- openldap-bugs - openldap.org

Re: ITS#5717
by ando＠sys-net.it 29 Sep '08

29 Sep '08

Fixed in HEAD; test044 updated as well. Please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Bug- Enforcing validation when validator is NULL
by Prashant kulkarni 29 Sep '08

29 Sep '08

Hi When I am trying to add/edit the value to the attribute "protocol information" which is required in our schema I am getting the error Invalid syntax :protocol information: no validator for syntax 1.3.6.1.4.1.1466.115.121.1.42 from the earlier mailing list I have found The problem seems to be lack of validations in the schema_init.c source code for attribure 'Protocol Information' this attribute protocolInformation is defined in core.schema {"( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )", 0, NULL, NULL, NULL}, including values like dnPretty ,UTF8StringValidate..etc in the code instead of NULL values will resolve my problem, but then that require the custom build and I have to do for all the attributes where validation is defined as NULL. I personally feel that for those attributes where validation are NULL in schema_init.c and other schema files, the openLDAP should not force the validation and give this error message, as all these attributes in which validation are not defined becomes unusable . In Tivoli/Sun and Microsoft Active directory LDAP validation is not enforced where validation is defined as NULL hence I am not getting these kind of error in Tivoli/Sun and Microsoft Active directory for editing of this attribute . So any idea how to resolve this ? there is any way to modify any of the config file in openldap to disable this validation for protocol information ? do I have to raise bug request for the same and is this going to be fixed in next openLDAP release. ? Any help and suggestions in this direction is highly appreciated. thanks and regards Prashant

3 2

Re: (ITS#5715) segfault in libdb
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: > >> I'm experiencing seg faults when using SASL/EXTERNAL bind when >> connected over >> ldapi://. I will try to examine this further. >> >> segfault at 0 ip b7f21d4c sp b370fd10 error 6 in >> libdb-4.6.so[b7ef9000+14f000] > > This bug is typical of loading a libsasl2 module (libsasldb) built with > a Berkeley DB version different from the one slapd was built with, or > loading a libsasl2 module built with a different version of libsasl2 > than the one slapd was built with. Can you check? Now I've rebuilt with the pre-installed BDB 4.5 (openSUSE 11.0) packages and it works. Hmm... Ciao, Michael.

1 0

(ITS#5719) Reset syncrepl interval after resceduling paused task
by rein＠OpenLDAP.org 29 Sep '08

29 Sep '08

Full_Name: Rein Tollevik Version: RE_24 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.93.160.250) Submitted by: rein When a syncrepl task is paused after the thread pool is pauses (due to dynamic configuration updates) it is rescheduled to run immediately. But the interval is not put back again, which causes the slapd_daemon_task() to exercise the CPU rescheduling the syncrepl task until the next clock second ticks off. I'll commit a fix shortly. Rein Tollevik Basefarm AS

1 0

(ITS#5718) [documentation] Mention dontusecopy control in conjunction with slapo-chain(5)
by ando＠sys-net.it 29 Sep '08

29 Sep '08

Full_Name: Pierangelo Masarati Version: irrelevant OS: irrelevant URL: ftp://ftp.openldap.org/incoming/dontusecopy-chain-2008-09-29-pierangelo-mas… Submission from: (NULL) (81.72.89.40) Submitted by: ando I'm not too familiar with sdl; moreover, I'm not sure whether this is the right place to mention the dontusecopy control first. In any case, it seems worth mentioning here this good practice for clients that might write to shadow DSAs and immediately read back. See patch at URL. Cheers, p.

1 0

Re: (ITS#5715) segfault in libdb
by ando＠sys-net.it 29 Sep '08

29 Sep '08

michael(a)stroeder.com wrote: > I will check this right now. Anyway find below the tail of the server's > log when invoking > > ldapwhoami -H > ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1 -Y > EXTERNAL OK, at a first glance, I see two things: 1) your search finds nothing, probably because anonymous cannot read the "entry" pseudo-attribute of "ou=schulung,dc=stroeder,dc=local" (see [1]) 2) this causes a sigsegv, which Is Bad (TM). You should check whether the result of those ACLs is correct, and in the meanwhile provide a core dump, to fix the sigsegv issue. p. > --------------------------------- snip -------------------------------- > ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 > SASL Canonicalize [conn=0]: > authcid="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" > slap_sasl_getdn: conn 0 > id=gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth [len=59] > ==>slap_sasl2dn: converting SASL name > gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth to a DN > ==> rewrite_context_apply [depth=1] > string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' > ==> rewrite_rule_apply > rule='gidnumber=([0-9]+)\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth' > string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' [1 > pass(es)] > ==> rewrite_context_apply [depth=1] > res={0,'ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))'} > [rw] authid: > "gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" -> > "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" > slap_parseURI: parsing > ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)) > ldap_url_parse_ext(ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))) > put_filter: "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" > put_filter: AND > put_filter_list "(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)" > put_filter: "(objectClass=posixAccount)" > put_filter: simple > put_simple_filter: "objectClass=posixAccount" > put_filter: "(uidNumber=500)" > put_filter: simple > put_simple_filter: "uidNumber=500" > put_filter: "(gidNumber=100)" > put_filter: simple > put_simple_filter: "gidNumber=100" > ber_scanf fmt ({mm}) ber: > ber_scanf fmt ({mm}) ber: > ber_scanf fmt ({mm}) ber: >>>> dnNormalize: <ou=schulung,dc=stroeder,dc=local> > => ldap_bv2dn(ou=schulung,dc=stroeder,dc=local,0) > <= ldap_bv2dn(ou=schulung,dc=stroeder,dc=local)=0 > => ldap_dn2bv(272) > <= ldap_dn2bv(ou=schulung,dc=stroeder,dc=local)=0 > <<< dnNormalize: <ou=schulung,dc=stroeder,dc=local> > slap_sasl2dn: performing internal search > (base=ou=schulung,dc=stroeder,dc=local, scope=2) > => hdb_search > bdb_dn2entry("ou=schulung,dc=stroeder,dc=local") > => access_allowed: auth access to "ou=schulung,dc=stroeder,dc=local" > "entry" requested > => dn: [4] ou=users,ou=schulung,dc=stroeder,dc=local > => dn: [5] ou=groups,ou=schulung,dc=stroeder,dc=local > => dn: [6] ou=schulung,dc=stroeder,dc=local > => acl_get: [6] matched > => acl_get: [6] attr entry > => acl_mask: access to entry "ou=schulung,dc=stroeder,dc=local", attr > "entry" requested > => acl_mask: to all values by "", (=0) > <= check a_dn_pat: * > <= acl_mask: [2] applying none(=0) (stop) > <= acl_mask: [2] mask: none(=0) > => slap_access_allowed: auth access denied by none(=0) [1] > => access_allowed: no more rules > send_ldap_result: conn=0 op=0 p=3 > send_ldap_result: err=32 matched="" text="" > <==slap_sasl2dn: Converted SASL name to <nothing> > SASL Canonicalize [conn=0]: > slapAuthcDN="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" > ./start-slapd1.sh: line 14: 20820 Segmentation fault > ${OPENLDAP_PREFIX}/libexec/slapd -d stats,acl,args,trace,sync -h > "ldap://0.0.0.0:2071 > ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1" -n > slapd-schulung-1 -u michael -f ${LOCALCONFIG}/slapd-1.conf -F > ${LOCALCONFIG}/slapd-1.conf.d > michael@nb2:~/temp/openldap-testbed-RE24> > > Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5715) segfault in libdb
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: >> I'm experiencing seg faults when using SASL/EXTERNAL bind when >> connected over >> ldapi://. I will try to examine this further. >> >> segfault at 0 ip b7f21d4c sp b370fd10 error 6 in >> libdb-4.6.so[b7ef9000+14f000] > > This bug is typical of loading a libsasl2 module (libsasldb) built with > a Berkeley DB version different from the one slapd was built with, or > loading a libsasl2 module built with a different version of libsasl2 > than the one slapd was built with. Can you check? I will check this right now. Anyway find below the tail of the server's log when invoking ldapwhoami -H ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1 -Y EXTERNAL Ciao, Michael. --------------------------------- snip -------------------------------- ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 SASL Canonicalize [conn=0]: authcid="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" slap_sasl_getdn: conn 0 id=gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth [len=59] ==>slap_sasl2dn: converting SASL name gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth to a DN ==> rewrite_context_apply [depth=1] string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' ==> rewrite_rule_apply rule='gidnumber=([0-9]+)\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth' string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))'} [rw] authid: "gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" -> "ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" slap_parseURI: parsing ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)) ldap_url_parse_ext(ldap:///ou=schulung,dc=stroeder,dc=local??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))) put_filter: "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" put_filter: AND put_filter_list "(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)" put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" put_filter: "(uidNumber=500)" put_filter: simple put_simple_filter: "uidNumber=500" put_filter: "(gidNumber=100)" put_filter: simple put_simple_filter: "gidNumber=100" ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: >>> dnNormalize: <ou=schulung,dc=stroeder,dc=local> => ldap_bv2dn(ou=schulung,dc=stroeder,dc=local,0) <= ldap_bv2dn(ou=schulung,dc=stroeder,dc=local)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=schulung,dc=stroeder,dc=local)=0 <<< dnNormalize: <ou=schulung,dc=stroeder,dc=local> slap_sasl2dn: performing internal search (base=ou=schulung,dc=stroeder,dc=local, scope=2) => hdb_search bdb_dn2entry("ou=schulung,dc=stroeder,dc=local") => access_allowed: auth access to "ou=schulung,dc=stroeder,dc=local" "entry" requested => dn: [4] ou=users,ou=schulung,dc=stroeder,dc=local => dn: [5] ou=groups,ou=schulung,dc=stroeder,dc=local => dn: [6] ou=schulung,dc=stroeder,dc=local => acl_get: [6] matched => acl_get: [6] attr entry => acl_mask: access to entry "ou=schulung,dc=stroeder,dc=local", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [2] applying none(=0) (stop) <= acl_mask: [2] mask: none(=0) => slap_access_allowed: auth access denied by none(=0) => access_allowed: no more rules send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=32 matched="" text="" <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=0]: slapAuthcDN="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" ./start-slapd1.sh: line 14: 20820 Segmentation fault ${OPENLDAP_PREFIX}/libexec/slapd -d stats,acl,args,trace,sync -h "ldap://0.0.0.0:2071 ldapi://%2Fhome%2Fmichael%2Ftemp%2Fopenldap-testbed-RE24%2Fslapd1" -n slapd-schulung-1 -u michael -f ${LOCALCONFIG}/slapd-1.conf -F ${LOCALCONFIG}/slapd-1.conf.d michael@nb2:~/temp/openldap-testbed-RE24>

1 0

Re: (ITS#5715) segfault in libdb
by ando＠sys-net.it 29 Sep '08

29 Sep '08

michael(a)stroeder.com wrote: > I'm experiencing seg faults when using SASL/EXTERNAL bind when connected over > ldapi://. I will try to examine this further. > > segfault at 0 ip b7f21d4c sp b370fd10 error 6 in libdb-4.6.so[b7ef9000+14f000] This bug is typical of loading a libsasl2 module (libsasldb) built with a Berkeley DB version different from the one slapd was built with, or loading a libsasl2 module built with a different version of libsasl2 than the one slapd was built with. Can you check? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5716) test046-dds failed (exit 127): invalid ELF header
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Hallvard B Furuseth wrote: > michael(a)stroeder.com writes: >> error while loading shared libraries: >> /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/libraries/libldap_r/.libs/libldap_r-2.4-releng.so.2: >> invalid ELF header > > Hopefully a PEBKAC. Loading libraries built for another architecture, > or something like that. I re-ran all the tests and it worked. Maybe it was caused by invoking 'make install' as root while still running 'make test' as normal user. Ciao, Michael.

1 0

wrong ITS (ITS#5715)
by manu＠netbsd.org 29 Sep '08

29 Sep '08

Please disregard my previous mail, I appended to the wrong ITS. -- Emmanuel Dreyfus manu(a)netbsd.org

1 0

fix (ITS#5717)
by manu＠netbsd.org 29 Sep '08

29 Sep '08

--E13BgyNx05feLLmH Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Attached is a fix for the problem: 1) if the member attribute is not part of the requested attribute set, but the mapped attributeis, then we still need to generate the dynlist 2) in this cas, we must add the member attribute to the searched attributes. -- Emmanuel Dreyfus manu(a)netbsd.org --E13BgyNx05feLLmH Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="dynlist.patch" --- servers/slapd/overlays/dynlist.c.orig 2008-07-10 02:43:03.000000000 +0200 +++ servers/slapd/overlays/dynlist.c 2008-09-29 17:43:07.000000000 +0200 @@ -369,9 +369,12 @@ /* Don't generate member list if it wasn't requested */ for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) { if ( userattrs || - ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + break; + if ( dlm->dlm_mapped_ad && + ad_inlist( dlm->dlm_mapped_ad, rs->sr_attrs ) ) break; } if ( dli->dli_dlm && !dlm ) return SLAP_CB_CONTINUE; @@ -477,8 +480,11 @@ } else { for ( i = 0; lud->lud_attrs[i]; i++) /* just count */ ; + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + i++; + o.ors_attrs = op->o_tmpcalloc( i + 1, sizeof( AttributeName ), op->o_tmpmemctx ); for ( i = 0, j = 0; lud->lud_attrs[i]; i++) { const char *text = NULL; @@ -515,8 +521,14 @@ j++; } + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) { + o.ors_attrs[j].an_name = dlm->dlm_member_ad->ad_cname; + o.ors_attrs[j].an_desc = dlm->dlm_member_ad; + j++; + } + if ( j == 0 ) { goto cleanup; } --E13BgyNx05feLLmH--

1 0

fix (ITS#5715)
by manu＠netbsd.org 29 Sep '08

29 Sep '08

--3V7upXqbjpZ4EhLz Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Attached is a fix for the problem: 1) if the member attribute is not part of the requested attribute set, but the mapped attributeis, then we still need to generate the dynlist 2) in this cas, we must add the member attribute to the searched attributes. -- Emmanuel Dreyfus manu(a)netbsd.org --3V7upXqbjpZ4EhLz Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="dynlist.patch" --- servers/slapd/overlays/dynlist.c.orig 2008-07-10 02:43:03.000000000 +0200 +++ servers/slapd/overlays/dynlist.c 2008-09-29 17:43:07.000000000 +0200 @@ -369,9 +369,12 @@ /* Don't generate member list if it wasn't requested */ for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) { if ( userattrs || - ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + break; + if ( dlm->dlm_mapped_ad && + ad_inlist( dlm->dlm_mapped_ad, rs->sr_attrs ) ) break; } if ( dli->dli_dlm && !dlm ) return SLAP_CB_CONTINUE; @@ -477,8 +480,11 @@ } else { for ( i = 0; lud->lud_attrs[i]; i++) /* just count */ ; + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) + i++; + o.ors_attrs = op->o_tmpcalloc( i + 1, sizeof( AttributeName ), op->o_tmpmemctx ); for ( i = 0, j = 0; lud->lud_attrs[i]; i++) { const char *text = NULL; @@ -515,8 +521,14 @@ j++; } + if ( dlm && dlm->dlm_member_ad && !ad_inlist( dlm->dlm_member_ad, rs->sr_attrs ) ) { + o.ors_attrs[j].an_name = dlm->dlm_member_ad->ad_cname; + o.ors_attrs[j].an_desc = dlm->dlm_member_ad; + j++; + } + if ( j == 0 ) { goto cleanup; } --3V7upXqbjpZ4EhLz--

1 0

ITS#5717
by ando＠sys-net.it 29 Sep '08

29 Sep '08

Emmanuel, I have a fix, should I go and commit it? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5717) slapo-dynlist expantion failed for mapped attributes
by menu＠netbsd.org 29 Sep '08

29 Sep '08

Full_Name: Emmanuel Dreyfus Version: OpenLDAP-2.4.11 OS: NetBSD-4.0 URL: Submission from: (NULL) (193.54.82.42) If slapo-dynlist is configured with attribute mapping, dynlist expantion will only work if the member attribute in included in the searched attriute set. Here is an example: Config: overlay dynlist dynlist-attrset ExMailAddress memberURL mailbox:revalias Searched entry: dn: mailAddress=foo-employee(a)example.net,o=ex objectClass: exMailAddress mailAddress: foo-employee(a)example.net memberURL: ldap:///o=ex,revalias?sub?(&(objectClass=exPerson)(employer=foo)) Expantion looks up objects like this: dn: uid=jdoe,o=ex objectClass: exPerson uid: jdoe revalias: john.doe(a)example.net employer: foo With the member attribute in the searched attribute set: $ ldapsearch mailAddress=foo-employee@example mailbox revalias dn: mailAddress=foo-employee(a)example.net,o=ex mailbox: john.doe(a)example.net mailbox: joe.luser(a)example.net mailbox: emmanuel.dreyfus(a)example.net Without it: $ ldapsearch mailAddress=foo-employee@example mailbox dn: mailAddress=foo-employee(a)example.net,o=ex Note that if no attribute set is provided, it works: $ ldapsearch mailAddress=foo-employee@example dn: mailAddress=foo-employee(a)example.net,o=ex objectClass: exMailAddress mailAddress: foo-employee(a)example.net mailbox: john.doe(a)example.net mailbox: joe.luser(a)example.net mailbox: emmanuel.dreyfus(a)example.net memberURL: ldap:///o=ex,revalias?sub?(&(objectClass=exPerson)(employer=foo)) I should provide a fix for that soon.

1 0

Re: (ITS#5716) test046-dds failed (exit 127): invalid ELF header
by h.b.furuseth＠usit.uio.no 29 Sep '08

29 Sep '08

michael(a)stroeder.com writes: > error while loading shared libraries: > /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/libraries/libldap_r/.libs/libldap_r-2.4-releng.so.2: > invalid ELF header Hopefully a PEBKAC. Loading libraries built for another architecture, or something like that. -- Hallvard

1 0

(ITS#5716) test046-dds failed (exit 127): invalid ELF header
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Full_Name: Michael Ströder Version: RE24 OS: openSUSE Linux 11.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.103.245) I will examine why this fails. >>>>> Starting test046-dds ... running defines.sh Running slapadd to build slapd database... /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/servers/slapd/.libs/lt-slapd: error while loading shared libraries: /home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/libraries/libldap_r/.libs/libldap_r-2.4-releng.so.2: invalid ELF header slapadd failed (127)! >>>>> ./scripts/test046-dds failed (exit 127) make[2]: *** [bdb-yes] Error 127 make[2]: Leaving directory `/home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests' make: *** [test] Error 2

1 0

(ITS#5715) segfault in libdb
by michael＠stroeder.com 29 Sep '08

29 Sep '08

Full_Name: Michael Ströder Version: RE24 OS: openSUSE Linux 11.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.103.245) HI! I'm experiencing seg faults when using SASL/EXTERNAL bind when connected over ldapi://. I will try to examine this further. segfault at 0 ip b7f21d4c sp b370fd10 error 6 in libdb-4.6.so[b7ef9000+14f000] Ciao, Michael.

1 0

Re: (ITS#5709) slapd sync provider skips some objects
by sylvain.thomas＠gmail.com 29 Sep '08

29 Sep '08

This is not a patch suggestion but may be it helps to better see the problem's origin : I applied the following patch to syncprov.c and I got good results. The concerned objects are sent with a NULL cookie but they are replicated well. The contextCSN is made up by the subsequent objects. Thanks and best regards Sylvain Thomas. ============================================ --- syncprov.c.orig 2008-09-29 11:08:36.000000000 +0200 +++ syncprov.c 2008-09-29 11:10:33.000000000 +0200 @@ -1642,8 +1642,6 @@ } } else { /* internal ops that aren't meant to be replicated */ - ldap_pvt_thread_rdwr_wunlock( &si->si_csn_rwlock ); - return SLAP_CB_CONTINUE; } /* Don't do any processing for consumer contextCSN updates */

1 0

(ITS#5714) [feature request] operational attrs defined via configuration
by ando＠sys-net.it 27 Sep '08

27 Sep '08

Full_Name: Pierangelo Masarati Version: HEAD OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (151.30.78.88) Currently, the attributeType statement does not allow to define operational attributes. The rationale was that operational attributes are somehow application-maintained, so configuration-defined attrs would be essentially unmaintainable. At the same time, modules that are able to maintain operational attributes can register them bypassing some of the checks attributes defined via configuration must pass. However, the availability of the "relax" control could make this restriction too strict. In fact, there are works in progress (e.g. draft-wahl-ldap-adminaddr) that define operational attrs which could easily be defined via configuration and maintained via the relax control. This is a feature request to suggest the possibility to define operational attrs via configuration. p.

1 0

Re: (ITS#5712) Could not set the connection timeout
by ando＠sys-net.it 27 Sep '08

27 Sep '08

essiambl(a)gmail.com wrote: > Full_Name: Luc-André Essiambre > Version: 2.4.11 > OS: Solaris 10 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (216.95.235.3) > > > I'm using openldap to authenticate users for our subversion repositories hosted > on apache httpd. Immediately after a server startup, I get these strange errors > saying "LDAP: Could not set the connection timeout" This message does not come from anything distributed with OpenLDAP software, so it does not help isolate your issue. > when I try to authenticate > myself. The weird thing is, after a couple of attempts at accessing the > subversion content (5 or 6 times), I'm eventually authenticated without error. > Then it will work for a while, then those same errors will come back. You don't specify in what sense you're using OpenLDAP: do you use the client libraries as part of a third-party clien to do a bind to a third-party server, or do you use OpenLDAP as the LDAP server, or both? If you use the client libraries with a third-party client, did you build it with -DLDAP_DEPRECATED=1 ? This is required to expose deprecated API to clients that make use of them. > openldap was compiled using the gcc compiler included in solaris (version 3.4.3) > without slapd, with cyrus-sasl-2.1.21. Solaris runs as a virtual server on sparc > hardware. In any case, I don't see (yet) an OpenLDAP bug, so you should direct further communications to openldap-technical(a)openldap.org, since your problem mainly addresses interoperation with other software. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

ITS#5713
by ando＠sys-net.it 27 Sep '08

27 Sep '08

Probably, the right fix consists in changing that attr's syntax to DirectoryString, and allow all syntaxes, from "--w-------" to passing the value to strtol(value, NULL, 0) etc. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5711) Password Modify Exop don't return ppolicy control in case of error
by ando＠sys-net.it 27 Sep '08

27 Sep '08

Guillaume.Rousse(a)inria.fr wrote: > When Password Modify ExOp fails, due to ppolicy restrictions, it doesn't return > any ppolicy control. Fixed in HEAD, please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5713) Documentation: olcDbMode incorrect at http://www.openldap.org/doc/admin24/slapdconf2.html
by rtdean＠cytherianage.net 26 Sep '08

26 Sep '08

Full_Name: Ryan T. Dean Version: 2.4.11 OS: FreeBSD 7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (64.124.245.244) The documentation present at http://www.openldap.org/doc/admin24/slapdconf2.html provides an incorrect example for the olcDbMode attribute. The documentation reads: >>> 5.2.6.9. olcDbMode: <integer> This directive specifies the file protection mode that newly created database index files should have. Default: olcDbMode: 0600 <<< However, olcDbMode takes an integer, and slapd will reject a value of 0600. It will accept a value of 600, however, this results in octal permissions 1130, which is -not- what you want. Instead, providing olcDbMode with a value of 384 will result in an octal permission of 0600, which is, I believe, what the documentation is attempting to state.

1 0

Re: ITS#5707 [Fwd: Re: 4.7.25 deadlock]
by quanah＠zimbra.com 26 Sep '08

26 Sep '08

Seriously, what kind of crap is that? They've got a serious flaw in their software, but don't intend to publish the patch? sheesh. --Quanah --On September 26, 2008 6:27:45 AM +0000 hyc(a)symas.com wrote: > So I guess we have to warn people about this one ourselves for a while. > > -------- Original Message -------- > Subject: Re: 4.7.25 deadlock > Date: Thu, 25 Sep 2008 23:15:31 -0700 > From: Michael Ubell <@oracle.com> > To: Howard Chu <hyc(a)symas.com> > > Howard, > > Generally we only post critical patches (data corruption, etc) to the > web site. Since this one only effects those using user defined locks > and does no damage, I don't think it will be posted. > > Mike > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5712) Could not set the connection timeout
by essiambl＠gmail.com 26 Sep '08

26 Sep '08

Full_Name: Luc-André Essiambre Version: 2.4.11 OS: Solaris 10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (216.95.235.3) I'm using openldap to authenticate users for our subversion repositories hosted on apache httpd. Immediately after a server startup, I get these strange errors saying "LDAP: Could not set the connection timeout" when I try to authenticate myself. The weird thing is, after a couple of attempts at accessing the subversion content (5 or 6 times), I'm eventually authenticated without error. Then it will work for a while, then those same errors will come back. openldap was compiled using the gcc compiler included in solaris (version 3.4.3) without slapd, with cyrus-sasl-2.1.21. Solaris runs as a virtual server on sparc hardware.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs