openldap-bugs

openldap-bugs@openldap.org

1 participants
21002 discussions

(ITS#8239) back-meta crashes after deleting a rewrite rule
by ryan＠openldap.org 07 Sep '15

07 Sep '15

Full_Name: Ryan Tandy Version: master OS: Debian URL: Submission from: (NULL) (24.68.37.4) Submitted by: ryan Deleting rewrite rules from a back-meta target is not implemented correctly. Deleting a single value (vs the entire attribute) isn't checked for, the entire rewrite_info and list of saved rules is always freed. Then meta_back_conn_destroy doesn't notice the rewrite_session has already been cleaned up, and tries to free it again.

1 0

Re: (ITS#7964) overlay rwm escape issue with more the 9 rules / rewrite statements
by Ryan Tandy 06 Sep '15

06 Sep '15

Uwe Werler wrote: > If I have rewrite rules like this: > > 23 olcOverlay={1}rwm,olcDatabase={3}hdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcRwmConfig > olcOverlay: {1}rwm > olcRwmRewrite: {0}rwm-rewriteEngine on > olcRwmRewrite: {1}rwm-rewriteContext searchFilter > olcRwmRewrite: {2}rwm-rewriteRule "(.*\$)uid=sapr3(\$.*)" "$1d%d=dlmsapr3$2" > olcRwmRewrite: {3}rwm-rewriteRule "(.*\$)uid=sdb(\$.*)" "$1uid=sdb$2" > olcRwmRewrite: {4}rwm-rewriteRule > "(.*\$)uid=sapadm(\$.*)" "$1uid=dlmsapadm$2" > olcRwmRewrite: {5}rwm-rewriteRule "(.*\$)uid=sapmnt(\$.*)" "$1uid=sapmnt$2" > olcRwmRewrite: {6}m-m-rewriteRule "(.*\$)uid=[a-z0-9]{3}adm(\$.*)" > "$1uid=dlmsidadm$2" > olcRwmRewrite: {7}rwm-rewriteRule "(.*\$)uid=sqd[a-z0-9]{3}(\$.*)" > "$1uid=dlmsqdsid$2" > olcRwmRewrite: {8}rwm-rewriteRule "(.*\$)uid=ora[a-z0-9]{3}(\$.*)" > "$1uid=dlmorasid$2" > olcRwmRewrite: {9}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}(\$.*)" > "$1uid=dlmsapr3$2" > olcRwmRewrite: {10}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}db(\$.*)" > "$1uid=dlmsapr3db$2" > olcRwmRewrite: {11}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}(\$.*)" > "$1uid=dlmdb2sid$2" > olcRwmRewrite: {12}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}ap(\$.*)" > "$1uid=dlmdb2sid$2" > > then the ninth rule / statent f failes to escape. In this example ora*** get's > not correctly rewritten d dlmora***: See loglevel trace: > > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapr3($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sdb($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapadm($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapmnt($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=[a-z0-9]{3}adm($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sqd[a-z0-9]{3}($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*\$)uid=ora[a-z0-9]{3}(\$.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sap[a-z0-9]{3}($.2929' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sap[a-z0-9]{3}db($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=db2[a-z0-9]{3}($.*)' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > 543b711d ==> rewrite_rule_apply rule='(.*$)uid=db2[a-z0-9]{3}a28%5$.*' > string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' > [1 pass(es)] > > If I insert a dummy statement like this: > > olcRwmRewrite: {0}rwm-rewriteEngine on > olcRwmRewrite: {1}rwm-rewriteContext searchFilter > olcRwmRewrite: {2}rwm-rewriteRule "(.*\$)uid=sapr3(\$.*)" "$1uid=dlmsapr3$2" > olcRwmRewrite: {3}rwm-rewriteRule "(.*\$)uid=sdb(\$.*)" "$1uid=sdb$2" > olcRwmRewrite: {4}rwm-rewriteRule "(.*\$)uid=sapadm(\$.*)" > "$1uid=dlmsapadm$2" > olcRwmRewrite: {5}rwm-rewriteRule "(.*\$)uid=sapmnt(\$.*)" "$1uid=sapmnt$2" > olcRwmRewrite: {6}rwm-rewriteRule "(.*\$)uid=[a-z0-9]{3}adm(\$.*)" > "$1uid=dlmsidadm$2" > olcRwmRewrite: {7}rwm-rewriteRule "(.*\$)uid=sqd[a-z0-9]{3}(\$.*)" E E "$1uid=dlmsqdsid$2" > olcRwmRewrite: {8}rwm-rewriteRule "(.*\$)uid=ora[a-z0-9]{3}(\$.*)" > "$1uid=dlmorasid$2" > olcRwmRewrite: {9}rwm-rewriteContext placeHolder alias searchFilter > olcRwmRewrite: {10}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}(\C%C).*)" > "$1uid=dlmsapr3$2" > olcRwmRewrite: {11}rwm-rewriteRule "(.*\\()uid=sap[a-z0-9]{3}db(\$.*)" > "$1uid=dlmsapr3db$2" > olcRwmRewrite: {12}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}(\$.*)" > "$1uid=dlmdb2sid$2" > olcRwmRewrite: {13}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}ap(\$.*)" > "$1uid=dlmdb2sid$2" > > then the escapes are working properly. > > Sometimes this occurs with the last rule too. It seems to me that this happens with the rule most recently inserted. If slapd was recently restarted, this would be the last rule in the list. The parsing rules are slightly different for slapd.conf vs ldif. Notable is that ldif parsing does not perform escape processing. So this slapd.conf line: rwm-rewriteRule "(.*\$)uid=sapr3(\$.*)" "$1uid=dlmsapr3$2" should actually correspond to this cn=config attribute: olcRwmRewrite: rwm-rewriteRule "(.*$)uid=sapr3($.*)" "$1uid=dlmsapr3$2" This is exactly the output of conversion with, for example, slaptest -f slapd.conf -F slapd.d. When a new rwm rule is added, existing rules are reloaded. The bug is that the existing rules were being passed through the slapd.conf line processor, which dropped backslashes on the way, while the rule actually being inserted was passed to the rewrite routines untouched. Fixed in git master by removing the extra escaping on insert. You will have to adjust your rules to use a single backslash instead of two. (bonus: rwm is needlessly reloading existing rules when appending with valx >= last, while it could be

1 0

(ITS#8238) mdb_cursor_put() returns inconsistent xcursor
by h.b.furuseth＠usit.uio.no 06 Sep '15

06 Sep '15

Full_Name: Hallvard B Furuseth Version: LMDB 0.9.16 OS: Linux x86_64 URL: ftp://ftp.openldap.org/incoming/Hallvard-Furuseth-150906.diff Submission from: (NULL) (81.191.45.5) Submitted by: hallvard Replace printf("oops!\n") with mdb_cassert(mc, 0) in cursor_chk(). Add if (!rc && mc->mc_xcursor) mdb_cursor_chk(&mc->mc_xcursor->mx_cursor); just before mdb_cursor_put() returns rc above "bad_sub:". Diff for this enclosed. $ make -s clean test CPPFLAGS="-DMDB_DEBUG" $ ./mtest4 mdb.c:1500: Assertion '0' failed in mdb_cursor_chk()

1 0

Re: (ITS#8237) Crash with MDB_MAXKEYSIZE=1500
by h.b.furuseth＠usit.uio.no 06 Sep '15

06 Sep '15

I wrote: > Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root(): The paste got munged. Test program at <ftp://ftp.openldap.org/incoming/Hallvard-Furuseth-150906.c>.

1 0

(ITS#8237) Crash with MDB_MAXKEYSIZE=1500
by h.b.furuseth＠usit.uio.no 06 Sep '15

06 Sep '15

Full_Name: Hallvard B Furuseth Version: LMDB 0.9.10-0.9.15 OS: Linux x86_64 URL: Submission from: (NULL) (81.191.45.5) Submitted by: hallvard Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root(): #define MDB_MAXKEYSIZE 1500 #include "mdb.c" #include "midl.c" int main(void) { MDB_dbi dbi; MDB_env *env; MDB_txn *txn; int i, rc =DMDB_SUCCESS; mdb_env_create(&env); mdb_env_open(env, "./testdb", MDB_WRITEMAP, 0664); mdb_txn_begin(env, NULL, 0, &txn); mdb_dbi_open(txn, NULL, 0, &dbi); for (i = 0; i < 6 && !rc; i++) { static char buf[1600] = "340215"; DB_v_val key = {1500, buf+i}, data = {500, buf}; mdb_put(txn, dbi, &key, &data, 0); } mdb_txn_abort(txn); mdb_env_close(env); return rc; } Broken by 34459e05856619e8 "ITS#7589 another mdb_page_split fix".

1 0

Re: (ITS#8230) [new PATCHes] totp: bug fixes and improvements
by peter＠adpm.de 06 Sep '15

06 Sep '15

Hi, Please have a look at the improved patch series in https://github.com/marschap/openldap/commits/contrib-totp3 and https://github.com/marschap/openldap/commits/contrib-totp4 They try to address the issues in the previous versions Changes: * contrib/passwd/totp: fix the big-endian case, support 32-bit archs Use memcpy for the WORDS_BIGENDIAN case [much simpler] Use uint64_t for same results in 32- and 64-bit cases * contrib/passwd/totp: support compiling using nettle Fix the botched previous patch. The two branches differ only in that patch, giving the following alternatives: - contrib-totp3 continues to use the HMAC_... macros It still requires the #if...#else...#endif to harmonize the setup in do_hmac() - contrib-totp4 gets rid of the HMAC_... macros It uses the different implementations directly in do_hmac() Of course separated by #if...#else..#endif Functionally both patches are equivalent: in my tests they yield the same results for OpenSSL and GnuTLS. Best PEter -- Peter Marschall peter(a)adpm.de

1 0

Re: (ITS#7889) rwm overlay causes incorrect acl parsing
by ryan＠nardis.ca 05 Sep '15

05 Sep '15

michael(a)stroeder.com wrote: >But could you please check whether this setting helps: > >rwm-drop-unrequested-attrs no It does. This is another case of ITS#6057; the ACL filter can only be evaluated if the filter attribute is included in those passed through by rwm, otherwise it is just skipped. The larger issue (should ACL evaluation assume the whole entry is available?) seems to still be unaddressed. I don't understand yet why rwm filters the attributes on its own by default, but I'm sure there's a reason. alexoz66(a)gmail.com wrote: >modifying entry "olcOverlay={0}rwm,olcDatabase={1}mdb,cn=config" >ldap_modify: Object class violation (65) > additional info: attribute 'olcRwmDropUnrequested' not allowed > >Looking at the schema it seems that the attribute olcRwmDropUnrequested >is not part of the olcRwmConfig object class (or any other object class >for that matter). This is fixed in git master now.

1 0

Re: (ITS#8230) [new PATCH] totp: bug fixes and improvements
by peter＠adpm.de 05 Sep '15

05 Sep '15

Hi, Please have a look at the improved patch series in https://github.com/marschap/openldap/commits/contrib-totp2 It tries to address all the issues highlighted on the first version. https://github.com/marschap/openldap/commit/e4e1045f59368af8d15172ad22fcc0f… contrib/passwd/totp: flexibilize decoding In function totp_b32_pton() - allow lowercase characters in encoded string too - allow padding to be omitted (totally, not only parts) With this added flexibility we can make use of keys encoded by other Base32-encoding implementations. In function chk_totp() determine the space required to hold the decoded key by calling totp_b32_pton() with a NULL argument for the target. Changes to previous version: - toupper()'s argument guarded with a cast to (unsigned char) - added rationale to commit message https://github.com/marschap/openldap/commit/edfa2b0fb3238ca9f231fa75bd452b4… contrib/passwd/totp: fix the big-endian case, support 32-bit archs - reverse tval in the WORDS_BIGENDIAN case before converting it to a string - use uint64_t for tval to have it correctly sized on 32-bit archs too - avoid magic number when converting tval to a string Changes to previous version: - complete rewrite https://github.com/marschap/openldap/commit/24007f02cebb0b7f801288b02d0ac8c… contrib/passwd/totp: fix decoding when padding is used In totp_b32_pton(), correctly count the number of '=' padding chars at the end of the base-32 encoded string: don't count the first padding char char twice. Note: '*str++' evaluates *str first and increases str later! Changes to previous version: - commit message only https://github.com/marschap/openldap/commit/435619ccd8be1b62f86db67643bca77… contrib/passwd/totp: support compiling using nettle Changes to previous version: - rewrite, concentrating the #ifdef's as much as possible Best Peter -- Peter Marschall peter(a)adpm.de

1 0

(ITS#8236) can't add keys to olc config for SSL
by michael.aldridge＠utdallas.edu 02 Sep '15

02 Sep '15

Full_Name: Michael Aldridge Version: @(#) $OpenLDAP: slapd (Ubuntu) (Aug 6 1515 23:14:45) $ buildd@lgw01-54:/build/openldap-VbUBZB/openldap-2.4.41+dfsg/debian/build/servers/slapd OS: Ubuntu 14.04.3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (129.110.157.13) Attempting to add the olc configuration directives for SSL returns a ldap_modify: Other (e.g., implementation specific) error (80). The certs check out and everything make sense from an issuing standpoint, slapd just won't accept the cert configuration. I can provide additional logs or debug information upon request.

1 0

(ITS#8235) compiler warnings in smbk5pwd.c with nettle
by ryan＠openldap.org 02 Sep '15

02 Sep '15

Full_Name: Ryan Tandy Version: master OS: Debian URL: Submission from: (NULL) (24.68.37.4) Submitted by: ryan smbk5pwd.c: In function 'lmhash': smbk5pwd.c:206:21: warning: passing argument 2 of 'nettle_des_set_key' from incompatible pointer type [-Wincompatible-pointer-types] des_set_key( &ctx, &key ); ^AIAIn file included from smbk5pwd.c:69:0: /usr/include/nettle/des.h:76:1: note: expected 'const uint8_t * {aka const unsigned char *}' but argument is of type 'unsigned char (*)[8]' des_set_key(struct des_ctx *ctx, const uint8_t *key); ^ (and several more) The openssl and gcrypt versions both used "&key" as well. It's correct for openssl, which takes a DES_cblock *. It's ambiguous for gcrypt, which takes a void *. It's wrong for nettle, which expects an unsigned char *. This is not a functional problem, since in all cases the pointer points at the beginning of the array. Fixing the warning does not change the output. smbk5pwd.c: In function 'nthash': smbk5pwd.c:249:36: warning: pointer targets in passing argument 3 of 'nettle_md4_update' differ in signedness [-Wpointer-sign] md4_update( &ctx, passwd->bv_len, passwd->bv_val ); ^ In file included from smbk5pwd.c:70:0: /usr/include/nettle/md4.h:69:1: note: expected 'const uint8_t * {aka const unsigned char *}' but argument is of type 'char *' md4_update(struct md4_ctx *ctx, ^ openssl and gcrypt both use void * here, nettle needs a cast (which should be safe). The remaining warnings are not nettle-specific. smbk5pwd.c: In function 'smbk5pwd_cf_func': smbk5pwd.c:915:14: warning: variable 'db' set but not used [-Wunused-but-set-variable] BackendDB db = *c->be; ^ Added in 29fab9c, apparently never used. Looks like cruft to me. Most likely didn't generate a warning with gcc prior to 4.6, due to the assignment just below. smbk5pwd.c: In function 'smbk5pwd_modules_init': smbk5pwd.c:968:2: warning: variable 'dummy_ad' set but not used [-Wunused-but-set-variable] dummy_ad; ^ The unused-but-set-variable warning is new in gcc 4.6 and there is a different no-op trick to suppress it in a portable way.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs