- openldap-bugs - openldap.org

Re: reference through null pointer and memory leak (related to ITS#7588)
by hyc＠symas.com 27 May '13

27 May '13

John Hardin wrote: > My previous email to ITS is unreadable. Here is a repeat of what I posted. Thanks, fixed now in master. > > -John > > > Configuration: > > CFLAGS="-g -O0" ./configure --exec-prefix=/usr --prefix=/ --enable-overlays=yes --enable-slapd --enable-debug > > Start server: > > valgrind --leak-check=full openldap/servers/slapd/slapd > > Perform search with sorted, paged results. Repeating the command will cause the leaked memory to grow. I'm using: > > ldapsearch -H ldap://10.10.9.85 -x -b ou=people,dc=example,dc=com -s one -E'!sss=sn:2.5.13.3' -E'!pr=10/prompt' > > At the prompt, type ctrl-C. > > Kill the slapd process. The output of valgrind shows the following: > > ==486== > ==486== HEAP SUMMARY: > ==486== in use at exit: 95,262 bytes in 1,984 blocks > ==486== total heap usage: 34,975 allocs, 32,991 frees, 22,150,370 bytes allocated > ==486== > ==486== 394 (16 direct, 378 indirect) bytes in 1 blocks are definitely lost in loss record 7 of 10 > ==486== at 0x4027282: malloc (vg_replace_malloc.c:270) > ==486== by 0x82228BF: ber_memalloc_x (memory.c:228) > ==486== by 0x822290C: ber_memalloc (memory.c:244) > ==486== by 0x81EAC29: tavl_insert (tavl.c:94) > ==486== by 0x81C7FE9: sssvlv_op_response (sssvlv.c:760) > ==486== by 0x8084184: slap_response_play (result.c:491) > ==486== by 0x80859AE: slap_send_search_entry (result.c:995) > ==486== by 0x810BDD6: bdb_search (search.c:1014) > ==486== by 0x80F11DB: overlay_op_walk (backover.c:671) > ==486== by 0x80F138B: over_op_func (backover.c:723) > ==486== by 0x80F1443: over_op_search (backover.c:750) > ==486== by 0x80748AE: fe_op_search (search.c:402) > ==486== > ==486== 94,753 (16 direct, 94,737 indirect) bytes in 1 blocks are definitely lost in loss record 10 of 10 > ==486== at 0x4027282: malloc (vg_replace_malloc.c:270) > ==486== by 0x82228BF: ber_memalloc_x (memory.c:228) > ==486== by 0x822290C: ber_memalloc (memory.c:244) > ==486== by 0x81EAB3A: tavl_insert (tavl.c:69) > ==486== by 0x81C7FE9: sssvlv_op_response (sssvlv.c:760) > ==486== by 0x8084184: slap_response_play (result.c:491) > ==486== by 0x80859AE: slap_send_search_entry (result.c:995) > ==486== by 0x810BDD6: bdb_search (search.c:1014) > ==486== by 0x80F11DB: overlay_op_walk (backover.c:671) > ==486== by 0x80F138B: over_op_func (backover.c:723) > ==486== by 0x80F1443: over_op_search (backover.c:750) > ==486== by 0x80748AE: fe_op_search (search.c:402) > ==486== > ==486== LEAK SUMMARY: > ==486== definitely lost: 32 bytes in 2 blocks > ==486== indirectly lost: 95,115 bytes in 1,976 blocks > ==486== possibly lost: 0 bytes in 0 blocks > ==486== still reachable: 115 bytes in 6 blocks > ==486== suppressed: 0 bytes in 0 blocks > ==486== Reachable blocks (those to which a pointer was found) are not shown. > ==486== To see them, rerun with: --leak-check=full --show-reachable=yes > ==486== > ==486== For counts of detected and suppressed errors, rerun with: -v > ==486== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 71 from 13) > > > > > > ----- Original Message ----- > From: Howard Chu <hyc(a)symas.com> > To: jdhgit(a)yahoo.com; openldap-its(a)openldap.org > Cc: > Sent: Friday, May 24, 2013 8:10 AM > Subject: Re: reference through null pointer and memory leak (related to ITS#7588) > > jdhgit(a)yahoo.com wrote: >> Full_Name: John Hardin >> Version: master >> OS: Centos 6.4 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (50.23.115.111) >> >> >> The commit for ITS#7588 causes a crash if next_node is NULL: >> >> /* Set the first entry to send for the next page */ >> so->so_tree = next_node; >> + next_node->avl_left = NULL; >> >> next_node will be NULL if all entries have been sent, or if slapd_shutdown is >> true. > > Thanks for pointing this out, will fix it shortly. > >> Another issue related to ITS#7588 is a memory leak when a sorted search with >> paged results is aborted. This may be because so->so_tree is not the root of the >> tree when free_sort_op() calls tavl_free(). > > Not being root of the tree is irrelevant. The tree is threaded, and every remaining node is connected by its preceding node's right child pointer. The tavl_free() function recurses over all of the right and left children, so this should not be a problem. > > Can you post a test case that demonstrates the leak? > > -- -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by hyc＠symas.com 27 May '13

27 May '13

Christian Kratzer wrote: > Hi Howard, Never mind, this was actually a bug in the handling of proxied attributes. Fixed now in master, your test case should work fine there. > > On Mon, 27 May 2013, hyc(a)symas.com wrote: >> ck(a)cksoft.de wrote: >>> Hi, >>> >>> Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. >> >> Yeah, using DNs other than the cn=config rootDN is frequently a problem. This >> is why when cn=config was introduced in 2.3 only the cn=config rootDN was >> allowed access to the tree. >> >> In this particular case, there's a simpler solution - add schema definitions >> for the missing RDN attributes directly to the cn=config entry. In your case, >> move the "ou" definition from the cn=core schema entry. >> >> There's nothing dirty about this solution - it has always been valid to define >> schema elements in the top-level slapd.conf file as well as in the top >> cn=config global config entry. The feature doesn't get used much because most >> 3rd party schemas are distributed as their own files, so it's simpler to just >> use the include directive to reference them. But for your current situation, >> you need to define these schema elements as early as possible, so that they >> can be processed as valid later on. > > Thanks for the feedback. > > As my sample had modifiersName: cn=Alice,ou=People,dc=test I added definitions for 'ou' and 'dc' to cn=config. > > It seems this helps for modifiersNames of entries below cn=config but not for cn=config itself. > > I have uploaded following three configs that illustrate the remaining problem: > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-1-fail.l… > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-2-ok.ldif > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-3-fail.l… > > The original failure with config-1 because of a modifiersName on cn=module{0},cn=config: > > [root@test-centos64 test]# slapadd -v -n0 -F config-1 -l config-1-fail.ldif > added: "cn=config" (00000001) > 51a32d4b str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) > slapadd: could not parse entry (line=42) > _# 7.41% eta none elapsed none spd 1.5 M/s > Closing DB... > [root@test-centos64 test]# > > Workaround applied in config-2 with attribute definitions in cn=config > > [root@test-centos64 test]# diff -u config-1-fail.ldif config-2-ok.ldif > --- config-1-fail.ldif 2013-05-27 11:50:35.368253951 +0200 > +++ config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 > @@ -28,6 +28,12 @@ > olcTLSVerifyClient: never > olcToolThreads: 1 > olcWriteTimeout: 0 > +olcAttributeTypes: ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' > + RFC2256: organizational unit this object belongs to' SUP name ) > +olcAttributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone > + nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST > + R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA > + LUE ) > structuralObjectClass: olcGlobal > entryUUID: 3b1e9034-58d9-1032-8161-d3a3b8e342e7 > creatorsName: cn=config > @@ -86,8 +92,6 @@ > ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) > olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 > : organization this object belongs to' SUP name ) > -olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' > - RFC2256: organizational unit this object belongs to' SUP name ) > olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated > with the entity' SUP name ) > olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui > @@ -193,10 +197,6 @@ > olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbo > x' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR ca > seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) > -olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone > - nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST > - R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA > - LUE ) > olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DE > SC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBST > R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) > [root@test-centos64 test]# > > [root@test-centos64 test]# slapadd -v -n0 -F config-2 -l config-2-ok.ldif > added: "cn=config" (00000001) > added: "cn=module{0},cn=config" (00000001) > added: "cn=schema,cn=config" (00000001) > added: "cn={0}core,cn=schema,cn=config" (00000001) > added: "olcDatabase={-1}frontend,cn=config" (00000001) > added: "olcDatabase={0}config,cn=config" (00000001) > added: "olcDatabase={1}mdb,cn=config" (00000001) > _#################### 100.00% eta none elapsed none fast! > Closing DB... > [root@test-centos64 test]# > > Breaks again after a modifiersname is added to cn=config > > [root@test-centos64 test]# diff -u config-2-ok.ldif config-3-fail.ldif > --- config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 > +++ config-3-fail.ldif 2013-05-27 11:52:57.346255334 +0200 > @@ -42,7 +42,7 @@ > olcLogLevel: Stats > olcLogLevel: Stats2 > entryCSN: 20130524161850.764209Z#000000#000#000000 > -modifiersName: cn=config > +modifiersName: cn=Alice,ou=People,dc=test > modifyTimestamp: 20130524161850Z > > dn: cn=module{0},cn=config > [root@test-centos64 test]# > > [root@test-centos64 test]# slapadd -v -n0 -F config-3 -l config-3-fail.ldif > 51a32daf str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) > slapadd: could not parse entry (line=1) > _# 7.35% eta none elapsed none spd 3.0 M/s > Closing DB... > [root@test-centos64 test]# > > Sorry if I do not see the obvious. Is there any possibility to get this to work for cn=config as well as entries below cn=config. > > How much freedom would we have to rearrange the entries und cn=config so we could have the schema defintions read before olcGlobal ? > > Greetings > Christian > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by ck＠cksoft.de 27 May '13

27 May '13

Hi Howard, On Mon, 27 May 2013, hyc(a)symas.com wrote: > ck(a)cksoft.de wrote: >> Hi, >> >> Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. > > Yeah, using DNs other than the cn=config rootDN is frequently a problem. This > is why when cn=config was introduced in 2.3 only the cn=config rootDN was > allowed access to the tree. > > In this particular case, there's a simpler solution - add schema definitions > for the missing RDN attributes directly to the cn=config entry. In your case, > move the "ou" definition from the cn=core schema entry. > > There's nothing dirty about this solution - it has always been valid to define > schema elements in the top-level slapd.conf file as well as in the top > cn=config global config entry. The feature doesn't get used much because most > 3rd party schemas are distributed as their own files, so it's simpler to just > use the include directive to reference them. But for your current situation, > you need to define these schema elements as early as possible, so that they > can be processed as valid later on. Thanks for the feedback. As my sample had modifiersName: cn=Alice,ou=People,dc=test I added definitions for 'ou' and 'dc' to cn=config. It seems this helps for modifiersNames of entries below cn=config but not for cn=config itself. I have uploaded following three configs that illustrate the remaining problem: http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-1-fail.l… http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-2-ok.ldif http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-3-fail.l… The original failure with config-1 because of a modifiersName on cn=module{0},cn=config: [root@test-centos64 test]# slapadd -v -n0 -F config-1 -l config-1-fail.ldif added: "cn=config" (00000001) 51a32d4b str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=42) _# 7.41% eta none elapsed none spd 1.5 M/s Closing DB... [root@test-centos64 test]# Workaround applied in config-2 with attribute definitions in cn=config [root@test-centos64 test]# diff -u config-1-fail.ldif config-2-ok.ldif --- config-1-fail.ldif 2013-05-27 11:50:35.368253951 +0200 +++ config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 @@ -28,6 +28,12 @@ olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 +olcAttributeTypes: ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' + RFC2256: organizational unit this object belongs to' SUP name ) +olcAttributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone + nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST + R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA + LUE ) structuralObjectClass: olcGlobal entryUUID: 3b1e9034-58d9-1032-8161-d3a3b8e342e7 creatorsName: cn=config @@ -86,8 +92,6 @@ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 : organization this object belongs to' SUP name ) -olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' - RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui @@ -193,10 +197,6 @@ olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbo x' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR ca seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) -olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone - nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST - R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA - LUE ) olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DE SC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) [root@test-centos64 test]# [root@test-centos64 test]# slapadd -v -n0 -F config-2 -l config-2-ok.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) added: "olcDatabase={0}config,cn=config" (00000001) added: "olcDatabase={1}mdb,cn=config" (00000001) _#################### 100.00% eta none elapsed none fast! Closing DB... [root@test-centos64 test]# Breaks again after a modifiersname is added to cn=config [root@test-centos64 test]# diff -u config-2-ok.ldif config-3-fail.ldif --- config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 +++ config-3-fail.ldif 2013-05-27 11:52:57.346255334 +0200 @@ -42,7 +42,7 @@ olcLogLevel: Stats olcLogLevel: Stats2 entryCSN: 20130524161850.764209Z#000000#000#000000 -modifiersName: cn=config +modifiersName: cn=Alice,ou=People,dc=test modifyTimestamp: 20130524161850Z dn: cn=module{0},cn=config [root@test-centos64 test]# [root@test-centos64 test]# slapadd -v -n0 -F config-3 -l config-3-fail.ldif 51a32daf str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=1) _# 7.35% eta none elapsed none spd 3.0 M/s Closing DB... [root@test-centos64 test]# Sorry if I do not see the obvious. Is there any possibility to get this to work for cn=config as well as entries below cn=config. How much freedom would we have to rearrange the entries und cn=config so we could have the schema defintions read before olcGlobal ? Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

1 0

Re: (ITS#7582) Access to uninitialized memory when sending cldap packet
by stefw＠redhat.com 27 May '13

27 May '13

On 23.05.2013 21:34, Howard Chu wrote: > Your patch doesn't fix the issue. The behavior under valgrind is > unchanged either way. Seems you're missing a '!' in your test. Indeed, thank you for fixing this and applying the patch. Cheers, Stef

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by hyc＠symas.com 27 May '13

27 May '13

ck(a)cksoft.de wrote: > Hi, > > Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. Yeah, using DNs other than the cn=config rootDN is frequently a problem. This is why when cn=config was introduced in 2.3 only the cn=config rootDN was allowed access to the tree. In this particular case, there's a simpler solution - add schema definitions for the missing RDN attributes directly to the cn=config entry. In your case, move the "ou" definition from the cn=core schema entry. There's nothing dirty about this solution - it has always been valid to define schema elements in the top-level slapd.conf file as well as in the top cn=config global config entry. The feature doesn't get used much because most 3rd party schemas are distributed as their own files, so it's simpler to just use the include directive to reference them. But for your current situation, you need to define these schema elements as early as possible, so that they can be processed as valid later on. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7609) back-meta enhancement: filter patterns for target selection
by hyc＠OpenLDAP.org 27 May '13

27 May '13

Full_Name: Howard Chu Version: 2.4.35 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc Since a lot of applications perform DN lookups using a search filter, it would be useful to allow specifying a regex pattern match on filters to select a target. This would avoid broadcasting a suffix-level search to all targets unnecessarily. The intended use case is for a system where the DIT is sharded across multiple servers, and entries are distributed across each target using some regular pattern. (e.g., uid=a.* on target1, uid=b.* on target2, etc...)

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by ck＠cksoft.de 26 May '13

26 May '13

Hi, Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. I have a more elaborate test setup with four servers. Two masters ldaptest1, ldaptest2 using syncrepl in mirrormode . Two slaves ldaptest3, ldaptest4 that use syncrepl to slave from the masters. The masters and the slaves also replicate cn=config between themselves. Replication config is as follows: on ldaptest1 and ldaptest2: dn: cn=config ... olcServerID: 1 ldap://ldaptest1.cksoft.de olcServerID: 2 ldap://ldaptest2.cksoft.de olcServerID: 3 ldap://ldaptest3.cksoft.de olcServerID: 4 ldap://ldaptest4.cksoft.de dn: olcDatabase={1}mdb,cn=config ... olcSyncrepl: rid=001 provider=ldap://ldaptest1.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcSyncrepl: rid=002 provider=ldap://ldaptest2.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcMirrorMode: TRUE on ldaptest3 and ldaptest4: dn: cn=config ... olcServerID: 1 ldap://ldaptest1.cksoft.de olcServerID: 2 ldap://ldaptest2.cksoft.de olcServerID: 3 ldap://ldaptest3.cksoft.de olcServerID: 4 ldap://ldaptest4.cksoft.de dn: olcDatabase={1}mdb,cn=config ... olcSyncrepl: rid=001 provider=ldap://ldaptest1.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcSyncrepl: rid=002 provider=ldap://ldaptest2.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcMirrorMode: FALSE Once I modify something trivial like olcLogLevel on the slaves using my personal dn, cn=config will have following operational attributes: # config dn: cn=config structuralObjectClass: olcGlobal entryUUID: dc78e00a-461a-1032-9454-cd151c72b364 creatorsName: cn=config createTimestamp: 20130430194949Z entryCSN: 20130526075059.867187Z#000000#004#000000 modifiersName: uid=ckratzer,ou=people,dc=test modifyTimestamp: 20130526075059Z contextCSN: 20130526074631.636527Z#000000#003#000000 contextCSN: 20130526075059.867187Z#000000#004#000000 entryDN: cn=config subschemaSubentry: cn=Subschema I then restart slapd on the first slave ldaptest3 and leave it running on ldaptest4. A change replicated from the masters will appear on ldaptest4 just fine. The restarted master on ldaptest3 fails to apply the change May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_message_to_entry: rid=001 DN: cn=test,dc=test, UUID: 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 inserted UUID 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 be_search (0) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 cn=test,dc=test May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 entry unchanged, ignored (cn=test,dc=test,) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_updateCookie: rid=001 be_modify failed (17) May 26 10:06:13 ldaptest3 slapd[2410]: do_syncrepl: rid=001 rc 17 retrying May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_message_to_entry: rid=002 DN: cn=test,dc=test, UUID: 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 inserted UUID 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 be_search (0) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 cn=test,dc=test, May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 entry unchanged, ignored (cn=test,dc=test,) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_updateCookie: rid=002 be_modify failed (17) May 26 10:06:13 ldaptest3 slapd[2410]: do_syncrepl: rid=002 rc 17 retrying I currently have customer data in above test setup so I had to do some obfuscation in above samples and logs. If required I can setup maximally stripped down case that illustrates the problem. Would it be possible to mask modifiersName inside cn=config to either a fixed value just append something like cn=proxied,cn=config to dns outside of cn=config. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

1 0

Re: (ITS#7607) Assertion triggers during many sequential transaction commits
by hyc＠symas.com 25 May '13

25 May '13

Howard Chu wrote: > éÌØÑ ìÕËØÑÎÏ× wrote: >> What can i do to help investigating this issue? >> I'm not very familliar with lmdb sources so any suggestions on where to look >> would be appreciated! > > I've installed a Win7 x64 VM here and compiled with gcc 4.8.0 and it works fine. > I've also installed Visual Studio 2012 Express and compiled with that, it's also working fine. Doesn't seem like there's an OpenLDAP bug here, must be a problem with your machine. >> ó Õ×ÁÖÅÎÉÅÍ, éÌØÑ >> >> >> 2013/5/24 Howard Chu <hyc(a)symas.com <mailto:hyc@symas.com>> >> >> ilya.lukyanov(a)gmail.com <mailto:ilya.lukyanov@gmail.com> wrote: >> >> Full_Name: Ilya Lukyanov >> Version: 2.4.35 >> OS: Windows 7 x64 >> URL: ftp://ftp.openldap.org/__incoming/ <ftp://ftp.openldap.org/incoming/> >> Submission from: (NULL) (95.25.254.250) >> >> >> I've built lmdb from source distribution of OpenLDAP 2.4.35 under >> Windows 7 x64 >> under Visual Studio 2012. All tests included into source distribution pass >> successfully. >> >> Then i'm executing my own test with code as follows: >> https://gist.github.com/__ilyalukyanov/5644971 >> <https://gist.github.com/ilyalukyanov/5644971> >> And i'm allways get an asserion when executing near 32500-th >> mdb_txn_commit >> (line 2231 - assert(oldpg_txnid <= env->me_pglast);) >> I think this is a bug because if consider the scenario with separate >> usage of >> LightningDB under high write-load scenario, 32k commits is not enough. >> >> >> Your test runs fine on my Linux box. I don't currently have a Windows 7 >> x64 test machine, won't be able to investigate this any time soon. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7606) reference through null pointer and memory leak
by quanah＠zimbra.com 24 May '13

24 May '13

--On Friday, May 24, 2013 9:06 PM +0000 jdhgit(a)yahoo.com wrote: Please don't send garbage to the ITS. I advise finding an email client that can actually generate proper email. --Quanah > --1665047788-1800616979-1369429529=:40525 > Content-Type: text/plain; charset=iso-8859-1 > Content-Transfer-Encoding: quoted-printable > > Configuration:=0A=0A=A0 CFLAGS=3D"-g -O0" ./configure > --exec-prefix=3D/usr = --prefix=3D/ --enable-overlays=3Dyes > --enable-slapd --enable-debug=0A=0ASta= rt server: =0A=0A=A0 valgrind > --leak-check=3Dfull openldap/servers/slapd/sl= apd=0A=0APerform search > with sorted, paged results. Repeating the command w= ill cause the leaked > memory to grow. I'm using:=0A=0A=A0 ldapsearch -H ldap= ://10.10.9.85 -x > -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one -E'!sss=3Dsn:2= .5.13.3' > -E'!pr=3D10/prompt'=0A=0AAt the prompt, type ctrl-C.=0A=0AKill the= > slapd process. The output of valgrind shows the > following:=0A=0A=3D=3D486= =3D=3D =0A=3D=3D486=3D=3D HEAP > SUMMARY:=0A=3D=3D486=3D=3D=A0=A0=A0=A0 in us= e at exit: 95,262 bytes in > 1,984 blocks=0A=3D=3D486=3D=3D=A0=A0 total heap = usage: 34,975 allocs, > 32,991 frees, 22,150,370 bytes allocated=0A=3D=3D486= =3D=3D > =0A=3D=3D486=3D=3D 394 (16 direct, 378 indirect) bytes in 1 blocks a= re > definitely lost in loss record 7 of 10=0A=3D=3D486=3D=3D=A0=A0=A0 at 0x4= > 027282: malloc (vg_replace_malloc.c:270)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x82= 228BF: ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x822290= C: ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x81EAC29: tav= l_insert (tavl.c:94)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x81C7FE9: sssvlv_op_res= ponse (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 > by 0x8084184: slap_response= _play > (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80859AE: slap_send_sea= > rch_entry (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x810BDD6: > bdb_searc= h (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F11DB: > overlay_op_walk = (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x80F138B: over_op_func (bac= kover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x80F1443: over_op_search (backo= ver.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 > by 0x80748AE: fe_op_search (search.c:= 402)=0A=3D=3D486=3D=3D > =0A=3D=3D486=3D=3D 94,753 (16 direct, 94,737 indirec= t) bytes in 1 > blocks are definitely lost in loss record 10 of 10=0A=3D=3D48= > 6=3D=3D=A0=A0=A0 at 0x4027282: malloc > (vg_replace_malloc.c:270)=0A=3D=3D486= =3D=3D=A0=A0=A0 by 0x82228BF: > ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D= =3D=A0=A0=A0 by 0x822290C: > ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0= =A0=A0 by 0x81EAB3A: > tavl_insert (tavl.c:69)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x81C7FE9: > sssvlv_op_response (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 by = > 0x8084184: slap_response_play (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 > by = 0x80859AE: slap_send_search_entry > (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0= by 0x810BDD6: bdb_search > (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x8= 0F11DB: > overlay_op_walk (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80= > F138B: over_op_func (backover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x80F144= 3: over_op_search (backover.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 > by 0x80748AE:= fe_op_search (search.c:402)=0A=3D=3D486=3D=3D > =0A=3D=3D486=3D=3D LEAK SUMM= ARY:=0A=3D=3D486=3D=3D=A0=A0=A0 definitely > lost: 32 bytes in 2 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0 indirectly lost: > 95,115 bytes in 1,976 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0=A0=A0 possibly > lost: 0 bytes in 0 blocks=0A=3D=3D486= =3D=3D=A0=A0=A0 still reachable: > 115 bytes in 6 blocks=0A=3D=3D486=3D=3D=A0= =A0=A0=A0=A0=A0=A0=A0 > suppressed: 0 bytes in 0 blocks=0A=3D=3D486=3D=3D Rea= chable blocks > (those to which a pointer was found) are not shown.=0A=3D=3D4= 86=3D=3D > To see them, rerun with: --leak-check=3Dfull --show-reachable=3Dye= > s=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D For counts of detected and > suppresse= d errors, rerun with: -v=0A=3D=3D486=3D=3D ERROR SUMMARY: 2 > errors from 2 c= ontexts (suppressed: 71 from 13) > --1665047788-1800616979-1369429529=:40525 > Content-Type: text/html; charset=iso-8859-1 > Content-Transfer-Encoding: quoted-printable > > <html><body><div style=3D"color:#000; background-color:#fff; > font-family:ti= mes new roman, new york, times, > serif;font-size:12pt">Configuration: <br= >>   CFLAGS=3D"-g -O0" ./configure --exec-prefix=3D/usr --prefix=3D/ >> --e= > nable-overlays=3Dyes --enable-slapd --enable-debug Start server: > <br= >>   valgrind --leak-check=3Dfull >> openldap/servers/slapd/slapd <b= > r>Perform search with sorted, paged results. Repeating the command will > cau= se the leaked memory to grow. I'm using:   ldapsearch -H > ldap:/= /10.10.9.85 -x -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one > -E'!sss=3Dsn:2.5= .13.3' -E'!pr=3D10/prompt' At the prompt, type > ctrl-C. Kill t= he slapd process. The output of valgrind shows the > following: =3D=3D= 486=3D=3D =3D=3D486=3D=3D HEAP > SUMMARY: =3D=3D486=3D=3D  &= nbsp;  in use at exit: > 95,262 bytes in 1,984 blocks =3D=3D486=3D=3D=    total heap > usage: 34,975 allocs, 32,991 frees, 22,150,370 byte= s > allocated =3D=3D486=3D=3D =3D=3D486=3D=3D 394 (16 > direct, 378 indirect) bytes in 1 blocks are definitely lost in loss > record= 7 of 10 =3D=3D486=3D=3D    at 0x4027282: > malloc (vg_repl= ace_malloc.c:270) =3D=3D486=3D=3D    > by 0x82228BF: ber_me= malloc_x > (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: = > ber_memalloc (memory.c:244) =3D=3D486=3D=3D    by > 0x81EAC= 29: tavl_insert (tavl.c:94) =3D=3D486=3D=3D    > by 0x81C7F= E9: sssvlv_op_response > (sssvlv.c:760) =3D=3D486=3D=3D    = by 0x8084184: > slap_response_play (result.c:491) =3D=3D486=3D=3D &nb= sp;  > by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486= > =3D=3D    by 0x810BDD6: bdb_search > (search.c:1014) =3D=3D= 486=3D=3D    by 0x80F11DB: > overlay_op_walk (backover.c:671)<= br>=3D=3D486=3D=3D    > by 0x80F138B: over_op_func (backover.c= > :723) =3D=3D486=3D=3D    by 0x80F1443: over_op_search > (ba= ckover.c:750) =3D=3D486=3D=3D    by 0x80748AE: > fe_op_sear= ch > (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D 94,753 (16 direct, > 9= 4,737 indirect) bytes in 1 blocks are definitely lost in loss record > 10 of = 10 =3D=3D486=3D=3D    at 0x4027282: malloc > (vg_replace_ma= lloc.c:270) =3D=3D486=3D=3D    by > 0x82228BF: ber_memalloc= _x > (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: ber_me= > malloc (memory.c:244) =3D=3D486=3D=3D    by 0x81EAB3A: > ta= vl_insert (tavl.c:69) =3D=3D486=3D=3D    by > 0x81C7FE9: ss= svlv_op_response > (sssvlv.c:760) =3D=3D486=3D=3D    by 0x8= 084184: > slap_response_play (result.c:491) =3D=3D486=3D=3D  &nb= sp; > by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486=3D=3D&= > nbsp;   by 0x810BDD6: bdb_search > (search.c:1014) =3D=3D486=3D= =3D    by 0x80F11DB: > overlay_op_walk (backover.c:671) =3D= =3D486=3D=3D    > by 0x80F138B: over_op_func (backover.c:723)<= > br>=3D=3D486=3D=3D    by 0x80F1443: over_op_search > (backover.c:750) =3D=3D486=3D=3D    by 0x80748AE: > fe_op_= search (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D LEAK > SUMMARY:<= br>=3D=3D486=3D=3D    definitely lost: 32 bytes > in 2 blocks<= br>=3D=3D486=3D=3D    indirectly lost: > 95,115 bytes in 1,976= > blocks =3D=3D486=3D=3D      possibly lost: 0 > b= ytes in 0 blocks =3D=3D486=3D=3D    still reachable: > 115 = bytes in 6 > blocks =3D=3D486=3D=3D      &nb= > sp;  suppressed: 0 bytes in 0 blocks =3D=3D486=3D=3D Reachable > bloc= ks (those to which a pointer was found) are not > shown. =3D=3D486=3D=3D T= o see them, rerun with: --leak-check=3Dfull > --show-reachable=3Dyes =3D= =3D486=3D=3D =3D=3D486=3D=3D For > counts of detected and suppressed erro= rs, rerun with: > -v =3D=3D486=3D=3D ERROR SUMMARY: 2 errors from 2 contex= ts > (suppressed: 71 from 13) <div style=3D"font-family: times new= > roman, new york, times, serif; font-size: 12pt;"><div > style=3D"font-family= : times new roman, new york, > times, serif; font-size: 12pt;"> </div> </div> </div></body></html> > --1665047788-1800616979-1369429529=:40525-- > > -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7606) reference through null pointer and memory leak
by jdhgit＠yahoo.com 24 May '13

24 May '13

--1665047788-1800616979-1369429529=:40525 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Configuration:=0A=0A=A0 CFLAGS=3D"-g -O0" ./configure --exec-prefix=3D/usr = --prefix=3D/ --enable-overlays=3Dyes --enable-slapd --enable-debug=0A=0ASta= rt server: =0A=0A=A0 valgrind --leak-check=3Dfull openldap/servers/slapd/sl= apd=0A=0APerform search with sorted, paged results. Repeating the command w= ill cause the leaked memory to grow. I'm using:=0A=0A=A0 ldapsearch -H ldap= ://10.10.9.85 -x -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one -E'!sss=3Dsn:2= .5.13.3' -E'!pr=3D10/prompt'=0A=0AAt the prompt, type ctrl-C.=0A=0AKill the= slapd process. The output of valgrind shows the following:=0A=0A=3D=3D486= =3D=3D =0A=3D=3D486=3D=3D HEAP SUMMARY:=0A=3D=3D486=3D=3D=A0=A0=A0=A0 in us= e at exit: 95,262 bytes in 1,984 blocks=0A=3D=3D486=3D=3D=A0=A0 total heap = usage: 34,975 allocs, 32,991 frees, 22,150,370 bytes allocated=0A=3D=3D486= =3D=3D =0A=3D=3D486=3D=3D 394 (16 direct, 378 indirect) bytes in 1 blocks a= re definitely lost in loss record 7 of 10=0A=3D=3D486=3D=3D=A0=A0=A0 at 0x4= 027282: malloc (vg_replace_malloc.c:270)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x82= 228BF: ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x822290= C: ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x81EAC29: tav= l_insert (tavl.c:94)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x81C7FE9: sssvlv_op_res= ponse (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x8084184: slap_response= _play (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80859AE: slap_send_sea= rch_entry (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x810BDD6: bdb_searc= h (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F11DB: overlay_op_walk = (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F138B: over_op_func (bac= kover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F1443: over_op_search (backo= ver.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80748AE: fe_op_search (search.c:= 402)=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D 94,753 (16 direct, 94,737 indirec= t) bytes in 1 blocks are definitely lost in loss record 10 of 10=0A=3D=3D48= 6=3D=3D=A0=A0=A0 at 0x4027282: malloc (vg_replace_malloc.c:270)=0A=3D=3D486= =3D=3D=A0=A0=A0 by 0x82228BF: ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D= =3D=A0=A0=A0 by 0x822290C: ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0= =A0=A0 by 0x81EAB3A: tavl_insert (tavl.c:69)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x81C7FE9: sssvlv_op_response (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x8084184: slap_response_play (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x80859AE: slap_send_search_entry (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0= by 0x810BDD6: bdb_search (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x8= 0F11DB: overlay_op_walk (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80= F138B: over_op_func (backover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F144= 3: over_op_search (backover.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80748AE:= fe_op_search (search.c:402)=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D LEAK SUMM= ARY:=0A=3D=3D486=3D=3D=A0=A0=A0 definitely lost: 32 bytes in 2 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0 indirectly lost: 95,115 bytes in 1,976 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0=A0=A0 possibly lost: 0 bytes in 0 blocks=0A=3D=3D486= =3D=3D=A0=A0=A0 still reachable: 115 bytes in 6 blocks=0A=3D=3D486=3D=3D=A0= =A0=A0=A0=A0=A0=A0=A0 suppressed: 0 bytes in 0 blocks=0A=3D=3D486=3D=3D Rea= chable blocks (those to which a pointer was found) are not shown.=0A=3D=3D4= 86=3D=3D To see them, rerun with: --leak-check=3Dfull --show-reachable=3Dye= s=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D For counts of detected and suppresse= d errors, rerun with: -v=0A=3D=3D486=3D=3D ERROR SUMMARY: 2 errors from 2 c= ontexts (suppressed: 71 from 13) --1665047788-1800616979-1369429529=:40525 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable <html><body><div style=3D"color:#000; background-color:#fff; font-family:ti= mes new roman, new york, times, serif;font-size:12pt">Configuration: <br= >  CFLAGS=3D"-g -O0" ./configure --exec-prefix=3D/usr --prefix=3D/ --e= nable-overlays=3Dyes --enable-slapd --enable-debug Start server: <br= >   valgrind --leak-check=3Dfull openldap/servers/slapd/slapd <b= r>Perform search with sorted, paged results. Repeating the command will cau= se the leaked memory to grow. I'm using:   ldapsearch -H ldap:/= /10.10.9.85 -x -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one -E'!sss=3Dsn:2.5= .13.3' -E'!pr=3D10/prompt' At the prompt, type ctrl-C. Kill t= he slapd process. The output of valgrind shows the following: =3D=3D= 486=3D=3D =3D=3D486=3D=3D HEAP SUMMARY: =3D=3D486=3D=3D  &= nbsp;  in use at exit: 95,262 bytes in 1,984 blocks =3D=3D486=3D=3D=    total heap usage: 34,975 allocs, 32,991 frees, 22,150,370 byte= s allocated =3D=3D486=3D=3D =3D=3D486=3D=3D 394 (16 direct, 378 indirect) bytes in 1 blocks are definitely lost in loss record= 7 of 10 =3D=3D486=3D=3D    at 0x4027282: malloc (vg_repl= ace_malloc.c:270) =3D=3D486=3D=3D    by 0x82228BF: ber_me= malloc_x (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: = ber_memalloc (memory.c:244) =3D=3D486=3D=3D    by 0x81EAC= 29: tavl_insert (tavl.c:94) =3D=3D486=3D=3D    by 0x81C7F= E9: sssvlv_op_response (sssvlv.c:760) =3D=3D486=3D=3D    = by 0x8084184: slap_response_play (result.c:491) =3D=3D486=3D=3D &nb= sp;  by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486= =3D=3D    by 0x810BDD6: bdb_search (search.c:1014) =3D=3D= 486=3D=3D    by 0x80F11DB: overlay_op_walk (backover.c:671)<= br>=3D=3D486=3D=3D    by 0x80F138B: over_op_func (backover.c= :723) =3D=3D486=3D=3D    by 0x80F1443: over_op_search (ba= ckover.c:750) =3D=3D486=3D=3D    by 0x80748AE: fe_op_sear= ch (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D 94,753 (16 direct, 9= 4,737 indirect) bytes in 1 blocks are definitely lost in loss record 10 of = 10 =3D=3D486=3D=3D    at 0x4027282: malloc (vg_replace_ma= lloc.c:270) =3D=3D486=3D=3D    by 0x82228BF: ber_memalloc= _x (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: ber_me= malloc (memory.c:244) =3D=3D486=3D=3D    by 0x81EAB3A: ta= vl_insert (tavl.c:69) =3D=3D486=3D=3D    by 0x81C7FE9: ss= svlv_op_response (sssvlv.c:760) =3D=3D486=3D=3D    by 0x8= 084184: slap_response_play (result.c:491) =3D=3D486=3D=3D  &nb= sp; by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486=3D=3D&= nbsp;   by 0x810BDD6: bdb_search (search.c:1014) =3D=3D486=3D= =3D    by 0x80F11DB: overlay_op_walk (backover.c:671) =3D= =3D486=3D=3D    by 0x80F138B: over_op_func (backover.c:723)<= br>=3D=3D486=3D=3D    by 0x80F1443: over_op_search (backover.c:750) =3D=3D486=3D=3D    by 0x80748AE: fe_op_= search (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D LEAK SUMMARY:<= br>=3D=3D486=3D=3D    definitely lost: 32 bytes in 2 blocks<= br>=3D=3D486=3D=3D    indirectly lost: 95,115 bytes in 1,976= blocks =3D=3D486=3D=3D      possibly lost: 0 b= ytes in 0 blocks =3D=3D486=3D=3D    still reachable: 115 = bytes in 6 blocks =3D=3D486=3D=3D      &nb= sp;  suppressed: 0 bytes in 0 blocks =3D=3D486=3D=3D Reachable bloc= ks (those to which a pointer was found) are not shown. =3D=3D486=3D=3D T= o see them, rerun with: --leak-check=3Dfull --show-reachable=3Dyes =3D= =3D486=3D=3D =3D=3D486=3D=3D For counts of detected and suppressed erro= rs, rerun with: -v =3D=3D486=3D=3D ERROR SUMMARY: 2 errors from 2 contex= ts (suppressed: 71 from 13) <div style=3D"font-family: times new= roman, new york, times, serif; font-size: 12pt;"><div style=3D"font-family= : times new roman, new york, times, serif; font-size: 12pt;"> </div> </div> </div></body></html> --1665047788-1800616979-1369429529=:40525--

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by pierangelo.masarati＠polimi.it 24 May '13

24 May '13

On 05/24/2013 09:41 PM, ck(a)cksoft.de wrote: > Full_Name: Christian Kratzer > Version: 2.4.35 > OS: CentOS 6.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (37.80.52.67) > > > Hi, > > I have setup an acl to allow write access to cn=config for users in the main > directory. > > This is mainly to have a clean audit trail of config changes using auditlog so > changes can be tracked back to who did them. > > We also backup config with slapcat -n0 and data with slapcat. > > When restoring configs and data I ran into two spefific problems when cn=config > entries have a modifiersdn outside of cn=config as in: > > dn: cn=config > objectClass: olcGlobal > ... > modifiersName: cn=Alice,ou=People,dc=test > modifyTimestamp: 20130524161850Z > > This is on openldap-2.4.35 on centos-6.4. > > I have built a simple test case to illustrate the problem. Should be easily > reproducible using after editing a few paths in below configs. > > We setup a new openldap server by using slapadd -n0 of below config and slapadd > of below data in test.ldif. > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config.ldif > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/test.ldif > > After starting slapd I modify the configuration as cn=Alice,ou=People,dc=test > using below scripts > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.sh > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.ldif > > I then extract following two backups from cn=config using slapcat -n0 and > dc=test using slapcat > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-cn=conf… > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-dc=test… > > First problem: An attempt to to restore slapcat-dc=test.ldif after deleting data > using "rm -f /var/lib/ldap/*" fails as follows: > > [root@test-centos64 openldap]# slapadd -v -F slapd.d -l slapcat-dc\=test.ldif > 519f93a8 PROXIED attributeDescription "OU" inserted. > 519f93a8 PROXIED attributeDescription "DC" inserted. > 519f93a8 => mdb_tool_entry_put: id2entry_add failed: err=17 > 519f93a8 => mdb_tool_entry_put: txn_aborted! File exists (17) > slapadd: could not add entry dn="dc=test" (line=1): txn_aborted! File exists This is a chicken and egg problem. OU is not built-in, so it cannot be used until it is configured. Configuration data must only use schema items whose definition is already loaded. I don't see a clear way out of this issue, so I'd pass the ball to Howard. My (humble) suggestion is: delegate modifications to identities whose DN is made of hardcoded attribute types: CN, UID (you can find what attribute types are hardcoded in schema_prep.c). p. > (17) > _#### 24.55% eta none elapsed none spd 2.0 > M/s > Closing DB... > [root@test-centos64 openldap]# > > I can successfully import the data if I edit cn=config.ldif and manuelly fix the > modifiersName to cn=config and reimport configuration using slapadd -n0. > > This also kills our disaster recovery scenario of deleting data and letting > syncrepl handle the recovery. > > Second problem: Recovery of the configuration fails as after "rm -fr slapd.d" > > [root@test-centos64 openldap]# slapadd -v -n0 -F slapd.d -l > slapcat-cn\=config.ldif > 519f95c2 str2entry: invalid value for attributeType modifiersName #0 (syntax > 1.3.6.1.4.1.1466.115.121.1.12) > slapadd: could not parse entry (line=1) > _# 5.39% eta none elapsed none spd 3.2 > M/s > Closing DB... > [root@test-centos64 openldap]# > > Again I am able to work around the problem by fixing the modifiersdn of the > cn=config dump before slapadding with slapadd -n0. > > Any chance of getting above use cases working ? I would like to provide the > customer in question with a straight forward recovery process for both data and > cn=config. > > They would like to avoid using the cn=config rootDN for regular administration > in order to have a clean audit trail of changes using auditlog on cn=config. > > Greetings > Christian > > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by ck＠cksoft.de 24 May '13

24 May '13

Full_Name: Christian Kratzer Version: 2.4.35 OS: CentOS 6.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (37.80.52.67) Hi, I have setup an acl to allow write access to cn=config for users in the main directory. This is mainly to have a clean audit trail of config changes using auditlog so changes can be tracked back to who did them. We also backup config with slapcat -n0 and data with slapcat. When restoring configs and data I ran into two spefific problems when cn=config entries have a modifiersdn outside of cn=config as in: dn: cn=config objectClass: olcGlobal ... modifiersName: cn=Alice,ou=People,dc=test modifyTimestamp: 20130524161850Z This is on openldap-2.4.35 on centos-6.4. I have built a simple test case to illustrate the problem. Should be easily reproducible using after editing a few paths in below configs. We setup a new openldap server by using slapadd -n0 of below config and slapadd of below data in test.ldif. http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config.ldif http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/test.ldif After starting slapd I modify the configuration as cn=Alice,ou=People,dc=test using below scripts http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.sh http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.ldif I then extract following two backups from cn=config using slapcat -n0 and dc=test using slapcat http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-cn=conf… http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-dc=test… First problem: An attempt to to restore slapcat-dc=test.ldif after deleting data using "rm -f /var/lib/ldap/*" fails as follows: [root@test-centos64 openldap]# slapadd -v -F slapd.d -l slapcat-dc\=test.ldif 519f93a8 PROXIED attributeDescription "OU" inserted. 519f93a8 PROXIED attributeDescription "DC" inserted. 519f93a8 => mdb_tool_entry_put: id2entry_add failed: err=17 519f93a8 => mdb_tool_entry_put: txn_aborted! File exists (17) slapadd: could not add entry dn="dc=test" (line=1): txn_aborted! File exists (17) _#### 24.55% eta none elapsed none spd 2.0 M/s Closing DB... [root@test-centos64 openldap]# I can successfully import the data if I edit cn=config.ldif and manuelly fix the modifiersName to cn=config and reimport configuration using slapadd -n0. This also kills our disaster recovery scenario of deleting data and letting syncrepl handle the recovery. Second problem: Recovery of the configuration fails as after "rm -fr slapd.d" [root@test-centos64 openldap]# slapadd -v -n0 -F slapd.d -l slapcat-cn\=config.ldif 519f95c2 str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=1) _# 5.39% eta none elapsed none spd 3.2 M/s Closing DB... [root@test-centos64 openldap]# Again I am able to work around the problem by fixing the modifiersdn of the cn=config dump before slapadding with slapadd -n0. Any chance of getting above use cases working ? I would like to provide the customer in question with a straight forward recovery process for both data and cn=config. They would like to avoid using the cn=config rootDN for regular administration in order to have a clean audit trail of changes using auditlog on cn=config. Greetings Christian

1 0

Re: (ITS#7607) Assertion triggers during many sequential transaction commits
by hyc＠symas.com 24 May '13

24 May '13

ilya.lukyanov(a)gmail.com wrote: > Full_Name: Ilya Lukyanov > Version: 2.4.35 > OS: Windows 7 x64 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (95.25.254.250) > > > I've built lmdb from source distribution of OpenLDAP 2.4.35 under Windows 7 x64 > under Visual Studio 2012. All tests included into source distribution pass > successfully. > > Then i'm executing my own test with code as follows: > https://gist.github.com/ilyalukyanov/5644971 > And i'm allways get an asserion when executing near 32500-th mdb_txn_commit > (line 2231 - assert(oldpg_txnid <= env->me_pglast);) > I think this is a bug because if consider the scenario with separate usage of > LightningDB under high write-load scenario, 32k commits is not enough. Your test runs fine on my Linux box. I don't currently have a Windows 7 x64 test machine, won't be able to investigate this any time soon. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7607) Assertion triggers during many sequential transaction commits
by ilya.lukyanov＠gmail.com 24 May '13

24 May '13

Full_Name: Ilya Lukyanov Version: 2.4.35 OS: Windows 7 x64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (95.25.254.250) I've built lmdb from source distribution of OpenLDAP 2.4.35 under Windows 7 x64 under Visual Studio 2012. All tests included into source distribution pass successfully. Then i'm executing my own test with code as follows: https://gist.github.com/ilyalukyanov/5644971 And i'm allways get an asserion when executing near 32500-th mdb_txn_commit (line 2231 - assert(oldpg_txnid <= env->me_pglast);) I think this is a bug because if consider the scenario with separate usage of LightningDB under high write-load scenario, 32k commits is not enough.

1 0

Re: reference through null pointer and memory leak (related to ITS#7588)
by hyc＠symas.com 24 May '13

24 May '13

jdhgit(a)yahoo.com wrote: > Full_Name: John Hardin > Version: master > OS: Centos 6.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (50.23.115.111) > > > The commit for ITS#7588 causes a crash if next_node is NULL: > > /* Set the first entry to send for the next page */ > so->so_tree = next_node; > + next_node->avl_left = NULL; > > next_node will be NULL if all entries have been sent, or if slapd_shutdown is > true. Thanks for pointing this out, will fix it shortly. > Another issue related to ITS#7588 is a memory leak when a sorted search with > paged results is aborted. This may be because so->so_tree is not the root of the > tree when free_sort_op() calls tavl_free(). Not being root of the tree is irrelevant. The tree is threaded, and every remaining node is connected by its preceding node's right child pointer. The tavl_free() function recurses over all of the right and left children, so this should not be a problem. Can you post a test case that demonstrates the leak? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by pa＠marcelot.net 24 May '13

24 May '13

On 23 mai 2013, at 19:41, Michael Ströder <michael(a)stroeder.com> wrote: > pa(a)marcelot.net wrote: >> On 23 mai 2013, at 16:31, Howard Chu <hyc(a)symas.com> wrote: >>> Don't do that. >> >> Sure, that's why I have a *bad* workaround to not update the 'objectClass' >> attribute even if the original and my generated one don't match. > > IMO this is not a *bad* workaround. I think it's good practice in a UI client > to *not* automagically modify attribute 'objectClass' without explicit user > interaction asking for modification. In the case of our UI, we don't even present the entries or attributes as is to the user but in an "abstracted" way. They may not even know it's read/stored internally from/as attributes or entries. So, yeah, so it's not so *bad*. It's more of an implementation tuning I wish would have not been required, because the modification seemed harmless and legit (according to LDAP standards). > Ciao, Michael. Regards, Pierre-Arnaud

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by pa＠marcelot.net 24 May '13

24 May '13

On 23 mai 2013, at 19:26, Michael Ströder <michael(a)stroeder.com> wrote: > pa(a)marcelot.net wrote: >> It looks like it's not possible to modify the 'objectClass' attribute of >> configuration entries. >> >> I have some code generating entries for OpenLDAP configuration from a UI utility >> and updating existing configuration entries in DIT. >> This code generates entries with the 'objectClass' attribute containing the full >> object class hierarchy (all the way to 'top') and not only the highest >> structural object class (which is the case of default OpenLDAP configuration). >> >> When updating the configuration in the DIT, the code then tries to complete the >> 'objectClass' attribute with the full list of object classes. >> That operations ends with "error code 53- UnwillingToPerform". >> >> >> Here's an example on the "cn=config" entry: >> #!RESULT ERROR >> #!CONNECTION ldap://10.211.55.13:389 >> #!DATE 2013-05-22T14:56:03.039 >> #!ERROR [LDAP: error code 53 - UnwillingToPerform] >> dn: cn=config >> changetype: modify >> replace: objectClass >> objectClass: olcConfig >> objectClass: olcGlobal >> objectClass: top > > It's not necessarily a bug. > > I think LDAP clients should not act too "smart" and therefore should not > automagically add object classes from the structural object class chain if > they are not already present. You will run into issues with various LDAP > server implementations - at least according to experiences I made with > conducting interop testing with web2ldap and several server implementations. Right, it's just that this kind of modifications is perfectly valid. I mean, I'm not breaking any LDAP rule or concept and if I add the same entry (as a new entry) with the full object class hierarchy, the server is allowing it without a hitch. I still think it should be possible to modify the objectclass but I'll take into account that the implementation does not allow it (yet? ;-)). > A schema-aware client could auto-complete structural object class chain if > adding a new entry though. But again: Don't be too smart. Exactly, that's why I updated my code to do. Let's be dumb, sometimes... > May I ask which UI utility you're using? Sure, that's an internal application we wrote to edit some parts of the OpenLDAP configuration. > Ciao, Michael. Regards, Pierre-Arnaud

1 0

Re: (ITS#7448) "assertion failed" in MDB
by dhawes＠vt.edu 24 May '13

24 May '13

On Wed, May 22, 2013 at 5:49 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > This is ITS#7536. There were more fixes for it in RE24 after 2.4.35 was > released. I just wanted to verify that RE24 does indeed fix this issue.

1 0

reference through null pointer and memory leak (related to ITS#7588)
by jdhgit＠yahoo.com 23 May '13

23 May '13

Full_Name: John Hardin Version: master OS: Centos 6.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (50.23.115.111) The commit for ITS#7588 causes a crash if next_node is NULL: /* Set the first entry to send for the next page */ so->so_tree = next_node; + next_node->avl_left = NULL; next_node will be NULL if all entries have been sent, or if slapd_shutdown is true. Another issue related to ITS#7588 is a memory leak when a sorted search with paged results is aborted. This may be because so->so_tree is not the root of the tree when free_sort_op() calls tavl_free().

1 0

Re: (ITS#7583) ldap_init_fd() does not work with LDAP_PROTO_UDP
by hyc＠symas.com 23 May '13

23 May '13

stefw(a)redhat.com wrote: > Full_Name: Stef Walter > Version: 2.4.35 > OS: Fedora 18 > URL: http://fedorapeople.org/~stefw/patches/openldap-02/0001-Make-ldap_init_fd-w… > Submission from: (NULL) (77.3.95.123) > > > The ldap_init_fd() function does not work with UDP sockets (ie: LDAP_PROTO_UDP > passed in as the proto argument). Later uses of the LDAP connection returned > fail unceremoniously. > > This patch fixes the issue: Thanks, patch applied to git master. > > http://fedorapeople.org/~stefw/patches/openldap-02/0001-Make-ldap_init_fd-w… > > Some test code to exercise and demonstrate the problem. The code does not > actually wait for a UDP response, but should exit with a zero return code when > successful. > > http://fedorapeople.org/~stefw/patches/openldap-02/frob-cldap-initfd.c > > $ gcc -o frob-cldap-initfd -Wall -lldap -llber frob-cldap-initfd.c > $ ./frob-cldap-initfd > frob-cldap-initfd: ldap_search_ext: -1 > > The above result occurs before the patch is applied. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7582) Access to uninitialized memory when sending cldap packet
by hyc＠symas.com 23 May '13

23 May '13

stefw(a)redhat.com wrote: > Full_Name: Stef Walter > Version: 2.4.35 > OS: Fedora 18 > URL: http://fedorapeople.org/~stefw/patches/openldap-01/0001-Fix-usage-of-uninit… > Submission from: (NULL) (77.3.95.123) > > > When sending a cldap (UDP) packet, like a search request, uninitialized memory > is accessed. This shows up in valgrind like this: > > ==31445== Conditional jump or move depends on uninitialised value(s) > ==31445== at 0x36632244E6: ldap_send_server_request (request.c:377) > ==31445== by 0x36632247C2: ldap_send_initial_request (request.c:166) > ==31445== by 0x36632142F8: ldap_pvt_search (search.c:128) > ==31445== by 0x366321454F: ldap_search_ext (search.c:69) > ==31445== by 0x400838: main (in /data/projects/openldap/frob-cldap-search) > ==31445== > > This is due to parsing the resulting packet to pull out a requestDN. UDP packets > have different BER layout, and therefore the assumptions made when parsing the > outgoing request are invalid. > > It does not seem necessary to track the request DN for UDP packets. The linked > patch disables this code path for UDP packets. > > Patch which fixes the issue: > http://fedorapeople.org/~stefw/patches/openldap-01/0001-Fix-usage-of-uninit… > > Test code for the issue: > http://fedorapeople.org/~stefw/patches/openldap-01/frob-cldap-search.c > > Note that the test code doesn't detect the issue on its own (or do anything > useful). Use valgrind to detect the issue: > > $ gcc -o frob-cldap-search -Wall -lldap -llber frob-cldap-search.c > $ valgrind ./frob-cldap-search Your patch doesn't fix the issue. The behavior under valgrind is unchanged either way. Seems you're missing a '!' in your test. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7594) incomplete MDB subdb cursor cleanup
by hyc＠symas.com 23 May '13

23 May '13

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: mdb.master 0cdd9dffddf66c730a35f48db2bb02d8bb3e5731 > OS: Linux x86_64 > URL: > Submission from: (NULL) (193.69.163.163) > Submitted by: hallvard > > > If a cursor is at a clean subDB page, and its current item is deleted > by another cursor, then MDB_GET_CURRENT returns the deleted item. Fixed now in mdb.master. The subcursor on the clean page will be invalidated when the page is touched. > Test program below, run with no args, the "m2/del" output line. > > If the page was dirty, I instead got (key = old, data = size 0). > I don't know if it should give MDB_NOTFOUND instead. > That's the test program run with one arg. > I did not check what happens if the other cursor rearranged > the pages, e.g. split the item off to another page. > > #include "lmdb.h" > #include <assert.h> > #include <stdio.h> > #include <stdlib.h> > > int main(int argc, char **argv) > { > char *fname = "test.mdb"; > MDB_env *env; > MDB_txn *txn; > MDB_dbi dbi; > MDB_cursor *mc, *m2; > MDB_val key, data; > int rc; > # define STR2VAL(s) (&(MDB_val){sizeof(s), s}) /* includes final \0 */ > # define SHOW(name) printf("%s:\t%s[%zd] -> %s[%zd]\n", name, \ > (char*)key.mv_data, key.mv_size, (char*)data.mv_data, data.mv_size) > # define E(e) { rc = (e); if (rc) { fprintf(stderr, "%s:%d: %s: %s\n",\ > __FILE__, __LINE__, #e, mdb_strerror(rc)); abort(); } } > > remove(fname); > E(mdb_env_create(&env)); > E(mdb_env_open(env, fname, MDB_NOSUBDIR, 0666)); > E(mdb_txn_begin(env, NULL, 0, &txn)); > E(mdb_dbi_open(txn, NULL, MDB_DUPSORT, &dbi)); > > E(mdb_cursor_open(txn, dbi, &mc)); > E(mdb_cursor_put(mc, STR2VAL("a"), STR2VAL("x"), 0)); > E(mdb_cursor_put(mc, STR2VAL("a"), STR2VAL("y"), 0)); > > if (argc < 2) { > E(mdb_txn_commit(txn)); > E(mdb_txn_begin(env, NULL, 0, &txn)); > E(mdb_cursor_open(txn, dbi, &mc)); > puts("With clean page:"); > } > E(mdb_cursor_open(txn, dbi, &m2)); > > E(mdb_cursor_get(mc, &key, &data, MDB_FIRST)); > E(mdb_cursor_get(m2, &key, &data, MDB_FIRST)); > SHOW("Name:\tKey -> Data (mv_data[mv_len]):\n" "m2"); > > E(mdb_cursor_del(mc, 0)); > E(mdb_cursor_get(m2, &key, &data, MDB_GET_CURRENT)); > SHOW("m2/del"); /* Should output the same as... */ > E(mdb_cursor_get(mc, &key, &data, MDB_GET_CURRENT)); > SHOW("mc/del"); /* ...this: "a[2] -> [0]". */ > > mdb_txn_abort(txn); > mdb_env_close(env); > return 0; > } > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7581) adding meta backend in cn=config with ldapadd / ldapmodify
by hyc＠symas.com 23 May '13

23 May '13

hyc(a)symas.com wrote: > dcoutadeur(a)linagora.com wrote: >> Full_Name: dcoutadeur >> Version: 2.4.35 / git >> OS: openSuse 11.3 x86_64 >> URL: >> Submission from: (NULL) (80.67.162.201) >> >> >> I apologize in advance if this is not considered as a bug, but I thought this >> ticket should help the community anyway... >> >> The problem is that it seems impossible to add meta backend in cn=config thanks >> to ldapadd / ldapmodify clients. I thought the major interest for cn=config was >> precisely to let administrators change the configuration in a remote way, but >> maybe new database configuration is an exception ? > > Seems we need some rework here to allow this case. Currently bconfig assumes > that the olcDatabaseConfig entry is sufficient by itself, and any child > entries underneath are just optional. It doesn't handle the case where the > olcDatabaseConfig entry is basically an incomplete config. Should work now in git master, please test. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by michael＠stroeder.com 23 May '13

23 May '13

pa(a)marcelot.net wrote: > On 23 mai 2013, at 16:31, Howard Chu <hyc(a)symas.com> wrote: >> Don't do that. > > Sure, that's why I have a *bad* workaround to not update the 'objectClass' > attribute even if the original and my generated one don't match. IMO this is not a *bad* workaround. I think it's good practice in a UI client to *not* automagically modify attribute 'objectClass' without explicit user interaction asking for modification. Ciao, Michael.

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by michael＠stroeder.com 23 May '13

23 May '13

This is a cryptographically signed message in MIME format. --------------ms090403020009030408070805 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable pa(a)marcelot.net wrote: > It looks like it's not possible to modify the 'objectClass' attribute o= f > configuration entries. >=20 > I have some code generating entries for OpenLDAP configuration from a U= I utility > and updating existing configuration entries in DIT. > This code generates entries with the 'objectClass' attribute containing= the full > object class hierarchy (all the way to 'top') and not only the highest > structural object class (which is the case of default OpenLDAP configur= ation). >=20 > When updating the configuration in the DIT, the code then tries to comp= lete the > 'objectClass' attribute with the full list of object classes. > That operations ends with "error code 53- UnwillingToPerform". >=20 >=20 > Here's an example on the "cn=3Dconfig" entry: > #!RESULT ERROR > #!CONNECTION ldap://10.211.55.13:389 > #!DATE 2013-05-22T14:56:03.039 > #!ERROR [LDAP: error code 53 - UnwillingToPerform] > dn: cn=3Dconfig > changetype: modify > replace: objectClass > objectClass: olcConfig > objectClass: olcGlobal > objectClass: top It's not necessarily a bug. I think LDAP clients should not act too "smart" and therefore should not automagically add object classes from the structural object class chain i= f they are not already present. You will run into issues with various LDAP server implementations - at least according to experiences I made with conducting interop testing with web2ldap and several server implementatio= ns. A schema-aware client could auto-complete structural object class chain i= f adding a new entry though. But again: Don't be too smart. May I ask which UI utility you're using? Ciao, Michael. --------------ms090403020009030408070805 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTMwNTIzMTcyNjAwWjAjBgkq hkiG9w0BCQQxFgQUigp5LllXS15xuHzQioG6nuOqOi0wbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAKbzYGPYLZcAWjv0/WTjtlgavVd5dN7dbpT+jLvQpMT32iabw4pq+S4R1giJFoTpmy9PT bhM6G4EI2k0G62FScEMTYSrARYtm4S6MafnNOqntIYFqEY0VrSzK7Zc0Xpcw49SIoNrSQ8zT PlqtPVzvSMOLHFwYJSzdmvYgw2SYUGsibYaeG0VqlWzL693QVSDIb2Mn9jaCBvd7LHFwuOlN stfl7ITPkm6eJ79LcA9l6NVx/bWnDx/sgSDFciFz3NvA5NCyzLmJq1ObFukvI3qPYUS2xtLY glQ4lTiM7EbfGrXwKDO72J6FueGj6PLQ831+hh6gZr9PMKBvazoPhUvSEQAAAAAAAA== --------------ms090403020009030408070805--

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs