- openldap-bugs - openldap.org

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 08 Aug '17

08 Aug '17

On Tue, Aug 08, 2017 at 03:10:35PM +0900, SATOH Fumiyasu wrote: >My slapd.service file: > >[Unit] >Description=OpenLDAP Server >After=syslog.target network-online.target >Documentation=man:slapd >Documentation=man:slapd.conf >Documentation=man:slapd-config >Documentation=man:slapd-bdb >Documentation=man:slapd-hdb >Documentation=man:slapd-mdb > >[Service] >Type=notify >ExecStart=%LIBEXECDIR%/slapd -d 0 -h "ldapi:/// ldap:///" > >[Install] >WantedBy=multi-user.target > >Any comment? No comment, looks good to me. :)

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 08 Aug '17

08 Aug '17

Hi, Sorry, I'm not good at English. :-) On Tue, 08 Aug 2017 05:12:02 +0900, Ryan Tandy wrote: > > I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of > > whether we set Type=forking or Type=notify. Not exactly "needed", but better to > > have it than not. > > I experimented a bit with a service file. It seems to work well with either Type=forking and NotifyAccess=all, or Type=notify and ExecStart=slapd -d none. The latter (disabling forking) is definitely what systemd upstream recommends. I think so too. I don't like forking, thus I use "Type=notify" and "ExecStart=slapd -d0 ..." in my slapd.service file. > In either case, MAINPID= didn't actually seem to help anything. Yes. > NotifyAccess=main has a chicken-and-egg problem, because systemd needs to know the main PID in order for us to send it the message containing the PID! :) I think the only reasonable way to leave forking enabled would be to also require a PIDFile= setting, which solves that problem. But I'd rather sidestep the entire thing, omit MAINPID= as well, and > Looking at the systemctl output I still think STATUS= is redundant and could be omitted. > > So I guess my recommendation for the notify call boils down to: > > rc = sd_notify( 1, "READY=1" ); Agreed. I'll fix servers/slapd/daemon.c later. Thank you. > and a slapd.service along the lines of: > > [Unit] > Description=OpenLDAP server > > [Service] > Type=notify > ExecStart=%LIBEXECDIR%/slapd -h 'ldap:/// ldapi:///' -d0 > > [Install] > WantedBy=multi-user.target > > (basically identical to the example in systemd.service(5).) My slapd.service file: [Unit] Description=OpenLDAP Server After=syslog.target network-online.target Documentation=man:slapd Documentation=man:slapd.conf Documentation=man:slapd-config Documentation=man:slapd-bdb Documentation=man:slapd-hdb Documentation=man:slapd-mdb [Service] Type=notify ExecStart=%LIBEXECDIR%/slapd -d 0 -h "ldapi:/// ldap:///" [Install] WantedBy=multi-user.target Any comment? -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 07 Aug '17

07 Aug '17

On Mon, Aug 07, 2017 at 01:12:02PM -0700, Ryan Tandy wrote: >Side note: the version message from slapd appears in the journal >twice, once with the timestamp and once without... not sure exactly >why! Sorry, meant to delete this paragraph before sending. The difference between "-dnone" and "-d0" is precisely an extra log to stderr :)

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 07 Aug '17

07 Aug '17

On Mon, Aug 07, 2017 at 12:23:27PM -0700, Ryan Tandy wrote: >I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of >whether we set Type=forking or Type=notify. Not exactly "needed", but better to >have it than not. I experimented a bit with a service file. It seems to work well with either Type=forking and NotifyAccess=all, or Type=notify and ExecStart=slapd -d none. The latter (disabling forking) is definitely what systemd upstream recommends. In either case, MAINPID= didn't actually seem to help anything. NotifyAccess=main has a chicken-and-egg problem, because systemd needs to know the main PID in order for us to send it the message containing the PID! :) I think the only reasonable way to leave forking enabled would be to also require a PIDFile= setting, which solves that problem. But I'd rather sidestep the entire thing, omit MAINPID= as well, and Looking at the systemctl output I still think STATUS= is redundant and could be omitted. So I guess my recommendation for the notify call boils down to: rc = sd_notify( 1, "READY=1" ); and a slapd.service along the lines of: [Unit] Description=OpenLDAP server [Service] Type=notify ExecStart=%LIBEXECDIR%/slapd -h 'ldap:/// ldapi:///' -d0 [Install] WantedBy=multi-user.target (basically identical to the example in systemd.service(5).) Side note: the version message from slapd appears in the journal twice, once with the timestamp and once without... not sure exactly why!

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 07 Aug '17

07 Aug '17

On Mon, Aug 07, 2017 at 01:30:44PM +0000, fumiyas(a)osstech.co.jp wrote: >I've created patches for slapd to add systemd service notification >(sd_notify(3)) support. Thanks for working on this! I'm also interested in having this feature. What do you think about including a slapd.service file? I know OpenLDAP has traditionally not included an init script, but systemd units are intended to be distro-agnostic as far as possible, and shipped by upstream projects in most cases, unlike init scripts. Ideally I'd like to include a template in the source and have the build system fill in the autoconf'ed path (i.e. to slapd) and have 'make install' install it to the right place. Autoconf bits look fine to me. >+ rc = sd_notifyf( 1, >+ "READY=1\n" >+ "STATUS=slapd: ready to serve connections...\n" >+ "MAINPID=%lu", >+ (unsigned long) getpid() ); unset_environment=1 seems reasonable, it's a little unfortunate that we can't call (for example) sd_notify("STOPPING=1") afterward, but it feels worthwhile compared to having to sanitize the environment when forking a child process. I'm not sure the STATUS= message adds value compared to just the basic readiness notification; can you comment on why you included it? I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of whether we set Type=forking or Type=notify. Not exactly "needed", but better to have it than not. I see you've placed this call later than the parent's exit point. Any comments about the timing of this relative to the parent's exit, and to the listener startup and so on? Are the listeners more likely to be ready to serve connections at this point? I seem to recall that in the past there was opposition to moving the parent's exit later, but I can't remember why. (and I still wish we could do that, and dispense with the ldapsearch-loop hacks...) cheers, Ryan

1 0

(ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 07 Aug '17

07 Aug '17

Full_Name: SATOH Fumiyasu Version: master OS: URL: Submission from: (NULL) (118.240.43.13) I've created patches for slapd to add systemd service notification (sd_notify(3)) support. Please see the following URLs: * Patch for master * https://github.com/osstech-jp/openldap/commit/4313f8685ac3365fe71639d378740… * Patch for 2.4.x (OPENLDAP_REL_ENG_2_4) * https://github.com/osstech-jp/openldap/commit/977d4483470d150839714cece64ae…

1 0

Re: (ITS#8706) illogical return from ldap_search_ext_s()
by hyc＠symas.com 05 Aug '17

05 Aug '17

kurt.w.heberlein(a)hpe.com wrote: > Full_Name: Kurt Heberlein > Version: 2.4.40+patches > OS: Debian Wheezy > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (66.168.54.228) > > > Using simple binding with TLS, i have a successfully bound (authenticated) user, > and using the same LDAP*, i experience intermittent failures attempting to > retrieve the user's memberOf list. The failure manifests itself as a return > from ldap_search_ext_s() with a return code of LDAP_SUCCESS but a NULL results > pointer. > > Most of the time this call correctly returns the list of groups the user is a > member of, but intermittently it returns a NULL list even though the return code > is LDAP_SUCCESS. There is no other error indication. What am i missing? Read RFC 4511. The ITS is for bug reports, not technical questions. There's no bug here. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8706) illogical return from ldap_search_ext_s()
by kurt.w.heberlein＠hpe.com 04 Aug '17

04 Aug '17

Full_Name: Kurt Heberlein Version: 2.4.40+patches OS: Debian Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.168.54.228) Using simple binding with TLS, i have a successfully bound (authenticated) user, and using the same LDAP*, i experience intermittent failures attempting to retrieve the user's memberOf list. The failure manifests itself as a return from ldap_search_ext_s() with a return code of LDAP_SUCCESS but a NULL results pointer. Most of the time this call correctly returns the list of groups the user is a member of, but intermittently it returns a NULL list even though the return code is LDAP_SUCCESS. There is no other error indication. What am i missing? The call looks like this: ret = ldap_search_ext_s(lp, base, scope, filter, attrs, 0, NULL, NULL, NULL, -1, &res); if(ret != LDAP_SUCCESS) { ... } else { assert(res != NULL); for(msg = ldap_first_message(lp, res); msg != NULL; msg = ldap_next_message(lp, msg)) { ... Where lp is the LDAP* pointer of for the successful bind of user base = "DC=EMEA,DC=AD,DC=SOMECOMPANY,DC=COM" scope = LDAP_SCOPE_SUBTREE filter = "(&(objectClass=user)(sAMAccountName=someusername))" attrs = attrs[0] = "memberOf" attrs[0] = NULL i dont find any documentation that indicates that res could be NULL after LDAP_SUCCESS is returned from the search. Thanks

1 0

Re: (ITS#8690) syncprov memory leak
by quanah＠symas.com 04 Aug '17

04 Aug '17

--On Tuesday, August 01, 2017 8:33 PM +0000 quanah(a)symas.com wrote: > With the patch applied, test019 sporadically segfaults after doing a > delete op on an entry. Took me 12/50 iterations with back-mdb, 2/50 > with back-bdb. But just 1/1 on two other occasions, so while it's not > every iteration, it's fairly repeatable. I will work on getting a > backtrace as well. With the current code, test050 sporadically fails (Took me 8/50 iterations): 5983d09b do_syncrep2: rid=012 cookie=rid=012,sid=002,csn=20170804014043.003558Z#000000#003#000000 5983d09b bdb_delete: deleted id=00000018 dn="cn=To be deleted by server 3,dc=example,dc=com" 5983d09b send_ldap_result: conn=-1 op=0 p=0 5983d09b send_ldap_result: err=0 matched="" text="" 5983d09b syncprov_sendresp: to=002, cookie=rid=011,sid=001,csn=20170804014043.003558Z#000000#003#000000 5983d09b => send_search_entry: conn 1012 dn="cn=To be deleted by server 3,dc=example,dc=com" ber_flush2: 175 bytes to sd 26 5983d09b <= send_search_entry: conn 1012 exit. 5983d09b slap_graduate_commit_csn: removing 0x7f93ac113800 20170804014043.003558Z#000000#003#000000 5983d09b syncrepl_entry: rid=013 be_delete cn=To be deleted by server 3,dc=example,dc=com (0) 5983d09b slap_queue_csn: queueing 0x7f93ac107860 20170804014043.003558Z#000000#003#000000 5983d09b bdb_modify: dc=example,dc=com 5983d09b bdb_modify: txn1 id: 8000004e 5983d09b bdb_dn2entry("dc=example,dc=com") 5983d09b bdb_modify: txn2 id: 8000004f 5983d09b bdb_modify_internal: 0x00000001: dc=example,dc=com 5983d09b bdb_modify_internal: replace contextCSN 5983d09b => entry_encode(0x00000001): dc=example,dc=com 5983d09b <= entry_encode(0x00000001): dc=example,dc=com 5983d09b syncprov_sendresp: to=004, cookie=rid=011,sid=001,csn= 5983d09b slap_build_sync_ctrl: ber_flatten2 failed (-1) 5983d09b send_ldap_result: conn=1013 op=1 p=3 5983d09b send_ldap_result: err=80 matched="" text="internal error" 5983d09b send_ldap_response: msgid=2 tag=101 err=80 ber_flush2: 146 bytes to sd 30 5983d09b conn=1013 op=1 SEARCH RESULT tag=101 err=80 duration=-1427710511.244ms nentries=0 text=internal error Aug 3 18:40:43 ub16 kernel: [42374.949965] slapd[30897]: segfault at 8000004e ip 00007f93bccb5cc0 sp 00007f93ba1aaa10 error 4 in libc-2.23.so[7f93bcc67000+1c0000] --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8705) Windows registry key creation incorrect
by quanah＠openldap.org 03 Aug '17

03 Aug '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: Windows 10 64-bit URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) When installing OpenLDAP on windows, it creates a registry key for the Eventlog to map startup/shutdown events. There was an attempt to fix the problem with the key value back in 2003, 6e8adce9d94ffff125d6acce669c35245d73d0df. However, the fix is incorrect. Without 6e8adce9d94ffff125d6acce669c35245d73d0df, the key value is set to (on a 64-bit install): "C:\Program Files\OpenLDAP\slapd.exe service" With 6e8adce9d94ffff125d6acce669c35245d73d0df, the key value is set to (on a 64-bit install): "C:\Program" The value that works is: "C:\Program Files\OpenLDAP\slapd.exe" The goal of 6e8adce9d94ffff125d6acce669c35245d73d0df was to strip of " service", but since it simply parses on a single space, if the install path has a space elsewhere in it, you end up with the incorrect value noted above.

1 0

Re: (ITS#8701) account usability control for password less logins
by benjamin.chang＠oracle.com 02 Aug '17

02 Aug '17

Question about a proposed workaround: Would it be possible to use slapo-ppolicy to set the pwdPolicySubentry attribute for each user to provide the desired 1.3.6.1.4.1.42.2.27.9.5.8 control response (see http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control), i.e., can pwdPolicySubentry be used supply the sub-entry and related operational attributes needed to validate users for password-less logins?

1 0

Re: (ITS#8690) syncprov memory leak
by quanah＠symas.com 01 Aug '17

01 Aug '17

--On Tuesday, July 11, 2017 9:17 PM +0000 quanah(a)symas.com wrote: > --On Tuesday, July 11, 2017 1:25 AM +0000 quanah(a)openldap.org wrote: > >> Full_Name: Quanah Gibson-Mount >> Version: 2.4.45 >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (47.208.148.239) With the patch applied, test019 sporadically segfaults after doing a delete op on an entry. Took me 12/50 iterations with back-mdb, 2/50 with back-bdb. But just 1/1 on two other occasions, so while it's not every iteration, it's fairly repeatable. I will work on getting a backtrace as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8702) SLAPD_MAX_DAEMON_THREADS is too small
by quanah＠symas.com 01 Aug '17

01 Aug '17

--On Friday, July 28, 2017 5:56 PM +0000 hyc(a)openldap.org wrote: > Was benchmarking on an Oracle M8 box with 2048 SPARC VCPUs. With 1024 > slapd threads configured, we needed 64 listener threads and 64 > threadqueues to eliminate slapd bottlenecks, but the current default in > daemon.c only allows up to 16 listener threads. > > It's a #ifndef so easily overridable at compile time, but 16 is probably > too small in this age of processors with more and more cores. It would be nice if instead of something hard coded, it was instead configurable by switching its usage to dynamically allocated arrays. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8704) LMDB add option to use prev meta page
by hyc＠openldap.org 31 Jul '17

31 Jul '17

Full_Name: Howard Chu Version: LMDB 0.9 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.136.45.220) Submitted by: hyc Generally, running LMDB in NOSYNC mode means all integrity guarantees are gone, in even of a system crash. However, if some other thread runs mdb_env_sync periodically it's possible that the older DB state is still consistent, even if slightly out of date. I have always intended to add an env flag for using the older meta page, to potentially access a DB even after the latest txn snapshot was corrupted. A patch for this has been contributed, although support in the command-line tools still needs to be added.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 29 Jul '17

29 Jul '17

The problem scenario looks like the following: 1. I run "/etc/init.d/slapd start" to start the daemon. 2. slapd drops to the "slapd" user. 3. slapd writes its PID file, now owned by the "slapd" user. 4. Someone compromises the daemon, which sits on the open network. 5. The attacker is generally limited in what he can do because the daemon doesn't run as root. However, he can write "1" into the slapd.pid file, and he does. 6. I run "/etc/init.d/slapd stop" to stop the daemon while I investigate the weird behavior resulting from the hack. 7. Oops, the machine reboots, because I killed PID 1.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by hyc＠symas.com 29 Jul '17

29 Jul '17

michael(a)orlitzky.com wrote: > Full_Name: Michael Orlitzky > Version: 2.4.45 > OS: Gentoo > URL: > Submission from: (NULL) (98.218.46.55) > > > The slapd daemon should create its PID file before dropping privileges. This > represents a minor security issue; additional factors are needed to make it > exploitable. > > Why? > > The purpose of the PID file is to hold the PID of the running daemon, > so that later it can be stopped, restarted, or otherwise signalled > (many daemons reload their configurations in response to a SIGHUP). > To fulfill that purpose, the contents of the PID file need to be > trustworthy. If the PID file is writable by a non-root user, then he > can replace its contents with the PID of a root process. Not sure this is a valid concern. The uid used to run services should not actually have a valid login shell, and thus should not ever be usable for any purpose other than running the daemon from init. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 28 Jul '17

28 Jul '17

Full_Name: Michael Orlitzky Version: 2.4.45 OS: Gentoo URL: Submission from: (NULL) (98.218.46.55) The slapd daemon should create its PID file before dropping privileges. This represents a minor security issue; additional factors are needed to make it exploitable. Why? The purpose of the PID file is to hold the PID of the running daemon, so that later it can be stopped, restarted, or otherwise signalled (many daemons reload their configurations in response to a SIGHUP). To fulfill that purpose, the contents of the PID file need to be trustworthy. If the PID file is writable by a non-root user, then he can replace its contents with the PID of a root process. Afterwards, any attempt to signal the PID contained in the PID file will instead signal a root process chosen by the non-root user (a vulnerability). This is commonly exploitable by init scripts that are run as root and which blindly trust the contents of their PID files. If one daemon flushes its cache in response to SIGUSR2 and another daemon drops all connections in response to SIGUSR2, it is not hard to imagine a denial-of-service by the user of the first daemon against the second.

1 0

(ITS#8702) SLAPD_MAX_DAEMON_THREADS is too small
by hyc＠openldap.org 28 Jul '17

28 Jul '17

Full_Name: Howard Chu Version: HEAD OS: Solaris 11.3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (31.216.236.133) Submitted by: hyc Was benchmarking on an Oracle M8 box with 2048 SPARC VCPUs. With 1024 slapd threads configured, we needed 64 listener threads and 64 threadqueues to eliminate slapd bottlenecks, but the current default in daemon.c only allows up to 16 listener threads. It's a #ifndef so easily overridable at compile time, but 16 is probably too small in this age of processors with more and more cores.

1 0

(ITS#8701) account usability control for password less logins
by manikya.prabhu.salveru＠oracle.com 27 Jul '17

27 Jul '17

Full_Name: Manikya Version: 2.4.44 OS: Solaris 11.3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (141.143.213.56) Solaris ldap clients are configured for pam_ldap and requires a control to validate users for password less logins. http://docs.oracle.com/cd/E19253-01/816-4556/schemas-250/index.html >From open-ds documentation. account usability control The account usability control provides a pair of request and response controls that can be used to determine whether a user account may be used for authenticating to the server. The request control has an OID of 1.3.6.1.4.1.42.2.27.9.5.8 and does not include a value. It should only be included in search request messages. The corresponding response control has an OID of 1.3.6.1.4.1.42.2.27.9.5.8 (the same as the request control), and it will be included in any search result entry messages for a search request that includes the account usability request control. The value for the account usability response control is encoded as follows: ACCOUNT_USABLE_RESPONSE ::= CHOICE { is_available [0] INTEGER, -- Seconds before expiration -- is_not_available [1] MORE_INFO } MORE_INFO ::= SEQUENCE { inactive [0] BOOLEAN DEFAULT FALSE, reset [1] BOOLEAN DEFAULT FALSE, expired [2] BOOLEAN DEFAULT_FALSE, remaining_grace [3] INTEGER OPTIONAL, seconds_before_unlock [4] INTEGER OPTIONAL } If the user account is available, then the control will include the number of seconds until the user's password expires, or -1 if password expiration is not enabled. If the user's account is not available, then the control will provide the reason it is unavailable.

1 0

(ITS#8700) Compile error
by papachoco＠gmail.com 27 Jul '17

27 Jul '17

Full_Name: Carlos Sanchez Version: 2.4.45 OS: macOS 10.12.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (68.97.40.67) I am getting the error below while compiling openldap 2.4.45 on the latest macOS sierra (10.12.6). I am only setting two configuration options configure-options = --disable-slapd --disable-slurpd Undefined symbols for architecture x86_64: "_ERR_remove_thread_state", referenced from: _tlso_destroy in libldap.a(tls_o.o) ld: symbol(s) not found for architecture x86_64 clang: error: linker command failed with exit code 1 (use -v to see invocation) make[2]: *** [apitest] Error 1 make[1]: *** [all-common] Error 1 make: *** [all-common] Error 1 openldap_client: Command failed with exit code 2: make

1 0

(ITS#8699) More for cursor_del with DUPSORT
by hyc＠openldap.org 26 Jul '17

26 Jul '17

Full_Name: Howard Chu Version: LMDB 0.9.21 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (31.216.236.133) Submitted by: hyc When deleting a series of records in a loop using mdb_cursor_get(MDB_NEXT) in a DUPSORT DB, when deleting the last dup of one key, the first dup of the next key gets skipped on the next iteration. This appears to be due to an incomplete fix to ITS#8622

1 0

(ITS#8698) ppolicy: responses from pwdCheckModule discarded when using an extended password modify
by tim＠bishnet.net 26 Jul '17

26 Jul '17

Full_Name: Tim Bishop Version: 2.4.42 OS: Ubuntu 16.04 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:630:340:1141::13) Whilst this issue was discovered on OpenLDAP 2.4.42, the code is unchanged on the latest version, so I believe it is still applicable there. The high-level overview of the problem is that when using the ppolicy overlay with an external pwdCheckModule, and a password is changed using the LDAPv3 Password Modify (RFC 3062) extended operation (ie. ldappasswd), the message returned by the pwdCheckModule is not passed back to the user. All other failure messages generated in ppolicy are returned correctly. I've looked into this and discovered the cause of the problem. We can start by looking at where the message is returned: https://github.com/openldap/openldap/blob/OPENLDAP_REL_ENG_2_4_42/servers/s… The check_password_quality function calls out to the pwdCheckModule which sets txt to point at a malloc'd string. Here we set rs->sr_text to point to that, and make a note to free it later. This is the exception, in all other cases, as can be seen a few lines below, rs->sr_text is set to a static string. Later on, the result is returned to the user: https://github.com/openldap/openldap/blob/OPENLDAP_REL_ENG_2_4_42/servers/s… And then after that, it is free'd. This all works fine for a normal password modify operation. The problem occurs when we wrap this in an extended password modify: https://github.com/openldap/openldap/blob/OPENLDAP_REL_ENG_2_4_42/servers/s… This line is where the call into ppolicy originates (with a few steps in between), and then on line 237 below we see a call to send_ldap_extended (which returns rs->sr_text to the user) that includes a pointer to rs. In cases where rs->sr_text is a static string this is fine, but where we've set it to a response from pwdCheckModule it has at this point been free'd and set to NULL before send_ldap_extended gets a chance to send it. The result is that confusingly the response from pwdCheckModule is returned for non-extended password changes, but not for extended ones. I don't have a fix for this since I'm not familiar enough with the slapd code. But I'd imagine it'd require setting a flag either in rs or op to note when free'ing of rs->sr_text is required, and then move that free call as far out as necessary (back to where rs is created in connection.c?) so that rs->sr_text is always available.

1 0

(ITS#8697) Remove refptr symbols from slapd.def
by quanah＠openldap.org 20 Jul '17

20 Jul '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: Windows 10 64-bit URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) When building OpenLDAP with a newer version of gcc, dlltool now exports a ton of ".refptr.FUNCTION" values out to the slapd.def file. This breaks the build process, as they aren't real functions. This is due to this change to gcc: https://gcc.gnu.org/ml/gcc-patches/2013-03/msg00858.html Fix is simple enough, simply update our sed that we run against slapd.def: quanah@ub16:~/git/openldap/openldap-head/servers/slapd$ git diff . diff --git a/servers/slapd/Makefile.in b/servers/slapd/Makefile.in index 177ad28..0327537 100644 --- a/servers/slapd/Makefile.in +++ b/servers/slapd/Makefile.in @@ -210,7 +210,7 @@ slapd.def: libbackends.a liboverlays.a version.o dlltool --exclude-symbols main,ServiceMain@8 --export-all-symbols \ --output-def $@.tmp $$objs; echo EXPORTS > $@ - $(SED) -e 1,2d -e 's/ @ [0-9][0-9]*//' $@.tmp | sort >> $@ + $(SED) -e 1,2d -e 's/ @ [0-9][0-9]*//' -e '/\.refptr\./d' $@.tmp | sort >> $@ $(RM) $@.tmp symdummy.c: slapd.def

1 0

(ITS#8696) deadlock with 3-way delta-MMR and syncprov-checkpoint
by ryan＠openldap.org 20 Jul '17

20 Jul '17

Full_Name: Ryan Tandy Version: 2.4.45 OS: Debian URL: Submission from: (NULL) (24.68.41.160) Submitted by: ryan This is rather similar to ITS#8429 (the deadlock is at the same location), but not enough for me to be sure it's the same. cat > slapd.conf << EOF include /path/to/core.schema include /path/to/cosine.schema serverid 1 ldap://:9001 serverid 2 ldap://:9002 serverid 3 ldap://:9003 database mdb directory db maxsize 104857600 envflags writemap index objectClass,cn,entryCSN,entryUUID,uid eq suffix dc=example,dc=com rootdn cn=root,dc=example,dc=com rootpw secret access to * by * read sizelimit unlimited syncrepl rid=1 provider="ldap://:9001" searchbase="dc=example,dc=com" type=refreshAndPersist retry="10 +" bindmethod=simple binddn="cn=root,dc=example,dc=com" credentials="secret" syncdata=accesslog logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncrepl rid=2 provider="ldap://:9002" searchbase="dc=example,dc=com" type=refreshAndPersist retry="10 +" bindmethod=simple binddn="cn=root,dc=example,dc=com" credentials="secret" syncdata=accesslog logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncrepl rid=3 provider="ldap://:9003" searchbase="dc=example,dc=com" type=refreshAndPersist retry="10 +" bindmethod=simple binddn="cn=root,dc=example,dc=com" credentials="secret" syncdata=accesslog logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" mirrormode on overlay syncprov syncprov-checkpoint 10 1 syncprov-reloadhint TRUE overlay accesslog logdb cn=accesslog logops writes logsuccess true logpurge 07+00:00 01+00:00 database mdb directory accesslog maxsize 104857600 envflags writemap index entryCSN,objectClass,reqEnd,reqResult,reqStart eq suffix cn=accesslog access to * by * read sizelimit unlimited overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE EOF cat > data.ldif << EOF dn: dc=example,dc=com objectClass: domain dn: uid=u0,dc=example,dc=com objectclass: account dn: cn=g0,dc=example,dc=com objectClass: groupOfNames member: EOF Start up all three slapds and get them synced and settled. I also executed no-op modifications on each node to ensure every server had CSNs from all the others. cat > groupmod.ldif << EOF dn: cn=g0,dc=example,dc=com add: member member: uid=u0,dc=example,dc=com dn: cn=g0,dc=example,dc=com delete: member member: uid=u0,dc=example,dc=com EOF Execute the above modification on one node and watch the other two. After a few times, I reliably get one or both nodes hanging. If I disable syncprov-checkpoint, I cannot reproduce the hang. Backtrace from a hung node: Thread 6 (Thread 0x7f77093d0700 (LWP 28817)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x0000560c5a9af3b7 in ldap_pvt_thread_cond_wait (cond=0x560c5b9696c0, mutex=0x560c5b969698) at thr_posix.c:277 #2 0x0000560c5a9add6e in ldap_int_thread_pool_wrapper (xpool=0x560c5b969690) at tpool.c:683 #3 0x00007f7718a4a494 in start_thread (arg=0x7f77093d0700) at pthread_create.c:333 #4 0x00007f771878ca8f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 Thread 5 (Thread 0x7f7709bd1700 (LWP 28816)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x0000560c5a9af3b7 in ldap_pvt_thread_cond_wait (cond=0x560c5b9696c0, mutex=0x560c5b969698) at thr_posix.c:277 #2 0x0000560c5a9add6e in ldap_int_thread_pool_wrapper (xpool=0x560c5b969690) at tpool.c:683 #3 0x00007f7718a4a494 in start_thread (arg=0x7f7709bd1700) at pthread_create.c:333 #4 0x00007f771878ca8f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 Thread 4 (Thread 0x7f770a3d2700 (LWP 28815)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x0000560c5a9af3b7 in ldap_pvt_thread_cond_wait (cond=0x560c5b993fc8, mutex=0x560c5b993fa0) at thr_posix.c:277 #2 0x0000560c5a9ac942 in ldap_pvt_thread_rmutex_lock (rmutex=0x560c5b993f68, owner=140149249615616) at rmutex.c:129 #3 0x0000560c5a98bd4c in accesslog_op_mod (op=0x7f770a3d14e0, rs=0x7f770a3d1120) at accesslog.c:1994 #4 0x0000560c5a941763 in overlay_op_walk (op=0x7f770a3d14e0, rs=0x7f770a3d1120, which=op_modify, oi=0x560c5b992a00, on=0x560c5b993d20) at backover.c:661 #5 0x0000560c5a941a50 in over_op_func (op=0x7f770a3d14e0, rs=0x7f770a3d1120, which=op_modify) at backover.c:730 #6 0x0000560c5a941b84 in over_op_modify (op=0x7f770a3d14e0, rs=0x7f770a3d1120) at backover.c:769 #7 0x0000560c5a92ef07 in syncrepl_message_to_op (si=0x560c5b992580, op=0x7f770a3d14e0, msg=0x7f76f4103bd0) at syncrepl.c:2417 #8 0x0000560c5a929f7e in do_syncrep2 (op=0x7f770a3d14e0, si=0x560c5b992580) at syncrepl.c:1014 #9 0x0000560c5a92c160 in do_syncrepl (ctx=0x7f770a3d1c10, arg=0x560c5b992980) at syncrepl.c:1565 #10 0x0000560c5a8b11cd in connection_read_thread (ctx=0x7f770a3d1c10, argv=0xc) at connection.c:1296 #11 0x0000560c5a9ade15 in ldap_int_thread_pool_wrapper (xpool=0x560c5b969690) at tpool.c:696 #12 0x00007f7718a4a494 in start_thread (arg=0x7f770a3d2700) at pthread_create.c:333 #13 0x00007f771878ca8f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 Thread 3 (Thread 0x7f770abd3700 (LWP 28814)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x0000560c5a9af3b7 in ldap_pvt_thread_cond_wait (cond=0x560c5b9696c0, mutex=0x560c5b969698) at thr_posix.c:277 #2 0x0000560c5a9add6e in ldap_int_thread_pool_wrapper (xpool=0x560c5b969690) at tpool.c:683 #3 0x00007f7718a4a494 in start_thread (arg=0x7f770abd3700) at pthread_create.c:333 #4 0x00007f771878ca8f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 Thread 2 (Thread 0x7f770b3d4700 (LWP 28813)): #0 0x00007f771878d083 in epoll_wait () at ../sysdeps/unix/syscall-template.S:84 #1 0x0000560c5a8ac6b3 in slapd_daemon_task (ptr=0x560c5bd176e0) at daemon.c:2539 #2 0x00007f7718a4a494 in start_thread (arg=0x7f770b3d4700) at pthread_create.c:333 #3 0x00007f771878ca8f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 Thread 1 (Thread 0x7f7719293400 (LWP 28812)): #0 0x00007f7718a4b6cd in pthread_join (threadid=140149266401024, thread_return=0x0) at pthread_join.c:90 #1 0x0000560c5a9af2f8 in ldap_pvt_thread_join (thread=140149266401024, thread_return=0x0) at thr_posix.c:197 #2 0x0000560c5a8ad99c in slapd_daemon () at daemon.c:2932 #3 0x0000560c5a88c105 in main (argc=8, argv=0x7ffd119da7b8) at main.c:1017

1 0

(ITS#8695) _sleep is deprecated
by quanah＠openldap.org 20 Jul '17

20 Jul '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: Windows 10 64-bit URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) When building OpenLDAP, we find: C:/msys64/home/build/sold-master/openldap/tests/progs/slapd-read.c: In function 'do_read': C:/msys64/home/build/sold-master/openldap/tests/progs/slapd-read.c:384:11: warning: '_sleep' is deprecated [-Wdeprecated-declarations] sleep( delay ); ^~~~~ In file included from C:/msys64/home/build/sold-master/openldap/include/ac/stdlib.h:26:0, from C:/msys64/home/build/sold-master/openldap/tests/progs/slapd-read.c:24: C:/msys64/mingw64/x86_64-w64-mingw32/include/stdlib.h:613:24: note: declared here _CRTIMP void __cdecl _sleep(unsigned long _Duration) __MINGW_ATTRIB_DEPRECATED; ^~~~~~ This comes from: include/ac/unistd.h The correct function call is Sleep #ifdef _WIN32 #define sleep Sleep #endif should resolve it.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs