- openldap-bugs - openldap.org

(ITS#5293) ldapdelete issue
by chitrav＠us.ibm.com 20 Dec '07

20 Dec '07

Full_Name: Chitra Venkatramani Version: 2.3.27 OS: Redhat URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (162.83.178.28) I added a set of entries to the LDAP server, with sub directories, such as -- dn: cn=aa,ou=chitrav,o=ibm.com dn: ou=bb,ou=chitrav,o=ibm.com dn: cn=bb1,ou=bb,ou=chitrav,o=ibm.com dn: ou=cc,ou=bb,ou=chitrav,o=ibm.com dn: cn=cc1,ou=cc,ou=bb,ou=chitrav,o=ibm.com when I tried to do an ldapdelete command with -r option, I get the following error for every entry in the server, although all the entries do get deleted. ldap_search: Server is unwilling to perform (53) additional info: critical control unavailable in context On looking at the ldapdelete.c source code, lines 390 and 391 say c.ldctl_oid = LDAP_CONTROL_SUBENTRIES; c.ldctl_iscritical = 1; Marking the iscritical flag to 0, makes the error go away. I am not sure what this control does. This seems like a bug though. If so, please let me know what the fix should be, and in which release it will be available. Please let me know if you need any more information. thanks -Chitra

1 0

(ITS#3429) schema download module
by raphael.ouazana＠linagora.com 20 Dec '07

20 Dec '07

Hi, Le Sam 15 décembre 2007 04:31, hyc(a)symas.com a écrit : > I was looking at this code in relation to current HEAD/RE24, and things have > changed quite a bit. Given the ability to dynamically load schema into cn=config, is there still a need for this module? (It is in fact the changes > made for dynamic schema manipulation in slapd that causes the > compatibility > issues with this module.) I don't use this module anymore. Dynamic schema loading would be useful to replace it by allowing replication of schema. In fact I see only a case where the module is still useful: when I want to get automatically the schema of some directory which is not very respectful of LDAP standards, for example by providing attributes without OID. Regards, Raphaël Ouazana.

1 0

(ITS#5292) Test047 requires "rwm"
by daveh＠coreng.com.au 19 Dec '07

19 Dec '07

Full_Name: Dave Horsfall Version: 2.4.7 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (192.65.182.30) When running "make test", test047 fails because "rwm" is assumed to be configured. It works fine if I configure it in before compiling.

1 0

(ITS#5291) Client timeout dumps core
by daveh＠coreng.com.au 19 Dec '07

19 Dec '07

Full_Name: Dave Horsfall Version: 2.4.7 OS: FreeBSD 4.10-STABLE URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (192.65.182.30) On setting the general client timeout with LDAP_OPT_TIMEOUT and performing a search on a simulated hung server ("nc -l 389"), I get a coredump: assertion "r != NULL" failed: file "error.c", line 272 GDB: (gdb) bt #0 0x28136748 in kill () from /usr/lib/libc.so.4 #1 0x2817803e in abort () from /usr/lib/libc.so.4 #2 0x28154033 in __assert () from /usr/lib/libc.so.4 #3 0x280bf519 in ldap_parse_result (ld=0x8050000, r=0x0, errcodep=0xbfbfdb2c, matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0) at error.c:272 #4 0x280bf455 in ldap_result2error (ld=0x8050000, r=0x0, freeit=0) at error.c:222 #5 0x280c016d in ldap_search_s (ld=0x8050000, base=0x0, scope=2, filter=0xbfbff450 "(uid=daveh)", attrs=0xbfbfdbd8, attrsonly=0, res=0xbfbfdbe0) at search.c:392 #6 0x8049e9b in main (argc=0, argv=0xbfbff8b8) at lget.c:662

1 0

Re: (ITS#5290) -E option missing from ldapsearch man page
by hyc＠symas.com 19 Dec '07

19 Dec '07

thm(a)duke.edu wrote: > Full_Name: Hunter Matthews > Version: ldapsearch 2.3.27 > OS: Centos-5 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (152.3.12.219) > > > ldapsearch -h > shows all (I assume) the options I can use. > > But the man page is missing -E at least. The -E option was added in a later release. The current 2.3 release is 2.3.39; you're far out of date. This ITS will be closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5290) -E option missing from ldapsearch man page
by thm＠duke.edu 19 Dec '07

19 Dec '07

Full_Name: Hunter Matthews Version: ldapsearch 2.3.27 OS: Centos-5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (152.3.12.219) ldapsearch -h shows all (I assume) the options I can use. But the man page is missing -E at least.

1 0

Re: (ITS#5289) test028 failed
by hyc＠symas.com 18 Dec '07

18 Dec '07

dieter(a)dkluenter.de wrote: > Full_Name: Dieter Kluenter > Version: HEAD > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (84.142.223.222) > test 028 fails with segmentation fault All tests pass for me. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5289) test028 failed
by dieter＠dkluenter.de 18 Dec '07

18 Dec '07

Full_Name: Dieter Kluenter Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.142.223.222) test 028 fails with segmentation fault gdb output Reading symbols from /work/ldap-src/servers/slapd/back-ldap/.libs/back_ldap-2-devel.so.0...done. Loaded symbols for ../servers/slapd/back-ldap/.libs/back_ldap-2-devel.so.0 Reading symbols from /work/ldap-src/servers/slapd/overlays/.libs/rwm-2-devel.so.0...done. Loaded symbols for ../servers/slapd/overlays/.libs/rwm-2-devel.so.0 Core was generated by `/work/ldap-src/servers/slapd/.libs/lt-slapd -Ta -d 0 -f /work/ldap-src/tests/te'. Program terminated with signal 11, Segmentation fault. #0 0xb78926d4 in rwm_cf_gen (c=0xbff812dc) at rwm.c:1771 1771 (struct ldaprwmap *)on->on_bi.bi_private; (gdb) bt #0 0xb78926d4 in rwm_cf_gen (c=0xbff812dc) at rwm.c:1771 #1 0x0806eb67 in config_set_vals (Conf=0xb789a228, c=0xbff812dc) at config.c:314 #2 0x0806f049 in config_add_vals (Conf=0xb789a228, c=0xbff812dc) at config.c:383 #3 0x080f05be in over_db_config (be=0x8275840, fname=0x822e008 "/work/ldap-src/tests/testrun/slapadd.conf", lineno=98, argc=2, argv=0x8255648) at backover.c:151 #4 0x0807035f in read_config_file (fname=0x822e008 "/work/ldap-src/tests/testrun/slapadd.conf", depth=0, cf=0x0, cft=0x81c88a0) at config.c:792 #5 0x080667c4 in read_config (fname=0x822e008 "/work/ldap-src/tests/testrun/slapadd.conf", dir=0x0) at bconfig.c:3455 #6 0x080f5d18 in slap_tool_init (progname=0x818a920 "slapadd", tool=1, argc=10, argv=0xbff8ac74) at slapcommon.c:523 #7 0x080f3acc in slapadd (argc=10, argv=0xbff8ac74) at slapadd.c:73 #8 0x0805d013 in main (argc=10, argv=0xbff8ac74) at main.c:645 (gdb) (gdb) down 0xb78926d4 #8 0x0805d013 in main (argc=10, argv=0xbff8ac74) at main.c:645 645 rc = tools[i].func( argc, argv ); (gdb) down 0x0806eb67 #0 0xb78926d4 in rwm_cf_gen (c=0xbff812dc) at rwm.c:1771 1771 (struct ldaprwmap *)on->on_bi.bi_private; (gdb) -Dieter

1 0

(ITS#5288) DB_CONFIG.example URL wrong in comments
by ghenry＠OpenLDAP.org 18 Dec '07

18 Dec '07

Full_Name: Gavin Henry Version: All OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.159.59.85) Submitted by: ghenry Should be: http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_co… Correcting.

1 0

Re: (ITS#5287) lanman hashes break compiling with GnuTLS
by hyc＠symas.com 17 Dec '07

17 Dec '07

quanah(a)zimbra.com wrote: > <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=245341> > > has a patch for compiling against gcrypt, don't know it it needs work. That's all well and good, but we can't incorporate 3rd party code unless the author specifically grants us permission, with the same IPR declarations as any other submission. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5287) lanman hashes break compiling with GnuTLS
by quanah＠zimbra.com 17 Dec '07

17 Dec '07

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=245341> has a patch for compiling against gcrypt, don't know it it needs work. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#5287) lanman hashes break compiling with GnuTLS
by quanah＠zimbra.com 17 Dec '07

17 Dec '07

Full_Name: Quanah Gibson-Mount Version: 2.4.7 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.92.25.194) If one enables lanman hashes while building OpenLDAP, and using GnuTLS instead of OpenSSL, the build will fail as the lanman code has OpenSSL specific assumptions. --Quanah

1 0

(ITS#5286) NULL value in sets
by raphael.ouazana＠linagora.com 17 Dec '07

17 Dec '07

Full_Name: Raphael Ouazana Version: HEAD, RE24, RE23 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (164.2.255.244) Hi, I repost this here as I think the discussion was lost in a closed ITS (#4860). The two solutions (other operation or previous behavior) would be fine for us, but I have not really time to make a patch for the moment. Le Sam 10 novembre 2007 16:37, ando(a)sys-net.it a .crit : >> Below I represent sets in {element1, element2} notation, to describe the >> current behaviour (in HEAD) for slap_set_join on the '+' operation: >> - {"One", "Two"} + {"Three", "Four"} ==> {"OneThree", "OneFour", >> "TwoThree", "TwoFour"} >> - {"One", "Two"} + {""} ==> {"One", "Two"} >> - {"One", "Two"} + {NULL} ==> {"One", "Two"} > > Although sets lack a specification, I think this behavior is desirable > in many cases: adding NULL is equivalent to adding EMPTY (""). The problem is that {NULL} is equivalent to NULL, ie the empty set. >> Consider the following set: >> set="[ldap:///] + [ldap:///<searchbase>??<scope>?<filter1>] + >> [??<scope>?<filter2>]" >> >> Assuming [ldap:///<searchbase>??<scope>?<filter1>] returns a DN, this >> works. However, if [ldap:///<searchbase>??<scope>?<filter1>] returns no >> entries, this value is NULL. Therefore, the rest of the set becomes: >> "[ldap:///] + {NULL} + [??<scope>?<filter2>]" >> ...which is handed to the '+' operation in slap_set_join, to become: >> [ldap:///??<scope>?<filter2>] >> ...which obviously isn't valid. > > Well, it is valid: it's an URI with an EMPTY DN. In terms of LDAP, yes, but it can cause security issues here, as the EMPTY DN is at a higher level that any one which would have been returned by a normal result. >> The attached patch changes the last case of the current behaviour for >> slap_set_join on the '+' operation. This was already the behaviour >> before version 1.24.2.6 Thu Sep 13 20:43:29 2007 UTC: >> - {"One", "Two"} + {NULL} ==> {NULL} > > This is different from the above behavior, although it makes sense on > its own. Probably we need two different addition operators: one > inclusive (NULL is equivalent to "") and one exclusive (NULL nullifies > the concatenation). > > Comments? No problem in having the two operators. I just think the normal behavior is to return NULL, has in term of sets the cartesian product A x NULL returns NULL, not A. Regards, Raphael Ouazana.

1 0

Re: (ITS#5274) add search to online docs
by h.b.furuseth＠usit.uio.no 16 Dec '07

16 Dec '07

kurt(a)OpenLDAP.org writes: > Right, not everyone knows how to make the fullest of the tools > available to them, or even know what tools are available to them. I > don't see providing yet another tool as a solution to these problems. I thought I was suggesting (an interface to) an existing tool - and teaching a way to use that as an added bonus. A matter of semantics I guess. -- Regards, Hallvard

1 0

Re: (ITS#5274) add search to online docs
by kurt＠OpenLDAP.org 16 Dec '07

16 Dec '07

On Dec 13, 2007, at 4:47 AM, Hallvard B Furuseth wrote: > kurt(a)OpenLDAP.org writes: >> There are lots of existing ways of searching an admin guide. >> >> First, most web search engines can be told to localize their search >> to >> a set of pages. For instance: >> http://www.google.com/search?q=site:www.openldap.org/doc/ >> admin24+rwm > > Not everyone knows how to do that. Right, not everyone knows how to make the fullest of the tools available to them, or even know what tools are available to them. I don't see providing yet another tool as a solution to these problems. -- Kurt

1 0

Re: (ITS#5285) password policy checks userPassword hash even without policies
by hyc＠symas.com 15 Dec '07

15 Dec '07

mbackes(a)symas.com wrote: > Full_Name: Matthew Backes > Version: 2.3, 2.4, head, etc > OS: all > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (67.115.65.234) > > > When receiving a new userPassword, slapo-ppolicy checks to see if that password > matches the hash already present in userPassword, and disallows it if this is > the case. > > This is a sensible default for most circumstances, as otherwise the user could > reset their age counters by using the same password. > > Unfortunately, it also blocks arguably-legitimate password changes; e.g. when > migration to SSHA from CRYPT where the first 8 chars of the new password match > the old. > > This patch changes this userPassword-has-changed check to only apply if there is > a password policy defined which requires it; in particular, any of pwdInHistory, > pwdMinAge, pwdMaxAge, pwdCheckQuality, or pwdMustChange must apply for this > check to be enforced. Rereading draft-behera, it says 5.2.4 pwdInHistory This attribute specifies the maximum number of used passwords stored in the pwdHistory attribute. If this attribute is not present, or if the value is 0, used passwords are not stored in the pwdHistory attribute and thus may be reused. As such the test can be simplified. Committing to HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#5145 Automatic groups overlay
by hyc＠symas.com 15 Dec '07

15 Dec '07

I did some minor cleanup and committed this. I think there may be other changes that could be made, to take advantage of sorted values and so cut down on the overhead of managing groups with large numbers of members. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: ITS#3515 ACLs enhancements
by ando＠sys-net.it 15 Dec '07

15 Dec '07

hyc(a)symas.com wrote: > This looks mostly like ACI to me, with some special inheritance rules. Is it > still relevant? AFAIR that was a custom ACL checking development that I found interesting from a technical point of view but (I might be wrong) of limited usefulness outside the scope it was developed for. In the meanwhile, and probably triggered by that posting, I added several ways of customizing access checking: via overlays, using dynacl (that was added earlier, for the purpose of isolating ACIs, but it could have served the same purpose). In this sense, I don't think this contribution can be of any use right now; it coulr be turned into a dynacl for custom use by the posters, or by anyone who find it useful. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: ITS#4987 slapo-constraint improvement
by hyc＠symas.com 14 Dec '07

14 Dec '07

hyc(a)symas.com wrote: > In reviewing the patch, I see several small details that need to be fixed. > E.g., you added a config keyword but re-used an existing OID for your new > attribute. OIDs must never be re-used, and certainly you must not use two > different attributes with the same OID. Oh never mind, I see the confusion. You're just defining a new 2nd argument to the existing keyword. > You use strlen/strncat, which are heavily discouraged in our code. (We never > use strcat/strncat; we use strlen only when it's unavoidable.) (Some uses of > strlen already existed in constraint.c; we just didn't get around to > eliminating them.) In general we use bervals instead of flat strings, and > there's almost never a reason to count string lengths at runtime. > > I got 3 rejects when applying the patch to my source tree (current HEAD). > > I think these points can all be cleaned up pretty easily. Let me know if you > need any particular pointers. I'm working on getting this to build now. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#4987 slapo-constraint improvement
by hyc＠symas.com 14 Dec '07

14 Dec '07

In reviewing the patch, I see several small details that need to be fixed. E.g., you added a config keyword but re-used an existing OID for your new attribute. OIDs must never be re-used, and certainly you must not use two different attributes with the same OID. You use strlen/strncat, which are heavily discouraged in our code. (We never use strcat/strncat; we use strlen only when it's unavoidable.) (Some uses of strlen already existed in constraint.c; we just didn't get around to eliminating them.) In general we use bervals instead of flat strings, and there's almost never a reason to count string lengths at runtime. I got 3 rejects when applying the patch to my source tree (current HEAD). I think these points can all be cleaned up pretty easily. Let me know if you need any particular pointers. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#4366 userPassword compare
by hyc＠symas.com 14 Dec '07

14 Dec '07

I think this is in general a bad idea. It's already noted as such in the README, which is fine. The code generally looks pretty good, although it would need to be updated for cn=config support. Does anyone else see a reason to integrate this and get it working with cn=config? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#3515 ACLs enhancements
by hyc＠symas.com 14 Dec '07

14 Dec '07

This looks mostly like ACI to me, with some special inheritance rules. Is it still relevant? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5285) password policy checks userPassword hash even without policies
by mbackes＠symas.com 14 Dec '07

14 Dec '07

Full_Name: Matthew Backes Version: 2.3, 2.4, head, etc OS: all URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (67.115.65.234) When receiving a new userPassword, slapo-ppolicy checks to see if that password matches the hash already present in userPassword, and disallows it if this is the case. This is a sensible default for most circumstances, as otherwise the user could reset their age counters by using the same password. Unfortunately, it also blocks arguably-legitimate password changes; e.g. when migration to SSHA from CRYPT where the first 8 chars of the new password match the old. This patch changes this userPassword-has-changed check to only apply if there is a password policy defined which requires it; in particular, any of pwdInHistory, pwdMinAge, pwdMaxAge, pwdCheckQuality, or pwdMustChange must apply for this check to be enforced. RCS file: /repo/OpenLDAP/pkg/ldap/servers/slapd/overlays/ppolicy.c,v retrieving revision 1.110 diff -u -r1.110 ppolicy.c --- ppolicy.c 17 Nov 2007 12:39:19 -0000 1.110 +++ ppolicy.c 15 Dec 2007 03:21:27 -0000 @@ -1776,7 +1776,13 @@ * Last check - the password history. */ /* FIXME: no access checking? */ - if (slap_passwd_check( op, NULL, pa, bv, &txt ) == LDAP_SUCCESS) { + if (( pp.pwdInHistory + || pp.pwdMinAge + || pp.pwdMaxAge + || pp.pwdCheckQuality + || pp.pwdMustChange ) /* make sure we care */ + && ( slap_passwd_check( op, NULL, pa, bv, &txt ) + == LDAP_SUCCESS )) { /* * This is bad - it means that the user is attempting * to set the password to the same as the old one.

1 0

ITS#3429 schema download module
by hyc＠symas.com 14 Dec '07

14 Dec '07

I was looking at this code in relation to current HEAD/RE24, and things have changed quite a bit. Given the ability to dynamically load schema into cn=config, is there still a need for this module? (It is in fact the changes made for dynamic schema manipulation in slapd that causes the compatibility issues with this module.) -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#4398 unique overlay enhancement
by hyc＠symas.com 14 Dec '07

14 Dec '07

Thanks for your patches. A more extensive version of these features was added in OpenLDAP 2.4 (March 2007). This ITS will be closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs