- openldap-bugs - openldap.org

(ITS#8634) OpenLDAP fails to build against OpenSSL 1.1
by hristo＠venev.name 10 Apr '17

10 Apr '17

Full_Name: Hristo Venev Version: Unreleased Release Candidate 2.4.45 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (95.111.59.55) Another user of the old DES API. Here's a patch (compiles, not tested): diff --git a/libraries/liblutil/passwd.c b/libraries/liblutil/passwd.c index 7aab344..c481326 100644 --- a/libraries/liblutil/passwd.c +++ b/libraries/liblutil/passwd.c @@ -38,9 +38,9 @@ # include <openssl/des.h> -typedef des_cblock des_key; -typedef des_cblock des_data_block; -typedef des_key_schedule des_context; +typedef DES_cblock des_key; +typedef DES_cblock des_data_block; +typedef DES_key_schedule des_context[1]; #define des_failed(encrypted) 0 #define des_finish(key, schedule) @@ -667,7 +667,7 @@ static void des_set_key_and_parity( des_key *key, unsigned char *keyData) { memcpy(key, keyData, 8); - des_set_odd_parity( key ); + DES_set_odd_parity( key ); } @@ -699,7 +699,7 @@ des_set_key_and_parity( des_key *key, unsigned char *keyData) } static void -des_set_key_unchecked( des_key *key, des_context ctxt ) +DES_set_key_unchecked( des_key *key, des_context ctxt ) { ctxt[0] = NULL; @@ -712,7 +712,7 @@ des_set_key_unchecked( des_key *key, des_context ctxt ) } static void -des_ecb_encrypt( des_data_block *plain, des_data_block *encrypted, +DES_ecb_encrypt( des_data_block *plain, des_data_block *encrypted, des_context ctxt, int op) { SECStatus rv; @@ -864,16 +864,16 @@ static int chk_lanman( ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); if (des_failed(&PasswordHash1)) { return LUTIL_PASSWD_ERR; } lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); if (des_failed(&PasswordHash2)) { return LUTIL_PASSWD_ERR; } @@ -1160,12 +1160,12 @@ static int hash_lanman( ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3],

1 0

Re: (ITS#8633) No released version of OpenLDAP supports OpenSSL 1.1.0
by hyc＠symas.com 10 Apr '17

10 Apr '17

hristo(a)venev.name wrote: > Full_Name: Hristo Venev > Version: 2.4.44 > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (95.111.59.55) > > > No version of OpenLDAP that builds and works against OpenSSL 1.1.0 has been > released yet. Support for OpenSSL 1.1.0 is in the 2.4.45 release candidate. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8633) No released version of OpenLDAP supports OpenSSL 1.1.0
by hristo＠venev.name 10 Apr '17

10 Apr '17

Full_Name: Hristo Venev Version: 2.4.44 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (95.111.59.55) No version of OpenLDAP that builds and works against OpenSSL 1.1.0 has been released yet.

1 0

Re: (ITS#8553) LMDB Windows UWP Patch
by Howard Chu 10 Apr '17

10 Apr '17

I see no patch filename or URL in this ticket.

1 0

Re: (ITS#8509) LMDB make targets for automake
by hyc＠symas.com 10 Apr '17

10 Apr '17

phantom+lmdb(a)live.ie wrote: > Full_Name: Aido > Version: 2.4.44 > OS: Ubuntu Trusty > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (216.239.90.19) > > > The current liblmdb Makefile does not make it easy to use liblmdb as a > submodule > to other projects that utilize automake e.g. automake uses a 'check' directive > instead of 'test'. > > Adding the following to the Makefile would make liblmdb more automake > friendly: > > EMPTY_AUTOMAKE_TARGETS = dvi pdf ps info html tags ctags distcheck > .PHONY: $(EMPTY_AUTOMAKE_TARGETS) > $(EMPTY_AUTOMAKE_TARGETS): > check: test > > See: > https://www.gnu.org/software/automake/manual/html_node/Third_002dParty-Make… > > The OpenLDAP Project doesn't use automake, and as a policy we don't include support for tools we don't use. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8632) VC parsing error
by hyc＠symas.com 10 Apr '17

10 Apr '17

okuznik(a)symas.com wrote: > Full_Name: Ondrej Kuznik > Version: master > OS: > URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170410-ITS-8632-request-the… > Submission from: (NULL) (2a02:c7f:2247:ec00:a3e:8eff:fe52:dac5) > > > When extracting a SASL mechanism, VC overlay requests a string from ber_scanf, > where it should be an in-place BerValue *. > > Patch attached. > > Thanks, applied to git master -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8631) OpenLDAP segfault on startup
by hyc＠symas.com 10 Apr '17

10 Apr '17

okuznik(a)symas.com wrote: > Full_Name: Ondrej Kuznik > Version: master/re24 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170410-ITS-8631-Initialize-… > Submission from: (NULL) (2a02:c7f:2247:ec00:a3e:8eff:fe52:dac5) > > > When playing around with ldapi, a typo uncovered a bug in the startup routines: > if the hostname cannot be resolved, an unitialised pointer would be referenced. > > Try running: > slapd -h ldap://does.not.exist -d -1 -f /dev/null > > Attached patch fixes this. > > Thanks, applied to git master -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8632) VC parsing error
by okuznik＠symas.com 10 Apr '17

10 Apr '17

Full_Name: Ondrej Kuznik Version: master OS: URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170410-ITS-8632-request-the… Submission from: (NULL) (2a02:c7f:2247:ec00:a3e:8eff:fe52:dac5) When extracting a SASL mechanism, VC overlay requests a string from ber_scanf, where it should be an in-place BerValue *. Patch attached.

1 0

(ITS#8631) OpenLDAP segfault on startup
by okuznik＠symas.com 10 Apr '17

10 Apr '17

Full_Name: Ondrej Kuznik Version: master/re24 OS: Linux URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170410-ITS-8631-Initialize-… Submission from: (NULL) (2a02:c7f:2247:ec00:a3e:8eff:fe52:dac5) When playing around with ldapi, a typo uncovered a bug in the startup routines: if the hostname cannot be resolved, an unitialised pointer would be referenced. Try running: slapd -h ldap://does.not.exist -d -1 -f /dev/null Attached patch fixes this.

1 0

Re: (ITS#7347) Exclusive bit masks for: ACL_WADD, ACL_WDEL, and ACL_WRITE
by daniel＠pluta.biz 10 Apr '17

10 Apr '17

Although I know that I'm highly probable not directly addressed by the question "For 2.5?" (see this its's notes), my answer/comment would be "Yes", even "Yes, of course.": As I think, introducing this feature into a later 2.5.x release seems to be as problematic as its introduction into running 2.4.x, I think it is a good or perhaps the best opportunity to introduce this feature into the first 2.5, or 2.6, ... or 3.0 release. Disclaimer (again): I do not mean applying my patch, which represents just a workaround for demonstration/testing purposes. Sorry, I don't know how to code the "the bitmask-separation" - but I could and would help testing it. By the way: Thank you very much for taking care of the its' incoming queue!

1 0

Re: (ITS#6897) segfault in lber on close
by quanah＠symas.com 08 Apr '17

08 Apr '17

Hello, Due to a lack of response to the necessary information required to pursue this report, this ITS will be closed. If you still encounter the issue with a current OpenLDAP release, please follow up with the information requested. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6874) slapd crashes while modifying a database
by quanah＠symas.com 08 Apr '17

08 Apr '17

Hello Dieter, Unfortunately your configuration for this ITS has been lost as it was stuck in a pastebin instead of supplied directly in the ITS itself. It does appear there was some question as to whether or not your configuration was valid, as well. If you still have this configuration and you still experience a crash with the current OpenLDAP release, please follow up with the full configuration information, debug backtrace, etc. In the meantime, this ITS will be closed. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6695) syncrepl end retrying and stop thread
by quanah＠symas.com 08 Apr '17

08 Apr '17

Hello, The information provided in the ITS is not actionable. The log appears to show syncrepl operating in REFRESH mode. However, the information as to why it is in REFRESH mode was not provided. At this point, numerous fixes to syncrepl have since been made. If you are able to reproduce the issue with the current OpenLDAP release, please respond to the ITS. In the meantime, this ITS will be closed. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6667) memberof infinite recursion on node rename
by quanah＠symas.com 08 Apr '17

08 Apr '17

Hello, Due to lack of response, this ITS will be closed. If you continue to encounter the issue with the current OpenLDAP release, please follow up with the information that was requested. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6648) Syncrepl cold refresh fails with mirrormode supplier
by quanah＠symas.com 08 Apr '17

08 Apr '17

Hi Andrew, Sorry for the delay in response to this issue report. I believe I actually encountered this same problem at a later point, and it is fixed in current OpenLDAP. Would you be able to confirm? Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8629) slapauth segfault with GSSAPI + olcAuthzRegexp using internal LDAP search + ppolicy overlay
by quanah＠symas.com 08 Apr '17

08 Apr '17

--On Thursday, April 06, 2017 3:22 PM +0000 clement.oudot(a)savoirfairelinux.com wrote: > Hello, > > I would like to know if some of you have an idea on how to fix this bug? > > I am able to test a patch if you can provide one. Hi Clement, Ondrej will be looking at this on Monday. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by quanah＠symas.com 07 Apr '17

07 Apr '17

--On Friday, April 07, 2017 7:59 PM +0000 Frank.Swasey(a)uvm.edu wrote: > Today at 1:36pm, Frank.Swasey(a)uvm.edu wrote: > >> Today at 7:59am, ondra(a)mistotebe.net wrote: >> >>> Would you be able to confirm the patch in my previous email does the >>> right thing for you? >> >> I am building it now, I'll test and report back. > > Yes, it has worked with every nasty test I have been able to dream up to > throw at it. Thanks for the confirmation. This fix will be included in OpenLDAP 2.4.45. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by Frank.Swasey＠uvm.edu 07 Apr '17

07 Apr '17

Today at 1:36pm, Frank.Swasey(a)uvm.edu wrote: > Today at 7:59am, ondra(a)mistotebe.net wrote: > >> Would you be able to confirm the patch in my previous email does the >> right thing for you? > > I am building it now, I'll test and report back. Yes, it has worked with every nasty test I have been able to dream up to throw at it. -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

1 0

Re: (ITS#6631) back-sql attribute order incorrect
by quanah＠symas.com 07 Apr '17

07 Apr '17

Hello, This ITS is being closed due to a lack of feedback. If you continue to encounter this issue with a current release of OpenLDAP, please file a new issue report, providing the additional details that were requested in this ITS. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6448) BUS Error on Multi Master Mode
by quanah＠symas.com 07 Apr '17

07 Apr '17

Hello, Thanks for the report, and I apologize for the delay in responding. I would note that 2.4.21 (at this point) is ancient, and there have been numerous fixes to Multimaster replication since that time. I would note in the future, if you choose to file a report, your exact configurations would also need to be supplied for a report such as this one. There was nothing particularly actionable based on this report. This ITS will be closed. If you can reproduce this issue with a current build of OpenLDAP, please file a new issue. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by Frank.Swasey＠uvm.edu 07 Apr '17

07 Apr '17

Today at 7:59am, ondra(a)mistotebe.net wrote: > Would you be able to confirm the patch in my previous email does the > right thing for you? I am building it now, I'll test and report back. -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

1 0

Re: (ITS#7032) LDAP Server not answering a request
by quanah＠symas.com 07 Apr '17

07 Apr '17

Hello, Due to lack of response, this ITS will be closed. If you continue to encounter the issue with a current build of OpenLDAP, please file a new ITS. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by ondra＠mistotebe.net 07 Apr '17

07 Apr '17

On Thu, Apr 06, 2017 at 02:48:45PM +0000, Frank.Swasey(a)uvm.edu wrote: > On Wed, 5 Apr 2017 at 8:18am, ondra(a)mistotebe.net wrote: > >> AFAIK, LDAP doesn't forbid it so I don't see that going away. > > Well, then that means that the current behavior is a bug in either the > syncrepl implementation or the accesslog recording. Since the MASTER > gets updated correctly and the REPLICAs (and other MMR members) all fall > down when attempting to process the accesslog entry. Yes, they might reject the log entry and fall back to regular syncrepl in the way they would in case of a conflict (which is mostly fine), or the interpretation might seem to fit and a chance is that it's different that the actual modification, causing the servers to silently get out of sync. >> It does need a fair bit of attention, the problem is it's something that >> would require a format change and there are already existing consumers >> that would be affected. >> >> I'm going to try with a patch to record something like this: >> regMod: sn:= George >> regMod: : >> regMod: sn:= George >> >> Together with the relevant syncrepl updates. >> >> While consumers would still be affected, this should be quite rare and >> the current handling of that case would have been incorrect anyway. The >> change would then only make the silent failure a noisy one. > > Noisy in that the replica/mmr falls over dead or just logs more stuff? In case of delta-syncrepl, it should reject it and fall back to regular syncrepl. I can't vouch for anything else that consumes accesslog data obviously. > To be honest, my goal is consistency. I want the replicas (and > MMR mates) to all wind up with the same values the master has. Would you be able to confirm the patch in my previous email does the right thing for you? -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by ondra＠mistotebe.net 06 Apr '17

06 Apr '17

On Thu, Apr 06, 2017 at 04:41:19PM +0100, Howard Chu wrote: > ondra(a)mistotebe.net wrote: >> Well, the clients are allowed to request a lot of strange things, some >> of which border on a DoS: e.g. right now slapd can't disallow a modify >> request like: (pumping up an attribute to extreme size) > > Nor should we disallow any such thing. "Be liberal in what you accept." Yes, not disallow in principle, it was meant as focusing on an option to define some resource/processing limits before we even thought about the other example that is relatively benign. BTW, the patch is now available here. The empty attribute should have replicas fall back to regular syncrepl, where the ones that understand it will interpret it correctly. ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170406-ITS-6545-accesslog-f… -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#6545) delta-syncrepl rejects modification master accepted
by hyc＠symas.com 06 Apr '17

06 Apr '17

ondra(a)mistotebe.net wrote: > On Thu, Apr 06, 2017 at 05:14:15PM +0200, Michael Str=C3=83=C2=B6der wr= ote: >> ondra(a)mistotebe.net wrote: >>> On Wed, Apr 05, 2017 at 04:14:12PM +0200, Michael Str=C3=84=E2=80=9A=C3= =85=E2=80=BAder wrote: >>>> =3D> There could be a slapd per-backend configuation directive to di= sallow it with a >>>> strong hint in the docs recommending to disallow it when using delta= -syncrepl. >>>> >>>> Suggestion: >>>> disallow mod_attr_repeated >>> >>> In my view, that's more pain than it's worth. >> >> Hmm, I think slapd should be able to disallow a crazy modify request l= ike this: >> >> dn: cn=3Dfoobar,dc=3Dexample,dc=3Dcom >> changetype: modify >> replace: description >> description: foobar1 >> - >> replace: description >> description: foobar2 >> - >> .. >> replace: description >> description: foobar1000 >> - > > Well, the clients are allowed to request a lot of strange things, some > of which border on a DoS: e.g. right now slapd can't disallow a modify > request like: Nor should we disallow any such thing. "Be liberal in what you accept." > > dn: cn=3Dfoobar,dc=3Dexample,dc=3Dcom > changetype: modify > replace: description > description: foobar1 > description: foobar2 > ... > description: foobar1000 > > So there. If we can agree on a way to handle that, we might see whether > it could be repurposed. > > I should have a patch for the accesslog issue soon. > --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs