- openldap-bugs - openldap.org

Re: (ITS#4975) --without-tls is broken
by h.b.furuseth＠usit.uio.no 20 May '07

20 May '07

Fixed in HEAD. -- Regards, Hallvard

1 0

Re: (ITS#4975) --without-tls is broken
by hyc＠symas.com 20 May '07

20 May '07

ando(a)sys-net.it wrote: >> I haven't kept track of the TLS changes though, so I don't know if just >> moving #ifdefs around is the right fix. > > As far as I understood it, the rationale of those changes was to be able > to handle, and significantly parse certificates, independently of any TLS > capability (including when no TLS is available). If you find a > combination of #ifdef's that gives this, then it should be the right one. Your understanding is correct. I can sort this out if you haven't already. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#4975) --without-tls is broken
by ando＠sys-net.it 20 May '07

20 May '07

> I haven't kept track of the TLS changes though, so I don't know if just > moving #ifdefs around is the right fix. As far as I understood it, the rationale of those changes was to be able to handle, and significantly parse certificates, independently of any TLS capability (including when no TLS is available). If you find a combination of #ifdef's that gives this, then it should be the right one. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#4975) --without-tls is broken
by h.b.furuseth＠usit.uio.no 20 May '07

20 May '07

Full_Name: Hallvard B Furuseth Version: HEAD OS: Linux URL: Submission from: (NULL) (129.240.202.105) Submitted by: hallvard slapd/schema_init.c:certificateExactNormalize() (outside HAVE_TLS) needs slapd/dn.c:dnX509normalize() (inside HAVE_TLS). The latter uses libldap/tls.c:ldap_X509dn2bv() (outside HAVE_TLS), which needs oid_name oids[] (inside HAVE_TLS). If those are all moved outside HAVE_TLS, test021-certificate still fails: Running ./scripts/test021-certificate... running defines.sh Running slapadd to build slapd database... Starting slapd on TCP/IP port 9011... Testing certificate handling... Add certificates... ldapmodify failed (18)! ...because certificateExactNormalize() isn't used (the certificateExactMatch syntax #ifdef HAVE_TLS'es it out). It passes if that #ifdef is removed too. I haven't kept track of the TLS changes though, so I don't know if just moving #ifdefs around is the right fix.

1 0

(ITS#4974) tls calls ldap_pvt_thread_self with wrong prototype
by h.b.furuseth＠usit.uio.no 20 May '07

20 May '07

Full_Name: Hallvard B Furuseth Version: HEAD, RE23 OS: URL: Submission from: (NULL) (129.240.202.105) Submitted by: hallvard libldap/tls.c calls CRYPTO_set_id_callback(ldap_pvt_thread_self), which causes ldap_pvt_thread_self to be called with the wrong prototype. That can cause OpenSSL to use a garbage value, e.g. if the unsigned long it expects takes two words but ldap_pvt_thread_t is an int. I'm fixing it in HEAD now and also inserting a check for whether ldap_pvt_thread_t fits in an unsigned long. Maybe the latter should go in configure, but since OpenSSL presumably breaks anyway if that fails I don't see much point at this time.

1 0

Re: (ITS#4958) slapd segfaults when overlay rwm, suffixmassage is used in conjunction with empty suffix
by ando＠sys-net.it 19 May '07

19 May '07

nvoutsin(a)noc.uoa.gr wrote: > As ando already said: > .....it tries to lookup a database to relay for when unbinding, > but unbind has no DN, so a strcmp on NULL is performed. This does not > happen when using the "relay" directive because relay database selection > does not occur for each operation.... Technically, the bug is now fixed in HEAD/re23 (please test). Concerning the issue initially raised on the -software list, which seems to be open yet, see discussion on the list. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4964) consumer with slapo-chain segfaults when using ldappasswd
by ando＠sys-net.it 19 May '07

19 May '07

This is now completely fixed in HEAD; I need to check any issue related to backporting to re23, for quick release. Please test. Thanks for reporting, p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#4973) Inconsistent initialization of internal modifications
by ando＠sys-net.it 19 May '07

19 May '07

Full_Name: Pierangelo Masarati Version: HEAD OS: irrelevant URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.72.89.40) Submitted by: ando While fixing slapo-chain(5) handling of passmods, I stumbled into an inconsistent initialization of internal modifications. What happens is that in most cases the Operation structure used for internal operations is either directly the structure passed to the function that performs the internal operation, or a copy of it, something like Operation op2 = *op; The oq_modify.rs_modlist member now contains an orm_no_opattrs field which, if non-zero, inhibits the modification of operational attributes, and thus indirectly breaks replication. I've fixed the occurrence in passwd_extop(), but the code is full of internal modifications that might need care. p.

1 0

Re: (ITS#4078) test001 fails on sparcv9
by h.b.furuseth＠usit.uio.no 18 May '07

18 May '07

I've updated and applied a patch I had lying around for this one: Give OperationBuffer struct members instead of using LBER_ALIGNED_BUFFER. -- Regards, Hallvard

1 0

Re: (ITS#4966) OpenLDAP 2.3.35 crashes on valsort overlay
by ando＠sys-net.it 18 May '07

18 May '07

digant(a)stanford.edu wrote: > When modding an entry, valsort seems to have crashed the server. I've uploaded > the stack trace and informaiton I was able to gather out of the core dump. In your upload: > #0 valsort_modify (op=0x2aabaeac0058, rs=0x417fef10) at valsort.c:455 > 455 for (i=0; !BER_BVISNULL( &ml->sml_values[i] ); i++) { can you detail what operation caused this? Can you print: ml, i, ml->sml_mod.sm_values, ml->sml_mod.sm_values[i] ? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4959) replica seg faults if syncrepl searchbase =""
by ando＠sys-net.it 18 May '07

18 May '07

ali.pouya(a)free.fr wrote: > The HEAD misses the definition of 'oids' 'oid_name', etc. So I get the following > error at build time : You probably caught HEAD in some inconsistent state during the addition of GNUTLS support; it's working just fine for me. Can you retry? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4961) If database suffix is ""
by ando＠sys-net.it 18 May '07

18 May '07

ali.pouya(a)free.fr wrote: > Unfortunately the problem has not been completely fixed in the HEAD. > With the fix in the head the error message disappears but the contextCSN ins NOT > ACTUALLY written to the disk. So at the next slapd startup the ContextCSN is > missing. An the servers hav to resynchronize. > > Below you find the log extract. Makes sense: the empty entry "" is not persistent... p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4971) patch for OpenLDAP 2-3-32
by ando＠sys-net.it 18 May '07

18 May '07

jemeterisan(a)mail.ru wrote: > I had noticed, that the patch, used for 'schema-map.c' doesn't work > correct. I hope, You also had checked it up. So what had I found in > the function 'backsql_ad2at': > The attribute name is stored in 'struct berval' structure, so if > You change '.bv_val' from 'userCertificate;binary' to > 'userCertificate', You should change '.bv_len' in accordance to > strlen(aaa.bv_val) without strlen(";binary"). I assume you refer to a patch that was submitted along with ITS#4868; that patch is absolutely incorrect and in fact it has been rejected. A consistent fix has been applied to hEAD code. It has never been backported to OpenLDAP 2.3 because nobody fed back about it. If you wish to test HEAD code and report success, I'll be happy to backport it to OpenLDAP 2.3 so that it gets released with the next release. > And by the way I want to store 'userCertificate' attribute type in PostrgreSQL. > > What type of the field in the table should I use? Any blob-like format would be fine (although I haven't tested it with PostgreSQL yet). > Just another question to the developers: > I've heared that OpenLDAP is sensible to DOS attacks, so, how can I avoid this > trouble? And I want to know more about this problem, if possible. Please direct software use related questions to the openldap-software mailing list. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#4972) thr_debug problems
by h.b.furuseth＠usit.uio.no 18 May '07

18 May '07

Full_Name: Hallvard B Furuseth Version: HEAD, RE23 OS: URL: Submission from: (NULL) (129.240.202.105) Submitted by: hallvard $LDAP_THREAD_DEBUG parsing is bogus, code in the inner loop should be outside it. Detached threads can validly exit after ldap_debug_thread_destroy() (fixed in HEAD). Valgrind carries the 'uninialized' state out of debug_already_initialized(). RE23/thr_debug.c has some other problems that are fixed in HEAD, but take a bit more work to fix and test. I'll align it with HEAD if anyone is interested.

1 0

Re: (ITS#4961) If database suffix is ""
by ali.pouya＠free.fr 18 May '07

18 May '07

Unfortunately the problem has not been completely fixed in the HEAD. With the fix in the head the error message disappears but the contextCSN ins NOT ACTUALLY written to the disk. So at the next slapd startup the ContextCSN is missing. An the servers hav to resynchronize. Below you find the log extract. Thanks Best regards Ali ============================ Log extract : daemon: shutdown requested and initiated. daemon: closing 7 connection_closing: readying conn=0 sd=11 for close connection_close: conn=0 sd=11 daemon: removing 11 conn=0 fd=11 closed (slapd shutdown) =>do_syncrepl rid=123 connection_get(12) connection_get(12): got connid=0 daemon: removing 12r slapd shutdown: waiting for 1 threads to terminate ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 12 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed slapd shutdown: initiated bdb_modify: bdb_dn2entry("") bdb_modify_internal: 0x00000000: <= acl_access_allowed: granted to database root bdb_modify_internal: replace contextCSN is_entry_objectclass("", "2.5.17.0") no objectClass attribute => entry_encode(0x00000000): bdb_modify: updated id=00000000 dn="" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" ====> bdb_cache_release_all slapd destroy: freeing system resources. slapd stopped.

1 0

Re: (ITS#4965) slapd stops if access to cn=monitor is restricted
by ali.pouya＠free.fr 18 May '07

18 May '07

Hi Pierangelo; The HEAD misses some new definitions (see followup 5 in ITS 4959) so I reproduced the problem with OPENLDAP_REL_ENG_2_4. I feel that the problem has not been fixed in this release. Thanks and best regards Ali

1 0

Re: (ITS#4959) replica seg faults if syncrepl searchbase =""
by ali.pouya＠free.fr 18 May '07

18 May '07

Hi Pierangelo; The HEAD misses some new definitions (see below) so I reproduced the problem with OPENLDAP_REL_ENG_2_4. The backtrace is the same as before : #0 0x00179d5a in strcmp () from /lib/tls/libc.so.6 #1 0x08068ede in select_backend (dn=0xb78bef5c, manageDSAit=0, noSubs=0) at backend.c:684 #2 0x0806a8ac in fe_aux_operational (op=0xb78bef40, rs=0xb78bee80) at backend.c:1779 #3 0x0806a01b in backend_operational (op=0xb78bef40, rs=0xb78bee80) at backend.c:1801 #4 0x080a7d06 in do_syncrepl (ctx=0xb78bf2a0, arg=0x88ab2e0) at syncrepl.c:547 #5 0x081281c3 in ldap_int_thread_pool_wrapper (xpool=0x886fd78) at tpool.c:704 #6 0x00907371 in start_thread () from /lib/tls/libpthread.so.0 #7 0x001d8ffe in clone () from /lib/tls/libc.so.6 =============== N.B. The HEAD misses the definition of 'oids' 'oid_name', etc. So I get the following error at build time : tls.c:2908: error: syntax error before '*' token tls.c: In function `find_oid': tls.c:2913: error: `oids' undeclared (first use in this function) tls.c:2913: error: (Each undeclared identifier is reported only once tls.c:2913: error: for each function it appears in.) tls.c: In function `ldap_X509dn2bv': tls.c:2946: error: `oid_name' undeclared (first use in this function) tls.c:2946: error: `oidname' undeclared (first use in this function) make[2]: *** [tls.lo] Erreur 1 make[2]: Leaving directory `/var/ali/openldap-2.4/head-170507/libraries/libldap' make[1]: *** [all-common] Erreur 1 make[1]: Leaving directory `/var/ali/openldap-2.4/head-170507/libraries' make: *** [all-common] Erreur 1 Thanks Best Regards Ali

1 0

(ITS#4971) patch for OpenLDAP 2-3-32
by jemeterisan＠mail.ru 18 May '07

18 May '07

Full_Name: Petrov Dmitry Version: 2-3-32 OS: Red Hat 9 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.195.208.66) Hi, guys! I had noticed, that the patch, used for 'schema-map.c' doesn't work correct. I hope, You also had checked it up. So what had I found in the function 'backsql_ad2at': The attribute name is stored in 'struct berval' structure, so if You change '.bv_val' from 'userCertificate;binary' to 'userCertificate', You should change '.bv_len' in accordance to strlen(aaa.bv_val) without strlen(";binary"). And by the way I want to store 'userCertificate' attribute type in PostrgreSQL. What type of the field in the table should I use? Just another question to the developers: I've heared that OpenLDAP is sensible to DOS attacks, so, how can I avoid this trouble? And I want to know more about this problem, if possible. With best wishes, Dmitry...

1 0

(ITS#4970) Problem between pwdReset and pwdMinAge
by py.bonnetain＠ba-consultants.fr 17 May '07

17 May '07

Full_Name: Pierre-Yves Bonnetain Version: 2.3.35 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (213.41.162.162) There is something "forgotten" in ppolicy overlay code. When pwdReset is set to TRUE, the user is properly asked to change his password. BUT if the (admin-made) previous password change is newer than pwdMinAge, the requested password change will be rejected with a "password too young" message : ----------- $ ssh somehost -l someuser Password: You are required to change your LDAP password immediately. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Constraint violation Password is too young to change ----------- The pwdMinAge parameter should be ignored when pwdReset is set, otherwise the user will effectively be locked out of his account while waiting for the minimum delay to expire. Here is a patch to correct this behavior. Proposed patch may not adhere to coding standards and such, so feel free to enhance it as needed . *** ppolicy.old 2007-02-08 13:31:24.000000000 +0100 --- ppolicy.c 2007-05-17 17:10:39.000000000 +0200 *************** *** 1696,1710 **** time_t pwtime = (time_t)-1, now; int age; ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; } } --- 1696,1716 ---- time_t pwtime = (time_t)-1, now; int age; ! /* Py Bonnetain, B&A Consultants : We DON'T CARE for minAge if pwdReset ! is set. */ ! if ((pa = attr_find( e->e_attrs, ad_pwdReset )) == NULL || ! ! bvmatch( &pa->a_nvals[0], &slap_true_bv) ) { ! ! if ((pa = attr_find( e->e_attrs, ad_pwdChangedTime )) != NULL) ! pwtime = parse_time( pa->a_nvals[0].bv_val ); ! now = slap_get_time(); ! age = (int)(now - pwtime); ! if ((pwtime != (time_t)-1) && (age < pp.pwdMinAge)) { ! rs->sr_err = LDAP_CONSTRAINT_VIOLATION; ! rs->sr_text = "Password is too young to change"; ! pErr = PP_passwordTooYoung; ! goto return_results; ! } } }

1 0

Re: (ITS#4965) slapd stops if access to cn=monitor is restricted
by ando＠sys-net.it 17 May '07

17 May '07

ali.pouya(a)free.fr wrote: > If I include the monitor back-end in my configuration I have to add the > following access rule as well : > > access to dn.sub="cn=monitor" by * read > > Otherwise slapd stops with the log reproduced below (my access rules include > "access to * by * none"). The problem is already fixed in HEAD: slapd starts, although it cannot register back-bdb monitor stuff unless a roodn is defined in the monitor backend. FFT: maybe the monitor database could have a default rootdn "cn=Monitor", much like the config database? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Re: (ITS#4968) acl problem
by ando＠sys-net.it 17 May '07

17 May '07

zeaal_3(a)yahoo.com wrote: > Full_Name: dhiren > Version: 2.2 > OS: fedora4 > URL: > Submission from: (NULL) (203.88.149.100) > > > when i enable following acl , user not able to login client side:- > > access to attrs=userPassword > by self write > by anonymous auth > by * none > > whts problem? when disable this acl user can login. Please direct software usage questions to the openldap-software list; or, just read the first few lines of slapd.conf(5) and find the answer yourself. This ITS will be closed. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

(ITS#4969) globalization missing is com.novell.ldap.resources package
by viral_barot＠persistent.co.in 17 May '07

17 May '07

Full_Name: viral barot Version: 2.3 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (220.225.70.2) It is found that package com.novell.ldap.resources does not include many language files for globalization support. This package contains only english and spanish (ResultCodeMessages.java and ResultCodeMessages_es.java) and other language files are missing. It would be fine if following files are included. ResultCodeMessages_ja.java ResultCodeMessages_ko.java ResultCodeMessages_it.java ResultCodeMessages_fr.java ResultCodeMessages_de.java ResultCodeMessages_pt_BR.java ResultCodeMessages_zh_CN.java ResultCodeMessages_zh_TW.java Thanks.

1 0

(ITS#4968) acl problem
by zeaal_3＠yahoo.com 17 May '07

17 May '07

Full_Name: dhiren Version: 2.2 OS: fedora4 URL: Submission from: (NULL) (203.88.149.100) when i enable following acl , user not able to login client side:- access to attrs=userPassword by self write by anonymous auth by * none whts problem? when disable this acl user can login.

1 0

(ITS#4966) OpenLDAP 2.3.35 crashes on valsort overlay
by digant＠stanford.edu 16 May '07

16 May '07

Full_Name: Digant C Kasundra Version: 2.3.35 OS: Debian 3.1 URL: ftp://ftp.openldap.org/incoming/digant-kasundra-20070516.txt Submission from: (NULL) (171.64.18.9) When modding an entry, valsort seems to have crashed the server. I've uploaded the stack trace and informaiton I was able to gather out of the core dump.

1 0

(ITS#4965) slapd stops if access to cn=monitor is restricted
by ali.pouya＠free.fr 16 May '07

16 May '07

Full_Name: Ali Pouya Version: 2.2.4alpha OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (145.242.3.30) If I include the monitor back-end in my configuration I have to add the following access rule as well : access to dn.sub="cn=monitor" by * read Otherwise slapd stops with the log reproduced below (my access rules include "access to * by * none"). I can send more information if required. Thanks and best regards Ali ============================================= Log extract : >>> dnPretty: <c=fr> => ldap_bv2dn(c=fr,0) <= ldap_bv2dn(c=fr)=0 => ldap_dn2bv(272) <= ldap_dn2bv(c=fr)=0 <<< dnPretty: <c=fr> >>> dnNormalize: <c=fr> => ldap_bv2dn(c=fr,0) <= ldap_bv2dn(c=fr)=0 => ldap_dn2bv(272) <= ldap_dn2bv(c=fr)=0 <<< dnNormalize: <c=fr> end get_filter 0 => monitor_back_search => access_allowed: search access to "cn=Databases,cn=Monitor" "entry" requested => acl_get: [2] attr entry => acl_mask: access to entry "cn=Databases,cn=Monitor", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: cn=admin,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: cn=connecteur,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: cn=sync,ou=internal,ou=min,o=gouv,c=fr <= check a_dn_pat: ou=applications,ou=external,ou=min,o=gouv,c=fr <= check a_dn_pat: * <= acl_mask: [5] applying none(=0) (stop) <= acl_mask: [5] mask: none(=0) => slap_access_allowed: search access denied by none(=0) => access_allowed: no more rules send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=32 matched="" text="" monitor_back_register_entry_attrs(""): base="cn=databases,cn=monitor" scope=one filter="(namingContexts:distinguishedNameMatch:=c=fr)": unable to find entry ====> bdb_cache_release_all backend_startup_one: bi_db_open failed! (-1) slapd shutdown: initiated ====> bdb_cache_release_all bdb_db_close: alock_close failed slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs