- openldap-bugs - openldap.org

Re: (ITS#7493) slapo-allowed: allowed* attrs are replicated
by michael＠stroeder.com 26 Jan '13

26 Jan '13

Any chance to see this patch appear in 2.4.34? Ciao, Michael.

1 0

(ITS#7504) document slapcat exit codes in man page
by balint＠balintreczey.hu 25 Jan '13

25 Jan '13

Full_Name: Balint Reczey Version: master OS: Linux URL: http://rbalint.cs.bme.hu/0002-document-slapcat-exit-codes-in-man-page.patch Submission from: (NULL) (84.0.168.17) Slapcat's exit value was undocumented, this patch aims to fix that. Copyright 2013 Balint Reczey <balint(a)balintreczey.hu> Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License.

1 0

(ITS#7503) slapcat: retry a few times when retrieving an entry
by balint＠balintreczey.hu 25 Jan '13

25 Jan '13

Full_Name: Balint Reczey Version: master OS: Linux URL: http://rbalint.cs.bme.hu/0001-slapcat-retry-a-few-times-when-retrieving-an-… Submission from: (NULL) (84.0.168.17) From: Axel Beckert <beckert(a)phys.ethz.ch> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: slapd: slapcat output truncated every now and then Date: Tue, 15 May 2012 18:33:57 +0200 Package: slapd Severity: grave Version: 2.4.23-7.2 Justification: Causes data loss Every now and then slapcat's output does not contain the whole content of the LDAP but is truncated at some LDIF entry border (i.e. all printed LDIF records seem complete). To reproduce run "while sleep 1; do slapcat | wc; done" on a moderately busy LDAP server (writes every few seconds to minutes; about 10000 entries) while slapd is running and notice the occasionally occurring huge change in wc's printed values, e.g.: # while sleep 1; do slapcat | wc; done 471698 1015498 15336677 471698 1015498 15336677 471698 1015498 15336677 ... 471698 1015497 15336635 471698 1015497 15336635 281829 606820 8632165 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336635 308627 664573 9476751 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336637 Please see email thread starting at http://www.openldap.org/lists/openldap-technical/201301/msg00195.html The attached modifications to OpenLDAP Software are subject to the following notice: Copyright 2013 Balint Reczey <balint(a)balintreczey.hu> Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License.

1 0

(ITS#7502) slapcat: retry a few times when retrieving an entry
by balint＠balintreczey.hu 25 Jan '13

25 Jan '13

Full_Name: Balint Reczey Version: master OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.0.168.17) From: Axel Beckert <beckert(a)phys.ethz.ch> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: slapd: slapcat output truncated every now and then Date: Tue, 15 May 2012 18:33:57 +0200 Package: slapd Severity: grave Version: 2.4.23-7.2 Justification: Causes data loss Every now and then slapcat's output does not contain the whole content of the LDAP but is truncated at some LDIF entry border (i.e. all printed LDIF records seem complete). To reproduce run "while sleep 1; do slapcat | wc; done" on a moderately busy LDAP server (writes every few seconds to minutes; about 10000 entries) while slapd is running and notice the occasionally occurring huge change in wc's printed values, e.g.: # while sleep 1; do slapcat | wc; done 471698 1015498 15336677 471698 1015498 15336677 471698 1015498 15336677 ... 471698 1015497 15336635 471698 1015497 15336635 281829 606820 8632165 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336635 308627 664573 9476751 <-- 471698 1015497 15336635 471698 1015497 15336635 471698 1015497 15336637 Please see email thread starting at http://www.openldap.org/lists/openldap-technical/201301/msg00195.html

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 25 Jan '13

25 Jan '13

Le 25/01/2013 15:59, Howard Chu a écrit : > Benin Technologies wrote: >> i was just testing back-sql, so my slapd.conf is basically the one >> that's shipped with openldap, as in >> "servers/slapd/back-sql/rdbms_depend/pgsql/slapd.conf > > OK, found the bug, fixed now in master. YEP, just tested it, it works. Many thanks !

1 0

Re: (ITS#7499)
by hyc＠symas.com 25 Jan '13

25 Jan '13

Benin Technologies wrote: > i was just testing back-sql, so my slapd.conf is basically the one > that's shipped with openldap, as in > "servers/slapd/back-sql/rdbms_depend/pgsql/slapd.conf OK, found the bug, fixed now in master. > Le 24/01/2013 20:00, Howard Chu a écrit : >> Benin Technologies wrote: >>> Le 24/01/2013 13:31, Howard Chu a écrit : >>>> Ah. In that case the fix must still be wrong. (Sorry, I'm patching >>>> this blind as I don't have any current SQL installation to test with.) >> >>> OK let me know when you fixed it, it the meantime I'll switch back to >>> slapd.conf >> >> Can you please include your slapd.conf here in this ITS? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

i was just testing back-sql, so my slapd.conf is basically the one that's shipped with openldap, as in "servers/slapd/back-sql/rdbms_depend/pgsql/slapd.conf I just changed a few parameters, like the pid and argfile directory, odbc and database parameters here it is include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw secret dbname LdapTest dbuser ldaptest dbpasswd ldaptest insentry_stmt "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)" upper_func "upper" strcast_func "text" concat_pattern "?||?" has_ldapinfo_dn_ru no Le 24/01/2013 20:00, Howard Chu a écrit : > Benin Technologies wrote: >> Le 24/01/2013 13:31, Howard Chu a écrit : >>> Ah. In that case the fix must still be wrong. (Sorry, I'm patching >>> this blind as I don't have any current SQL installation to test with.) > >> OK let me know when you fixed it, it the meantime I'll switch back to >> slapd.conf > > Can you please include your slapd.conf here in this ITS? >

1 0

Re: (ITS#7499)
by hyc＠symas.com 24 Jan '13

24 Jan '13

Benin Technologies wrote: > Le 24/01/2013 13:31, Howard Chu a écrit : >> Ah. In that case the fix must still be wrong. (Sorry, I'm patching >> this blind as I don't have any current SQL installation to test with.) > OK let me know when you fixed it, it the meantime I'll switch back to > slapd.conf Can you please include your slapd.conf here in this ITS? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

Le 24/01/2013 13:31, Howard Chu a écrit : > Benin Technologies wrote: >> Yes the fix worked (I downloaded the latest openldap.tar.gz on your >> gitweb and installed it). Now slapd starts after having converted to >> cn=config >> >> But after the conversion my ldapsearch returns an 80 error (with >> slapd.conf it worked, the data from PostgreSQL where returned) >> Thus my question : are there other steps to be taken after the >> conversion (all I did was : slaptest -f slapd.conf -F slapd.d) > > Ah. In that case the fix must still be wrong. (Sorry, I'm patching > this blind as I don't have any current SQL installation to test with.) > OK let me know when you fixed it, it the meantime I'll switch back to slapd.conf Thanks BT

1 0

Re: (ITS#7501) added TCP keepalive support to back_ldap
by tedcheng＠symas.com 24 Jan '13

24 Jan '13

On Jan 24, 2013, at 5:32 AM, Howard Chu wrote: > tedcheng(a)symas.com wrote: >> Full_Name: Ted C. Cheng >> Version: master >> OS: Linux/Solaris >> URL: https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch >> Submission from: (NULL) (76.174.253.197) >> >> >> >> Please find in the URL a patch that adds TCP keepalive support to back_ldap. >> >> Please review and apply the patch. > > Note - constructs like "#if 0" are only used for tentative/experimental changes. For patches intended to be released to the public, just delete the blocked out lines. > "#if 0" seems to be a common practice in the code. I only removed the one in the patch. Please find in the link below. https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch Ted C. Cheng Symas Corporation

1 0

Re: (ITS#7501) added TCP keepalive support to back_ldap
by hyc＠symas.com 24 Jan '13

24 Jan '13

tedcheng(a)symas.com wrote: > Full_Name: Ted C. Cheng > Version: master > OS: Linux/Solaris > URL: https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch > Submission from: (NULL) (76.174.253.197) > > > > Please find in the URL a patch that adds TCP keepalive support to back_ldap. > > Please review and apply the patch. Note - constructs like "#if 0" are only used for tentative/experimental changes. For patches intended to be released to the public, just delete the blocked out lines. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7496) Segemtation fault in mdb_entry_decode
by meike.stone＠googlemail.com 24 Jan '13

24 Jan '13

>> Thread 1 (Thread 0x7f738b21c700 (LWP 19394)): > > >> #1 0x0000000000501d30 in mdb_search (op=0xc3a020, rs=0x7f738b21ba30) at >> search.c:720 >> scopeok = 1 >> edata = {mv_size = 0, mv_data = 0x7f74bbb99728} > > > This indicates that the entry being debugged is actually zero bytes, i.e. > it's not a valid entry at all. Nodes like this get stored in the database > during slapadd when a child entry gets added before its parent; a zero-byte > stub is stored as a placeholder for the missing parent. > When you ran slapadd > you should have seen warning messages about missing entries, telling you > that your LDIF is incomplete. Yes you are right, I repeated the import via slapcat to test and got this error message: ~ # slapadd -w -q -f /etc/openldap/slapd.conf -l /backup.ldif 50f98421 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable -#################### 100.00% eta none elapsed 09m18s spd 4.6 M/s Closing DB...Error, entries missing! entry 1156449: cn=1356155776-83002,ou=... ,... ,ou=root (I shortened the entry DN in output with "...") I recognized this message before, but thought the entry was not imported ... > > We can prevent the SEGV but your database is still invalid because your LDIF > is invalid. Yes, will ask in the mailing list for additional information not directly releated to this SEGV. Thanks Kindly regards Maike

1 0

Re: (ITS#7499)
by hyc＠symas.com 24 Jan '13

24 Jan '13

Benin Technologies wrote: > Yes the fix worked (I downloaded the latest openldap.tar.gz on your > gitweb and installed it). Now slapd starts after having converted to > cn=config > > But after the conversion my ldapsearch returns an 80 error (with > slapd.conf it worked, the data from PostgreSQL where returned) > Thus my question : are there other steps to be taken after the > conversion (all I did was : slaptest -f slapd.conf -F slapd.d) Ah. In that case the fix must still be wrong. (Sorry, I'm patching this blind as I don't have any current SQL installation to test with.) > I don't think this has something to do with that 7499 bug, so I'll post > the question on the technical mailing list (but if nobody bumped into > that 7499 bug before, it logically means that nobody is using back-sql > with cn=config yet) Agreed, I think it's unlikely that anyone else has used this yet. > > ldapsearch -x -h localhost -b "dc=example,dc=com" "(objectClass=*)" > # extended LDIF > # > # LDAPv3 > # base <dc=example,dc=com> with scope subtree > # filter: (objectClass=*) > # requesting: ALL > # > > # search result > search: 2 > result: 80 Other (e.g., implementation specific) error > > # numResponses: 1 > > > Le 24/01/2013 04:46, Howard Chu a écrit : >> Benin Technologies wrote: >>>>>>> Yes, it's a bug. The conversion should have used double-quotes on >>> these >>>>>>> parameters. Will be fixed shortly. >>> >>> >>> ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in >>> the file olcDatabase={1}sql.ldif, like this : >>> >>> olcSqlInsEntryStmt: "insert into ldap_entries >>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>> ldap_entries),?,?,?,?)" >>> >>> >>> Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation >>> specific error)". With the old "slapd.conf", ldapsearch works fine. Is >>> there anything else to do when converting slapd.conf to cn=config on a >>> back-sql implementation ? >> >> Yes, actually the quotes are optional, but you must get the fix from git. >> Commit 56a0d9004f0fba943028041ea5af62338b6dfccd >>> >>> >>> >>> >>> Le 24/01/2013 02:44, hyc(a)symas.com a écrit : >>>> benintechnologies(a)yahoo.fr wrote: >>>>> Hi, >>>>> >>>>> thank you for your reply >>>>> >>>>> I simply took the slapd.conf file adapted to PostgreSQL in the source >>>>> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >>>>> >>>>> In that file, we have : >>>>> olcSqlInsEntryStmt: insert into ldap_entries >>>>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>>>> ldap_entries),?,?,?,?) >>>>> >>>>> it works with static configuration (slapd.conf) : I successfully >>>>> managed >>>>> to insert some data into the postgresql tables >>>>> >>>>> But after having converted it to cn=config (slaptest -f slapd.conf -F >>>>> slapd.d) slapd doesn't start anymore : >>>>> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >>>>> <cn=root,dc=example,dc=com> >>>>> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra >>>>> cruft >>>>> after<SQL expression>. >>>>> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >>>>> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >>>>> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >>>>> 50ff3f0a send_ldap_result: err=19 matched="" text="" >>>>> 50ff3f0a slapd destroy: freeing system resources. >>>>> 50ff3f0a slapd stopped. >>>>> 50ff3f0a connections_destroy: nothing to destroy. >>>>> >>>>> I believe it's a bug, no ? >>> >>> >> >> > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

Yes the fix worked (I downloaded the latest openldap.tar.gz on your gitweb and installed it). Now slapd starts after having converted to cn=config But after the conversion my ldapsearch returns an 80 error (with slapd.conf it worked, the data from PostgreSQL where returned) Thus my question : are there other steps to be taken after the conversion (all I did was : slaptest -f slapd.conf -F slapd.d) I don't think this has something to do with that 7499 bug, so I'll post the question on the technical mailing list (but if nobody bumped into that 7499 bug before, it logically means that nobody is using back-sql with cn=config yet) ldapsearch -x -h localhost -b "dc=example,dc=com" "(objectClass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 Le 24/01/2013 04:46, Howard Chu a écrit : > Benin Technologies wrote: >> >>>>Yes, it's a bug. The conversion should have used double-quotes on >> these >> >>>>parameters. Will be fixed shortly. >> >> >> ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in >> the file olcDatabase={1}sql.ldif, like this : >> >> olcSqlInsEntryStmt: "insert into ldap_entries >> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >> ldap_entries),?,?,?,?)" >> >> >> Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation >> specific error)". With the old "slapd.conf", ldapsearch works fine. Is >> there anything else to do when converting slapd.conf to cn=config on a >> back-sql implementation ? > > Yes, actually the quotes are optional, but you must get the fix from git. > Commit 56a0d9004f0fba943028041ea5af62338b6dfccd >> >> >> >> >> Le 24/01/2013 02:44, hyc(a)symas.com a écrit : >>> benintechnologies(a)yahoo.fr wrote: >>>> Hi, >>>> >>>> thank you for your reply >>>> >>>> I simply took the slapd.conf file adapted to PostgreSQL in the source >>>> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >>>> >>>> In that file, we have : >>>> olcSqlInsEntryStmt: insert into ldap_entries >>>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>>> ldap_entries),?,?,?,?) >>>> >>>> it works with static configuration (slapd.conf) : I successfully >>>> managed >>>> to insert some data into the postgresql tables >>>> >>>> But after having converted it to cn=config (slaptest -f slapd.conf -F >>>> slapd.d) slapd doesn't start anymore : >>>> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >>>> <cn=root,dc=example,dc=com> >>>> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra >>>> cruft >>>> after<SQL expression>. >>>> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >>>> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >>>> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >>>> 50ff3f0a send_ldap_result: err=19 matched="" text="" >>>> 50ff3f0a slapd destroy: freeing system resources. >>>> 50ff3f0a slapd stopped. >>>> 50ff3f0a connections_destroy: nothing to destroy. >>>> >>>> I believe it's a bug, no ? >> >> > >

1 0

Re: (ITS#7498) Openldap syncrepl issue
by arunkumar_1123＠yahoo.com 24 Jan '13

24 Jan '13

> MMR has supported delta-syncrepl since 2.4.27. You should use it. I did consider delta-syncrepl, but given the high write load expected, I was not sure if it was the right decision. I am expecting an average load of 50-100 writes per second, and with 1 backup provider, and 10 consumers, it might get heavy on the provider which is serving the writes, given that OpenLDAP would be maintaining another DB for the access log. But with this syncrepl issue, it looks like I need to change the replication mode to refreshAndPersist anyway. As such it looks like delta syncrepl is also refreshAndPersist too. Is there any recommendation between simple refreshAndPersist and delta-syncrepl with refreshAndPersist for high write loads? Thanks PS: I see that delta syncrepl is compatible with MMR which I presume to be MultiMaster. I hope it works with Mirror Mode too. I did not find any documents supporting this.

1 0

(ITS#7501) added TCP keepalive support to back_ldap
by tedcheng＠symas.com 24 Jan '13

24 Jan '13

Full_Name: Ted C. Cheng Version: master OS: Linux/Solaris URL: https://dl.dropbox.com/u/94235048/back_ldap_tcp_keepalive.patch Submission from: (NULL) (76.174.253.197) Please find in the URL a patch that adds TCP keepalive support to back_ldap. Please review and apply the patch. Thanks, Ted C. Cheng Symas Corporation

1 0

Re: (ITS#7499)
by hyc＠symas.com 24 Jan '13

24 Jan '13

Benin Technologies wrote: > >>>>Yes, it's a bug. The conversion should have used double-quotes on these > >>>>parameters. Will be fixed shortly. > > > ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in > the file olcDatabase={1}sql.ldif, like this : > > olcSqlInsEntryStmt: "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)" > > > Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation > specific error)". With the old "slapd.conf", ldapsearch works fine. Is > there anything else to do when converting slapd.conf to cn=config on a > back-sql implementation ? Yes, actually the quotes are optional, but you must get the fix from git. Commit 56a0d9004f0fba943028041ea5af62338b6dfccd > > > > > Le 24/01/2013 02:44, hyc(a)symas.com a écrit : >> benintechnologies(a)yahoo.fr wrote: >>> Hi, >>> >>> thank you for your reply >>> >>> I simply took the slapd.conf file adapted to PostgreSQL in the source >>> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >>> >>> In that file, we have : >>> olcSqlInsEntryStmt: insert into ldap_entries >>> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >>> ldap_entries),?,?,?,?) >>> >>> it works with static configuration (slapd.conf) : I successfully managed >>> to insert some data into the postgresql tables >>> >>> But after having converted it to cn=config (slaptest -f slapd.conf -F >>> slapd.d) slapd doesn't start anymore : >>> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >>> <cn=root,dc=example,dc=com> >>> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft >>> after<SQL expression>. >>> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >>> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >>> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >>> 50ff3f0a send_ldap_result: err=19 matched="" text="" >>> 50ff3f0a slapd destroy: freeing system resources. >>> 50ff3f0a slapd stopped. >>> 50ff3f0a connections_destroy: nothing to destroy. >>> >>> I believe it's a bug, no ? > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

>>>>Yes, it's a bug. The conversion should have used double-quotes on these >>>>parameters. Will be fixed shortly. ok thanks, I added manually the double-quotes on olcSqlInsEntryStmt in the file olcDatabase={1}sql.ldif, like this : olcSqlInsEntryStmt: "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)" Now slapd starts, but ldapsearch returns "80 Other (e.g., implementation specific error)". With the old "slapd.conf", ldapsearch works fine. Is there anything else to do when converting slapd.conf to cn=config on a back-sql implementation ? Le 24/01/2013 02:44, hyc(a)symas.com a écrit : > benintechnologies(a)yahoo.fr wrote: >> Hi, >> >> thank you for your reply >> >> I simply took the slapd.conf file adapted to PostgreSQL in the source >> (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) >> >> In that file, we have : >> olcSqlInsEntryStmt: insert into ldap_entries >> (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from >> ldap_entries),?,?,?,?) >> >> it works with static configuration (slapd.conf) : I successfully managed >> to insert some data into the postgresql tables >> >> But after having converted it to cn=config (slaptest -f slapd.conf -F >> slapd.d) slapd doesn't start anymore : >> 0ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>, >> <cn=root,dc=example,dc=com> >> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft >> after<SQL expression>. >> 50ff3f0a config error processing olcDatabase={1}sql,cn=config: >> <olcSqlInsEntryStmt> *extra cruft after<SQL expression>* >> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 >> 50ff3f0a send_ldap_result: err=19 matched="" text="" >> 50ff3f0a slapd destroy: freeing system resources. >> 50ff3f0a slapd stopped. >> 50ff3f0a connections_destroy: nothing to destroy. >> >> I believe it's a bug, no ?

1 0

(ITS#7500) libldap starttls crashes if invalid GnuTLS cipher suite string
by jouko.orava＠iki.fi 24 Jan '13

24 Jan '13

Full_Name: Jouko Orava Version: 2.4.28, 2.4.33 OS: Debian/Ubuntu URL: Submission from: (NULL) (82.181.197.37) If the cipher suite string is unacceptable to GnuTLS, libldap_r-2.4 crashes in ldap_start_tls_s() due to a double free. See https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1103353 for my original bug submission, including a suggested patch, https://launchpadlibrarian.net/129174364/openldap-ciphersuite.patch and a simple example ldapsearch-like program that can be used to test the issue. This bug is not critical, since using a valid GnuTLS cipher suite does work, for example "NORMAL" or "SECURE256". However, trying to use anything more specific is exceedingly difficult -- basically trial and error, due to applications crashing in libldap with an invalid one. The two other TLS implementations in OpenLDAP are not affected by this bug. The double free occurs in openldap/libraries/libldap/tls2.c:ldap_int_tls_init_ctx(), in the ldap_pvt_tls_ctx_free(lo->ldo_tls_ctx); call in the error_exit: path. Because the cipher suite string was unacceptable to GnuTLS, the context is either released by GnuTLS or never properly initialized. The error_exit: path tries to release that context, and causes the C library to abort the program as it detects a double free. Simply commenting the ldap_pvt_tls_ctx_free(lo->ldo_tls_ctx); call in the error_exit: path in openldap/libraries/libldap/tls2.c:ldap_int_tls_init_ctx() masks the issue, but is obviously incorrect (as it affects the two other TLS implementations too). My suggested patch is to use the configured cipher suite string when creating the new TLS context, instead of "NORMAL" as is currently done, in openldap/libraries/libldap/tls_g.c:tlsg_ctx_new(). If there is a problem with the cipher suite priority string, the initial context is torn down, and caught earlier in openldap/libraries/libldap/tls2.c, avoiding the crash. (However, the cipher suite string will be parsed twice.) There seem to be numerous unhandled bug reports in various distributions and applications, including http://www.openldap.org/its/index.cgi/Incoming?id=6939#themesg which are quite tricky to investigate, as the actual bug occurs deep in libldap. Only user checks with a patched libldap will prove whether these are actually caused by this bug or not. It is very easy to assume it is an application bug, due to the symptoms and pretty limited circumstances. Recap: libldap + GnuTLS, application using ldap_start_tls, and any cipher suite string not acceptable to GnuTLS will cause libldap to crash due to a double free.

1 0

Re: (ITS#7499)
by hyc＠symas.com 24 Jan '13

24 Jan '13

benintechnologies(a)yahoo.fr wrote: > Hi, > > thank you for your reply > > I simply took the slapd.conf file adapted to PostgreSQL in the source > (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) > > In that file, we have : > olcSqlInsEntryStmt: insert into ldap_entries > (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from > ldap_entries),?,?,?,?) > > it works with static configuration (slapd.conf) : I successfully managed > to insert some data into the postgresql tables > > But after having converted it to cn=config (slaptest -f slapd.conf -F > slapd.d) slapd doesn't start anymore : > 0ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, > <cn=root,dc=example,dc=com> > 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft > after <SQL expression>. > 50ff3f0a config error processing olcDatabase={1}sql,cn=config: > <olcSqlInsEntryStmt> *extra cruft after <SQL expression>* > 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 > 50ff3f0a send_ldap_result: err=19 matched="" text="" > 50ff3f0a slapd destroy: freeing system resources. > 50ff3f0a slapd stopped. > 50ff3f0a connections_destroy: nothing to destroy. > > I believe it's a bug, no ? Yes, it's a bug. The conversion should have used double-quotes on these parameters. Will be fixed shortly. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7499)
by benintechnologies＠yahoo.fr 24 Jan '13

24 Jan '13

Hi, thank you for your reply I simply took the slapd.conf file adapted to PostgreSQL in the source (/openldap-2.4.33/servers/slapd/back-sql/rdbms_depend/pgsql) In that file, we have : olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?) it works with static configuration (slapd.conf) : I successfully managed to insert some data into the postgresql tables But after having converted it to cn=config (slaptest -f slapd.conf -F slapd.d) slapd doesn't start anymore : 0ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, <cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft after <SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> *extra cruft after <SQL expression>* 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. I believe it's a bug, no ? thanks BT Le 24/01/2013 00:39, quanah(a)zimbra.com a écrit : > --On Wednesday, January 23, 2013 10:58 PM +0000 benintechnologies(a)yahoo.fr > wrote: > >> I just noticed I forgot some infos, so here is the problem again : >> >> If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the >> line starting with olcSqlInsEntryStmt, then slapd starts fine. >> >> So what's the right syntax for olcSqlInsEntryStmt ??? > > From the man page: > > > insentry_stmt<SQL expression> > The statement that is used to insert a new entry in table > ldap_entries; see "METAINFORMATION USED" for details. The > default is "INSERT INTO ldap_entries (dn, oc_map_id, parent, > keyval) VALUES (?, ?, ?, ?)". > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > >

1 0

Re: (ITS#7499)
by quanah＠zimbra.com 24 Jan '13

24 Jan '13

--On Wednesday, January 23, 2013 10:58 PM +0000 benintechnologies(a)yahoo.fr wrote: > I just noticed I forgot some infos, so here is the problem again : > > If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the > line starting with olcSqlInsEntryStmt, then slapd starts fine. > > So what's the right syntax for olcSqlInsEntryStmt ??? >From the man page: insentry_stmt <SQL expression> The statement that is used to insert a new entry in table ldap_entries; see "METAINFORMATION USED" for details. The default is "INSERT INTO ldap_entries (dn, oc_map_id, parent, keyval) VALUES (?, ?, ?, ?)". --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7499)
by benintechnologies＠yahoo.fr 23 Jan '13

23 Jan '13

I just noticed I forgot some infos, so here is the problem again : Hi, Has anyone out there managed to successfully convert slapd.conf into cn=config with back-sql enabled ? I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql support (./configure --enable-sql) According tohttp://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>,<cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft after<SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after<SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. The error message seems to be "extra cruft after<SQL expression>" If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the line starting with olcSqlInsEntryStmt, then slapd starts fine. So what's the right syntax for olcSqlInsEntryStmt ??? Thanks Ben

1 0

(ITS#7499) bug on dynamic configuration with back-sql
by benintechnologies＠yahoo.fr 23 Jan '13

23 Jan '13

Full_Name: Ben Tech Version: 2.4.33 OS: Debian 6.0.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (41.85.161.126) Hi, I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql. According to http://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, <cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft after <SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after <SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. If I comment that line, the server starts fine # olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) v alues ((select max(id)+1 from ldap_entries),?,?,?,?)

1 0

Re: (ITS#7495) access filter not correctly validated if assertion attribute not requested
by michael＠stroeder.com 23 Jan '13

23 Jan '13

Using extra_attrs would be a possible work-around (tested). Unfortunately it seems to trigger a seg fault in slapo-rwm in my setup which is hard to track down to a certain cause. slapd starts ok but quite soon a seg fault message is written to syslog. Just before the seg fault I see the usual search requests of sssd in the logs... Ciao, Michael.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs