openldap-bugs

openldap-bugs@openldap.org

1 participants
20962 discussions

Re: (ITS#8762) Unlocking an account doesn't remove pwdFailureTime
by michael＠stroeder.com 27 Oct '17

27 Oct '17

mihai.munteanu(a)thalesgroup.com wrote: > Scenario: > 0. we have configured that after 3 login failed attempts, the account to be > locked. > 1. user test1 fails to login 3 times -> account is locked Please provide the password policy as LDIF. > 2. admin unlocks test1's account and notify test1 user Which exact LDAP operation is done when "admin unlocks test1's account". Are you just removing 'pwdAccountLockedTime'? I'm asking because there might be a misunderstanding how that is supposed to work. In this case it's an usage question better to be discussed on openldap-technical mailing list. Ciao, Michael.

1 0

(ITS#8762) Unlocking an account doesn't remove pwdFailureTime
by mihai.munteanu＠thalesgroup.com 27 Oct '17

27 Oct '17

Full_Name: Mihai Munteanu Version: 2.4.44 OS: CentOS7 x64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (86.12.190.162) Scenario: 0. we have configured that after 3 login failed attempts, the account to be locked. 1. user test1 fails to login 3 times -> account is locked 2. admin unlocks test1's account and notify test1 user 3. user test1 tries 1 time to login using a wrong password and gets his account locked again. Expectation here: account should not be locked after first attempt of a wrong password, but after third attempt, as it was the case on step 1. It turns out that it is locked again after first attempt due to the fact that on step 2, only pwdAccountLockedTime field is removed from LDAP, but not also pwdFailureTime fields. It seems pwdFailureTime is internally cleared only: - when test1 successfully authenticate (having his account unlocked) - admin changes test1's password See below my details: $>ldapsearch -x -b "cn=test1,ou=users,dc=thales,dc=com" + ... pwdChangedTime: 20171027043554Z pwdFailureTime: 20171027052019.225837Z pwdFailureTime: 20171027052021.776604Z pwdFailureTime: 20171027052024.436413Z pwdAccountLockedTime: 20171027052024Z entryCSN: 20171027055105.381686Z#000000#000#000000 ... $>cat unlock.ldif: dn: cn=test1,ou=users,dc=thales,dc=com changetype: modify delete: pwdAccountLockedTime - delete: pwdFailureTime $>ldapmodify -x -W -D "cn=admin,ou=users,dc=thales,dc=com" -f unlock.ldif Enter LDAP Password: modifying entry "cn=test1,ou=users,dc=thales,dc=com" ldap_modify: Constraint violation (19) additional info: pwdFailureTime: no user modification allowed $>cat unlock.ldif dn: cn=test1,ou=users,dc=thales,dc=com changetype: modify delete: pwdAccountLockedTime $>ldapmodify -x -W -D "cn=jamessmith,ou=users,dc=thales,dc=com" -f unlock.ldif Enter LDAP Password: modifying entry "cn=test1,ou=users,dc=thales,dc=com" $>ldapsearch -x -b "cn=test1,ou=users,dc=thales,dc=com" + ... pwdChangedTime: 20171027043554Z pwdFailureTime: 20171027052019.225837Z pwdFailureTime: 20171027052021.776604Z pwdFailureTime: 20171027052024.436413Z entryCSN: 20171027055105.381686Z#000000#000#000000 ... Result: pwdAccountLockedTime is removed but pwdFailureTime is not automatically removed also. Expected: since I'm not allowed to remove pwdFailureTime I would expect to be automatically removed via removal of pwdAccountLockedTime.

1 0

Re: (ITS#8760) LMDB: seg fault on opening a new database
by hyc＠symas.com 26 Oct '17

26 Oct '17

github(a)nicwatson.org wrote: > Full_Name: Nic Watson > Version: LMDB 0.9.21 > OS: Ubuntu 16.04.3 LTS > URL: https://gist.github.com/jnwatson/86b43b0515fe552a087d741d4ab43922 > Submission from: (NULL) (108.56.136.246) > > > See the URL for the minimal C program to reproduce the crash and the gdb > backtrace. > > LMDB will seg fault in mdb_dbi_open when creating a new database if the > environment was opened read-only. Thanks for the report, but this doesn't seem like a bug. Trying to create something when the environment was opened read-only is clearly a misuse of the API, and SEGVs are expected when the API is misused. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8761) Comment for SLAPD_OVER_RETCODE define in portable.h is incorrect
by metzen＠gmail.com 23 Oct '17

23 Oct '17

Full_Name: Matt McDonald Version: OS: URL: Submission from: (NULL) (2601:282:b01:175b:359:7f8e:53e6:7341) The comment for the SLAPD_OVER_RETCODE entry in include/portable.hin incorrectly describes it as the "Referential Integrity" overlay, when it should indicate the "return code" overlay. diff --git a/include/portable.hin b/include/portable.hin index 3b17ccf04..3e340b6c7 100644 --- a/include/portable.hin +++ b/include/portable.hin @@ -1020,7 +1020,7 @@ /* define for Referential Integrity overlay */ #undef SLAPD_OVER_REFINT -/* define for Referential Integrity overlay */ +/* define for return code overlay */ #undef SLAPD_OVER_RETCODE /* define for Rewrite/Remap overlay */

1 0

(ITS#8760) LMDB: seg fault on opening a new database
by github＠nicwatson.org 22 Oct '17

22 Oct '17

Full_Name: Nic Watson Version: LMDB 0.9.21 OS: Ubuntu 16.04.3 LTS URL: https://gist.github.com/jnwatson/86b43b0515fe552a087d741d4ab43922 Submission from: (NULL) (108.56.136.246) See the URL for the minimal C program to reproduce the crash and the gdb backtrace. LMDB will seg fault in mdb_dbi_open when creating a new database if the environment was opened read-only. This was found trying to update py-lmdb from 0.9.19 to 0.9.21. Two unit tests crashed that didn't crash before, both on the same line in mdb.c. The program in the URL is derived from one of the tests. The change was introduced in commit e8e82933. In mdb.c, line 9772 (https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/mdb.c#L9772) the mdb_cursor_put was wrapped in the macro WITH_CURSOR_TRACKING. In that macro, the variable tp is assigned the address of an entry of the passed-in cursor's transaction's mt_cursors array. However, mt_cursors isn't initialized in this case.

1 0

Re: (ITS#7042) [PATCH] allow unsetting of tls_* options for syncrepl
by patrick＠monnerat.net 21 Oct '17

21 Oct '17

This is a multi-part message in MIME format. --------------19DA99C0CC1B00C741A26BE6 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit On 10/19/2017 05:07 PM, Quanah Gibson-Mount wrote: > Hi Patrick, Hi Quanah, Thanks for your directives and future action. > > What we need is for you to simply reply to this ITS with your IPR > statement, and the patch attached. This will allow us to include it. > Here they are: I, Patrick Monnerat, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. Patrick --------------19DA99C0CC1B00C741A26BE6 Content-Type: text/x-patch; name="0001-Allow-unsetting-of-tls_-syncrepl-options.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename*0="0001-Allow-unsetting-of-tls_-syncrepl-options.patch" >From 167330b0cfe3f45351c0ebdce3545c1347e9029b Mon Sep 17 00:00:00 2001 From: Patrick Monnerat <patrick(a)monnerat.net> Date: Sat, 21 Oct 2017 16:35:32 +0100 Subject: [PATCH] Allow unsetting of tls_* syncrepl options. This can be done by setting them to an empty string value. ITS: #7042 --- libraries/libldap/tls2.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c index 04db612..7e1b17b 100644 --- a/libraries/libldap/tls2.c +++ b/libraries/libldap/tls2.c @@ -836,31 +836,31 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) return 0; case LDAP_OPT_X_TLS_CACERTFILE: if ( lo->ldo_tls_cacertfile ) LDAP_FREE( lo->ldo_tls_cacertfile ); - lo->ldo_tls_cacertfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_cacertfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_CACERTDIR: if ( lo->ldo_tls_cacertdir ) LDAP_FREE( lo->ldo_tls_cacertdir ); - lo->ldo_tls_cacertdir = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_cacertdir = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_CERTFILE: if ( lo->ldo_tls_certfile ) LDAP_FREE( lo->ldo_tls_certfile ); - lo->ldo_tls_certfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_certfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_KEYFILE: if ( lo->ldo_tls_keyfile ) LDAP_FREE( lo->ldo_tls_keyfile ); - lo->ldo_tls_keyfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_keyfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_DHFILE: if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile ); - lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_dhfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_ECNAME: if ( lo->ldo_tls_ecname ) LDAP_FREE( lo->ldo_tls_ecname ); - lo->ldo_tls_ecname = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_ecname = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile ); - lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_crlfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_REQUIRE_CERT: if ( !arg ) return -1; @@ -888,7 +888,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) #endif case LDAP_OPT_X_TLS_CIPHER_SUITE: if ( lo->ldo_tls_ciphersuite ) LDAP_FREE( lo->ldo_tls_ciphersuite ); - lo->ldo_tls_ciphersuite = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_ciphersuite = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; return 0; case LDAP_OPT_X_TLS_PROTOCOL_MIN: @@ -899,7 +899,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) if ( ld != NULL ) return -1; if ( lo->ldo_tls_randfile ) LDAP_FREE (lo->ldo_tls_randfile ); - lo->ldo_tls_randfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; + lo->ldo_tls_randfile = (arg && *(char *)arg) ? LDAP_STRDUP( (char *) arg ) : NULL; break; case LDAP_OPT_X_TLS_NEWCTX: if ( !arg ) return -1; -- 2.5.5 --------------19DA99C0CC1B00C741A26BE6--

1 0

(ITS#8759) mixed overlay nops & memberof cause segfault
by zhixu.liu＠gmail.com 20 Oct '17

20 Oct '17

Full_Name: Z. Liu Version: 2.4.44 OS: Gentoo URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (221.218.169.84) if we enable overlay nops & memberof together, then doing a member MODDN operation, slapd will segfault and exit immediately. Example operation: dn: uid=test,ou=People,dc=example,dc=dc=com changetype: moddn newrdn: uid=chenln deleteoldrdn: 1 newsuperior: ou=Leave,dc=example,dc=com The reason is: in servers/slapd/overlays/memberof.c, function memberof_value_modify define mod/values/nvalues in the stack, which will be passed to other overlays, nops will try to free them if no attribute is changed.

1 0

(ITS#8758) New Mirror in the Netherlands
by mirror＠koddos.net 19 Oct '17

19 Oct '17

Full_Name: Martin Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (109.123.96.17) Hello, We wish to create a new public mirror in the Netherlands for OpenLDAP. Is there any server we can use for rsync? Regards, Martin

1 0

Re: (ITS#7042) [PATCH] allow unsetting of tls_* options for syncrepl
by quanah＠symas.com 19 Oct '17

19 Oct '17

Hi Patrick, What we need is for you to simply reply to this ITS with your IPR statement, and the patch attached. This will allow us to include it. IPR guidelines are here: <https://www.openldap.org/devel/contributing.html#notice> Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8671) Declare ldap_init_fd() in ldap.h to help external consumers
by quanah＠symas.com 19 Oct '17

19 Oct '17

--On Thursday, October 19, 2017 10:20 AM +0300 Alexander Bokovoy <abokovoy(a)redhat.com> wrote: > Hi Quanah, > > On ti, 12 syys 2017, Quanah Gibson-Mount wrote: >> Hi Alexander, >> >> Your submission appears to be missing an IPR statement as noted at >> <https://www.openldap.org/devel/contributing.html#notice>. This is >> required for your submission to be evaluated. Please add an IPR at >> your earliest convenience. > Attached is a re-based patch set since there were changes in git master > in last month or so that affected the same area. > > There are two patches: one for git master, one for 2.4 branch. Since > there is no functional change in the code, I'd like to see the 2.4 > version in an upcoming release as that would greatly help Samba. > > I'm also including an IPR notice below: > > Red Hat, Inc. hereby place the following modifications to OpenLDAP > Software (and only these modifications) into the public domain. > Hence, these modifications may be freely used and/or redistributed > for any purpose with or without attribution and/or other notice. Thanks very much! I'll get this into my scratch repo for review. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs