openldap-bugs

openldap-bugs@openldap.org

1 participants
20963 discussions

Re: (ITS#8797) improper use of gnutls causes segfault
by hyc＠symas.com 15 Jan '18

15 Jan '18

ryan(a)nardis.ca wrote: > On Mon, Jan 15, 2018 at 07:33:52PM +0000, lukas(a)selfnet.de wrote: >> During initialization, libldap sets custom gnutls mutex functions: >> https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries… >> >> PAM uses libldap via dlopen and unloads it when it's done, but openldap doesn't >> undo gnutls_global_set_mutex, so any further calls to locking functions inside >> openldap will segfault since these function pointers now point to nowhere since >> openldap is unloaded. >> >> I encountered this issue in cups since cups uses gnutls itself for the web >> interface and segfaults when it uses gnutls after libldap. > > Thanks for this report. > > This is not the first issue caused by our usage of the custom mutex > functions; see also <https://bugs.debian.org/803197>. > > Removing the custom mutex functions and (for sufficiently recent GnuTLS) > the calls to gnutls_global_{,de}init() looks like a more and more > attractive solution. I am not aware of anyone using OpenLDAP with GnuTLS > on a platform for which GnuTLS lacks built-in mutex functions... PAM should be using nss-pam-ldapd, not calling libldap directly. This is an architectural flaw in both GnuTLS and PAM, not an OpenLDAP bug. This ITS is invalid. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8797) improper use of gnutls causes segfault
by ryan＠nardis.ca 15 Jan '18

15 Jan '18

On Mon, Jan 15, 2018 at 07:33:52PM +0000, lukas(a)selfnet.de wrote: >During initialization, libldap sets custom gnutls mutex functions: >https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries… > >PAM uses libldap via dlopen and unloads it when it's done, but openldap doesn't >undo gnutls_global_set_mutex, so any further calls to locking functions inside >openldap will segfault since these function pointers now point to nowhere since >openldap is unloaded. > >I encountered this issue in cups since cups uses gnutls itself for the web >interface and segfaults when it uses gnutls after libldap. Thanks for this report. This is not the first issue caused by our usage of the custom mutex functions; see also <https://bugs.debian.org/803197>. Removing the custom mutex functions and (for sufficiently recent GnuTLS) the calls to gnutls_global_{,de}init() looks like a more and more attractive solution. I am not aware of anyone using OpenLDAP with GnuTLS on a platform for which GnuTLS lacks built-in mutex functions...

1 0

(ITS#8797) improper use of gnutls causes segfault
by lukas＠selfnet.de 15 Jan '18

15 Jan '18

Full_Name: Lukas K. Version: 2.4.44+dfsg-5+deb9u1 OS: Debian Stretch URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:7c7:2100:130:b9b5:f8df:7b98:8c2e) During initialization, libldap sets custom gnutls mutex functions: https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries… PAM uses libldap via dlopen and unloads it when it's done, but openldap doesn't undo gnutls_global_set_mutex, so any further calls to locking functions inside openldap will segfault since these function pointers now point to nowhere since openldap is unloaded. I encountered this issue in cups since cups uses gnutls itself for the web interface and segfaults when it uses gnutls after libldap.

1 0

Re: (ITS#8766) Version 2.4.45 vulnerable - CVE-2017-14159
by quanah＠symas.com 15 Jan '18

15 Jan '18

Hi Muthamma, If you read the CVE and follow the link to the related OpenLDAP ITS, you will discover that the reported issue was marked invalid. I.e., what was reported is not a security vulnerability, or will it ever be fixed. Hope this helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8796) SASL bind resets SSF for subsequent binds
by ondra＠openldap.org 15 Jan '18

15 Jan '18

Full_Name: Ondrej Kuznik Version: master/re24 OS: URL: https://github.com/mistotebe/openldap/tree/ITS8796 Submission from: (NULL) (82.10.24.68) After the first bind, a second or any subsequent SASL bind on the same connection that requires non-zero SSF will fail since SSF isn't copied properly. See above for a patch.

1 0

Re: (ITS#8795) Authentication in database
by ryan＠nardis.ca 13 Jan '18

13 Jan '18

Hello, The ITS is for bug reports, not user support. For support, please contact the openldap-technical(a)openldap.org mailing list, or join the #openldap IRC channel. This ITS will be closed.

1 0

(ITS#8795) Authentication in database
by Bhade.j＠gmail.com 13 Jan '18

13 Jan '18

Full_Name: Jayant bhade Version: 3 OS: Ubuntu 14.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2405:204:9008:90a1::13dc:60ad) I'm new for ldap configuration. I getting error for authentication users. Additional info (13) user not found no secret in data base. Kindly help to resolve this problem.

1 0

(ITS#8794) Fix implicit function declaration warnings
by jamegerwe＠fake-box.com 29 Dec '17

29 Dec '17

Full_Name: Jame Gerwe Version: 2.4.45 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (88.198.125.96) If openldap gets compiled with -DLDAP_CONNECTIONLESS, then /libraries/libldap/open.c: In function ldap_initialize: /libraries/libldap/open.c:251:7: warning: implicit declaration of function ldap_is_ldapc_url [-Wimplicit-function-declaration] if (ldap_is_ldapc_url(url)) ^~~~~~~~~~~~~~~~~ Independent of -DLDAP_CONNECTIONLESS we also have complaints about pthread_{set,get}concurrency(): /libraries/libldap_r/thr_posix.c: In function ldap_pvt_thread_set_concurrency: /libraries/libldap_r/thr_posix.c:93:9: warning: implicit declaration of function pthread_setconcurrency [-Wimplicit-function-declaration] return pthread_setconcurrency( n ); ^~~~~~~~~~~~~~~~~~~~~~ /libraries/libldap_r/thr_posix.c: In function ldap_pvt_thread_get_concurrency: /libraries/libldap_r/thr_posix.c:107:9: warning: implicit declaration of function pthread_getconcurrency [-Wimplicit-function-declaration] return pthread_getconcurrency(); ^~~~~~~~~~~~~~~~~~~~~~ Although thr_posix.c includes (indirectly) pthread.h, the home of these two functions, they are not declared in the _DEFAULT_SOURCE set of pthread.h (of glibc). To declare them use #define _GNU_SOURCE or similar prior to including pthread.h. Suggested patch for the first warning: Add ldap_is_ldapc_url() to ldap.h and include it by open.c: -------- [PATCH] Fix implicit-function-declaration in open.c If LDAP_CONNECTIONLESS is defined, then open.c uses 'ldap_is_ldapc_url()' which is defined in url.c but not part of any API (neither public nor private). Make the function part of the public API in ldap.h and include ldap.h in open.c. diff a/include/ldap.h b/include/ldap.h --- a/include/ldap.h +++ b/include/ldap.h @@ -2041,6 +2041,12 @@ LDAP_F( int ) ldap_is_ldapi_url LDAP_P(( LDAP_CONST char *url )); +#ifdef LDAP_CONNECTIONLESS +LDAP_F( int ) +ldap_is_ldapc_url LDAP_P(( + LDAP_CONST char *url )); +#endif + LDAP_F( int ) ldap_url_parse LDAP_P(( LDAP_CONST char *url, diff a/libraries/libldap/open.c b/libraries/libldap/open.c --- a/libraries/libldap/open.c +++ b/libraries/libldap/open.c @@ -33,6 +33,7 @@ #include <ac/unistd.h> #include "ldap-int.h" +#include "ldap.h" #include "ldap_log.h" /* Caller must hold the conn_mutex since simultaneous accesses are possible */

1 0

ITS#8793
by i＠maskray.me 16 Dec '17

16 Dec '17

> Wrong. > Closing this ITS. Sorry but can you re-visit this please? Suppose a MDB_IDL points to [5, 9,7,5,3,1] where the first element denotes the number of elements. [-inf, 1) => position 6; the first element less than or equal to 1 does not exist, thus it points outside of the list [1,3) => position 5 [3,5) => position 4 [5,7) => position 3 [7,9) => position 2 [9,inf) => position 1 Thanks!

1 0

Re: (ITS#8793) [PATCH] Fix comment in lmdb: greater -> less
by hyc＠symas.com 16 Dec '17

16 Dec '17

i(a)maskray.me wrote: > Full_Name: Fangrui Song > Version: 2.4.45 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/fangrui-song-171216.patch > Submission from: (NULL) (24.130.65.8) > > > ID Lists are in decreasing order and the search algorithms actually find the > first ID less than or equal to the argument. Wrong. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs