- openldap-bugs - openldap.org

Re: (ITS#5218) ber_get_next at /liblber/io.c:710
by quanah＠zimbra.com 06 Nov '07

06 Nov '07

--On November 6, 2007 10:21:45 PM +0000 dappleby(a)deakin.edu.au wrote: > Is anyone able to tell me how/why this occurs? You made the mistake of using the RH ldap packages, that's why. As to whether or not this has been fixed, please don't open up bug reports on obsolete versions of OpenLDAP. Send your question to openldap-software, and maybe someone can help you there. Personally I'd suggest using Buchan Milne's builds for RH or Symas's CDS packages. Odds are though, it has been fixed. 2.2.13 is quite old, with 2.4.6 being the current release. <http://staff.telkomsa.net/packages/> <http://www.symas.com/> --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5217) refint overlay doc contribution
by ghenry＠OpenLDAP.org 06 Nov '07

06 Nov '07

<quote who="andreas(a)mandriva.com.br"> > Full_Name: Andreas Hasenack > Version: 2.3.39 > OS: linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (200.140.247.99) > > > Please find at > http://users.mandriva.com.br/~andreas/ldap-doc/doc-refint-patch/ > a patch and some image files for the admin guide. It adds documentation, > examples and figures for the referential integrity overlay. Looks good. Same comments as ITS#5216 I really appreciate your effort for this Andreas. Thanks. > Disclaimer (let me know if I got it right: I repeated it in the patch > file, but > obviously can't add it to the binary image files): > > This patch file is derived from OpenLDAP Software. All of the > modifications to > OpenLDAP Software represented in the following patch(es) were developed by > Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not > subject > to any license of Mandriva. > I, Andreas Hasenack, hereby place the following modifications to OpenLDAP > Software (and only these modifications) into the public domain. Hence, > these > modifications may be freely used and/or redistributed for any purpose with > or > without attribution and/or other notice. > > >

1 0

Re: (ITS#5216) Dynamic Lists doc contribution to the admin guide
by ghenry＠OpenLDAP.org 06 Nov '07

06 Nov '07

<quote who="andreas(a)mandriva.com.br"> > Full_Name: Andreas Hasenack > Version: 2.3.39 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (200.140.247.99) > > > Please find at > http://users.mandriva.com.br/~andreas/ldap-doc/doc-dynlist-patch/ > a patch and some image files for the admin guide. It adds documentation, > examples and figures for the Dynamic List overlay. Thanks! As discussed in #ldap all looks good. > Disclaimer (let me know if I got it right: I repeated it in the patch > file, but > obviously can't add it to the binary image files): I'll leave Kurt to check this. Once approved I'll commit it and then look forward to the other patches you've got in your queue ;-) > > This patch file is derived from OpenLDAP Software. All of the > modifications to > OpenLDAP Software represented in the following patch(es) were developed by > Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not > subject > to any license of Mandriva. > I, Andreas Hasenack, hereby place the following modifications to OpenLDAP > Software (and only these modifications) into the public domain. Hence, > these > modifications may be freely used and/or redistributed for any purpose with > or > without attribution and/or other notice. > > >

1 0

(ITS#5218) ber_get_next at /liblber/io.c:710
by dappleby＠deakin.edu.au 06 Nov '07

06 Nov '07

Full_Name: Daniel Appleby Version: 3 OS: RHEL4 Update 5 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (128.184.138.7) Hi, I am getting a signal 6 (abort) in the samba logs which reports: [2007/11/06 19:01:06, 0, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_suffix(1155) smbldap_search_suffix: Problem during the LDAP search: (Local error) smbd: ../../../libraries/liblber/io.c:516: ber_get_next: Assertion `ber->ber_buf == ((void *)0)' failed. It dropped a core and here is the full backtrace: #0 0x003db7a2 in ?? () #1 0x0025f7a5 in raise () from /lib/tls/libc.so.6 #2 0x00261209 in abort () from /lib/tls/libc.so.6 #3 0x007f06f4 in smb_panic2 (why=0x0, decrement_pid_count=1) at lib/util.c:1565 #4 0x007f086c in smb_panic (why=0x0) at lib/util.c:1454 #5 0x007dcd8f in sig_fault (sig=0) at lib/fault.c:41 #6 <signal handler called> #7 0x003db7a2 in ?? () #8 0x0025f7a5 in raise () from /lib/tls/libc.so.6 #9 0x00261209 in abort () from /lib/tls/libc.so.6 #10 0x00258d91 in __assert_fail () from /lib/tls/libc.so.6 #11 0x0094c1f5 in ber_get_next (sb=0x99231b0, len=0xbfe4072c, ber=0x992d880) at ../../../libraries/liblber/io.c:710 #12 0x0011a6a2 in try_read1msg (ld=0x9923100, msgid=10, all=1, sb=0x99231b0, lcp=0xbfe407dc, result=0xbfe40d34) at ../../../libraries/libldap/result.c:473 #13 0x0011bb6f in ldap_result (ld=0x9923100, msgid=10, all=1, timeout=0x0, result=0xbfe40d34) at ../../../libraries/libldap/result.c:378 #14 0x0011d28b in ldap_search_s (ld=0x9923100, base=0x992a618 "dc=deakin,dc=edu,dc=au", scope=2, filter=0x992da08 "(&(uid=pfield)(objectclass=sambaSamAccount))", attrs=0x992c580, attrsonly=0, res=0xbfe40d34) at ../../../libraries/libldap/search.c:364 #15 0x0086a9ff in smbldap_search (ldap_state=0x9922e70, base=0x992a618 "dc=deakin,dc=edu,dc=au", scope=2, filter=0xbfe408f0 "(&(uid=pfield)(objectclass=sambaSamAccount))", attrs=0x992c580, attrsonly=0, res=0xbfe40d34) at lib/smbldap.c:1047 #16 0x0086b116 in smbldap_search_suffix (ldap_state=0x9922e70, filter=0xbfe408f0 "(&(uid=pfield)(objectclass=sambaSamAccount))", search_attr=0x992c580, result=0xbfe40d34) at lib/smbldap.c:1148 #17 0x007c1cda in ldapsam_search_suffix_by_name (ldap_state=0x9922e00, user=Variable "user" is not available. ) at passdb/pdb_ldap.c:227 #18 0x007c524d in ldapsam_getsampwnam (my_methods=0x9922d70, user=0x992c410, sname=0x992d928 "pfield") at passdb/pdb_ldap.c:1291 #19 0x007bbaea in context_getsampwnam (context=0x9922c20, sam_acct=0x992c410, username=0x992d928 "pfield") at passdb/pdb_interface.c:197 #20 0x007bdbcf in pdb_getsampwnam (sam_acct=0x992c410, username=0x992d928 "pfield") at passdb/pdb_interface.c:883 #21 0x0082b2ad in check_sam_security (auth_context=0x9878dd0, my_private_data=0x0, mem_ctx=0x9924808, user_info=0x992d8b8, server_info=0x992afc0) at auth/auth_sam.c:240 #22 0x0082c54a in check_samstrict_security (auth_context=0x9878dd0, my_private_data=0x0, mem_ctx=0x0, user_info=0x992d8b8, server_info=0x0) at auth/auth_sam.c:372 #23 0x00829789 in check_ntlm_password (auth_context=0x9878dd0, user_info=0x992d8b8, server_info=0x992afc0) at auth/auth.c:255 #24 0x0083372e in auth_ntlmssp_check_password (ntlmssp_state=0x992bd68, user_session_key=0x0, lm_session_key=0x0) at auth/auth_ntlmssp.c:108 #25 0x00710a36 in ntlmssp_server_auth (ntlmssp_state=0x992bd68, request={data = 0x992c358 "NTLMSSP", length = 176, free = 0x7edc20 <free_data_blob>}, reply=0xbfe41350) at libsmb/ntlmssp.c:663 #26 0x0070ff0a in ntlmssp_update (ntlmssp_state=0x992bd68, in={data = 0x992c358 "NTLMSSP", length = 176, free = 0x7edc20 <free_data_blob>}, out=0xbfe41350) at libsmb/ntlmssp.c:259 #27 0x00833aa6 in auth_ntlmssp_update (auth_ntlmssp_state=0x0, request={data = 0x992c358 "NTLMSSP", length = 176, free = 0x7edc20 <free_data_blob>}, reply=0x0) at auth/auth_ntlmssp.c:187 #28 0x006b17a1 in reply_sesssetup_and_X_spnego (conn=0x0, inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "", length=354, bufsize=131072) at smbd/sesssetup.c:504 #29 0x006b2eb2 in reply_sesssetup_and_X (conn=0x0, inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "", length=354, bufsize=131072) at smbd/sesssetup.c:669 #30 0x006d95e2 in switch_message (type=115, inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "", size=354, bufsize=0) at smbd/process.c:968 #31 0x006d9a1c in process_smb (inbuf=0xb7bc2008 "", outbuf=0xb7ba1008 "") at smbd/process.c:998 #32 0x006da744 in smbd_process () at smbd/process.c:1560 #33 0x0086d057 in main (argc=2, argv=0xbfe44664) at smbd/server.c:900 Our openldap version is openldap-2.2.13-7.4E. I know that this is a redhat package etc but I would like to know if this has already been fixed or not? If it has been fixed can you let me know what version it was fixed in as I will need to supply redhat with a patch. Is anyone able to tell me how/why this occurs? If you need more info please let me know Thanks In Advance Daniel

1 0

(ITS#5217) refint overlay doc contribution
by andreas＠mandriva.com.br 06 Nov '07

06 Nov '07

Full_Name: Andreas Hasenack Version: 2.3.39 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (200.140.247.99) Please find at http://users.mandriva.com.br/~andreas/ldap-doc/doc-refint-patch/ a patch and some image files for the admin guide. It adds documentation, examples and figures for the referential integrity overlay. Disclaimer (let me know if I got it right: I repeated it in the patch file, but obviously can't add it to the binary image files): This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not subject to any license of Mandriva. I, Andreas Hasenack, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#5216) Dynamic Lists doc contribution to the admin guide
by andreas＠mandriva.com.br 06 Nov '07

06 Nov '07

Full_Name: Andreas Hasenack Version: 2.3.39 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (200.140.247.99) Please find at http://users.mandriva.com.br/~andreas/ldap-doc/doc-dynlist-patch/ a patch and some image files for the admin guide. It adds documentation, examples and figures for the Dynamic List overlay. Disclaimer (let me know if I got it right: I repeated it in the patch file, but obviously can't add it to the binary image files): This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Andreas Hasenack <andreas(a)mandriva.com.br>. These modifications are not subject to any license of Mandriva. I, Andreas Hasenack, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

cache? of parent failes for hdb
by Dan Oscarsson 06 Nov '07

06 Nov '07

I have found that using hdb there is a bug that now prevents me from moving from my old commercial X.500 database to openldap. I need to use hdb as I move objects using rename. I am running openldap under SLES 10. The version there is 2.3.32 but I have compiled 2.3.38 and tried that too. Both have same bug. Also compiled and tried openldap-2.4.5beta. Same failure there too. I am using hdb as database. What I do is to run a job that moves around a lot of leaf nodes to other branches, sometimes creating new branches before moving the leaf node there. The job moves about 7000 nodes out of 20000 when the bug occurs. After having run this, some nodes cannot be found by searching starting at a subtree under database suffix. I have done a simple test program to see if the bug appears. It does two searches: 1) Search with search base = database suffix 2) Search with search base = a branch 2 nodes deep below database suffix. If everything is correct, same number of objects should be found. My tests show: - running test: ok - running job that moves nodes - running test: failes, many objects are missing in search starting at search base that is 2 nodes below database suffix. - stopping and starting slapd - running test again: ok >From this I suspect that it is the cache of which parent node belongs to that gets corrupted. Or can it be something else? What more could I do to trace down the bug? I do not know if the above information is enough for you to find what is wrong? I have looked at the code, but it takes some time to understand it when doing it for the first time. maybe som debugging code could be added find the place where the bug is. Regards, Dan

2 1

Re: (ITS#5213) LDAP detection failed
by quanah＠zimbra.com 06 Nov '07

06 Nov '07

--On Monday, November 05, 2007 1:56 PM +0000 harij2007(a)gmail.com wrote: The ITS system is for reporting bugs in OpenLDAP, not usage questions. Please send your questions on how to use and configure OpenLDAP to openldap-software(a)openldap.org --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#5187) test020-proxycache failing in RE_2_4
by rhafer＠suse.de 06 Nov '07

06 Nov '07

I think I have an idea what causes this bug. It is possible that the client closes the connection before the server had a chance to run the cleanup handler, the server sets op->o_abandon then (in connection_closing()). And after that the cleanup handler is started, which in case of op->o_abandon does not store the results in the cache. To make this race more reproduceable it is sufficient to insert a usleep(100) before the call to slap_cleanup_play() in send_ldap_response() in result.c. Any suggestions for possible ways to fix this? On Dienstag, 23. Oktober 2007, rhafer(a)suse.de wrote: > On Dienstag, 23. Oktober 2007, ando(a)sys-net.it wrote: > > For the records: I seem to be ble to consistently reproduce the issue > > when running slapd under valgrind; > > Thanks, that seems to do the trick for me as well. > > > I haven't seen it yet when running the test > > regularly (single CPU i386, recently). -- Ralf

1 0

Re: (ITS#5214) Compilation error with a non C++ compiler
by h.b.furuseth＠usit.uio.no 06 Nov '07

06 Nov '07

It has been fixed in OpenLDAP 2.3.39. -- Hallvard

1 0

(ITS#5215) Use of ln is hardcoded in some files
by emmanuel.duru＠atosorigin.com 06 Nov '07

06 Nov '07

Full_Name: Emmanuel Duru Version: 2.3.38 OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.68.44.148) configure allows the use of "cp" instead of "ln", but the build/shtool tool uses a hardcoded "ln" (line 1266). Some makefiles (libraries/liblunicode, libraries/libldap_r and servers/slapd/back-hdb) use a hardcoded "-s" option. This is a problem on Windows because in cygwin environment "cp -s" behaves the same way as "ln -s". The use of "ln" is not welcome here because it creates a Windows shortcut, which is not understood by mingw compiler.

1 0

(ITS#5214) Compilation error with a non C++ compiler
by emmanuel.duru＠atosorigin.com 06 Nov '07

06 Nov '07

Full_Name: Emmanuel Duru Version: 2.3.38 OS: Solaris 8 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.68.44.148) There is a compilation error in servers/slapd/backglue.c: line 624 : "int rc" should be before line 623 : "op->o_bd = glue_back_select( b0, dn );"

1 0

UNBINDINGS and CRASH
by Antonio Guirado Puerta 05 Nov '07

05 Nov '07

Hello, We are testing openldap-2.3.38 with db-4.5.20. Our tests are oriented to measure capacity and stability of LDAP daemon. 3 clients machines perform search queries against the ldap server. We have used two types of clients: library NET::LDAP in perl, and C LDAP library directly. The problem is reproduced whit both types of clients We are observed that the ldap server crash after 24-48 hours after working with high load (1000-2000 searches/second). In log file there is the following message: connection_read(24): no connection! connection_read(18): no connection! connection_read(20): no connection! connection_read(19): no connection! connection_read(23): no connection! connection_read(18): no connection! connection_read(16): no connection! connection_read(22): no connection! connection_read(19): no connection! Using TCPDump we have observed that clients do not finish the search witch an unbind operation. Simply TCP connection is closed by a FIN packet. We suppose that this is the cause than produces the message in the LDAP log. The main issue is than after 24-48 hours the LDAP daemon dies. We have also tested openldap-2.3.30. Our configures are: Berkeley DB config.status 4.5.20 configured by ../dist/configure, generated by GNU Autoconf 2.60, with options \"'--prefix=/opt/lib/db-4.5.20' '--enable-compat185' '--enable-cxx'\" configured by ./configure, generated by GNU Autoconf 2.59, with options \"'--prefix=/opt/openldap-2.3.38' '--exec-prefix=/opt/openldap-2.3.38' '--disable-syslog' '--disable-ipv6' '--enable-slapd' '--enable-crypt' '--enable-bdb' '--enable-syncprov' '--with-threads' '--with-tls' 'CPPFLAGS=-I/opt/lib/db/include -I/opt/lib/openssl/include' 'LDFLAGS=-L/opt/lib/db/lib -L/opt/lib/openssl/lib The machine is a linux Redhat Enterprise 4.5. -- ___________________________________________ Antonio M. Guirado Puerta Sistemas de Información y Comunicaciones Fundación Integra. http://www.f-integra.org Teléfono: +34 968 355161 Fax: +34 968 355131 Correo: antonio.guirado(a)f-integra.org ___________________________________________ Este mensaje y los posibles documentos adjuntos al mismo son confidenciales y dirigidos exclusivamente a los destinatarios de los mismos. Si por un error de transmisión, o equivocación en la dirección de envío, usted ha recibido este mensaje y no es el destinatario de la información, por favor, notifíqueselo al remitente y borre este mensaje, sin usar, informar, distribuir, imprimir, copiar o difundir el mensaje, total o parcialmente, por ningún medio. Gracias.

2 1

(ITS#5213) LDAP detection failed
by harij2007＠gmail.com 05 Nov '07

05 Nov '07

Full_Name: harikrishna jalamanchili Version: 2.3.39 OS: rhel4 ws URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (65.57.245.11) i have configured the ldap server2.3.39. i could be able to create the user accounts using the ldapadd command. but i am having Google Search Appliance which in turn contains thE AIX server. i am connected to the internet. my ldap server is thrown with a dynamic ip address. now what is the problem is when i am trying to access the ldap server through the internet "LDAP detection failed" which is the message i am getting. step wise i display the configuration: step1: installed the RPM's - openldap-servers/openldap-server-sql/openldap-clients/openldap step2: extracted the openldap<version>.tgz from the net step3: cd openldap<version>/ ./configure step4: make depend step5: make step6: make test step7: su root -c 'make install' step8: then /usr/local/etc/openldap/sladp.conf file configured step9: then i edited /etc/openldap/slapd.conf file step10: then i edited /etc/openldap/ldap.conf file step11: i have created ldif file step12: according to the database i created ldif file format step13: i have edited ldap.conf file where i specified the URI i could be able to search the ldapaccounts but i was not been able to access it from the internet and as well as from gsa

1 0

ITS#5212 command that caused the crash
by tonni＠hetnet.nl 05 Nov '07

05 Nov '07

> That's all very interesting, but you haven't provided the standard > items needed in a crash report - a stack trace from the crash, Yes I have, but later than your reply on the ITS site. > and the actual client command that caused the crash. Also, the slapd > configuration, plus any relevant schema if you've used any custom > schema in relation to this failing command. Other details: Command: ldapsearch2.4 -x -D "cn=admin,dc=billy,dc=demon,dc=nl" -w secret 'facsimileTelephoneNumber=+4753491111' facsimile TelephoneNumber slapd.conf: 1386 [root:tru.leerlingen] /etc/openldap2.4 # grep '^[^#]' slapd.conf include /etc/openldap2.4/schema/core.schema include /etc/openldap2.4/schema/cosine.schema include /etc/openldap2.4/schema/corba.schema include /etc/openldap2.4/schema/inetorgperson.schema include /etc/openldap2.4/schema/java.schema include /etc/openldap2.4/schema/krb5-kdc.schema include /etc/openldap2.4/schema/kerberosobject.schema include /etc/openldap2.4/schema/misc.schema include /etc/openldap2.4/schema/nis.schema include /etc/openldap2.4/schema/nitrobit-ads.schema include /etc/openldap2.4/schema/openldap.schema include /etc/openldap2.4/schema/samba.schema include /etc/openldap2.4/schema/evolutionperson.schema include /etc/openldap2.4/schema/calendar.schema include /etc/openldap2.4/schema/qmail.schema include /etc/openldap2.4/schema/authldap.schema include /etc/openldap2.4/schema/dhcp.schema include /etc/openldap2.4/schema/pykota.schema include /etc/openldap2.4/schema/ppolicy.schema include /etc/openldap2.4/schema/DUAConfigProfile.schema include /etc/openldap2.4/schema/local.schema pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args allow bind_v2 password-hash {CLEARTEXT} TLSCACertificateFile /etc/certs/CA/CA.pem TLSCertificateFile /etc/certs/slapd/servercert.pem TLSCertificateKeyFile /etc/certs/slapd/serverkey.pem TLSVerifyClient never sasl-authz-policy to authz-regexp uid=(.*),cn=digest-md5,cn=auth "ldap:///dc=billy,dc=demon,dc=nl??sub?uid=$1" authz-regexp uid=(.*),cn=cram-md5,cn=auth "ldap:///dc=billy,dc=demon,dc=nl??sub?uid=$1" include /etc/openldap2.4/slapd.access modulepath /usr/lib/openldap2.4 moduleload back_ldap.la moduleload back_monitor.la moduleload accesslog.la moduleload ppolicy.so moduleload smbk5pwd.so plugin preoperation libaddrdnvalues-plugin.so addrdnvalues_preop_init backend monitor database monitor database config rootdn "cn=admin,dc=billy,dc=demon,dc=nl" database bdb suffix "dc=billy,dc=demon,dc=nl" directory /var/lib/ldap2.4/ rootdn "cn=admin,dc=billy,dc=demon,dc=nl" rootpw kopjekoffie overlay ppolicy ppolicy_default "cn=Standard,ou=Policies,dc=billy,dc=demon,dc=nl" ppolicy_use_lockout overlay smbk5pwd cachesize 1000 checkpoint 250 240 loglevel stats dbconfig set_cachesize 0 10240000 1 dbconfig set_lg_regionmax 2048000 dbconfig set_lg_bsize 2048000 dbconfig set_lk_max_locks 2000 dbconfig set_lk_max_lockers 2000 dbconfig set_lk_max_objects 2000 index entryCSN,entryUUID eq include /etc/openldap2.4/indices.conf indices.conf: 1385 [root:tru.leerlingen] /etc/openldap2.4 # grep '^[^#]' indices.conf index accountstatus pres,eq index anniversary pres,eq index assistantName pres,eq index assistantPhone pres,eq index birthDate pres,eq index businessRole pres,eq index calCalURI pres,eq index calFBURL pres,eq index callbackPhone pres,eq index carPhone pres,eq index category pres,eq index cn pres,eq,sub index companyPhone pres,eq index description pres,eq,sub index destinationIndicator pres,eq,sub index dhcpClassData pres,eq index dhcpHWAddress pres,eq index dhcpPrimaryDN pres,eq index dhcpRange pres,eq index displayName pres,eq,sub index fileAs pres,eq,sub index filtermember pres,eq,sub index gidNumber pres,eq index givenName pres,eq index homePhone pres,eq index homePostalAddress pres index krb5PrincipalName eq index labeledURI pres,eq index mail pres,eq,sub index mailer pres,eq index maillocaladdress pres,eq index mailroutingaddress pres,eq index mailsource pres,eq index managerName pres,eq index memberuid pres,eq index mobile pres,eq index note pres,eq index o pres,eq index objectClass pres,eq index otherPhone pres,eq index otherPostalAddress pres index ou pres,eq index pager pres,eq index postalAddress pres index primaryPhone pres,eq index pykotaUserName pres,eq,sub index pykotaGroupName pres,eq,sub index pykotaPrinterName pres,eq,sub index pykotaBillingCode pres,eq,sub index pykotaLastJobIdent eq index quota pres,eq index radio pres,eq index rfc822mailmember pres,eq index roomNumber pres,eq index sn pres,eq,sub index spouseName pres,eq index telephoneNumber pres,eq index facsimileTelephoneNumber pres index telex pres,eq index title pres,eq index tty pres,eq index uid pres,eq index uidNumber pres,eq index uniqueMember pres index userPassword pres,eq index sambaAcctFlags pres,eq index sambaAlgorithmicRidBase pres,eq index sambaDomainName pres,eq index sambaGroupType pres,eq index sambaHomeDrive pres,eq index sambaHomePath pres,eq index sambaKickoffTime pres,eq index sambaLMPassword pres,eq index sambaLogoffTime pres,eq index sambaLogonScript pres,eq index sambaLogonTime pres,eq index sambaNextGroupRid pres,eq index sambaNextRid pres,eq index sambaNextUserRid pres,eq index sambaNTPassword pres,eq index sambaPrimaryGroupSID pres,eq index sambaProfilePath pres,eq index sambaPwdCanChange pres,eq index sambaPwdLastSet pres,eq index sambaPwdMustChange pres,eq index sambaSID pres,eq,sub index sambaUserWorkstations pres,eq slapd.access: 1388 [root:tru.leerlingen] /etc/openldap2.4 # grep '^[^#]' slapd.access access to dn="cn=config" by dn=cn=admin,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree="cn=config" by dn=cn=admin,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree="cn=monitor" by dn.exact=cn=admin,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=userPassword,sambaLMPassword,sambaNTPassword,accountStatus by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by self write by * auth access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=registeredAddress,street,postalCode,postalAddress,localityName,homePhone attrs=mail,mobile,birthDate by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by self write access to dn.subtree=ou=contacts,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree=ou=pykota,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by dn=cn=pykotauser,ou=pykota,dc=billy,dc=demon,dc=nl read by * none access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=pykotaLimitBy,pykotaUserName,pykotaOverCharge,pykotaLifeTimePaid,pykotaBalance,pykotaLifeTimePaid,pykotaPayments by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by dn=cn=pykotauser,ou=pykota,dc=billy,dc=demon,dc=nl read by * none access to dn=cn=admin,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by * search access to dn.subtree=dc=billy,dc=demon,dc=nl attrs=postalAddress,title,fileAs,telephoneNumber,description,homePhone,mobile,birthDate,mail attrs=accountstatus,confirmtext,maildrop,mailbox,mailMessageStore,homepostaladdress attrs=shadowLastChange,shadowMin,shadowMax,shadowWarning,shadowInactive,shadowFlag,shadowExpire attrs=sambaPwdCanChange,sambaPwdMustChange,sambaAcctFlags,sambaPwdLastSet attrs=sambaSID,sambaPrimaryGroupSID,sambaPasswordHistory,sambaKickoffTime attrs=sambaPwdMustChange,sambaAcctFlags,sambaPasswordHistory,sambaKickoffTime,sambaLogonHours attrs=sambaPwdCanChange,sambaPwdLastSet,sambaSID,sambaPrimaryGroupSID,sambaBadPasswordCount,sambaBadPasswordTime attrs=sambaLogonHours,sambaLogonScript,sambaHomeDrive,sambaDomainName attrs=mailhost,quota,member by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by self write by * none access to dn.base=cn=tru.leerlingen,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by dn=cn=pykotaadmin,ou=pykota,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree=cn=System,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * none access to dn.subtree=ou=mailaliases,ou=groups,dc=billy,dc=demon,dc=nl by dn=cn=admin,dc=billy,dc=demon,dc=nl write by group=cn=peoplemanagers,cn=katter,ou=groups,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree="" by dn=cn=admin,dc=billy,dc=demon,dc=nl write by * read access to dn.subtree="dc=billy,dc=demon,dc=nl" by * read Relevant schema: core.schema --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

1 0

Re: (ITS#5209) Setting sasl-host in slapd.conf fails
by hyc＠symas.com 05 Nov '07

05 Nov '07

arjones(a)simultan.dyndns.org wrote: > Full_Name: Andrew Rucker Jones > Version: 2.4.6 > OS: Linux > URL: > Submission from: (NULL) (87.165.239.200) > > > I just upgraded from a working 2.3.39 installation to 2.4.6 without making > changes, but slapd does not start. Upon further investigation, i found that > slaptest claims my slapd.conf is clean, but slapd -d 100 says that sasl-host is > already set. That is, in my slapd.conf, i set sasl-host once and only once, but > slapd comes across that lines and claims that sasl-host had already been set > before that. Looking at the code, it seems that lines 354-358 in config.c > (servers/slapd/) fails to accurately check whether or not something with the > ARG_UNIQUE flag has really already been set from the configuration file. > > Commenting out the sasl-host line in slapd.conf lets slapd start, but i assume > from looking at bconfig.c that the value of sasl-host is wrong. Thanks for the report, this is now fixed in HEAD. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5212) OL 2.4.6 slapd crashes on ?undefined search string
by hyc＠symas.com 05 Nov '07

05 Nov '07

tonni(a)hetnet.nl wrote: > Full_Name: Tonni Earnshaw > Version: 2.4.6 > OS: Fedora FC6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (213.10.163.78) > > > slapd built on FC6 from Buchan Milne's openldap2.4-2.4.6-1mdv2008.1.src.rpm > available on Mandriva Cooker mirrors and specifically composed to recognize Red > Hat-derived systems. Building the source results in a number of rpms, one of > which is openldap2.4-servers-2.4.6-1.fc6.i386.rpm and contains slapd2.4. > Running 'make test' in the rpm BUILD folder after the build resulted in all > (52?) tests passing. > > slapd2.4 normally runs stably and well. Although FC6 has native BDB 4.3.29, > Buchan has created slapds to use a discrete patched 4.2.52. Whilst checking a > question on the ML and searching on the rfc2256 core.schema attribute > facsimileTelephoneNumber slapd crashed repeatedly. Increasing log level output > to 1 and parsing slaps's log showed it doing this on returning a value of > ?undefined for the search. That's all very interesting, but you haven't provided the standard items needed in a crash report - a stack trace from the crash, and the actual client command that caused the crash. Also, the slapd configuration, plus any relevant schema if you've used any custom schema in relation to this failing command. - -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#5212 stack trace on unstripped slapd binary
by tonni＠hetnet.nl 05 Nov '07

05 Nov '07

(gdb) continue Continuing. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1237890160 (LWP 3221)] 0x080774fb in filter2bv_x (op=0x9f3eea0, f=0xb58731dc, fstr=0x9f3eee4) at filter.c:610 610 if ( f->f_av_desc->ad_type->sat_equality->smr_usage & SLAP_MR_MUTATION_NORMALIZER ) { (gdb) bt #0 0x080774fb in filter2bv_x (op=0x9f3eea0, f=0xb58731dc, fstr=0x9f3eee4) at filter.c:610 #1 0x08074afb in do_search (op=0x9f3eea0, rs=0xb6374144) at search.c:138 #2 0x0807240c in connection_operation (ctx=0xb6374238, arg_v=0x9f3eea0) at connection.c:1145 #3 0x08072981 in connection_read_thread (ctx=0xb6374238, argv=0x13) at connection.c:1271 #4 0x00d4ee07 in ldap_int_thread_pool_wrapper (xpool=0x9dd9540) at tpool.c:619 #5 0x00be245b in start_thread () from /lib/libpthread.so.0 #6 0x00b2523e in clone () from /lib/libc.so.6 (gdb) quit --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

1 0

(ITS#5212) OL 2.4.6 slapd crashes on ?undefined search string
by tonni＠hetnet.nl 04 Nov '07

04 Nov '07

Full_Name: Tonni Earnshaw Version: 2.4.6 OS: Fedora FC6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.10.163.78) slapd built on FC6 from Buchan Milne's openldap2.4-2.4.6-1mdv2008.1.src.rpm available on Mandriva Cooker mirrors and specifically composed to recognize Red Hat-derived systems. Building the source results in a number of rpms, one of which is openldap2.4-servers-2.4.6-1.fc6.i386.rpm and contains slapd2.4. Running 'make test' in the rpm BUILD folder after the build resulted in all (52?) tests passing. slapd2.4 normally runs stably and well. Although FC6 has native BDB 4.3.29, Buchan has created slapds to use a discrete patched 4.2.52. Whilst checking a question on the ML and searching on the rfc2256 core.schema attribute facsimileTelephoneNumber slapd crashed repeatedly. Increasing log level output to 1 and parsing slaps's log showed it doing this on returning a value of ?undefined for the search. Because Buchan's builds install discrete OL versions, OL 2.3.39 and 2.4.6 both exist on my system and can be run independently. Sopping slapd2.4 and starting slapd2.3 proved that this problem doees not exist with 2.3.39. An ldd on the slapd binary shows it uses its own libraries, not those of slapd2.3: linux-gate.so.1 => (0x00110000) libldap_r-2.4.so.2 => /usr/lib/libldap_r-2.4.so.2 (0x00d43000) liblber-2.4.so.2 => /usr/lib/liblber-2.4.so.2 (0x00b99000) libltdl.so.3 => /usr/lib/libltdl.so.3 (0x00d3a000) libslapd24_db-4.2.so => /usr/lib/libslapd24_db-4.2.so (0x00bf6000) libodbc.so.1 => /usr/lib/libodbc.so.1 (0x00cc9000) libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0x041f5000) libdl.so.2 => /lib/libdl.so.2 (0x00bc2000) libssl.so.6 => /lib/libssl.so.6 (0x0073c000) libcrypto.so.6 => /lib/libcrypto.so.6 (0x0353c000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x05599000) libresolv.so.2 => /lib/libresolv.so.2 (0x003da000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0x001c1000) libpthread.so.0 => /lib/libpthread.so.0 (0x00bdd000) libc.so.6 => /lib/libc.so.6 (0x00a57000) /lib/ld-linux.so.2 (0x00a3a000) libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x0045d000) libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00943000) libcom_err.so.2 => /lib/libcom_err.so.2 (0x00a2a000) libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x007b4000) libz.so.1 => /usr/lib/libz.so.1 (0x00bc8000) libnsl.so.1 => /lib/libnsl.so.1 (0x0036e000) libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x007aa000)

1 0

Re: (ITS#5207) Password checking: external program
by ghenry＠OpenLDAP.org 04 Nov '07

04 Nov '07

<quote who="Hadmut Danisch"> > Gavin Henry wrote: >> I don't read that as rude, merely advice. Don't take it personally please. > > > I do. His point was not to understand or answer my question. His point was to allege that I would not know what I am talking about and would not have understood the basic principles of LDAP just because my wording differed slightly from his expectations. The problem with e-mail is that a persons tone can't be portrayed. > > It was a personal attack and I take it as such. I don't care about, but I notice that the guys behind openldap tend to rather attack people personally than answering security relevant questions and that they None of our team do this. We all have limited time and do our best to reply to users questions or ITS reports. But you must understand, 99% of questions asked have been asked before with the answers being available in the mailing archives. 9 times out of 10 a user hasn't read any of our docs, so we politely ask, "have you read any of the docs?", that's not "have you *read* any of the docs?" implying an insult. So if we come across as attacking people, then I believe that this is an interpretation of the reader. > expect everyone to know what's not in the docs but hidden somewhere in some strange FAQ machine. Not really strange, pretty standard at the time and still used in many OSS projects. I've actually ported most of the relevant parts of our FAQ-O-Matic to the 2.4 Admin Guide, at present over 80 new pages of content over a 6-7 month period of unpaid commitment. So when I ask, as the OpenLDAP Project Documention Leader, have you read any of the docs, I think I'm entitled to put that question to a user. That's not being rude. > > Beyond the fact that this is not worth of further dispute, from my point of view this way of dealing with questions and handling authentication details disqualifies as software engineers for security relevant software. I disagree. Nothing in this thread can back up your claim here. > > Just for your information: I read the specs when they were issued as X.500 and X.509 in the CCITT Blue Book. But I am not rereading specs every day, LDAP is just a small detail of my daily work. Ok. > >> OpenLDAP supports SASL, SASL does have it's own documentation. Did you try to read any of that? > > Again, this offending way to assume that anyone who does not have exactly your point of view could not have read the specs. "try to read" is offensive. Maybe I should have asked, "Did you browse the SASL docs?", "Or did you take a quick look over at the SASL documentation?". They all mean the same thing, with no offence intended. It's all in how the reader sees it. <snip> > So before blaming me for not reading and understanding specs, tell me, where exactly this is specified. > > Do those particular specs you're blaming me for not having read at all exist? I don't know, I'm not a SASL expert. Maybe one of the Core team can answer this. If you do find the answer or implement something to solve your feature request, documentation patches are always welcome. We are an Open Source Community after all. Gavin.

1 0

(ITS#5211) syncrepl: server fails to sync on unknown cookie
by e.vanoosten＠grons.nl 02 Nov '07

02 Nov '07

Full_Name: Erik van Oosten Version: 2.3.36 OS: cygwin URL: Submission from: (NULL) (212.78.164.66) When I start sync operation with a made up cookie (just some random bytes), the server replies with a response with result code 2 (Protocol Error). RFC4533 specifies: "If the server does not recognize the request cookie or the request is made under different associations or non-equivalent protections, the server SHALL return the initial content as if no cookie had been provided or return an empty content with the e-syncRefreshRequired LDAP result code." RFC2119: "MUST This word, or the terms "REQUIRED" or "SHALL", mean that the definition is an absolute requirement of the specification." Expected behavior: either the initial content as if no cookie had been provided or an empty content with the e-syncRefreshRequired LDAP result code.

1 0

Re: (ITS#5210) SyncRepl: upon unchanged DIT expected only delete phase for refreshAndPersist
by hyc＠symas.com 02 Nov '07

02 Nov '07

e.vanoosten(a)grons.nl wrote: > Full_Name: Erik van Oosten > Version: 2.3.36 > OS: cygwin > URL: > Submission from: (NULL) (212.78.164.66) > > > When you start a refreshAndPersist sync operation with an initial cookie, and > the DIT has not changed since the cookie was issued, during the refresh phase I > expect to get a single message, namely a SyncInfoMessage of refreshDelete with > refreshDone equals to TRUE (no present phase, only the delete phase). > Observed behavior is that you get a single message, namely a SyncInfoMessage of > refreshPresent with refreshDone equals to TRUE (only the present phase, no > delete phase). > > Note: a refreshOnly operation in the same circumstances works as expected. > > Issue submitted as requested by Howard Chu. Thanks for the report. This is now fixed in HEAD. syncprov.c 1.207 and 1.208 contain the relevant changes. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#5210) SyncRepl: upon unchanged DIT expected only delete phase for refreshAndPersist
by e.vanoosten＠grons.nl 02 Nov '07

02 Nov '07

Full_Name: Erik van Oosten Version: 2.3.36 OS: cygwin URL: Submission from: (NULL) (212.78.164.66) When you start a refreshAndPersist sync operation with an initial cookie, and the DIT has not changed since the cookie was issued, during the refresh phase I expect to get a single message, namely a SyncInfoMessage of refreshDelete with refreshDone equals to TRUE (no present phase, only the delete phase). Observed behavior is that you get a single message, namely a SyncInfoMessage of refreshPresent with refreshDone equals to TRUE (only the present phase, no delete phase). Note: a refreshOnly operation in the same circumstances works as expected. Issue submitted as requested by Howard Chu.

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by hyc＠symas.com 02 Nov '07

02 Nov '07

hume-ml(a)bofh.ca wrote: > On Fri, 2007-11-02 at 11:09 +0000, Gavin Henry wrote: >>> A search such as the following: >>> ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > > >> Where is "dc=dal,dc=ca" set? > > That's a typo, sorry. Should be "dc=domain,dc=com". Missed that when > "redacting" the initial submission. This bug has been fixed in CVS HEAD. Also, this is a dup of ITS#5191 so it has already been closed. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5208) OpenLDAP w/ multiple bdb backends provides invalid paged result responses
by hume-ml＠bofh.ca 02 Nov '07

02 Nov '07

On Fri, 2007-11-02 at 11:09 +0000, Gavin Henry wrote: > > > > A search such as the following: > > ldapsearch -h localhost -x -E pr=2 -b dc=dal,dc=ca '(objectclass=*)' > Where is "dc=dal,dc=ca" set? That's a typo, sorry. Should be "dc=domain,dc=com". Missed that when "redacting" the initial submission.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs