problematic). We provide cn=monitor for this purpose. The primary use (or I should say misuse) of such strings is for server behavior discovery (whether the behavior is due to a feature or a bug). As this use leads to interoperability problems (as illustrated by the HTTP "mozilla" compatibility problems), we must allow spoofing and should discourage this use. We support the former via the rootdse configuration option. We support the latter by not providing any values by default. While it certainly is possible for a client to abuse cn=monitor version information, the very fact that the version information is in cn=monitor, which generally requires special authorization to read, instead of the root dse, which generally is readable by most every client, is effective in discouraging this abuse. I think it reasonable to assume any administrative tool for determining whether an OpenLDAP server is up to date would have appropriate authorization to read the cn=monitor values. I note that such tools should not assume a server needs not be upgraded simply because the version is high enough. There easily could be dependent software whose version is not high enough. It would be good for cn=monitor to not only expose the OpenLDAP version information, but to expose version information for dependent software. Of course, as there is an endless number of dependent software, this upgrade detection approach problematic. Seems it would be better to use tools that ran directly on the box to determine whether a server's software needed to be upgraded. But I digresss. In the past we have rejected submissions to extend slapd(8) to generate these values, hence I think this feature request should be closed. However, such closure certainly doesn't preclude someone from implementing **additional** vendorName/Version functionality and submitting it for consideration. There is one aspect of our current vendorName/Version support that is lacking is in dealing with multiple broken clients requiring different vendorName/Version strings. An overlay which spoofed these strings on a configurable basis, whether by authorization identity and/or IP address and/or other authorization factor, would be an interesting functionality addition. Kurt

1 0

(ITS#4757) Support for RFC 3045: Storing Vendor Information in the LDAP root DSE
by michael＠stroeder.com 19 Nov '06

19 Nov '06

Full_Name: Michael Ströder Version: not relevant OS: not relevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.124.27.203) HI! I'd like to see support for RFC 3045 in slapd. Yes, I know I can set this using configuration directive rootDSE in slapd.conf. But that doesn't really help, especially regarding 'vendorVersion'. Ciao, Michael.

1 0

Re: (ITS#4723) SEGV in syncprov search
by richton＠nbcs.rutgers.edu 17 Nov '06

17 Nov '06

Still no good with 2.3.30. I ran 2.3.30 test033 under librtc (valgrind-esque) and it came up clean, so this has to be intermittent or more than a simple config can instigate. [1] t_delete(0xc2c398, 0x50, 0x992e508, 0xfec3c000, 0x0, 0x0), at 0xfebc783c [2] _malloc_unlocked(0x25, 0x0, 0xcb4b0, 0xfec3c000, 0x0, 0x99d3829), at 0xfebc6ecc [3] malloc(0x25, 0x0, 0xffffffff, 0xfffffff8, 0x0, 0xd573ef7d), at 0xfebc6d00 =>[4] ber_memalloc_x(s = 37U, ctx = (nil)), line 226 in "memory.c" [5] ch_malloc(size = 37U), line 54 in "ch_malloc.c" [6] hdb_fix_dn(e = 0x99d3630, checkit = 0), line 445 in "dn2id.c" [7] hdb_cache_find_id(op = 0xd57ff4f4, tid = (nil), id = 7586U, eip = 0xd573f2e8, islocked = 0, locker = 150U, lock = 0xd573f26c), line 765 in "cache.c" [8] hdb_search(op = 0xd57ff4f4, rs = 0xd57ff4b8), line 696 in "search.c" [9] syncprov_findcsn(op = 0x3edff0, mode = FIND_PRESENT), line 685 in "syncprov.c" [10] syncprov_op_search(op = 0x3edff0, rs = 0xd57ffd50), line 2056 in "syncprov.c" [11] overlay_op_walk(op = 0x3edff0, rs = 0xd57ffd50, which = op_search, oi = 0x31bfb8, on = 0x31c0b0), line 491 in "backover.c" [12] over_op_func(op = 0x3edff0, rs = 0xd57ffd50, which = op_search), line 551 in "backover.c" [13] over_op_search(op = 0x3edff0, rs = 0xd57ffd50), line 573 in "backover.c" [14] fe_op_search(op = 0x3edff0, rs = 0xd57ffd50), line 355 in "search.c" [15] do_search(op = 0x3edff0, rs = 0xd57ffd50), line 217 in "search.c" [16] connection_operation(ctx = 0xd57ffe14, arg_v = 0x3edff0), line 1122 in "connection.c" [17] ldap_int_thread_pool_wrapper(xpool = 0x2c5df0), line 478 in "tpool.c"

1 0

Re: (ITS#4675) slapd bus error when searching in a subtree
by quanah＠stanford.edu 17 Nov '06

17 Nov '06

--On Wednesday, November 15, 2006 3:53 PM +0000 ghen(a)telenet.be wrote: > Why was tick ticket closed? The problem still exists. Did you read the notes in the ITS system? --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

RE: (ITS#4756) IPv6 Addresses are not supported in ACL peername
by Damon.Groenveld＠ca.com 17 Nov '06

17 Nov '06

Given that the code (in aclparse.c) calls inet_addr() with the peername.ip parameter, I can't see how it could will work with IPv6. The only possible workaround is using a regex instead of ip type which by passes the inet_addr() call. I raised it as a bug since the latest version (as far as I can tell) is meant to support IPv6 and there is no way that peername.ip does and there isn't an alternative. I asked the question regarding other ways to restrict access since I noted that the documentation mentions TCP Wrappers and has a see also of host_options(5) -- which does not exist, so I was hoping that some advice might come while someone looked at the problem (if or when it was deemed important enough). Damon Groenveld CA Architect, Development tel: +61 3 9727 8920 fax: +61 3 9727 3491 mobile: +61 419 922 326 damon.groenveld(a)ca.com -----Original Message----- From: Howard Chu [mailto:hyc@symas.com] Sent: Friday, 17 November 2006 4:59 PM To: Groenveld, Damon Cc: openldap-its(a)openldap.org Subject: Re: (ITS#4756) IPv6 Addresses are not supported in ACL peername damon.groenveld(a)ca.com wrote: > Full_Name: Damon Groenveld > Version: LATEST > OS: Solaris, WinXP, Linux, AIX, HP-UX > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (60.224.6.218) > > > There does not seem to be the ability to specify an IPv6 address in the peername > part of the ACL. > > Is there any other way to restrict access to a host IP address when using only > IPv6 addresses? Software usage questions should be directed to the OpenLDAP-software mailing list. There is no indication of a bug here, most likely this report should be closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: (ITS#4756) IPv6 Addresses are not supported in ACL peername
by hyc＠symas.com 17 Nov '06

17 Nov '06

damon.groenveld(a)ca.com wrote: > Full_Name: Damon Groenveld > Version: LATEST > OS: Solaris, WinXP, Linux, AIX, HP-UX > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (60.224.6.218) > > > There does not seem to be the ability to specify an IPv6 address in the peername > part of the ACL. > > Is there any other way to restrict access to a host IP address when using only > IPv6 addresses? Software usage questions should be directed to the OpenLDAP-software mailing list. There is no indication of a bug here, most likely this report should be closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

(ITS#4756) IPv6 Addresses are not supported in ACL peername
by damon.groenveld＠ca.com 17 Nov '06

17 Nov '06

Full_Name: Damon Groenveld Version: LATEST OS: Solaris, WinXP, Linux, AIX, HP-UX URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (60.224.6.218) There does not seem to be the ability to specify an IPv6 address in the peername part of the ACL. Is there any other way to restrict access to a host IP address when using only IPv6 addresses?

1 0

Re: (ITS#4755) Show peer's name when syncrepl fails
by daveh＠ci.com.au 17 Nov '06

17 Nov '06

On Thu, 16 Nov 2006, Howard Chu wrote: > Since the rid is supposed to be unique, would you settle for that? > Particularly since there may be multiple sessions to the same host... Yes, that will do nicely. In the meantime I was getting it to print si->si_bindconf.sb_uri.bv_val, as I sort of need it right now... -- Dave Horsfall DTM VK2KFU daveh(a)ci.com.au Ph: +61 2 9552-5509 (d) -5500 (sw) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs