- openldap-bugs - openldap.org

[Issue 10032] New: at_add returns a free'd pointer on error
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10032 Issue ID: 10032 Summary: at_add returns a free'd pointer on error Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: ondra(a)mistotebe.net Target Milestone: --- When an invalid schema is provided (e.g. the current ./servers/slapd/schema/msuser.schema of memberof/dynlist is loaded already), at_add() hits error handling and frees at->at_oid, but that string is being returned in *err. A fix is coming. -- You are receiving this mail because: You are on the CC list for the issue.

1 7

[Issue 9989] New: «make clean» shall not delete libraries/libldap/ldap.pc and libraries/liblber/lber.pc
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=9989 Issue ID: 9989 Summary: «make clean» shall not delete libraries/libldap/ldap.pc and libraries/liblber/lber.pc Product: OpenLDAP Version: 2.6.3 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: build Assignee: bugs(a)openldap.org Reporter: dpa-openldap(a)aegee.org Target Milestone: --- «./configure» and «./config.status» do create ./libraries/libldap/ldap.pc, ./libraries/liblber/lber.pc, while «make clean» deletes both .pc files. «make install» fails, if ./libraries/libldap/ldap.pc or ./libraries/liblber/lber.pc are missing. «./configure && make clean && make depend && make install» is a valid workflow for many other (autoconf/automake based) projects. ./libraries/libldap/ldap.pc and ./libraries/liblber/lber.pc shall be deleted by «make distclean», and kept by «make clean». See also https://www.gnu.org/prep/standards/html_node/Standard-Targets.html for the idea behind «make clean» vs «make distclean». -- You are receiving this mail because: You are on the CC list for the issue.

1 8

[Issue 10028] New: crash with pwdMinDelay
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10028 Issue ID: 10028 Summary: crash with pwdMinDelay Product: OpenLDAP Version: 2.5.14 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: hamano(a)osstech.co.jp Target Milestone: --- slapd crash when using pwdMinDelay of ppolicy. The cause is that slap_timestamp() writes to undefined area. It has already been fixed. backtrace: ``` (gdb) bt #0 0x00007f2c70bdbaff in raise () from /lib64/libc.so.6 #1 0x00007f2c70baeea5 in abort () from /lib64/libc.so.6 #2 0x00007f2c70baed79 in __assert_fail_base.cold.0 () from /lib64/libc.so.6 #3 0x00007f2c70bd4456 in __assert_fail () from /lib64/libc.so.6 #4 0x0000000000499fdf in entry_schema_check (op=<optimized out>, op@entry=0x7f2c2a9a9ff0, e=<optimized out>, e@entry=0x7f2c20001d30, oldattrs=<optimized out>, oldattrs@entry=0x7f2c20001d30, manage=0, add=add@entry=0, socp=socp@entry=0x7f2c2a9a99d8, text=0x7f2c2a9a9f30, textbuf=0x7f2c2a9a9b40 "", textlen=256) at ../../../servers/slapd/schema_check.c:89 #5 0x00000000004f5dc1 in mdb_modify_internal (op=<optimized out>, op@entry=0x7f2c2a9a9ff0, tid=tid@entry=0x11dc8c0, modlist=<optimized out>, e=<optimized out>, e@entry=0x7f2c2a9a9ac0, text=text@entry=0x7f2c2a9a9f30, textbuf=textbuf@entry=0x7f2c2a9a9b40 "", textlen=256) at ../../../../servers/slapd/back-mdb/modify.c:419 #6 0x00000000004f6cfa in mdb_modify (op=0x7f2c2a9a9ff0, rs=0x7f2c2a9a9f10) at ../../../../servers/slapd/back-mdb/modify.c:714 #7 0x00000000004d5833 in overlay_op_walk (op=0x7f2c2a9a9ff0, rs=0x7f2c2a9a9f10, which=<optimized out>, oi=0xfc1a00, on=0x0) at ../../../servers/slapd/backover.c:706 #8 over_op_func (op=0x7f2c2a9a9ff0, rs=0x7f2c2a9a9f10, which=op_modify) at ../../../servers/slapd/backover.c:766 #9 0x00007f2c6be56a95 in ppolicy_bind_response (op=<optimized out>, rs=0x7f2c2a9aa730) at ../../../../servers/slapd/overlays/ppolicy.c:1827 #10 0x0000000000475878 in slap_response_play (op=0x7f2c201039a0, rs=0x7f2c2a9aa730) at ../../../servers/slapd/result.c:567 #11 send_ldap_response (op=op@entry=0x7f2c201039a0, rs=rs@entry=0x7f2c2a9aa730) at ../../../servers/slapd/result.c:642 #12 0x0000000000475f2c in slap_send_ldap_result (op=0x7f2c201039a0, rs=0x7f2c2a9aa730) at ../../../servers/slapd/result.c:918 #13 0x000000000052b6cf in mdb_bind (op=0x7f2c201039a0, rs=0x7f2c2a9aa730) at ../../../../servers/slapd/back-mdb/bind.c:148 #14 0x00000000004d5833 in overlay_op_walk (op=0x7f2c201039a0, rs=0x7f2c2a9aa730, which=<optimized out>, oi=0xfc1a00, on=0x0) at ../../../servers/slapd/backover.c:706 #15 over_op_func (op=0x7f2c201039a0, rs=0x7f2c2a9aa730, which=op_bind) at ../../../servers/slapd/backover.c:766 #16 0x00000000004824f2 in fe_op_bind (op=0x7f2c201039a0, rs=0x7f2c2a9aa730) at ../../../servers/slapd/bind.c:383 #17 0x00000000004822ea in do_bind (op=0x7f2c201039a0, rs=0x7f2c2a9aa730) at ../../../servers/slapd/bind.c:206 #18 0x0000000000466847 in connection_operation (ctx=<optimized out>, ctx@entry=0x7f2c2a9aa9b8, arg_v=arg_v@entry=0x7f2c201039a0) at ../../../servers/slapd/connection.c:1113 #19 0x0000000000465ec1 in connection_read_thread (ctx=<optimized out>, argv=0x11) at ../../../servers/slapd/connection.c:1265 #20 0x00007f2c72d5ea22 in ldap_int_thread_pool_wrapper (xpool=<optimized out>) at ../../../libraries/libldap/tpool.c:1053 #21 0x00007f2c70f5b1cf in start_thread () from /lib64/libpthread.so.0 #22 0x00007f2c70bc6e73 in clone () from /lib64/libc.so.6 ``` -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 9997] New: Potential memory leak in servers/slapd/syncrepl.c
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=9997 Issue ID: 9997 Summary: Potential memory leak in servers/slapd/syncrepl.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: 1061499390(a)qq.com Target Milestone: --- Version: Github:master Potential memory leak in syncrepl.c line 605.Calling ldap_search_ext_s() without calling ldap_msgfree() to free the memory will cause a memory leak. Doc says "Note that res parameter of ldap_search_ext_s() and ldap_search_s() should be freed with ldap_msgfree() regardless of return value of these functions." in https://www.openldap.org/software/man.cgi?query=ldap_search_ext_s&apropos=0… -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 9990] New: Part of the ITS#8698 fix breaks exop overlays that set a callback
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=9990 Issue ID: 9990 Summary: Part of the ITS#8698 fix breaks exop overlays that set a callback Product: OpenLDAP Version: 2.5.13 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: subbarao(a)computer.org Target Milestone: --- We have a password exop overlay that sets up a callback, which has stopped working when upgrading to 2.5.13. and I tracked it down to a change to servers/slapd/passwd.c implemented as part of the fix for ITS#8698: https://git.openldap.org/openldap/openldap/-/merge_requests/304/diffs?commi… It appears that the intent of this change was to loop through the o_callback list and only remove the cb callback created in this section of the code. But that isn't necessary because the cb callback never gets added to the original list. With this change, line 295 clobbers the original o_callback list which never gets restored -- that's why our exop overlay stopped working. Fortunately, the fix is very simple -- just revert this part of the change. The original code already saved/restored the o_callback list properly. When I reverted this part of the change, our exop overlay resumed working, and the rest of the ITS#8698 functionality (messages from the pwdCheckModule module being returned to the user) also worked as expected. -- You are receiving this mail because: You are on the CC list for the issue.

1 13

[Issue 10035] New: TLSv1.3 cipher suites can be set incorrectly
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10035 Issue ID: 10035 Summary: TLSv1.3 cipher suites can be set incorrectly Product: OpenLDAP Version: 2.6.4 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: ipuleston(a)sonicwall.com Target Milestone: --- I noticed that, on the client side, when I use LDAP_OPT_X_TLS_CIPHER_SUITE to set an OpenSSL cipher-suites list that contains a TLSv1.3 cipher suite, that may or may not get set correctly, depending on where it is located in the list. The following is what I am seeing with TLS versions 1.2 and 1.3 enabled: If I set this cipher-suites list: "3DES:TLS_AES_128_GCM_SHA256:!eNULL" Then WireShark shows shows it offering these ciphers in the TLS Client Hello, which is correct (the single given TLSv1.3 suite, plus 6 using 3-DES): Cipher Suites (7 suites) Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301) Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008) Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) However, if I set this cipher-suites list: "!eNULL:3DES:TLS_AES_128_GCM_SHA256" Then it now incorrectly offers two additional TLSv1.3 suites: Cipher Suites (9 suites) Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302) Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303) Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301) Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008) Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) Those first three are all of the TLSv3 ciphers supported by OpenSSL in this system. -- You are receiving this mail because: You are on the CC list for the issue.

1 7

[Issue 10003] New: Potential Use After Free in libraries/libldap/open.c
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10003 Issue ID: 10003 Summary: Potential Use After Free in libraries/libldap/open.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: 1061499390(a)qq.com Target Milestone: --- Version: Github:master Potential Use After Free in open.c line 590. Doc says "Once it(ldap_unbind) is called, the connection to the LDAP server is closed, and the ld structure is invalid." in https://www.openldap.org/software/man.cgi?query=ldap_unbind_ext&apropos=0&s… -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 9998] New: Potential memory leak in tests/progs/slapd-mtread.c
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=9998 Issue ID: 9998 Summary: Potential memory leak in tests/progs/slapd-mtread.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: test suite Assignee: bugs(a)openldap.org Reporter: 1061499390(a)qq.com Target Milestone: --- Version: Github:master Potential memory leak in slapd-mtread.c line 520.Calling ldap_search_ext_s() without calling ldap_msgfree() to free the memory will cause a memory leak. Doc says "Note that res parameter of ldap_search_ext_s() and ldap_search_s() should be freed with ldap_msgfree() regardless of return value of these functions." in https://www.openldap.org/software/man.cgi?query=ldap_search_ext_s&apropos=0… -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10048] New: adding a regex entry for overlay variant crashes slapd
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10048 Issue ID: 10048 Summary: adding a regex entry for overlay variant crashes slapd Product: OpenLDAP Version: 2.6.4 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: stefan(a)kania-online.de Target Milestone: --- I'm using symas-packages 2.6.4 on a Debian 11 system. Two providers with multi provider replication. I try to add different entries wit overlay "variant" first without regex. Here my ldif for the configuration: ----------- dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: variant.la ----------- ----------- dn: olcOverlay={2}variant,olcDatabase={2}mdb,cn=config objectClass: olcVariantConfig olcVariantPassReplication: TRUE dn: name=global-addr,olcOverlay={2}variant,olcDatabase={2}mdb,cn=config objectClass: olcVariantVariant olcVariantEntry: dc=example,dc=net dn: olcVariantVariantAttribute=postaladdress,name={0}global-addr,olcOverlay={2}variant,olcDatabase={2}mdb,cn=config objectClass: olcVariantAttribute olcVariantVariantAttribute: postaladdress olcVariantAlternativeAttribute: postaladdress olcVariantAlternativeEntry: ou=firma,dc=example,dc=net dn: name=company-phone,name={0}global-addr,olcOverlay={2}variant,olcDatabase={2}mdb,cn=config objectClass: olcVariantAttribute olcVariantVariantAttribute: telephonenumber olcVariantAlternativeAttribute: mobile olcVariantAlternativeEntry: cn=verw-al,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net ----------- That works as expected. Then I wrote a ldif-file for variant WITH regex: ----------- dn: name=verw-tel,olcOverlay={2}variant,olcDatabase={2}mdb,cn=config objectClass: olcVariantRegex olcVariantEntryRegex: cn=.+,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net dn: olcVariantVariantAttribute=telephonNumber,name={1}verw-tel,olcOverlay={2}variant,olcDatabase={2}mdb,cn=config objectClass: olcVariantAttributePattern olcVariantVariantAttribute: telephoneNumber olcVariantAlternativeAttribute: telephoneNumber olcVariantAlternativeEntryPattern: ou=Verwaltung,ou=firma,dc=example,dc=net ----------- When I try to add the ldif with ldapadd slapd crashes with the following messages in the log: --------------- May 06 08:16:28 provider02 slapd[8018]: conn=1001 fd=20 ACCEPT from PATH=/var/symas/run/ldapi (PATH=/var/symas/run/ldapi) May 06 08:16:28 provider02 slapd[8018]: conn=1001 op=0 BIND dn="" method=163 May 06 08:16:28 provider02 slapd[8018]: conn=1001 op=0 BIND authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" May 06 08:16:28 provider02 slapd[8018]: conn=1001 op=0 BIND dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71 May 06 08:16:28 provider02 slapd[8018]: conn=1001 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000146 text= May 06 08:16:28 provider02 slapd[8018]: conn=1001 op=1 ADD dn="name=verw-tel,olcOverlay={2}variant,olcDatabase={2}mdb,cn=config" May 06 08:16:28 provider02 slapd[8018]: slap_get_csn: conn=1001 op=1 generated new csn=20230506081628.055320Z#000000#001#000000 manage=1 May 06 08:16:28 provider02 slapd[8018]: slap_queue_csn: queueing 0x7f7c64012890 20230506081628.055320Z#000000#001#000000 May 06 08:16:28 provider02 slapd[8018]: olcVariantEntryRegex: value #0: <olcVariantEntryRegex> handler exited with 19! May 06 08:16:28 provider02 systemd[1]: symas-openldap-server.service: Main process exited, code=killed, status=11/SEGV May 06 08:16:28 provider02 systemd[1]: symas-openldap-server.service: Failed with result 'signal'. --------------- Even if olcVariantEntryRegex is wrong (what I don't know up to now) slapd should not crash. -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10015] New: Config File KEEPALIVE_IDLE KEEPALIVE_PROBES KEEPALIVE_INTERVAL parser does random memory write
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10015 Issue ID: 10015 Summary: Config File KEEPALIVE_IDLE KEEPALIVE_PROBES KEEPALIVE_INTERVAL parser does random memory write Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: sean(a)teletech.com.au Target Milestone: --- In openldap/libraries/libldap/init.c: [master branch] The Config File integers KEEPALIVE_IDLE KEEPALIVE_PROBES KEEPALIVE_INTERVAL Should be struct ol_attribute.type ATTR_OPT_INT rather than ATTR_INT. ATTR_INT interprets struct ol_attribute.offset as a pointer to integer. ATTR_OPT_INT interprets struct ol_attribute.offset as an option number to be passed to ldap_set_option() -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 10016] New: syncprov may abandon a psearch improperly
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10016 Issue ID: 10016 Summary: syncprov may abandon a psearch improperly Product: OpenLDAP Version: 2.5.13 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: hyc(a)openldap.org Target Milestone: --- When processing an Abandon, it may remove the detached search op from the connection while the qtask is actively sending search responses on the connection. If the Abandon is due to an Unbind or connection loss, the connection structure may get reused by a new conn while the qtask is still running. -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 9953] New: Push replication issue for the pwdHistory attribute
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=9953 Issue ID: 9953 Summary: Push replication issue for the pwdHistory attribute Product: OpenLDAP Version: 2.4.57 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: dh(a)dotlan.net Target Milestone: --- Hello, I'm using a master ldap instance with a push replication instance to external slaves using the ldap backend on Debian 11 (2.4.57) and I came across some replication issues that forces me to drop the slave dbs and do a manually fullsync everything this error occurs. The problem =========== I know that replication and maintaining a password policy is a complicated task, especially since the ppolicy overlay must be loaded and active in every instance (master, push instance, slave). This problem leads to interesting challanges. First, I encountered a problem where pwdChangedTime would be duplicate because the ppolicy overlay of the push instance and the back_ldap/slave instance would like to set it (which leads to a duplicate attribute error). To fix problem I backported the patch [1] to my local version of the slapd packages. After this problem was fixed, I've encountered the next problematic attribute: "pwdHistory". I've play around with some syncrepl settings, but in the end, it seems to be a similar issue. It looks likes the pwdHistory attribute is not yet present on the slave and both instances (push and slave) try to add the pwdHistory Attributes which leads to a problem where both entries collied (pwdHistory: value #0 already exists). For whatever reason pwdHistory doesn't show up as modified field on the slave in the MOD request. But anyways. Something seems to be wrong, and it could a similar replication issue compared with pwdChangedTime I've lookup into the change history of the ppolicy.c file in the 2.5 and 2.6 branch but couldn't find a newer commit that would address this issue. Does anyone has encountered a similar issue? I've not played around with the 2.5 or 2.6 version, but looking at the code, I've either not seen a fix or the problem might still exist, hopefully I am wrong. Any suggestions? -- best regards Daniel Hoffend [1] https://github.com/openldap/openldap/commit/7a34f46d1cabe8e80937d5167b62152… Setup ===== Host Master - Debian 11 slapd 2.4.57+dfsg-3 - slapd master instance with cn=config - push replikation instance with simple config (syncrepl from localhost, write to backend ldap) Host Slave - Debian 11 slapd 2.4.57+dfsg-3 - Readonly slave On all 3 instances ppolicy is enabled otherwise the operational attributes would be not known/available and sync of locked accounts or per account selected password policy assignment wouldn't work. PUSH Replication Instance ========================= database ldap [...] overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=org" syncrepl rid=__RID__ provider=ldap://localhost:389/ binddn="cn=replication,ou=system,dc=example,dc=org" bindmethod=simple credentials="secret" searchbase="dc=example,dc=org" type=refreshAndPersist schemachecking=off retry="5 12 60 +" attrs="*,memberOf,pwdPolicySubentry,pwdChangedTime,pwdAccountLockedTime,pwdHistory,creatorsName,createTimestamp,modifiersName,modifyTimestamp" --- Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_message_to_entry: rid=016 DN: uid=user1,ou=accounts,dc=example,dc=org, UUID: db720f56-df0d-103c-8635-9543ccd6e97d Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid a0a89700 Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 be_search (0) Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 uid=user1,ou=accounts,dc=example,dc=org Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_null_callback : error code 0x14 Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 be_modify uid=user1,ou=accounts,dc=example,dc=org (20) Nov 3 00:00:45 ldapmaster slapd[2308611]: syncrepl_entry: rid=016 be_modify failed (20) Nov 3 00:00:45 ldapmaster slapd[2308611]: do_syncrepl: rid=016 rc 20 retrying SLAVE LDAP Server ================= database mdb [...] overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=org" --- Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176499 op=59513 SRCH base="uid=user1,ou=accounts,dc=example,dc=org" scope=0 deref=0 filter="(objectClass=*)" Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176499 op=59513 SEARCH RESULT tag=101 err=0 nentries=1 text= Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176500 op=59513 MOD dn="uid=user1,ou=accounts,dc=example,dc=org" Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176500 op=59513 MOD attr=structuralObjectClass creatorsName createTimestamp userPassword pwdChangedTime memberOf entryCSN modifiersName modifyTimestamp Nov 3 00:00:45 ldapslave slapd[2221506]: conn=176500 op=59513 RESULT tag=103 err=20 text=modify/add: pwdHistory: value #0 already exists -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 10004] New: Potential memory leak in libraries/librewrite/ldapmap.c
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10004 Issue ID: 10004 Summary: Potential memory leak in libraries/librewrite/ldapmap.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: 1061499390(a)qq.com Target Milestone: --- Version: Github:master Potential memory leak in ldapmap.c line 310, 321.Calling ldap_initialize() without calling ldap_unbind_ext() to free the memory will cause a memory leak. There is no ldap_unbind_ext before calling ldap_initialize in line 376, and the ld will be allocated again. -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10037] New: Instructions for building argon2.so are inaccurate
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10037 Issue ID: 10037 Summary: Instructions for building argon2.so are inaccurate Product: OpenLDAP Version: 2.6.4 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: documentation Assignee: bugs(a)openldap.org Reporter: sclassen(a)lbl.gov Target Milestone: --- The instructions for building the argon2.so shared library are inaccurate. According to: servers/slapd/pwmods/README.argon2 Building -------- 1) Customize the OPENLDAP variable in Makefile to point to the OpenLDAP source root. For initial testing you might also want to edit DEFS to define SLAPD_ARGON2_DEBUG, which enables logging to stderr (don't leave this on in production, as it prints passwords in cleartext). 2) Run 'make' to produce argon2.so 3) Copy argon2.so somewhere permanent. 4) Edit your slapd.conf (eg. /etc/ldap/slapd.conf), and add: moduleload ...path/to/argon2.so 5) Restart slapd. When I run make from within servers/slapd/pwmods/ I get the following error: [user@machine openldap-2.6.4]# cd servers/slapd/pwmods/ [user@machine pwmods]# make make: *** No rule to make target 'dummyvalue', needed by 'all-common'. Stop. I’m not sure what “dummyvalue” is supposed to be so I commented out line 288 in servers/slapd/pwmods/Makefile # LIBRARY = dummyvalue And get this error: [user@ machine pwmods]# make /bin/sh ../../../libtool --tag=disable-static --mode=compile cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -DSLAPD_IMPORT -c version.c libtool: compile: cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -DSLAPD_IMPORT -c version.c -fPIC -DPIC -o .libs/version.o version.c:1:6: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘:’ token usage: mkversion [-c] [-s] [-p package] [-v version] application ^ make: *** [Makefile:310: version.lo] Error 1 -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10033] New: olcDbCacheSize in mdb configuration example
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10033 Issue ID: 10033 Summary: olcDbCacheSize in mdb configuration example Product: OpenLDAP Version: 2.6.0 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: documentation Assignee: bugs(a)openldap.org Reporter: stefan(a)kania-online.de Target Milestone: --- on Page: https://openldap.org/doc/admin26/overlays.html#The%20Proxy%20Cache%20Engine There is an example for pcache-db configuration for a mdb-database: ----------- dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcMdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}mdb olcDbDirectory: ./testrun/db.2.a olcDbCacheSize: 20 olcDbIndex: objectClass eq olcDbIndex: cn,sn,uid,mail pres,eq,sub ----------- But olcDbCacheSize is an bdb/hdb attribute. -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 9999] New: Potential memory leak in tests/progs/slapd-search.c
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=9999 Issue ID: 9999 Summary: Potential memory leak in tests/progs/slapd-search.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: test suite Assignee: bugs(a)openldap.org Reporter: 1061499390(a)qq.com Target Milestone: --- Version: Github:master Potential memory leak in slapd-search.c line 207.Calling ldap_search_ext_s() without calling ldap_msgfree() to free the memory will cause a memory leak. Doc says "Note that res parameter of ldap_search_ext_s() and ldap_search_s() should be freed with ldap_msgfree() regardless of return value of these functions." in https://www.openldap.org/software/man.cgi?query=ldap_search_ext_s&apropos=0… -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 10046] New: Wrong ObjectClass Name in example in manpage slapo-variant
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10046 Issue ID: 10046 Summary: Wrong ObjectClass Name in example in manpage slapo-variant Product: OpenLDAP Version: 2.6.4 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: documentation Assignee: bugs(a)openldap.org Reporter: stefan(a)kania-online.de Target Milestone: --- Manpage is telling: ---------- # share the Headquarters' address as the company address dn: olcVariantVariantAttribute=postaladdress,name={0}example,olcOverlay={x}variant,$DATABASE objectClass: olcVariantVariantAttribute olcVariantVariantAttribute: postaladdress olcVariantAlternativeAttribute: postaladdress olcVariantAlternativeEntry: ou=Headquarters,dc=example,dc=com ---------- But the name of the ObjectClass is objectClass=olcVariantAttribute -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 9996] New: Potential memory leak in libraries/librewrite/ldapmap.c
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=9996 Issue ID: 9996 Summary: Potential memory leak in libraries/librewrite/ldapmap.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: 1061499390(a)qq.com Target Milestone: --- Version: Github:master Potential memory leak in ldapmap.c line 359.Calling ldap_search_ext_s() without calling ldap_msgfree() to free the memory will cause a memory leak. Doc says "Note that res parameter of ldap_search_ext_s() and ldap_search_s() should be freed with ldap_msgfree() regardless of return value of these functions." in https://www.openldap.org/software/man.cgi?query=ldap_search_ext_s&apropos=0… -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10030] New: Add support for OpenSSL 3.0 to 2.5 stable release
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10030 Issue ID: 10030 Summary: Add support for OpenSSL 3.0 to 2.5 stable release Product: OpenLDAP Version: 2.5.14 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- As OpenSSL 1.1.1 is being sunset September 2023 we will need to add OpenSSL 3.0 support to the 2.5 series. -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10041] New: unnecessary dynlist evaluation
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10041 Issue ID: 10041 Summary: unnecessary dynlist evaluation Product: OpenLDAP Version: 2.5.14 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: overlays Assignee: bugs(a)openldap.org Reporter: david.coutadeur(a)gmail.com Target Milestone: --- Created attachment 963 --> https://bugs.openldap.org/attachment.cgi?id=963&action=edit openldap config + data for showing the dynlist usecase Evaluation of member of dynamic groups by dynlist can be slow. However, in some context, the evaluation is not necessary, especially when searching object that are not dynamic groups. You can find attached a configuration and data file showing the use case: - 10000 users - 100 static groups - 5000 dynamic groups, with a filter (&(uid=user*)(objectClass=person), grabbing all users Example of "normal" slow search ~ 115s: ldapsearch -x -H 'ldap://localhost:389/' -D 'uid=admin,ou=people,dc=my-organization,dc=com' -w 'secret' -b 'ou=groups,dc=my-organization,dc=com' '(member=uid=user1,ou=people,dc=my-organization,dc=com)' Example of abnormal slow search ~ 115s: ldapsearch -x -H 'ldap://localhost:389/' -D 'uid=admin,ou=people,dc=my-organization,dc=com' -w 'secret' -b 'ou=groups,dc=my-organization,dc=com' '(&(objectClass=groupOfNames)(member=uid=user1,ou=people,dc=my-organization,dc=com))' Here, the filter about the objectClass could be evaluated first to avoid unnecessary search in dynamic groups. Example of rapid search with DSA IT ~ 1ms: ldapsearch -x -H 'ldap://localhost:389/' -D 'uid=admin,ou=people,dc=my-organization,dc=com' -w 'secret' -b 'ou=groups,dc=my-organization,dc=com' '(&(objectClass=groupOfNames)(member=uid=user1,ou=people,dc=my-organization,dc=com))' -M -- You are receiving this mail because: You are on the CC list for the issue.

1 8

[Issue 10000] New: Potential memory leak in tests/progs/slapd-watcher.c
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10000 Issue ID: 10000 Summary: Potential memory leak in tests/progs/slapd-watcher.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: test suite Assignee: bugs(a)openldap.org Reporter: 1061499390(a)qq.com Target Milestone: --- Version: Github:master Potential memory leak in slapd-watcher.c line 517.Calling ldap_search_ext_s() without calling ldap_msgfree() to free the memory will cause a memory leak. Doc says "Note that res parameter of ldap_search_ext_s() and ldap_search_s() should be freed with ldap_msgfree() regardless of return value of these functions." in https://www.openldap.org/software/man.cgi?query=ldap_search_ext_s&apropos=0… -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10023] New: Asynchronous connects are broken
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10023 Issue ID: 10023 Summary: Asynchronous connects are broken Product: OpenLDAP Version: 2.5.14 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: ipuleston(a)sonicwall.com Target Milestone: --- We have a port of OpenLDAP client running in an embedded system, which is using asynchronous connects to the LDAP server. We have been using OpenLDAP 2.4.40 for a long time, and I just upgraded it to use 2.5.14 (as the current LTS release). After doing this, async connects to the LDAP server no longer work. You can see this in the following debug output: A successful async connect with 2.4.40: ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP Ian-DC1.sd80.com:389 ldap_pvt_gethostbyname_a: host=Ian-DC1.sd80.com, r=0 ldap_new_socket: 251 ldap_prepare_socket: 251 ldap_connect_to_host: Trying 192.168.168.3:389 ldap_pvt_connect: fd: 251 tm: 10 async: -1 ldap_ndelay_on: 251 attempting to connect: connect errno: 115 ldap_int_poll: fd: -1 tm: 0 A failed async connect with 2.5.14: ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP Ian-DC1.sd80.com:389 ldap_pvt_gethostbyname_a: host=Ian-DC1.sd80.com, r=0 ldap_new_socket: 247 ldap_prepare_socket: 247 ldap_connect_to_host: Trying 10.21.61.3:389 ldap_pvt_connect: fd: 247 tm: 10 async: -1 ldap_ndelay_on: 247 attempting to connect: connect errno: 115 ldap_open_defconn: successful ldap_send_server_request Sending Bind Request, len=0x6ca10c1f ldap_write: want=63 error=Resource temporarily unavailable Note that in both cases the connect attempt returns errno 115, EINPROGRESS, meaning that it has not completed. But after that: ● 2.4.40 calls ldap_int_poll (via ldap_send_initial_request -> ldap_int_check_async_open) to begin the wait for async completion. ● 2.5.14 instead reports a successful connect, and tries to send the bind which fails since thre socket is not yet connected. I tracked the problem down to a change made for ITS #8022 "an async connect may still succeed immediately" in this commit: https://git.openldap.org/openldap/openldap/-/commit/ae6347bac12bbf843678a83… That change in ldap_new_connection makes it set lconn_status for an async connect to LDAP_CONNST_CONNECTED rather than LDAP_CONNST_CONNECTING if ldap_int_open_connection returns 0. The problem is that ldap_int_open_connection returns 0 after getting the EINPROGRESS. ldap_connect_to_host returns -2 for the latter, but ldap_int_open_connection doesn't check for that, returning 0 for any return code other than -1. I think that the bug is actually in ldap_int_open_connection rather than in the above commit. It should probably return -2 when ldap_connect_to_host returns that. -- You are receiving this mail because: You are on the CC list for the issue.

1 18

[Issue 10011] New: Incompatibilities with stricter C99 compilers
by openldap-its＠openldap.org 10 Jul '23

10 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10011 Issue ID: 10011 Summary: Incompatibilities with stricter C99 compilers Product: OpenLDAP Version: 2.6.4 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: build Assignee: bugs(a)openldap.org Reporter: sam(a)gentoo.org Target Milestone: --- Newer C compilers (>= Clang 16 and likely >= GCC 14) reject some constructs removed in C99 like implicit function declarations and implicit ints. Some compilers are also starting to reject obsolete K&R prototypes which were removed in C23. I've filed an MR at https://git.openldap.org/openldap/openldap/-/merge_requests/605 to address the issues in configure as well as a small number of issues in the codebase itself. For more information, see LWN.net [0] or LLVM's Discourse [1], the Gentoo wiki [2], or the (new) c-std-porting mailing list [3]. [0] https://lwn.net/Articles/913505/ [1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-… [2] https://wiki.gentoo.org/wiki/Modern_C_porting [3] hosted at lists.linux.dev. -- You are receiving this mail because: You are on the CC list for the issue.

1 7

[Issue 10079] New: Facing syncrepl issue after selecting filter and attrs
by openldap-its＠openldap.org 06 Jul '23

06 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10079 Issue ID: 10079 Summary: Facing syncrepl issue after selecting filter and attrs Product: OpenLDAP Version: 2.4.49 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: ramprasad.sharma(a)orange.com Target Milestone: --- I'm facing an issue, when I'm using replication without filter and attrs, it works fine but when I try it with filter and attrs , I get nentries=0 and replication dont happen.. what could be the possible issue, I tried many thing.. syncrepl rid=<%= @%> provider=ldaps://master.<%= @%>h:636/ bindmethod=simple binddn="cn=replication,dc=di-diod,dc=tech" credentials=<%= @%> searchbase="ou=people,dc=di-diod,dc=tech" filter="(objectClass=posixAccount)" attrs="cn,uid,x1sshPubKey,x2sshPubKey,uidNumber,gidNumber,homeDirectory,gecos,loginShell,description,sshPublicKey" scope=sub schemachecking=on type=refreshOnly interval=00:00:00:01 retry="30 5 300 3" I can use any help on call also.. -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 10078] New: segfault error 4 in in dynlist-2.5.so.0.1.8
by openldap-its＠openldap.org 05 Jul '23

05 Jul '23

https://bugs.openldap.org/show_bug.cgi?id=10078 Issue ID: 10078 Summary: segfault error 4 in in dynlist-2.5.so.0.1.8 Product: OpenLDAP Version: 2.5.13 Hardware: All OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: gustav(a)spllg.de Target Milestone: --- whenever i execute an ldapsearch, slapd crashes and i find the following lines in /var/log/syslog segfault at 0 ip 00007f876bece9c1 sp 00007f876a1fc0c0 error 4 in dynlist-2.5.so.0.1.8[7f876becb000+6000] likely on CPU 0 (core 0, socket 0) Code: 48 29 d0 48 89 d7 48 89 c1 31 c0 83 c1 6c c1 e9 03 f3 48 ab 48 8b 84 24 10 02 00 00 4c 89 ef c7 84 24 a0 00 00 00 03 00 00 00 <48> 8b 00 ff 50 78 44 39 73 64 74 09 45 84 e4 0f 85 22 03 00 00 48 Stopping OpenLDAP: slapd. slapd.service: Deactivated successfully. the database had been imported from ldap-2.4.57 where ldap runs fine. is there anything i can do to fix the problem? -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 10075] New: back-sql regression between 2.4.40 and 2.4.44
by openldap-its＠openldap.org 28 Jun '23

28 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=10075 Issue ID: 10075 Summary: back-sql regression between 2.4.40 and 2.4.44 Product: OpenLDAP Version: 2.4.44 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: backends Assignee: bugs(a)openldap.org Reporter: daniel.walker(a)ncas.ac.uk Target Milestone: --- I have just upgraded from CentOS6 to CentOS7 ( I know, not my pick :). On OpenLdap back-sql 2.4.40 on CentOS6, this seems to be honoured: "Multiple attributeType definitions are allowed for an entry; that is, multiple ldap_attr_mappings rows can refer to the same ldap_oc_mappings row with the same name; the resulting attribute values are honored for multivalued attributes in search filters, in search results, in compare AVAs. However, only rules according to the first instance of that attributeType are followed in add, modify and delete operations. This limitation, under certain circumstances, may be removed in the future." (from https://www.openldap.org/faq/data/cache/978.html ) I was using this feature to get memberAddress attributes from two separate tables in my SQL (internal people and external people) Upon upgrading to 2.4.44 on CentOS7, the second entry is no longer honoured. Relevant entries: MariaDB [ncas_database]> SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=4 AND name='memberAddress'; +---------------+--------------------------------------+------------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------------+-------------+---------------+------------+ | name | sel_expr | from_tbls | join_where | add_proc | delete_proc | param_order | expect_return | sel_expr_u | +---------------+--------------------------------------+------------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------------+-------------+---------------+------------+ | memberAddress | CONCAT(emails.address,"@domain.name") | groups,people_groups AS ps,people,emails | groups.id=ps.group_id AND ps.person_id=people.id AND people.id=emails.person_id AND emails.main=1 AND (people.contract_end > NOW() OR people.contract_end IS NULL) | NULL | NULL | 3 | 0 | NULL | | memberAddress | email | groups,external_members | groups.id=external_members.group_id | NULL | NULL | 3 | 0 | NULL | +---------------+--------------------------------------+------------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+-------------+-------------+---------------+------------+ 2 rows in set (0.000 sec) The second one is ignored; no requests to the external_members table show in the logs. Is this a known bug? I did look through the archives, but I wasn't able to find it. -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 10069] New: Error when installing openldap from brew on Macos Catalina
by openldap-its＠openldap.org 22 Jun '23

22 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=10069 Issue ID: 10069 Summary: Error when installing openldap from brew on Macos Catalina Product: OpenLDAP Version: 2.6.4 Hardware: x86_64 OS: Mac OS Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: build Assignee: bugs(a)openldap.org Reporter: marianogedisman(a)gmail.com Target Milestone: --- Hello! I'm getting this error when installing from Homebrew on MacOS Catalina: ==> ./configure --prefix=/usr/local/Cellar/openldap/2.6.4 --sysconfdir=/usr/loca n==> make install Error: inreplace failed /usr/local/etc/openldap/slapd.conf: expected replacement of #<Pathname:/usr/local/Cellar/openldap/2.6.4> with #<Pathname:/usr/local/opt/openldap> /usr/local/etc/openldap/slapd.ldif: expected replacement of #<Pathname:/usr/local/Cellar/openldap/2.6.4> with #<Pathname:/usr/local/opt/openldap> -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 4066] Uniqueness overlay incorrectly checks for dupes with MODs outside of its seach base
by openldap-its＠openldap.org 19 Jun '23

19 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=4066 --- Comment #6 from knotmecute <kmcbacklink(a)gmail.com> --- https://knotmecute.com/ https://knotmecute.com/handmade/banjaran-collection/ https://knotmecute.com/handmade/mehfil-collection/ -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 4066] Uniqueness overlay incorrectly checks for dupes with MODs outside of its seach base
by openldap-its＠openldap.org 19 Jun '23

19 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=4066 --- Comment #5 from knotmecute <kmcbacklink(a)gmail.com> --- Step into the vibrant world of Knotmecute's Banjaran collection, where exquisite bohemian jewelry takes center stage, inspired by tribal aesthetics and vibrant cultures. Our brand strives to revive the rich heritage art of tribes, incorporating abstract patterns and colorful mirror work into stunning pieces that make a bold and stylish statement. Crafted with meticulous precision and attention to detail, our luxury bohemian jewels are designed to complement a variety of occasions, from carefree beach travels to destination weddings. Each piece is thoughtfully created to evoke a sense of wanderlust and adventure, adding a touch of boho charm to your jewelry ensemble. The Banjara collection offers a wide range of accessories that cater to every woman's unique style and trending preferences. Whether you desire a statement necklace to elevate your evening attire or vibrant earrings to accentuate your beachy look, we have the perfect piece to fulfill your needs. Every jewelry piece in the Banjara collection is a work of art, meticulously handcrafted with vibrant colors, intricate mirror work, and captivating patterns. These colorful jewels go beyond being mere accessories—they carry a personalized touch, reflecting the essence of your vibrant spirit. Embrace the beauty of bohemian aesthetics with Knotmecute's Banjara brand. Discover our collection and adorn yourself with these stunning jewels that will turn heads wherever you go. Experience the joy of wearing luxurious, colorful bohemian jewelry that reflects your individuality and leaves a lasting impression. -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10066] New: fsync -> fcntl(F_FULLFSYNC) on Apple platforms?
by openldap-its＠openldap.org 15 Jun '23

15 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=10066 Issue ID: 10066 Summary: fsync -> fcntl(F_FULLFSYNC) on Apple platforms? Product: LMDB Version: unspecified Hardware: All OS: Mac OS Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: liblmdb Assignee: bugs(a)openldap.org Reporter: christophersauer(a)pacbell.net Target Milestone: --- Hi, Howard, I was thinking of adopting LMDB for a cross-platform project, but when quickly browsing the code, didn't see specializations for Apple platform' weakened fsync -> fcntl(F_FULLFSYNC). (Doc quick link, if useful: https://developer.apple.com/library/archive/documentation/System/Conceptual…) Should I be concerned? I think it's very likely that you're way ahead of me, but I just wanted to check in. (And couldn't otherwise find anything online about this.) Thanks so much for all you do! Chris -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 10054] New: Value size limited to 2,147,479,552 bytes
by openldap-its＠openldap.org 12 Jun '23

12 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=10054 Issue ID: 10054 Summary: Value size limited to 2,147,479,552 bytes Product: LMDB Version: unspecified Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: liblmdb Assignee: bugs(a)openldap.org Reporter: louis(a)meilisearch.com Target Milestone: --- Hello, According to the documentation[0], a database that is not using `MDB_DUPSORT` can store values up to `0xffffffff` bytes (around 4GB). In practice, under Linux, the actual limit is `0x7ffff000` though (2^31 - 4096, so around 2GB). This is due to the write loop in `mdb_page_flush`. The `wsize` value determining how many bytes will be written can be as big as `4096*dp->mp_pages`[1], and the number of overflow pages grows with the size of the value put inside the DB. The `wsize` is not split in smaller chunks in the case where there are many overflow pages to write, and as a result the call to `pwrite`[2] does not perform a full write, but only a "short" write of 2147479552 bytes (the maximum allowed on a call to `pwrite` on Linux[3]). This would be OK if the short write condition was handled by looping and performing another `pwrite` with the rest of the data, but instead `EIO` is returned[4]. There seems to be a related, but different issue on macOS when trying to `pwrite` more the 2^31 bytes, that was already reported[5]. This issue was reported to me by a Meilisearch user because it causes their database indexing to fail[6]. I had to investigate a bit because their setup was peculiar (high number of documents in their database) and the `EIO` error code is not very descriptive of the underlying issue. I join a C reproducer of the issue that attempts to add a 2147479553 bytes value to the DB and fails with `EIO` (decreasing `nb_items` to a smaller value such as `2107479552` does succeed)[7]. Thank you for making LMDB! Louis Dureuil. [0]: https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/lmdb.h#LL284… [1]: https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/mdb.c#LL3770… [2]: https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/mdb.c#L3820 [3]: https://stackoverflow.com/questions/70368651/why-cant-linux-write-more-than… [4]: https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/mdb.c#L3840 [5]: https://bugs.openldap.org/show_bug.cgi?id=9736 [6]: https://github.com/meilisearch/meilisearch/issues/3654 [7]: https://github.com/dureuill/lmdb_3654/tree/main -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 10062] New: How to store a data item of length greater than 511 in a dupsort db
by openldap-its＠openldap.org 12 Jun '23

12 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=10062 Issue ID: 10062 Summary: How to store a data item of length greater than 511 in a dupsort db Product: LMDB Version: 0.9.30 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: liblmdb Assignee: bugs(a)openldap.org Reporter: mega.alpha100(a)gmail.com Target Milestone: --- Is there a workaround to storing a data item with a length greater than the value of `fn mdb_env_get_maxkeysize()` or 511 in a dupsort db? Also, I tried to change the value of the `MDB_MAXKEYSIZE` macro but that led to an illegal instruction -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 10050] New: Use of stack allocated string in mdb_strerror
by openldap-its＠openldap.org 12 Jun '23

12 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=10050 Issue ID: 10050 Summary: Use of stack allocated string in mdb_strerror Product: LMDB Version: unspecified Hardware: All OS: Windows Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: liblmdb Assignee: bugs(a)openldap.org Reporter: es(a)m-labs.hk Target Milestone: --- https://git.openldap.org/openldap/openldap/-/blob/mdb.master/libraries/libl… This piece of code exists from 2014, and these lines are not working outside of MSVC. Moreover, they lead to segfaults in MINGW compiled environments. Please see the patch we use for potential fix: https://github.com/msys2/MINGW-packages/blob/31012dd33a32390d1e5f9b93388799… -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 10061] New: Query on setting TLSVerifyClient option set to demand
by openldap-its＠openldap.org 12 Jun '23

12 Jun '23

https://bugs.openldap.org/show_bug.cgi?id=10061 Issue ID: 10061 Summary: Query on setting TLSVerifyClient option set to demand Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: ramajay52(a)gmail.com Target Milestone: --- Dear Experts, In my case, I had set TLSVerifyClient to demand. I couldn't be able to establish a connection While providing TLSCACertificateFile alone. While setting the TLSVerifyClient option demand is it mandatory to provide the following option? 1. TLSCACertificateFile 2. TLSCertificateKeyFile 3. TLSCertificateFile Regards, Ram -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 8447] LMDB: Overwriting values in MDB_DUPSORT databases broken
by openldap-its＠openldap.org 25 May '23

25 May '23

https://bugs.openldap.org/show_bug.cgi?id=8447 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|TEST |FIXED --- Comment #6 from Quanah Gibson-Mount <quanah(a)openldap.org> --- Fixed in RE0.9: • 76bad923 by Howard Chu at 2023-05-25T19:33:44+00:00 ITS#8447 fix cursor_put(MDB_CURRENT) on DUPSORT DB with different-sized data -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 9736] New: pwrite bug in OSX breaking LMDB promise about the maximum value size
by openldap-its＠openldap.org 22 May '23

22 May '23

https://bugs.openldap.org/show_bug.cgi?id=9736 Issue ID: 9736 Summary: pwrite bug in OSX breaking LMDB promise about the maximum value size Product: LMDB Version: unspecified Hardware: All OS: Mac OS Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: liblmdb Assignee: bugs(a)openldap.org Reporter: renault.cle(a)gmail.com Target Milestone: --- Hi, I was working with LMDB and found an issue when trying to write a value of approximately 3.3GiB in the database, I dive into the LMDB source code of the mdb_put method using the lldb debugger and found out that it was not related to an issue in LMDB itself but rather a bug in the pwrite function of the Mac OS libc implementation. The pwrite function is given four parameters, the file descriptor, the buffer, the count of bytes to write from the buffer and, the offset of where to write it in the file. On Mac OS the count of bytes is a size_t that must be a 64bits unsigned integer but when you call pwrite with a number bigger or equal to 2^31 it returns an error 22 (invalid argument). LMDB was returning a 22 error from the mdb_put call and not an EINVAL because the error was cause by an internal issue and not something catchable by LMDB. I am not sure about what we can do, can we implement this single pwrite [1] as multiple pwrite with counts smaller than 2^31 in a loop, just for Mac OS? Like for Windows where we do specific things for this operating system too? I also found this issue on the RocksDB repository [2] about a similar problem they have with pwrite and write on Mac OS it seems. I understand that this is not a real promise that LMDB is specifying but rather an "in theory" rule [3]. Thank you for your time, kero [1]: https://github.com/LMDB/lmdb/blob/01b1b7dc204abdf3849536979205dc9e3a0e3ece/… [2]: https://github.com/facebook/rocksdb/issues/5169 [3]: http://www.lmdb.tech/doc/group__mdb.html#structMDB__val -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 10055] New: EOS EOL
by openldap-its＠openldap.org 19 May '23

19 May '23

https://bugs.openldap.org/show_bug.cgi?id=10055 Issue ID: 10055 Summary: EOS EOL Product: OpenLDAP Version: 2.4.44 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: documentation Assignee: bugs(a)openldap.org Reporter: andrew.hudson(a)rtx.com Target Milestone: --- Hello, I work with Raytheon Intelligence and Space. I just have a quick question. I am in charge of keeping track of the software that is on my program's environment. We are on version 2.4.44. I am just wondering what the End of Support and the end of life of this version. Thank you very much. Andrew Hudson -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 4501] jdbcldap: use of enum reserved work (Java 1.5)
by openldap-its＠openldap.org 15 May '23

15 May '23

https://bugs.openldap.org/show_bug.cgi?id=4501 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 4501] jdbcldap: use of enum reserved work (Java 1.5)
by openldap-its＠openldap.org 15 May '23

15 May '23

https://bugs.openldap.org/show_bug.cgi?id=4501 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|UNCONFIRMED |RESOLVED --- Comment #11 from Quanah Gibson-Mount <quanah(a)openldap.org> --- Commits: • f200ebd2 by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Set javac source="8". • 578fba58 by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Delete unused class Compare. JDK 1.5 removed the String.compareTo(Object) method so this class won't compile anymore, but luckily it's unused and can simply be deleted. • fa6c4c44 by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Replace use of 'enum' as an identifier. Java 1.5 made 'enum' a keyword, which may not be used as an identifier. • 339120d5 by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Replace use of deprecated class StringBufferInputStream. JDK 1.1 deprecated class StringBufferInputStream because it does not properly convert characters into bytes. • f494f56d by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Replace call to deprecated LDAPConnection.bind() method. JLDAP Sep_ndk_2003 deprecated LDAPConnection.bind(int, String, String) in favour of LDAPConnection.bind(int, String, byte[]). • 70b87f22 by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Replace call to deprecated File.toURL() method. JDK 6 deprecated File.toURL() in favour of File.toURI().toURL() because it does not automatically escape characters that are illegal in URLs. • 44c3341b by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Add @Deprecated annotations to deprecated interface methods. JDK 1.5 deprecated these interface methods so they should be annotated as deprecated also in this implementation of that interface. • 25e88de0 by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Use full package name to disambiguate ambiguous reference. JDK 8 introduced java.util.Base64 which has the same class name as com.novell.ldap.util.Base64 which this code calls. • 762419dc by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Add java.sql interface methods introduced by JDK 6. • 8432fbfe by Fredrik Roubert at 2023-02-18T18:27:29+01:00 ITS#4501 Add java.sql interface methods introduced by JDK 7. -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10053] New: liblber/idtest.c (and psap.h dependency) irrelevant to OpenLDAP
by openldap-its＠openldap.org 15 May '23

15 May '23

https://bugs.openldap.org/show_bug.cgi?id=10053 Issue ID: 10053 Summary: liblber/idtest.c (and psap.h dependency) irrelevant to OpenLDAP Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: ondra(a)mistotebe.net Target Milestone: --- configure.ac checks for psap.h presence, the only user being liblber's idtest.c - a test program that uses none of liblber API and claims to be part of ISODE X.500 code. I'm tempted to remove the configure check and the source file, letting that project adopt it if they still use it for something. -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 4501] jdbcldap: use of enum reserved work (Java 1.5)
by openldap-its＠openldap.org 11 May '23

11 May '23

https://bugs.openldap.org/show_bug.cgi?id=4501 --- Comment #10 from Shawn McKinney <smckinney(a)symas.com> --- (In reply to Fredrik Roubert from comment #9) > I never managed to find any documentation about what JAR files were needed, > so instead I used guesswork and Google to come up with this list on my own > for building with JDK 1.4.2: > > ant-1.7.0.jar > ant-junit-1.6.5.jar > ant-launcher-1.6.5.jar > jface-3.0.1.jar > junit-3.8.1.jar > novell-jldap-2013.08.30.1433-xplat.jar > swt-linux-gtk-3.0.1.jar > > I have no idea how correct that list might be, but at least it turned out to > be sufficent to make the build work. > > For building with JDK 8, the list becomes substantially smaller: > > jface-3.0.1.jar > novell-jldap-2013.08.30.1433-xplat.jar > swt-linux-gtk-3.0.1.jar Thanks, before I saw your reply, got it built with these (similar list): jldap-2009-10-07.jar junit-4.13.2.jar org.eclipse.jface-3.29.0.jar org.eclipse.swt.gtk.linux.x86_64-3.122.0.jar > > But I can't help wondering about JdbcLdapBrowserApp, whether that really is > something that is ever used by anyone anymore, for if it is not, you would > be able to simplify your codebase considerably by deleting all that source > code (and with that, the need for org.eclipse.swt and jfaces). Fortunately, these jars, other than jdbcldap, are recent, meaning they at least have no known CVE's outstanding? But, like you I'm left with the same thoughts. Who's using this, what parts can be sundowned, how do we test it, what to do next. -- Shawn -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 4501] jdbcldap: use of enum reserved work (Java 1.5)
by openldap-its＠openldap.org 10 May '23

10 May '23

https://bugs.openldap.org/show_bug.cgi?id=4501 --- Comment #9 from Fredrik Roubert <fredrik(a)roubert.name> --- I never managed to find any documentation about what JAR files were needed, so instead I used guesswork and Google to come up with this list on my own for building with JDK 1.4.2: ant-1.7.0.jar ant-junit-1.6.5.jar ant-launcher-1.6.5.jar jface-3.0.1.jar junit-3.8.1.jar novell-jldap-2013.08.30.1433-xplat.jar swt-linux-gtk-3.0.1.jar I have no idea how correct that list might be, but at least it turned out to be sufficent to make the build work. For building with JDK 8, the list becomes substantially smaller: jface-3.0.1.jar novell-jldap-2013.08.30.1433-xplat.jar swt-linux-gtk-3.0.1.jar But I can't help wondering about JdbcLdapBrowserApp, whether that really is something that is ever used by anyone anymore, for if it is not, you would be able to simplify your codebase considerably by deleting all that source code (and with that, the need for org.eclipse.swt and jfaces). -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10052] New: ldapsearch error "can't contact LDAP Server" <1%
by openldap-its＠openldap.org 10 May '23

10 May '23

https://bugs.openldap.org/show_bug.cgi?id=10052 Issue ID: 10052 Summary: ldapsearch error "can't contact LDAP Server" <1% Product: OpenLDAP Version: 2.4.44 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: client tools Assignee: bugs(a)openldap.org Reporter: w3eagle(a)yahoo.com Target Milestone: --- version used: 2.4.44 that is from Amazon2 core OS: AWS Linux2 Details: Users reported occasional issues with AD server authentication with MicroStrategy. Open case with MicroStrategy and learnt then use openldap library for the AD authentication. We were able to reproduce the issue with ldapsearch like below. ldapsearch -H ldaps://$REMOTEHOST:$REMOTEPORT \ -x -D "CN=??????" \ -y pssd.txt -LLL \ -b "OU=???????" "(sAMAccountName=????)" dn We use crontab to query AD once every minute, and we were able to see a few issues each day, error rate is more than 1/1000 but less than 1/100. The error looks like below - ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Not much info was logged other than this. We tried all kinds of stuff but it didn't help, eg. the ldap.conf settings to ignore certs validation, simplify the cert folder files etc. and the like. We think perhaps the TLS might be the issue, so we setup an nginx node within the same vpc, which communicates with AD server over TLS, but terminates TLS and talk to other ec2 with clear text. We were not able to see any errors. So we have proved, for some reason, then ldapsearch over ldaps fails with a low percentage. I previously reported case 10049, but it was closed. The message is like openldap is using other components for https/tls; so possibly bugs from other libraires. So to prove this issue is indeep on openldap, I schedule the same ldapsearch on the nginx box itself. Knowing nginx was using the same openssl library (openssl 1.0.2k), we reproduced the same, ~1% "can't contact LDAP server" error, on the nginx box. So this error is perhaps more related to openldap, or perhaps Cyrus SASL? (cyrus-sasl-lib 2.1.26). My question is whether this sounds like an openldap bug. Please advise. Thanks -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 10051] New: ldapsearch error can't contact LDAP <1%
by openldap-its＠openldap.org 10 May '23

10 May '23

https://bugs.openldap.org/show_bug.cgi?id=10051 Issue ID: 10051 Summary: ldapsearch error can't contact LDAP <1% Product: OpenLDAP Version: 2.4.44 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: client tools Assignee: bugs(a)openldap.org Reporter: w3eagle(a)yahoo.com Target Milestone: --- -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 10049] New: ldapsearch can't contact LDAP
by openldap-its＠openldap.org 10 May '23

10 May '23

https://bugs.openldap.org/show_bug.cgi?id=10049 Issue ID: 10049 Summary: ldapsearch can't contact LDAP Product: OpenLDAP Version: 2.4.44 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: w3eagle(a)yahoo.com Target Milestone: --- -- You are receiving this mail because: You are on the CC list for the issue.

1 5

[Issue 4501] jdbcldap: use of enum reserved work (Java 1.5)
by openldap-its＠openldap.org 10 May '23

10 May '23

https://bugs.openldap.org/show_bug.cgi?id=4501 --- Comment #8 from Shawn McKinney <smckinney(a)symas.com> --- I've setup a build env, using Java 8, apache ant 1.10, etc. Now, getting errors on missing dependencies, org.eclipse.swt.*, jfaces, ... I have not found instructions on openldap.org website how to build this. That's fine, certainly not something for this MR to address. But, before I go spend time chasing this down, are there steps written down? Doesn't have to be accurate, anything at all would help. Thanks -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10021] New: Cannot insert data into wiredtiger backend
by openldap-its＠openldap.org 27 Apr '23

27 Apr '23

https://bugs.openldap.org/show_bug.cgi?id=10021 Issue ID: 10021 Summary: Cannot insert data into wiredtiger backend Product: OpenLDAP Version: 2.6.4 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: backends Assignee: bugs(a)openldap.org Reporter: jailbird(a)fdf.net Target Milestone: --- I have a test system running OpenLDAP 2.6.4 linked against WiredTiger 11.1.0 running on a RHEL9.1-based system. Running kernel is 6.1.16, filesystem is XFS. back_wt.la was added to cn=module and a simple olcDatabase=wt was created like: dn: olcDatabase=wt objectClass: olcDatabaseConfig objectClass: olcWtConfig olcDatabase: wt olcDbDirectory: /var/lib/ldap olcSuffix: dc=fdf,dc=net olcLimits: {0}dn.base="cn=root,dc=fdf,dc=net" time.soft=unlimited time.hard=u nlimited size.soft=unlimited size.hard=unlimited olcRootDN: cn=root,dc=fdf,dc=net olcWtConfig: create olcDbIndex: objectClass,uid,gidNumber,uidNumber pres,eq olcDbIndex: ou,cn,mail pres,eq,sub structuralObjectClass: olcWtConfig I start slapd and it creates the database files correctly. I then go and try to create the container with a simple .ldif and ldapadd: dn: dc=fdf,dc=net objectClass: dcObject objectClass: organization o: FDF dc: fdf That generates: [1677801597:758327][83158:0x55b4158fb640], file:dn2id.wt, WT_CURSOR.insert: [WT_VERB_DEFAULT][ERROR]: __wt_txn_id_check, 1339: write operations are not supported in read-committed or read-uncommitted transactions.: Operation not supported Mar 2 15:59:57 slapd[83158]: wt_dn2id_add: insert failed: Operation not supported (95) That comes from WiredTiger @ https://github.com/wiredtiger/wiredtiger/blob/5a032be765b1ebd9bb789e837cd00… but I don't seem to understand why it's happening on a simple add? Am I missing something obvious? -- You are receiving this mail because: You are on the CC list for the issue.

1 8

[Issue 9436] New: OpenSSL 3.0: libldap uses depreciated functions
by openldap-its＠openldap.org 27 Apr '23

27 Apr '23

https://bugs.openldap.org/show_bug.cgi?id=9436 Issue ID: 9436 Summary: OpenSSL 3.0: libldap uses depreciated functions Product: OpenLDAP Version: 2.5 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: libraries Assignee: bugs(a)openldap.org Reporter: quanah(a)openldap.org Target Milestone: --- OpenLDAP master fails to build against OpenSSL 3.0 alpha when "no-deprecated" is specified. Currently hitting these errors: ./.libs/libldap.so: undefined reference to `SSL_get_peer_certificate' ./.libs/libldap.so: undefined reference to `PEM_read_bio_DHparams' ./.libs/libldap.so: undefined reference to `ERR_get_error_line' ./.libs/libldap.so: undefined reference to `DH_free' ./.libs/libldap.so: undefined reference to `SSL_CTX_set_tmp_dh' Notes: SSL_get_peer_certificate is SSL_get1_peer_certificate in 3.0.0 SSL_CTX_set_tmp_dh should be replaced as follows: # define SSL_CTX_set_tmp_dh(ctx,dh) \ SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)(dh)) Have to dig deeper for: PEM_read_bio_DHparams ERR_get_error_line DH_free -- You are receiving this mail because: You are on the CC list for the issue.

1 18

[Issue 10036] New: ldapsearch to support IPv6 addresses in session tracking control
by openldap-its＠openldap.org 27 Apr '23

27 Apr '23

https://bugs.openldap.org/show_bug.cgi?id=10036 Issue ID: 10036 Summary: ldapsearch to support IPv6 addresses in session tracking control Product: OpenLDAP Version: 2.6.4 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: client tools Assignee: bugs(a)openldap.org Reporter: vantaa(a)outlook.com Target Milestone: --- When ldapsearch is told to include the session tracking control (-e sessiontracking), it gets the local IP address via gethostbyname() which is IPv4 only. Probably it should use getaddrinfo() which is IPv6 capable. The source code is in clients/tools/common.c:st_value(). -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 8958] 2nd cn=config update blocks slapd while adding subordinate index
by openldap-its＠openldap.org 24 Apr '23

24 Apr '23

https://bugs.openldap.org/show_bug.cgi?id=8958 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9993 -- You are receiving this mail because: You are on the CC list for the issue.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs