openldap-bugs

openldap-bugs@openldap.org

1 participants
20960 discussions

Re: (ITS#8459) security scans causing slapd failure
by michael＠stroeder.com 05 Jul '16

05 Jul '16

duffy.lasker(a)sykes.com wrote: > Full_Name: duffy lasker > Version: slapd version 2.4.40 > OS: CentOS 7 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (184.96.44.7) > > > security scans for kernel segmentation testing causes the slapd service to enter > failed state, whether the test is successful (causes segmentation fault) or > not. > > the ldap server is apparently flooded with STARTTLS events until test end or > successful fault caused. Note that the RHEL/CentOS packages of OpenLDAP are heavily patched and linked against libnss. Hence it's probably better to report this to them. Also there were some fixes in their packages recently. Did you yum update to latest package version? You can also try to reproduce this failure with recent OpenLDAP release built from source and linked to OpenSSL. That would be more important to the OpenLDAP community. Ciao, Michael.

1 0

(ITS#8459) security scans causing slapd failure
by duffy.lasker＠sykes.com 05 Jul '16

05 Jul '16

Full_Name: duffy lasker Version: slapd version 2.4.40 OS: CentOS 7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (184.96.44.7) security scans for kernel segmentation testing causes the slapd service to enter failed state, whether the test is successful (causes segmentation fault) or not. the ldap server is apparently flooded with STARTTLS events until test end or successful fault caused. flooded event: ACCEPT from IP=xxx.xxx.xxx.xxx:yyyyyy (IP=0.0.0.0:389) slapd[1251]: conn=15765834 op=0 STARTTLS slapd[1251]: conn=15765834 op=0 RESULT oid= err=0 text= ACCEPT from IP=xxx.xxx.xxx.xxx:zzzzz (IP=0.0.0.0:6%6) slapd[1251]: conn=15765834 fd=35 closed (TLS negotiation failure) result: kernel: slapd[14239]: segfault at 10 ip 00007f5028f81c65 sp 00007f4ffdffa550 error 4 in libnss3.so[7f5028f3b000+11e000] systemd: slapd.service: main process exited, code=killed, status=11/SEGV systemd: Unit slapd.service entered failed state. systemd: slapd.service failed.

1 0

(ITS#8458) syncrepl ppolicy with LDIF backend fails
by mozo＠mozo.jp 01 Jul '16

01 Jul '16

Full_Name: Moriyoshi Koizumi Version: 2.4.40 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (14.3.144.188) As LDIF backend tries to store the values for the attributes in "prettified" form and the value is transferred verbatim in wire, replication of pwdAttribute (1.3.6.1.4.1.42.2.27.8.1.1) ends up with the following error: > syncrepl_message_to_entry: rid=001 mo cheheck (pwdAttribute: value #0 invalid per syntax) The validation causing the error itself is done in the following part in servers/slapd/modify.c: /* * check that each value is valid per syntax * and pretty if appropriate */ for ( nvals = 0; !BER_BVISNULL( &ml->sml_values[nvals] ); nvals++ ) { struct berval pval; if ( pretty ) { rc = ordered_value_pretty( ad, &ml->sml_values[nvals], &pval, ctx ); } else { rc = ordered_value_validate( ad, &ml->sml_values[nvals], ml->sml_op ); } if( rc != 0 ) { snprintf( textbuf, textlen, "%s: value #%ld invalid per syntax", ml->sml_type.bv_val, (long) nvals ); *text = textbuf; return LDAP_INVALID_SYNTAX; } if( pretty ) { ber_memfree_x( ml->sml_values[nvals].bv_val, ctx ); ml->sml_values[nvals] = pval; } } where pwdAttribute has the corresponding prettifier assigned to its schema (servers/slapd/overlays/ppolicy.c), which eventually is fed with the value in prettified form that will effectively make slap_bv2ad() in attrPretty() fail. { Syntax *syn; MatchingRule *mr; syn = ch_malloc( sizeof( Syntax )); *syn = *ad_pwdAttribute->ad_type->sat_syntax; syn->ssyn_pretty = attrPretty; ad_pwdAttribute->ad_type->sat_syntax = syn; mr = ch_malloc( sizeof( MatchingRule )); *mr = *ad_pwdAttribute->ad_type->sat_equality; mr->smr_normalize = attrNormalize; ad_pwdAttribute->ad_type->sat_equality = mr; } The replication works fine for other such attributes that have the same syntax (OID, 1.3.6.1.4.1.1466.115.121.1.38) like objectClass because those attributes are accompanied by the validators as well as prettifiers which validate the value both in prettified and OID form. For instance, objectClass has the corresponding validator oialalidate() besides the prettifier objectClassPretty().

1 0

(ITS#8457) back-sql: unordered entries combined with pagination gives wrong results
by matthias.hunstock＠tu-ilmenau.de 28 Jun '16

28 Jun '16

Full_Name: Matthias Hunstock Version: git HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/fix-sql-order.patch Submission from: (NULL) (2001:638:904:bf:e544:e758:826b:80ce) Back-SQL does not use any "ORDER BY" statements when querying for ldap entries. If a client uses pagination, there is code that that generates an optimized SQL query with a WHERE clause like " AND ldap_entries.id > x " with x being the highest id from the last paginated search result. As the DBMS gives results in unsorted order, this leads to extremely reduced result sets because it is randomly cut off. The linked patch resolves the issue for us.

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by lorenz＠cloudflare.com 28 Jun '16

28 Jun '16

--001a114aa6f8aae6bb0536563239 Content-Type: text/plain; charset=UTF-8 I did not know that! Thanks for your help. -- Lorenz --001a114aa6f8aae6bb0536563239 Content-Type: text/html; charset=UTF-8 <div dir="ltr">I did not know that! Thanks for your help.<div><br></div><div>--</div><div>Lorenz</div></div> --001a114aa6f8aae6bb0536563239--

1 0

(ITS#8456) slapacl segfaults with mdb if object does not exists
by best＠univention.de 28 Jun '16

28 Jun '16

Full_Name: Florian Best Version: 2.4.42+dfsg-2.210.201511060842 OS: UCS 4.1-2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (82.198.197.8) Running the following command causes a segfault. There is no object for the DN provided with "-b". gdb --args slapacl -D uid=Administator,cn=users,dc=school,dc=local -b uid=doesnotexists,dc=school,dc=local -d0 -u jejectClass:univentionAdminUserSettings Program received signal SIGSEGV, Segmentation fault. 0x00007ffff013fbc8 in mdb_txn_begin () from /usr/lib/ldap/back_mdb.so (gdb) bt #0 0x00007ffff013fbc8 in mdb_txn_begin () from /usr/lib/ldap/back_mdb.so #1 0x00007ffff3a3a8d0 in mdb_opinfo_get () from /usr/lib/ldap/back_mdb.so #2 0x00007ffff013aac6 in mdb_entry_get () from /usr/lib/ldap/back_mdb.so #3 0x0000000000498267 in overlay_entry_get_ov () #4 0x00000000004982e7 in ?? () #5 0x000000000043f236 in fe_acl_group %)%9 #6 0x000000000043cd28 in backend_group () #7 0x0000000000453d9c in slap_access_allowed () #8 0x00000000004980cd in ?? () #9 0x0000000000450d8c in access_allowed_mask () #10 0x000000000049f793 in slapacl () #11 0x00000000004160bf in main ()

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by h.b.furuseth＠usit.uio.no 28 Jun '16

28 Jun '16

On 28. juni 2016 13:06, Lorenz Bauer wrote: > I had a look at your changes, it seems like they obsolete my other bug report > as well. Good, I'll close that. > At the same time, I think you are introducing a double free? In copyfd1, if > memalign (and friends) fails you goto done, which then proceeds to free(). > Same for the case where CreateMutex or CreateFree return an error, since they > happen before allocation, but also goto done. In those cases the code leaves the HANDLE or pointer = NULL. free(NULL) does nothing. The "done:" code omits CloseHandle when the handle is NULL. Hmm. Unless failed posix_memalign() may put garbage in the destination pointer. Probably not, but can tweak the code to be safe just in case. -- Hallvard

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by lorenz＠cloudflare.com 28 Jun '16

28 Jun '16

--94eb2c033d26fe88ce053654a1b2 Content-Type: text/plain; charset=UTF-8 I had a look at your changes, it seems like they obsolete my other bug report as well. At the same time, I think you are introducing a double free? In copyfd1, if memalign (and friends) fails you goto done, which then proceeds to free(). Same for the case where CreateMutex or CreateFree return an error, since they happen before allocation, but also goto done. -- Lorenz On 28 June 2016 at 11:09, Hallvard Breien Furuseth <h.b.furuseth(a)usit.uio.no > wrote: > Looks like a dup of ITS#8209. I've pushed a fix to > mdb.master. Hadn't gotten around to testing it properly. > > -- > Hallvard > --94eb2c033d26fe88ce053654a1b2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I had a look at your changes, it seems like they obsolete = my other bug report as well.<div><br></div><div>At the same time, I think y= ou are introducing a double free? In copyfd1, if memalign (and friends) fai= ls you goto done, which then proceeds to free(). Same for the case where Cr= eateMutex or CreateFree return an error, since they happen before allocatio= n, but also goto done.</div><div><br></div><div>--</div><div>Lorenz</div></= div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On 28 June 20= 16 at 11:09, Hallvard Breien Furuseth <span dir=3D"ltr"><<a href=3D"mail= to:h.b.furuseth@usit.uio.no" target=3D"_blank">h.b.furuseth(a)usit.uio.no</a>= ></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0= 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Looks like a dup of IT= S#8209.=C2=A0 I've pushed a fix to<br> mdb.master.=C2=A0 Hadn't gotten around to testing it properly.<span cla= ss=3D"HOEnZb"><font color=3D"#888888"><br> <br> -- <br> Hallvard<br> </font></span></blockquote></div><br></div> --94eb2c033d26fe88ce053654a1b2--

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by lorenz＠cloudflare.com 28 Jun '16

28 Jun '16

--001a1143e19852a7140536547685 Content-Type: text/plain; charset=UTF-8 Thanks for the fix, and my bad for not finding the bug report. I didn't use the ITS interface properly. -- Lorenz On 28 June 2016 at 11:09, Hallvard Breien Furuseth <h.b.furuseth(a)usit.uio.no > wrote: > Looks like a dup of ITS#8209. I've pushed a fix to > mdb.master. Hadn't gotten around to testing it properly. > > -- > Hallvard > --001a1143e19852a7140536547685 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thanks for the fix, and my bad for not finding the bug rep= ort. I didn't use the ITS interface properly.<div><br></div><div>--</di= v><div>Lorenz<br><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">= On 28 June 2016 at 11:09, Hallvard Breien Furuseth <span dir=3D"ltr"><<a= href=3D"mailto:h.b.furuseth@usit.uio.no" target=3D"_blank">h.b.furuseth@us= it.uio.no</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style= =3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Looks li= ke a dup of ITS#8209.=C2=A0 I've pushed a fix to<br> mdb.master.=C2=A0 Hadn't gotten around to testing it properly.<span cla= ss=3D"HOEnZb"><font color=3D"#888888"><br> <br> -- <br> Hallvard<br> </font></span></blockquote></div><br></div></div></div> --001a1143e19852a7140536547685--

1 0

Re: (ITS#8452) LMDB: mdb_env_copyfd2 can deadlock due to missing mdb_env_cthr_toggle check
by h.b.furuseth＠usit.uio.no 28 Jun '16

28 Jun '16

Looks like a dup of ITS#8209. I've pushed a fix to mdb.master. Hadn't gotten around to testing it properly. -- Hallvard

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs