- openldap-bugs - openldap.org

Re: (ITS#6324) slapd -d ? emits incorrect value for LDAP_DEBUG_ANY on x86_64
by h.b.furuseth＠usit.uio.no 30 Oct '09

30 Oct '09

That fix caused a lot of overflow warnings about LDAP_DEBUG_ANY. I've updated ldap/include/ldap_log.h, ldap/servers/slapd/bconfig.c with an alternate fix. (The main.c fix stays.) While I was at it, I handled output of ANY as -1 specially, since that is a common input value but other negative numbers are not. -- Hallvard

1 0

(ITS#6356) slapd.conf tcp-buffer gets uninitialized value
by h.b.furuseth＠usit.uio.no 30 Oct '09

30 Oct '09

Full_Name: Hallvard B Furuseth Version: HEAD OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard config_tcp_buffer() passes 'idx' uninitialized to tcp_buffer_add_one(). Introduced in rev 1.384 for ITS#6234 (TCP buffer configuration) when !defined(LDAP_TCP_BUFFER_X_ORDERED), then rev 1.388 removed the #ifdef LDAP_TCP_BUFFER_X_ORDERED which could set the value. (Not sure if this needed an ITS -- the code is in 2.4.18/19, but inside #ifdef LDAP_TCP_BUFFER which is #defined if LDAP_DEVEL.)

1 0

(ITS#6355) Uninitialiezed rsa_callback with OpenSSL
by h.b.furuseth＠usit.uio.no 30 Oct '09

30 Oct '09

Full_Name: Hallvard B Furuseth Version: HEAD, 2.4.19 OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard libldap/tls_o.c:lso_tmp_rsa_cb() returns an uninitialized value if BN_set_word() fails. Introduced in rev 1.13; openldap 2.4.19. Fixing to return NULL.

1 0

Re: (ITS#6339) ldapsearch -V doesn't exist after version info
by quanah＠zimbra.com 30 Oct '09

30 Oct '09

--On Friday, October 30, 2009 9:44 AM +0100 Pierangelo Masarati <masarati(a)aero.polimi.it> wrote: > quanah(a)zimbra.com wrote: >> Full_Name: Quanah Gibson-Mount >> Version: 2.4.19 >> OS: >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (75.111.29.239) >> >> >> Executing ldapsearch -V to get the version information correctly prints >> it, but then proceeds to execute a search. > > Perhaps it's not clearly documented (no "-V" in man page, unclear message > in help) but you need to use -VV to exit after printing version. That's... bizarre. Even slapd doesn't behave that way. Nor any other program comes immediately to mind. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6339) ldapsearch -V doesn't exist after version info
by masarati＠aero.polimi.it 30 Oct '09

30 Oct '09

quanah(a)zimbra.com wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.4.19 > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (75.111.29.239) > > > Executing ldapsearch -V to get the version information correctly prints it, but > then proceeds to execute a search. Perhaps it's not clearly documented (no "-V" in man page, unclear message in help) but you need to use -VV to exit after printing version. p.

1 0

Re: ITS#3526 chaining enhancements
by masarati＠aero.polimi.it 30 Oct '09

30 Oct '09

hyc(a)symas.com wrote: > Looks to me like the mentioned features have been implemented and this ITS > should be closed. OK? Not sure, need to check. p.

1 0

ITS#3526 chaining enhancements
by hyc＠symas.com 29 Oct '09

29 Oct '09

Looks to me like the mentioned features have been implemented and this ITS should be closed. OK? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6346) syncrepl problems with 2.4.19
by hyc＠symas.com 29 Oct '09

29 Oct '09

openldap(a)science-computing.de wrote: > Full_Name: Christoph Herrmann > Version: 2.4.19 > OS: SLES11 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (193.17.244.2) > > > > we did some stress tests to an openldap-2.4.19 test infrastructure. > we are running the tests in a single master environment with 5 slave servers, > all with openldap-2.4.19. All machines are running ntpd and are in sync: Thanks for this report, very helpful. A proposed fix for this is now in CVS HEAD overlays/syncprov.c. Please test and let us know your results, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6340) What should I do it well?
by quanah＠zimbra.com 28 Oct '09

28 Oct '09

Hello, kbind is obsolete, and has been for quite some time. You should be using SASL/GSSAPI instead. In any case, this question is not a bug report, so it does not belong in the ITS system. I would suggest you use the openldap-technical list if you have further questions about developing applications with the OpenLDAP libraries. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6352) Not all certificates are read if the TLS_CACERTDIR contains broken links
by quanah＠zimbra.com 28 Oct '09

28 Oct '09

--On Tuesday, October 27, 2009 8:30 AM +0000 steffen.gruner(a)basf.com wrote: > Full_Name: Steffen Gruner > Version: 2.3.43 The 2.3 release series is no longer supported. I suggest upgrading to the latest stable release (2.4.19) and trying there. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6352) Not all certificates are read if the TLS_CACERTDIR contains broken links
by hyc＠symas.com 28 Oct '09

28 Oct '09

steffen.gruner(a)basf.com wrote: > Full_Name: Steffen Gruner > Version: 2.3.43 > OS: Gentoo Linux > URL: > Submission from: (NULL) (84.171.177.13) > > > If in the TLS_CACERTDIR (/etc/ssl/certs/ on by box) contains broken symbolic > links the ldapsearch command stops on the first broken link and doesn't use all > the other certificates. This functionality is provided by the OpenSSL library; you should file this bug report with them. In the meantime, now you know yet another reason why we recommend using TLS_CACERT instead of TLS_CACERTDIR. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6354) Regex-based authzTo example in docs, section 15.3.3.1, is incorrect.
by tim＠stoo.org 28 Oct '09

28 Oct '09

Full_Name: Tim Stewart Version: 2.4.x OS: N/A URL: Submission from: (NULL) (65.200.62.8) The OpenLDAP documentation at: http://www.openldap.org/doc/admin24/sasl.html#SASL%20Authentication describes an example of using a regular expression to describe a set of distinguished names as opposed to using an ldap:// URL. The example is authzTo: dn.regex=^uid=[^,]*,dc=example,dc=com$ which will produce a syntax error. Instead, the example should read like authzTo: dn.regex:^uid=[^,]*,dc=example,dc=com$ (the first `=' is replaced with `:') which is accepted by the server.

1 0

(ITS#6353) berval->string conversions ignore \0
by h.b.furuseth＠usit.uio.no 28 Oct '09

28 Oct '09

Full_Name: Hallvard B Furuseth Version: HEAD, RE24 OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard Conversion from a binary blob (struct berval*, BerElement read) to a char* string typically just grabs bv.bv_val even when the value may contain embedded '\0's. In these cases, correct operation may require that the conversion fails if bv_len != (bv_val ? strlen(bv_val) : 0). Or if bv_val is not \0-terminated, to check if memchr(bv_val, '\0', bv_len) == NULL. Examples: liblber/decode.c: ber_get_stringa, ber_get_stringb, ber_get_bitstringa, ber_scanf "aAv" Similarly, a lot of code requires a berval to be \0-terminated, but some also - sometimes unwarranted - also that the first \0 it encounters when walking the value is the terminating \0. For example, libldap/getdn.c has some exported functions that look for \0 without checking bv_len, some which checks bv_len but not a terminating \0, and some which does both. I really don't know which of these functions can expect there is no embedded \0. I think we need to introduce 'typedef struct berval BerString', used to document that bv_len == (bv_val ? strlen(bv_val) : 0) for the particular berval in question (e.g. in a function prototype). And maybe a typedef BerData for the opposite.

1 0

Re: (ITS#6334) hang during ldapmodify
by quanah＠zimbra.com 27 Oct '09

27 Oct '09

--On Tuesday, October 27, 2009 2:57 PM +0000 mkd(a)cs.brown.edu wrote: > One last question... what upstream stable release will include this fix? 2.4.20 will. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#6334) hang during ldapmodify
by mkd＠cs.brown.edu 27 Oct '09

27 Oct '09

One last question... what upstream stable release will include this fix? Thanks! Mark Howard Chu wrote: > You're welcome, thanks for your help digging into the problem. >

1 0

(ITS#6352) Not all certificates are read if the TLS_CACERTDIR contains broken links
by steffen.gruner＠basf.com 27 Oct '09

27 Oct '09

Full_Name: Steffen Gruner Version: 2.3.43 OS: Gentoo Linux URL: Submission from: (NULL) (84.171.177.13) If in the TLS_CACERTDIR (/etc/ssl/certs/ on by box) contains broken symbolic links the ldapsearch command stops on the first broken link and doesn't use all the other certificates. Please see this trace: ... open("/lib/libz.so", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\24\0\0004\0\0\0\240"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=69512, ...}) = 0 mmap2(NULL, 71888, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7b39000 mmap2(0xb7b4a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x10) = 0xb7b4a000 close(4) = 0 munmap(0xb7ecf000, 145583) = 0 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 4 fstat64(4, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0 poll([{fd=4, events=POLLIN}], 1, 10) = 1 ([{fd=4, revents=POLLIN}]) read(4, "H\323y\354\334WM\262\274<qu\24\37\270\250\375ZI2\177\363\325\344-K\253'\330\241\211\243"..., 32) = 32 close(4) = 0 getuid32() = 1000 time(NULL) = 1256629367 open("/etc/ssl/cert.pem", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/etc/ssl/certs/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|0x80000) = 4 fstat64(4, {st_mode=S_IFDIR|0755, st_size=12512, ...}) = 0 fcntl64(4, F_GETFD) = 0x1 (flags FD_CLOEXEC) getdents(4, /* 120 entries */, 4096) = 4064 open("/etc/ssl/certs//.", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFDIR|0755, st_size=12512, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, 0xb7ef2000, 4096) = -1 EISDIR (Is a directory) close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//..", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFDIR|0755, st_size=152, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, 0xb7ef2000, 4096) = -1 EISDIR (Is a directory) close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//d537fba6.0", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=1505, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, "-----BEGIN CERTIFICATE-----\nMIIEK"..., 4096) = 1505 read(5, ""..., 4096) = 0 close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//DigiNotar_Root_CA.pem", O_RDONLY|O_LARGEFILE) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=1980, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef2000 read(5, "-----BEGIN CERTIFICATE-----\nMIIFi"..., 4096) = 1980 read(5, ""..., 4096) = 0 close(5) = 0 munmap(0xb7ef2000, 4096) = 0 open("/etc/ssl/certs//QuoVadis_Root_Certification_Authority.pem", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) close(4) = 0 write(2, "ldap_bind: Can't contact LDAP ser"..., 42ldap_bind: Can't contact LDAP server (-1) ) = 42 exit_group(1) = ?

1 0

Re: (ITS#6334) hang during ldapmodify
by hyc＠symas.com 26 Oct '09

26 Oct '09

SATOH Fumiyasu wrote: >> Please try with the latest include/ldap_pvt.h (1.113) and libldap/sasl.c >> (1.74) from CVS, thanks. > > http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/sasl.c.diff?r1=1… > > s/errno/err/ ? > Absolutely right, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6334) hang during ldapmodify
by fumiyas＠osstech.jp 26 Oct '09

26 Oct '09

> Please try with the latest include/ldap_pvt.h (1.113) and libldap/sasl.c > (1.74) from CVS, thanks. http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/sasl.c.diff?r1=1… s/errno/err/ ? -- -- Name: SATOH Fumiyasu (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- Personal Home: http://www.SFO.jp/blog/

1 0

Re: (ITS#6334) hang during ldapmodify
by hyc＠symas.com 26 Oct '09

26 Oct '09

Mark Dieterich wrote: > Howard, > >> Please try with the latest include/ldap_pvt.h (1.113) and libldap/sasl.c >> (1.74) from CVS, thanks. > > I couldn't get the 2.4.19 stable release to compile with just these few > changes, so I just pulled the entire CVS HEAD. I'm happy to report that > my test case no longer hangs! It looks like you changed the logic to > catch partial writes and this appears to have fixed the error I was seeing. > > So it looks like my issue and the Stanford issue were linked after all. > > Thanks! You're welcome, thanks for your help digging into the problem. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6334) hang during ldapmodify
by mkd＠cs.brown.edu 26 Oct '09

26 Oct '09

Howard, > Please try with the latest include/ldap_pvt.h (1.113) and libldap/sasl.c > (1.74) from CVS, thanks. I couldn't get the 2.4.19 stable release to compile with just these few changes, so I just pulled the entire CVS HEAD. I'm happy to report that my test case no longer hangs! It looks like you changed the logic to catch partial writes and this appears to have fixed the error I was seeing. So it looks like my issue and the Stanford issue were linked after all. Thanks! Mark

1 0

Re: (ITS#6310) Slapd with pcache crashes under load
by hyc＠symas.com 26 Oct '09

26 Oct '09

karavelov(a)spnet.net wrote: > Hello, > The bug seems to be in the new code in pcache overlay handling cache > refreshes. When I switched configuration with only TTL/negTTL (without > TTR) the crashes have disappeared from both scenarios I have used: > > 1. One process with back-sql + pcache (crashed with segmentation failt > when using TTR) > > 2. Two processes, first with back-sql, second with back-ldap + pcache, > that communicate over unix domain socket (crashed on assertion in > entry_clean when using TTR) > > So the bug is not fixed but is located in pcache> consistency_check> > refresh_query A fix was committed to CVS HEAD a few days ago, please test, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6334) hang during ldapmodify
by hyc＠symas.com 26 Oct '09

26 Oct '09

mkd(a)cs.brown.edu wrote: > Quanah, > > A quick correction... I should have said the operation hangs when I use > SSL. However, I just did a quick test and it also hangs when using TLS > as well. I'm not sure if the underlying mechanism (once security is > enabled with TLS) is actually the same, it appears to be from the packet > dumps, but wanted to make sure I was clear about this. > >> From my testing, the operation needs to utilize TLS or SSL and > SASL/GSSAPI. If I turn off TLS/SSL or use simple binding, everything > works. It's only when I combine all of these mechanisms and use an ldif > file of a certain size (apparently) things start to hang. Please try with the latest include/ldap_pvt.h (1.113) and libldap/sasl.c (1.74) from CVS, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6327) ldapsearch hangs
by quanah＠zimbra.com 26 Oct '09

26 Oct '09

--On Saturday, October 24, 2009 12:25 AM +0000 quanah(a)zimbra.com wrote: > --On Thursday, October 22, 2009 11:31 PM +0000 quanah(a)zimbra.com wrote: > >> --On Thursday, October 22, 2009 6:16 PM +0000 quanah(a)zimbra.com wrote: >> >>> There's obviously some flaw in length generation somewhere. > > > With changes in HEAD, 3 attr query works, 2 attr query fails. > > SASL/DIGEST-MD5 works regardless. SASL/GSSAPI seems to be the problem > mechanism. Got slapd to output at loglevel 2 today with a freeze: sasl_generic_write: want=78, written=53 0000: 00 00 00 4a 05 04 07 ff 00 00 00 1c 00 00 00 00 ...J............ 0010: e2 10 36 3d 1c 17 41 0e 79 2d 8e b7 a3 19 d3 5c ..6=..A.y-.....\ 0020: 71 b0 7a 94 ab 5a 9d ff b9 31 c3 89 54 18 e6 ab q.z..Z...1..T... 0030: f1 da 10 39 22 ...9" ldap_write: want=14, written=14 0000: 30 0c 02 01 05 65 07 0a 01 00 04 00 04 00 0....e........ --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

[Fwd: Re: [Lam-public] LDAP sizelimit exceeded, not all entries are shown.]
by Roland Gruber 26 Oct '09

26 Oct '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I am the developer of "LDAP Account Manager". One of our users reported a strange problem, maybe you can help here. The application runs the same LDAP search two times. But the second time OpenLDAP returns an error 4 - sizelimit exeeded. The user reported that he removed all sizelimits from slapd.conf and ldap.conf and still gets the error. The log files are attached. These are the two queries: conn=3 op=3 SRCH base="ou=People,dc=example,dc=com" scope=2 deref=3 filter="(&(&(!(uid=*$))(|(objectClass=inetOrgPerson)(objectClass=posixAccount))))" conn=3 op=3 SRCH attr=uid givenname sn uidnumber gidnumber conn=3 op=3 SEARCH RESULT tag=101 err=0 nentries=15 text= conn=4 op=1 SRCH base="ou=People,dc=example,dc=com" scope=2 deref=0 filter="(&(&(!(uid=*$))(|(objectClass=inetOrgPerson)(objectClass=posixAccount))))" conn=4 op=1 SRCH attr=uid givenname sn uidnumber gidnumber conn=4 op=1 SEARCH RESULT tag=101 err=4 nentries=12 text= Any ideas? Thanks a lot for your help. Best regards Roland - -------- Original-Nachricht -------- Betreff: Re: [Lam-public] LDAP sizelimit exceeded, not all entries are shown. Datum: Mon, 12 Oct 2009 15:18:02 +0200 Von: Sou Smith <smith.sou(a)gmail.com> An: Roland Gruber <post(a)rolandgruber.de> Referenzen: <b9082d9f0910070307q7f234632uee4ffa2836c15a04(a)mail.gmail.com> <4ACCD310.50708(a)rolandgruber.de> <b9082d9f0910090227y6d1d0b61k996bbae626426fb3(a)mail.gmail.com> <4ACF4E4B.3010202(a)rolandgruber.de> Hi Roland, I have debugged slapd using loglevel 256. I send you two log files in the attachment. First, slapd.log contains starting slapd, logging in LAM and the first page that LAM shows (User list - showing 15 users). The second file, slapd2.log is extended slapd.log with my click on "Users" (shows only 12 users and the message about sizelimit exceeded) and click on "Groups" (same problem, same number of entries). I have looked into those files, but still don't know where is the problem. Thank you for your time. Best regards, Sou Smith 2009/10/9 Roland Gruber <post(a)rolandgruber.de> > Hi Sou, > > Sou Smith schrieb: >> I have tried to debug slapd, >> while I have tested LAM. I have clicked on "Users" link and after that I >> have looked into log file. I have tried to debug step by step 1- trace >> function calls, 2- debug packet handling, 4- heavy trace debugging, 8- >> connection management, 32- search filter processing, 64- configuration >> processing, 256- stats log connections/operations/results, 512- stats log >> entries sent, 1024- print communication with shell backends, 2048- print >> entry parsing debugging = 10 log files. But I couldn't locate that error > in >> anyone of them. I have tried to debug everything (-d-1 parameter), but > the >> log file was so large and blind, that I haven't found the problem (if > there >> was any). > > you can set slapd to debug mode: > > In /etc/ldap/slapd.conf turn logging on with the line "loglevel 256". > OpenLDAP uses /var/log/syslog for log output. slapd needs to be restarted. > > This should give you all searches done by LAM and the return codes from > slapd. > > - -- Best regards Roland Gruber LDAP Account Manager http://www.ldap-account-manager.org/ Want more? Get LDAP Account Manager Pro! http://www.ldap-account-manager.org/lamcms/lamPro -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkrUw+wACgkQq/ywNCsrGZ43awCfWOWAe49jWNSHW1S3i1rq6V04 YB4AmQH/vVTOOJ8P94nuA6C5aOzJk3cS =h4QQ -----END PGP SIGNATURE-----

3 3

Re: (ITS#6334) hang during ldapmodify
by mkd＠cs.brown.edu 26 Oct '09

26 Oct '09

Quanah, A quick correction... I should have said the operation hangs when I use SSL. However, I just did a quick test and it also hangs when using TLS as well. I'm not sure if the underlying mechanism (once security is enabled with TLS) is actually the same, it appears to be from the packet dumps, but wanted to make sure I was clear about this. >From my testing, the operation needs to utilize TLS or SSL and SASL/GSSAPI. If I turn off TLS/SSL or use simple binding, everything works. It's only when I combine all of these mechanisms and use an ldif file of a certain size (apparently) things start to hang. Clear as mud? Mark Quanah Gibson-Mount wrote: > --On Monday, October 26, 2009 10:49 AM -0400 Mark Dieterich > <mkd(a)cs.brown.edu> wrote: > >> Quanah, >> >> As expected, the 2.4.19 version with the encode.c from HEAD hangs if TLS >> is enabled as well. Not sure where to go from here. > > Does it happen with TLS only, no SASL/GSSAPI? > > --Quanah

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs