https://bugs.openldap.org/show_bug.cgi?id=8752
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://bugs.openldap.org/s
| |how_bug.cgi?id=9782
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9534
Issue ID: 9534
Summary: Persistent test043 failures
Product: OpenLDAP
Version: 2.5
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
In testing current RE25 as of 4/23/2021
(73b2769d05529a7d474661023f2c4f3a931417b2)
test043 is sporadically failing. Examining the testrun log, it appears
replication never even initiated.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9877
Issue ID: 9877
Summary: Session Tracking failing to log IP addresses
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
From slapd log in master with session tracking enabled:
62c45cfe.3b59f358 0x7fa3b0aa8700 conn=1002 fd=15 ACCEPT from IP=127.0.0.1:58790
(IP=127.0.0.1:9012)
62c45cff.017af6f5 0x7fa3b0aa8700 conn=1002 op=1 [IP=[
USERNAME=cn=manager,dc=example,dc=com] modifications:
62c45cff.017b2c53 0x7fa3b0aa8700 conn=1002 op=1 [IP=[
USERNAME=cn=manager,dc=example,dc=com] MOD dn="cn=replicator,dc=example,dc=com"
62c45cff.017bb35e 0x7fa3b0aa8700 conn=1002 op=1 [IP=[
USERNAME=cn=manager,dc=example,dc=com] MOD attr=pwdLastSuccess
Note the missing IP address. This works correctly in current 2.6.2
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9874
Issue ID: 9874
Summary: slapadd is returning garbage error data
Product: OpenLDAP
Version: 2.6.2
Hardware: All
OS: All
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: quanah(a)openldap.org
Target Milestone: ---
When slapadd encounters an error, instead of returning that error it is
returning garbage text.
Example:
slapadd: could not add entry dn="olcDatabase={1}mdb,cn=config" (line=1119): #]I
Note the: "#]I"
If run with -d -1, we see the actual error is:
mdb_db_init: Initializing mdb database
olcDbDirectory: value #0: invalid path: No such file or directory
slapadd: could not add entry dn="olcDatabase={1}mdb,cn=config" (line=1119):
olcDbDirectory: value #0: invalid path: No such file or directory
slapadd shutdown: initiated
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9642
Issue ID: 9642
Summary: Adding a task to runqueue doesn't wake the main thread
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: ondra(a)mistotebe.net
Target Milestone: ---
If a connection adds a new syncrepl stanza, that is not started until the main
thread comes around to doing it. However if that thread is currently stuck in
SLAP_EVENT_WAIT() and nothing else happens (like an unbind over the connection
that modified the config), the task is never started. This can take a long
time.
No idea yet how to wake it up with/from ldap_pvt_runqueue_insert() given that
sits within libldap and not really something that should be calling
slap_wake_listener().
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9875
Issue ID: 9875
Summary: OpenLDAP 2.6 libldap_r.so is missing
Product: OpenLDAP
Version: 2.6.2
Hardware: All
OS: All
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: andysyam61(a)gmail.com
Target Milestone: ---
OpenLDAP 2.6 libldap_r.so is missing
https://github.com/python-ldap/python-ldap/issues/432
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9468
Issue ID: 9468
Summary: slapd-ldap does anonymous bind even if rebind-as-user
is set
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: ---
Component: backends
Assignee: bugs(a)openldap.org
Reporter: tero.saarni(a)est.tech
Target Milestone: ---
When back-ldap retries bind operation after connection retry, it will do it as
anonymous even if rebind-as-user is set to yes.
Expected behavior is that (re)bind is done with user's credentials from the
initial bind operation.
I observed following (Warning: I might have understood details of the code
incorrectly):
When rebind-as-user is set and bind operation from client is processed, proxy
will copy the credentials to ldapconn_t representing the remote LDAP
connection. When remote LDAP connection is closed (e.g. by the proxy itself due
to timeout), the bind credentials information is lost when freeing the old
ldapconn_t. At this point, client still holds the connection to proxy and is
unaware of the remote connection being lost. Proxy then re-establishes the
connection and "synthetically" generates new bind itself, but since it does not
have the credentials stored in memory anymore, it sends anonymous bind on
behalf of the client.
As a side effect, slapd currently crashes if remote server does not allow
anonymous bind and responds with InvalidCredentials instead. The crash is due
to assert(), which is handled in separate issue
https://bugs.openldap.org/show_bug.cgi?id=9288
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=7468
OndÅ™ej KuznÃk <ondra(a)mistotebe.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://bugs.openldap.org/s
| |how_bug.cgi?id=9871
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=7966
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |VERIFIED
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=7966
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also|https://bugs.openldap.org/s |
|how_bug.cgi?id=9871 |
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=7966
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends on|6166 |
Status|UNCONFIRMED |RESOLVED
Resolution|--- |DUPLICATE
Target Milestone|2.7.0 |---
--- Comment #8 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
*** This issue has been marked as a duplicate of issue 9871 ***
Referenced Issues:
https://bugs.openldap.org/show_bug.cgi?id=6166
[Issue 6166] Overlay/backend restructuring
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=6166
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks|7966 |
Referenced Issues:
https://bugs.openldap.org/show_bug.cgi?id=7966
[Issue 7966] OpenLDAP server 2.4.40 crashes with rwm and ppolicy overlay during
bind
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=7966
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://bugs.openldap.org/s
| |how_bug.cgi?id=9871
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9862
Issue ID: 9862
Summary: segmentation fault in ldap_simple_bind_s and openssl
Product: OpenLDAP
Version: 2.4.49
Hardware: x86_64
OS: Linux
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: atsoi(a)marklogic.com
Target Milestone: ---
We have segmentation fault when using ldap_simple_bind_s.
The openldap version is 2.4.59
The openssl version is 1.0.2zd.
2021-05-09 01:11:22.021 Critical:+#5 0x00007f8f7212a038 in signalHandler(int,
siginfo_t, void) () from
/usr/lib/jvm/jre-1.8.0-openjdk-1.8.0.282.b08-1.el7_9.x86_64/lib/amd64/server/libjvm.so
2021-05-09 01:11:22.021 Critical:+#6
2021-05-09 01:11:22.021 Critical:+#7 0x00007f8f78dc7f6e in BIO_set () from
lib/libcrypto.so.1.0.0
2021-05-09 01:11:22.021 Critical:+#8 0x00007f8f78dc7fe2 in BIO_new () from
lib/libcrypto.so.1.0.0
2021-05-09 01:11:22.021 Critical:+#9 0x00007f8f78a34574 in tlso_sb_setup ()
from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#10 0x00007f8f787f6062 in ber_sockbuf_add_io
() from lib/liblber-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#11 0x00007f8f78a31a68 in
ldap_int_tls_connect.isra.1 () from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#12 0x00007f8f78a32288 in ldap_int_tls_start
() from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#13 0x00007f8f78a0da70 in
ldap_int_open_connection () from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#14 0x00007f8f78a2014d in ldap_new_connection
() from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#15 0x00007f8f78a0d15a in ldap_open_defconn
() from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#16 0x00007f8f78a21568 in
ldap_send_initial_request () from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#17 0x00007f8f78a167a2 in ldap_sasl_bind ()
from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#18 0x00007f8f78a16b8a in ldap_sasl_bind_s ()
from lib/libldap_r-2.4.so.2
2021-05-09 01:11:22.021 Critical:+#19 0x00007f8f78a172e0 in ldap_simple_bind_s
() from lib/libldap_r-2.4.so.2
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8245
--- Comment #15 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
head:
• 81b5ca91
by OndÅ™ej KuznÃk at 2022-06-14T21:52:18+00:00
ITS#8245 Do not try to release a NULL entry
RE26 (2.6.3):
• 85649edf
by OndÅ™ej KuznÃk at 2022-06-23T18:34:57+00:00
ITS#8245 Do not try to release a NULL entry
RE25 (2.5.13):
• c8059b5d
by OndÅ™ej KuznÃk at 2022-06-23T18:46:44+00:00
ITS#8245 Do not try to release a NULL entry
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8227
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|2.7.0 |---
Status|RESOLVED |VERIFIED
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9870
Issue ID: 9870
Summary: Remove optional overlay syntax
Product: OpenLDAP
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: ondra(a)mistotebe.net
Target Milestone: ---
While the module/overlay support was really young, an unreleased version of
OpenLDAP supported 'optional overlays' that could fail start up without that
being treated as a fatal error.
This was later disabled, never documented and nowadays it can't work anyway,
but the configuration option is still there in config_overlay() honouring
overlay names starting with the '-' character as an alias. A patch to remove
that leftover is coming.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9869
Issue ID: 9869
Summary: LDAP over TLS not doing hostname verification in
version 2.4.59
Product: OpenLDAP
Version: 2.4.59
Hardware: x86_64
OS: Linux
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: libraries
Assignee: bugs(a)openldap.org
Reporter: radiatejava(a)gmail.com
Target Milestone: ---
My software was using openldap client 2.4.44 to talk to the LDAP server. We
have shifted to 2.4.59 now to address some issues. Ever since we shifted, the
new version is allowing LDAP over TLS without hostname verification.
In the older 2.4.44, I always got this error if hostname did not match the CN
value:
return code -1 - Can't contact LDAP server) diagnostic message TLS: hostname
does not match CN in peer certificate
But after the lib update, no such error even if I am using LDAP server IP to do
LDAP bind while LDAP server certificate has CN set as some FQDN (say
test.ldap.com). Our client side code has not changed while we updated the ldap
lib. For our client, we are only doing these settings:
ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTDIR, lCertsDir)
ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, lCert)
Has there been any change in this regard? How do I enforce hostname
verification now?
Thanks
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8227
OndÅ™ej KuznÃk <ondra(a)mistotebe.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |WORKSFORME
--- Comment #6 from OndÅ™ej KuznÃk <ondra(a)mistotebe.net> ---
Yeah, just gone all the way to backlogging one consumer till we block in
slapd_wait_writer() and the other one keeps receiving all messages as they are
prepared, just as one would hope. Resuming the blocked consumer seems to flush
everything down that connection as well.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8227
--- Comment #5 from Howard Chu <hyc(a)openldap.org> ---
Possibly this ticket is obsolete then. If you're satisfied that
suspending/blocking one consumer doesn't interfere with other
consumers' progress, we can just close this.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=8227
--- Comment #4 from OndÅ™ej KuznÃk <ondra(a)mistotebe.net> ---
Maybe you meant something else because I'm not seeing this,
syncprov_matchops->syncprov_qresp already schedules a separate syncprov_qtask
for each active persist session that has anything to send out. Those sessions
each have a separate response queue, sharing a reference to the resinfo
provided.
And those tasks then run independent of each other sending messages (since
ITS#5985 just one message at a time), reclaiming syncres and since ITS#8039
possibly resinfo as they make progress. Also verified all of this at runtime.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=6942
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|--- |High
--- Comment #3 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
Fairly critical for 2.7.0 so that we can better handle replicated environments
with chaining where MMR is in play.
--
You are receiving this mail because:
You are on the CC list for the issue.
https://bugs.openldap.org/show_bug.cgi?id=9861
Issue ID: 9861
Summary: Read-only databases can't be opened - regression
introduced with da0527ac
Product: LMDB
Version: unspecified
Hardware: aarch64
OS: Mac OS
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: liblmdb
Assignee: bugs(a)openldap.org
Reporter: jocke(a)ordo.one
Target Milestone: ---
Created attachment 905
--> https://bugs.openldap.org/attachment.cgi?id=905&action=edit
Reduced simple test to open the environment that fails
The ability to open an environment in read-only mode when the file permissions
is 'read only' for the user is no longer possible after the commit
da0527ac75b811419b7007202799f96b2edb5aef.
It is simply reproduced by creating a database with e.g. mtest.c, then changing
the permissions to read-only, then running another trivial program trying to
open the environment in read-only mode / no-lock mode fails.
Specifically, after some investigation it seems that the check on line 5516 "if
(!(flags & (MDB_RDONLY|MDB_WRITEMAP))) {" was removed in the above commit such
that mdb_fopen() is called (presumably incorrectly?).
Returning that guard check seems to restore functionality, but I'm not familiar
enough with the code base to say that is a valid fix - but seems likely.
I applied that single change here:
https://github.com/hassila/swift-lmdb/tree/hassila-mdb-merge-patch
with this commit:
https://github.com/hassila/swift-lmdb/commit/c940b4c807c278cea43d2e3858dc22…
To reproduce with a clean checkout:
1. make
2. mkdir tested
3. ./mtest
4. chmod -wx testdb/data.mdb
5. run the attached program (reduced from real code base)
--
You are receiving this mail because:
You are on the CC list for the issue.