https://bugs.openldap.org/show_bug.cgi?id=5555
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|2.5.0 |2.6.0
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=5500
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|2.5.0 |2.6.0
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=5422
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|2.5.0 |2.6.0
Keywords|OL_2_5_REQ |OL_2_6_REQ
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=5344
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|2.5.0 |2.6.0
Keywords|OL_2_5_REQ |OL_2_6_REQ
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=5335
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|2.5.0 |2.6.0
Keywords|OL_2_5_REQ |OL_2_6_REQ
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8839
. <openldap(a)mailinator.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|never use md5 and/or sha1, |never use md5 and/or sha1,
|use sha512, file signing |use sha-3 512 and/or
| |blake3, file signing
--- Comment #1 from . <openldap(a)mailinator.com> ---
openldap-2.4.53.md5 07-Sep-2020 15:20
59
openldap-2.4.53.sha1 07-Sep-2020 15:20
68
you are still using md5 and sha1. these are broken.
use sha3-512 and/or blake3.
start signing the files. you can use gnupg for that.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=6749
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |TEST
--- Comment #4 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
Commits:
• bc021bb2
by Quanah Gibson-Mount at 2020-09-18T14:56:43+00:00
ITS#6749 - Change configure monitor warning to DEBUG CONFIG instead of DEBUG
ANY
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9317
Issue ID: 9317
Summary: LDAPS connection fails to multi-IP DNS using
DIGEST-MD5 mechanism
Product: OpenLDAP
Version: 2.4.46
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: paul.raines(a)gmail.com
Target Milestone: ---
Our MS AD ldap servers are in DNS using alias ldap.example.org at multiple IP
addresses like so:
# host ldap.example.orgldap.example.org has address 172.18.1.10
ldap.example.org has address 172.21.1.10
ldap.example.org has address 172.24.1.10
ldap.example.org has address 172.30.1.10
For CentOS 6 this was not a problem. But with CentOS 7 (2.4.44) and CentOS 8
(2.4.46) the following fails
# ldapwhoami -d -1 -H ldaps://ldap.example.org -Y DIGEST-MD5 -U username -W
with the error:
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: 80090303: LdapErr: DSID-0C090574, comment: The
digest-uri does not match any LDAP SPN's registered for this server., data 0,
v3839
ldap_free_connection 1 1
ldap_send_unbind
If one reverse DNS IP lookups one of the IPs and uses the unique name (e.g.
ldap01.example.org) instead it works fine
I think openldap should work in this case with DNS aliases.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9315
Issue ID: 9315
Summary: FR: Support SPIFFE Certificate Provisioner
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: dar(a)xoe.solutions
Target Milestone: ---
Created attachment 754
--> https://bugs.openldap.org/attachment.cgi?id=754&action=edit
A SPIFFE samle certificate
SPIFFE is a protocol for attesting workload identities.
It implements a pull based workflow where clients request ad-hoc certificates
about their identity from a unix domain socket.
While there is a helper that can wrap clients it is uncertain
how certificate rolls, which happen by default every few minutes,
shall be signalled to the ldap client: https://github.com/spiffe/spiffe-helper
I assume there is no signal which induces graceful reloading of the
certificates.
Therefore, it might be considerable adding direct spiffe support
to the ldap client. See example:
https://github.com/spiffe/c-spiffe/blob/master/c-spiffe.cc
Please find attached a spiffe sample cert, for mere information. Note it does
convey identity (exclusively) through SAN, which currently seems not be
supported in OpenLDAP. I'm going to open another issue for that.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9286
Issue ID: 9286
Summary: mdb_cursor_get MDB_GET_MULTIPLE key not populated
Product: LMDB
Version: 0.9.25
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: corey(a)kaylors.net
Target Milestone: ---
Reading the docs it says "Return key and up to a page of duplicate data items
from current cursor position." when MDB_GET_MULTIPLE is used. I don't see the
key being populated, but when I call MDB_GET_CURRENT after the use of
MDB_GET_MULTIPLE the key is the value I expect. Looking through the code I
don't see the key getting used in this path. Granted, I'm not proficient with C
so I may have overlooked something.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9268
Issue ID: 9268
Summary: Test065 fails due to invalid log level
Product: OpenLDAP
Version: 2.4.50
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: build
Assignee: bugs(a)openldap.org
Reporter: andy(a)asjohnson.com
Target Milestone: ---
Line #109 of tests/scripts/test065-proxyauthz:
$SLAPD -f $CONF2 -h $URI2 -d $LVL -d pcache > $LOG2 2>&1 &
Results in this:
must compile with LDAP_DEBUG for debugging
unrecognized log level "pcache" (deferred)
After which the test fails.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9250
Bug ID: 9250
Summary: librewrite only supports up to 9 submatches
Product: OpenLDAP
Version: 2.4.49
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: ryan(a)openldap.org
Target Milestone: ---
libraries/librewrite$ cat nine.conf
rewriteEngine on
rewriteContext default
rewriteRule "(.)(.)(.)(.)(.)(.)(.)(.)(.)" "$9$8$7$6$5$4$3$2$1" :
libraries/librewrite$ ./rewrite -f nine.conf abcdefghijklmnop
abcdefghijklmnop -> ihgfedcba [0:ok]
libraries/librewrite$ cat eleven.conf
rewriteEngine on
rewriteContext default
rewriteRule "(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)" "$11$10$9$8$7$6$5$4$3$2$1" :
libraries/librewrite$ ./rewrite -f eleven.conf abcdefghijklmnop
abcdefghijklmnop -> a1a0ihgfedcba [0:ok]
I guess no one has needed that many yet... :)
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugs.openldap.org/show_bug.cgi?id=9185
Bug ID: 9185
Summary: glue entry
Product: OpenLDAP
Version: 2.4.48
Hardware: All
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: client tools
Assignee: bugs(a)openldap.org
Reporter: gnoe(a)symas.com
Target Milestone: ---
--
You are receiving this mail because:
You are watching someone on the CC list of the bug.
https://bugs.openldap.org/show_bug.cgi?id=8805
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |VERIFIED
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8113
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |VERIFIED
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8113
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|2.5.0 |---
Keywords|OL_2_5_REQ |
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8113
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |INVALID
--- Comment #6 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
Never mind, bug with the build of OpenLDAP I was using.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8113
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |UNCONFIRMED
Resolution|INVALID |---
--- Comment #5 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
In fact, for the ldap_get_dn.3.links file, only the first three links are
created, the rest are not:
Links file has:
ldap_explode_dn.3
ldap_explode_rdn.3
ldap_dn2ufn.3
ldap_str2dn.3
ldap_dnfree.3
ldap_dn2str.3
ldap_dn2dcedn.3
ldap_dcedn2dn.3
ldap_dn2ad_canonical.3
on an installation:
[root@tx02 man3]# ls ldap_explode*
ldap_explode_dn.3 ldap_explode_rdn.3
[root@tx02 man3]# ls ldap_dn2ufn*
ldap_dn2ufn.3
[root@tx02 man3]# ls ldap_str2dn.3
ls: cannot access ldap_str2dn.3: No such file or directory
[root@tx02 man3]# ls ldap_dnfree.3
ls: cannot access ldap_dnfree.3: No such file or directory
[root@tx02 man3]# ls ldap_dn2dcedn.3
ls: cannot access ldap_dn2dcedn.3: No such file or directory
(etc)
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8113
Howard Chu <hyc(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |INVALID
--- Comment #4 from Howard Chu <hyc(a)openldap.org> ---
(In reply to Quanah Gibson-Mount from comment #3)
> It's definitely not fixed.
>
> While it is a part of the ldap_get_dn.3 man page, the installation piece
> that's supposed to create a link to that man page for the ldap_str2dn
> function is not working.
According to commits, this has been in place since 2001. This bug report is
invalid.
Note:
make install DESTDIR=/tmp/xman
...
installing ldap_get_dn.3 in /tmp/xman/usr/local/share/man/man3
installing ldap_explode_dn.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_explode_rdn.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_dn2ufn.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_str2dn.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_dnfree.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_dn2str.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_dn2dcedn.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_dcedn2dn.3 in /tmp/xman/usr/local/share/man/man3 as link to
ldap_get_dn.3
installing ldap_dn2ad_canonical.3 in /tmp/xman/usr/local/share/man/man3 as link
to ldap_get_dn.3
...
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8113
--- Comment #3 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
It's definitely not fixed.
While it is a part of the ldap_get_dn.3 man page, the installation piece that's
supposed to create a link to that man page for the ldap_str2dn function is not
working.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8113
--- Comment #2 from jscott(a)posteo.net ---
This has been fixed. It's in my manpage on Debian Bullseye:
ldap_str2dn() parses a string representation of a distinguished name contained
in str into its components, which are stored in as ldap_ava structures,
arranged in LDAPAVA, LDAPRDN, and LDAPDN terms. Space for dn will be obtained
dynamically and should be freed by the caller using ldap_dnfree(3). The LDAPDN
is defined as:
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9015
--- Comment #10 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
Commits:
• afc970b1
by Howard Chu at 2020-09-15T12:08:22+01:00
ITS#9015 syncprov: fix for zero-length suffix
If the "" glue entry exists and lacks a contextCSN, must perform
an additional search to be sure the DB is otherwise empty. If so,
skip creating the contextCSN.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9338
Issue ID: 9338
Summary: slapd write waiter doesn't resume pending ops
Product: OpenLDAP
Version: 2.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: hyc(a)openldap.org
Target Milestone: ---
If a socket output buffer fills up (e.g. because the client is not reading
responses fast enough) slapd will queue up any newly received operations on
that connection and defer their execution till later. In the new write waiter
code in master/2.5, after the socket becomes writable again the pending ops
are not getting rescheduled for execution because of a missing call to
connection_write(). As a result, a client waiting for these ops on that
connection to finish will be hung forever.
This bug impacts the syncrepl consumer in delta-sync mode if it loses sync and
has to fallback to Refresh mode, and its connection was backlogged on the
provider side. In the fallback case the consumer sends an Abandon for the
current search and issues a new Refresh search, but if the socket was blocked
on the provider side the new search won't execute.
A fix for the write waiter is ready, and also the consumer will be patched to
simply close the connection and open a new one on its fallback, to avoid
running into this problem.
--
You are receiving this mail because:
You are on the CC list for the issue.