openldap-bugs

openldap-bugs@openldap.org

1 participants
20959 discussions

Re: (ITS#4742) parameter unique_attributes and unknown attribute types
by hyc＠symas.com 11 Nov '06

11 Nov '06

ando(a)sys-net.it wrote: > hyc(a)symas.com wrote: >> Another possibility would be to always enable LDAP_DEBUG_CONFIG for the >> tools. The only reason I suggest this is because I would prefer that >> runtime configuration errors are only logged when specifically >> requested, not at DEBUG_ANY. Since the error messages are already >> returnes to the client in the protocol, it's not always necessary to log >> them separately. >> > The point is that I'd like to separate informative messages about > configuration (LDAP_DEBUG_CONFIG) from __the__ message that described > why slaptest failed (or slapd refuses to start). Right now, either you > get all (which is annoying) or none (which is frustrating). Apparently, > unless we hijack LDAP_DEBUG_NONE for the duration of config parsing, and > OR it to all messages followed by "return ARG_BAD_CONF;", we need > another LDAP_DEBUG_*. OK. And we have usually used DEBUG_ANY for fatal messages of this type. The point I'm making now is that config errors are no longer always fatal; it depends on whether we're starting up or already running. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: (ITS#4742) parameter unique_attributes and unknown attribute types
by ando＠sys-net.it 11 Nov '06

11 Nov '06

hyc(a)symas.com wrote: > Another possibility would be to always enable LDAP_DEBUG_CONFIG for the > tools. The only reason I suggest this is because I would prefer that > runtime configuration errors are only logged when specifically > requested, not at DEBUG_ANY. Since the error messages are already > returnes to the client in the protocol, it's not always necessary to log > them separately. > The point is that I'd like to separate informative messages about configuration (LDAP_DEBUG_CONFIG) from __the__ message that described why slaptest failed (or slapd refuses to start). Right now, either you get all (which is annoying) or none (which is frustrating). Apparently, unless we hijack LDAP_DEBUG_NONE for the duration of config parsing, and OR it to all messages followed by "return ARG_BAD_CONF;", we need another LDAP_DEBUG_*. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4742) parameter unique_attributes and unknown attribute types
by hyc＠symas.com 11 Nov '06

11 Nov '06

ando(a)sys-net.it wrote: > michael(a)stroeder.com wrote: >> It seems that slapd stops without configuration error message if unknown >> attribute types are set for parameter unique_attributes (slapo-unique). It would >> be nice if a descriptive message is displayed (like in other cases). >> > I think this occurs if debug is set to "config" or "-1". However, it > would be more appropriate to log configuration errors that result in > failures at "any", so that whatever logging is set they show up. For > this purpose, many of the current occurrences of LDAP_DEBUG_CONFIG > should be turned into (LDAP_DEBUG_CONFIG | LDAP_DEBUG_NONE), so that > they show up when caught by tools with default logging (e.g. > slaptest(8)), or into LDAP_DEBUG_ANY, so that they show up all times. > I'd vote for the latter. Another possibility would be to always enable LDAP_DEBUG_CONFIG for the tools. The only reason I suggest this is because I would prefer that runtime configuration errors are only logged when specifically requested, not at DEBUG_ANY. Since the error messages are already returnes to the client in the protocol, it's not always necessary to log them separately. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: (ITS#4745) libslapi undefined symbols
by quanah＠stanford.edu 11 Nov '06

11 Nov '06

--On Saturday, November 11, 2006 9:10 PM +0000 hyc(a)symas.com wrote: > quanah(a)stanford.edu wrote: >> Full_Name: Quanah Gibson-Mount >> Version: 2.3.28 >> OS: Linux 2.6 64-bit >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (171.66.155.86) >> >> >> When building OpenLDAP 2.3.28, I found that libslapi is full of undefined >> symbols. Is it not being linked correctly? >> > Do you actually have a slapi plugin that isn't working? There's no > evidence of a bug here. Most dynamic libraries that depend on other > objects are full of undefined symbols. Nope, I don't use slapi at all, other than to enable it to disable the broken acl cacheing in 2.3. Thanks. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Re: (ITS#4745) libslapi undefined symbols
by hyc＠symas.com 11 Nov '06

11 Nov '06

quanah(a)stanford.edu wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3.28 > OS: Linux 2.6 64-bit > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (171.66.155.86) > > > When building OpenLDAP 2.3.28, I found that libslapi is full of undefined > symbols. Is it not being linked correctly? > Do you actually have a slapi plugin that isn't working? There's no evidence of a bug here. Most dynamic libraries that depend on other objects are full of undefined symbols. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

(ITS#4745) libslapi undefined symbols
by quanah＠stanford.edu 11 Nov '06

11 Nov '06

Full_Name: Quanah Gibson-Mount Version: 2.3.28 OS: Linux 2.6 64-bit URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (171.66.155.86) When building OpenLDAP 2.3.28, I found that libslapi is full of undefined symbols. Is it not being linked correctly? ldap-uat00:/usr/local/stow/openldap-2.3.28.9-gcc411/lib> ldd libslapi.so libc.so.6 => /lib/libc.so.6 (0x00002b58357d6000) /lib64/ld-linux-x86-64.so.2 => /lib64/ld-linux-x86-64.so.2 (0x0000555555554000) ldap-uat00:/usr/local/stow/openldap-2.3.28.9-gcc411/lib> ldd -r -d libslapi-2.3.so.0.2.16 libc.so.6 => /lib/libc.so.6 (0x00002adf05784000) /lib64/ld-linux-x86-64.so.2 => /lib64/ld-linux-x86-64.so.2 (0x0000555555554000) undefined symbol: slap_schema (./libslapi-2.3.so.0.2.16) undefined symbol: sockbuf_max_incoming (./libslapi-2.3.so.0.2.16) undefined symbol: ch_mfuncs (./libslapi-2.3.so.0.2.16) undefined symbol: slap_send_ldap_extended (./libslapi-2.3.so.0.2.16) undefined symbol: slap_cids (./libslapi-2.3.so.0.2.16) undefined symbol: slap_unknown_bv (./libslapi-2.3.so.0.2.16) undefined symbol: frontendDB (./libslapi-2.3.so.0.2.16) undefined symbol: sockbuf_max_incoming_auth (./libslapi-2.3.so.0.2.16) undefined symbol: local_ssf (./libslapi-2.3.so.0.2.16) undefined symbol: slap_debug (./libslapi-2.3.so.0.2.16) undefined symbol: slap_send_search_entry (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_syslog_level (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_syslog (./libslapi-2.3.so.0.2.16) undefined symbol: slap_send_ldap_result (./libslapi-2.3.so.0.2.16) undefined symbol: slap_send_search_reference (./libslapi-2.3.so.0.2.16) undefined symbol: entry2str_mutex (./libslapi-2.3.so.0.2.16) undefined symbol: be_isroot (./libslapi-2.3.so.0.2.16) undefined symbol: slapi_plugins_used (./libslapi-2.3.so.0.2.16) undefined symbol: be_slurp_update (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_cond_init (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_cond_broadcast (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_mods_free (./libslapi-2.3.so.0.2.16) undefined symbol: lutil_strcopy (./libslapi-2.3.so.0.2.16) undefined symbol: slap_mods_check (./libslapi-2.3.so.0.2.16) undefined symbol: value_add_one (./libslapi-2.3.so.0.2.16) undefined symbol: attr_merge_normalize_one (./libslapi-2.3.so.0.2.16) undefined symbol: rdn_validate (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_pool_context (./libslapi-2.3.so.0.2.16) undefined symbol: ber_dupbv (./libslapi-2.3.so.0.2.16) undefined symbol: get_supported_extop (./libslapi-2.3.so.0.2.16) undefined symbol: attr_merge_normalize (./libslapi-2.3.so.0.2.16) undefined symbol: ch_free (./libslapi-2.3.so.0.2.16) undefined symbol: modify_add_values (./libslapi-2.3.so.0.2.16) undefined symbol: ber_sockbuf_free (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_cond_signal (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_mutex_unlock (./libslapi-2.3.so.0.2.16) undefined symbol: be_issuffix (./libslapi-2.3.so.0.2.16) undefined symbol: ch_calloc (./libslapi-2.3.so.0.2.16) undefined symbol: slap_sl_free (./libslapi-2.3.so.0.2.16) undefined symbol: anlist2charray_x (./libslapi-2.3.so.0.2.16) undefined symbol: ch_strdup (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_bv2rdn (./libslapi-2.3.so.0.2.16) undefined symbol: value_match (./libslapi-2.3.so.0.2.16) undefined symbol: slap_str2ad (./libslapi-2.3.so.0.2.16) undefined symbol: overlay_is_inst (./libslapi-2.3.so.0.2.16) undefined symbol: ber_bvfree (./libslapi-2.3.so.0.2.16) undefined symbol: is_ad_subtype (./libslapi-2.3.so.0.2.16) undefined symbol: access_allowed_mask (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_mutex_destroy (./libslapi-2.3.so.0.2.16) undefined symbol: dnExtractRdn (./libslapi-2.3.so.0.2.16) undefined symbol: send_ldap_sasl (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_charray_dup (./libslapi-2.3.so.0.2.16) undefined symbol: register_supported_control (./libslapi-2.3.so.0.2.16) undefined symbol: slap_mods2entry (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_cond_wait (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_rdnfree (./libslapi-2.3.so.0.2.16) undefined symbol: ber_bvarray_add (./libslapi-2.3.so.0.2.16) undefined symbol: be_entry_get_rw (./libslapi-2.3.so.0.2.16) undefined symbol: dnPrettyNormal (./libslapi-2.3.so.0.2.16) undefined symbol: select_backend (./libslapi-2.3.so.0.2.16) undefined symbol: dnParent (./libslapi-2.3.so.0.2.16) undefined symbol: lt_dlerror (./libslapi-2.3.so.0.2.16) undefined symbol: attr_delete (./libslapi-2.3.so.0.2.16) undefined symbol: be_entry_release_rw (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_bv2dn (./libslapi-2.3.so.0.2.16) undefined symbol: str2entry (./libslapi-2.3.so.0.2.16) undefined symbol: dnNormalize (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_initialize (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_mutex_lock (./libslapi-2.3.so.0.2.16) undefined symbol: get_supported_controls (./libslapi-2.3.so.0.2.16) undefined symbol: lt_dlclose (./libslapi-2.3.so.0.2.16) undefined symbol: entry_alloc (./libslapi-2.3.so.0.2.16) undefined symbol: slap_parse_ctrl (./libslapi-2.3.so.0.2.16) undefined symbol: entry2str (./libslapi-2.3.so.0.2.16) undefined symbol: entry_dup (./libslapi-2.3.so.0.2.16) undefined symbol: slap_entry2mods (./libslapi-2.3.so.0.2.16) undefined symbol: overlay_op_walk (./libslapi-2.3.so.0.2.16) undefined symbol: rdnNormalize (./libslapi-2.3.so.0.2.16) undefined symbol: str2filter (./libslapi-2.3.so.0.2.16) undefined symbol: filter_free (./libslapi-2.3.so.0.2.16) undefined symbol: attr_find (./libslapi-2.3.so.0.2.16) undefined symbol: ber_sockbuf_alloc (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_rdn2bv (./libslapi-2.3.so.0.2.16) undefined symbol: entry_free (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_dnfree (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_str2rdn (./libslapi-2.3.so.0.2.16) undefined symbol: dnIsSuffix (./libslapi-2.3.so.0.2.16) undefined symbol: rdnMatch (./libslapi-2.3.so.0.2.16) undefined symbol: ber_bvarray_free (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_unbind_ext_s (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_charray_free (./libslapi-2.3.so.0.2.16) undefined symbol: test_filter (./libslapi-2.3.so.0.2.16) undefined symbol: lt_dlopen (./libslapi-2.3.so.0.2.16) undefined symbol: overlay_register (./libslapi-2.3.so.0.2.16) undefined symbol: modify_delete_values (./libslapi-2.3.so.0.2.16) undefined symbol: attr_free (./libslapi-2.3.so.0.2.16) undefined symbol: backend_connection_init (./libslapi-2.3.so.0.2.16) undefined symbol: build_new_dn (./libslapi-2.3.so.0.2.16) undefined symbol: entry_schema_check (./libslapi-2.3.so.0.2.16) undefined symbol: ad_inlist (./libslapi-2.3.so.0.2.16) undefined symbol: filter2bv_x (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_mutex_init (./libslapi-2.3.so.0.2.16) undefined symbol: ber_sockbuf_ctrl (./libslapi-2.3.so.0.2.16) undefined symbol: attr_dup (./libslapi-2.3.so.0.2.16) undefined symbol: connection_assign_nextid (./libslapi-2.3.so.0.2.16) undefined symbol: ch_realloc (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_controls_free (./libslapi-2.3.so.0.2.16) undefined symbol: mods_structural_class (./libslapi-2.3.so.0.2.16) undefined symbol: lt_dlsym (./libslapi-2.3.so.0.2.16) undefined symbol: filter_dup (./libslapi-2.3.so.0.2.16) undefined symbol: dnPretty (./libslapi-2.3.so.0.2.16) undefined symbol: slap_bv2ad (./libslapi-2.3.so.0.2.16) undefined symbol: acl_check_modlist (./libslapi-2.3.so.0.2.16) undefined symbol: dnMatch (./libslapi-2.3.so.0.2.16) undefined symbol: slap_mods_free (./libslapi-2.3.so.0.2.16) undefined symbol: ch_malloc (./libslapi-2.3.so.0.2.16) undefined symbol: ldap_pvt_thread_cond_destroy (./libslapi-2.3.so.0.2.16) undefined symbol: lt_dlinit (./libslapi-2.3.so.0.2.16) undefined symbol: overlay_config (./libslapi-2.3.so.0.2.16)

1 0

Re: (ITS#4744) Bug in SASL authzTo validation using an ldap:// rule
by hyc＠symas.com 11 Nov '06

11 Nov '06

hyc(a)symas.com wrote: > ando(a)sys-net.it wrote: >> As far as I remember, that test is intended to prevent mapping when the >> search returns more than one entry. This makes perfectly sense, >> otherwise a SASL identity (or an authorization identity) would be >> arbitrarily mapped to one of the matching entries. So mapping is >> intended to succeed if and only if exactly one identity can be resolved. > > That test is only supposed to prevent mapping when doing an authzRegexp > mapping of a single SASL userID to a DN. When looking up > authzFrom/authzTo it is supposed to allow multiple results. > Interestingly, it looks like slap_sasl_match isn't even used for > authzRegexp mapping any more. Something is definitely broken here. > This behavior was changed in rev 1.126 of saslauthz.c. I believe the relevant portions of that patch need to be reverted. e.g. patch -R: diff -u -r1.125 -r1.126 --- saslauthz.c 26 Apr 2004 19:47:02 -0000 1.125 +++ saslauthz.c 26 Apr 2004 20:47:08 -0000 1.126 @@ -772,14 +802,26 @@ { smatch_info *sm = o->o_callback->sc_private; - if (rs->sr_type != REP_SEARCH) return 0; + if ( rs->sr_type != REP_SEARCH ) { + if ( rs->sr_err != LDAP_SUCCESS ) { + sm->match = -1; + } + return 0; + } + + if ( sm->match == 1 ) { + sm->match = -1; + return 0; + } if (dn_match(sm->dn, &rs->sr_entry->e_nname)) { sm->match = 1; - return -1; /* short-circuit the search */ + + } else { + sm->match = -1; } - return 1; + return 0; } /* @@ -984,7 +1026,7 @@ op.o_bd->be_search( &op, &rs ); - if (sm.match) { + if (sm.match == 1) { rc = LDAP_SUCCESS; } else { rc = LDAP_INAPPROPRIATE_AUTH; -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: (ITS#4744) Bug in SASL authzTo validation using an ldap:// rule
by hyc＠symas.com 11 Nov '06

11 Nov '06

ando(a)sys-net.it wrote: > sylvain(a)pilotsystems.net wrote: >> Full_Name: Sylvain Viollon >> Version: 2.3 >> OS: FreeBSD 5 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (83.204.228.114) >> >> >> >> I have an directory with some users in ou=people,dc=pilotsystems,dc=net branch, >> having a custom class krbUser ; and a user (cn=auth,dc=pilotsystems,dc=net) >> having the following attribute : >> >> authzTo: ldap:///ou=people,dc=pilotsystems,dc=net??sub?(objectClass=krbUser) >> >> He can successfully authenticate, but not become an user listed by the search >> (with PROXYAUTHZ). Running slapd in debug-mode I saw that he can only become the >> last user returned by the search. >> >> In source, I read the file 'servers/slapd/saslauthz.c'. The filter >> 'sasl_sc_smatch' said if the wanted user is in the search result. In this >> function, there is a test : >> >> if ( sm->match == 1 ) { >> sm->match = -1; >> return 0; >> } >> >> I have removed the line : >> >> sm->match = -1; >> >> Which make the match to fail if there is an entry in the search return after the >> good one. Like every DN have to be unique, there is no multiple solution, and >> validation would not be discarded for that. I didn't know if it's a good >> solution, but it's work. >> >> > As far as I remember, that test is intended to prevent mapping when the > search returns more than one entry. This makes perfectly sense, > otherwise a SASL identity (or an authorization identity) would be > arbitrarily mapped to one of the matching entries. So mapping is > intended to succeed if and only if exactly one identity can be resolved. That test is only supposed to prevent mapping when doing an authzRegexp mapping of a single SASL userID to a DN. When looking up authzFrom/authzTo it is supposed to allow multiple results. Interestingly, it looks like slap_sasl_match isn't even used for authzRegexp mapping any more. Something is definitely broken here. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: (ITS#4744) Bug in SASL authzTo validation using an ldap:// rule
by ando＠sys-net.it 11 Nov '06

11 Nov '06

sylvain(a)pilotsystems.net wrote: > Full_Name: Sylvain Viollon > Version: 2.3 > OS: FreeBSD 5 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (83.204.228.114) > > > > I have an directory with some users in ou=people,dc=pilotsystems,dc=net branch, > having a custom class krbUser ; and a user (cn=auth,dc=pilotsystems,dc=net) > having the following attribute : > > authzTo: ldap:///ou=people,dc=pilotsystems,dc=net??sub?(objectClass=krbUser) > > He can successfully authenticate, but not become an user listed by the search > (with PROXYAUTHZ). Running slapd in debug-mode I saw that he can only become the > last user returned by the search. > > In source, I read the file 'servers/slapd/saslauthz.c'. The filter > 'sasl_sc_smatch' said if the wanted user is in the search result. In this > function, there is a test : > > if ( sm->match == 1 ) { > sm->match = -1; > return 0; > } > > I have removed the line : > > sm->match = -1; > > Which make the match to fail if there is an entry in the search return after the > good one. Like every DN have to be unique, there is no multiple solution, and > validation would not be discarded for that. I didn't know if it's a good > solution, but it's work. > > As far as I remember, that test is intended to prevent mapping when the search returns more than one entry. This makes perfectly sense, otherwise a SASL identity (or an authorization identity) would be arbitrarily mapped to one of the matching entries. So mapping is intended to succeed if and only if exactly one identity can be resolved. If the behavior you're experiencing is consistent with the above, there is no evidence of a bug in OpenLDAP software. If it's not, please detail. Otherwise, this ITS will be closed. p. Unless Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

(ITS#4744) Bug in SASL authzTo validation using an ldap:// rule
by sylvain＠pilotsystems.net 11 Nov '06

11 Nov '06

Full_Name: Sylvain Viollon Version: 2.3 OS: FreeBSD 5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.204.228.114) I have an directory with some users in ou=people,dc=pilotsystems,dc=net branch, having a custom class krbUser ; and a user (cn=auth,dc=pilotsystems,dc=net) having the following attribute : authzTo: ldap:///ou=people,dc=pilotsystems,dc=net??sub?(objectClass=krbUser) He can successfully authenticate, but not become an user listed by the search (with PROXYAUTHZ). Running slapd in debug-mode I saw that he can only become the last user returned by the search. In source, I read the file 'servers/slapd/saslauthz.c'. The filter 'sasl_sc_smatch' said if the wanted user is in the search result. In this function, there is a test : if ( sm->match == 1 ) { sm->match = -1; return 0; } I have removed the line : sm->match = -1; Which make the match to fail if there is an entry in the search return after the good one. Like every DN have to be unique, there is no multiple solution, and validation would not be discarded for that. I didn't know if it's a good solution, but it's work. Openldap 2.2 and 2.4 seems to have the same problem.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs