A fix for that is at
ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20150408-ITS-8057-uniqueness-…
The above patch is derived from OpenLDAP Software. All of the
modifications to OpenLDAP Software represented in the above patches were
developed by Ondrej Kuznik <ondra(a)mistotebe.net>. I have not assigned
rights and/or interest in this work to any party.
I, Ondrej Kuznik, hereby place the above modifications to OpenLDAP
Software (and only these modifications) into the public domain. Hence,
these modifications may be freely used and/or redistributed for any
purpose with or without attribution and/or other notice
Full_Name: Matt Dainty
Version: 2.4.40
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (173.38.209.6)
Documentation makes reference to `tls_ciphersuite=` option for
olcSyncrepl/syncrepl settings however I got an error when trying to use it.
On a hunch, I tried using `tls_cipher_suite=` instead matching the style of the
equivalent ldap.conf setting and this worked.
Confirmed what the code was doing here:
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl…
slapd-config(5), slapd.conf(5) are affected as well as the admin guide,
potentially slapd-meta(5) and slapd-ldap(5) too if those backends reuse the same
config code.
--On Tuesday, April 07, 2015 11:12 AM +0000 rolandsytt(a)yahoo.com wrote:
> Full_Name: Roland S.tt
> Version: 2.4.40
> OS: CentOS Linux release 7.0.1406
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (194.126.102.178)
>
>
> Slapd memory usage increases endlessly. It's same in 2.4.39 (from CentOS 7
> repository). During some simple activity (e.g ldapsearch) memory usage
> increases, but it's not decreases after the activity end.
You're likely seeing the numerous issues known to occur when using glibc as
the default allocator. OpenLDAP is routinely profiled for memory leaks,
and there are none currently known to exist. It is always strongly advised
to use a different memory allocator with OpenLDAP, such as tcmalloc.
For example, I wrap slapd with:
quanah@zre-ldap001:~/p4/zimbra/main/ThirdParty/openldap/patches$ more
../../../ZimbraServer/src/libexec/zmslapd
#!/bin/bash
#
# ***** BEGIN LICENSE BLOCK *****
# Zimbra Collaboration Suite Server
# Copyright (C) 2007, 2008, 2009, 2010, 2012, 2013, 2014 Zimbra, Inc.
#
# This program is free software: you can redistribute it and/or modify it
under
# the terms of the GNU General Public License as published by the Free
Software Foundation,
# version 2 of the License.
#
# This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY;
# without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
# You should have received a copy of the GNU General Public License along
with this program.
# If not, see <http://www.gnu.org/licenses/>.
# ***** END LICENSE BLOCK *****
#
ulimit -n 32768
ulimit -c unlimited
ulimit -v unlimited
export LD_PRELOAD=/opt/zimbra/tcmalloc/lib/libtcmalloc_minimal.so
exec /opt/zimbra/openldap/sbin/slapd "$@"
As there is no actionable bug report here, this bug will be closed.
--Quanah
--
Quanah Gibson-Mount
Platform Architect
Zimbra, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
Full_Name: Roland S.tt
Version: 2.4.40
OS: CentOS Linux release 7.0.1406
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (194.126.102.178)
Slapd memory usage increases endlessly. It's same in 2.4.39 (from CentOS 7
repository). During some simple activity (e.g ldapsearch) memory usage
increases, but it's not decreases after the activity end.
Loaded modules:D0D
olcModuleLoad: {0}dynlist.la
olcModuleLoad: {1}ppolicy.la
olcModuleLoad: {2}syncprov.la
olcModuleLoad: {3}auditlog.la
olcModuleLoad: {4}memberof.la
olcDatabase: {1}bdb
Number of entries in DB: ~2000
How to reproduce
Install CentOS 7 openldap-servers package or build Openldap 2.4.40 RPM using
openldap.spec from CentOS 7 openldap-servers source package. Then do numerous
ldap searches from multiple hosts.
--On Tuesday, April 07, 2015 4:01 AM +0000 quanah(a)zimbra.com wrote:
> --On Saturday, February 14, 2015 6:16 PM +0000 ondra(a)mistotebe.net wrote:
>
>> Full_Name: Ondrej Kuznik
>> Version: master
>> OS:
>> URL:
>> ftp://ftp.openldap.org/pub/Ondrej-Kuznik-20150214-ITS-8057-uniqueness-ACL
>> .patch Submission from: (NULL) (86.177.93.243)
>>
>>
>> This is caused by my fix for #6641. Since anyone can specify the
>> manageDSAit control on an operation it is trivial to bypass the
>> uniqueness check as it stands.
>
> This "fix" causes OpenLDAP to crash during replication:
>
> <http://fpaste.org/207817/70741142/>
Also crashes when using ldapmodify -M or ldapmodrdn -M
--Quanah
--
Quanah Gibson-Mount
Platform Architect
Zimbra, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
--On Saturday, February 14, 2015 6:16 PM +0000 ondra(a)mistotebe.net wrote:
> Full_Name: Ondrej Kuznik
> Version: master
> OS:
> URL:
> ftp://ftp.openldap.org/pub/Ondrej-Kuznik-20150214-ITS-8057-uniqueness-ACL
> .patch Submission from: (NULL) (86.177.93.243)
>
>
> This is caused by my fix for #6641. Since anyone can specify the
> manageDSAit control on an operation it is trivial to bypass the
> uniqueness check as it stands.
This "fix" causes OpenLDAP to crash during replication:
<http://fpaste.org/207817/70741142/>
--Quanah
--
Quanah Gibson-Mount
Platform Architect
Zimbra, Inc.
--------------------
Zimbra :: the leader in open source messaging and collaboration
Full_Name: Ryan Tandy
Version: master, 2.4
OS: Debian
URL:
Submission from: (NULL) (24.68.37.4)
updating the copied nss-pam-ldapd files:
ftp://ftp.openldap.org/incoming/20150405_rtandy_nssov-update-nss-pam-ldapd-…
updating nssov for those changes, see commit msg for details:
ftp://ftp.openldap.org/incoming/20150405_rtandy_nssov-update-to-protocol-ve…
while I'm in the code anyway, cleaning up a few compiler warnings (that were
already there, I didn't introduce them :P). Cosmetic stuff: unused variables,
return-type (void/non-void) mismatches, a couple of undeclared prototypes.
ftp://ftp.openldap.org/incoming/20150405_rtandy_nssov-clean-up-some-compile…
Please note, the protocol change breaks backwards compat with older versions of
the client libraries (per nss-pam-ldapd/README).
Tested on Linux. No idea about Solaris etc, sorry.
The DN field was removed from the pam protocol, so uid lookup happens on every
connection now. I couldn't think of a safe way to avoid that; suggestions
welcome.
--
(the following statements apply to patches 2 and 3 only; patch 1 is copied from
work by Arthur de Jong, licensed LGPLv2.1)
The attached patch files are derived from OpenLDAP Software. All of the
modifications to OpenLDAP Software represented in the preceding patches were
developed by Ryan Tandy <ryan(a)nardis.ca>. I have not assigned rights and/or
interest in this work to any party.
I, Ryan Tandy, hereby place the preceding modifications to OpenLDAP Software
(and only these modifications) into the public domain. Hence, these
modifications may be freely used and/or redistributed for any purpose with or
without attribution and/or other notice.
--001a113513b628687b0512e2d415
Content-Type: text/plain; charset=UTF-8
I haven't compared the same build with and with out the fixes for
ITS#7961,#7987, however I can confirm that under the same environment, RE24
(scheduled for 2.4.41) remains stable while 2.4.40 crashes from time to
time. Actually I would strongly suggest upgrading to 2.4.41 when available.
On Sun, Mar 22, 2015 at 9:36 PM, Howard Chu <hyc(a)symas.com> wrote:
> Nikos Voutsinas wrote:
>
>> I am in the process of doing so. Do you have in mind a specific
>> commit/fix in REL_EN that might have solved this; That would help me
>> reproduce the initial problem (in 2.4.40) and confirm the fix (in
>> REL_ENG).
>>
>
> Most likely 9a72292ac134f80c1befe8102dee1160e57a92ec
>
>>
>> For start I will try to upgrade to REL_ENG the same system from which I
>> got the debug log, to see if that would help recover (although I have no
>> great hopes).
>>
>> On Sun, Mar 22, 2015 at 12:39 AM, Howard Chu <hyc(a)symas.com
>> <mailto:hyc@symas.com>> wrote:
>>
>> nvoutsin(a)gmail.com <mailto:nvoutsin@gmail.com> wrote:
>>
>> Full_Name: Nikos Voutsinas
>> Version: 2.4.40
>> OS: Debian
>> URL:
>> ftp://ftp.openldap.org/__incoming/NikosVoutsinas_20-03-
>> __2015_mdb_assertion.id2entry
>> <ftp://ftp.openldap.org/incoming/NikosVoutsinas_20-03-
>> 2015_mdb_assertion.id2entry>
>> Submission from: (NULL) (5.55.167.101)
>>
>>
>> slapd with an mdb backend, after some time of normal operation,
>> may reach into a
>> situation where you can almost predictably crash it, with a
>> simple modify
>> operation.
>>
>>
>> Please test RE24 and see if you can still reproduce this issue.
>>
>> --
>> -- Howard Chu
>> CTO, Symas Corp. http://www.symas.com
>> Director, Highland Sun http://highlandsun.com/hyc/
>> Chief Architect, OpenLDAP http://www.openldap.org/__project/
>> <http://www.openldap.org/project/>
>>
>>
>>
>
> --
> -- Howard Chu
> CTO, Symas Corp. http://www.symas.com
> Director, Highland Sun http://highlandsun.com/hyc/
> Chief Architect, OpenLDAP http://www.openldap.org/project/
>
--001a113513b628687b0512e2d415
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">I haven't compared the same build with and with out th=
e fixes for ITS#7961,#7987, however I can confirm that under the same envir=
onment, RE24 (scheduled for 2.4.41) remains stable while 2.4.40 crashes fro=
m time to time. Actually I would strongly suggest upgrading to 2.4.41 when =
available.<br></div><div class=3D"gmail_extra"><br><div class=3D"gmail_quot=
e">On Sun, Mar 22, 2015 at 9:36 PM, Howard Chu <span dir=3D"ltr"><<a hre=
f=3D"mailto:hyc@symas.com" target=3D"_blank">hyc(a)symas.com</a>></span> w=
rote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex"><span class=3D"">Nikos Voutsinas wr=
ote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
I am in the process of doing so. Do you have in mind a specific<br>
commit/fix in REL_EN that might have solved this; That would help me<br>
reproduce the initial problem (in 2.4.40) and confirm the fix (in REL_ENG).=
<br>
</blockquote>
<br></span>
Most likely 9a72292ac134f80c1befe8102dee11<u></u>60e57a92ec<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><span class=3D"">
<br>
For start I will try to upgrade to REL_ENG the same system from which I<br>
got the debug log, to see if that would help recover (although I have no<br=
>
great hopes).<br>
<br>
On Sun, Mar 22, 2015 at 12:39 AM, Howard Chu <<a href=3D"mailto:hyc@syma=
s.com" target=3D"_blank">hyc(a)symas.com</a><br></span>
<mailto:<a href=3D"mailto:hyc@symas.com" target=3D"_blank">hyc(a)symas.com=
</a>>> wrote:<span class=3D""><br>
<br>
=C2=A0 =C2=A0 <a href=3D"mailto:nvoutsin@gmail.com" target=3D"_blank">nvout=
sin(a)gmail.com</a> <mailto:<a href=3D"mailto:nvoutsin@gmail.com" target=
=3D"_blank">nvoutsin(a)gmail.com</a>> wrote:<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Full_Name: Nikos Voutsinas<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Version: 2.4.40<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 OS: Debian<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 URL:<br></span>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"ftp://ftp.openldap.org/__incoming/Ni=
kosVoutsinas_20-03-__2015_mdb_assertion.id2entry" target=3D"_blank">ftp://f=
tp.openldap.org/__<u></u>incoming/NikosVoutsinas_20-03-<u></u>__2015_mdb_as=
sertion.id2entry</a><span class=3D""><br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <<a href=3D"ftp://ftp.openldap.org/incoming/=
NikosVoutsinas_20-03-2015_mdb_assertion.id2entry" target=3D"_blank">ftp://f=
tp.openldap.org/<u></u>incoming/NikosVoutsinas_20-03-<u></u>2015_mdb_assert=
ion.id2entry</a>><br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Submission from: (NULL) (5.55.167.101)<br>
<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 slapd with an mdb backend, after some time of n=
ormal operation,<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 may reach into a<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 situation where you can almost predictably cras=
h it, with a<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 simple modify<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 operation.<br>
<br>
<br>
=C2=A0 =C2=A0 Please test RE24 and see if you can still reproduce this issu=
e.<br>
<br>
=C2=A0 =C2=A0 --<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0-- Howard Chu<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0CTO, Symas Corp. <a href=3D"http://www.symas.com=
" target=3D"_blank">http://www.symas.com</a><br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0Director, Highland Sun <a href=3D"http://highlan=dsun.com/hyc/" target=3D"_blank">http://highlandsun.com/hyc/</a><br></span>
=C2=A0 =C2=A0 =C2=A0 =C2=A0Chief Architect, OpenLDAP <a href=3D"http://www.=openldap.org/__project/" target=3D"_blank">http://www.openldap.org/__<u></u=
>project/</a><br>
=C2=A0 =C2=A0 <<a href=3D"http://www.openldap.org/project/" target=3D"_b=
lank">http://www.openldap.org/<u></u>project/</a>><br>
<br>
<br>
</blockquote><div class=3D"HOEnZb"><div class=3D"h5">
<br>
<br>
-- <br>
=C2=A0 -- Howard Chu<br>
=C2=A0 CTO, Symas Corp.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"=
http://www.symas.com" target=3D"_blank">http://www.symas.com</a><br>
=C2=A0 Director, Highland Sun=C2=A0 =C2=A0 =C2=A0<a href=3D"http://highland=sun.com/hyc/" target=3D"_blank">http://highlandsun.com/hyc/</a><br>
=C2=A0 Chief Architect, OpenLDAP=C2=A0 <a href=3D"http://www.openldap.org/p=
roject/" target=3D"_blank">http://www.openldap.org/<u></u>project/</a><br>
</div></div></blockquote></div><br></div>
--001a113513b628687b0512e2d415--