- openldap-bugs - openldap.org

Re: (ITS#5796) back-sql intermittently failing
by ando＠sys-net.it 11 Nov '08

11 Nov '08

Robert Brooks wrote: > Pierangelo Masarati wrote: >> I have no possibility to setup a back-sql with mysql right now. Can >> you post your configuration? Can you post some (verbose) logs of >> operations affecting back-sql (e.g. with BACKSQL_TRACE manually >> #defined in back-sql/back-sql.h)? Can you step thru a search into >> backsql_search() and see if it gets called and why it doesn't get to >> contacting the rdbms? > > I'm compiling with BACKSQL_TRACE defined right now. > > After further prodding I have discovered... > > ejabberd (a jabber daemon) makes connections to ldap, which it keeps > open indefinitely. It appears mysql's odbc connector will time out an > idle mysql connection after 8 hours. Since this is the slave system it's > entirely possible for it not touch mysql connections for at least 8 hours. > > If we restart mysql some ldap queries fail on back-sql portion until we > kill ejabberd (to close it's ldap connections). > > I'll give you logs with tracing enabled asap, but this looks like a big > clue as to what is happening. OK, this makes sense. In fact, back-sql does not seem to specifically handle broken connections to the odbc. It appears it would need something similar to idle-timeout as in back-ldap and back-meta. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5796) back-sql intermittently failing
by robb＠wtg.cw.com 11 Nov '08

11 Nov '08

Pierangelo Masarati wrote: > I have no possibility to setup a back-sql with mysql right now. Can you > post your configuration? Can you post some (verbose) logs of operations > affecting back-sql (e.g. with BACKSQL_TRACE manually #defined in > back-sql/back-sql.h)? Can you step thru a search into backsql_search() > and see if it gets called and why it doesn't get to contacting the rdbms? I'm compiling with BACKSQL_TRACE defined right now. After further prodding I have discovered... ejabberd (a jabber daemon) makes connections to ldap, which it keeps open indefinitely. It appears mysql's odbc connector will time out an idle mysql connection after 8 hours. Since this is the slave system it's entirely possible for it not touch mysql connections for at least 8 hours. If we restart mysql some ldap queries fail on back-sql portion until we kill ejabberd (to close it's ldap connections). I'll give you logs with tracing enabled asap, but this looks like a big clue as to what is happening.

1 0

Re: (ITS#5796) back-sql intermittently failing
by ando＠sys-net.it 11 Nov '08

11 Nov '08

robb(a)wtg.cw.com wrote: > Full_Name: Robert Brooks > Version: 2 > OS: 2.4.12 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (62.49.19.14) > > > Set up is a pair of centos 4 hosts, one acts as primary, the other is a syncrepl > consumer and mysql slave. Apart from syncrepl config/myqsl slave all config and > software versions are the same. Mysql queries on both hosts are to localhost via > socket. > > After a period of operation (24-48 hours) the slave host drops the back-sql part > of directory for some queries (same query will suceed some times). Using strace > it can been seen that the ldap searches are not resulting in queries to mysql. > Back-sql is a subordinate db and results from hdb backed part of directory are > returned. > > Restarting slapd fixes the problem, but start-up reports the shutdown was > unclean on hdb db. Operation of primary is reliable. I have no possibility to setup a back-sql with mysql right now. Can you post your configuration? Can you post some (verbose) logs of operations affecting back-sql (e.g. with BACKSQL_TRACE manually #defined in back-sql/back-sql.h)? Can you step thru a search into backsql_search() and see if it gets called and why it doesn't get to contacting the rdbms? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

[Fwd: ITS#4556 ACLs for new entries]
by hyc＠symas.com 11 Nov '08

11 Nov '08

For completeness' sake... ACL checking for Added entries is available in RE24/HEAD. See the add_content_acl / olcAddContentAcl setting in slapd.conf/slapd.d. The default for most DBs is off, for backward compatibility. It is ON by default for cn=config. -------- Original Message -------- Subject: ITS#4556 ACLs for new entries Date: Fri, 21 Sep 2007 09:00:37 -0700 From: Howard Chu <hyc(a)symas.com> To: OpenLDAP Devel <openldap-devel(a)openldap.org> Revisiting this topic - DITStructureRules are not a solution to this problem. E.g. in cn=config, now that you can grant write access to arbitrary users, it becomes pretty critical to be able to prevent certain users from creating certain types of objects. E.g., I may want to allow someone to be able to create one type of child object under cn=config (e.g., databases) but not some other type (e.g., modules). So at the very least we need to be able to use ACL filters on new entries. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5796)
by robb＠webtechnologygroup.co.uk 11 Nov '08

11 Nov '08

can re-create this problem by restarting mysql. Following a restart about one in five queries fails on back-sql portion of directory.

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by quanah＠zimbra.com 10 Nov '08

10 Nov '08

--On Tuesday, November 11, 2008 3:52 AM +0000 abartlet(a)samba.org wrote: > > --=-nSmbtQnR20QHrM5OsFp5 > Content-Type: text/plain > Content-Transfer-Encoding: quoted-printable > > On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: >> A tentative implementation is in HEAD, please test. You need to: > > I just wanted to say thankyou very much for doing this. The Samba side > of things has taken far longer than I ever imagined, but I hope to look > at the OpenLDAP integration this or next week. It was added to RE24 today, for inclusion in 2.4.13, so getting feedback would be great. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5768) [enhancement] add support for Dereference Control
by abartlet＠samba.org 10 Nov '08

10 Nov '08

--=-nSmbtQnR20QHrM5OsFp5 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2008-10-23 at 00:15 +0200, Pierangelo Masarati wrote: > A tentative implementation is in HEAD, please test. You need to: I just wanted to say thankyou very much for doing this. The Samba side of things has taken far longer than I ever imagined, but I hope to look at the OpenLDAP integration this or next week. Andrew Bartlett --=20 Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com --=-nSmbtQnR20QHrM5OsFp5 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQBJGQF+z4A8Wyi0NrsRAnpXAJ9c4Lx4uVyadLTvaTaAm7rvTWKC+QCgrK9p Vhadna7DXcJs0h11JPmkg8c= =HgJ+ -----END PGP SIGNATURE----- --=-nSmbtQnR20QHrM5OsFp5--

1 0

Re: (ITS#5797) build failed
by hyc＠symas.com 10 Nov '08

10 Nov '08

cycwj(a)163.com wrote: > Full_Name: bluewind > Version: 2.4.12 > OS: ubunt server 8 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (219.133.134.8) > > > try to build on ubutnu server 8, use install manaul from www.openldap.org > > #./configure (ok) > #make depen (ok) > #make (ok) > > but,when execution > > #make test > > the system stop on "Running slapadd to build slapd database...", no any > response > > after about 1 hour I think what Ando was trying to say very subtly is that your bug report does not contain much useful information, and you should have searched the ITS for similar issues before posting. This is a known bug in BerkeleyDB 4.7.25. We have to guess that this is the version of BDB that you're using because you didn't provide this info in your report. ITS#5707 already contains the details of this bug and the official patch from Oracle. The patch is also present in the OpenLDAP CVS. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5799) smbk5pwd update to work with heimdal 1.2 API
by hyc＠symas.com 10 Nov '08

10 Nov '08

admin(a)dmarkey.com wrote: > Full_Name: David Markey > Version: 2.4 > OS: Solaris/AIX/Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (79.97.241.103) > > > Update smbk5pwd to work with the heimdal 1.2 API. Work has been done on the > mailing list but the patches have not been applied to the release. I don't see any patches in your report. Patches that are to be considered for inclusion into the codebase must be submitted to the ITS by their authors, with any Rights statement as needed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5796)
by robb＠webtechnologygroup.co.uk 10 Nov '08

10 Nov '08

strace from failing slapd process 13637 send(3, "<167>Nov 5 10:34:39 slapd[13628"..., 117, MSG_NOSIGNAL) = 117 13637 semop(22052874, 0xb53ad7d0, 2) = 0 13637 semop(22052874, 0xb53ad7e0, 1) = 0 13637 time(NULL) = 1225881279 13637 semop(22052874, 0xb53ad750, 2) = 0 13637 semop(22052874, 0xb53ad760, 1) = 0 13637 write(57, "\27\3\1\0 \334@\'\353]R\251-Q\251Dd>0\376&\227\326\4\222dU\t\266/\356\177"..., 90) = 90 13637 time(NULL) = 1225881279 13637 stat64("/etc/localtime", {st_dev=makedev(3, 3), st_ino=1032239, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size= 1323, st_atime=2008/11/05-10:31:17, st_mtime=2007/08/09-19:54:26, st_ctime=2007/08/09-19:54:26}) = 0 13637 stat64("/etc/localtime", {st_dev=makedev(3, 3), st_ino=1032239, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size= 1323, st_atime=2008/11/05-10:31:17, st_mtime=2007/08/09-19:54:26, st_ctime=2007/08/09-19:54:26}) = 0 13637 stat64("/etc/localtime", {st_dev=makedev(3, 3), st_ino=1032239, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=16, st_size= 1323, st_atime=2008/11/05-10:31:17, st_mtime=2007/08/09-19:54:26, st_ctime=2007/08/09-19:54:26}) = 0 13637 send(3, "<167>Nov 5 10:34:39 slapd[13628"..., 76, MSG_NOSIGNAL) = 76 looks like it connect to mysql but never queries it. any way I can capture something useful with gdb?

1 0

(ITS#5802) nssov_uid2dn using wrong LDAP filter
by ralf＠OpenLDAP.org 10 Nov '08

10 Nov '08

Full_Name: Ralf Haferkamp Version: HEAD, RE24 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.136.132) Submitted by: ralf The uid2dn function to resolve a username into a DN uses filters of the form "(&(objectclass=posixAccount)(uidNumber=<username>))" in it's query. The correct filter would be: "(&(objectclass=posixAccount)(uid=<username>))" Fix will appear in CVS soon.

1 0

(ITS#5801) "nssov-map" directive cause slapd to crash on startup
by ralf＠OpenLDAP.org 10 Nov '08

10 Nov '08

Full_Name: Ralf Haferkamp Version: HEAD, RE24 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.136.132) Submitted by: ralf Adding the line: nssov-map group uniquemember member To the nssov configuration in /etc/openldap/slapd.conf cause slapd to crash on startup. I'll commit a fix to HEAD shortly.

1 0

(ITS#5800) nssov overlay crashing on empty groups
by ralf＠OpenLDAP.org 10 Nov '08

10 Nov '08

Full_Name: Ralf Haferkamp Version: HEAD, RE24 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (89.166.136.132) Submitted by: ralf Calling "getent group" causes the nssov-overlay to crash, when there are "posixGroups" without members. A fix is coming.

1 0

(ITS#5799) smbk5pwd update to work with heimdal 1.2 API
by admin＠dmarkey.com 10 Nov '08

10 Nov '08

Full_Name: David Markey Version: 2.4 OS: Solaris/AIX/Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (79.97.241.103) Update smbk5pwd to work with the heimdal 1.2 API. Work has been done on the mailing list but the patches have not been applied to the release.

1 0

Missing module PPolicy with openldap on CentOS5.0!
by Nguyen Quang Huy 10 Nov '08

10 Nov '08

Dear all! I'm setup openldap + CentOS 5.0 (I'm setup by YUM). I'm setup and configure test LDAP --> Ok, but I can't configure password policies for Openldap beacause openldap missing ppolicy module. I'm searching with google this error, but I can't append module ppolicy. Please help me!! Thanks.

3 2

Re: (ITS#5798) MMR/mirror mode circumvents schema check
by ando＠sys-net.it 08 Nov '08

08 Nov '08

h.b.furuseth(a)usit.uio.no wrote: > hyc(a)symas.com writes: >> IMO defaulting schemacheck off for replication is fine because >> replicated entries will have been checked on the master. > > What if two simulaneous, valid changes to the same entry on two masters > produce a schema error when combined? I haven't been tracking MMR - > does the entry end up with a schema error, or does MMR consider two > changes to the same entry a conflict and fail to replicate, or...? AFAIK, the last entryCSN should win. Something like: MM1 MM2 time 0 csn0 csn0 (same) time 1 csn0+1 -> - time 2 - <- csn0+2 time 3 csn0+1,csn0+2 csn0+2,csn0+1 (one wins, I assume the latest) At all times, each entry is sane. The one that wins is sane, the one that loses will be replaced by the one that wins. The reason for this ITS and other stuff that will come shortly is that I've been asked to audit MMR, by designing a suite of tests that check functionality and reliability of MMR under possibly reproducible conflict, concurrency and other critical conditions. I'm highlighting a series of issues. I won't post ITSes or other notices until I find out whether it's slapd's or my tests' fault. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5798) MMR/mirror mode circumvents schema check
by h.b.furuseth＠usit.uio.no 08 Nov '08

08 Nov '08

hyc(a)symas.com writes: > IMO defaulting schemacheck off for replication is fine because > replicated entries will have been checked on the master. What if two simulaneous, valid changes to the same entry on two masters produce a schema error when combined? I haven't been tracking MMR - does the entry end up with a schema error, or does MMR consider two changes to the same entry a conflict and fail to replicate, or...? -- Hallvard

1 0

Re: (ITS#5798) MMR/mirror mode circumvents schema check
by hyc＠symas.com 08 Nov '08

08 Nov '08

Howard Chu wrote: > All we have to do is change the code from setting the DB flag to using the > per-op o_no_schema_check flag. IMO defaulting schemacheck off for replication > is fine because replicated entries will have been checked on the master. Of course, it was already using the per-op flag too. Probably meant to remove the per-DB flag and forgot to some time ago. Fixed now in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5798) MMR/mirror mode circumvents schema check
by hyc＠symas.com 08 Nov '08

08 Nov '08

ando(a)sys-net.it wrote: > ando(a)sys-net.it wrote: >> Full_Name: Pierangelo Masarati >> Version: HEAD/re24 >> OS: irrelevant >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (82.63.140.131) >> Submitted by: ando >> >> >> When syncrepl is configured, schema checking is switched off. As a consequence, >> schema checking does not occur for all writes, including direct writes from >> clients when MMR/MM is in use. >> >> Internal writes performed by syncrepl should be marked as such, in order to >> disable schema checking only when appropriate. > > It all seems to boil down to the fact that syncrepl schemachecking is > off by default. So, not specifying any results in having multimasters > with schemachecking disabled, which is not desirable. I recommend > schema checking be on by default. All we have to do is change the code from setting the DB flag to using the per-op o_no_schema_check flag. IMO defaulting schemacheck off for replication is fine because replicated entries will have been checked on the master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5798) MMR/mirror mode circumvents schema check
by ando＠sys-net.it 08 Nov '08

08 Nov '08

Howard Chu wrote: > ando(a)sys-net.it wrote: >> ando(a)sys-net.it wrote: >>> Full_Name: Pierangelo Masarati >>> Version: HEAD/re24 >>> OS: irrelevant >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (82.63.140.131) >>> Submitted by: ando >>> >>> >>> When syncrepl is configured, schema checking is switched off. As a >>> consequence, >>> schema checking does not occur for all writes, including direct >>> writes from >>> clients when MMR/MM is in use. >>> >>> Internal writes performed by syncrepl should be marked as such, in >>> order to >>> disable schema checking only when appropriate. >> >> It all seems to boil down to the fact that syncrepl schemachecking is >> off by default. So, not specifying any results in having multimasters >> with schemachecking disabled, which is not desirable. I recommend >> schema checking be on by default. > > All we have to do is change the code from setting the DB flag to using > the per-op o_no_schema_check flag. IMO defaulting schemacheck off for > replication is fine because replicated entries will have been checked on > the master. Well, it used to be so, but now with MMR (and mirror mode) it's no longer so. Using the per-op is fine, as long as the caller consistently sets it. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5798) MMR/mirror mode circumvents schema check
by ando＠sys-net.it 08 Nov '08

08 Nov '08

ando(a)sys-net.it wrote: > Full_Name: Pierangelo Masarati > Version: HEAD/re24 > OS: irrelevant > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (82.63.140.131) > Submitted by: ando > > > When syncrepl is configured, schema checking is switched off. As a consequence, > schema checking does not occur for all writes, including direct writes from > clients when MMR/MM is in use. > > Internal writes performed by syncrepl should be marked as such, in order to > disable schema checking only when appropriate. It all seems to boil down to the fact that syncrepl schemachecking is off by default. So, not specifying any results in having multimasters with schemachecking disabled, which is not desirable. I recommend schema checking be on by default. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5798) MMR/mirror mode circumvents schema check
by ando＠sys-net.it 08 Nov '08

08 Nov '08

Full_Name: Pierangelo Masarati Version: HEAD/re24 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (82.63.140.131) Submitted by: ando When syncrepl is configured, schema checking is switched off. As a consequence, schema checking does not occur for all writes, including direct writes from clients when MMR/MM is in use. Internal writes performed by syncrepl should be marked as such, in order to disable schema checking only when appropriate. p.

1 0

Re: (ITS#5797) build failed
by ando＠sys-net.it 08 Nov '08

08 Nov '08

cycwj(a)163.com wrote: > Full_Name: bluewind > Version: 2.4.12 > OS: ubunt server 8 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (219.133.134.8) > > > try to build on ubutnu server 8, use install manaul from www.openldap.org > > #./configure (ok) > #make depen (ok) > #make (ok) > > but,when execution > > #make test > > the system stop on "Running slapadd to build slapd database...", no any > response > > after about 1 hour Thanks for the detailed report. Did you read <http://www.openldap.org/faq/data/cache/56.html>, significantly <http://www.openldap.org/faq/data/cache/58.html>, <http://www.openldap.org/faq/data/cache/59.html> and <http://www.openldap.org/faq/data/cache/1122.html>? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5797) build failed
by cycwj＠163.com 06 Nov '08

06 Nov '08

Full_Name: bluewind Version: 2.4.12 OS: ubunt server 8 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (219.133.134.8) try to build on ubutnu server 8, use install manaul from www.openldap.org #./configure (ok) #make depen (ok) #make (ok) but,when execution #make test the system stop on "Running slapadd to build slapd database...", no any response after about 1 hour

1 0

Re: (ITS#5773) bi_entry_get_rw() and overlays issue
by hyc＠symas.com 06 Nov '08

06 Nov '08

ando(a)sys-net.it wrote: > h.b.furuseth(a)usit.uio.no wrote: >> ando(a)sys-net.it writes: >>> I think bi_entry_get_rw() needs work. >> Or maybe phase it out in favor of some other call? >> >>> In fact, as also discussed in ITS#5628, callers either return the >>> entry or have no means to modify the arguments of the request. >> It has more troubles than that. See e.g. the notes about passing rw=1 >> (write) to it here: >> http://www.openldap.org/lists/openldap-devel/200803/msg00055.html >> And there is no equivalent of the REP_ENTRY_MUSTRELEASE flag which >> says to pass an rw=1 argument to bi_entry_release_rw(). > > Well, I see many places where an entry needs to be fetched. Typically, > it needs to be done read-only. In fact, the rw flag makes no sense. You can only fetch an entry ro; if you actually fetched it for write access and modified the entry, there's no API to commit the changed entry to stable storage. You would only be making a transient change to a cached copy (which could disappear as soon as you release the entry). So if we're going to change this API, the first thing to do is get rid of the rw flag. You must use be_modify if you want to change anything about an entry... > So the difference between > bi_entry_get_ro() and an internal search is that if we are fine with the > entry in-cache, we save lots of manipulation. However this might no > longer suffice when overlays muck with the entry (like slapo-rwm). > Moreover, when overlays are present, I see the need to: > 1) run it like it came from outside, going thru all the overlays That's what overlays currently do when they do the bd_info swap and then call be_entry_get_rw(). > 2) go straight to the underlying database That's done by calling bd_info->bi_entry_get_rw()... > 3) go thru overlays starting at some point (e.g. when called from inside > an overlay under the assumption the entry is fetched as that overlay > would see it, so with only any possible mucking from overlays layered > deeper than the caller). That's what overlay_entry_get_ov() does. Also note that passing a NULL overinst here accomplishes (2). > This probably needs to modify the way > callbacks are actually called, allowing some "after self" feature in > playing not just the overlay list, but also the response (and the cleanup). Then we need an "opcode" for this, so that response / cleanup handlers know why they're being invoked. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs