openldap-bugs

openldap-bugs@openldap.org

1 participants
20960 discussions

(ITS#8581) slapd-meta backend SSL negociation timeout
by louis.chanouha＠univ-toulouse.fr 04 Feb '17

04 Feb '17

Full_Name: Louis Chanouha Version: 2.4.40 OS: Debian 8 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (90.76.56.40) Hello, I experience some problems with slapd-meta with ldaps backend. gnuTLS (or openssl) negociation timeout seems not to be handled, and i can't find any reference to modify this timeout on docs. My server becames unresponsive (too many connexion slots) when a ssl-secured backend server time out after TCP connexion establishment. To reproduce the error, i have an meta directory configured like this: database meta suffix "dc=localauth" rootdn "%n=Manager,dc=localauth" rootpw XXX uri "ldaps://localhost:666/ou=UT,dc=localauth" lastmod off suffixmassage "ou=UT,dc=localauth" "ou=people,dc=example,dc=fr" timeout 1 conn-ttl 1 network-timeout 1 And i launch a netcat to listen to the 666 port: nc -l -p 666 Then, this command never time out: ldapwhoami -H ldap://YYYY:9009 -D uid=me,ou=UT,dc=localauth -W Error does not happen when no ssl used ("timeout 1" option works well) OS: Debian 8 Jessie x64 slapd: 2.4.40+dfsg-1+deb8u2 gnutls: 3.3.8-6+deb8u4 Sorry for my english, and thanks for the help, Regards, Louis Chanouha University of Toulouse

1 0

(ITS#8580) force openssl use the server side cipher preference
by sca+openldap＠andreasschulze.de 03 Feb '17

03 Feb '17

Full_Name: Andreas Schulze Version: RE24 OS: Linux URL: ftp://ftp.openldap.org/incoming/andreas-schulze-20170203.patch Submission from: (NULL) (2001:a60:f0b4:e502:758b:b0b2:3fc:f121) In OpenSSL client and Server may select a cipher. The patch force the cipher preference is force by the server and not by the client, which is a openssl default Let the server select ciphers is best practice for webservers for example.

1 0

(ITS#8579) LMDB: me_fd should be O_CLOEXEC on POSIX systems
by lmb＠cloudflare.com 03 Feb '17

03 Feb '17

Full_Name: Lorenz Bauer Version: OS: Linux URL: Submission from: (NULL) (2a06:98c0:1000:8200:18fd:e772:495e:6163) This is in some ways a follow up to ITS#8505. In the issue I argued that LMDB did not deal well with fork/exec. Hallvard committed a fix in 04acac634a7b276332e2. I think the fix still has one major weakness: me_fd does not have O_CLOEXEC set. Now, Hallvard omitted this change on purpose. mdb_env_get_fd() exposes me_fd to the user, so there could conceivably be client code out there which expects the fd to persist across exec(). (Please correct my if I misunderstood your argument.) I believe that the correct action is to set O_CLOEXEC on me_fd by default, and break such client code. 1. Using mdb_env_get_fd this way is Undefined Behaviour (according to the doc) Before ITS#8505, the documentation made it sound like ANY use after fork() / exec() is disallowed. At the same time, mdb_env_get_fd made no mention / promises wrt exec() behaviour. Adopting O_CLOEXEC in my opinion does not violate the API set out so far. We can, in the opposite, clarify what is acceptable use (as Hallvard already has done). 2. mdb_env_get_fd has inconsistent semantics across OSs When creating file handles on Windows we pass NULL as the lpSecurityAttributes argument to CreateFileW: If this parameter is NULL, the handle returned by CreateFile cannot be inherited by any child processes the application may create [...] me_fd already has O_CLOEXEC on Windows. 3. Manually closing me_fd after fork() is not possible in all environments Hallvard suggests calling fork(), close(mdb_env_get_fd()) and then exec() for users which do not want to leak me_fd to child processes. We use LMDB from the Go platform, which does not expose fork and exec separately (due to the well-known pitfalls they have). We can't use Hallvard's suggestion therefore. 4. me_fd can still be passed around by dup()ing the handle If there are legitimate uses of passing the handle around, users can explicitly dup the handle and then pass it on to child processes. I hope my arguments are convincing enough to make the change before the next release. The benefits are * Consistent semantics between OS * (In my view) saner defaults * and a solution which works well across environments. The downside is that we might break unknown client code. I can'c come up with a use case of passing me_fd to children, so I suspect the risk is low. The patch itself is trivial, and I'm happy to contribute it if desired. Lorenz

1 0

(ITS#8578) remove unused-variables in RE24 testing call (2.4.45)
by sca+openldap＠andreasschulze.de 01 Feb '17

01 Feb '17

Full_Name: A. Schulze Version: RE24 testing call (2.4.45) OS: URL: ftp://ftp.openldap.org/incoming/andreas-schulze-20170201.patch Submission from: (NULL) (2001:a60:f0b4:e502:758b:b0b2:3fc:f121) the patch remove variables that are declared but unused.

1 0

(ITS#8577) Accesslog overlay hangs slapd depending on module loading order
by mj＠netauth.com 01 Feb '17

01 Feb '17

Full_Name: Mike Jackson Version: 2.4.44 OS: Oracle Linux Server release 7.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.157.185.162) Same issue as Stroeder mentioned here: http://www.openldap.org/lists/openldap-bugs/201111/msg00027.html If accesslog.la is loaded before syncprov.la, slapd will stop accepting connections immediately after accesslog overlay is added. olcModuleLoad: {0}ppolicy.la olcModuleLoad: {1}auditlog.la olcModuleLoad: {2}back_ldap.la olcModuleLoad: {3}unique.la olcModuleLoad: {4}accesslog.la olcModuleLoad: {5}syncprov.la ldapadd -f dn: oDatatabase={4}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {4}mdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=log olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart olcDbMaxSize: 1073741824 olcDbMode: 0600 olcAccess: {0}to * by dn.children="ou=global-admins,ou=admin-users,dc=foo,dc=net" read dn: olcOverlay=accesslog,olcDatabase={4}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olccccessLogDB<ncn=log olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 7+00:00 1+00:00

1 0

(ITS#8576) Broken LDAP_TAILQ_ macros
by hyc＠openldap.org 01 Feb '17

01 Feb '17

Full_Name: Howard Chu Version: HEAD etc OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.235.15.200) Submitted by: hyc In commit 8ee824832844c16d4199f3aacd8b1d613933a7d5 we have "LDAP_TAILQ fix" but no explanation of what was broken. In particular though, the LDAP_TAILQ_PREV macro is now broken. It checks for foo == LDAP_TAILQ_FIRST(head) which becomes foo == (head)->tqh_first but the initializer actually used foo = &(head).tqh_first so this comparison will always be false. I don't see any clear reason why these were changed from the originals. I'm inclined to revert the change. Reverting will affect a few uses of LDAP_TAILQ_LAST in back-ldap and back-meta but the other affected macros appear to be unused in our source tree. Tripped over this while attempting to use LDAP_TAILQ_PREV in new code.

1 0

(ITS#8575) Argon2 Password hashing contrib module
by simon＠slevermann.de 26 Jan '17

26 Jan '17

Full_Name: Simon Levermann Version: OS: URL: ftp://ftp.openldap.org/incoming/simon-levermann-170126.patch Submission from: (NULL) (2001:638:708:f002:deab:9ae4:7f07:d350) This patch adds a password hashing module for the argon2 function to the contrib/slapd-modules/passwd/ modules. Argon2 is a relatively new hash function which has won the Password Hashing Competition (https://password-hashing.net) The attached patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Simon Levermann simon(a)slevermann.de. I have not assigned rights and/or interest in this work to any party. I, Simon Levermann, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#8574) bconfig support for DNs that need escaping
by okuznik＠symas.com 25 Jan '17

25 Jan '17

Full_Name: Ondrej Kuznik Version: master OS: URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170125-Deal-with-rDN-correc… Submission from: (NULL) (151.228.185.198) When an rdn under cn=config needs escaping, incorrect value gets passed to the attribute and, if the attribute is single-value, the entry is rejected by entry_naming_check(). Patch against master is attached.

1 0

(ITS#8573) ldap* tools should be able to function w/o a conf file
by quanah＠openldap.org 24 Jan '17

24 Jan '17

Full_Name: Quanah Gibson-Mount Version: 2.4.44 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.26) Right now, it is impossible to configure the ldap* command line tools so that they function in major circumstances w/o also having a configuration file (I.e., ldap.conf, .ldaprc, etc). For example, the ability to use startTLS with LDAP requires such a file so that the CA file and/or cert path for the tool can be defined. The "-o" option should be expanded to cover additional configuration parameters from the conf file, as has already been done with the network timeout parameter.

1 0

Re: (ITS#8572) FOR INFO ONLY: SASL SCRAM-SHA-1 authz may fail incorrectly
by quanah＠symas.com 19 Jan '17

19 Jan '17

--On Thursday, January 19, 2017 8:55 AM +0000 william.b.clay(a)acm.org wrote: > Full_Name: Bill Clay > Version: 2.4.44 > OS: Debian/GNU Linux 7.8 (Wheezy) > URL: > Submission from: (NULL) (79.12.44.250) Hi Bill, I appreciate that you are attempting to be helpful. However, the ITS system is only for reporting bugs occuring in OpenLDAP as clearly noted on the ITS submission form. If you want to provide informational updates, they would probably best go to the openldap-technical mailing list. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs