- openldap-bugs - openldap.org

(ITS#6517) undefined references to ldif_*
by abartlet＠samba.org 22 Apr '10

22 Apr '10

--=-hLLTpGMzur3nD+xeX+/o Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Using these instructions, the issue remains with current CVS: I have had it sometimes build from an old tree, but this from scratch does not: =3D=3DGetting OpenLDAP=3D=3D This guide presumes you are running OpenLDAP CVS HEAD from after 22 April 2010 (or a release after that date) You need the 'deref' and 'rdnval' overlay. This may be in your packaged version, but if not your must rebuild. To get OpenLDAP from CVS run: CVSROOT=3D:pserver:anonymous@cvs.OpenLDAP.org:/repo/OpenLDAP export CVSROOT cvs login You will need to enter at the prompt: Password: (enter OpenLDAP) Then check out the tree cvs -z3 checkout -P openldap Then change to the newly created 'openldap' directory: cd openldap To update your OpenLDAP checkout (discarding local conflicts) from CVS run: cvs -z9 update -dP 2>&1 | grep ^C | cut -b3-| xargs rm cvs -z9 update -dP To build it run: CFLAGS=3D"-fno-omit-frame-pointer" `dirname $0`/configure --enable-overlays=3Dmod --enable-modules --enable-dynamic || exit 1 make clean all AC_CFLAGS=3D-g --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-hLLTpGMzur3nD+xeX+/o Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iD8DBQBL0BYkz4A8Wyi0NrsRAuntAKCf7rc4Q9IQrpMwcTeY6cOQIaSgnQCeOGh2 FxErm+tMjQUnb0y7Hmgs9n8= =zuyi -----END PGP SIGNATURE----- --=-hLLTpGMzur3nD+xeX+/o--

1 0

Re: (ITS#6151) Update cosine.schema to RFC 4524
by michael＠stroeder.com 22 Apr '10

22 Apr '10

Kurt Zeilenga wrote: > obsoletes != OBSOLETE, so no. That is, the meaning of the term > 'obsolete' is quite different in these two contexts. > > The latter context the term is defined as follows: The OBSOLETE field, if > present, indicates the element is not active. I agree that OBSOLETE should not be set in this case. > For user application attribute types, whether the type is active or not is, > I think, best left to the schema administrator. Who is the schema administrator? I'm nitpicking here because on the OpenLDAP lists we all keep telling OpenLDAP admins not to mess with the standard schema at all. IMO this includes setting OBSOLETE. Ciao, Michael.

1 0

Re: (ITS#6151) Update cosine.schema to RFC 4524
by kurt＠OpenLDAP.org 21 Apr '10

21 Apr '10

On Apr 21, 2010, at 6:03 PM, masarati(a)aero.polimi.it wrote: >> Kurt Zeilenga wrote: >>>=20 >>> On Jun 1, 2009, at 4:30 AM, michael(a)stroeder.com wrote: >>>> Updated schema file cosine-update.schema attached. >>>=20 >>> I note that differs are generally preferred, even where the file is >>> mostly changed. This helps ensure changes that others might make to = the >>> file you started with are not lost. >>=20 >> I thought about sending a diff but the file in this form is more >> readable for easy review. Could someone please look at it whether = that's >> ok? >=20 >> Another approach would be to have two schema files, one which only >> contains the schema descriptions from RFC 4524 and one with the = missing >> schema descriptions from RFC 1274 with the latter obviously being >> dependent on the former. >=20 > I have one preliminary question for Kurt: since rfc4524 obsoletes = rfc1274, > should those schema items that were not brought forward be marked as > OBSOLETE? obsoletes !=3D OBSOLETE, so no. That is, the meaning of the term = 'obsolete' is quite different in these two contexts. The latter context the term is defined as follows: The OBSOLETE field, if present, indicates the element is not active. For user application attribute types, whether the type is active or not = is, I think, best left to the schema administrator. (Update operations = upon an inactive element is limited to removal of the element.) > If yes, then all schema could fit in one file. I'd like a > clear way to separate valid from obsolete schema. The obsolete items > should be available for backwards compatibility. As an alternative, = I'd > like to have a "slim" (without obsolete) and a complete version of the > file. I rather no element be specified in multiple files. > Could you please upload the file? Through the ITS attachments > don't work too well. >=20 >>>> IPR notice: >>>> This patch file is derived from OpenLDAP Software and RFC 4524 and = RFC >>>> 1274. All of the modifications to OpenLDAP Software represented in = the >>>> attached file were developed by Michael Str=F6der = <michael(a)stroeder.com>. >>>> I have not assigned rights and/or interest in this work to any = party. >>>=20 >>> While this notice of origin is fine, you did not include a rights >>> statement. >>=20 >> I, Michael Str=F6der, hereby place the modified schema file = cosine.schema >> attached to ITS#6151 (and only these modifications) into the public >> domain. Hence, these modifications may be freely used and/or >> redistributed for any purpose with or without attribution and/or = other >> notice. >=20 > Am I right in assuming this IPR is fine? Thanks, p. Yes. - Kurt

1 0

ITS#6250
by masarati＠aero.polimi.it 21 Apr '10

21 Apr '10

Why is this ITS in software development, and open? Anyone intends to develop that feature, despite the discussion? p.

1 0

Re: (ITS#6151) Update cosine.schema to RFC 4524
by masarati＠aero.polimi.it 21 Apr '10

21 Apr '10

> Kurt Zeilenga wrote: >> >> On Jun 1, 2009, at 4:30 AM, michael(a)stroeder.com wrote: >>> Updated schema file cosine-update.schema attached. >> >> I note that differs are generally preferred, even where the file is >> mostly changed. This helps ensure changes that others might make to the >> file you started with are not lost. > > I thought about sending a diff but the file in this form is more > readable for easy review. Could someone please look at it whether that's > ok? > Another approach would be to have two schema files, one which only > contains the schema descriptions from RFC 4524 and one with the missing > schema descriptions from RFC 1274 with the latter obviously being > dependent on the former. I have one preliminary question for Kurt: since rfc4524 obsoletes rfc1274, should those schema items that were not brought forward be marked as OBSOLETE? If yes, then all schema could fit in one file. I'd like a clear way to separate valid from obsolete schema. The obsolete items should be available for backwards compatibility. As an alternative, I'd like to have a "slim" (without obsolete) and a complete version of the file. Could you please upload the file? Through the ITS attachments don't work too well. >>> IPR notice: >>> This patch file is derived from OpenLDAP Software and RFC 4524 and RFC >>> 1274. All of the modifications to OpenLDAP Software represented in the >>> attached file were developed by Michael Ströder <michael(a)stroeder.com>. >>> I have not assigned rights and/or interest in this work to any party. >> >> While this notice of origin is fine, you did not include a rights >> statement. > > I, Michael Ströder, hereby place the modified schema file cosine.schema > attached to ITS#6151 (and only these modifications) into the public > domain. Hence, these modifications may be freely used and/or > redistributed for any purpose with or without attribution and/or other > notice. Am I right in assuming this IPR is fine? Thanks, p.

1 0

Re: (ITS#6529) slapcat: bad configuration file!
by masarati＠aero.polimi.it 21 Apr '10

21 Apr '10

> Full_Name: SLava > Version: 2.4.21 > OS: Gentoo Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (77.120.255.22) > > > My aim is to regularly backup openldap database, so I created a special > backup-user to do that. But while doing this command: "slapcat -f > /etc/openldap/slapd.conf -b "dc=my,dc=domain,dc=com" -l backup.ldif - I > get this > error: "/etc/openldap/slapd.conf: line 77: invalid path: Permission denied > slapcat: bad configuration file!". I watched my conf file and there is > "directory /var/lib/openldap-data/my-domain-com" string in line 77. I > looked for > permission rights and all seems to be properly. Don't know what to do... > > By the way, the same command under "root" works perfectly. Your file permissions are obviously inappropriate for the operation you're trying to perform. There is no evidence of an OpenLDAP bug; there is not even an evidence of an LDAP-related issue. This ITS will be closed. p.

1 0

Re: (ITS#6472) Syncrepl : loop problem with moddn on a new node
by masarati＠aero.polimi.it 21 Apr '10

21 Apr '10

This is a known issue. That patch is now obsoleted by the code that has been committed to HEAD and ported to re24 for release. Please test re24 out of the CVS, or apply the corresponding modifications to slapd/syncrepl.c to 2.4.21, and test. Please note that test018 has been modified to reproduce and test the problem you highlighted. If you run the new test18 with 2.4.21 it should consistently fail, while it passes with the new code. p. > Hello, > > Le 17/04/2010 22:00, > masarati(a)aero.polimi.it (par Internet) a écrit : >> A fix is in HEAD, please test > > I have tried the compilaltion of the source 2.4.21 with your patch, > "make test" failed on "test020-proxycache for bdb" with this error : > > >>>>> Starting test020-proxycache for bdb... > Starting master slapd on TCP/IP port 9011... > Using ldapsearch to check that master slapd is running... > Using ldapadd to populate the master directory... > Starting proxy cache on TCP/IP port 9012... > Using ldapsearch to check that proxy slapd is running... > Making queries on the proxy cache... > Query 1: filter:(sn=Jon) attrs:all (expect nothing) > Query 2: filter:(|(cn=*Jon*)(sn=Jon*)) attrs:cn sn title uid > Query 3: filter:(sn=Smith*) attrs:cn sn uid > ./scripts/test020-proxycache: line 173: 16714 Erreur de segmentation > $SLAPD -f $CONF2 -h $URI2 -d $LVL -d pcache > $LOG2 2>&1 > ldapsearch failed (255)! > ./scripts/test020-proxycache: line 177: kill: (16714) - Aucun processus > de ce type > >>>>> ./scripts/test020-proxycache failed for bdb (exit 255) > make[2]: *** [bdb-mod] Erreur 255 > make[2]: quittant le répertoire « > /root/openldap/2.4.21-its6472/compil-upstream/openldap-2.4.21/tests » > make[1]: *** [test] Erreur 2 > make[1]: quittant le répertoire « > /root/openldap/2.4.21-its6472/compil-upstream/openldap-2.4.21/tests » > make: *** [test] Erreur 2 > > I have used this compilation steps : > tar -zxvf openldap-2.4.21.tgz > > cd openldap-2.4.21 > > patch -p0 < ../pierangelo-masarati-2010-04-17-sync-rename.1.patch > patching file servers/slapd/syncrepl.c > Hunk #2 succeeded at 2554 (offset -10 lines). > Hunk #3 succeeded at 2891 (offset -10 lines). > Hunk #4 succeeded at 3026 (offset -10 lines). > > ./configure --enable-debug --enable-dynamic --enable-syslog > --enable-proctitle --enable-ipv6 --enable-local --enable-slapd > --enable-aci --enable-cleartext --enable-crypt --disable-lmpasswd > --enable-spasswd --enable-modules --enable-rewrite --enable-rlookups > --enable-slapi --enable-slp --enable-wrappers --enable-backends=mod > --enable-ldbm=no --disable-ndb --enable-overlays=mod --with-subdir=ldap > --with-cyrus-sasl --with-threads --with-tls=openssl --with-odbc=unixodbc > > make depend > > make > > make test > > regards, > Julien > >

1 0

(ITS#6529) slapcat: bad configuration file!
by slava.kargaltsev＠gmail.com 21 Apr '10

21 Apr '10

Full_Name: SLava Version: 2.4.21 OS: Gentoo Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (77.120.255.22) My aim is to regularly backup openldap database, so I created a special backup-user to do that. But while doing this command: "slapcat -f /etc/openldap/slapd.conf -b "dc=my,dc=domain,dc=com" -l backup.ldif - I get this error: "/etc/openldap/slapd.conf: line 77: invalid path: Permission denied slapcat: bad configuration file!". I watched my conf file and there is "directory /var/lib/openldap-data/my-domain-com" string in line 77. I looked for permission rights and all seems to be properly. Don't know what to do... By the way, the same command under "root" works perfectly.

1 0

Re: ITS#6055
by masarati＠aero.polimi.it 20 Apr '10

20 Apr '10

> Can you give me the exact commands I need to put into the wiki, for a > user to go from a checkout of OpenLDAP, to a build with this module > installed just like all the others? Assuming one builds in the tree, - follow instructions for anonymous CVS checkout of HEAD branch <http://www.openldap.org/software/repo.html#AnonCVS> - cd contrib/slapd-modules/samba4 - edit Makefile if needed; as it is, it assumes you build in tree, and installs in /usr/local/libexec/openldap - make; make install - in slapd.conf: modulepath /usr/local/libexec/openldap moduleload rdnval.la # ... database hdb # ... overlay rdnval That's it. p.

1 0

Re: ITS#6055
by abartlet＠samba.org 20 Apr '10

20 Apr '10

--=-GJES2Ff4FHn/Nl+ftOBF Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2010-04-21 at 05:42 +0200, masarati(a)aero.polimi.it wrote: > > My eventual goal is that folks using a Ubuntu or Fedora system would > > have Samba4 'just work' with the packaged OpenLDAP. I can of course > > lobby them to get their packages updated to build from contrib, but it'= s > > easier if it's just in there.=3D20 > > > > Similarly, when I ask folks to configure with 'OpenLDAP HEAD' in the > > short term, it is of course easier for me if everything is already in > > place.=3D20 > > > > But this is your project, not mine, and I am happy with whatever we can > > make work.=3D20 >=20 > Right now, along the lines illustrated by Howard, I've committed > everything to contrib/slapd-modules/samba4. You may need to tweak the > Makefile if you are not building in the source tree (as I usually do; the= n > adjust LDAP_BUILD to your build tree), and if you wish to install modules > in some specific place (prefix, exec_prefix, ldap_subdir). >=20 > My medium term objective would be to have: >=20 > - generally useful modules built-in (e.g. slapo-deref) >=20 > - Samba4-specific modules all in one contrib directory, possibly > harmonized and consolidated when possible in a single module, to ease > configuration and maintenance >=20 > The latter could then have a specific configure, if needed, so that > packagers could make and install them as easily as possible. In the > meanwhile, we should live with this interim solution. Time permitting, I > see no issue in maintaining that code, much like we already do with the > other modules. Can you give me the exact commands I need to put into the wiki, for a user to go from a checkout of OpenLDAP, to a build with this module installed just like all the others? Thanks, --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-GJES2Ff4FHn/Nl+ftOBF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iD8DBQBLznxIz4A8Wyi0NrsRAl6mAJ4+rykBiTBAhn3ANiDgEfc8dG1OAgCghGeg ycx5bF3Vlb1Yx3OMwa3p13k= =XUh6 -----END PGP SIGNATURE----- --=-GJES2Ff4FHn/Nl+ftOBF--

1 0

Re: ITS#6055
by masarati＠aero.polimi.it 20 Apr '10

20 Apr '10

> My eventual goal is that folks using a Ubuntu or Fedora system would > have Samba4 'just work' with the packaged OpenLDAP. I can of course > lobby them to get their packages updated to build from contrib, but it's > easier if it's just in there.=20 > > Similarly, when I ask folks to configure with 'OpenLDAP HEAD' in the > short term, it is of course easier for me if everything is already in > place.=20 > > But this is your project, not mine, and I am happy with whatever we can > make work.=20 Right now, along the lines illustrated by Howard, I've committed everything to contrib/slapd-modules/samba4. You may need to tweak the Makefile if you are not building in the source tree (as I usually do; then adjust LDAP_BUILD to your build tree), and if you wish to install modules in some specific place (prefix, exec_prefix, ldap_subdir). My medium term objective would be to have: - generally useful modules built-in (e.g. slapo-deref) - Samba4-specific modules all in one contrib directory, possibly harmonized and consolidated when possible in a single module, to ease configuration and maintenance The latter could then have a specific configure, if needed, so that packagers could make and install them as easily as possible. In the meanwhile, we should live with this interim solution. Time permitting, I see no issue in maintaining that code, much like we already do with the other modules. p.

1 0

Re: ITS#6055
by abartlet＠samba.org 20 Apr '10

20 Apr '10

--=-dnOZfedjaeI8f/8PVlNm Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2010-04-21 at 04:32 +0200, masarati(a)aero.polimi.it wrote: > > My only concern is that it be maintained, so that the OpenLDAP backend > > can be a supported part of Samba4 into the long term. (I know it's not > > been in good shape for the past while, but there is hope we can get it > > back on track). > > > > Do contrib modules come with this level of maintenance? >=20 > Inherently no, because they would not be configured/built along with the > rest of the package. Of course, as soon as users (possibly including > myself) notice issues, they would be maintained (see for example nssov). >=20 > The most straightforward way of having it routinely built is to place it > in slapd/overlays/; I guess this needs consensus from the rest of the > team. I'd vote in favor; please holler. My eventual goal is that folks using a Ubuntu or Fedora system would have Samba4 'just work' with the packaged OpenLDAP. I can of course lobby them to get their packages updated to build from contrib, but it's easier if it's just in there.=20 Similarly, when I ask folks to configure with 'OpenLDAP HEAD' in the short term, it is of course easier for me if everything is already in place.=20 But this is your project, not mine, and I am happy with whatever we can make work.=20 Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-dnOZfedjaeI8f/8PVlNm Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iD8DBQBLzmzwz4A8Wyi0NrsRAomfAJ9J4b76Ujcu5fC3Yig3lgIBJ712ywCeOw3U fDuSKTOqEEfK1JEriBOcJ8g= =FSwh -----END PGP SIGNATURE----- --=-dnOZfedjaeI8f/8PVlNm--

1 0

Re: ITS#6055
by masarati＠aero.polimi.it 20 Apr '10

20 Apr '10

> masarati(a)aero.polimi.it wrote: >>> My only concern is that it be maintained, so that the OpenLDAP backend >>> can be a supported part of Samba4 into the long term. (I know it's not >>> been in good shape for the past while, but there is hope we can get it >>> back on track). >>> >>> Do contrib modules come with this level of maintenance? >> >> Inherently no, because they would not be configured/built along with the >> rest of the package. Of course, as soon as users (possibly including >> myself) notice issues, they would be maintained (see for example nssov). >> >> The most straightforward way of having it routinely built is to place it >> in slapd/overlays/; I guess this needs consensus from the rest of the >> team. I'd vote in favor; please holler. > > I think contrib is the right place for now. It seems to me that the > requirements here are still a moving target, so it's better in contrib. > (Contrib items are free to add new features independent of the rest of the > release cycle. Items in the main slapd/overlays are more constrained to > bugfixes-only within a release cycle.) Fair enough. I've started committing stuff to contrib/slapd-modules/samba4 p.

1 0

Re: ITS#6055
by hyc＠symas.com 20 Apr '10

20 Apr '10

masarati(a)aero.polimi.it wrote: >> My only concern is that it be maintained, so that the OpenLDAP backend >> can be a supported part of Samba4 into the long term. (I know it's not >> been in good shape for the past while, but there is hope we can get it >> back on track). >> >> Do contrib modules come with this level of maintenance? > > Inherently no, because they would not be configured/built along with the > rest of the package. Of course, as soon as users (possibly including > myself) notice issues, they would be maintained (see for example nssov). > > The most straightforward way of having it routinely built is to place it > in slapd/overlays/; I guess this needs consensus from the rest of the > team. I'd vote in favor; please holler. I think contrib is the right place for now. It seems to me that the requirements here are still a moving target, so it's better in contrib. (Contrib items are free to add new features independent of the rest of the release cycle. Items in the main slapd/overlays are more constrained to bugfixes-only within a release cycle.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: ITS#6055
by masarati＠aero.polimi.it 20 Apr '10

20 Apr '10

> My only concern is that it be maintained, so that the OpenLDAP backend > can be a supported part of Samba4 into the long term. (I know it's not > been in good shape for the past while, but there is hope we can get it > back on track). > > Do contrib modules come with this level of maintenance? Inherently no, because they would not be configured/built along with the rest of the package. Of course, as soon as users (possibly including myself) notice issues, they would be maintained (see for example nssov). The most straightforward way of having it routinely built is to place it in slapd/overlays/; I guess this needs consensus from the rest of the team. I'd vote in favor; please holler. p.

1 0

Re: ITS#6055
by abartlet＠samba.org 20 Apr '10

20 Apr '10

--=-plI2z6xrAOfHgQ7f8NT2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2010-04-21 at 03:44 +0200, masarati(a)aero.polimi.it wrote: > > On Tue, 2010-04-20 at 15:37 +0200, masarati(a)aero.polimi.it wrote: > >> > That's no problem at all. > >> > >> Good. This version explicitly check for instantiation as global, and > >> also > >> does some further sanity checks prior to startup. > >> > >> <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-20-rdnval= .2.c> > >> > >> > It now just fails in the same was as without > >> > the patch. I'll mention it on openldap-technical if I can't get > >> > assistance on #ldap. > >> > >> Not quite clear what patch and what failure you refer to. Anyway, I'v= e > >> tested this version of the overlay as global (refuses to start) and on= a > >> database, either empty or populated, and it works as intended. Please > >> test and report. Thanks, p. > > > > It seems to be working well. When can I expect it to be in the tree? > > > > (I'll then require folks to use the current OpenLDAP CVS if they want t= o > > use the LDAP backend). >=20 > I can commit it in a minute. It's not 100% clear to me what's the most > appropriate location: slapd/overlays/ may not, as this looks like > something definitely specific to Samba4; probably, contrib/slapd-modules/ > is more appropriate. Perhaps, a contrib/slapd-modules/samba4/ would be > the most appropriate, along with future specific (i.e. not of general > usefulness) modules, as we did for the nssov module. >=20 > Comments? I mean, from others, not only from you :) My only concern is that it be maintained, so that the OpenLDAP backend can be a supported part of Samba4 into the long term. (I know it's not been in good shape for the past while, but there is hope we can get it back on track).=20 Do contrib modules come with this level of maintenance? Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-plI2z6xrAOfHgQ7f8NT2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iD8DBQBLzmHxz4A8Wyi0NrsRAlF3AKCXBqb/jzSgemy/GREWapoan6QkVwCgj1of Dmourk1xQiMAlvWFJocYuSQ= =rE8J -----END PGP SIGNATURE----- --=-plI2z6xrAOfHgQ7f8NT2--

1 0

Re: ITS#6055
by masarati＠aero.polimi.it 20 Apr '10

20 Apr '10

> On Tue, 2010-04-20 at 15:37 +0200, masarati(a)aero.polimi.it wrote: >> > That's no problem at all. >> >> Good. This version explicitly check for instantiation as global, and >> also >> does some further sanity checks prior to startup. >> >> <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-20-rdnval.2.c> >> >> > It now just fails in the same was as without >> > the patch. I'll mention it on openldap-technical if I can't get >> > assistance on #ldap. >> >> Not quite clear what patch and what failure you refer to. Anyway, I've >> tested this version of the overlay as global (refuses to start) and on a >> database, either empty or populated, and it works as intended. Please >> test and report. Thanks, p. > > It seems to be working well. When can I expect it to be in the tree? > > (I'll then require folks to use the current OpenLDAP CVS if they want to > use the LDAP backend). I can commit it in a minute. It's not 100% clear to me what's the most appropriate location: slapd/overlays/ may not, as this looks like something definitely specific to Samba4; probably, contrib/slapd-modules/ is more appropriate. Perhaps, a contrib/slapd-modules/samba4/ would be the most appropriate, along with future specific (i.e. not of general usefulness) modules, as we did for the nssov module. Comments? I mean, from others, not only from you :) p.

1 0

Re: ITS#6055
by abartlet＠samba.org 20 Apr '10

20 Apr '10

--=-u2bdcYXWzM+LH/qgpb9q Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2010-04-20 at 15:37 +0200, masarati(a)aero.polimi.it wrote: > > That's no problem at all. >=20 > Good. This version explicitly check for instantiation as global, and als= o > does some further sanity checks prior to startup. >=20 > <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-20-rdnval.2.= c> >=20 > > It now just fails in the same was as without > > the patch. I'll mention it on openldap-technical if I can't get > > assistance on #ldap. >=20 > Not quite clear what patch and what failure you refer to. Anyway, I've > tested this version of the overlay as global (refuses to start) and on a > database, either empty or populated, and it works as intended. Please > test and report. Thanks, p. It seems to be working well. When can I expect it to be in the tree? (I'll then require folks to use the current OpenLDAP CVS if they want to use the LDAP backend). Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-u2bdcYXWzM+LH/qgpb9q Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iD8DBQBLzldRz4A8Wyi0NrsRAgzTAJ4lv6P1wia2JLA7L2jPNkpgEvX3FwCgqyY0 jrguLg5MsW14D6wPlNThuko= =F1ZZ -----END PGP SIGNATURE----- --=-u2bdcYXWzM+LH/qgpb9q--

1 0

Re: (ITS#6165) Support offline modify (slapmodify) for cn=config
by quanah＠zimbra.com 20 Apr '10

20 Apr '10

--On Tuesday, April 20, 2010 4:03 AM +0000 masarati(a)aero.polimi.it wrote: > >> Very cute, but it fails the second portion of the requirement, which is >> command validation. ;) > > Here's a poor man's implementation. It *should* work for add & modify; > don't quite know how to delete entries; this also implies renaming. > probably, this would need be_tool_rename & be_tool_delete hooks. Cannot > compete in efficiency with slapadd; uses newly added ldifutil stuff > (ITS#6194). Please test. Cool, thanks! I'll give it a spin :) I believe delete support was added to back-ldif in HEAD, but I'm not sure how it works either. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: ITS#6055
by masarati＠aero.polimi.it 20 Apr '10

20 Apr '10

> That's no problem at all. Good. This version explicitly check for instantiation as global, and also does some further sanity checks prior to startup. <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-20-rdnval.2.c> > It now just fails in the same was as without > the patch. I'll mention it on openldap-technical if I can't get > assistance on #ldap. Not quite clear what patch and what failure you refer to. Anyway, I've tested this version of the overlay as global (refuses to start) and on a database, either empty or populated, and it works as intended. Please test and report. Thanks, p.

1 0

Re: ITS#6055
by abartlet＠samba.org 19 Apr '10

19 Apr '10

--=-8VSfpSadYnNS78ACEBD7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2010-04-20 at 07:11 +0200, masarati(a)aero.polimi.it wrote: > > On Mon, 2010-04-19 at 02:15 +0200, masarati(a)aero.polimi.it wrote: > >> Refactored rdnval.c available at > >> > >> <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-18-rdnval= .c> > >> > >> attempts to repair the database at startup; useful when the overlay is > >> configured for an existing database. Please test. > > > > Sadly it segfaults on startup (we don't have the DB at startup - we > > expect the first operations to create them). >=20 > It's not that sad: this overlay is not intended to be used as global. Yo= u > should use it within any database you want the rdnvalue stored. I haven'= t > considered yet how hard it would be to allow it to be global, and if it's > worth. Since it needs to write operational attributes to the directory, > it may run into issues in case non-local storage databases are used, and > it'd definitely risk to suffer from authentication issues. Does it make > sense for you to add an instance in each database you need rndvalue for? That's no problem at all. It now just fails in the same was as without the patch. I'll mention it on openldap-technical if I can't get assistance on #ldap. Then, when I get past that, I'll get back to this! Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-8VSfpSadYnNS78ACEBD7 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iD8DBQBLzU0sz4A8Wyi0NrsRAu1jAKCZMe8/cj55Qm+nFk1lZ0nRDnvQWACfXKCh jbVrJNvjzyeb5W6fOR49u58= =UMuS -----END PGP SIGNATURE----- --=-8VSfpSadYnNS78ACEBD7--

1 0

Re: ITS#6055
by masarati＠aero.polimi.it 19 Apr '10

19 Apr '10

> On Mon, 2010-04-19 at 02:15 +0200, masarati(a)aero.polimi.it wrote: >> Refactored rdnval.c available at >> >> <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-18-rdnval.c> >> >> attempts to repair the database at startup; useful when the overlay is >> configured for an existing database. Please test. > > Sadly it segfaults on startup (we don't have the DB at startup - we > expect the first operations to create them). It's not that sad: this overlay is not intended to be used as global. You should use it within any database you want the rdnvalue stored. I haven't considered yet how hard it would be to allow it to be global, and if it's worth. Since it needs to write operational attributes to the directory, it may run into issues in case non-local storage databases are used, and it'd definitely risk to suffer from authentication issues. Does it make sense for you to add an instance in each database you need rndvalue for? p. > I produced the environment with Samba4 from master > (538a07a80aae72b57e5c23133158c7f214d0c27a) with the attached additional > patch > > TEST_LDAP=yes OPENLDAP_SLAPD=/usr/local/libexec/slapd make quicktest > > This ran: > '/usr/local/libexec/slapd' > '-F/scratch/samba-2/source4/st/dc/private/ldap/slapd.d' '-h' 'ldapi://% > 2Fscratch%2Fsamba-2%2Fsource4%2Fst%2Fdc%2Fprivate%2Fldap%2Fldapi' '-d0' > > and running that under gdb produced > > Program received signal SIGSEGV, Segmentation fault. > 0x000000000057ba54 in rdnval_repair (be=0x7fffffffdbe0) at rdnval.c:466 > 466 op->o_req_dn = op->o_bd->be_suffix[ 0 ]; > Missing separate debuginfos, use: debuginfo-install > glibc-2.11.90-17.x86_64 libgcc-4.4.3-12.fc13.x86_64 > libicu-4.2.1-7.fc12.x86_64 libicu-4.2.1-8.fc13.x86_64 libstdc > ++-4.4.3-12.fc13.x86_64 libtool-ltdl-2.2.6-18.fc12.x86_64 > libtool-ltdl-2.2.6-18.fc13.x86_64 libuuid-2.17.2-1.fc13.x86_64 > mysql-libs-5.1.45-2.fc13.x86_64 postgresql-libs-8.4.3-1.fc13.x86_64 > (gdb) p op > $1 = (Operation *) 0x7fffffffd4d0 > (gdb) p op->o_bd > $2 = (BackendDB *) 0x0 > (gdb) p *op > $3 = {o_hdr = 0x7fffffffd640, o_tag = 99, o_time = 1271737105, o_tincr = > 1, o_bd = 0x0, o_req_dn = {bv_len = 0, bv_val = 0x0}, o_req_ndn = > {bv_len = 0, bv_val = 0x0}, o_request = {oq_add = {rs_modlist = 0x0, > rs_e = 0x0}, oq_bind = { > rb_method = 0, rb_cred = {bv_len = 0, bv_val = 0x0}, rb_edn = > {bv_len = 0, bv_val = 0x0}, rb_ssf = 0, rb_mech = {bv_len = 0, bv_val = > 0x0}}, oq_compare = {rs_ava = 0x0}, oq_modify = {rs_mods = {rs_modlist = > 0x0, > rs_no_opattrs = 0 '\000'}, rs_increment = 0}, oq_modrdn = > {rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_deleteoldrdn > = 0, rs_newrdn = {bv_len = 0, bv_val = 0x0}, rs_nnewrdn = {bv_len = 0, > bv_val = 0x0}, > rs_newSup = 0x0, rs_nnewSup = 0x0}, oq_search = {rs_scope = 0, > rs_deref = 0, rs_slimit = 0, rs_tlimit = 0, rs_limit = 0x0, rs_attrsonly > = 0, rs_attrs = 0x0, rs_filter = 0x0, rs_filterstr = {bv_len = 0, bv_val > = 0x0}}, > oq_abandon = {rs_msgid = 0}, oq_cancel = {rs_msgid = 0}, oq_extended > = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = > 0x0}, oq_pwdexop = {rs_extended = {rs_reqoid = {bv_len = 0, bv_val = > 0x0}, rs_flags = 0, > rs_reqdata = 0x0}, rs_old = {bv_len = 0, bv_val = 0x0}, rs_new = > {bv_len = 0, bv_val = 0x0}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon > = 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', > o_is_auth_check = 0 '\000', > o_dont_replicate = 0 '\000', o_acl_priv = ACL_NONE, o_nocaching = 0 > '\000', o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000', > o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 31 > times>, > o_controls = 0x7fffffffd788, o_authz = {sai_method = 0, sai_mech = > {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn > = {bv_len = 0, bv_val = 0x0}, sai_ssf = 0, sai_transport_ssf = 0, > sai_tls_ssf = 0, > sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x0, > o_ctrls = 0x0, o_csn = {bv_len = 0, bv_val = 0x0}, o_private = 0x0, > o_extra = {slh_first = 0x0}, o_next = {stqe_next = 0x0}} > (gdb) > > > -- > Andrew Bartlett http://samba.org/~abartlet/ > Authentication Developer, Samba Team http://samba.org > Samba Developer, Cisco Inc. > >

1 0

Re: ITS#6055
by abartlet＠samba.org 19 Apr '10

19 Apr '10

--=-JaZE3OeFLXsBmyVf+gjk Content-Type: multipart/mixed; boundary="=-5geAzHYesMuCPweb8j5I" --=-5geAzHYesMuCPweb8j5I Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 2010-04-19 at 02:15 +0200, masarati(a)aero.polimi.it wrote: > Refactored rdnval.c available at >=20 > <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-18-rdnval.c> >=20 > attempts to repair the database at startup; useful when the overlay is > configured for an existing database. Please test. Sadly it segfaults on startup (we don't have the DB at startup - we expect the first operations to create them).=20 I produced the environment with Samba4 from master (538a07a80aae72b57e5c23133158c7f214d0c27a) with the attached additional patch TEST_LDAP=3Dyes OPENLDAP_SLAPD=3D/usr/local/libexec/slapd make quicktest This ran:=20 '/usr/local/libexec/slapd' '-F/scratch/samba-2/source4/st/dc/private/ldap/slapd.d' '-h' 'ldapi://% 2Fscratch%2Fsamba-2%2Fsource4%2Fst%2Fdc%2Fprivate%2Fldap%2Fldapi' '-d0' and running that under gdb produced Program received signal SIGSEGV, Segmentation fault. 0x000000000057ba54 in rdnval_repair (be=3D0x7fffffffdbe0) at rdnval.c:466 466 op->o_req_dn =3D op->o_bd->be_suffix[ 0 ]; Missing separate debuginfos, use: debuginfo-install glibc-2.11.90-17.x86_64 libgcc-4.4.3-12.fc13.x86_64 libicu-4.2.1-7.fc12.x86_64 libicu-4.2.1-8.fc13.x86_64 libstdc ++-4.4.3-12.fc13.x86_64 libtool-ltdl-2.2.6-18.fc12.x86_64 libtool-ltdl-2.2.6-18.fc13.x86_64 libuuid-2.17.2-1.fc13.x86_64 mysql-libs-5.1.45-2.fc13.x86_64 postgresql-libs-8.4.3-1.fc13.x86_64 (gdb) p op $1 =3D (Operation *) 0x7fffffffd4d0 (gdb) p op->o_bd $2 =3D (BackendDB *) 0x0 (gdb) p *op $3 =3D {o_hdr =3D 0x7fffffffd640, o_tag =3D 99, o_time =3D 1271737105, o_ti= ncr =3D 1, o_bd =3D 0x0, o_req_dn =3D {bv_len =3D 0, bv_val =3D 0x0}, o_req_ndn =3D {bv_len =3D 0, bv_val =3D 0x0}, o_request =3D {oq_add =3D {rs_modlist =3D 0= x0, rs_e =3D 0x0}, oq_bind =3D { rb_method =3D 0, rb_cred =3D {bv_len =3D 0, bv_val =3D 0x0}, rb_edn = =3D {bv_len =3D 0, bv_val =3D 0x0}, rb_ssf =3D 0, rb_mech =3D {bv_len =3D 0, bv= _val =3D 0x0}}, oq_compare =3D {rs_ava =3D 0x0}, oq_modify =3D {rs_mods =3D {rs_modl= ist =3D 0x0,=20 rs_no_opattrs =3D 0 '\000'}, rs_increment =3D 0}, oq_modrdn =3D {rs_mods =3D {rs_modlist =3D 0x0, rs_no_opattrs =3D 0 '\000'}, rs_deleteold= rdn =3D 0, rs_newrdn =3D {bv_len =3D 0, bv_val =3D 0x0}, rs_nnewrdn =3D {bv_len= =3D 0, bv_val =3D 0x0},=20 rs_newSup =3D 0x0, rs_nnewSup =3D 0x0}, oq_search =3D {rs_scope =3D 0= , rs_deref =3D 0, rs_slimit =3D 0, rs_tlimit =3D 0, rs_limit =3D 0x0, rs_attr= sonly =3D 0, rs_attrs =3D 0x0, rs_filter =3D 0x0, rs_filterstr =3D {bv_len =3D 0,= bv_val =3D 0x0}},=20 oq_abandon =3D {rs_msgid =3D 0}, oq_cancel =3D {rs_msgid =3D 0}, oq_ext= ended =3D {rs_reqoid =3D {bv_len =3D 0, bv_val =3D 0x0}, rs_flags =3D 0, rs_reqda= ta =3D 0x0}, oq_pwdexop =3D {rs_extended =3D {rs_reqoid =3D {bv_len =3D 0, bv_val = =3D 0x0}, rs_flags =3D 0,=20 rs_reqdata =3D 0x0}, rs_old =3D {bv_len =3D 0, bv_val =3D 0x0}, rs_= new =3D {bv_len =3D 0, bv_val =3D 0x0}, rs_mods =3D 0x0, rs_modtail =3D 0x0}}, o_ab= andon =3D 0, o_cancel =3D 0, o_groups =3D 0x0, o_do_not_cache =3D 0 '\000', o_is_auth_check =3D 0 '\000',=20 o_dont_replicate =3D 0 '\000', o_acl_priv =3D ACL_NONE, o_nocaching =3D 0 '\000', o_delete_glue_parent =3D 0 '\000', o_no_schema_check =3D 0 '\000', o_no_subordinate_glue =3D 0 '\000', o_ctrlflag =3D '\000' <repeats 31 times>,=20 o_controls =3D 0x7fffffffd788, o_authz =3D {sai_method =3D 0, sai_mech = =3D {bv_len =3D 0, bv_val =3D 0x0}, sai_dn =3D {bv_len =3D 0, bv_val =3D 0x0}, = sai_ndn =3D {bv_len =3D 0, bv_val =3D 0x0}, sai_ssf =3D 0, sai_transport_ssf =3D 0, sai_tls_ssf =3D 0,=20 sai_sasl_ssf =3D 0}, o_ber =3D 0x0, o_res_ber =3D 0x0, o_callback =3D 0= x0, o_ctrls =3D 0x0, o_csn =3D {bv_len =3D 0, bv_val =3D 0x0}, o_private =3D 0x= 0, o_extra =3D {slh_first =3D 0x0}, o_next =3D {stqe_next =3D 0x0}} (gdb)=20 --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-5geAzHYesMuCPweb8j5I Content-Disposition: attachment; filename="add-rdnval.patch" Content-Transfer-Encoding: base64 Content-Type: text/x-patch; name="add-rdnval.patch"; charset="UTF-8" ZGlmZiAtLWdpdCBhL3NvdXJjZTQvc2V0dXAvc2xhcGQuY29uZiBiL3NvdXJjZTQvc2V0dXAvc2xh cGQuY29uZg0KaW5kZXggMDA3N2EyMi4uZTVmY2QwNiAxMDA2NDQNCi0tLSBhL3NvdXJjZTQvc2V0 dXAvc2xhcGQuY29uZg0KKysrIGIvc291cmNlNC9zZXR1cC9zbGFwZC5jb25mDQpAQCAtNDksNiAr NDksNyBAQCBkZWZhdWx0c2VhcmNoYmFzZSAke0RPTUFJTkROfQ0KIHJvb3RkbiBjbj1NYW5hZ2Vy DQogDQogb3ZlcmxheSBkZXJlZg0KK292ZXJsYXkgcmRudmFsDQogDQogJHtSRUZJTlRfQ09ORklH fQ0KIA0K --=-5geAzHYesMuCPweb8j5I-- --=-JaZE3OeFLXsBmyVf+gjk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iD8DBQBLzS/Pz4A8Wyi0NrsRApX6AJ0cG3n8qHNNN8TgvyQDIQD9wWTkXQCfbGgW rlvjjg0JC8ufGPwfp5709c8= =LCEs -----END PGP SIGNATURE----- --=-JaZE3OeFLXsBmyVf+gjk--

1 0

Re: (ITS#6165) Support offline modify (slapmodify) for cn=config
by masarati＠aero.polimi.it 19 Apr '10

19 Apr '10

> Very cute, but it fails the second portion of the requirement, which is > command validation. ;) Here's a poor man's implementation. It *should* work for add & modify; don't quite know how to delete entries; this also implies renaming. probably, this would need be_tool_rename & be_tool_delete hooks. Cannot compete in efficiency with slapadd; uses newly added ldifutil stuff (ITS#6194). Please test. p.

1 0

Re: (ITS#6165) Support offline modify (slapmodify) for cn=config
by quanah＠zimbra.com 19 Apr '10

19 Apr '10

--On Sunday, April 18, 2010 10:17 PM +0200 masarati(a)aero.polimi.it wrote: >> Full_Name: Quanah Gibson-Mount >> Version: 2.4.16 >> OS: NA >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (75.111.29.239) >> >> >> The slapmodify function already exists, but we've never built a tool >> around it. >> It would be useful to be able to have a utility that validates commands >> that >> users can use to modify cn=config while slapd is offline, rather than >> resorting >> to text editors that don't do validation of the changes being made. > > What about this? > > <ftp://ftp.openldap.org/incoming/slapmodify> Very cute, but it fails the second portion of the requirement, which is command validation. ;) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ITS#5804
by masarati＠aero.polimi.it 19 Apr '10

19 Apr '10

The syntax added by ITS#5804 has never been documented. A patch to slapd.access(5) is about to be committed. p.

1 0

Re: (ITS#6482) slapcat doesn't continue with -c after the first corrupted database entry
by sysadmin＠htl-leonding.ac.at 18 Apr '10

18 Apr '10

I had restarted the server many times and it still worked, so I don't think the data was cached. Maybe the different method of access caused the difference, because the non-corrupted entries were still accessible via their id, so direct access worked. Could it be that slapcat doesn't correctly handle the case of invalid entries (entries with decoding errors)? Before this generic patch, I checked if the current entry had the id of the first invalid entry and in this case I incremented the ID by three, got the resulting entry and continued the export --> slapcat "skipped" the entries which it couldn't decode and then continued processing normally. Sorry that I can't test catastrophic recovery any more, because I have deleted the corrupted database, but I think that the main problem was that slapcat (and also other ldap-tools) wasn't able to decode the few damaged entries and didn't try to work around that problem.

1 0

ITS#6055
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

Refactored rdnval.c available at <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-18-rdnval.c> attempts to repair the database at startup; useful when the overlay is configured for an existing database. Please test. p.

1 0

Re: ITS#6017
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

> > --=-Ga69RST1xu0P4I4ibWcD > Content-Type: text/plain; charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > On Sun, 2010-04-18 at 22:59 +0200, masarati(a)aero.polimi.it wrote: >> Still needed? Would the entryUUID of the parent stored in a >> "parentUUID" >> attribute fit? > > While we may change our minds again, Samba4 currently does not require > parentUUID to be stored. We now calculate it dynamically at runtime.=20 OK, thanks. In any case, while refactoring the rdnval.c (ITS#6055), I also implemented this <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-18-pguid.c>. It keeps the parentUUID in sync, and repairs the database at startup (useful when the overlay is added on existing databases). p.

1 0

Re: ITS#6017
by abartlet＠samba.org 18 Apr '10

18 Apr '10

--=-Ga69RST1xu0P4I4ibWcD Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, 2010-04-18 at 22:59 +0200, masarati(a)aero.polimi.it wrote: > Still needed? Would the entryUUID of the parent stored in a "parentUUID" > attribute fit? While we may change our minds again, Samba4 currently does not require parentUUID to be stored. We now calculate it dynamically at runtime.=20 Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc. --=-Ga69RST1xu0P4I4ibWcD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iD8DBQBLy49wz4A8Wyi0NrsRAgxwAJ96NWo95lkdiVV2WSpz9F/EdKaDfwCeO6Y3 +zF9u9EWpDvziGGAsOAyB8Q= =a/rb -----END PGP SIGNATURE----- --=-Ga69RST1xu0P4I4ibWcD--

1 0

ITS#6017
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

Still needed? Would the entryUUID of the parent stored in a "parentUUID" attribute fit? p.

1 0

Re: (ITS#6165) Support offline modify (slapmodify) for cn=config
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

> Full_Name: Quanah Gibson-Mount > Version: 2.4.16 > OS: NA > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (75.111.29.239) > > > The slapmodify function already exists, but we've never built a tool > around it. > It would be useful to be able to have a utility that validates commands > that > users can use to modify cn=config while slapd is offline, rather than > resorting > to text editors that don't do validation of the changes being made. What about this? <ftp://ftp.openldap.org/incoming/slapmodify> ;) p.

1 0

Re: (ITS#6482) slapcat doesn't continue with -c after the first corrupted database entry
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

> The main point wasn't to tell you how important the data was, but that > tools like ldapsearch or other tools connecting to slapd using port 389 > still saw the good data. Because it was cached? Was this true after restarting the server? > And slapd never complained about a corrupted > database. As a result of that the data corruption was hidden (all other > programs worked, only three non-important entries were not accessible) > until I tried to use slapcat to export the data for an upgrade. > > Regarding "If the underlying database fails, there's little slapcat can > do.": As long as slapd sees the data, because it sends it in responses > to ldap-queries, the database hasn't failed so much, that slapcat > couldn't retrieve those data. Well, as I said in my previous message, slapcat is asking the underlying database to provide entries. If the underlying database fails, there's little slapcat can do. When the underlying database is back-bdb/hdb, slapd accesses data using indexes (dn/filter indexes mapped to IDs; the entry is then accessed using BDB in DB_SET mode), while slapcat accesses it using BDB cursors in DB_NEXT mode. Your approach of guessing IDs in the hope it works sounds a bit naive; I think in your case it worked by chance. Perhaps, a more "robust" approach would be to have back-bdb/hdb bi_tool_entry_next() to try to use itself the DB_SET approach instead of the DB_NEXT when the latter fails, with slapcat only knowing about the failure (so it can abort if -c is not passed). > Regarding "any garbage coming out of a corrupted database": slapd never > complained about the database being corrupted, it started without any > problems (except that three entries were unreadable), the entries after > those damaged entries made sense and weren't garbage. Berkeley's > db_tools claimed that there were some errors in the db, but slapd worked > without problems, only slapcat (and ldapdelete when trying to delete > those entries) complained that it couldn't decode them (which seems to > be rather a problem of the application layer than of the database layer, > but might have been caused by some little db corruption). When things go wrong, and specifically when this happens outside the code of our pertinence (in this case BDB), usually the best we can do is to rely on what any diagnostics/recovery capability they provide. Again, what worked for you may not work for another kind of corruption. Actually, going on might provide inconsistent data, something as bad as data loss. > I tried tools like "db_recover", but they didn't help, What about catastrophic recovery, using archived log files? > so I wanted to > extract the good ldap entries (using slapcat ...) to drop the database > and recreate it with the exported ldif, which failed because slapcat > stopped after the first failure (even with -c). Using the submitted > patch I was able to export all readable data into a ldif-file and to > recreate the database. > > summary: > * slapd never complained, ldapsearch listed the data, only few entries > were missing (because for them following was true: > > <= entry_decode: slap_str2undef_ad(object�..!p): > AttributeDescription > contains inappropriate characters) > > --> it seems that some attribute-values were damaged, but not the dn? > > * if ldapsearch is able to retrieve the data, slapcat should also do In general, I concur. However, slapd and tools access data in a slightly different manner, so this may not be trivial, and might require a redesign. > * I don't know how you want to recover an corrupted database. I tried to > recover all good entries and then to recreate it. And for that I wanted > to use slapcat (or is there any other tool for exporting data from the > ldap database than slapcat with option -c)? None I know about. > * maybe the way -c works shouldn't be changed, but there should be an > option for trying data recovery harder without having to patch openldap > (which is complicated for users of other distros not working directly > with the sources, but with precompiled packages) I'd take this as a feature request for redesigning the tools iteration procedure in order to try to overcome minor db corruptions. p.

1 0

Re: (ITS#6528) test020 with hdb: Query 15: ldapsearch failed (4)
by michael＠stroeder.com 18 Apr '10

18 Apr '10

Seems to work now with recent checkout. Ciao, Michael.

1 0

Re: (ITS#6225) GSSAPI support for client library (fixes)
by mimir＠samba.org 18 Apr '10

18 Apr '10

--LZvS9be/3tNcYl/X Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Howard, On Fri, Jul 24, 2009 at 09:20:46PM -0700, Howard Chu wrote: > mimir(a)samba.org wrote: > >Full_Name: Rafal Szczesniak > >Version: Stable (2.4.16) > >OS: GNU/Linux > >URL: http://www.samba.org/~mimir/gssapi-bugfix.diff > >Submission from: (NULL) (67.51.54.234) > > > > > >This is a bugfix patch for OpenLDAP's gssapi support. > > > One of these patches appears to duplicate ITS#6092. As the original > author of this code, could you also take a look at #6091 and #6093? I'm really sorry but after I looked at current code in HEAD and I thought I= liked it (the actual issue was fixed), following with this thread completely went of= f my radar. I've found it while looking through my mailbox. The last chunk of this its' patch still applies though. It's a minor thing = but fixes potential memory leak. I can open a separate ITS for it if you like. As for the other patches - #6091 is (was) convenient but not absolutely nec= essary and #6093 is interesting but I'm not sure if it isn's a bit too much. If yo= u're connecting invalid (from kerberos point of view) hostname then, well, find out what's = the correct=20 hostname first. This its # can be closed of course. cheers, --=20 Rafal Szczesniak Samba Team member http://www.samba.org Likewise Software http://www.likewise.com --LZvS9be/3tNcYl/X Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iD8DBQFLy1e3Hvdfyv3qiKkRAk7ZAJ0VPkzc89VAxXh/AF4EZVCJTvS/fgCfeZK7 TULoTjp8aXQkK0oGZNShxsY= =zucU -----END PGP SIGNATURE----- --LZvS9be/3tNcYl/X--

1 0

Re: (ITS#6482) slapcat doesn't continue with -c after the first corrupted database entry
by sysadmin＠htl-leonding.ac.at 18 Apr '10

18 Apr '10

This is a multi-part message in MIME format. --------------020204070007000004050507 Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit The main point wasn't to tell you how important the data was, but that tools like ldapsearch or other tools connecting to slapd using port 389 still saw the good data. And slapd never complained about a corrupted database. As a result of that the data corruption was hidden (all other programs worked, only three non-important entries were not accessible) until I tried to use slapcat to export the data for an upgrade. Regarding "If the underlying database fails, there's little slapcat can do.": As long as slapd sees the data, because it sends it in responses to ldap-queries, the database hasn't failed so much, that slapcat couldn't retrieve those data. Regarding "any garbage coming out of a corrupted database": slapd never complained about the database being corrupted, it started without any problems (except that three entries were unreadable), the entries after those damaged entries made sense and weren't garbage. Berkeley's db_tools claimed that there were some errors in the db, but slapd worked without problems, only slapcat (and ldapdelete when trying to delete those entries) complained that it couldn't decode them (which seems to be rather a problem of the application layer than of the database layer, but might have been caused by some little db corruption). I tried tools like "db_recover", but they didn't help, so I wanted to extract the good ldap entries (using slapcat ...) to drop the database and recreate it with the exported ldif, which failed because slapcat stopped after the first failure (even with -c). Using the submitted patch I was able to export all readable data into a ldif-file and to recreate the database. summary: * slapd never complained, ldapsearch listed the data, only few entries were missing (because for them following was true: <= entry_decode: slap_str2undef_ad(object�..!p): AttributeDescription contains inappropriate characters) --> it seems that some attribute-values were damaged, but not the dn? * if ldapsearch is able to retrieve the data, slapcat should also do * I don't know how you want to recover an corrupted database. I tried to recover all good entries and then to recreate it. And for that I wanted to use slapcat (or is there any other tool for exporting data from the ldap database than slapcat with option -c)? * maybe the way -c works shouldn't be changed, but there should be an option for trying data recovery harder without having to patch openldap (which is complicated for users of other distros not working directly with the sources, but with precompiled packages) --------------020204070007000004050507 Content-Type: text/html; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-15"> </head> <body bgcolor="#ffffff" text="#000000"> The main point wasn't to tell you how important the data was, but that tools like ldapsearch or other tools connecting to slapd using port 389 still saw the good data. And slapd never complained about a corrupted database. As a result of that the data corruption was hidden (all other programs worked, only three non-important entries were not accessible) until I tried to use slapcat to export the data for an upgrade. Regarding "If the underlying database fails, there's little slapcat can do.": As long as slapd sees the data, because it sends it in responses to ldap-queries, the database hasn't failed so much, that slapcat couldn't retrieve those data. Regarding "any garbage coming out of a corrupted database": slapd never complained about the database being corrupted, it started without any problems (except that three entries were unreadable), the entries after those damaged entries made sense and weren't garbage. Berkeley's db_tools claimed that there were some errors in the db, but slapd worked without problems, only slapcat (and ldapdelete when trying to delete those entries) complained that it couldn't decode them (which seems to be rather a problem of the application layer than of the database layer, but might have been caused by some little db corruption). I tried tools like "db_recover", but they didn't help, so I wanted to extract the good ldap entries (using slapcat ...) to drop the database and recreate it with the exported ldif, which failed because slapcat stopped after the first failure (even with -c). Using the submitted patch I was able to export all readable data into a ldif-file and to recreate the database. summary: * slapd never complained, ldapsearch listed the data, only few entries were missing (because for them following was true: <pre><= entry_decode: slap_str2undef_ad(object&#65533;..!p): AttributeDescription contains inappropriate characters) --> it seems that some attribute-values were damaged, but not the dn? </pre> * if ldapsearch is able to retrieve the data, slapcat should also do * I don't know how you want to recover an corrupted database. I tried to recover all good entries and then to recreate it. And for that I wanted to use slapcat (or is there any other tool for exporting data from the ldap database than slapcat with option -c)? * maybe the way -c works shouldn't be changed, but there should be an option for trying data recovery harder without having to patch openldap (which is complicated for users of other distros not working directly with the sources, but with precompiled packages) </body> </html> --------------020204070007000004050507--

1 0

Re: (ITS#6482) slapcat doesn't continue with -c after the first corrupted database entry
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

> Maybe I haven't described the situation correctly: > The database was used for managing user accounts (via nss_ldap). The > database seems to had three corrupted entries in the middle (good > entries were following after that). The command "getent passwd" i.e. > still listed all users except those three with corrupted entries, but > export via slapcat and reimport of the data would have led to loss of > many more accounts. Lossing half your data is not the expected behaviour > for a tool, which should list all the existing (or at least somehow > readable) database entries. I'm not questioning the importance of the data slapcat couldn't export. > The important point is that slapcat cancelled the export at the first > corrupted database entry and didn't even try to get to the non-corrupted > database entries (which were seen by the other LDAP-tools). This is not correct. Slapcat tries. It asks the underlying backend to provide the subsequent entries. If the underlying database fails, there's little slapcat can do. > It didn't > even try in "continuation" mode, so there was no way to rescue all the > readable data via slapcat. I've tested slapcat in continuation mode by forcibly having be_entry_get() return NULL, and it works as expected: it continues to the next one, as soon as be_entry_next() is able to return a valid ID. if it can't, then anything you'd get from be_entry_next() with an arbitrary ID is unreliable. > For slapcat all entries occuring after the > first corrupt entry were lost. As the remaining good entries were still > accessible and visible via the other tools communicating with slapd via > the port 389, the expected behaviour for slapcat would have been to try > harder to ignore the damaged entries and to recover the remaining > readable entries after them. Maybe slapcat really failed to extract the > next entries id, but in "continuation"-mode it should try hard to > workaround any errors caused by non-readable entries. In case of an > non-readable entry my patch continues stupidly incrementing the id by 1 > and trying to read that entry. As soon as it can extract an entry, it > continues processing. If by "try hard" you mean that any garbage coming out of a corrupted database would be fine for you, then you can fix your patch by having it stop when id == NOID. To me, it sounds a bit too hard. What about recovering the database first, did you try? p.

1 0

Re: (ITS#6528) test020 with hdb: Query 15: ldapsearch failed (4)
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

Thanks, I'm working at this. p. > Full_Name: Michael Ströder > Version: HEAD > OS: > URL: > Submission from: (NULL) (84.163.121.239) > > > Note: It seems to work with back-bdb > > $ ./run -b hdb test020 > Cleaning up test run directory leftover from previous run. > Running ./scripts/test020-proxycache for hdb... > Starting master slapd on TCP/IP port 9011... > Using ldapsearch to check that master slapd is running... > Using ldapadd to populate the master directory... > Starting proxy cache on TCP/IP port 9012... > Using ldapsearch to check that proxy slapd is running... > Making queries on the proxy cache... > Query 1: filter:(sn=Jon) attrs:all (expect nothing) > Query 2: filter:(|(cn=*Jon*)(sn=Jon*)) attrs:cn sn title uid > Query 3: filter:(sn=Smith*) attrs:cn sn uid > Query 4: filter:(sn=Doe*) attrs:cn sn title uid > Query 5: filter:(uid=johnd) attrs:mail postaladdress telephonenumber cn > uid > Query 6: filter:(mail=*@mail.alumni.example.com) attrs:cn sn title uid > Query 7: filter:(mail=*) attrs:cn sn title uid > Query 8: filter:(mail=*example.com) attrs:cn sn title uid > ldapsearch failed (4) > Query 9: filter:(uid=b*) attrs:mail > ldapsearch failed (4) > Query 1 not cacheable > Query 2 cacheable > Query 3 cacheable > Query 4 cacheable > Query 5 cacheable > Query 6 cacheable > Query 7 not cacheable > Query 8 cacheable > Query 9 cacheable > Successfully verified cacheability > Query 10: filter:(|(cn=*Jones)(sn=Jones)) attrs:cn sn title uid > Query 11: filter:(sn=Smith) attrs:cn sn title uid > Query 12: filter:(uid=bjorn) attrs:mail postaladdress telephonenumber cn > uid > Query 13: filter:(mail=jaj@mail.alumni.example.com) attrs:cn sn title uid > Query 14: filter:(mail=*example.com) attrs:cn sn title uid > ldapsearch failed (4) > Query 15: filter:(uid=b*) attrs:mail > ldapsearch failed (4) > Query 10 answerable > Query 11 answerable > Query 12 answerable > Query 13 not answerable > Query 14 not answerable > Query 15 answerable > Successfully verified answerability > Filtering ldapsearch results... > Filtering original ldif... > Comparing filter output... > Comparison failed > > >

1 0

Re: (ITS#6527) Build errors in function � slap_cf_aux_table_unparse�
by masarati＠aero.polimi.it 18 Apr '10

18 Apr '10

Thanks, Quanah is working at this. p. > Full_Name: Michael Ströder > Version: RE24 > OS: openSUSE 11.2 Linux > URL: > Submission from: (NULL) (84.163.121.239) > > > HEAD builds and make test works. > > RE24 fails to build since recent check-ins (anon CVS) yesterday: > > make[3]: Leaving directory > `/usr/src/michael/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers/slapd/overlays' > ../../build/mkversion -v "2.4.X" -s -n Versionstr slapd > version.c > cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. > -I../../include > -c -o main.o main.c > cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. > -I../../include > -c -o globals.o globals.c > cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. > -I../../include > -c -o bconfig.o bconfig.c > cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. > -I../../include > -c -o config.o config.c > config.c: In function �slap_cf_aux_table_unparse�: > config.c:1575: error: duplicate case value > config.c:1547: error: previously used here > make[2]: *** [config.o] Error 1 > make[2]: Leaving directory > `/usr/src/michael/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers/slapd' > make[1]: *** [all-common] Error 1 > make[1]: Leaving directory > `/usr/src/michael/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers' > make: *** [all-common] Error 1 > > >

1 0

(ITS#6528) test020 with hdb: Query 15: ldapsearch failed (4)
by michael＠stroeder.com 18 Apr '10

18 Apr '10

Full_Name: Michael Ströder Version: HEAD OS: URL: Submission from: (NULL) (84.163.121.239) Note: It seems to work with back-bdb $ ./run -b hdb test020 Cleaning up test run directory leftover from previous run. Running ./scripts/test020-proxycache for hdb... Starting master slapd on TCP/IP port 9011... Using ldapsearch to check that master slapd is running... Using ldapadd to populate the master directory... Starting proxy cache on TCP/IP port 9012... Using ldapsearch to check that proxy slapd is running... Making queries on the proxy cache... Query 1: filter:(sn=Jon) attrs:all (expect nothing) Query 2: filter:(|(cn=*Jon*)(sn=Jon*)) attrs:cn sn title uid Query 3: filter:(sn=Smith*) attrs:cn sn uid Query 4: filter:(sn=Doe*) attrs:cn sn title uid Query 5: filter:(uid=johnd) attrs:mail postaladdress telephonenumber cn uid Query 6: filter:(mail=*@mail.alumni.example.com) attrs:cn sn title uid Query 7: filter:(mail=*) attrs:cn sn title uid Query 8: filter:(mail=*example.com) attrs:cn sn title uid ldapsearch failed (4) Query 9: filter:(uid=b*) attrs:mail ldapsearch failed (4) Query 1 not cacheable Query 2 cacheable Query 3 cacheable Query 4 cacheable Query 5 cacheable Query 6 cacheable Query 7 not cacheable Query 8 cacheable Query 9 cacheable Successfully verified cacheability Query 10: filter:(|(cn=*Jones)(sn=Jones)) attrs:cn sn title uid Query 11: filter:(sn=Smith) attrs:cn sn title uid Query 12: filter:(uid=bjorn) attrs:mail postaladdress telephonenumber cn uid Query 13: filter:(mail=jaj@mail.alumni.example.com) attrs:cn sn title uid Query 14: filter:(mail=*example.com) attrs:cn sn title uid ldapsearch failed (4) Query 15: filter:(uid=b*) attrs:mail ldapsearch failed (4) Query 10 answerable Query 11 answerable Query 12 answerable Query 13 not answerable Query 14 not answerable Query 15 answerable Successfully verified answerability Filtering ldapsearch results... Filtering original ldif... Comparing filter output... Comparison failed

1 0

Re: (ITS#6482) slapcat doesn't continue with -c after the first corrupted database entry
by sysadmin＠htl-leonding.ac.at 18 Apr '10

18 Apr '10

Maybe I haven't described the situation correctly: The database was used for managing user accounts (via nss_ldap). The database seems to had three corrupted entries in the middle (good entries were following after that). The command "getent passwd" i.e. still listed all users except those three with corrupted entries, but export via slapcat and reimport of the data would have led to loss of many more accounts. Lossing half your data is not the expected behaviour for a tool, which should list all the existing (or at least somehow readable) database entries. The important point is that slapcat cancelled the export at the first corrupted database entry and didn't even try to get to the non-corrupted database entries (which were seen by the other LDAP-tools). It didn't even try in "continuation" mode, so there was no way to rescue all the readable data via slapcat. For slapcat all entries occuring after the first corrupt entry were lost. As the remaining good entries were still accessible and visible via the other tools communicating with slapd via the port 389, the expected behaviour for slapcat would have been to try harder to ignore the damaged entries and to recover the remaining readable entries after them. Maybe slapcat really failed to extract the next entries id, but in "continuation"-mode it should try hard to workaround any errors caused by non-readable entries. In case of an non-readable entry my patch continues stupidly incrementing the id by 1 and trying to read that entry. As soon as it can extract an entry, it continues processing.

1 0

(ITS#6527) Build errors in function �slap_cf_aux_table_unparse�
by michael＠stroeder.com 18 Apr '10

18 Apr '10

Full_Name: Michael Ströder Version: RE24 OS: openSUSE 11.2 Linux URL: Submission from: (NULL) (84.163.121.239) HEAD builds and make test works. RE24 fails to build since recent check-ins (anon CVS) yesterday: make[3]: Leaving directory `/usr/src/michael/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers/slapd/overlays' ../../build/mkversion -v "2.4.X" -s -n Versionstr slapd > version.c cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. -I../../include -c -o main.o main.c cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. -I../../include -c -o globals.o globals.c cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. -I../../include -c -o bconfig.o bconfig.c cc -g -O2 -DSLAP_SCHEMA_EXPOSE -I../../include -I. -I./slapi -I. -I../../include -c -o config.o config.c config.c: In function slap_cf_aux_table_unparse: config.c:1575: error: duplicate case value config.c:1547: error: previously used here make[2]: *** [config.o] Error 1 make[2]: Leaving directory `/usr/src/michael/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers/slapd' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/usr/src/michael/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers' make: *** [all-common] Error 1

1 0

Re: (ITS#6458) syncrepl fails if attribute has no equalty maching rule
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

Should now be fixed in HEAD; please test. Thanks, p.

1 0

Re: (ITS#6458) syncrepl fails if attribute has no equalty maching rule
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> I see the issue, and I've isolated it to the case where you're removing a > value. In that case, in attr_cmp(), nn == 0 and no < o; the original test > for modifying an attribute without matching rule fails. I've fixed it > according to this patch, not sure whether it's appropriate for other cases > > <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-17-syncrepl-no-…> > > Please test and review. Thanks, p. Please disregard, this patch is breaking other things (basically, producer's and consumer's entries are equivalent, but attrs are listed in a different order; this conforms to the LDAP model but breaks the original, preferable behavior). Working at a better fix. p.

1 0

Re: (ITS#6458) syncrepl fails if attribute has no equalty maching rule
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> Full_Name: Patrick Cernko > Version: 2.4.21 > OS: Linux > URL: > http://www.mpi-inf.mpg.de/~pcernko/syncrepl_fails_if_attribute_has_no_equal… > Submission from: (NULL) (139.19.3.67) > > > Hi OpenLDAP-Programmers, > > although some related bug reports were posted in the past years, this > issue > still seems not to be fixed: > > OpenLDAP's syncrepl replication fails if it comes to removing one of a > multi-value attribes of an object if this attribute does not have a > equality > matching rule defined in the schema. Modification works on the master > server but > fails to replicate to the slave(s) leaving them with the dit version just > before > and not replicating any other changes any more. > > I compiled a small example how to reproduce the problem with the (maybe > "well-known") nisNetgroupTriple attribute from nis.schema as shipped with > openldap-2.4.21: > > - extract the files from > http://www.mpi-inf.mpg.de/~pcernko/syncrepl_fails_if_attribute_has_no_equal… > into an empty working directory > - download the tarball to that working dir and configure similar to the > just > extracted configure.sh > - build and install it to get an install subdir in the working dir > - start the master using sh master.sh in the working dir > This will create the "master" database in your working dir, slapadd the > dit.ldif and start a master slapd with a unix socket /tmp/master. > - start the slave using sh slave.sh > This will create "slave" database in your working dir and start the > slave > slapd with a unix socket /tmp/slave which will immediately start syncing > from > the running master > - if you want you can search the 2 servers with > install/bin/ldapsearch -H ldapi://%2ftmp%2fmaster/ -b ou=openldap -LLL > resp. > install/bin/ldapsearch -H ldapi://%2ftmp%2fslave/ -b ou=openldap -LLL > - use "python mod.py" to remove one of the nisNetgroupTriple attributes > from the > netgroup object > - you will see a debug message from the slave server like this: > > bdb_modify_internal: delete nisNetgroupTriple > bdb_modify_internal: 18 modify/delete: nisNetgroupTriple: no equality > matching > rule > send_ldap_result: err=18 matched="" text="modify/delete: > nisNetgroupTriple: no > equality matching rule" > null_callback : error code 0x12 > slap_graduate_commit_csn: removing 0x29931c0 > 20100120124712.028626Z#000000#000#000000 > syncrepl_entry: rid=001 be_modify cn=netgroup,ou=openldap (18) > syncrepl_entry: rid=001 be_modify failed (18) > > if not, use "python mod.py add" to re-add the removed nisNetgroupTriple > and > try again. Sometimes, it seems to work (race condition?). > - you can also verify the difference with: > install/bin/ldapsearch -H ldapi://%2ftmp%2fmaster/ -b ou=openldap -LLL > cn=netgroup > install/bin/ldapsearch -H ldapi://%2ftmp%2fslave/ -b ou=openldap -LLL > cn=netgroup > - from now on, the slave will fail to sync any succeeding changes, as it > continuously tries to sync the modification above first. :-( > > Now, obviously having an attribute without equality matching rule is not a > good > idea in the first place. However, the (official?) nis.schema comes with > such an > attribute which we must use like this (e.g. we would have to patch the > Solaris > kernel to change it for the Solaris NFS server). > > It is possible to modify a nisNetgroup object like this: according to the > debugging output, I guess the master removes simply ALL nisNetgroupTriple > attributes and adds only the attributes that should remain. When the > corresponding syncrepl_entry is handled by the slave, it seems the it in > contrast tries to really only remove the 2-be-removed attribute which does > not > work as it cannot identify the right one due to a missing eq-match > operator. > > I suggest the best way to solve this issue is to try to get syncrepl do > exactly > the same actions (not resulting changes) as the server does. I see the issue, and I've isolated it to the case where you're removing a value. In that case, in attr_cmp(), nn == 0 and no < o; the original test for modifying an attribute without matching rule fails. I've fixed it according to this patch, not sure whether it's appropriate for other cases <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-17-syncrepl-no-…> Please test and review. Thanks, p.

1 0

Re: (ITS#6463) dnssrv_back_referrals: ldaps not handled, search base gone
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> Full_Name: Jochen Keutel > Version: 2.4.21 > OS: Solaris 10 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (87.159.206.14) > > > dnssrv_back_referrals() always returns ldap URLs - even when the original > request was a ldaps query. This is a (logical) duplicate of ITS#6462; see related answers. > Additionally only protocol and hostname are put into the URL - the search > base > doesn't appear any more. > > Problematic code: > > url.bv_len = STRLENOF( "ldap://" ) + strlen( hosts[i] ); > url.bv_val = ch_malloc( url.bv_len + 1 ); > > strcpy( url.bv_val, "ldap://" ); > strcpy( &url.bv_val[STRLENOF( "ldap://" )], hosts[i] ); > > I'm not sure whether you want me to deliver a complete patch or not ... This behavior conforms to RFC4511, section 4.1.10: - If the <dn> part is present, the client uses this name in its next request to progress the operation, and if it is not present the client uses the same name as in the original request. I note that few lines above the same RFC states: - It is RECOMMENDED that the <dn> part be present to avoid ambiguity. However, slapd-dnssrv(5) computes the referral from DNS SRV records, rather than returning data it knows about. So returning the <dn> part here would be incorrect, in my opinion, as the client could legitimately rely on the fact that the returned DN is appropriate, while it may not. p.

1 0

Re: (ITS#6462) DNS SRV records: ldaps ???
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> --On Wednesday, January 27, 2010 1:28 AM +0000 jochen(a)keutel.de wrote: > >> Full_Name: Jochen Keutel >> Version: 2.4.21 >> OS: Solaris 10 >> URL: ftp://ftp.openldap.org/incoming/ > >> protocol is either "ldap" oder "ldaps". > > LDAPS is not a defined protocol. I would suggest using LDAP with > startTLS, > which is RFC Defined. One could argue that OpenLDAP supports ldaps in many places. I agree in general with your reply, but I'd treat this ITS as a feature request, although I'm not going to give it any special priority. p.

1 0

Re: (ITS#6491) LDAP Error code 80 - Dn index delete failed
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> Full_Name: Robert Hanson > Version: 2.4.21 > OS: RedHat 4.7 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (74.203.208.250) > > > 1) start with an empty database; use slapadd to add a large (3 MB) > database. 2) > Use ldapbrowser to delete nearly all the nodes. After this process, I get > to a > point where a subnode can't be deleted; I see the message "12:00:27 PM: > Failed > to delete entry ou=Agents, lcc=Call Center 1, ou=Company, o=Spanlink > Communications > Reason: [LDAP: error code 80 - DN index delete failed] > 12:15:19 PM: Failed to delete entry ou=Agents, lcc=Call Center 1, > ou=Company, > o=Spanlink Communications > Reason: [LDAP: error code 80 - DN index delete failed]" in the ldapbrowser > window. > > Steps to reproduce: (on redhat linux; I think any linux will do) > 1) build bdb 4.8.26 from the distro; build openldap 2.4.21 from the > distro. > 2) copy built slapd to an appropriate place. link it to slapadd. > 3) FTP: ftp.calabrio.com, user openldap, pass *a68pcJH (Account is > scheduled to > close 3/23/2010; let me know if you need the file uploaded again). unzip > the > file, it contains the slapcat.out; a blank database (in a subfolder), and > a > slapd.conf file. > 4) Edit the slapd.conf file as needed to point to the directory where you > put > the database. > > That was the setup, now here are the steps to reproduce the problem: > > 5) use slapadd -c -f slapd.conf -l slapcat.out to create the database. > 6) start slapd (using slapd -d 1 -f slapd.conf) > 7) use ldapbrowser to delete the "lcc=call center 1" node. > > It takes a long time, but eventually you'll see it fail while trying to > delete > the "agents" node. Can you reproduce with -dtrace? It'll generate a large log file, please only post the part related to the failure. p.

1 0

Re: (ITS#6472) Syncrepl : loop problem with moddn on a new node
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

A fix is in HEAD, please test slapd/syncrepl.c 1.502 -> 1.503 Thanks for reporting, p.

1 0

Re: (ITS#6472) Syncrepl : loop problem with moddn on a new node
by hyc＠symas.com 17 Apr '10

17 Apr '10

masarati(a)aero.polimi.it wrote: > >> It's not clear to me where the issue is. What is the "right" sequence the >> add of the new superior and the mordrdn should be transmitted? Should the >> provider operate differently, or should the consumer check all syncrepl >> messages and try to rebuild the final state, instead of giving up when the >> internal lookup for the newsuperior fails? Probably, a workaround could >> be to perform the modrdn by crating the new superior as a glue object, >> which eventually will be replaced by the actual add. > > I've quickly hacked things this way, and it seems to work fine. > > <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-17-sync-rename.…> > > Please let me know if this approach is sound enough, I might have > overlooked some implications. Patch looks good, solution makes sense. This is one of the reasons we would expect glue entries to be used. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6524) gnutls cipher spec is unclear
by matthijs＠cacholong.nl 17 Apr '10

17 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Kurt Zeilenga wrote: > On Apr 17, 2010, at 3:15 AM, matthijs(a)cacholong.nl wrote: > >> On Apr 16, 2010, at 6:01 PM, Howard Chu wrote: >>> If Peter wants his patch considered for inclusion in OpenLDAP he = >> should write to the ITS himself, we cannot accept 3rd party = >> contributions. >> >> What's the reasoning behind this? > > 3rd parties (middle men) not only hinder good communication between the authors(s) of the contribution and the Project/Foundation, they introduce various risks to both the author and the Project/Foundation. > > Regard, Kurt (Executive Director, The OpenLDAP Foundation) > Hi, Thanks for the explanation, I'll keep it in mind when forwarding patches and / or bug reports from the Debian bugtracker. Regards, Matthijs Mohlmann -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkvKDnUACgkQ2n1ROIkXqbDFtwCgjOrjYmDPXtqYpQrQTNzq7gqL RcsAmgKRRJB28cke29WMHhKIIcB/+q7L =QTpi -----END PGP SIGNATURE-----

1 0

Re: (ITS#6472) Syncrepl : loop problem with moddn on a new node
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> It's not clear to me where the issue is. What is the "right" sequence the > add of the new superior and the mordrdn should be transmitted? Should the > provider operate differently, or should the consumer check all syncrepl > messages and try to rebuild the final state, instead of giving up when the > internal lookup for the newsuperior fails? Probably, a workaround could > be to perform the modrdn by crating the new superior as a glue object, > which eventually will be replaced by the actual add. I've quickly hacked things this way, and it seems to work fine. <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-17-sync-rename.…> Please let me know if this approach is sound enough, I might have overlooked some implications. p.

1 0

Re: (ITS#6472) Syncrepl : loop problem with moddn on a new node
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

>> Full_Name: Julien COMBES >> Version: 2.4.21 >> OS: Debian 5.0.4 >> URL: ftp://ftp.openldap.org/incoming/its-syncrepl-loop-moddn.tar.bz2 >> Submission from: (NULL) (212.23.175.185) >> >> >> Hello, >> >> I think I have found a loop problem with syncrepl replication with >> openldap >> 2.4.21, BDB 4.7.25 with all patches and hdb database. The problem >> appears >> sometimes when an entry is moved with "modrdbn -s" in a node which has >> just been >> created. I have reproduced the problem with the creation of a node and a >> moddn >> while the consumer was stopped and then restarted after. >> >> The problem follows these steps : >> - When it starts, the consumer does a request objectClass=* on the >> provider : >> Feb 12 09:09:19 ldapma24-ida01 slapd[30445]: conn=1007 op=1 SRCH >> base="dc=my,dc=domain" scope=2 deref=0 filter="(objectClass=*)" >> >> - The consumer finds the modrdn and tries to do this : >> Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: >> ==>hdb_modrdn(cn=user1,ou=A,dc=my,dc=domain,cn=user1,ou=X,dc=my,dc=domain) >> >> - The consumer fails with these errors : >> Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: => >> hdb_dn2id("ou=x,dc=my,dc=domain") >> Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: <= hdb_dn2id: get failed: >> DB_NOTFOUND: No matching key/data pair found (-30988) >> Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: hdb_modrdn: >> newSup(ndn=ou=x,dc=my,dc=domain) not here! >> Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: send_ldap_result: conn=-1 >> op=0 p=0 >> Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: send_ldap_result: err=32 >> matched="" >> text="new superior not found" >> >> - The consumer retries the request objectClass=* on the provider and >> loops on >> the problem. The replication doesn't work anymore. >> >> To reproduce the problem, I have used these steps : >> - start an empty provider >> - ldapadd the entries in mydomain.ldif >> ldapadd -x -h 127.0.0.1 -D "dc=my,dc=domain" -W -f mydomain.ldif >> - start the consumer. >> - stop the consumer when replication is finished >> - ldapadd the new node >> ldapadd -x -h 127.0.0.1 -D "dc=my,dc=domain" -W -f add.ldif >> - modrdn -s >> ldapmodrdn -x -h 127.0.0.1 -D "dc=my,dc=domain" -W -r -s >> "ou=X,dc=my,dc=domain" >> "cn=user1,ou=A,dc=my,dc=domain" "cn=user1" >> - start the consumer >> >> I join in its-syncrepl-loop-moddn.tar.bz2 : >> - slapd.conf of provider and consummer >> - log files of provider and consummer >> - mydomain.ldif and add.ldif > > Thanks for the detailed report. The bug is confirmed, and it's not > related to back-hdb, but seems to be syncrepl-related in general. It's not clear to me where the issue is. What is the "right" sequence the add of the new superior and the mordrdn should be transmitted? Should the provider operate differently, or should the consumer check all syncrepl messages and try to rebuild the final state, instead of giving up when the internal lookup for the newsuperior fails? Probably, a workaround could be to perform the modrdn by crating the new superior as a glue object, which eventually will be replaced by the actual add. p.

1 0

Re: (ITS#6472) Syncrepl : loop problem with moddn on a new node
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> Full_Name: Julien COMBES > Version: 2.4.21 > OS: Debian 5.0.4 > URL: ftp://ftp.openldap.org/incoming/its-syncrepl-loop-moddn.tar.bz2 > Submission from: (NULL) (212.23.175.185) > > > Hello, > > I think I have found a loop problem with syncrepl replication with > openldap > 2.4.21, BDB 4.7.25 with all patches and hdb database. The problem appears > sometimes when an entry is moved with "modrdbn -s" in a node which has > just been > created. I have reproduced the problem with the creation of a node and a > moddn > while the consumer was stopped and then restarted after. > > The problem follows these steps : > - When it starts, the consumer does a request objectClass=* on the > provider : > Feb 12 09:09:19 ldapma24-ida01 slapd[30445]: conn=1007 op=1 SRCH > base="dc=my,dc=domain" scope=2 deref=0 filter="(objectClass=*)" > > - The consumer finds the modrdn and tries to do this : > Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: > ==>hdb_modrdn(cn=user1,ou=A,dc=my,dc=domain,cn=user1,ou=X,dc=my,dc=domain) > > - The consumer fails with these errors : > Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: => > hdb_dn2id("ou=x,dc=my,dc=domain") > Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: <= hdb_dn2id: get failed: > DB_NOTFOUND: No matching key/data pair found (-30988) > Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: hdb_modrdn: > newSup(ndn=ou=x,dc=my,dc=domain) not here! > Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: send_ldap_result: conn=-1 > op=0 p=0 > Feb 12 09:09:19 ldapra24-ida01 slapd[12156]: send_ldap_result: err=32 > matched="" > text="new superior not found" > > - The consumer retries the request objectClass=* on the provider and > loops on > the problem. The replication doesn't work anymore. > > To reproduce the problem, I have used these steps : > - start an empty provider > - ldapadd the entries in mydomain.ldif > ldapadd -x -h 127.0.0.1 -D "dc=my,dc=domain" -W -f mydomain.ldif > - start the consumer. > - stop the consumer when replication is finished > - ldapadd the new node > ldapadd -x -h 127.0.0.1 -D "dc=my,dc=domain" -W -f add.ldif > - modrdn -s > ldapmodrdn -x -h 127.0.0.1 -D "dc=my,dc=domain" -W -r -s > "ou=X,dc=my,dc=domain" > "cn=user1,ou=A,dc=my,dc=domain" "cn=user1" > - start the consumer > > I join in its-syncrepl-loop-moddn.tar.bz2 : > - slapd.conf of provider and consummer > - log files of provider and consummer > - mydomain.ldif and add.ldif Thanks for the detailed report. The bug is confirmed, and it's not related to back-hdb, but seems to be syncrepl-related in general. p.

1 0

Re: (ITS#6482) slapcat doesn't continue with -c after the first corrupted database entry
by masarati＠aero.polimi.it 17 Apr '10

17 Apr '10

> Full_Name: Himmelbauer > Version: 2.4.19 > OS: Gentoo Linux > URL: ftp://ftp.openldap.org/incoming/himmelbauer-100301.patch > Submission from: (NULL) (92.248.100.200) > > > Was not able to retrieve database entries from a corrupted LDAP database > using > slapcat (openldap 2.4.19) with option -c. It aborts after the first > corrupted > entry with > > <= entry_decode: slap_str2undef_ad(object�!p): > AttributeDescription > contains inappropriate characters > # no data for entry id=xxxxxxxx > > and doesn't continue with the next valid entry as I would have expected. > > A damaged database is not good, but as slapcat is described as the tool to > recover the non-corrupted data in various forums, it would be good when it > really continues on errors. Other ldap-related tools like ldapsearch > ignore the > damaged data, so it is really annoying, when you want to recover your data > and > don't even get all the readable entries. > > The patch corrects the handling of damaged entries by slapcat when -c is > used, > so that the output is continued with the next non-damaged entry. When -c > is not > used slapcat stops after the first corrupted entry (as expected). > > The patch works for me, but I know that it is not really correct, because > when > there would be no non-damaged entry left it would either cause a endless > loop or > some crashes. > > So a modification would be needed to stop the loop when the last database > entry > was processed, but I didn't know how to access that id. I do not quite understand this report and your fix. The code seems to work as intended. "continue" here means keep processing the database if an entry can't be extracted from the database. This does by no means imply that processing can always continue. If the database is corrupted, it is likely that from the first appearance of the corruption, not even the next entry id can be retrieved at all. Otherwise, if the only error consists in not being able to extract an entry, continuation occurs as expected in the current code. What likely happened in your case was that as soon as the database corruption was encountered, be_entry_next() was unable to compute the id of the next entry. This is why you don't even get a log of the ids of the entries that couldn't be extracted. I'd close this ITS. p.

1 0

Re: (ITS#6524) gnutls cipher spec is unclear
by Kurt＠OpenLDAP.org 17 Apr '10

17 Apr '10

On Apr 17, 2010, at 3:15 AM, matthijs(a)cacholong.nl wrote: > On Apr 16, 2010, at 6:01 PM, Howard Chu wrote: >> If Peter wants his patch considered for inclusion in OpenLDAP he =3D > should write to the ITS himself, we cannot accept 3rd party =3D > contributions. >=20 > What's the reasoning behind this? 3rd parties (middle men) not only hinder good communication between the = authors(s) of the contribution and the Project/Foundation, they = introduce various risks to both the author and the Project/Foundation. Regard, Kurt (Executive Director, The OpenLDAP Foundation)

1 0

(ITS#6526) slapd does not start: slapo-rwm + rewriteContext searchfilter + rewriteRule + cn=config
by daniel＠pluta.biz 17 Apr '10

17 Apr '10

Full_Name: Daniel Pluta Version: HEAD OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:470:9feb:ff02:749a:cf80:5be3:e252) Using the following rwm configuration: overlay rwm rwm-rewriteEngine on rwm-rewriteContext searchFilter rwm-rewriteRule "(.*)" "(&(ou=openldap)$1)" ":@I" 1.) works fine after starting slapd with: slapd -f slapd.conf 2.) converts fine (at least no error messages): slaptest -f slapd.conf -F slapd.d 3.) but slapd's startup aborts when using: slapd -F slapd.d fyi here's slapd's output when started "slapd -F slapd.d -d -1" (rwm-related output): ldif_read_file: read entry file: "/tmp/openldap/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb/olcOverlay={1}rwm.ldif" => str2entry: "dn: olcOverlay={1}rwm objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {1}rwm olcRwmRewrite: {0}rwm-rewriteEngine "on" olcRwmRewrite: {1}rwm-rewriteContext "searchFilter" olcRwmRewrite: {2}rwm-rewriteRule "(.*)" "(&(ou=openldap)$1)" ":@I" olcRwmTFSupport: false olcRwmNormalizeMapped: FALSE structuralObjectClass: olcRwmConfig entryUUID: 2dbc3768-de64-102e-990e-a3438cd19586 creatorsName: cn=config createTimestamp: 20100417115744Z entryCSN: 20100417115744.885645Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100417115744Z " >>> dnPrettyNormal: <olcOverlay={1}rwm> => ldap_bv2dn(olcOverlay={1}rwm,0) <= ldap_bv2dn(olcOverlay={1}rwm)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={1}rwm)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={1}rwm)=0 <<< dnPrettyNormal: <olcOverlay={1}rwm>, <olcOverlay={1}rwm> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(olcOverlay={1}rwm) -> 0x9581ef4 => test_filter PRESENT => access_allowed: search access to "olcOverlay={1}rwm,olcDatabase={2}hdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 line 0 (rwm-rewriteEngine "on") line 0 (rwm-rewriteEngine "on") line 0 (rwm-rewriteContext "searchFilter" ==> here the shell is back :-/ BTW: after commenting out 'rwm-rewriteRule "(.*)" "(&(ou=openldap)$1)" ":@I"' slapd starts just fine. Adding this rule vi cn=config works, but searchfilter-rewriting does not work. Removeing the rule via cn=config results in assertion error rwm.c's function "rwm_cf_gen" in line 2158.

1 0

(ITS#6525) gnutls cipher spec is unclear
by peter＠adpm.de 17 Apr '10

17 Apr '10

Full_Name: Peter Marschall Version: 2.4.21 OS: Linux / BSD URL: ftp://ftp.openldap.org/incoming/Peter-Marschall-20100417-*.patch Submission from: (NULL) (94.217.132.71) Hi, as Matthijs Mohlmann already noted in ITS#6524, the man pages about the TLSCipherSuite resp. TLS_CIPHER_SUITE are for gnutls a bit unclear, only an example for OpenSSL is provided. I wrote patches to alleviate this problem and sent them to the Debian bug tracking system (from where Matthijs they kindly [and with my permission] forwarded to ITS#6524). Please find the patches in * ftp://ftp.openldap.org/incoming/Peter-Marschall-20100417-ldap.conf_TLS_CIPH… * ftp://ftp.openldap.org/incoming/Peter-Marschall-20100417-slapd.conf-TLSCiph… Please consider them for inclusion in the next release of OpenLDAP (BTW, when will that be?) Thanks Peter Marschall

1 0

Re: (ITS#6524) gnutls cipher spec is unclear
by matthijs＠cacholong.nl 17 Apr '10

17 Apr '10

On Apr 16, 2010, at 6:01 PM, Howard Chu wrote: > matthijs(a)cacholong.nl wrote: >> Full_Name: Matthijs Mohlmann >> Version: 2.4.21 >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (83.163.247.203) >>=20 >>=20 >> Hi, >>=20 >> The manpage about the TLS_CIPHER_SUITE is for gnutls a bit unclear, = only an >> example for OpenSSL is provided. >>=20 >> Peter Marschall wrote a patch for this documentation issue. >=20 > If Peter wants his patch considered for inclusion in OpenLDAP he = should write to the ITS himself, we cannot accept 3rd party = contributions. >=20 >> See also: >> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D510346 >> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D563113 >>=20 >> Regards, >>=20 >> Matthijs Mohlmann >=20 >=20 > --=20 > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ Hi, What's the reasoning behind this? I'll ask Peter to file this issue in ITS. Regards, Matthijs Mohlmann

1 0

Re: (ITS#4685) Updated changelog overlay by Neil Dunbar
by sebastian＠rieger.info 16 Apr '10

16 Apr '10

This is a cryptographically signed message in MIME format. --------------ms040209080804080304070307 Content-Type: multipart/alternative; boundary="------------020001050102090908040002" This is a multi-part message in MIME format. --------------020001050102090908040002 Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: quoted-printable Hi, it's been a while, but the changelog overlay is still necessary in our=20 environment, so I changed five lines in the code to keep up with the=20 current stable version of OpenLDAP. You can find the patch and the documentation in: ftp://ftp.openldap.org/incoming/rieger-changelog-2.4.21-pkg-100416.tgz <= ftp://ftp.openldap.org/incoming/rieger-changelog-23-pkg-080706.tgz> the patch and the overlay has been tested against OpenLDAP 2.4.21. Sebastian --------------020001050102090908040002 Content-Type: text/html; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv=3D"content-type" content=3D"text/html; charset=3DISO-885= 9-15"> </head> <body bgcolor=3D"#ffffff" text=3D"#000000"> Hi, it's been a while, but the changelog overlay is still necessary in our environment, so I changed five lines in the code to keep up with the current stable version of OpenLDAP. You can find the patch and the documentation in: <pre><a href=3D"ftp://ftp.openldap.org/incoming/rieger-changelog-23-pkg-080706.t= gz">ftp://ftp.openldap.org/incoming/rieger-changelog-2.4.21-pkg-100416.tg= z</a> the patch and the overlay has been tested against OpenLDAP 2.4.21. </pre> Sebastian </body> </html> --------------020001050102090908040002-- --------------ms040209080804080304070307 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWAjCC BwowggXyoAMCAQICAwCdWDANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRl IFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlh dGUgQ2xpZW50IENBMB4XDTA5MDkyNjAwMDAwMVoXDTEwMDkyNjIzNTk1OVowcTEeMBwGA1UE ChMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMSkwJwYDVQQDEyBTdGFydENvbSBGcmVlIENlcnRp ZmljYXRlIE1lbWJlcjEkMCIGCSqGSIb3DQEJARYVc2ViYXN0aWFuQHJpZWdlci5pbmZvMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtbXkuAbQ11bUAkNHp59cKjUVBRE0xNY F1wt9Yeb0HqnulERLuDAgSChPh1v2HoCwNtYlSrSbBaL6Hs2zXt/ATrUgkBi0FNuUAGVKubd sQN118tW1jMEaUmSsVO0vaj509jGL+81kkq0raPcqgQqvMwYs1ZShfH/WpkzKGUwvpthZxCG U1sGQPIgR7iiE2J6b9mb71D1QiGs9A2KcBBpTPUAleHz4QPG+x7LUzMuVzpZ51rTXd9T59Fv r3x4tsgLQ7JZgNPwQ1XOaIDdpC2FItDK9nNIvTkeYfo6+Ue456/ZHSCUkFzJNYZteWXux10k T4UKS5+jfv+CTVMeDR8iUQIDAQABo4IDjTCCA4kwCQYDVR0TBAIwADALBgNVHQ8EBAMCBLAw HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBTscNXjgXcy8YBjZv0h XzV2WlkSHTAgBgNVHREEGTAXgRVzZWJhc3RpYW5AcmllZ2VyLmluZm8wgagGA1UdIwSBoDCB nYAUU3Ltkpzg2ssBXHx+ljVO8tS4UYKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMN U3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2ln bmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQ0wggFH BgNVHSAEggE+MIIBOjCCATYGCysGAQQBgbU3AQIBMIIBJTAuBggrBgEFBQcCARYiaHR0cDov L3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjA0BggrBgEFBQcCARYoaHR0cDovL3d3dy5z dGFydHNzbC5jb20vaW50ZXJtZWRpYXRlLnBkZjCBvAYIKwYBBQUHAgIwga8wFBYNU3RhcnRD b20gTHRkLjADAgEBGoGWTGltaXRlZCBMaWFiaWxpdHksIHJlYWQgdGhlIHNlY3Rpb24gKkxl Z2FsIExpbWl0YXRpb25zKiBvZiB0aGUgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3Jp dHkgUG9saWN5IGF2YWlsYWJsZSBhdCBodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3ku cGRmMGMGA1UdHwRcMFowK6ApoCeGJWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2NydHUxLWNy bC5jcmwwK6ApoCeGJWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4G CCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9z dWIvY2xhc3MxL2NsaWVudC9jYTBCBggrBgEFBQcwAoY2aHR0cDovL3d3dy5zdGFydHNzbC5j b20vY2VydHMvc3ViLmNsYXNzMS5jbGllbnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0BAQUFAAOCAQEARMqy5GWeKJXpUBwrSjtO0gWn XSZyW49x2M2Nne+zG6xXAf6We+gl4dpnktuVc3a8fk9syfjYHdRF5adWC/5E/rpq7SB3jMsA G8BfnOpQXzJlTNPda3YLcE328AtxGBAM+4HZSIBGDLeaLU0V+ZdTq6J+q+Z+vtsWtAe4gyIi w7kDbkJ8Q726Q4jW5AitmC7O/3JV7nZ3i5cboYRK6jduxSH7NRKa2SLqvQel7rfZDeYMzK9o PHXYgwkddPSrwaF/0Wtrkk3sKuswOzyQB6/4S4mkuT8bFuox4puIJwyi2LMQeuXmHN9Vny/9 Roo6FB32sgdjlZbzSTGblhFCaM9n9TCCBwowggXyoAMCAQICAwCdWDANBgkqhkiG9w0BAQUF ADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNl Y3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENs YXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBMB4XDTA5MDkyNjAwMDAwMVoX DTEwMDkyNjIzNTk1OVowcTEeMBwGA1UEChMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMSkwJwYD VQQDEyBTdGFydENvbSBGcmVlIENlcnRpZmljYXRlIE1lbWJlcjEkMCIGCSqGSIb3DQEJARYV c2ViYXN0aWFuQHJpZWdlci5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA wtbXkuAbQ11bUAkNHp59cKjUVBRE0xNYF1wt9Yeb0HqnulERLuDAgSChPh1v2HoCwNtYlSrS bBaL6Hs2zXt/ATrUgkBi0FNuUAGVKubdsQN118tW1jMEaUmSsVO0vaj509jGL+81kkq0raPc qgQqvMwYs1ZShfH/WpkzKGUwvpthZxCGU1sGQPIgR7iiE2J6b9mb71D1QiGs9A2KcBBpTPUA leHz4QPG+x7LUzMuVzpZ51rTXd9T59Fvr3x4tsgLQ7JZgNPwQ1XOaIDdpC2FItDK9nNIvTke Yfo6+Ue456/ZHSCUkFzJNYZteWXux10kT4UKS5+jfv+CTVMeDR8iUQIDAQABo4IDjTCCA4kw CQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MB0GA1UdDgQWBBTscNXjgXcy8YBjZv0hXzV2WlkSHTAgBgNVHREEGTAXgRVzZWJhc3RpYW5A cmllZ2VyLmluZm8wgagGA1UdIwSBoDCBnYAUU3Ltkpzg2ssBXHx+ljVO8tS4UYKhgYGkfzB9 MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJl IERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlm aWNhdGlvbiBBdXRob3JpdHmCAQ0wggFHBgNVHSAEggE+MIIBOjCCATYGCysGAQQBgbU3AQIB MIIBJTAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjA0 BggrBgEFBQcCARYoaHR0cDovL3d3dy5zdGFydHNzbC5jb20vaW50ZXJtZWRpYXRlLnBkZjCB vAYIKwYBBQUHAgIwga8wFBYNU3RhcnRDb20gTHRkLjADAgEBGoGWTGltaXRlZCBMaWFiaWxp dHksIHJlYWQgdGhlIHNlY3Rpb24gKkxlZ2FsIExpbWl0YXRpb25zKiBvZiB0aGUgU3RhcnRD b20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUG9saWN5IGF2YWlsYWJsZSBhdCBodHRwOi8v d3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMGMGA1UdHwRcMFowK6ApoCeGJWh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwK6ApoCeGJWh0dHA6Ly9jcmwuc3RhcnRz c2wuY29tL2NydHUxLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGGLWh0 dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MxL2NsaWVudC9jYTBCBggrBgEFBQcw AoY2aHR0cDovL3d3dy5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMS5jbGllbnQuY2Eu Y3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0BAQUF AAOCAQEARMqy5GWeKJXpUBwrSjtO0gWnXSZyW49x2M2Nne+zG6xXAf6We+gl4dpnktuVc3a8 fk9syfjYHdRF5adWC/5E/rpq7SB3jMsAG8BfnOpQXzJlTNPda3YLcE328AtxGBAM+4HZSIBG DLeaLU0V+ZdTq6J+q+Z+vtsWtAe4gyIiw7kDbkJ8Q726Q4jW5AitmC7O/3JV7nZ3i5cboYRK 6jduxSH7NRKa2SLqvQel7rfZDeYMzK9oPHXYgwkddPSrwaF/0Wtrkk3sKuswOzyQB6/4S4mk uT8bFuox4puIJwyi2LMQeuXmHN9Vny/9Roo6FB32sgdjlZbzSTGblhFCaM9n9TCCB+IwggXK oAMCAQICAQ0wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx KTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIx MDE1NFoXDTEyMTAyMjIxMDE1NFowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgw NgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBD QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOM pohBllVHrdRvEg/q6r8jR+EK75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl 0TWBuUr/UXBhPk+Kmy7bI4yW4urC+y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOh V+VHzQMALuGYn5KZmc1NbJQYclsGkDxDz2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1 xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr/+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y /w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCA1swggNXMAwGA1UdEwQFMAMBAf8wCwYDVR0P BAQDAgGmMB0GA1UdDgQWBBRTcu2SnODaywFcfH6WNU7y1LhRgjCBqAYDVR0jBIGgMIGdgBRO C+8apEBbpRdphzDKNGhD0EGu8qGBgaR/MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFy dENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5n MSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eYIBATAJBgNVHRIE AjAAMD0GCCsGAQUFBwEBBDEwLzAtBggrBgEFBQcwAoYhaHR0cDovL3d3dy5zdGFydHNzbC5j b20vc2ZzY2EuY3J0MGAGA1UdHwRZMFcwLKAqoCiGJmh0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9y Zy9zZnNjYS1jcmwuY3JsMCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5j cmwwggFdBgNVHSAEggFUMIIBUDCCAUwGCysGAQQBgbU3AQEEMIIBOzAvBggrBgEFBQcCARYj aHR0cDovL2NlcnQuc3RhcnRjb20ub3JnL3BvbGljeS5wZGYwNQYIKwYBBQUHAgEWKWh0dHA6 Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9pbnRlcm1lZGlhdGUucGRmMIHQBggrBgEFBQcCAjCBwzAn FiBTdGFydCBDb21tZXJjaWFsIChTdGFydENvbSkgTHRkLjADAgEBGoGXTGltaXRlZCBMaWFi aWxpdHksIHJlYWQgdGhlIHNlY3Rpb24gKkxlZ2FsIExpbWl0YXRpb25zKiBvZiB0aGUgU3Rh cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUG9saWN5IGF2YWlsYWJsZSBhdCBodHRw Oi8vY2VydC5zdGFydGNvbS5vcmcvcG9saWN5LnBkZjARBglghkgBhvhCAQEEBAMCAAcwUAYJ YIZIAYb4QgENBEMWQVN0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgRnJl ZSBTU0wgRW1haWwgQ2VydGlmaWNhdGVzMA0GCSqGSIb3DQEBBQUAA4ICAQCqmuHgW4zOHRv8 HcYsMCCgt5Mm/fECts0RKL8p/8cwz/+B/wXPBRQ04KCUfp19i4tBD91O07IxvgmiIvdPvGJU oQA6ZD635v/Es4xrSbXzOhGpbiToaXKjK9zssyt2mBiT+USHmery0930Gg2bCKKF5emEhUf9 B6VOBSQ3NMLshWmZhWwq406fETWMkVk01+plkr/k62jsLo98663XUqYFBItlqsDPRv+aOCF0 Gxh8e6F07y+s68PSDmDt0DimQ4BTYR3ilIKjAFIi3IP/loXBnvmOLpirsYIbcGmLIA/2y3yH 6KdzQv7uSasAwloswCa7oZmzleCxvOfTBQm9sP2HmOecwz1RpkNzGXa4sHTiq4ZRYzo2IoZp tvFBzrzQ9ht5CtC757oni6o0DHOhrlHGQEDlr/eqVuAX24kF6QKomzDHm9D2SEmuzxRMxogX NsQLlUZDOJAff/oongNQ/zk4kScLH+q5KFYDrDfXwsOdtrczprlX4qg0uGxWL9NLF/3RRsGr B1FH9w7C4aQ0mHXo2++Eio7bqiwyDrgJtmwNWsQOvu5IxXjSJ4ElOjj0jK3vsQI6HP+nKGjB rYRQ/popq/4v/BfMA8Hcs2rO6MZHQrWlvIVYq/JiZ26eAm3JJZQzD5HkOqkDZsUg4Tnql9Y8 sdnE4v7z6vv08sVf7LZXoTGCA9AwggPMAgEBMIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UE ChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUg U2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0 ZSBDbGllbnQgQ0ECAwCdWDAJBgUrDgMCGgUAoIICEDAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN AQcBMBwGCSqGSIb3DQEJBTEPFw0xMDA0MTYxODEzMTFaMCMGCSqGSIb3DQEJBDEWBBSemYdx 261TAGqe6598nsAxx3VvpzBfBgkqhkiG9w0BCQ8xUjBQMAsGCWCGSAFlAwQBAjAKBggqhkiG 9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcN AwICASgwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25p bmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgMAnVgwgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEWMBQG A1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNh dGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVk aWF0ZSBDbGllbnQgQ0ECAwCdWDANBgkqhkiG9w0BAQEFAASCAQCzjUvvX7cFLTKWOJkM0N6i LT/0W7gZwWe0lyhQqYhLZdNMf3wOmnbiyQZPtJKUEAZXjfqtF8NWfDeC1ewYmSNCT8UlgCA/ Lx0Dvnn3IxqFheyFNm2W9xiCw8AOJmTSLQFIICbVzR3vEKHeM/oRKXywueFgmr4lqFbG00az 4QMU/J9Og/UffErMKvmwtGz4YAHMDPFCZ0Mh6PTZaUNh/6iuyXIeBlC0b9BpajAQJhUUU3G9 e4l/9se5XcghrP4K1t+UvtSGATPdlVOCAvwmxw694Fp+Dk563gYaAl+swMfP8xbQelu59ZBr oi6dDEtmqsCMNvZRF7ICsLxZlqI95gn8AAAAAAAA --------------ms040209080804080304070307--

1 0

Re: (ITS#6524) gnutls cipher spec is unclear
by hyc＠symas.com 16 Apr '10

16 Apr '10

matthijs(a)cacholong.nl wrote: > Full_Name: Matthijs Mohlmann > Version: 2.4.21 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (83.163.247.203) > > > Hi, > > The manpage about the TLS_CIPHER_SUITE is for gnutls a bit unclear, only an > example for OpenSSL is provided. > > Peter Marschall wrote a patch for this documentation issue. If Peter wants his patch considered for inclusion in OpenLDAP he should write to the ITS himself, we cannot accept 3rd party contributions. > See also: > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510346 > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=563113 > > Regards, > > Matthijs Mohlmann > > Patch: > --- openldap-2.1.21/doc/man/man5/ldap.conf.5 > +++ openldap-2.1.21/doc/man/man5/ldap.conf.5 2010-04-15 08:26:41.000000000 > +0200 > @@ -334,19 +334,37 @@ > .B TLS_CIPHER_SUITE<cipher-suite-spec> > Specifies acceptable cipher suite and preference order. > <cipher-suite-spec> should be a cipher specification for OpenSSL, > -e.g., HIGH:MEDIUM:+SSLv2. > +<cipher-suite-spec> should be a cipher specification for OpenSSL resp. GNUtls. > +Example: > +.RS > +.RS > +.TP > +.I OpenSSL: > +TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv2 > +.TP > +.I GNUtls: > +TLS_CIPHER_SUITE SECURE256:!AES-128-CBC > +.RE > > -To check what ciphers a given spec selects, use: > +To check what ciphers a given spec selects in OpenSSL, use: > > .nf > openssl ciphers \-v<cipher-suite-spec> > .fi > > -To obtain the list of ciphers in GNUtls use: > +With GNUtls the available specs can be found in the manual page of > +.BR gnutls\-cli (1) > +(see the description of the > +option > +.BR \-\-priority ). > + > +In older versions of GNUtls, where gnutls\-cli does not support the option > +\-\-priority, you can obtain the \(em more limited \(em list of ciphers by > calling: > > .nf > - gnutls-cli \-l > + gnutls\-cli \-l > .fi > +.RE > .TP > .B TLS_RANDFILE<filename> > Specifies the file to obtain random bits from when /dev/[u]random is > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6524) gnutls cipher spec is unclear
by matthijs＠cacholong.nl 16 Apr '10

16 Apr '10

Full_Name: Matthijs Mohlmann Version: 2.4.21 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.163.247.203) Hi, The manpage about the TLS_CIPHER_SUITE is for gnutls a bit unclear, only an example for OpenSSL is provided. Peter Marschall wrote a patch for this documentation issue. See also: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510346 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=563113 Regards, Matthijs Mohlmann Patch: --- openldap-2.1.21/doc/man/man5/ldap.conf.5 +++ openldap-2.1.21/doc/man/man5/ldap.conf.5 2010-04-15 08:26:41.000000000 +0200 @@ -334,19 +334,37 @@ .B TLS_CIPHER_SUITE <cipher-suite-spec> Specifies acceptable cipher suite and preference order. <cipher-suite-spec> should be a cipher specification for OpenSSL, -e.g., HIGH:MEDIUM:+SSLv2. +<cipher-suite-spec> should be a cipher specification for OpenSSL resp. GNUtls. +Example: +.RS +.RS +.TP +.I OpenSSL: +TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv2 +.TP +.I GNUtls: +TLS_CIPHER_SUITE SECURE256:!AES-128-CBC +.RE -To check what ciphers a given spec selects, use: +To check what ciphers a given spec selects in OpenSSL, use: .nf openssl ciphers \-v <cipher-suite-spec> .fi -To obtain the list of ciphers in GNUtls use: +With GNUtls the available specs can be found in the manual page of +.BR gnutls\-cli (1) +(see the description of the +option +.BR \-\-priority ). + +In older versions of GNUtls, where gnutls\-cli does not support the option +\-\-priority, you can obtain the \(em more limited \(em list of ciphers by calling: .nf - gnutls-cli \-l + gnutls\-cli \-l .fi +.RE .TP .B TLS_RANDFILE <filename> Specifies the file to obtain random bits from when /dev/[u]random is

1 0

Re: (ITS#6515) A lot of dead links on main page of OpenLDAP man.
by Kurt＠OpenLDAP.org 15 Apr '10

15 Apr '10

On Apr 15, 2010, at 5:37 PM, hyc(a)symas.com wrote: > Dzmitry Stremkouski wrote: >> http://www.openldap.org/doc/admin24/schema.html - Contains them, as = well >=20 > I guess the web site is just out of date. I note that update to date for doc/admin24 means "as of the last 2.4 = patch release". -- Kurt=

1 0

Re: (ITS#6515) A lot of dead links on main page of OpenLDAP man.
by hyc＠symas.com 15 Apr '10

15 Apr '10

Dzmitry Stremkouski wrote: > http://www.openldap.org/doc/admin24/schema.html - Contains them, as well I guess the web site is just out of date. The last link in question was fixed by ITS#6493 on 2010-03-18. The IANA link was fixed on 2007-07-07. I don't recall when the bsa link was removed, but it's gone in the 2.4 doc. > On Mon, Apr 12, 2010 at 10:10 PM, Howard Chu <hyc(a)symas.com > <mailto:hyc@symas.com>> wrote: > > mitroko(a)gmail.com <mailto:mitroko@gmail.com> wrote: > > Full_Name: Dmitry Stremkouski > Version: > OS: GNU/Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (95.84.189.132) > > > Hello guys. The part of OpenLDAP Manual (wich can be found here - > http://www.openldap.org/doc/admin23/schema.html) contains a lot of broken > links. > Please correct. > > > The 2.3 release is no longer maintained. This doc will not be updated. > > FE: http://www.alvestrand.no/harald/objectid/ - dead > A: http://www.bsa-global.com/ - dead (doesn't look good enough for > global OID > authority) > A: http://www.iana.org/cgi-bin/enterprise.pl - should be (redirect, > but futher, > IMHO, will be dead, try http://pen.iana.org/pen/PenApplication.page) > > Thanks. > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > > > > > -- > <pre> > (o_ - Dzmitry Stremkouski. > //\ - cel: +7 (916) 090-85-68 > V_/_- web: http://mitroko.com > </pre> > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: ITS#6475
by masarati＠aero.polimi.it 15 Apr '10

15 Apr '10

>> Such a behavior allows replays attacks >> within the modification propagation time frame, but it ensures that bind >> are still possible when then master is down. I think it could be >> interesting to have a configuration setting for that. > > We should bring this to -devel, to see whether it makes sense and whether > it would be acceptable. A fix in this sense is in HEAD. Modifications consist in the original patch (well-known SASL mechs exploit the dontUseCopy control to actually lookup and propagate auxprops to the master ("sasl-auxprops-dontusecopy" directive). Another directive ("sasl-auxprops-dontusecopy-ignore") allows to ignore errors and lookup/store auxprops locally. By default it's FALSE for consistency. If set to TRUE, replicas will be misaligned, but service will be possible. Choose what best fits your needs. Both directives are not documented yet, as I consider the whole code highly experimental. Right now, is only built when #define LDAP_DEVEL. Please note that the relatively minor modifications to slapo-chain(5) are not conditioned on #define SLAP_AUXPROP_DONTUSECOPY, because I think they are generally useful, and I've checked they don't break anything (I could check so far). Please report any inconvenience. p.

1 0

Re: (ITS#6469) push replication entryCSN of database suffix out of sync
by rhafer＠suse.de 15 Apr '10

15 Apr '10

Am Donnerstag 15 April 2010 00:53:04 schrieb hyc(a)symas.com: > rhafer(a)suse.de wrote: > > Am Mittwoch 03 Februar 2010 09:39:19 schrieb hyc(a)symas.com: > >> rhafer(a)suse.de wrote: > >>> Am Dienstag 02 Februar 2010 23:30:23 schrieb hyc(a)symas.com: > >>>> But how did the suffix entry get created without an entryCSN in > >>>> the first place? The MOD that updates the contextCSN doesn't > >>>> happen until after the suffix entry already exists. > >>> > >>> It wasn't created without an entryCSN. It always had one. But the > >>> MOD to update the contextCSN (coming from the provider) doesn't > >>> contain one. So bdb_modify() will call slap_mods_opattrs() to add > >>> entryCSN to the MOD operation. The easiest fix is probably to > >>> never touch the opattrs if "updatedn" is doing MODs, though I am > >>> not yet sure if it might break something. Currently my fix (not > >>> committed yet) only skips the slap_mods_opattrs() step if > >>> "updatedn" it is doing a MOD on contextCSN. > >> > >> Ah, got it. Yes, sounds like your fix is fine. > > > > Do you think it's fine to always skip slap_mods_opattrs() if > > "updatedn" is writing? Or should I check for contextCSN MODs > > specifically? > > > >> Historically the updatedn user (e.g. slurpd) has always provided > >> all of the operational attributes in its updates. > > I guess the question is what have we done in the past for updatedn > writes? If we filled in missing opattrs, then we should continue to > do so. So it should be a special case for contextCSN mods. Ok, that's how the current fix work. So I think we are fine here now. -- Ralf

1 0

Re: (ITS#6513) dynacl/aci fails on searches with attributes
by masarati＠aero.polimi.it 14 Apr '10

14 Apr '10

> If you don't mind playing with HEAD code, you could try this patch > > <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-14-extra-attrs.…> Never mind, I think I already made it incompatible with HEAD code. I'm going to commit this stuff anyway, please stay tuned. p. > You need to add > > extra_attrs OpenLDAPACI > > within the database that contains the offending slapo-rwm instance. > > Please test and report. Thanks, p. > > > >

1 0

Re: (ITS#6513) dynacl/aci fails on searches with attributes
by masarati＠aero.polimi.it 14 Apr '10

14 Apr '10

If you don't mind playing with HEAD code, you could try this patch <ftp://ftp.openldap.org/incoming/pierangelo-masarati-2010-04-14-extra-attrs.…> You need to add extra_attrs OpenLDAPACI within the database that contains the offending slapo-rwm instance. Please test and report. Thanks, p.

1 0

Re: (ITS#6469) push replication entryCSN of database suffix out of sync
by hyc＠symas.com 14 Apr '10

14 Apr '10

rhafer(a)suse.de wrote: > Am Mittwoch 03 Februar 2010 09:39:19 schrieb hyc(a)symas.com: >> rhafer(a)suse.de wrote: >>> Am Dienstag 02 Februar 2010 23:30:23 schrieb hyc(a)symas.com: >>>> But how did the suffix entry get created without an entryCSN in the >>>> first place? The MOD that updates the contextCSN doesn't happen >>>> until after the suffix entry already exists. >>> >>> It wasn't created without an entryCSN. It always had one. But the >>> MOD to update the contextCSN (coming from the provider) doesn't >>> contain one. So bdb_modify() will call slap_mods_opattrs() to add >>> entryCSN to the MOD operation. The easiest fix is probably to never >>> touch the opattrs if "updatedn" is doing MODs, though I am not yet >>> sure if it might break something. Currently my fix (not committed >>> yet) only skips the slap_mods_opattrs() step if "updatedn" it is >>> doing a MOD on contextCSN. >> >> Ah, got it. Yes, sounds like your fix is fine. > Do you think it's fine to always skip slap_mods_opattrs() if "updatedn" > is writing? Or should I check for contextCSN MODs specifically? > >> Historically the updatedn user (e.g. slurpd) has always provided all of >> the operational attributes in its updates. > I guess the question is what have we done in the past for updatedn writes? If we filled in missing opattrs, then we should continue to do so. So it should be a special case for contextCSN mods. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6513) dynacl/aci fails on searches with attributes
by masarati＠aero.polimi.it 14 Apr '10

14 Apr '10

> --Boundary-00=_glFxL04kLcJl7l6 > Content-Type: Text/Plain; > charset="iso-8859-15" > Content-Transfer-Encoding: quoted-printable > > Thanks for your quick answer Pierangelo, > > On Monday, 12. April 2010, masarati(a)aero.polimi.it wrote: >> > [...] >> > My guess is that you're trying to use ACIs with a non-local storage. >> In >> > that case your analysis is correct. Can you provide your (sanitized) >> > configuration? > > I am using a local hdb backend. > > In order to generate a minimal test case I found out, that it seems to > be=20 > related to the rwm overlay. > > Although I have set rwm-rewriteEngine to off, rwm seems to be partially=20 > active. > Commenting out the rwm directives completely makes the searches work as=20 > expected. > > Please find attached a testcase with slapd.conf and ldif data. > To experience the issue simply perform a search with e.g. attribute 1.1 as > = > one=20 > of the users in the data. > Then comment the rwm-... lines in slapd.conf, restart slapd and try again. > Voil=E0 the difference. I see. probably, a relatively "quick" fix would be to allow to define a list of attributes, specific for a database, that is available to all implementations that need to muck with requested attrs (e.g. slapd-ldap, slapd-meta, slapo-rwm). They are supposed to be added to the list of requested attrs whenever appropriate. It's up to the administrato to keep it updated with everything that may be needed by special features like ACI. Something like required_attrs OpenLDAPACI In the future, we might be able to figure out a clever way to self-detect what attributes need to be treated this way. I'll work at that, time permitting. Thanks for reporting. p.

1 0

(ITS#6523) idassert marks proxyAuthz as non-critical
by masarati＠aero.polimi.it 14 Apr '10

14 Apr '10

Full_Name: Pierangelo Masarati Version: HEAD/re24 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (129.72.141.24) Submitted by: ando RFC 4370 requires the criticality flag to be present and set to TRUE. I also note that slapd by default tolerates this behavior, and provides the disallow proxy_authz_non_critical directive to behave in strict accordance with RFC 4370. I've introduced a corresponding proxy-authz-[non-]critical flag in idassert. p.

1 0

Re: (ITS#6518) Slapd-ldap proxy between replica and mirror
by masarati＠aero.polimi.it 14 Apr '10

14 Apr '10

> We have problems when we introduce a back-ldap proxy server between a > delta-syncrepl server and a mirror configuration of two servers. > > The modifications through the replica server (with chaining configuration) > over > the first mirror server are made without problems. The problem appears > when we > introduce a back-ldap proxy between replica and the two servers in mirror > mode. I've already fixed the bit of this issue related to not being able to process ordered attributes in proxies (ITS#6516). This is required to retrieve attributes authzFrom and authzTo, used by the proxy authorization process. The rest of your issue is related to the fact that the slave uses proxyAuthz to propagate the modify request to the updateref server. When this is a proxy, it needs to add proxyAuthz itself to correctly proxy the operation to the master. But two proxyAuthz controls are not allowed. You'd need to use distributed procedures, which are not implemented in OpenLDAP. A distributed operation would then consist in an extended operation that wraps the original one into a new request, with its own controls. At this point, proxyAuthz could apply incrementally at each layer. I'd treat your ITS as yet another request to implement distributed procedures. p.

1 0

Re: (ITS#6468) ACLs in subordinate databases can be ignored
by hyc＠symas.com 14 Apr '10

14 Apr '10

rein(a)OpenLDAP.org wrote: > On 02/02/2010 04:25 PM, Hallvard B Furuseth wrote: >> Hold on. Is the current behavior self-consistent, i.e. one could call >> it an undocumented feature? If so someone may have noticed this and >> written their ACLs accordingly. It's not friendly to change the >> meaning of existing installations' ACLs in the middle of RE24. >> >> OTOH if current behavior is broken even as a "feature", fix away. >> E.g. if clients can choose which ACLs will apply in the subordinate >> by picking a base DN inside vs outside the subordinate. > > From my analyzis of the problem, the subordinate ACLs are used in all > cases except when syncprov desides which "live" modifications it should > replicate to its consumers. Searching with the credentials used by the > syncrepl consumer gives me the attributes and entries my subordinate > ACLs allows, and they are replicated during the refresh phase. But > access to entries and/or attributes being modified during the persistent > phase are rejected. > > But yes, the change should be analyzed by somebody else before being > included in a release. The fix seems to head in the right direction. One could argue that the correct behavior is to apply the subordinate's ACLs first, and then check the parent's ACLs, and then finally any global ACLs. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6522) man page for pcache overlay doesn't state requirement for rootdn
by jonathan＠phillipoux.net 14 Apr '10

14 Apr '10

Full_Name: Jonathan Clarke Version: current RE24 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/jonathan-clarke-pcache-man-20100414.patch Submission from: (NULL) (82.127.99.208) In the code for the pcache overlay, there is a comment stating: /* Cached database must have the rootdn */ And trying to configure the pcache overlay on a database without rootdn, via slapd.conf, produces errors like: pcache_db_open(): underlying database of type "ldap" serving naming context "o=passwd" has no "rootdn", required by "pcache". However, the pcache man page doesn't mention this. I suggest the patch above.

1 0

(ITS#6521) docs: pcache overlay section in admin guide
by jonathan＠phillipoux.net 14 Apr '10

14 Apr '10

Full_Name: Jonathan Clarke Version: irrelevant OS: irrelevant URL: ftp://ftp.openldap.org/incoming/jcl-admin-guide-overlays-20100414.patch Submission from: (NULL) (82.127.99.208) The section of the admin guide on the proxy cache overlay is a little out of date. The patch below: - updates deprected keywords to their new names (s/proxyAttrset/pcacheAttrset/, etc) - adds a configuration example for back-config, which is not trivial to guess

1 0

Re: (ITS#6519) syncprov sends bogus cookie on accesslog purge
by quanah＠zimbra.com 14 Apr '10

14 Apr '10

--On Tuesday, April 13, 2010 9:22 PM +0000 quanah(a)zimbra.com wrote: > --On Tuesday, April 13, 2010 9:07 PM +0000 openldap-its(a)OpenLDAP.org > wrote: > > Here is the -d -1 output from the provider during this time period. You > can clearly see part way through where the empty cookie is sent after a > delete operation is completed. I can confirm Update of /repo/OpenLDAP/pkg/ldap/servers/slapd/overlays Modified Files: accesslog.c 1.105 -> 1.106 Log Message: ITS#6519 don't replicate purge deletes CVS Web URLs: http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/overlays/ http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/overlays/accesslog.c Changes are generally available on cvs.openldap.org (and CVSweb) within 30 minutes of being committed. fixes the issue. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6520) ACL bug with various .expand styles
by masarati＠aero.polimi.it 14 Apr '10

14 Apr '10

Fixed in HEAD; please test. Thanks, p.

1 0

Re: (ITS#6376) memleak in 2.3
by jonathan＠OpenLDAP.org 14 Apr '10

14 Apr '10

On 14/11/2009 05:21, mbackes(a)symas.com wrote: > Full_Name: Matthew Backes > Version: 2.3 only > OS: any > URL: > Submission from: (NULL) (76.88.99.93) > > > In 2.3, if you have a lot of fast writes such that syncprov_sendresp's > op tmp memory is exhausted and it has resorted to malloc()s AND > controls are asserted, the rs.sr_ctrls free at the end of the function > leaks. > > To duplicate: Set up a master and a replica. Do mods like crazy with > some control asserted, e.g. manageDSAIT. > > 2.4/head handle this differently so it isn't a problem there. Hi, This ITS says 2.3 only, but it is listed in the changelog for 2.4.20. Did this also affect versions on the 2.4 branch < 2.4.20, then? Just checking for bug fixes and came across this inconsistency. Any enlightenment welcome. Jonathan

1 0

(ITS#6520) ACL bug with various .expand styles
by kean.johnston＠gmail.com 13 Apr '10

13 Apr '10

Full_Name: Kean Johnston Version: 2.4.21 OS: Linux (Debian Lenny) URL: ftp://ftp.openldap.org/incoming/kean-johnston-100413.patch Submission from: (NULL) (41.133.19.25) Assumption: the following ACL should result in $0 being expanded for the set: access to dn.one="ou=hosts,dc=example,dc=com" attrs=authorizedService by set.expand="[cn=access,$0]/member* & user" compare by * =rsdx break Reason for assumption: man slapd.access states: Forms of the <what> clause other than regex may provide submatches as well. The base(object), the sub(tree), the one(level), and the chil- dren forms provide $0 as the match of the entire string. The sub(tree), the one(level), and the children forms also provide $1 as the match of the rightmost part of the DN as defined in the <what> clause. Bug: does not work as expected. The reason is that in slap.h slap_style_t starts with ACL_STYLE_REGEX = 0, so any structure that uses slap_style_t and uses memset to null out the structure will have its default style be ACL_STYLE_REGEX. In acl.c there are 4 places where you test for ACL_STYLE_REGEX on a->acl_attrval_style without checking if an actual attribute value was supplied. The patch below fixes those cases. The better (arguably) fix would be to change slap_style_t to start with ACL_STYLE_NONE = 0, and then explicitly set the style when it is encountered in aclparse.c. However, I did not want to change slap.h in case it changes some ABI and the change to aclparse.c is larger. As things currently stand, dn.expand, set.expand and group.expand will not expand $0 and $1 as documented if you use dn.{base,one,sub,children} in the what clause. I have attached a patch, and as per instruction: I, James Kean Johnston, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. ftp://ftp.openldap.org/incoming/kean-johnston-100413.patch

1 0

Re: (ITS#6519) syncprov sends bogus cookie on accesslog purge
by quanah＠zimbra.com 13 Apr '10

13 Apr '10

--On Tuesday, April 13, 2010 9:07 PM +0000 openldap-its(a)OpenLDAP.org wrote: Here is the -d -1 output from the provider during this time period. You can clearly see part way through where the empty cookie is sent after a delete operation is completed. 01c0: 69 6c 31 24 04 22 75 73 65 72 2e 32 37 36 40 66 il1$."user.276@f 01d0: 72 65 65 6c 61 6e 63 65 72 2e 6c 61 62 2e 7a 69 reelancer.lab.zi 01e0: 6d 62 72 61 2e 63 6f 6d 30 11 04 03 75 69 64 31 mbra.com0...uid1 01f0: 0a 04 08 75 73 65 72 2e 32 37 36 30 43 04 0b 6f ...user.2760C..o 0200: 62 6a 65 63 74 43 6c 61 73 73 31 34 04 14 6f 72 bjectClass14..or 0210: 67 61 6e 69 7a 61 74 69 6f 6e 61 6c 50 65 72 73 ganizationalPers 0220: 6f 6e 04 0d 7a 69 6d 62 72 61 41 63 63 6f 75 6e on..zimbraAccoun 0230: 74 04 0d 61 6d 61 76 69 73 41 63 63 6f 75 6e 74 t..amavisAccount 0240: 30 2f 04 1a 7a 69 6d 62 72 61 50 61 73 73 77 6f 0/..zimbraPasswo 0250: 72 64 4d 6f 64 69 66 69 65 64 54 69 6d 65 31 11 rdModifiedTime1. 0260: 04 0f 32 30 31 30 30 34 31 33 32 30 34 35 35 34 ..20100413204554 0270: 5a 30 10 04 02 63 6e 31 0a 04 08 75 73 65 72 2e Z0...cn1...user. 0280: 32 37 36 30 2d 04 0e 7a 69 6d 62 72 61 4d 61 69 2760-..zimbraMai 0290: 6c 48 6f 73 74 31 1b 04 19 66 72 65 65 6c 61 6e lHost1...freelan 02a0: 63 65 72 2e 6c 61 62 2e 7a 69 6d 62 72 61 2e 63 cer.lab.zimbra.c 02b0: 6f 6d om <= send_search_entry: conn 2605 exit. send_ldap_result: conn=2605 op=3 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=4 tag=101 err=0 ber_flush2: 14 bytes to sd 20 0000: 30 0c 02 01 04 65 07 0a 01 00 04 00 04 00 0....e........ tls_write: want=35, written=35 0000: 17 03 01 00 1e 59 2c c6 87 d7 64 fe a5 b5 74 e9 .....Y,...d...t. 0010: ff cf e6 00 22 30 dc 8b ed 0f c2 c9 aa d7 64 43 ...."0........dC 0020: 9a d2 3a ..: ldap_write: want=14, written=14 0000: 30 0c 02 01 04 65 07 0a 01 00 04 00 04 00 0....e........ conn=2605 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= daemon: activity on 1 descriptor daemon: activity on: 20r daemon: read active on 20 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(20) connection_get(20): got connid=2605 connection_read(20): checking for input on id=2605 ber_get_next tls_read: want=5, got=5 0000: 15 03 01 00 12 ..... tls_read: want=18, got=18 0000: 07 3e f1 34 3c 74 48 e4 2d 64 da bf 16 b2 f0 e3 .>.4<tH.-d...... 0010: 82 1f .. TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 20 failed errno=0 (Success) connection_read(20): input error=-2 id=2605, closing. connection_closing: readying conn=2605 sd=20 for close connection_close: conn=2605 sd=20 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: removing 20 tls_write: want=23, written=23 0000: 15 03 01 00 12 d7 55 9d 59 8c 18 96 64 bf e7 f9 ......U.Y...d... 0010: 9e 2c 0a 91 c4 9d ba .,..... TLS trace: SSL3 alert write:warning:close notify conn=2605 fd=20 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: 38r daemon: read active on 38 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(38) connection_get(38): got connid=2603 connection_read(38): checking for input on id=2603 ber_get_next tls_read: want=5, got=5 0000: 15 03 01 00 12 ..... tls_read: want=18, got=18 0000: 81 9f e4 91 64 6e bc c8 ba 53 be e0 5e 5e 75 f9 ....dn...S..^^u. 0010: ac e4 .. TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 38 failed errno=0 (Success) connection_read(38): input error=-2 id=2603, closing. connection_closing: readying conn=2603 sd=38 for close connection_close: conn=2603 sd=38 daemon: removing 38 tls_write: want=23, written=23 0000: 15 03 01 00 12 50 be 29 9e e3 e6 b8 88 55 46 64 .....P.).....UFd 0010: 08 d4 83 45 e4 df b1 ...E... TLS trace: SSL3 alert write:warning:close notify conn=2603 fd=38 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 37r daemon: read active on 37 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(37) connection_get(37): got connid=2602 connection_read(37): checking for input on id=2602 ber_get_next tls_read: want=5, got=5 0000: 15 03 01 00 12 ..... tls_read: want=18, got=18 0000: b8 e7 6e 24 27 de cc 33 fd 77 b9 29 8a a4 5e 79 ..n$'..3.w.)..^y 0010: 53 7c S| TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 37 failed errno=0 (Success) connection_read(37): input error=-2 id=2602, closing. connection_closing: readying conn=2602 sd=37 for close connection_close: conn=2602 sd=37 daemon: removing 37 tls_write: want=23, written=23 0000: 15 03 01 00 12 7c e4 28 fb 15 b4 f9 dc 69 44 4d .....|.(.....iDM 0010: 40 21 1b 78 7f 41 35 @!.x.A5 TLS trace: SSL3 alert write:warning:close notify conn=2602 fd=37 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero => hdb_search bdb_dn2entry("cn=accesslog") => access_allowed: search access to "cn=accesslog" "entry" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) search_candidates: base="cn=accesslog" (0x00000001) scope=1 => hdb_dn2idl("cn=accesslog") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates LE => bdb_inequality_candidates (reqStart) => key_read bdb_idl_fetch_key: <= bdb_index_read 2 candidates => key_read bdb_idl_fetch_key: <= bdb_index_read: failed (-30988) <= bdb_inequality_candidates: id=2, first=9, last=10 <= bdb_filter_candidates: id=2 first=9 last=10 <= bdb_list_candidates: id=2 first=9 last=10 <= bdb_filter_candidates: id=2 first=9 last=10 <= bdb_list_candidates: id=2 first=9 last=10 <= bdb_filter_candidates: id=2 first=9 last=10 bdb_search_candidates: id=2 first=9 last=10 entry_decode: "" <= entry_decode() => test_filter LE => access_allowed: search access to "reqStart=20100413191807.000004Z,cn=accesslog" "reqStart" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 entry_decode: "" <= entry_decode() => test_filter LE => access_allowed: search access to "reqStart=20100413191807.000009Z,cn=accesslog" "reqStart" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "reqStart=20100413191807.000004Z,cn=accesslog" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("reqStart=20100413191807.000004Z,cn=accesslog") => bdb_entry_get: found entry: "reqStart=20100413191807.000004Z,cn=accesslog" bdb_entry_get: rc=0 => test_filter AND => test_filter_and => test_filter EQUALITY => access_allowed: search access to "reqStart=20100413191807.000004Z,cn=accesslog" "objectClass" requested => dn: [1] cn=accesslog => acl_get: [1] matched => acl_get: [1] attr objectClass => acl_mask: access to entry "reqStart=20100413191807.000004Z,cn=accesslog", attr "objectClass" requested => acl_mask: to value by "uid=zmreplica,cn=admins,cn=zimbra", (=0) <= check a_dn_pat: uid=zimbra,cn=admins,cn=zimbra <= check a_dn_pat: cn=config <= check a_dn_pat: uid=zmreplica,cn=admins,cn=zimbra <= acl_mask: [3] applying read(=rscxd) (stop) <= acl_mask: [3] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter EQUALITY => access_allowed: search access to "reqStart=20100413191807.000004Z,cn=accesslog" "reqResult" requested => dn: [1] cn=accesslog => acl_get: [1] matched => acl_get: [1] attr reqResult => acl_mask: access to entry "reqStart=20100413191807.000004Z,cn=accesslog", attr "reqResult" requested => acl_mask: to value by "uid=zmreplica,cn=admins,cn=zimbra", (=0) <= check a_dn_pat: uid=zimbra,cn=admins,cn=zimbra <= check a_dn_pat: cn=config <= check a_dn_pat: uid=zmreplica,cn=admins,cn=zimbra <= acl_mask: [3] applying read(=rscxd) (stop) <= acl_mask: [3] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) <= test_filter 6 <= test_filter_and 6 <= test_filter 6 syncprov_matchops: sid ffffffff fscope 1 rc 6 ==> hdb_delete: reqStart=20100413191807.000004Z,cn=accesslog bdb_dn2entry("reqStart=20100413191807.000004Z,cn=accesslog") => access_allowed: delete access to "cn=accesslog" "children" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => access_allowed: delete access to "reqStart=20100413191807.000004Z,cn=accesslog" "entry" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => hdb_dn2id_delete 0x9: "reqStart=20100413191807.000004Z,cn=accesslog" <= hdb_dn2id_delete 0x9: 0 => index_entry_del( 9, "reqStart=20100413191807.000004Z,cn=accesslog" ) => key_change(DELETE,9) bdb_idl_delete_key: 9 [66ec5701] <= key_change 0 => key_change(DELETE,9) bdb_idl_delete_key: 9 [98599c51] <= key_change 0 => key_change(DELETE,9) bdb_idl_delete_key: 9 [61e2b421] <= key_change 0 => key_change(DELETE,9) bdb_idl_delete_key: 9 [0096defd] <= key_change 0 => key_change(DELETE,9) bdb_idl_delete_key: 9 <= key_change 0 => key_change(DELETE,9) bdb_idl_delete_key: 9 <= key_change 0 => key_change(DELETE,9) bdb_idl_delete_key: 9 [80000000] <= key_change 0 => key_change(DELETE,9) bdb_idl_delete_key: 9 <= key_change 0 <= index_entry_del( 9, "reqStart=20100413191807.000004Z,cn=accesslog" ) success ====> bdb_cache_delete( 9 ) hdb_delete: deleted id=00000009 dn="reqStart=20100413191807.000004Z,cn=accesslog" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" syncprov_sendresp: cookie= => send_search_entry: conn 1013 dn="reqStart=20100413191807.000004Z,cn=accesslog" => access_allowed: read access to "reqStart=20100413191807.000004Z,cn=accesslog" "entry" requested => dn: [1] cn=accesslog => acl_get: [1] matched => acl_get: [1] attr entry => acl_mask: access to entry "reqStart=20100413191807.000004Z,cn=accesslog", attr "entry" requested => acl_mask: to all values by "uid=zmreplica,cn=admins,cn=zimbra", (=0) <= check a_dn_pat: uid=zimbra,cn=admins,cn=zimbra <= check a_dn_pat: cn=config <= check a_dn_pat: uid=zmreplica,cn=admins,cn=zimbra <= acl_mask: [3] applying read(=rscxd) (stop) <= acl_mask: [3] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) conn=1013 op=2 ENTRY dn="reqStart=20100413191807.000004Z,cn=accesslog" ber_flush2: 112 bytes to sd 18 0000: 30 6e 02 01 03 64 30 04 2c 72 65 71 53 74 61 72 0n...d0.,reqStar 0010: 74 3d 32 30 31 30 30 34 31 33 31 39 31 38 30 37 t=20100413191807 0020: 2e 30 30 30 30 30 34 5a 2c 63 6e 3d 61 63 63 65 .000004Z,cn=acce 0030: 73 73 6c 6f 67 30 00 a0 37 30 35 04 18 31 2e 33 sslog0..705..1.3 0040: 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e .6.1.4.1.4203.1. 0050: 39 2e 31 2e 32 04 19 30 17 0a 01 03 04 10 43 30 9.1.2..0......C0 0060: b3 35 9f 63 47 af b6 f3 66 1b e4 76 6c 54 04 00 .5.cG...f..vlT.. tls_write: want=186, written=186 0000: 17 03 01 00 20 77 40 e5 e4 99 b3 f0 07 5a 3d c9 .... w@......Z=. 0010: 11 4b 1d c2 97 45 d2 d1 d6 52 c9 89 74 37 b7 c9 .K...E...R..t7.. 0020: fd 72 3d cf 8d 17 03 01 00 90 f3 dc 6b 91 cd f5 .r=.........k... 0030: 6a 87 21 7c 61 fa 8e 69 ea f8 21 9e ec ea 85 a2 j.!|a..i..!..... 0040: 9d f0 8a 32 82 66 62 9c bf 15 00 02 ef c0 d0 34 ...2.fb........4 0050: 16 4e 2d a6 25 e3 5f 0d 95 68 2d 7b 74 8f 41 a8 .N-.%._..h-{t.A. 0060: 4b 51 93 78 46 d6 8e 44 33 12 44 05 6c 37 09 03 KQ.xF..D3.D.l7.. 0070: b5 d3 13 58 c2 7a 82 9e 3e 0e 4d 6f f0 90 a7 3d ...X.z..>.Mo...= 0080: 4b 5f 44 5f 7d 3a cc 28 93 b6 3f 37 05 c8 c6 77 K_D_}:.(..?7...w 0090: f4 40 72 97 ea a9 0e a0 ab 98 09 5c b8 08 54 a7 .@r........\..T. 00a0: 7d 2e 72 6f 5f 14 db e4 0b bc 0b ca 1f 3e ae 83 }.ro_........>.. 00b0: 37 51 c5 82 44 b7 b4 00 9a 35 7Q..D....5 ldap_write: want=112, written=112 0000: 30 6e 02 01 03 64 30 04 2c 72 65 71 53 74 61 72 0n...d0.,reqStar 0010: 74 3d 32 30 31 30 30 34 31 33 31 39 31 38 30 37 t=20100413191807 0020: 2e 30 30 30 30 30 34 5a 2c 63 6e 3d 61 63 63 65 .000004Z,cn=acce 0030: 73 73 6c 6f 67 30 00 a0 37 30 35 04 18 31 2e 33 sslog0..705..1.3 0040: 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e .6.1.4.1.4203.1. 0050: 39 2e 31 2e 32 04 19 30 17 0a 01 03 04 10 43 30 9.1.2..0......C0 0060: b3 35 9f 63 47 af b6 f3 66 1b e4 76 6c 54 04 00 .5.cG...f..vlT.. <= send_search_entry: conn 1013 exit. => bdb_entry_get: ndn: "reqStart=20100413191807.000009Z,cn=accesslog" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("reqStart=20100413191807.000009Z,cn=accesslog") => bdb_entry_get: found entry: "reqStart=20100413191807.000009Z,cn=accesslog" bdb_entry_get: rc=0 => test_filter AND => test_filter_and => test_filter EQUALITY => access_allowed: search access to "reqStart=20100413191807.000009Z,cn=accesslog" "objectClass" requested => dn: [1] cn=accesslog => acl_get: [1] matched => acl_get: [1] attr objectClass => acl_mask: access to entry "reqStart=20100413191807.000009Z,cn=accesslog", attr "objectClass" requested => acl_mask: to value by "uid=zmreplica,cn=admins,cn=zimbra", (=0) <= check a_dn_pat: uid=zimbra,cn=admins,cn=zimbra <= check a_dn_pat: cn=config <= check a_dn_pat: uid=zmreplica,cn=admins,cn=zimbra <= acl_mask: [3] applying read(=rscxd) (stop) <= acl_mask: [3] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter EQUALITY => access_allowed: search access to "reqStart=20100413191807.000009Z,cn=accesslog" "reqResult" requested => dn: [1] cn=accesslog => acl_get: [1] matched => acl_get: [1] attr reqResult => acl_mask: access to entry "reqStart=20100413191807.000009Z,cn=accesslog", attr "reqResult" requested => acl_mask: to value by "uid=zmreplica,cn=admins,cn=zimbra", (=0) <= check a_dn_pat: uid=zimbra,cn=admins,cn=zimbra <= check a_dn_pat: cn=config <= check a_dn_pat: uid=zmreplica,cn=admins,cn=zimbra <= acl_mask: [3] applying read(=rscxd) (stop) <= acl_mask: [3] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) <= test_filter 6 <= test_filter_and 6 <= test_filter 6 syncprov_matchops: sid ffffffff fscope 1 rc 6 ==> hdb_delete: reqStart=20100413191807.000009Z,cn=accesslog bdb_dn2entry("reqStart=20100413191807.000009Z,cn=accesslog") => access_allowed: delete access to "cn=accesslog" "children" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => access_allowed: delete access to "reqStart=20100413191807.000009Z,cn=accesslog" "entry" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => hdb_dn2id_delete 0xa: "reqStart=20100413191807.000009Z,cn=accesslog" <= hdb_dn2id_delete 0xa: 0 => index_entry_del( 10, "reqStart=20100413191807.000009Z,cn=accesslog" ) => key_change(DELETE,a) bdb_idl_delete_key: a [66ec5701] <= key_change 0 => key_change(DELETE,a) bdb_idl_delete_key: a [98599c51] <= key_change 0 => key_change(DELETE,a) bdb_idl_delete_key: a [61e2b421] <= key_change 0 => key_change(DELETE,a) bdb_idl_delete_key: a [0096defd] <= key_change 0 => key_change(DELETE,a) bdb_idl_delete_key: a <= key_change 0 => key_change(DELETE,a) bdb_idl_delete_key: a <= key_change 0 => key_change(DELETE,a) bdb_idl_delete_key: a [80000000] <= key_change 0 => key_change(DELETE,a) bdb_idl_delete_key: a <= key_change 0 <= index_entry_del( 10, "reqStart=20100413191807.000009Z,cn=accesslog" ) success ====> bdb_cache_delete( 10 ) daemon: activity on 1 descriptor daemon: activity on: 18r daemon: read active on 18 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(18) connection_get(18): got connid=1013 connection_read(18): checking for input on id=1013 ber_get_next tls_read: want=5, got=5 0000: 17 03 01 00 20 .... tls_read: want=32, got=32 0000: d7 e0 2b 7c 92 57 a1 11 a4 0b d8 76 81 f5 15 e7 ..+|.W.....v.... 0010: b3 58 97 b6 10 65 aa 30 9d 38 e3 2c 90 63 a5 9d .X...e.0.8.,.c.. tls_read: want=5, got=5 0000: 17 03 01 00 20 .... tls_read: want=32, got=32 0000: 2a bd 8d 49 d2 58 87 51 8f b4 32 e7 70 07 8c 13 *..I.X.Q..2.p... 0010: 1d d2 19 c8 43 a1 fb 28 89 4f cf df a8 58 6c 2a ....C..(.O...Xl* ldap_read: want=8, got=7 0000: 30 05 02 01 04 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x3f69170 ptr=0x3f69170 end=0x3f69175 len=5 0000: 02 01 04 42 00 ...B. op tag 0x42, time 1271191556 ber_get_next tls_read: want=5, got=5 0000: 15 03 01 00 20 .... tls_read: want=32, got=32 0000: 04 7f 9e 27 41 7e af b2 de ec b2 b5 e9 b5 15 d7 ...'A~.......... 0010: 5f 1a 9a 5f 64 8e cf d5 8e a6 d4 e2 8b 4e 27 6e _.._d........N'n TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 18 failed errno=0 (Success) connection_read(18): input error=-2 id=1013, closing. connection_closing: readying conn=1013 sd=18 for close hdb_delete: deleted id=0000000a dn="reqStart=20100413191807.000009Z,cn=accesslog" daemon: activity on 1 descriptor daemon: activity on: send_ldap_result: conn=-1 op=0 p=0 connection_close: deferring conn=1013 sd=18 send_ldap_result: err=0 matched="" text="" daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero conn=1013 op=3 do_unbind conn=1013 op=3 UNBIND hdb_modify: cn=accesslog bdb_dn2entry("cn=accesslog") bdb_modify_internal: 0x00000001: cn=accesslog <= acl_access_allowed: granted to database root bdb_modify_internal: replace entryCSN connection_resched: attempting closing conn=1013 sd=18 connection_close: conn=1013 sd=18 => key_change(DELETE,1) bdb_idl_delete_key: 1 daemon: removing 18 <= key_change 0 tls_write: want=37, written=37 0000: 15 03 01 00 20 32 b4 ef e6 42 1b 72 80 46 e6 b5 .... 2...B.r.F.. 0010: d5 f4 ad 44 4f 37 eb c5 03 75 69 29 17 f3 be ac ...DO7...ui).... 0020: 4e 60 80 e2 4e N`..N => key_change(ADD,1) bdb_idl_insert_key: 1 TLS trace: SSL3 alert write:warning:close notify <= key_change 0 => entry_encode(0x00000001): <= entry_encode(0x00000001): conn=1013 fd=18 closed --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#6519) syncprov sends bogus cookie on accesslog purge
by quanah＠zimbra.com 13 Apr '10

13 Apr '10

Full_Name: Quanah Gibson-Mount Version: 2.4.21 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.45.108) When the accesslog database is purged, the syncprov overlay sends a bogus cookie response to open syncrepl clients, causing them to drop connection. This bogus cookie should never have been sent. >From the slapd log on the provider, we have the initial connection: Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 fd=18 ACCEPT from IP=10.18.97.26:60034 (IP=10.18.97.79:389) Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=0 STARTTLS Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=0 RESULT oid= err=0 text= Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 fd=18 TLS established tls_ssf=256 ssf=256 Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=1 BIND dn="uid=zmreplica,cn=admins,cn=zimbra" method=128 Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=1 BIND dn="uid=zmreplica,cn=admins,cn=zimbra" mech=SIMPLE ssf=0 Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=1 RESULT tag=97 err=0 text= Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" Apr 13 13:16:43 freelancer slapd[4276]: conn=1013 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Approximately 30 minutes later (which is my setting), the purge takes place: Apr 13 13:45:54 freelancer slapd[4276]: slap_queue_csn: queing 0x446a7200 20100413204554.501961Z#000000#000#000000 Apr 13 13:45:54 freelancer slapd[4276]: slap_queue_csn: queing 0x395e788 20100413204554.501961Z#000000#000#000000 Apr 13 13:45:54 freelancer slapd[4276]: slap_graduate_commit_csn: removing 0x3f94690 20100413204554.501961Z#000000#000#000000 Apr 13 13:45:54 freelancer slapd[4276]: syncprov_sendresp: cookie=rid=100,csn=20100413204554.501961Z#000000#000#000000 Apr 13 13:45:54 freelancer slapd[4276]: conn=2605 op=2 RESULT tag=105 err=0 text= Apr 13 13:45:54 freelancer slapd[4276]: slap_graduate_commit_csn: removing 0x3f80030 20100413204554.501961Z#000000#000#000000 Apr 13 13:45:54 freelancer slapd[4276]: conn=2605 op=3 SRCH base="" scope=2 deref=3 filter="(&(zimbraId=58a68771-fded-4aa2-baab-e1ac349e0028)(objectClass=zimbraAccount))" Apr 13 13:45:54 freelancer slapd[4276]: conn=2605 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Apr 13 13:45:54 freelancer slapd[4276]: conn=2605 fd=20 closed (connection lost) Apr 13 13:45:54 freelancer slapd[4276]: conn=2603 fd=38 closed (connection lost) Apr 13 13:45:54 freelancer slapd[4276]: conn=2602 fd=37 closed (connection lost) Apr 13 13:45:56 freelancer slapd[4276]: syncprov_sendresp: cookie= Apr 13 13:45:56 freelancer slapd[4276]: conn=1013 op=3 UNBIND Apr 13 13:45:56 freelancer slapd[4276]: conn=1013 fd=18 closed As you can see, an empty cookie is sent, and the consumer immediately closes connection, re-establishing it shortly thereafter: Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 fd=18 ACCEPT from IP=10.18.97.26:36796 (IP=10.18.97.79:389) Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=0 STARTTLS Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=0 RESULT oid= err=0 text= Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 fd=18 TLS established tls_ssf=256 ssf=256 Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=1 BIND dn="uid=zmreplica,cn=admins,cn=zimbra" method=128 Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=1 BIND dn="uid=zmreplica,cn=admins,cn=zimbra" mech=SIMPLE ssf=0 Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=1 RESULT tag=97 err=0 text= Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=2 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" Apr 13 13:46:56 freelancer slapd[4276]: conn=2671 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Apr 13 13:46:56 freelancer slapd[4276]: Entry reqStart=20100413204554.000009Z,cn=accesslog CSN 20100413204554.501961Z#000000#000#000000 older or equal to ctx 20100413204554.501961Z#000000#000#000000 Apr 13 13:46:56 freelancer slapd[4276]: syncprov_search_response: cookie=rid=100,csn=20100413204656.794873Z#000000#000#000000

1 0

Re: (ITS#6474) test004 (hdb) crashes when slapd is compiled with -D_FORTIFY_SOURCE=2
by hyc＠symas.com 13 Apr '10

13 Apr '10

h.b.furuseth(a)usit.uio.no wrote: >> There is no real buffer overflow here AFAICS but the real problem is, >> that the destination of the strcpy() is defined as char[1] in this >> case (it's the nrdn member of a struct diskNode). The additional >> runtime check when compiling with -D_FORTIFY_SOURCE=2 sees that the >> destination data will not fit in there and aborts. > > This is similar to the struct hack, except nrdn is not the last struct > member. IIRC it actually is invalid to use nrdn as an accessor for the > following struct members (from the compiler's point of view). > > Another case of "not quite the Struct Hack" broke last year: ITS#6303. > If _FORTIFY_SOURCE is warning us that gcc might break this code, the > memcpy patch might merely shut up the warning without fixing the > problem. In that case, the simplest change would be to do away with > struct diskNode - or keep it for reference but not actually use it. > > I'm reopening the ITS for someone else to decide if they care, I have > other things on my mind currently. > Nope, we don't care. The purpose and usage of diskNode is thoroughly documented in the comments and all of the uses are correct. Marking this Test again. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6474) test004 (hdb) crashes when slapd is compiled with -D_FORTIFY_SOURCE=2
by h.b.furuseth＠usit.uio.no 13 Apr '10

13 Apr '10

> There is no real buffer overflow here AFAICS but the real problem is, > that the destination of the strcpy() is defined as char[1] in this > case (it's the nrdn member of a struct diskNode). The additional > runtime check when compiling with -D_FORTIFY_SOURCE=2 sees that the > destination data will not fit in there and aborts. This is similar to the struct hack, except nrdn is not the last struct member. IIRC it actually is invalid to use nrdn as an accessor for the following struct members (from the compiler's point of view). Another case of "not quite the Struct Hack" broke last year: ITS#6303. If _FORTIFY_SOURCE is warning us that gcc might break this code, the memcpy patch might merely shut up the warning without fixing the problem. In that case, the simplest change would be to do away with struct diskNode - or keep it for reference but not actually use it. I'm reopening the ITS for someone else to decide if they care, I have other things on my mind currently. -- Hallvard

1 0

Re: (ITS#6517) undefined references to ldif_*
by michael＠stroeder.com 13 Apr '10

13 Apr '10

masarati(a)aero.polimi.it wrote: >> masarati(a)aero.polimi.it wrote: > >>> Actually it's not that; Michael routinely builds with --enable-dynamic, >>> and libldap now (dynamically) depends on liblutil for the LDIF part. >>> >> I did not want to introduce any new dependencies nor break any existing >> code with the new LDIF library. Ideally, you would only have to link >> with -lldif for external code that wants to use the LDIF API (such as >> ldif_get_entry or ldif_parse_line). Any existing code, or code that >> just wants to use the new higher level api ldap_parse_ldif_record_x >> would only have to link with -lldap. >> >> Is --enable-dynamic the only additional build flag I need to use? > > In fact, you did not introduce any further dependence, as ldif_* functions > (those provided in liblutil/ldif.c) are present in liblutil. I fixed the > issue by reversing the link order of libraries. > > It used to be liblutil, liblber, libldap (I think that was because earlier > there used to be dependencies of liblutil on the others, please correct > me). Now it's libldap, liblber, liblutil, and it builds fine with > --enable-dynamic=yes/no. Please check whether my fix is appropriate. It seems to work for me now. Ciao, Michael.

1 0

Re: (ITS#6517) undefined references to ldif_*
by richm＠stanfordalumni.org 13 Apr '10

13 Apr '10

masarati(a)aero.polimi.it wrote: >> masarati(a)aero.polimi.it wrote: >> > > >>> Actually it's not that; Michael routinely builds with --enable-dynamic, >>> and libldap now (dynamically) depends on liblutil for the LDIF part. >>> >>> >> I did not want to introduce any new dependencies nor break any existing >> code with the new LDIF library. Ideally, you would only have to link >> with -lldif for external code that wants to use the LDIF API (such as >> ldif_get_entry or ldif_parse_line). Any existing code, or code that >> just wants to use the new higher level api ldap_parse_ldif_record_x >> would only have to link with -lldap. >> >> Is --enable-dynamic the only additional build flag I need to use? >> > > In fact, you did not introduce any further dependence, as ldif_* functions > (those provided in liblutil/ldif.c) are present in liblutil. I fixed the > issue by reversing the link order of libraries. > > It used to be liblutil, liblber, libldap (I think that was because earlier > there used to be dependencies of liblutil on the others, please correct > me). Now it's libldap, liblber, liblutil, and it builds fine with > --enable-dynamic=yes/no. Please check whether my fix is appropriate. > I just pulled the latest code from anonymous(a)cvs.openldap.org - started from a clean directory - ran configure with --enable-dynamic --disable-static - make depend and make install - build completed successfully - server works fine, ldapmodify works fine > p. > > > > >

1 0

Re: (ITS#6517) undefined references to ldif_*
by masarati＠aero.polimi.it 13 Apr '10

13 Apr '10

> masarati(a)aero.polimi.it wrote: >> Actually it's not that; Michael routinely builds with --enable-dynamic, >> and libldap now (dynamically) depends on liblutil for the LDIF part. >> > I did not want to introduce any new dependencies nor break any existing > code with the new LDIF library. Ideally, you would only have to link > with -lldif for external code that wants to use the LDIF API (such as > ldif_get_entry or ldif_parse_line). Any existing code, or code that > just wants to use the new higher level api ldap_parse_ldif_record_x > would only have to link with -lldap. > > Is --enable-dynamic the only additional build flag I need to use? In fact, you did not introduce any further dependence, as ldif_* functions (those provided in liblutil/ldif.c) are present in liblutil. I fixed the issue by reversing the link order of libraries. It used to be liblutil, liblber, libldap (I think that was because earlier there used to be dependencies of liblutil on the others, please correct me). Now it's libldap, liblber, liblutil, and it builds fine with --enable-dynamic=yes/no. Please check whether my fix is appropriate. p.

1 0

Re: (ITS#6517) undefined references to ldif_*
by richm＠stanfordalumni.org 13 Apr '10

13 Apr '10

masarati(a)aero.polimi.it wrote: >> Michael Ströder wrote: >> >>> hyc(a)symas.com wrote: >>> >>>> richm(a)stanfordalumni.org wrote: >>>> >>>>> This is most likely related to my recent LDIF changes. But I didn't >>>>> see >>>>> this problem. What platform is this? What build flags are you using? >>>>> >>>> Built fine here too, looks like an inconsistent build tree over there. >>>> >>> The build with the same build flags on the very same system worked right >>> before the recent libldif check-ins. I'm using anon CVS pserver for cvs >>> up. >>> >> The anon CVS server has some lag in receiving updates from the master >> server. >> Don't you have an account on the master? >> > > Actually it's not that; Michael routinely builds with --enable-dynamic, > and libldap now (dynamically) depends on liblutil for the LDIF part. > I did not want to introduce any new dependencies nor break any existing code with the new LDIF library. Ideally, you would only have to link with -lldif for external code that wants to use the LDIF API (such as ldif_get_entry or ldif_parse_line). Any existing code, or code that just wants to use the new higher level api ldap_parse_ldif_record_x would only have to link with -lldap. Is --enable-dynamic the only additional build flag I need to use? > p. > > > > > >

1 0

Re: (ITS#6513) dynacl/aci fails on searches with attributes
by peter＠adpm.de 13 Apr '10

13 Apr '10

--Boundary-00=_glFxL04kLcJl7l6 Content-Type: Text/Plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable Thanks for your quick answer Pierangelo, On Monday, 12. April 2010, masarati(a)aero.polimi.it wrote: > > [...] > > My guess is that you're trying to use ACIs with a non-local storage. In > > that case your analysis is correct. Can you provide your (sanitized) > > configuration? I am using a local hdb backend. In order to generate a minimal test case I found out, that it seems to be=20 related to the rwm overlay. Although I have set rwm-rewriteEngine to off, rwm seems to be partially=20 active. Commenting out the rwm directives completely makes the searches work as=20 expected. Please find attached a testcase with slapd.conf and ldif data. To experience the issue simply perform a search with e.g. attribute 1.1 as = one=20 of the users in the data. Then comment the rwm-... lines in slapd.conf, restart slapd and try again. Voil=E0 the difference. > > [...] >=20 > Automatically detecting what attributes need to be added to requests for > proxying sounds like an overkill. Probably, a reasonable workaround could > be to add a configuration directive that lists what attributes need to be > added to requests. This directive should be honored by proxy backends and > in general by all those backends that do not pass back complete entries to > the frontend. In the case of proxy backends its use would be > straightforward, since requested attrs need to be mapped anyway in the > request. Adding some more would not be a big deal. =20 That would be absolutely sufficient for me. > Things might be a bit > more complicated in case of, say, special configurations like proxycache, > where ACIs would need to be added to all attribute templates, and so. Yet > another reason to avoid ACIs :) As much as I'd like to, but I fear I can't. I am trying to migrate from a non-OpenLDAP directory solution with a comple= x=20 permission structure in in-tree ACLs to OpenLDAP. Unfortunately the permissions are set up in a way that do not let them writ= e=20 as a short list of ACLs. Changing the permission structure is not possible as lots of applications=20 depend on it. =2D-=20 Peter Marschall peter(a)adpm.de --Boundary-00=_glFxL04kLcJl7l6 Content-Type: application/x-compressed-tar; name="testcase.tgz" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="testcase.tgz" H4sIAOZWxEsAA+1YbW/jNgzuV/tXCMkBa3duXtz0CqQItq7JDTcc0sOKfjp0gyzJiTZH8iS5Sfbr R8mOm+SSJn1bN8AEAtsUxYekSJqOTnBKG0SK+ODVqAX0odOy1/bZqbsCI8yvrVYHFg/a7ZMP7dZp q3MG/HZ42jo9QK3XM+meMm2wQuhggpUmY5xukwOx+BVj9FZUR01mSDOhOG3qMhfQ8TG6Spn43L/4 giaYC6SZumMK2UU+yhQ2XAoU84T5fh1xQZKMsg2riM0MExoedYAgvmyC4abRaPjFHm8J3i03iVSs kd8/JKS52C0GMkaqUcqUlmIhDQZPx0wxRCUyY4ZUJgyfMGevRiPpp5zae89r3mHVhOU8MkV8YNXH aqSdyEYJu2pREjkacTFChzVIHqNriGsUS4XsE9eGE33kg0zC7ljiORF0cfnZ7lQMU4QJYTrfgcU8 knSOjERKStO/HgCLouvcoVzQM9KjosFmmJhereZ70dz73mnaKEBEL4/HiqTD1kZxYvgdhIaPxmAV wMroD0bMZYLBImxAIMoMQzJGOEmKRb2EY0V0b2mTA1lBv6ATLgLZM4BXgyQTeMScVAa5pnNz7CMW UswnMgPczIy3W2i3fQGkqVR0l2HLsg5EsyRGvensEWau2ZUHEXiuItYDp6FG0OBq2OgPVk9DZ5FR jPVqBcIjDKBzgUnSxISjqeKGrZkQYfInE7QpoW4TPEcTSTOb4Hmo/PwxxWbsNTOtmgmP8tIpVhKJ qWd1/D6m0TJPTSc+6H8ZAjspNjjCGsqRxVxw2zr0i6n3F9o964WrfGyg8G0coPT7P9meZWyDOzQy RZHCAopC2/yx6/ZojnydxTGfeV55RusdpHRh0UJAm2VzBUcvFcQe3jLQCqHoj/ySmzePMu5WtdWM 7XmDJHRRqb7ToAVahRhlXI8ZRQJDp7K1ny7S1zYEKsC69VxxK+nU80pR0P5JUE7yLLB93boO7ZOy mZcnKrHFGjBh1Pzyepjf3Nx86nse+6sQJCLQIhhB9YkhWBOAniSQgcycjKtPl4+oyLwuIKUIyaz3 9bfg9n1hHrImoPzeLyQ9l1zwOy5UDAQ0UObJOF7mXsKRwXvFg4TBWWKWl37NbN+uHTbeB0c/AOKh gzwK1sDf1VDtXRuY78Kysmrd2iYQzbAi4488MUxtXx/YOPWHD5myAX8f5AtoWP0hdDOONdoKttgz wQbyl+6/QbGYKYWTHOYhCViFsx1cffTfemap6OXItq5GQvlrjrb5/N/ZOv93OmeL+T/sdNp2/j9p n1Tz/79Bdei8djzvoja8LOGy6Mj3b4MudOp0lQEzNRb8bzfn+xIE7JbFBwMMJF3UqrtXR30Eb1Rz rgIS6IAGs/Ovjn1bT7Mo4aReYGY9mPrTdvBocJxkMDL4Musip+H5RoTPNiJ8nhE3dvwNXiQkTtW6 NcXEuc2e/HVuB2TClOExJ9iw0sg9dS3mA1HOBwnIyCytw5Byaf0qvfzZsr/1d1+jYcq/PZ8G95wc LUglFGxCJGWBtjtNANPQZJhNIqbqdtrfEvDnHf9/N+DhloCHbxDwLUf+pIjnup5XcVsi8jb2wHmR RYEET2wH+f8dq7yVv0J8IoqGadX7y5/D3fsvC3uyS2I/uug0HL6G/WUd+2XqddEvkq34EW70Y88Y 7+9HuJ8f4TY/wl1+7GxYD3viavEqtt9LejX42p8wWyP7nvxjMmu1Th1MPf/34ZjT+n543xzmQ03k CUEINwZhR9q8eBB24FWfPBVVVFFFFVVUUUUVVVRRRRVVVNH/l/4B1nCcvQAoAAA= --Boundary-00=_glFxL04kLcJl7l6--

1 0

Re: (ITS#6515) A lot of dead links on main page of OpenLDAP man.
by mitroko＠gmail.com 13 Apr '10

13 Apr '10

--000e0ce0457c739d9a04841af395 Content-Type: text/plain; charset=UTF-8 http://www.openldap.org/doc/admin24/schema.html - Contains them, as well On Mon, Apr 12, 2010 at 10:10 PM, Howard Chu <hyc(a)symas.com> wrote: > mitroko(a)gmail.com wrote: > >> Full_Name: Dmitry Stremkouski >> Version: >> OS: GNU/Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (95.84.189.132) >> >> >> Hello guys. The part of OpenLDAP Manual (wich can be found here - >> http://www.openldap.org/doc/admin23/schema.html) contains a lot of broken >> links. >> Please correct. >> > > The 2.3 release is no longer maintained. This doc will not be updated. > > FE: http://www.alvestrand.no/harald/objectid/ - dead >> A: http://www.bsa-global.com/ - dead (doesn't look good enough for global >> OID >> authority) >> A: http://www.iana.org/cgi-bin/enterprise.pl - should be (redirect, but >> futher, >> IMHO, will be dead, try http://pen.iana.org/pen/PenApplication.page) >> >> Thanks. >> > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > -- <pre> (o_ - Dzmitry Stremkouski. //\ - cel: +7 (916) 090-85-68 V_/_- web: http://mitroko.com </pre> --000e0ce0457c739d9a04841af395 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <a href=3D"http://www.openldap.org/doc/admin24/schema.html">http://www.open= ldap.org/doc/admin24/schema.html</a> - Contains them, as well <div c= lass=3D"gmail_quote">On Mon, Apr 12, 2010 at 10:10 PM, Howard Chu <<a href=3D"mailto:hyc@symas.com">hyc(a)symas.com</a>> = wrote: <blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, = 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><a href=3D"mailto= :mitroko@gmail.com" target=3D"_blank">mitroko(a)gmail.com</a> wrote: <blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, = 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Full_Name: Dmitry Stremkouski Version: OS: GNU/Linux URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_blank">ftp://f= tp.openldap.org/incoming/</a> Submission from: (NULL) (95.84.189.132) Hello guys. The part of OpenLDAP Manual (wich can be found here - <a href=3D"http://www.openldap.org/doc/admin23/schema.html" target=3D"_blan= k">http://www.openldap.org/doc/admin23/schema.html</a>) contains a lot of b= roken links. Please correct. </blockquote> The 2.3 release is no longer maintained. This doc will not be updated. <blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, = 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> FE: <a href=3D"http://www.alvestrand.no/harald/objectid/" target=3D"_blank"= >http://www.alvestrand.no/harald/objectid/</a> - dead A: <a href=3D"http://www.bsa-global.com/" target=3D"_blank">http://www.bsa-= global.com/</a> - dead (doesn't look good enough for global OID authority) A: <a href=3D"http://www.iana.org/cgi-bin/enterprise.pl" target=3D"_blank">= http://www.iana.org/cgi-bin/enterprise.pl</a> - should be (redirect, but fu= ther, IMHO, will be dead, try <a href=3D"http://pen.iana.org/pen/PenApplication.p= age" target=3D"_blank">http://pen.iana.org/pen/PenApplication.page</a>) Thanks. </blockquote> -- =C2=A0-- Howard Chu =C2=A0CTO, Symas Corp. =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"http:= //www.symas.com" target=3D"_blank">http://www.symas.com</a> =C2=A0Director, Highland Sun =C2=A0 =C2=A0 <a href=3D"http://highlandsun.c= om/hyc/" target=3D"_blank">http://highlandsun.com/hyc/</a> =C2=A0Chief Architect, OpenLDAP =C2=A0<a href=3D"http://www.openldap.org/p= roject/" target=3D"_blank">http://www.openldap.org/project/</a> </blockquote></div> -- <pre> (o_ - Dz= mitry Stremkouski. //\ - cel: +7 (916) 090-85-68 V_/_- web: <a href= =3D"http://mitroko.com">http://mitroko.com</a> </pre> --000e0ce0457c739d9a04841af395--

1 0

(ITS#6518) Slapd-ldap proxy between replica and mirror
by udorta＠iac.es 13 Apr '10

13 Apr '10

Full_Name: Ubay Dorta Version: 2.4.21 OS: Suse Linux Enterprise Server 10 SP2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (161.72.9.46) We have problems when we introduce a back-ldap proxy server between a delta-syncrepl server and a mirror configuration of two servers. The modifications through the replica server (with chaining configuration) over the first mirror server are made without problems. The problem appears when we introduce a back-ldap proxy between replica and the two servers in mirror mode. First Scenario: --------------------- A delta syncrepl server replicating from the first server of a mirror. IPs: delta syncrepl (192.168.1.5), mirror server 1 (192.168.1.10), mirror server 2 (192.168.1.20) replica slapd.conf ##################### # Chaining configuration # ##################### overlay chain chain-uri "ldap://mirror1:389" chain-idassert-bind bindmethod="simple" binddn="cn=replicator,dc=example,dc=com" credentials="secret" mode="self" chain-return-error TRUE ########## # Replica # ########## database bdb suffix "dc=example,dc=com" rootdn "cn=Administrator,dc=example,dc=com" rootpw "secret" checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres overlay ppolicy ppolicy_default "cn=Default Password Policy,dc=example,dc=com" ppolicy_forward_updates ppolicy_hash_cleartext overlay memberof ################## # Syncrepl directives # ################## syncrepl rid=001 provider=ldap://mirror1:389 type=refreshAndPersist retry="60 +" searchbase="dc=example,dc=com" filter="(objectclass=*)" scope=sub attrs="*" schemachecking=on binddn="cn=replicator,dc=example,dc=com" bindmethod=simple credentials=secret sizelimit=unlimited logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog # Refer updates to the master updateref ldap://mirror1:389 ------------------------- ------------------------- slapd.conf of mirror server #1 ------------------------------------------- # Global section serverID 1 moduleload memberof access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by dn.base="cn=replicator,dc=example,dc=com" read by * auth access to attrs=shadowLastChange by self write by * read # Give the replica DN unlimited read access. This ACL needs to be # merged with other ACL statements, and/or moved within the scope # of a database. The "by * break" portion causes evaluation of # subsequent rules. See slapd.access(5) for details. access to * by dn.base="cn=replicator,dc=example,dc=com" read by * break access to * by * read # Load the accesslog overlay moduleload accesslog.la #Load the syncprov overlay moduleload syncprov.la # Accesslog database definitions database bdb monitoring off suffix cn=accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ####################################################################### # BDB database definitions ####################################################################### database bdb monitoring off suffix "dc=example,dc=com" rootdn "cn=Administrator,dc=example,dc=com" rootpw "secret" checkpoint 1024 5 cachesize 10000 index objectClass,uidNumber,gidNumber eq index member,mail eq,pres index cn,displayname,uid,sn,givenname sub,eq,pres overlay ppolicy ppolicy_default "cn=Default Password Policy,dc=example,dc=com" ppolicy_hash_cleartext overlay memberof # Habilitar authz-policiy authz-policy to index entryCSN eq index entryUUID eq # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #################################################### # MirrorMode - Syncrepl directive syncrepl rid=001 provider=ldap://mirror2:389 bindmethod=simple binddn="cn=Administrator,dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on --------------- --------------- In the mirror servers we have set the attribute authzTo for the replicator dn: ldapsearch -x -b 'cn=replicator,dc=example,dc=com' -H ldap://mirror1:389 -D 'cn=Administrator,dc=example,dc=com' -w secret authzTo # replicator, example.com dn: cn=replicator,dc=example,dc=com authzTo: ldap:///dc=example,dc=com??sub?(objectClass=person) When we launch the following modification through the replica: ldapmodify -x -H ldap://replica:389 -f pass1_user.ldif -D 'uid=user,ou=people,dc=example,dc=com' -W Enter LDAP Password: modifying entry "uid=user,ou=people,dc=example,dc=com" In the mirror server we get: ldap-mirror1[2649]: conn=1002 op=2 PROXYAUTHZ dn="uid=user,ou=people,dc=example,dc=com" ldap-mirror1[2649]: conn=1002 op=2 MOD dn="uid=user,ou=people,dc=example,dc=com" ldap-mirror1[2649]: conn=1002 op=2 MOD attr=userPassword ldap-mirror1[2649]: conn=1002 op=2 RESULT tag=103 err=0 text= Therefore modifying through the replica server is possible with the chaining configuration. Second sceneario -------------------------- The problem appears when we introduce the back-ldap proxy server to set the high availability feature that provides the mirror mode. IPs: ----- 192.168.1.5 -> delta syncrepl 192.168.1.10 -> Back-ldap proxy 192.168.1.20 -> Mirror mode server 1 192.168.1.30 -> Mirror mode server 2 back-ldap proxy slapd.conf: database ldap suffix "dc=example,dc=com" uri "ldap://mirror1:389 ldap://mirror2:389" rootdn "cn=Administrator,dc=example,dc=com" overlay ppolicy Launching the modification to the proxy, it works: ldapmodify -x -H ldap://proxy:389 -f pass1_user.ldif -D 'uid=user,ou=people,dc=example,dc=com' -W Enter LDAP Password: modifying entry "uid=udg77530,ou=people,dc=example,dc=com" The /var/log/messages of proxy and mirror shows the following: ldap-proxy[4051]: conn=1000 fd=8 ACCEPT from IP=192.168.1.5:42921 (IP=192.168.1.10:389) ldap-proxy[4051]: conn=1000 op=0 BIND dn="uid=user,ou=people,dc=example,dc=com" method=128 ldap-mirror1[3438]: conn=1015 fd=19 ACCEPT from IP=192.168.1.10:18103 (IP=192.168.1.20:1389) ldap-mirror1[3438]: conn=1015 op=0 BIND dn="" method=128 ldap-mirror1[3438]: conn=1015 op=0 RESULT tag=97 err=0 text= ldap-mirror1[3438]: conn=1015 op=1 SRCH base="uid=user,ou=people,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" ldap-mirror1[3438]: conn=1015 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= ldap-mirror1[3438]: conn=1016 fd=20 ACCEPT from IP=192.168.1.10:18104 (IP=192.168.1.20:1389) ldap-mirror1[3438]: conn=1016 op=0 BIND dn="uid=user,ou=people,dc=example,dc=com" method=128 ldap-mirror1[3438]: conn=1016 op=0 BIND dn="uid=user,ou=people,dc=example,dc=com" mech=SIMPLE ssf=0 ldap-mirror1[3438]: conn=1016 op=0 RESULT tag=97 err=0 text= ldap-proxy[4051]: conn=1000 op=0 BIND dn="uid=user,ou=people,dc=example,dc=com" mech=SIMPLE ssf=0 ldap-mirror1[3438]: conn=1015 op=2 SRCH base="uid=user,ou=people,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" ldap-mirror1[3438]: conn=1015 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= ldap-proxy[4051]: conn=1000 op=0 RESULT tag=97 err=0 text= ldap-proxy[4051]: conn=1000 op=1 MOD dn="uid=user,ou=people,dc=example,dc=com" ldap-proxy[4051]: conn=1000 op=1 MOD attr=userPassword ldap-mirror1[3438]: conn=1015 op=3 SRCH base="uid=user,ou=people,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" ldap-mirror1[3438]: conn=1015 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= ldap-mirror1[3438]: conn=1016 op=1 MOD dn="uid=user,ou=people,dc=example,dc=com" ldap-mirror1[3438]: conn=1016 op=1 MOD attr=userPassword ldap-mirror1[3438]: conn=1016 op=1 RESULT tag=103 err=0 text= ldap-proxy[4051]: conn=1000 op=1 RESULT tag=103 err=0 text= ldap-proxy[4051]: conn=1000 op=2 UNBIND ldap-mirror1[3438]: conn=1016 op=2 UNBIND ldap-mirror1[3438]: conn=1016 fd=20 closed ldap-proxy[4051]: conn=1000 fd=8 closed But when the modification is made through the replica server we get the error: ldapmodify -x -H ldap://replica:389 -f pass1_user.ldif -D 'uid=user,ou=people,dc=example,dc=com' -W Enter LDAP Password: modifying entry "uid=user,ou=people,dc=rexample,dc=com" ldap_modify: unknown result code (123) ldap-proxy[3688]: daemon: activity on 1 descriptor ldap-proxy[3688]: daemon: activity on: ldap-proxy[3688]: 12r ldap-proxy[3688]: ldap-proxy[3688]: daemon: read active on 12 ldap-proxy[3688]: daemon: epoll: listen=7 active_threads=0 tvp=NULL ldap-proxy[3688]: connection_get(12) ldap-proxy[3688]: connection_get(12): got connid=1001 ldap-proxy[3688]: connection_read(12): checking for input on id=1001 ldap-proxy[3688]: op tag 0x66, time 1271064513 ldap-proxy[3688]: conn=1001 op=2 do_modify ldap-proxy[3688]: conn=1001 op=2 do_modify: dn (uid=user,ou=people,dc=example,dc=com) ldap-proxy[3688]: => get_ctrls ldap-proxy[3688]: => get_ctrls: oid="2.16.840.1.113730.3.4.18" (noncritical) ldap-proxy[3688]: parseProxyAuthz: conn 1001 authzid="dn:uid=user,ou=people,dc=example,dc=com" ldap-proxy[3688]: slap_sasl_getdn: conn 1001 id=dn:uid=user,ou=people,dc=example,dc=com [len=38] ldap-proxy[3688]: >>> dnNormalize: <uid=user,ou=people,dc=example,dc=com> ldap-proxy[3688]: <<< dnNormalize: <uid=user,ou=people,dc=example,dc=com> ldap-proxy[3688]: ==>slap_sasl2dn: converting SASL name uid=user,ou=people,dc=example,dc=com to a DN ldap-proxy[3688]: <==slap_sasl2dn: Converted SASL name to <nothing> ldap-proxy[3688]: parseProxyAuthz: conn=1001 "uid=user,ou=people,dc=example,dc=com" ldap-proxy[3688]: ==>slap_sasl_authorized: can cn=replicator,dc=example,dc=com become uid=user,ou=people,dc=example,dc=com? ldap-proxy[3688]: <== slap_sasl_authorized: return 48 ldap-proxy[3688]: <= get_ctrls: n=1 rc=123 err="not authorized to assume identity" ldap-proxy[3688]: send_ldap_result: conn=1001 op=2 p=3 ldap-proxy[3688]: send_ldap_result: err=123 matched="" text="not authorized to assume identity" ldap-proxy[3688]: send_ldap_response: msgid=3 tag=103 err=123 ldap-proxy[3688]: conn=1001 op=2 RESULT tag=103 err=123 text=not authorized to assume identity ldap-proxy[3688]: conn=1001 op=2 do_modify: get_ctrls failed ldap-proxy[3688]: daemon: activity on 1 descriptor ldap-proxy[3688]: daemon: activity on: ldap-proxy[3688]: ldap-proxy[3688]: daemon: epoll: listen=7 active_threads=0 tvp=NULL The file pass1_user.ldif has: dn: uid=user,ou=people,dc=example,dc=com changetype: modify replace: userPassword userPassword: ####CRYPT PASSWORD#### Thanks

1 0

Re: (ITS#6517) undefined references to ldif_*
by masarati＠aero.polimi.it 12 Apr '10

12 Apr '10

> Michael Ströder wrote: >> hyc(a)symas.com wrote: >>> richm(a)stanfordalumni.org wrote: >>>> This is most likely related to my recent LDIF changes. But I didn't >>>> see >>>> this problem. What platform is this? What build flags are you using? >>> >>> Built fine here too, looks like an inconsistent build tree over there. >> >> The build with the same build flags on the very same system worked right >> before the recent libldif check-ins. I'm using anon CVS pserver for cvs >> up. > > The anon CVS server has some lag in receiving updates from the master > server. > Don't you have an account on the master? Actually it's not that; Michael routinely builds with --enable-dynamic, and libldap now (dynamically) depends on liblutil for the LDIF part. p.

1 0

Re: (ITS#6194) Patch - Enhancement - provide LDIF support as libldif
by richm＠stanfordalumni.org 12 Apr '10

12 Apr '10

masarati(a)aero.polimi.it wrote: >>>> Sorry about that. You can find it here: >>>> http://rmeggins.fedorapeople.org/ldifutil.c >>>> >>> Gotit, thanks. I have one first comment: the public API does not >>> generally expose the memory context. I'm renaming >>> ldap_parse_ldif_record() as ldap_parse_ldif_record_x(), and eliminating >>> the void *ctx arg from ldap_parse_ldif_record(), if you don't mind. >>> >> tested and applied to HEAD; please test. Thanks, p. >> > > More comments: > > 1) perhaps it may be worth providing a function that converts a LDIFRecord > structure into a string, and one that sends it to a stream > For debugging purposes, or something like that? > 2) I note you put > > LDAPMod **lr_mods; /* list of mods for LDAP_REQ_MODIFY, > LDAP_REQ_ADD */ > struct berval lr_newrdn; /* LDAP_REQ_MODDN, LDAP_REQ_MODRDN, > LDAP_REQ_RENAME */ > struct berval lr_newsuperior; /* LDAP_REQ_MODDN, LDAP_REQ_MODRDN, > LDAP_REQ_RENAME */ > int lr_deleteoldrdn; /* LDAP_REQ_MODDN, LDAP_REQ_MODRDN, > LDAP_REQ_RENAME */ > /* the following are for future support */ > struct berval lr_extop_oid; /* LDAP_REQ_EXTENDED */ > struct berval lr_extop_data; /* LDAP_REQ_EXTENDED */ > struct berval lr_cmp_attr; /* LDAP_REQ_COMPARE */ > struct berval lr_cmp_bvalue; /* LDAP_REQ_COMPARE */ > > in the structure; the last four are not used right now. I think it would > make sense to group struct members by op in substructures, and then put > them in a union, to stress the fact that they're mutually exclusive. Much > like Howard did for the corresponding substructures in the Operation > struct in slapd. > Please check out this patch - ftp://ftp.openldap.org/incoming/openldap-2.4.21-ldifrecord-union-20100412.p… > p. > > > > >

1 0

Re: (ITS#6517) undefined references to ldif_*
by hyc＠symas.com 12 Apr '10

12 Apr '10

Michael Ströder wrote: > hyc(a)symas.com wrote: >> richm(a)stanfordalumni.org wrote: >>> This is most likely related to my recent LDIF changes. But I didn't see >>> this problem. What platform is this? What build flags are you using? >> >> Built fine here too, looks like an inconsistent build tree over there. > > The build with the same build flags on the very same system worked right > before the recent libldif check-ins. I'm using anon CVS pserver for cvs up. The anon CVS server has some lag in receiving updates from the master server. Don't you have an account on the master? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6517) undefined references to ldif_*
by michael＠stroeder.com 12 Apr '10

12 Apr '10

hyc(a)symas.com wrote: > richm(a)stanfordalumni.org wrote: >> michael(a)stroeder.com wrote: >>> Full_Name: >>> Version: HEAD >>> OS: Linux >>> URL: >>> Submission from: (NULL) (84.163.96.140) >>> >>> >>> cc -g -O2 -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -o >>> .libs/ldapurl ldapurl.o lduversion.o -L/dummy/lib >>> ../../libraries/liblutil/liblutil.a ../../libraries/libldap/.libs/libldap.so >>> /usr/src/michael/openldap/HEAD/openldap/libraries/liblber/.libs/liblber.so >>> ../../libraries/liblber/.libs/liblber.so -lsasl2 -lssl -lcrypto -lcrypt -lresolv >>> -Wl,--rpath -Wl,/opt/openldap-HEAD/lib >>> ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_getline' >>> ../../libraries/libldap/.libs/libldap.so: undefined reference to >>> `ldif_countlines' >>> ../../libraries/libldap/.libs/libldap.so: undefined reference to >>> `ldif_parse_line2' >>> ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_debug' >>> collect2: ld returned 1 exit status >>> make[2]: *** [ldapurl] Error 1 >>> make[2]: Leaving directory >>> `/usr/src/michael/openldap/HEAD/openldap/clients/tools' >>> make[1]: *** [all-common] Error 1 >>> make[1]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/clients' >>> make: *** [all-common] Error 1 >>> >>> >> This is most likely related to my recent LDIF changes. But I didn't see >> this problem. What platform is this? What build flags are you using? > > Built fine here too, looks like an inconsistent build tree over there. The build with the same build flags on the very same system worked right before the recent libldif check-ins. I'm using anon CVS pserver for cvs up. Ciao, Michael.

1 0

Re: (ITS#6517) undefined references to ldif_*
by hyc＠symas.com 12 Apr '10

12 Apr '10

richm(a)stanfordalumni.org wrote: > michael(a)stroeder.com wrote: >> Full_Name: >> Version: HEAD >> OS: Linux >> URL: >> Submission from: (NULL) (84.163.96.140) >> >> >> cc -g -O2 -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -o >> .libs/ldapurl ldapurl.o lduversion.o -L/dummy/lib >> ../../libraries/liblutil/liblutil.a ../../libraries/libldap/.libs/libldap.so >> /usr/src/michael/openldap/HEAD/openldap/libraries/liblber/.libs/liblber.so >> ../../libraries/liblber/.libs/liblber.so -lsasl2 -lssl -lcrypto -lcrypt -lresolv >> -Wl,--rpath -Wl,/opt/openldap-HEAD/lib >> ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_getline' >> ../../libraries/libldap/.libs/libldap.so: undefined reference to >> `ldif_countlines' >> ../../libraries/libldap/.libs/libldap.so: undefined reference to >> `ldif_parse_line2' >> ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_debug' >> collect2: ld returned 1 exit status >> make[2]: *** [ldapurl] Error 1 >> make[2]: Leaving directory >> `/usr/src/michael/openldap/HEAD/openldap/clients/tools' >> make[1]: *** [all-common] Error 1 >> make[1]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/clients' >> make: *** [all-common] Error 1 >> >> > This is most likely related to my recent LDIF changes. But I didn't see > this problem. What platform is this? What build flags are you using? Built fine here too, looks like an inconsistent build tree over there. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6517) undefined references to ldif_*
by richm＠stanfordalumni.org 12 Apr '10

12 Apr '10

michael(a)stroeder.com wrote: > Full_Name: > Version: HEAD > OS: Linux > URL: > Submission from: (NULL) (84.163.96.140) > > > cc -g -O2 -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -o > .libs/ldapurl ldapurl.o lduversion.o -L/dummy/lib > ../../libraries/liblutil/liblutil.a ../../libraries/libldap/.libs/libldap.so > /usr/src/michael/openldap/HEAD/openldap/libraries/liblber/.libs/liblber.so > ../../libraries/liblber/.libs/liblber.so -lsasl2 -lssl -lcrypto -lcrypt -lresolv > -Wl,--rpath -Wl,/opt/openldap-HEAD/lib > ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_getline' > ../../libraries/libldap/.libs/libldap.so: undefined reference to > `ldif_countlines' > ../../libraries/libldap/.libs/libldap.so: undefined reference to > `ldif_parse_line2' > ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_debug' > collect2: ld returned 1 exit status > make[2]: *** [ldapurl] Error 1 > make[2]: Leaving directory > `/usr/src/michael/openldap/HEAD/openldap/clients/tools' > make[1]: *** [all-common] Error 1 > make[1]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/clients' > make: *** [all-common] Error 1 > > This is most likely related to my recent LDIF changes. But I didn't see this problem. What platform is this? What build flags are you using?

1 0

(ITS#6517) undefined references to ldif_*
by michael＠stroeder.com 12 Apr '10

12 Apr '10

Full_Name: Version: HEAD OS: Linux URL: Submission from: (NULL) (84.163.96.140) cc -g -O2 -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -Wl,-R/dummy/lib -o .libs/ldapurl ldapurl.o lduversion.o -L/dummy/lib ../../libraries/liblutil/liblutil.a ../../libraries/libldap/.libs/libldap.so /usr/src/michael/openldap/HEAD/openldap/libraries/liblber/.libs/liblber.so ../../libraries/liblber/.libs/liblber.so -lsasl2 -lssl -lcrypto -lcrypt -lresolv -Wl,--rpath -Wl,/opt/openldap-HEAD/lib ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_getline' ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_countlines' ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_parse_line2' ../../libraries/libldap/.libs/libldap.so: undefined reference to `ldif_debug' collect2: ld returned 1 exit status make[2]: *** [ldapurl] Error 1 make[2]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/clients/tools' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/clients' make: *** [all-common] Error 1

1 0

Re: (ITS#6515) A lot of dead links on main page of OpenLDAP man.
by hyc＠symas.com 12 Apr '10

12 Apr '10

mitroko(a)gmail.com wrote: > Full_Name: Dmitry Stremkouski > Version: > OS: GNU/Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (95.84.189.132) > > > Hello guys. The part of OpenLDAP Manual (wich can be found here - > http://www.openldap.org/doc/admin23/schema.html) contains a lot of broken > links. > Please correct. The 2.3 release is no longer maintained. This doc will not be updated. > FE: http://www.alvestrand.no/harald/objectid/ - dead > A: http://www.bsa-global.com/ - dead (doesn't look good enough for global OID > authority) > A: http://www.iana.org/cgi-bin/enterprise.pl - should be (redirect, but futher, > IMHO, will be dead, try http://pen.iana.org/pen/PenApplication.page) > > Thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6516) Proxy backends normalize ordered attrs incorrectly
by masarati＠aero.polimi.it 12 Apr '10

12 Apr '10

> They need to use ordered_value_*() functions instead. Fixed in HEAD. p.

1 0

(ITS#6516) Proxy backends normalize ordered attrs incorrectly
by masarati＠aero.polimi.it 12 Apr '10

12 Apr '10

Full_Name: Pierangelo Masarati Version: HEAD/re24 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (129.72.165.199) Submitted by: ando They need to use ordered_value_*() functions instead. A patch is coming. p.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs