- openldap-bugs - openldap.org

(ITS#5645) <suffix> invalid DN 21 (Invalid syntax)
by support＠msm-projects.net 05 Aug '08

05 Aug '08

Full_Name: MSM-Projects Support Version: 2.4.11 OS: Debian Linux (2.6.18-6-xen-amd64) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.9.60.153) We installed a ldap server version 2.4.11. With default slapd.conf the server is starting. Changing the default-suffix to a version we need (building a replica with an existing host), we get error: line 54 (suffix "o=my-domain, c=com") >>> dnPrettyNormal: <o=my-domain, c=com> => ldap_bv2dn(o=my-domain, c=com,0) <= ldap_bv2dn(o=my-domain, c=com)=0 ldap_err2string /usr/local/openldap/etc/openldap/slapd.conf: line 54: <suffix> invalid DN 21 (Invalid syntax)

1 0

Re: (ITS#5581) slapd: search.c:970: oc_filter: Assertion `f != ((void *)0)' failed.
by stef＠memberwebs.com 05 Aug '08

05 Aug '08

I get this problem with 2.4.11 (but not with 2.4.10). My slapo-unique configuration is as follows: unique_uri ldap:///?cn?sub unique_uri ldap:///?uid,login?sub?(!(disabled=TRUE)) The filter seems valid to me, but please correct me if I'm wrong.

1 0

Re: (ITS#5644) make test000 core dumps
by michael＠stroeder.com 05 Aug '08

05 Aug '08

Pierangelo Masarati wrote: > ----- michael(a)stroeder.com wrote: > >> michael(a)stroeder.com wrote: >>> Maybe slapd starts but this is not correctly detected by the test >> script? >> >> This does not seem to be the case. > > Can you start it manually? Good idea. Indeed that's possible: cd tests/ ../servers/slapd/.libs/lt-slapd -d 1 -h ldap://127.0.0.1:9011 -f testrun/slapd.1.conf Ciao, Michael.

1 0

Re: (ITS#5644) make test000 core dumps
by ando＠sys-net.it 05 Aug '08

05 Aug '08

----- michael(a)stroeder.com wrote: > michael(a)stroeder.com wrote: > > Maybe slapd starts but this is not correctly detected by the test > script? > > This does not seem to be the case. Can you start it manually? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5644) make test000 core dumps
by michael＠stroeder.com 05 Aug '08

05 Aug '08

michael(a)stroeder.com wrote: > Maybe slapd starts but this is not correctly detected by the test script? This does not seem to be the case. Ciao, Michael.

1 0

Re: (ITS#5644) make test000 core dumps
by michael＠stroeder.com 05 Aug '08

05 Aug '08

Pierangelo Masarati wrote: >> slapd starting >> daemon: listen(ldap://localhost:9011/, 5) failed errno=3D98 (Address >> already in use) > > ^^^^ ? p. I already saw this but this is caused by the 2nd try to start slapd. You might have noticed several lines of console output saying "Waiting 5 seconds for slapd to start...". I've checked with fuser 9011/tcp and by looking at output of 'netstat -anp' before invoking 'make test' that there's no process bound on that port. Maybe slapd starts but this is not correctly detected by the test script? Ciao, Michael.

1 0

Re: (ITS#5644) make test000 core dumps
by ando＠sys-net.it 05 Aug '08

05 Aug '08

> slapd starting > daemon: listen(ldap://localhost:9011/, 5) failed errno=3D98 (Address > alre= > ady in use) ^^^^ ? p. > lt-slapd shutdown: initiated > =3D=3D=3D=3D> bdb_cache_release_all > lt-slapd destroy: freeing system resources. > slapd stopped. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5644) make test000 core dumps
by michael＠stroeder.com 05 Aug '08

05 Aug '08

This is a multi-part message in MIME format. --------------000504090501070603080100 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Pierangelo Masarati wrote: > ----- "Michael Ströder" <michael(a)stroeder.com> wrote: > >> Pierangelo Masarati wrote: >>> Are you sure you're loading the sasl mechs you've compiled for? >> That's a typical issue with SASL (see SASL_PATH, in case). >>>> #2 0x405df014 in ?? () from /usr/lib/libldap-2.4.so.2 >> Hmm, it seems the problem is rather that the LDAP client libs from the >> >> RPM package installed by openSUSE are loaded instead the ones from the >> >> build directory. That's bad. Any way around this when running 'make >> test'? > > LD_LIBRARY_PATH to your just built libs? Hmm, I don't have a clue what's going on. I tried with my RE24 source tree from which I've successfully built a couple of days ago. I've removed openSUSE packages for OpenLDAP client libs and cyrus-sasl-ldap-auxprop. Still no success. It does not core dump anymore but slapd does not start (see below). Ciao, Michael. -------------------------------- snip --------------------------------- >>>>> Starting test000-rootdse ... running defines.sh Starting slapd on TCP/IP port 9011... Using ldapsearch to retrieve the root DSE... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ./scripts/test000-rootdse: line 66: kill: (21057) - No such process ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) >>>>> Test failed >>>>> ./scripts/test000-rootdse failed (exit 255) make[2]: *** [bdb-yes] Error 255 make[2]: Leaving directory `/home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests' make: *** [test] Error 2 -------------------------------- snip --------------------------------- --------------000504090501070603080100 Content-Type: text/x-log; name="slapd.1.log" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline; filename="slapd.1.log" @(#) $OpenLDAP: slapd 2.4.X (Aug 5 2008 13:40:27) $ michael@nb2:/home/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/ser= vers/slapd ldap_pvt_gethostbyname_a: host=3Dnb2, r=3D0 daemon_init: ldap://localhost:9011/ daemon_init: listen on ldap://localhost:9011/ daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap://localhost:9011/) daemon: listener initialized ldap://localhost:9011/ daemon_init: 3 listeners opened ldap_create lt-slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.5.20: (June 6, 2008) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.5.20: (June 6, 2008) =3D=3D>sql_back_initialize() <=3D=3Dsql_back_initialize() =3D=3D> translucent_initialize =3D> str2entry: "dn: vendorName: The OpenLDAP Project <http://www.openldap.org/> " >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> <=3D str2entry() -> 0x8338184 bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <o=3DOpenLDAP Project,l=3DInternet> =3D> ldap_bv2dn(o=3DOpenLDAP Project,l=3DInternet,0) <=3D ldap_bv2dn(o=3DOpenLDAP Project,l=3DInternet)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(o=3DOpenLDAP Project,l=3DInternet)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(o=3Dopenldap project,l=3Dinternet)=3D0=20 <<< dnPrettyNormal: <o=3DOpenLDAP Project,l=3DInternet>, <o=3Dopenldap pr= oject,l=3Dinternet> >>> dnPrettyNormal: <cn=3DMonitor> =3D> ldap_bv2dn(cn=3DMonitor,0) <=3D ldap_bv2dn(cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Dmonitor)=3D0=20 <<< dnPrettyNormal: <cn=3DMonitor>, <cn=3Dmonitor> >>> dnNormalize: <cn=3DSubschema> =3D> ldap_bv2dn(cn=3DSubschema,0) <=3D ldap_bv2dn(cn=3DSubschema)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Dsubschema)=3D0=20 <<< dnNormalize: <cn=3Dsubschema> matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.84= 0.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion = $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $= olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcInd= exSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcInde= xIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSo= ckbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThread= s $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSiz= e $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth= $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcDDSmaxDynamicObject= s $ olcProxyCacheQueries $ olcSpSessionlog $ mailPreferenceOption $ shado= wLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ sh= adowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber= $ searchTimeLimit $ bindTimeLimit $ profileTTL $ pwdMinAge $ pwdMaxAge $= pwdInHistory $ pwdCheckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGr= aceAuthNLimit $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInter= val ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.8= 40.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersio= n $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending= $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcI= ndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIn= dexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olc= SockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThre= ads $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheS= ize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDep= th $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcDDSmaxDynamicObje= cts $ olcProxyCacheQueries $ olcSpSessionlog $ mailPreferenceOption $ sha= dowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ = shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumb= er $ searchTimeLimit $ bindTimeLimit $ profileTTL $ pwdMinAge $ pwdMaxAge= $ pwdInHistory $ pwdCheckQuality $ pwdMinLength $ pwdExpireWarning $ pwd= GraceAuthNLimit $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInt= erval ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1= =2E3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer= $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDR= ecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ co= rbaIor $ javaCodebase $ javaDoc $ mailLocalAddress $ mailHost $ mailRouti= ngAddress $ rfc822MailMember $ gecos $ homeDirectory $ loginShell $ membe= rUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumb= er $ macAddress $ bootFile $ nisMapEntry $ attributeMap $ credentialLevel= $ objectclassMap $ defaultSearchScope $ serviceCredentialLevel $ pwdChec= kModule ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.= 3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ o= lcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecor= d $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ corbaI= or $ javaCodebase $ javaDoc $ mailLocalAddress $ mailHost $ mailRoutingAd= dress $ rfc822MailMember $ gecos $ homeDirectory $ loginShell $ memberUid= $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $= macAddress $ bootFile $ nisMapEntry $ attributeMap $ credentialLevel $ o= bjectclassMap $ defaultSearchScope $ serviceCredentialLevel $ pwdCheckMod= ule ) ) 2.5.13.35 (certificateMatch): 2.5.13.34 (certificateExactMatch): = matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userC= ertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2= =2E5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supported= Control $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ support= edApplicationContext $ pwdAttribute ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29 = NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryT= tl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConn= MaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstr= IfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen = $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMax= Incoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcD= bCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcD= bMode $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDb= ProtocolVersion $ olcDbConnectionPoolMax $ olcDDSmaxDynamicObjects $ olcP= roxyCacheQueries $ olcSpSessionlog $ mailPreferenceOption $ shadowLastCha= nge $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpi= re $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ searc= hTimeLimit $ bindTimeLimit $ profileTTL $ pwdMinAge $ pwdMaxAge $ pwdInHi= story $ pwdCheckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthN= Limit $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME '= generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp $ pwdCh= angedTime $ pwdAccountLockedTime $ pwdFailureTime $ pwdGraceUseTime ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NA= ME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uni= queMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NA= ME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME '= telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pa= ger ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octe= tStringMatch' APPLIES ( userPassword $ olcDbCryptKey $ pwdHistory $ javaS= erializedData ) ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStr= ingMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerM= atch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $= olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTime= out $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAny= Len $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefD= epth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxInco= mingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize = $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ o= lcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConne= ctionPoolMax $ olcDDSmaxDynamicObjects $ olcProxyCacheQueries $ olcSpSess= ionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax = $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServiceP= ort $ ipProtocolNumber $ oncRpcNumber $ searchTimeLimit $ bindTimeLimit $= profileTTL $ pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheckQuality $ pw= dMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockoutDuration $= pwdMaxFailure $ pwdFailureCountInterval ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanM= atch' APPLIES ( hasSubordinates $ olcGentleHUP $ olcHidden $ olcLastMod $= olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcDbNo= Sync $ olcDbDirtyRead $ olcDbLinearIndex $ olcChainCacheURI $ olcChainRet= urnError $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ o= lcDbSingleConn $ olcDbUseTemporaryConn $ olcDbNorefs $ olcAccessLogSucces= s $ olcDDSstate $ olcMemberOfRefInt $ pwdReset $ olcPPolicyHashCleartext = $ olcPPolicyUseLockout $ olcProxySaveQueries $ olcRwmNormalizeMapped $ ol= cSpNoPresent $ olcSpReloadHint $ olcTranslucentStrict $ olcTranslucentNoG= lue $ olcUniqueStrict $ followReferrals $ dereferenceAliases $ pwdLockout= $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'c= aseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePos= talAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'nume= ricStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME= 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator= $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME '= caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ d= nQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExac= tMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ = ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcCon= figDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcA= ttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcB= ackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ o= lcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olc= ObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFo= rmat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcR= eferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplog= File $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $= olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimi= t $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCAC= ertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLS= CertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $= olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $= olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbIndex $ olcDbLo= ckDetect $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbACLPassw= d $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAsser= tMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdl= eTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuaran= tine $ olcDbSocketPath $ olcDbSocketExtensions $ olcAccessLogOps $ olcAcc= essLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAuditlogFile $ o= lcConstraintAttribute $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl $ = olcDDSinterval $ olcDDStolerance $ olcDGAttrPair $ olcDLattrSet $ olcMemb= erOfDangling $ olcMemberOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMemb= erOfAD $ olcMemberOfDanglingError $ olcProxyCache $ olcProxyAttrset $ olc= ProxyTemplate $ olcProxyResponseCB $ olcRefintAttribute $ olcRwmRewrite $= olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcTranslucentLocal $ ol= cTranslucentRemote $ olcUniqueIgnore $ olcUniqueAttribute $ olcUniqueURI = $ olcValSortAttr $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st = $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox= $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initia= ls $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseu= donym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ ho= st $ documentIdentifier $ documentTitle $ documentVersion $ documentLocat= ion $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buil= dingName $ documentPublisher $ corbaRepositoryId $ javaClassName $ javaCl= assNames $ javaFactory $ javaReferenceAddress $ carLicense $ departmentNu= mber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ = ipServiceProtocol $ nisMapName $ defaultServerList $ preferredServerList = $ authenticationMethod $ serviceSearchDescriptor $ serviceAuthenticationM= ethod $ memberURL ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAM= E 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicat= or $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME = 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $= dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgn= oreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion = $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcC= onfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ ol= cAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ ol= cBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $= olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ o= lcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSalt= Format $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ ol= cReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcRepl= ogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost= $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLi= mit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSC= ACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcT= LSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile= $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef= $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbIndex $ olcDb= LockDetect $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbACLPas= swd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAss= ertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbI= dleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuar= antine $ olcDbSocketPath $ olcDbSocketExtensions $ olcAccessLogOps $ olcA= ccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAuditlogFile $= olcConstraintAttribute $ olcDDSmaxTtl $ olcDDSminTtl $ olcDDSdefaultTtl = $ olcDDSinterval $ olcDDStolerance $ olcDGAttrPair $ olcDLattrSet $ olcMe= mberOfDangling $ olcMemberOfGroupOC $ olcMemberOfMemberAD $ olcMemberOfMe= mberOfAD $ olcMemberOfDanglingError $ olcProxyCache $ olcProxyAttrset $ o= lcProxyTemplate $ olcProxyResponseCB $ olcRefintAttribute $ olcRwmRewrite= $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcTranslucentLocal $ = olcTranslucentRemote $ olcUniqueIgnore $ olcUniqueAttribute $ olcUniqueUR= I $ olcValSortAttr $ knowledgeInformation $ sn $ serialNumber $ c $ l $ s= t $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeB= ox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ init= ials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ ps= eudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ = host $ documentIdentifier $ documentTitle $ documentVersion $ documentLoc= ation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ bu= ildingName $ documentPublisher $ corbaRepositoryId $ javaClassName $ java= ClassNames $ javaFactory $ javaReferenceAddress $ carLicense $ department= Number $ displayName $ employeeNumber $ employeeType $ preferredLanguage = $ ipServiceProtocol $ nisMapName $ defaultServerList $ preferredServerLis= t $ authenticationMethod $ serviceSearchDescriptor $ serviceAuthenticatio= nMethod $ memberURL ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1 (distinguishedNameMat= ch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( = creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContex= ts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ = olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN = $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ olcRelay $ olcAccessLogDB $ me= mberOf $ olcMemberOfDN $ pwdPolicySubentry $ olcPPolicyDefault $ olcRefin= tNothing $ olcRefintModifiersName $ olcUniqueBase $ member $ owner $ role= Occupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRed= irect $ defaultSearchBase $ dgIdentity ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'o= bjectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ s= upportedFeatures $ supportedApplicationContext $ pwdAttribute ) ) lt-slapd startup: initiated. backend_startup_one: starting "cn=3Dconfig" config_back_db_open config_build_entry: "cn=3Dconfig" config_build_entry: "cn=3Dschema" config_build_entry: "cn=3D{0}core" config_build_entry: "cn=3D{1}cosine" config_build_entry: "cn=3D{2}corba" config_build_entry: "cn=3D{3}java" config_build_entry: "cn=3D{4}inetorgperson" config_build_entry: "cn=3D{5}misc" config_build_entry: "cn=3D{6}nis" config_build_entry: "cn=3D{7}openldap" config_build_entry: "cn=3D{8}duaconf" config_build_entry: "cn=3D{9}dyngroup" config_build_entry: "cn=3D{10}ppolicy" config_build_entry: "olcDatabase=3D{-1}frontend" config_build_entry: "olcDatabase=3D{0}config" config_build_entry: "olcDatabase=3D{1}bdb" config_build_entry: "olcDatabase=3D{2}monitor" backend_startup_one: starting "o=3DOpenLDAP Project,l=3DInternet" bdb_db_open: "o=3DOpenLDAP Project,l=3DInternet" bdb_db_open: warning - no DB_CONFIG file found in directory /home/michael= /src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests/testrun/db.1.a: (2). Expect poor performance for suffix "o=3DOpenLDAP Project,l=3DInternet". bdb_db_open: database "o=3DOpenLDAP Project,l=3DInternet": dbenv_open(/ho= me/michael/src/openldap/OPENLDAP_REL_ENG_2_4/openldap/tests/testrun/db.1.= a). backend_startup_one: starting "cn=3DMonitor" >>> dnNormalize: <cn=3DMonitor> <<< dnNormalize: <cn=3Dmonitor> >>> dnPretty: <cn=3DBackends> =3D> ldap_bv2dn(cn=3DBackends,0) <=3D ldap_bv2dn(cn=3DBackends)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DBackends)=3D0=20 <<< dnPretty: <cn=3DBackends> >>> dnNormalize: <cn=3DBackends> <<< dnNormalize: <cn=3Dbackends> >>> dnPretty: <cn=3DConnections> =3D> ldap_bv2dn(cn=3DConnections,0) <=3D ldap_bv2dn(cn=3DConnections)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DConnections)=3D0=20 <<< dnPretty: <cn=3DConnections> >>> dnNormalize: <cn=3DConnections> <<< dnNormalize: <cn=3Dconnections> >>> dnPretty: <cn=3DDatabases> =3D> ldap_bv2dn(cn=3DDatabases,0) <=3D ldap_bv2dn(cn=3DDatabases)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DDatabases)=3D0=20 <<< dnPretty: <cn=3DDatabases> >>> dnNormalize: <cn=3DDatabases> <<< dnNormalize: <cn=3Ddatabases> >>> dnPretty: <cn=3DListeners> =3D> ldap_bv2dn(cn=3DListeners,0) <=3D ldap_bv2dn(cn=3DListeners)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DListeners)=3D0=20 <<< dnPretty: <cn=3DListeners> >>> dnNormalize: <cn=3DListeners> <<< dnNormalize: <cn=3Dlisteners> >>> dnPretty: <cn=3DLog> =3D> ldap_bv2dn(cn=3DLog,0) <=3D ldap_bv2dn(cn=3DLog)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DLog)=3D0=20 <<< dnPretty: <cn=3DLog> >>> dnNormalize: <cn=3DLog> <<< dnNormalize: <cn=3Dlog> >>> dnPretty: <cn=3DOperations> =3D> ldap_bv2dn(cn=3DOperations,0) <=3D ldap_bv2dn(cn=3DOperations)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DOperations)=3D0=20 <<< dnPretty: <cn=3DOperations> >>> dnNormalize: <cn=3DOperations> <<< dnNormalize: <cn=3Doperations> >>> dnPretty: <cn=3DOverlays> =3D> ldap_bv2dn(cn=3DOverlays,0) <=3D ldap_bv2dn(cn=3DOverlays)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DOverlays)=3D0=20 <<< dnPretty: <cn=3DOverlays> >>> dnNormalize: <cn=3DOverlays> <<< dnNormalize: <cn=3Doverlays> >>> dnPretty: <cn=3DSASL> =3D> ldap_bv2dn(cn=3DSASL,0) <=3D ldap_bv2dn(cn=3DSASL)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DSASL)=3D0=20 <<< dnPretty: <cn=3DSASL> >>> dnNormalize: <cn=3DSASL> <<< dnNormalize: <cn=3Dsasl> >>> dnPretty: <cn=3DStatistics> =3D> ldap_bv2dn(cn=3DStatistics,0) <=3D ldap_bv2dn(cn=3DStatistics)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DStatistics)=3D0=20 <<< dnPretty: <cn=3DStatistics> >>> dnNormalize: <cn=3DStatistics> <<< dnNormalize: <cn=3Dstatistics> >>> dnPretty: <cn=3DThreads> =3D> ldap_bv2dn(cn=3DThreads,0) <=3D ldap_bv2dn(cn=3DThreads)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DThreads)=3D0=20 <<< dnPretty: <cn=3DThreads> >>> dnNormalize: <cn=3DThreads> <<< dnNormalize: <cn=3Dthreads> >>> dnPretty: <cn=3DTime> =3D> ldap_bv2dn(cn=3DTime,0) <=3D ldap_bv2dn(cn=3DTime)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DTime)=3D0=20 <<< dnPretty: <cn=3DTime> >>> dnNormalize: <cn=3DTime> <<< dnNormalize: <cn=3Dtime> >>> dnPretty: <cn=3DTLS> =3D> ldap_bv2dn(cn=3DTLS,0) <=3D ldap_bv2dn(cn=3DTLS)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DTLS)=3D0=20 <<< dnPretty: <cn=3DTLS> >>> dnNormalize: <cn=3DTLS> <<< dnNormalize: <cn=3Dtls> >>> dnPretty: <cn=3DWaiters> =3D> ldap_bv2dn(cn=3DWaiters,0) <=3D ldap_bv2dn(cn=3DWaiters)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3DWaiters)=3D0=20 <<< dnPretty: <cn=3DWaiters> >>> dnNormalize: <cn=3DWaiters> <<< dnNormalize: <cn=3Dwaiters> >>> dnNormalize: <cn=3DBackend 0> <<< dnNormalize: <cn=3Dbackend 0> >>> dnNormalize: <cn=3DDatabase 0,cn=3DDatabases,cn=3DMonitor> =3D> ldap_bv2dn(cn=3DDatabase 0,cn=3DDatabases,cn=3DMonitor,0) <=3D ldap_bv2dn(cn=3DDatabase 0,cn=3DDatabases,cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Ddatabase 0,cn=3Ddatabases,cn=3Dmonitor)=3D0=20 <<< dnNormalize: <cn=3Ddatabase 0,cn=3Ddatabases,cn=3Dmonitor> >>> dnNormalize: <cn=3DBackend 1> <<< dnNormalize: <cn=3Dbackend 1> >>> dnNormalize: <cn=3DBackend 2> <<< dnNormalize: <cn=3Dbackend 2> >>> dnNormalize: <cn=3DDatabase 2,cn=3DDatabases,cn=3DMonitor> =3D> ldap_bv2dn(cn=3DDatabase 2,cn=3DDatabases,cn=3DMonitor,0) <=3D ldap_bv2dn(cn=3DDatabase 2,cn=3DDatabases,cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Ddatabase 2,cn=3Ddatabases,cn=3Dmonitor)=3D0=20 <<< dnNormalize: <cn=3Ddatabase 2,cn=3Ddatabases,cn=3Dmonitor> >>> dnNormalize: <cn=3DBackend 3> <<< dnNormalize: <cn=3Dbackend 3> >>> dnNormalize: <cn=3DDatabase 1,cn=3DDatabases,cn=3DMonitor> =3D> ldap_bv2dn(cn=3DDatabase 1,cn=3DDatabases,cn=3DMonitor,0) <=3D ldap_bv2dn(cn=3DDatabase 1,cn=3DDatabases,cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Ddatabase 1,cn=3Ddatabases,cn=3Dmonitor)=3D0=20 <<< dnNormalize: <cn=3Ddatabase 1,cn=3Ddatabases,cn=3Dmonitor> >>> dnNormalize: <cn=3DBackend 4> <<< dnNormalize: <cn=3Dbackend 4> >>> dnNormalize: <cn=3DBackend 5> <<< dnNormalize: <cn=3Dbackend 5> >>> dnNormalize: <cn=3DBackend 6> <<< dnNormalize: <cn=3Dbackend 6> >>> dnNormalize: <cn=3DBackend 7> <<< dnNormalize: <cn=3Dbackend 7> >>> dnNormalize: <cn=3DBackend 8> <<< dnNormalize: <cn=3Dbackend 8> >>> dnNormalize: <cn=3DBackend 9> <<< dnNormalize: <cn=3Dbackend 9> >>> dnNormalize: <cn=3DBackend 10> <<< dnNormalize: <cn=3Dbackend 10> >>> dnNormalize: <cn=3DBackend 11> <<< dnNormalize: <cn=3Dbackend 11> >>> dnNormalize: <cn=3DBackend 12> <<< dnNormalize: <cn=3Dbackend 12> >>> dnNormalize: <cn=3DMax File Descriptors> <<< dnNormalize: <cn=3Dmax file descriptors> >>> dnNormalize: <cn=3DTotal> <<< dnNormalize: <cn=3Dtotal> >>> dnNormalize: <cn=3DCurrent> <<< dnNormalize: <cn=3Dcurrent> >>> dnNormalize: <cn=3DFrontend> <<< dnNormalize: <cn=3Dfrontend> >>> dnNormalize: <cn=3DDatabase 0> <<< dnNormalize: <cn=3Ddatabase 0> >>> dnNormalize: <cn=3DBackend 0,cn=3DBackends,cn=3DMonitor> =3D> ldap_bv2dn(cn=3DBackend 0,cn=3DBackends,cn=3DMonitor,0) <=3D ldap_bv2dn(cn=3DBackend 0,cn=3DBackends,cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Dbackend 0,cn=3Dbackends,cn=3Dmonitor)=3D0=20 <<< dnNormalize: <cn=3Dbackend 0,cn=3Dbackends,cn=3Dmonitor> >>> dnNormalize: <cn=3DDatabase 1> <<< dnNormalize: <cn=3Ddatabase 1> >>> dnNormalize: <cn=3DBackend 3,cn=3DBackends,cn=3DMonitor> =3D> ldap_bv2dn(cn=3DBackend 3,cn=3DBackends,cn=3DMonitor,0) <=3D ldap_bv2dn(cn=3DBackend 3,cn=3DBackends,cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Dbackend 3,cn=3Dbackends,cn=3Dmonitor)=3D0=20 <<< dnNormalize: <cn=3Dbackend 3,cn=3Dbackends,cn=3Dmonitor> >>> dnNormalize: <cn=3DDatabase 2> <<< dnNormalize: <cn=3Ddatabase 2> >>> dnNormalize: <cn=3DBackend 2,cn=3DBackends,cn=3DMonitor> =3D> ldap_bv2dn(cn=3DBackend 2,cn=3DBackends,cn=3DMonitor,0) <=3D ldap_bv2dn(cn=3DBackend 2,cn=3DBackends,cn=3DMonitor)=3D0=20 =3D> ldap_dn2bv(272) <=3D ldap_dn2bv(cn=3Dbackend 2,cn=3Dbackends,cn=3Dmonitor)=3D0=20 <<< dnNormalize: <cn=3Dbackend 2,cn=3Dbackends,cn=3Dmonitor> >>> dnNormalize: <cn=3DListener 0> <<< dnNormalize: <cn=3Dlistener 0> >>> dnNormalize: <cn=3DListener 1> <<< dnNormalize: <cn=3Dlistener 1> >>> dnNormalize: <cn=3DListener 2> <<< dnNormalize: <cn=3Dlistener 2> >>> dnNormalize: <cn=3DBind> <<< dnNormalize: <cn=3Dbind> >>> dnNormalize: <cn=3DUnbind> <<< dnNormalize: <cn=3Dunbind> >>> dnNormalize: <cn=3DSearch> <<< dnNormalize: <cn=3Dsearch> >>> dnNormalize: <cn=3DCompare> <<< dnNormalize: <cn=3Dcompare> >>> dnNormalize: <cn=3DModify> <<< dnNormalize: <cn=3Dmodify> >>> dnNormalize: <cn=3DModrdn> <<< dnNormalize: <cn=3Dmodrdn> >>> dnNormalize: <cn=3DAdd> <<< dnNormalize: <cn=3Dadd> >>> dnNormalize: <cn=3DDelete> <<< dnNormalize: <cn=3Ddelete> >>> dnNormalize: <cn=3DAbandon> <<< dnNormalize: <cn=3Dabandon> >>> dnNormalize: <cn=3DExtended> <<< dnNormalize: <cn=3Dextended> >>> dnNormalize: <cn=3DOverlay 0> <<< dnNormalize: <cn=3Doverlay 0> >>> dnNormalize: <cn=3DOverlay 1> <<< dnNormalize: <cn=3Doverlay 1> >>> dnNormalize: <cn=3DOverlay 2> <<< dnNormalize: <cn=3Doverlay 2> >>> dnNormalize: <cn=3DOverlay 3> <<< dnNormalize: <cn=3Doverlay 3> >>> dnNormalize: <cn=3DOverlay 4> <<< dnNormalize: <cn=3Doverlay 4> >>> dnNormalize: <cn=3DOverlay 5> <<< dnNormalize: <cn=3Doverlay 5> >>> dnNormalize: <cn=3DOverlay 6> <<< dnNormalize: <cn=3Doverlay 6> >>> dnNormalize: <cn=3DOverlay 7> <<< dnNormalize: <cn=3Doverlay 7> >>> dnNormalize: <cn=3DOverlay 8> <<< dnNormalize: <cn=3Doverlay 8> >>> dnNormalize: <cn=3DOverlay 9> <<< dnNormalize: <cn=3Doverlay 9> >>> dnNormalize: <cn=3DOverlay 10> <<< dnNormalize: <cn=3Doverlay 10> >>> dnNormalize: <cn=3DOverlay 11> <<< dnNormalize: <cn=3Doverlay 11> >>> dnNormalize: <cn=3DOverlay 12> <<< dnNormalize: <cn=3Doverlay 12> >>> dnNormalize: <cn=3DOverlay 13> <<< dnNormalize: <cn=3Doverlay 13> >>> dnNormalize: <cn=3DOverlay 14> <<< dnNormalize: <cn=3Doverlay 14> >>> dnNormalize: <cn=3DOverlay 15> <<< dnNormalize: <cn=3Doverlay 15> >>> dnNormalize: <cn=3DOverlay 16> <<< dnNormalize: <cn=3Doverlay 16> >>> dnNormalize: <cn=3DOverlay 17> <<< dnNormalize: <cn=3Doverlay 17> >>> dnNormalize: <cn=3DOverlay 18> <<< dnNormalize: <cn=3Doverlay 18> >>> dnNormalize: <cn=3DOverlay 19> <<< dnNormalize: <cn=3Doverlay 19> >>> dnNormalize: <cn=3DBytes> <<< dnNormalize: <cn=3Dbytes> >>> dnNormalize: <cn=3DPDU> <<< dnNormalize: <cn=3Dpdu> >>> dnNormalize: <cn=3DEntries> <<< dnNormalize: <cn=3Dentries> >>> dnNormalize: <cn=3DReferrals> <<< dnNormalize: <cn=3Dreferrals> >>> dnNormalize: <cn=3DMax> <<< dnNormalize: <cn=3Dmax> >>> dnNormalize: <cn=3DMax Pending> <<< dnNormalize: <cn=3Dmax pending> >>> dnNormalize: <cn=3DOpen> <<< dnNormalize: <cn=3Dopen> >>> dnNormalize: <cn=3DStarting> <<< dnNormalize: <cn=3Dstarting> >>> dnNormalize: <cn=3DActive> <<< dnNormalize: <cn=3Dactive> >>> dnNormalize: <cn=3DPending> <<< dnNormalize: <cn=3Dpending> >>> dnNormalize: <cn=3DBackload> <<< dnNormalize: <cn=3Dbackload> >>> dnNormalize: <cn=3DState> <<< dnNormalize: <cn=3Dstate> >>> dnNormalize: <cn=3DRunqueue> <<< dnNormalize: <cn=3Drunqueue> >>> dnNormalize: <cn=3DTasklist> <<< dnNormalize: <cn=3Dtasklist> >>> dnNormalize: <cn=3DStart> <<< dnNormalize: <cn=3Dstart> >>> dnNormalize: <cn=3DCurrent> <<< dnNormalize: <cn=3Dcurrent> >>> dnNormalize: <cn=3DUptime> <<< dnNormalize: <cn=3Duptime> >>> dnNormalize: <cn=3DRead> <<< dnNormalize: <cn=3Dread> >>> dnNormalize: <cn=3DWrite> <<< dnNormalize: <cn=3Dwrite> slapd starting daemon: listen(ldap://localhost:9011/, 5) failed errno=3D98 (Address alre= ady in use) lt-slapd shutdown: initiated =3D=3D=3D=3D> bdb_cache_release_all lt-slapd destroy: freeing system resources. slapd stopped. --------------000504090501070603080100--

1 0

Re: (ITS#5639) Digital (PGP-)signature for downloadable sources
by michael＠stroeder.com 05 Aug '08

05 Aug '08

Kurt Zeilenga wrote: >> Hashes have to be validated out-of-band each time a new release is >> published. The trusted keys be have to be validated out-of-band only >> each time a new trust anchor key is generated. > > The point here that an attacker can create the same level of trust for > any new signing key they might use (or trust in that no signing was > done) for the rouge release as the trust tends to be just publication of > the signing key on the web site. Creating signing keys happens less frequently and keys can also be digitally signed by others. So it's not the same level of trust if done right. > And, as I noted, an attacker could just change stable from 2.m.y to > 2.n.x, where 2.n.x was some crackable release. This is another question anyway. It's not a matter of hash vs. digital signature of the released tar.gz since "stable" is additional meta-information on the web site. Publishing this meta-information in a trusted way would certainly also desirable. (And for related reasons I still consider my request in ITS#4787 to be valid.) > What about a purely self-signed signing key with finger print published > on the website, and possible release announcements. I'm fine with that. > (The latter arguable would be better, as it's more widely published.) > [This appears to be the appraoch you've taken with web2ldap.] And I'm open to get my key cross-signed. > But, as I've noted, this really doesn't offer significant better > security than widely published hashes. Once you trusted this signing key you will notice if the key changes. > However, if what you want is a signing key in which members of the > public can personally verify is in the control of the project, that > would be more difficult to provide. Yes. Again, I'm fine with a pragmatic approach. > Or, if what you want is a signing key which is in a wide web of trust, > the difficultly depends on the scale of the web of trust desired (to the > point of approaching the general public problem). You could start with signing and try to spread the signing key and additionally get it signed by others. BTW: I'm not limited to PGP in this regard. Ciao, Michael.

1 0

Re: (ITS#5634) str2entry NULL (smr_normalize reqControls 21) when slapadding accesslog-DB with reqControls
by michael＠stroeder.com 05 Aug '08

05 Aug '08

Pierangelo Masarati wrote: > ----- michael(a)stroeder.com wrote: > >> ando(a)sys-net.it wrote: >>> Should be fixed now, please test. p. >> Thanks. >> >> Unfortunately I can't test HEAD because of ITS#5644. > > Well, that seems to happen at shutdown, so you should be able to test this specific issue :) It seems to work. Ciao, Michael.

1 0

Re: (ITS#5644) make test000 core dumps
by ando＠sys-net.it 05 Aug '08

05 Aug '08

----- "Michael Ströder" <michael(a)stroeder.com> wrote: > Pierangelo Masarati wrote: > > Are you sure you're loading the sasl mechs you've compiled for? > That's a typical issue with SASL (see SASL_PATH, in case). > > > >> #2 0x405df014 in ?? () from /usr/lib/libldap-2.4.so.2 > > Hmm, it seems the problem is rather that the LDAP client libs from the > > RPM package installed by openSUSE are loaded instead the ones from the > > build directory. That's bad. Any way around this when running 'make > test'? LD_LIBRARY_PATH to your just built libs? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5644) make test000 core dumps
by michael＠stroeder.com 05 Aug '08

05 Aug '08

Pierangelo Masarati wrote: > Are you sure you're loading the sasl mechs you've compiled for? That's a typical issue with SASL (see SASL_PATH, in case). > >> #2 0x405df014 in ?? () from /usr/lib/libldap-2.4.so.2 Hmm, it seems the problem is rather that the LDAP client libs from the RPM package installed by openSUSE are loaded instead the ones from the build directory. That's bad. Any way around this when running 'make test'? Ciao, Michael.

1 0

Re: (ITS#5634) str2entry NULL (smr_normalize reqControls 21) when slapadding accesslog-DB with reqControls
by ando＠sys-net.it 05 Aug '08

05 Aug '08

----- michael(a)stroeder.com wrote: > ando(a)sys-net.it wrote: > > Should be fixed now, please test. p. > > Thanks. > > Unfortunately I can't test HEAD because of ITS#5644. Well, that seems to happen at shutdown, so you should be able to test this specific issue :) p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5644) make test000 core dumps
by ando＠sys-net.it 05 Aug '08

05 Aug '08

Are you sure you're loading the sasl mechs you've compiled for? That's a typical issue with SASL (see SASL_PATH, in case). p. ----- michael(a)stroeder.com wrote: > Full_Name: Michael Str�der > Version: HEAD > OS: openSUSE Linux 11.0 > URL: > Submission from: (NULL) (84.163.95.185) > > > (gdb) bt full > #0 0x40462915 in free () from /lib/libc.so.6 > No symbol table info available. > #1 0x40074ccd in ber_memfree_x (p=0x7fffffff, ctx=0x0) at > memory.c:152 > __PRETTY_FUNCTION__ = "ber_memfree_x" > #2 0x405df014 in ?? () from /usr/lib/libldap-2.4.so.2 > No symbol table info available. > #3 0x405c1578 in ?? () from /usr/lib/libldap-2.4.so.2 > No symbol table info available. > #4 0x405ee930 in _fini () from /usr/lib/libldap-2.4.so.2 > No symbol table info available. > #5 0x40012ebf in ?? () from /lib/ld-linux.so.2 > No symbol table info available. > #6 0x40013817 in ?? () from /lib/ld-linux.so.2 > No symbol table info available. > #7 0x40254cb4 in ?? () from /lib/libdl.so.2 > No symbol table info available. > #8 0x4000de26 in ?? () from /lib/ld-linux.so.2 > No symbol table info available. > #9 0x402550dc in ?? () from /lib/libdl.so.2 > No symbol table info available. > #10 0x40254cea in dlclose () from /lib/libdl.so.2 > No symbol table info available. > #11 0x4024d3a1 in _sasl_done_with_plugins () from > /usr/lib/libsasl2.so.2 > No symbol table info available. > #12 0x40245c20 in sasl_done () from /usr/lib/libsasl2.so.2 > No symbol table info available. > #13 0x080cc1e4 in slap_sasl_destroy () at sasl.c:1156 > No locals. > #14 0x080a48c9 in slap_destroy () at init.c:255 > rc = 0 > #15 0x08050cfb in main (argc=8, argv=0xbfbe2184) at main.c:965 > i = 8 > no_detach = 1 > rc = 0 > urls = 0x82d2050 "ldap://localhost:9011/" > username = 0x0 > groupname = 0x0 > sandbox = 0x0 > syslogUser = 160 > g_argc = 8 > g_argv = (char **) 0xbfbe2184 > configfile = 0x82d2008 > "/home/michael/src/openldap/HEAD/openldap/tests/testrun/slapd.1.conf" > configdir = 0x0 > serverName = 0xbfbe4079 "lt-slapd" > serverMode = 1 > scp = (struct sync_cookie *) 0x0 > scp_entry = (struct sync_cookie *) 0x0 > debug_unknowns = (char **) 0x0 > syslog_unknowns = (char **) 0x0 > serverNamePrefix = 0x81f146b "" > l = 2097734 > slapd_pid_file_unlink = 1 > ---Type <return> to continue, or q <return> to quit--- > slapd_args_file_unlink = 1 > firstopt = 0 > __PRETTY_FUNCTION__ = "main" Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5634) str2entry NULL (smr_normalize reqControls 21) when slapadding accesslog-DB with reqControls
by michael＠stroeder.com 05 Aug '08

05 Aug '08

ando(a)sys-net.it wrote: > Should be fixed now, please test. p. Thanks. Unfortunately I can't test HEAD because of ITS#5644. Ciao, Michael.

1 0

(ITS#5644) make test000 core dumps
by michael＠stroeder.com 05 Aug '08

05 Aug '08

Full_Name: Michael Ströder Version: HEAD OS: openSUSE Linux 11.0 URL: Submission from: (NULL) (84.163.95.185) (gdb) bt full #0 0x40462915 in free () from /lib/libc.so.6 No symbol table info available. #1 0x40074ccd in ber_memfree_x (p=0x7fffffff, ctx=0x0) at memory.c:152 __PRETTY_FUNCTION__ = "ber_memfree_x" #2 0x405df014 in ?? () from /usr/lib/libldap-2.4.so.2 No symbol table info available. #3 0x405c1578 in ?? () from /usr/lib/libldap-2.4.so.2 No symbol table info available. #4 0x405ee930 in _fini () from /usr/lib/libldap-2.4.so.2 No symbol table info available. #5 0x40012ebf in ?? () from /lib/ld-linux.so.2 No symbol table info available. #6 0x40013817 in ?? () from /lib/ld-linux.so.2 No symbol table info available. #7 0x40254cb4 in ?? () from /lib/libdl.so.2 No symbol table info available. #8 0x4000de26 in ?? () from /lib/ld-linux.so.2 No symbol table info available. #9 0x402550dc in ?? () from /lib/libdl.so.2 No symbol table info available. #10 0x40254cea in dlclose () from /lib/libdl.so.2 No symbol table info available. #11 0x4024d3a1 in _sasl_done_with_plugins () from /usr/lib/libsasl2.so.2 No symbol table info available. #12 0x40245c20 in sasl_done () from /usr/lib/libsasl2.so.2 No symbol table info available. #13 0x080cc1e4 in slap_sasl_destroy () at sasl.c:1156 No locals. #14 0x080a48c9 in slap_destroy () at init.c:255 rc = 0 #15 0x08050cfb in main (argc=8, argv=0xbfbe2184) at main.c:965 i = 8 no_detach = 1 rc = 0 urls = 0x82d2050 "ldap://localhost:9011/" username = 0x0 groupname = 0x0 sandbox = 0x0 syslogUser = 160 g_argc = 8 g_argv = (char **) 0xbfbe2184 configfile = 0x82d2008 "/home/michael/src/openldap/HEAD/openldap/tests/testrun/slapd.1.conf" configdir = 0x0 serverName = 0xbfbe4079 "lt-slapd" serverMode = 1 scp = (struct sync_cookie *) 0x0 scp_entry = (struct sync_cookie *) 0x0 debug_unknowns = (char **) 0x0 syslog_unknowns = (char **) 0x0 serverNamePrefix = 0x81f146b "" l = 2097734 slapd_pid_file_unlink = 1 ---Type <return> to continue, or q <return> to quit--- slapd_args_file_unlink = 1 firstopt = 0 __PRETTY_FUNCTION__ = "main"

1 0

Re: (ITS#5639) Digital (PGP-)signature for downloadable sources
by h.b.furuseth＠usit.uio.no 04 Aug '08

04 Aug '08

Kurt(a)OpenLDAP.org writes: >On Aug 4, 2008, at 2:06 PM, h.b.furuseth(a)usit.uio.no wrote: >> Kurt(a)OpenLDAP.org writes: >>> I note as well that properly deploying release signing requires >>> more than script modification. For instance, one does need to >>> consider that the host to sign the releases might itself been >>> taken over and the implications of such a takeover. >> >> For that part, signatures in the 'https:' site would help. > > I think you need to re-think that assertion. Er, yes, I was thinking of the "outside" equivalent, hacking DNS and "taking over" that way. I have the impression that's the most common way to "take over" a site, but I may be wrong. -- Hallvard

1 0

Re: (ITS#5639) Digital (PGP-)signature for downloadable sources
by Kurt＠OpenLDAP.org 04 Aug '08

04 Aug '08

On Aug 4, 2008, at 3:23 PM, michael(a)stroeder.com wrote: > Kurt Zeilenga wrote: >> For instance, web_ldap says it provides a signature for a digital >> release, but clicking on the link provides a page which says "Not >> found". > > I knew this (transition during a major OS update on my local machine). > It's fixed. My point was not wether you knew it or not, but whether any verifier would care. > >> But, as I noted with hashes, the fact that release messages are >> widely >> published may make it more likely that such problems will be >> detected. > > Hashes have to be validated out-of-band each time a new release is > published. The trusted keys be have to be validated out-of-band only > each time a new trust anchor key is generated. The point here that an attacker can create the same level of trust for any new signing key they might use (or trust in that no signing was done) for the rouge release as the trust tends to be just publication of the signing key on the web site. And, as I noted, an attacker could just change stable from 2.m.y to 2.n.x, where 2.n.x was some crackable release. Personally, I place a less trust on a signing key I fetch off a website than a hash I get both by email, on a moderated list, that I can verify in the list archives, and on the FTP site. The former is actually seems more subject to MITM attack than the latter. Now, with https:, I would say they have fairly comparable security considerations. Basically, if an attacker owns the website/ftp host, the attacker can fool most everyone. > >> For instance, one does need to consider that >> the host to sign the releases might itself been taken over and the >> implications of such a takeover. > > There is no 100% security. I already know this. But raising security > level is always an desirable goal. You haven't clearly stated how the security level is actually getting raised through the signing you suggest. > >> Anyways, for this to go anywhere, I think you or others advocating it >> need to more precisely state which attacks you concerned about, how >> you >> think digital signatures will help, and detail requirements on that >> signing (in particular, requirements on signing key so trust can be >> established and maintained). > > I have no objections against a single release manager using his > personal > key or a dedicated key for OpenLDAP tar.gz signing stored in your > local > file system reasonably protected by a passphrase. As I see it > you're the > only one packaging the tar.gz. So this should not be too difficult for > you. What about a purely self-signed signing key with finger print published on the website, and possible release announcements. (The latter arguable would be better, as it's more widely published.) [This appears to be the appraoch you've taken with web2ldap.] But, as I've noted, this really doesn't offer significant better security than widely published hashes. However, if what you want is a signing key in which members of the public can personally verify is in the control of the project, that would be more difficult to provide. Or, if what you want is a signing key which is in a wide web of trust, the difficultly depends on the scale of the web of trust desired (to the point of approaching the general public problem). > Well, if you don't want to do that then just leave it... > >> Note that these are human-factor attacks, not attacks based upon any >> weakness in the PGP signing standards or implementations. > > I already know that. This comment was for the peanut gallery. -- Kurt

1 0

Re: (ITS#5639) Digital (PGP-)signature for downloadable sources
by Kurt＠OpenLDAP.org 04 Aug '08

04 Aug '08

On Aug 4, 2008, at 2:06 PM, h.b.furuseth(a)usit.uio.no wrote: > Kurt(a)OpenLDAP.org writes: >> I note as well that properly deploying release signing requires >> more than script modification. For instance, one does need to >> consider that the host to sign the releases might itself been >> taken over and the implications of such a takeover. > > For that part, signatures in the 'https:' site would help. I think you need to re-think that assertion. > Not that I'm making an issue of it, I've got OpenLDAP installations > that I didn't verify against any signature right on this host. > > -- > Hallvard > >

1 0

Re: (ITS#5634) str2entry NULL (smr_normalize reqControls 21) when slapadding accesslog-DB with reqControls
by ando＠sys-net.it 04 Aug '08

04 Aug '08

Should be fixed now, please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5624) overlay rwm causes assertion
by ando＠sys-net.it 04 Aug '08

04 Aug '08

This should be now fixed in HEAD; please test. Sorry for the late commit. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5643) Back-relay subordinate issue
by ando＠sys-net.it 04 Aug '08

04 Aug '08

Full_Name: Pierangelo Masarati Version: HEAD,re24,re23 OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (82.231.225.242) Submitted by: ando Back-relay wants to find the relayed database while parsing the "relay" directive; however, if back-relay is instantiated as subordinate, the relayed database might not exist yet, or it might just not show up because subordinated as well. The issue can be worked around by not defining a relay directive. However, a simple fix appears to consist in deferring relayed database lookup. p.

1 0

Re: (ITS#5634) str2entry NULL (smr_normalize reqControls 21) when slapadding accesslog-DB with reqControls
by ando＠sys-net.it 04 Aug '08

04 Aug '08

----- michael(a)stroeder.com wrote: > Full_Name: Michael Str�der > Version: RE24 > OS: Linux > URL: > Submission from: (NULL) (84.163.81.95) > > > I tried to restore an accesslog > > reqControls: {0}{2.16.840.1.113730.3.4.2} > > <= str2entry NULL (smr_normalize reqControls 21) > slapadd: could not parse entry (line=6) I have a fix, but can't commit right now; I'll try later. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5642) Double free on exit, when specific attributetype is defined
by stef＠memberwebs.com 04 Aug '08

04 Aug '08

Full_Name: Stef Walter Version: 2.4.11 OS: FreeBSD 6.3-RELEASE-p2 URL: Submission from: (NULL) (38.99.5.20) When the following line is present in the schema (or slapd.conf), then upon exit any slap* process aborts due to a double free of memory: attributetype ( 278.1.3.6.1 NAME 'requireClass' SUP objectClass ) The OID is obviously fictional. This can be triggered reliably by running: # slaptest

1 0

Re: (ITS#5639) Digital (PGP-)signature for downloadable sources
by michael＠stroeder.com 04 Aug '08

04 Aug '08

Kurt Zeilenga wrote: > For instance, web_ldap says it provides a signature for a digital > release, but clicking on the link provides a page which says "Not > found". I knew this (transition during a major OS update on my local machine). It's fixed. > But, as I noted with hashes, the fact that release messages are widely > published may make it more likely that such problems will be detected. Hashes have to be validated out-of-band each time a new release is published. The trusted keys be have to be validated out-of-band only each time a new trust anchor key is generated. > For instance, one does need to consider that > the host to sign the releases might itself been taken over and the > implications of such a takeover. There is no 100% security. I already know this. But raising security level is always an desirable goal. > Anyways, for this to go anywhere, I think you or others advocating it > need to more precisely state which attacks you concerned about, how you > think digital signatures will help, and detail requirements on that > signing (in particular, requirements on signing key so trust can be > established and maintained). I have no objections against a single release manager using his personal key or a dedicated key for OpenLDAP tar.gz signing stored in your local file system reasonably protected by a passphrase. As I see it you're the only one packaging the tar.gz. So this should not be too difficult for you. Well, if you don't want to do that then just leave it... > Note that these are human-factor attacks, not attacks based upon any > weakness in the PGP signing standards or implementations. I already know that. Ciao, Michael.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs