- openldap-bugs - openldap.org

Re: (ITS#4899) ITS4855 fix breaks 2.3.34
by hyc＠symas.com 28 Mar '07

28 Mar '07

quanah(a)stanford.edu wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3.34 > OS: Linux 2.6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (171.66.35.82) > > > I patched 2.3.34 with the patch in RE_23 for fixing the thread pool issue > (ITS#4855) So really this is a bug in RE23, not 2.3.34, yes? > <http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap_r/tpool.c.diff?r…> > > My patch being: > > ldap-uat00:/usr/local/build/PATCHES/openldap# cat ITS4855 > --- openldap-2.3.34/libraries/libldap_r/tpool.c.orig 2007-03-26 > 15:19:56.000000000 -0700 > +++ openldap-2.3.34/libraries/libldap_r/tpool.c 2007-03-26 15:20:20.000000000 > -0700 > @@ -664,7 +664,7 @@ > int i; > > for ( i=MAXKEYS-1; i>=0; i--) { > - if ( ctx[i].ltk_key ) > + if ( ctx[i].ltk_key == NULL ) > continue; > if ( ctx[i].ltk_free ) > ctx[i].ltk_free( ctx[i].ltk_key, ctx[i].ltk_data ); -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#4899) ITS4855 fix breaks 2.3.34
by quanah＠stanford.edu 28 Mar '07

28 Mar '07

Full_Name: Quanah Gibson-Mount Version: 2.3.34 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (171.66.35.82) I patched 2.3.34 with the patch in RE_23 for fixing the thread pool issue (ITS#4855) <http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap_r/tpool.c.diff?r…> My patch being: ldap-uat00:/usr/local/build/PATCHES/openldap# cat ITS4855 --- openldap-2.3.34/libraries/libldap_r/tpool.c.orig 2007-03-26 15:19:56.000000000 -0700 +++ openldap-2.3.34/libraries/libldap_r/tpool.c 2007-03-26 15:20:20.000000000 -0700 @@ -664,7 +664,7 @@ int i; for ( i=MAXKEYS-1; i>=0; i--) { - if ( ctx[i].ltk_key ) + if ( ctx[i].ltk_key == NULL ) continue; if ( ctx[i].ltk_free ) ctx[i].ltk_free( ctx[i].ltk_key, ctx[i].ltk_data ); Now when I shut down slapd, it core dumps: 1282 cache.c: No such file or directory. in cache.c (gdb) bt #0 bdb_locker_id_free (key=0x2aad2fe00628, data=0x39) at cache.c:1282 #1 0x00002aad2d0bef21 in ldap_pvt_thread_pool_context_reset (vctx=0x2aad2d1f2260) at tpool.c:670 #2 0x000000000044e07c in slap_destroy () at init.c:304 #3 0x00000000004159f9 in main (argc=3, argv=0x7fff7de07438) at main.c:874 If I remove the patch, there is no core dump. I see no additional related commits for this change. --Quanah

1 0

Re: (ITS#4898) slapd crashes when no structural object class provided
by quanah＠stanford.edu 28 Mar '07

28 Mar '07

--On Wednesday, March 28, 2007 8:45 PM +0000 blentz(a)channing-bete.com wrote: > Full_Name: Ben Lentz > Version: 2.3.34 > OS: Fedora Core 3 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (12.169.82.130) > > > Background: > This is a heavily modified RPM build of the 2.2.17 release which came > standard with Fedora Core 3. ldbm is deprecated, and it is highly advised that it not be used. Bugs with LDBM are unlikely to be fixed, and it has already been removed from the 2.4 release. If you can reproduce this issue with back-bdb, please follow up. --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

(ITS#4898) slapd crashes when no structural object class provided
by blentz＠channing-bete.com 28 Mar '07

28 Mar '07

Full_Name: Ben Lentz Version: 2.3.34 OS: Fedora Core 3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (12.169.82.130) Background: This is a heavily modified RPM build of the 2.2.17 release which came standard with Fedora Core 3. Versions: OpenLDAP 2.3.34, gcc-3.4.4, glibc-2.3.6, db4-4.2.52 Build: ./configure --enable-ldbm -with-ldbm-api=berkeley --enable-bdb --enable-ldap --enable-meta --enable-monitor --enable-null --enable-rewrite --disable-shared --with-kerberos=k5only --with-cyrus-sasl Configuration: /etc/openldap/slapd.conf: database ldbm /usr/sbin/slapd -u ldap -h "ldap:///" -d 1 & Issue: Client executes something dumb, causing a "No structural object class" error: ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -w secret dn: dc=my-domain,dc=com objectClass: top objectClass: dcObject dc: my-domain ^D slapd output (crash): connection_get(10): got connid=0 connection_read(10): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 79 contents: ber_get_next do_add ber_scanf fmt ({m) ber: >>> dnPrettyNormal: <dc=my-domain,dc=com> <<< dnPrettyNormal: <dc=my-domain,dc=com>, <dc=my-domain,dc=com> ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: dn2entry_r: dn: "dc=my-domain,dc=com" => dn2id( "dc=my-domain,dc=com" ) => ldbm_cache_open( "dn2id.dbb", 73, 600 ) <= ldbm_cache_open (opened 0) <= dn2id NOID entry failed op attrs add: no structural object class provided (65) slapd: ../../../../servers/slapd/back-ldbm/cache.c:111: cache_return_entry_rw: Assertion `e->e_private != ((void *)0)' failed. [1]+ Aborted /usr/sbin/slapd -u ldap -h "ldap:///" -d 1 ldapadd output: adding new entry "dc=my-domain,dc=com" ldap_result: Can't contact LDAP server (-1) Is there something wrong with my build or runtime environment that would cause this? I am mostly concerned that this is a "minor security issue", e.g. server bugs which clients can use to deny services to others. I am looking to upgrade several production servers from 2.2.17 to 2.3.34 and need to ensure that things are as stable as possible beforehand. I can provide more detailed information (versions, straces, cores, etc.) upon request. Thanks for any insight you can provide.

1 0

(ITS#4897) admin-guide 11.3.3.2. Policy Configuration confuses "from" and "to"
by mb＠computer-leipzig.com 28 Mar '07

28 Mar '07

Full_Name: Michael Bunk Version: 2.3.30 OS: Linux URL: Submission from: (NULL) (84.185.166.80) Wrong: "This directive can be set to none for no rules (the default), from for source rules, to for destination rules, or both for both source and destination rules." Correct: "This directive can be set to none for no rules (the default), to for source rules, from for destination rules, or both for both source and destination rules." This bug is present in http://www.openldap.org/doc/admin23/sasl.html and in revision 1.34.2.2 (HEAD at this moment) of admin/sasl.sdf.

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by ando＠sys-net.it 27 Mar '07

27 Mar '07

Michael Ströder wrote: > Pierangelo Masarati wrote: >> michael(a)stroeder.com wrote: >> >>> bdb_idl_fetch_key: [5941c014] >>> <= bdb_index_read: failed (-30989) >> ^^^ >> >> $ grep 30989 dn.h >> #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ >> >> I guess something strange is going on with libdb run-time loading... > > Well, it seems you were right. Strange that make test did not reveal any > problems (AFAICS). You can close that for now. I guess it's mostly because make test never uses SASL (the only case I know of is test028 if you explicitly force it by setting SLAPD_USE_SASL). Cheers, p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 27 Mar '07

27 Mar '07

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: > >> bdb_idl_fetch_key: [5941c014] >> <= bdb_index_read: failed (-30989) > > ^^^ > > $ grep 30989 dn.h > #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ > > I guess something strange is going on with libdb run-time loading... Well, it seems you were right. Strange that make test did not reveal any problems (AFAICS). You can close that for now. Ciao, Michael.

1 0

Re: (ITS#4894) Connection refused
by bgmilne＠staff.telkomsa.net 27 Mar '07

27 Mar '07

--nextPart1606934.cSND5gyAuy Content-Type: text/plain; charset="iso-8859-6" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Monday 26 March 2007, mcar_bhim(a)rediffmail.com wrote: > Full_Name: Mukesh > Version: v 1.8.8.7 > OS: Microsoft Windows XP Profesional Version 2002 Service Pack 2 > URL: > Submission from: (NULL) (164.151.129.37) > > > When authenticating user through LDAP "Connection to LDAP could not be > opened. Login of user failed:" appears suddenly. This doesnot happen > regularly but suddenly slapd crash down. To avoid this we open 30 in a day > and at the end of the day we see that only 5 instances are only running. You need to provide a lot more information on this. We are doing millions of authentications per day without any problems. You should provide at least: 1)What software you are reporting this on (I am not aware of a version 1.8.= 8.7=20 of OpenLDAP) 2)Some configuration details, e.g. a sanitized slapd.conf 3)Some means of reproducing the problem with a generic (e.g. OpenLDAP=20 commandline) client =2D-=20 Buchan Milne ISP Systems Specialist - Monitoring/Authentication Team Leader B.Eng,RHCE(803004789010797),LPIC-2(LPI000074592) --nextPart1606934.cSND5gyAuy Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQBGCQ31rJK6UGDSBKcRAnZAAJ9YPnPpJewNa4xNZNWaFCbIExTB4ACfUSud +If/rn2ZlB9kj3nh7nEbE88= =HnKz -----END PGP SIGNATURE----- --nextPart1606934.cSND5gyAuy--

1 0

Re: (ITS#4896) overlay auditlog not working in 2.3.34
by bgmilne＠staff.telkomsa.net 27 Mar '07

27 Mar '07

--nextPart1454941.Kjy3Wla0Ym Content-Type: text/plain; charset="iso-8859-6" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Tuesday 27 March 2007, atmp(a)yandex.ru wrote: > Full_Name: Artyom > Version: 2.3.34 > OS: linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.234.190.5) > > > In 2.3.34 overlay auditlog command is not working. > Sample slapd.conf: > ------ > loglevel any > database dbd > suffix ... > overlay auditlog /tmp/audit.log > ------- > Log file records > ------- > line XX: <overlay> extra cruft after <overlay> ignored. > ------- > > No any records will be placed in /tmp/audit.log file in case of > append/modify operations. Please see the man page for slapo-auditlog. Then, correct your configuratio= n.=20 E.g.: database dbd suffix ... overlay auditlog auditlog /tmp/audit.log I am using auditlog in production with 2.3.34. I am sure someone with sufficient rights will close this ITS. Please use th= e=20 OpenLDAP-software mailing list for configuration finger-trouble. Regards, Buchan =2D-=20 Buchan Milne ISP Systems Specialist - Monitoring/Authentication Team Leader B.Eng,RHCE(803004789010797),LPIC-2(LPI000074592) --nextPart1454941.Kjy3Wla0Ym Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQBGCQCurJK6UGDSBKcRAiLHAKDIrC1WGqNud9iaeRgYy+iespmy5wCgqaN5 YdTAysCusHYIcCuPRzq2mWQ= =92Px -----END PGP SIGNATURE----- --nextPart1454941.Kjy3Wla0Ym--

1 0

(ITS#4896) overlay auditlog not working in 2.3.34
by atmp＠yandex.ru 27 Mar '07

27 Mar '07

Full_Name: Artyom Version: 2.3.34 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.234.190.5) In 2.3.34 overlay auditlog command is not working. Sample slapd.conf: ------ loglevel any database dbd suffix ... overlay auditlog /tmp/audit.log ------- Log file records ------- line XX: <overlay> extra cruft after <overlay> ignored. ------- No any records will be placed in /tmp/audit.log file in case of append/modify operations.

1 0

(ITS#4895) overlay auditlog not working in 2.3.34
by atmp＠yandex.ru 27 Mar '07

27 Mar '07

Full_Name: Version: 2.3.34 OS: linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.234.190.5) In 2.3.34 overlay auditlog command is not working. Sample slapd.conf: ------ loglevel any database dbd suffix ... overlay auditlog /tmp/audit.log ------- Log file records ------- line XX: <overlay> extra cruft after <overlay> ignored. ------- No any records will be placed in /tmp/audit.log file in case of append/modify operations.

1 0

(ITS#4894) Connection refused
by mcar_bhim＠rediffmail.com 26 Mar '07

26 Mar '07

Full_Name: Mukesh Version: v 1.8.8.7 OS: Microsoft Windows XP Profesional Version 2002 Service Pack 2 URL: Submission from: (NULL) (164.151.129.37) When authenticating user through LDAP "Connection to LDAP could not be opened. Login of user failed:" appears suddenly. This doesnot happen regularly but suddenly slapd crash down. To avoid this we open 30 in a day and at the end of the day we see that only 5 instances are only running.

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 23 Mar '07

23 Mar '07

Pierangelo Masarati wrote: > michael(a)stroeder.com wrote: > >> bdb_idl_fetch_key: [5941c014] >> <= bdb_index_read: failed (-30989) > > ^^^ > > $ grep 30989 dn.h > #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ > > I guess something strange is going on with libdb run-time loading... Hmm, could be because the SASL RPM is built against db 4.4.20 and OpenLDAP is built against BDB 4.5.20 in /opt/bdb-4.5. I'll check that. Ciao, Michael.

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by ando＠sys-net.it 23 Mar '07

23 Mar '07

michael(a)stroeder.com wrote: > bdb_idl_fetch_key: [5941c014] > <= bdb_index_read: failed (-30989) ^^^ $ grep 30989 dn.h #define DB_OLD_VERSION (-30989)/* Out-of-date version. */ I guess something strange is going on with libdb run-time loading... p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: Tranlucent Overlay (ITS#4889)
by ghenry＠suretecsystems.com 23 Mar '07

23 Mar '07

<quote who="Howard Chu"> > Gavin Henry wrote: >> <quote who="Howard Chu"> >>> Gavin Henry wrote: >>>> <quote who="hyc(a)symas.com"> >>>>> Curious that your opening log says "No dynamic config support for >>>>> database bdb." Are you sure you have a clean install here? >>>> I thought that was weird to. This was setup on my laptop, no OpenLDAP >>>> from >>>> rpm or source ever installed. Fresh 2.3.34 and db-4.2.52 (5 patches). >>> Yeah, false alarm. The presence of the rwm overlay taints the entire >>> stack. >> >> Isn't this because translucent doesn't support dynamic config, so >> disables >> bdb dynamic config? >> >> Everything is now working, with no crashes without rwm. >> >> I've not had chance to test HEAD yet. > > Translucent does support dynamic config, but rwm doesn't. Not in 2.3.34 as I understand it. translucent.c doesn't have and olc* things anyway. > > -- > -- Howard Chu > Chief Architect, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

1 0

Re: Tranlucent Overlay (ITS#4889)
by hyc＠symas.com 23 Mar '07

23 Mar '07

Gavin Henry wrote: > <quote who="Howard Chu"> >> Gavin Henry wrote: >>> <quote who="hyc(a)symas.com"> >>>> Curious that your opening log says "No dynamic config support for >>>> database bdb." Are you sure you have a clean install here? >>> I thought that was weird to. This was setup on my laptop, no OpenLDAP >>> from >>> rpm or source ever installed. Fresh 2.3.34 and db-4.2.52 (5 patches). >> Yeah, false alarm. The presence of the rwm overlay taints the entire >> stack. > > Isn't this because translucent doesn't support dynamic config, so disables > bdb dynamic config? > > Everything is now working, with no crashes without rwm. > > I've not had chance to test HEAD yet. Translucent does support dynamic config, but rwm doesn't. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Tranlucent Overlay (ITS#4889)
by ghenry＠suretecsystems.com 23 Mar '07

23 Mar '07

<quote who="Howard Chu"> > Gavin Henry wrote: >> <quote who="hyc(a)symas.com"> > >>> Curious that your opening log says "No dynamic config support for >>> database bdb." Are you sure you have a clean install here? >> >> I thought that was weird to. This was setup on my laptop, no OpenLDAP >> from >> rpm or source ever installed. Fresh 2.3.34 and db-4.2.52 (5 patches). > > Yeah, false alarm. The presence of the rwm overlay taints the entire > stack. Isn't this because translucent doesn't support dynamic config, so disables bdb dynamic config? Everything is now working, with no crashes without rwm. I've not had chance to test HEAD yet. Gavin. > > -- > -- Howard Chu > Chief Architect, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

1 0

Re: (ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 22 Mar '07

22 Mar '07

Debug output related to this: ---------------------------- `slapd -d 255` --------------------------- daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 busy >>> >>> slap_listener(ldapi://%2fhome%2fmichael%2fBizness%2fOpenLDAP%2fODD_2006%2fslapd-socket) daemon: listen=8, new connection on 15 daemon: added 15r (active) listener=(nil) daemon: activity on 2 descriptors daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=0 connection_read(15): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 18 02 01 01 60 13 02 0....`.. ldap_read: want=18, got=18 0000: 01 03 04 00 a3 0c 04 08 45 58 54 45 52 4e 41 4c ........EXTERNAL 0010: 04 00 .. ber_get_next: tag 0x30 len 24 contents: ber_dump: buf=0x08247cb0 ptr=0x08247cb0 end=0x08247cc8 len=24 0000: 02 01 01 60 13 02 01 03 04 00 a3 0c 04 08 45 58 ...`..........EX 0010: 54 45 52 4e 41 4c 04 00 TERNAL.. ber_get_next ldap_read: want=8 error=Resource temporarily unavailable do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cb3 end=0x08247cc8 len=21 0000: 60 13 02 01 03 04 00 a3 0c 04 08 45 58 54 45 52 `..........EXTER 0010: 4e 41 4c 04 00 NAL.. ber_scanf fmt ({m) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cba end=0x08247cc8 len=14 0000: 00 0c 04 08 45 58 54 45 52 4e 41 4c 04 00 ....EXTERNAL.. ber_scanf fmt (m) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cc6 end=0x08247cc8 len=2 0000: 00 00 .. ber_scanf fmt (}}) ber: ber_dump: buf=0x08247cb0 ptr=0x08247cc8 end=0x08247cc8 len=0 >>> >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_sasl_bind: dn () mech EXTERNAL ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 SASL Canonicalize [conn=0]: authcid="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" slap_sasl_getdn: conn 0 id=gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth [len=59] ==>slap_sasl2dn: converting SASL name gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth to a DN ==> rewrite_context_apply [depth=1] string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' ==> rewrite_rule_apply rule='gidnumber=([0-9]+)\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth' string='gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))'} [rw] authid: "gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" -> "ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" slap_parseURI: parsing ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)) ldap_url_parse_ext(ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))) str2filter "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" put_filter: "(&(objectClass=posixAccount)(uidNumber=500)(gidNumber=100))" put_filter: AND put_filter_list "(objectClass=posixAccount)(uidNumber=500)(gidNumber=100)" put_filter: "(objectClass=posixAccount)" put_filter: simple put_simple_filter: "objectClass=posixAccount" put_filter: "(uidNumber=500)" put_filter: simple put_simple_filter: "uidNumber=500" put_filter: "(gidNumber=100)" put_filter: simple put_simple_filter: "gidNumber=100" begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb1f76154 ptr=0xb1f76156 end=0xb1f76197 len=65 0000: a3 1b 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 ....objectClass. 0010: 0c 70 6f 73 69 78 41 63 63 6f 75 6e 74 a3 10 04 .posixAccount... 0020: 09 75 69 64 4e 75 6d 62 65 72 04 03 35 30 30 a3 .uidNumber..500. 0030: 10 04 09 67 69 64 4e 75 6d 62 65 72 04 03 31 30 ...gidNumber..10 0040: 30 0 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb1f76154 ptr=0xb1f76173 end=0xb1f76197 len=36 0000: 00 10 04 09 75 69 64 4e 75 6d 62 65 72 04 03 35 ....uidNumber..5 0010: 30 30 a3 10 04 09 67 69 64 4e 75 6d 62 65 72 04 00....gidNumber. 0020: 03 31 30 30 .100 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb1f76154 ptr=0xb1f76185 end=0xb1f76197 len=18 0000: 00 10 04 09 67 69 64 4e 75 6d 62 65 72 04 03 31 ....gidNumber..1 0010: 30 30 00 end get_filter 0 end get_filter_list end get_filter 0 >>> >>> dnNormalize: <ou=Users,ou=odd2006,dc=block-floete,dc=de> => ldap_bv2dn(ou=Users,ou=odd2006,dc=block-floete,dc=de,0) <= ldap_bv2dn(ou=Users,ou=odd2006,dc=block-floete,dc=de)=0 => ldap_dn2bv(272) <= ldap_dn2bv(ou=users,ou=odd2006,dc=block-floete,dc=de)=0 <<< dnNormalize: <ou=users,ou=odd2006,dc=block-floete,dc=de> slap_sasl2dn: performing internal search (base=ou=users,ou=odd2006,dc=block-floete,dc=de, scope=2) => hdb_search bdb_dn2entry("ou=users,ou=odd2006,dc=block-floete,dc=de") entry_decode: "" <= entry_decode() => access_allowed: auth access to "ou=Users,ou=odd2006,dc=block-floete,dc=de" "entry" requested => dn: [4] ou=users,ou=odd2006,dc=block-floete,dc=de => acl_get: [4] matched => acl_get: [4] attr entry => acl_mask: access to entry "ou=Users,ou=odd2006,dc=block-floete,dc=de", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [2] applying read(=rscxd) (stop) <= acl_mask: [2] mask: read(=rscxd) => slap_access_allowed: auth access granted by read(=rscxd) => access_allowed: auth access granted by read(=rscxd) search_candidates: base="ou=users,ou=odd2006,dc=block-floete,dc=de" (0x00000002) scope=2 => hdb_dn2idl("ou=users,ou=odd2006,dc=block-floete,dc=de") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [5941c014] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=0 last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=0 last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=2 last=0 <= bdb_filter_candidates: id=0 first=2 last=0 bdb_search_candidates: id=0 first=2 last=0 hdb_search: no candidates send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=0 matched="" text="" <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=0]: slapAuthcDN="gidNumber=100+uidNumber=500,cn=peercred,cn=external,cn=auth" ./start-slapd.sh: line 12: 4310 Segmentation fault ${OPENLDAP_PREFIX}/libexec/slapd -d 255 -h "ldap://0.0.0.0:2006 ldapi://%2fhome%2fmichael%2fBizness%2fOpenLDAP%2fODD_2006%2fslapd-socket" -n slapd-odd2006 -u michael -o slp=off -f ${LOCALCONFIG}/slapd.conf

1 0

Re: Tranlucent Overlay (ITS#4889)
by hyc＠symas.com 22 Mar '07

22 Mar '07

ando(a)sys-net.it wrote: > ghenry(a)suretecsystems.com wrote: > >> That's strange though, as I merely followed the slapd-ldap(5) man page: > > Slapo-rwm(5) works just fine by itself; the point is that when it was > designed there was no cleanup hook in the callback structure, so it was > __permmently replacing__ the original values of request DN and DN-valued > attributes instead of __temporarily replace__ them and set the original > values back when done. So it interacts poorly with other, more recent > overlays. Given that this particular rwm invocation isn't doing anything, it should be easy enough to just comment it out and see if the problem still occurs. Curious that your opening log says "No dynamic config support for database bdb." Are you sure you have a clean install here? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Tranlucent Overlay (ITS#4889)
by ando＠sys-net.it 22 Mar '07

22 Mar '07

ghenry(a)suretecsystems.com wrote: > That's strange though, as I merely followed the slapd-ldap(5) man page: Slapo-rwm(5) works just fine by itself; the point is that when it was designed there was no cleanup hook in the callback structure, so it was __permmently replacing__ the original values of request DN and DN-valued attributes instead of __temporarily replace__ them and set the original values back when done. So it interacts poorly with other, more recent overlays. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: (ITS#4888) Enhance back-sql with paged results
by ando＠sys-net.it 22 Mar '07

22 Mar '07

adamson(a)andrew.cmu.edu wrote: > When I checked on the patch file in my Emacs window this morning I saw the > "modified buffer" flag was still on because I hadn't saved the final > version. Grrrr. It included the function declarations and one last fix. > Sorry about that. :) > When I extract the last ID number from the cookie, I > have to make sure we're in the same objectClass as when the ID number was > saved. > I've replaced the patch file on my web server. If it doesn't fix the > root entry bug you're seeing, could you show me the search you're > performing? I'll have to more closely follow what's happening in the > switch ( bsi.bsi_scope ) { > segment around line 2115 in backsql_search() to see if there is some > special case for the root entry. It works now, thanks. I'll commit the patch, but I think we should definitely move the cookie stuff to the frontend and generalize the cookie stuff to use bervals before we close this ITS. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

Re: Tranlucent Overlay (ITS#4889)
by ghenry＠suretecsystems.com 22 Mar '07

22 Mar '07

<quote who="Pierangelo Masarati"> > In re23 slapo-rwm should not be used in conjunction with other overlays; > there > is a number of reports about interoperability issues, and only recently > Howard > fixed (I should say "reworked") it in HEAD/re24. Can you reproduce the > same > issue with HEAD? Will do later this week. That's strange though, as I merely followed the slapd-ldap(5) man page: suffixmassage, map, rewrite* These directives are no longer supported by back-ldap; their functionality is now delegated to the rwm overlay. Essentially, add a statement overlay rwm first, and prefix all rewrite/map statements with rwm- to obtain the original behavior. See slapo-rwm(5) for details. Maybe a man page patch is needed to stop others hitting this. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Re: (ITS#4876) Multiple levels of uniqueness
by hyc＠symas.com 22 Mar '07

22 Mar '07

quanah(a)stanford.edu wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.3.33 > OS: NA > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (171.64.19.81) > > > In using the uniqueness overlay, I found there are times I want to apply > uniqueness rules differently based on (sub)tree. For example, I might like > something along these lines where the db starts at dc=stanford,dc=edu: The unique overlay in HEAD now supports this functionality. See the updated manpage. test024 has also been updated accordingly, if you need examples. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#4892) slapd HEAD crashes with ldapi:// and SASL EXTERNAL
by michael＠stroeder.com 22 Mar '07

22 Mar '07

Full_Name: Michael Ströder Version: HEAD OS: openSUSE 10.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.124.31.177) HI! slapd.conf contains (identiation and line-wrapping may be screwed up: # EXTERNAL over Unix Domain socket authz-regexp "gidnumber=([0-9]+)\\+uidnumber=([0-9]+),cn=peercred,cn=external,cn=auth" "ldap:///ou=Users,ou=odd2006,dc=block-floete,dc=de??sub?(&(objectClass=posixAccount)(uidNumber=$2)(gidNumber=$1))" Ciao, Michael. $ ldapwhoami -H ldapi://%2fhome%2fmichael%2fBizness%2fOpenLDAP%2fODD_2006%2fslapd-socket -Y EXTERNAL SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

1 0

(ITS#4891) OpenLDAP with dynlist crash
by socrtp-ldap＠soclab.eu.org 22 Mar '07

22 Mar '07

Full_Name: Piotr Stolc Version: 2.3.34 OS: Gentoo, NetBSD URL: http://lysergic.soclab.eu.org/dynlist-bug.ldif Submission from: (NULL) (195.8.99.234) I found this bug while trying to run OpenLDAP with dynlist overlay and my own schema. The functionality of dynlist overlay works ok, but when browsing LDAP tree with PHPLDAPAdmin the server dies. I spent a few hours debugging the problem (accesslog overlay is cool :)) and created simple sample entries using default schemas. Here is what I have found: OpenLDAP server dies on this query: $ ldapsearch -D cn=Manager,dc=test,dc=pl -W -x -h 10.1.1.15 -b dc=test,dc=pl -s one dn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=test,dc=pl> with scope oneLevel # filter: (objectclass=*) # requesting: dn # # Manager, test.pl dn: cn=Manager,dc=test,dc=pl # testGroup, test.pl dn: ou=testGroup,dc=test,dc=pl ldap_result: Can't contact LDAP server (-1) It has also problem with another query - one of the slapd processes locks up with nearly 100% CPU usage: $ ldapsearch -D cn=Manager,dc=test,dc=pl -W -x -h 10.1.1.15 -b cn=testList,dc=test,dc=pl -s one mail The following query works fine and shows that dynlist overlay is working: $ ldapsearch -D cn=Manager,dc=test,dc=pl -W -x -h 10.1.1.15 -b cn=testList,dc=test,dc=pl mail The problem shows up with the latest stable version of OpenLDAP 2.3.34 on Gentoo Linux and with OpenLDAP 2.3.32 on NetBSD. I've pasted into URL field link to the LDIF with the sample dc=test,dc=pl structure that shows the error. Here is the config for "dc=test,dc=pl" I've used: database bdb suffix "dc=test,dc=pl" rootdn "cn=Manager,dc=test,dc=pl" rootpw secret directory /var/lib/openldap-data-test index cn eq overlay dynlist dynlist-attrset groupOfURLs memberURL

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs