- openldap-bugs - openldap.org

(ITS#8895) LMDB bug on Windows 64 when built by MSVC
by hrissan＠mail.ru 08 Aug '18

08 Aug '18

Full_Name: Hrissan Version: lmdb commit 26c7df88e44e31623d0802a564f24781acdefde3 OS: Windows 7 64-bit URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (108.61.166.173) Dear Howard, lots of thanks for quick fix of ITS#8891, now another issue... I know your position that Microsoft Visual Studio is crap (it may be, but not everyone has a choice), but here is the problem: When building LMDB targeting Win64 using 64-bit compiler in Microsoft Visual Studio, the database will still be limited to just 2 gigabytes, with mdb_put returning error as soon as database attempts to grow beyond that. The problem is "off_t" is incorrectly defined as "long" in MSVC posix compatibility layer, and long is 32-bit on windows 64-bit build. As a result mdb_page_flush (and other functions using off_t) become broken. I understand this is Microsoft's, not LMDB issue, but still LMDB source contains lots of workarounds, so probably adding one will save the day for many ppl. Microsoft has this issue since at least 2008 (And it is still there in latest Visual Studio Community 2017 version 15.7.6), so no hope for fix from them. I propose the following fix (as narrow as possible - for example no fix for MinGW on Windows or MSVC on Linux) #if defined(_WIN32) && defined(_MSC_VER) typedef long long int lmdb_off_t; // 64-bit on both 32- and 64- bit Windows #else typedef off_t lmdb_off_t; #endif And using lmdb_off_t instead of off_t on 4 occasions where it is used.

1 0

(ITS#8894) git clone fails
by openldap＠openldap.org 07 Aug '18

07 Aug '18

Full_Name: Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2a02:587:390c:800:299:99ff:fe99:9999) Cloning into 'openldap'... fatal: dumb http transport does not support shallow capabilities

1 0

(ITS#8893) New LDAP option to support binding to specific IPv4/IPv6 address at client side
by sudhir.singam＠gmail.com 07 Aug '18

07 Aug '18

Full_Name: sudhir reddy singam Version: master branch OS: fedora URL: Submission from: (NULL) (131.228.66.13) The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by NOKIA. NOKIA has not assigned rights and/or interest in this work to any party. I, SINGAM SUDHIR REDDY authorized by NOKIA, my employer, to release this work under the following terms. NOKIA hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. **** Description: This is continuation to ITS#8847. NOKIA has decided to contribute on this small feature, that is, providing new LDAP option to be able to set the source bind IP address at openldap client side. Following are the design details of what we are planning to do. Please provide your comments for the design, so that we can proceed with the implementation. Details: Requirement: User shall be able to set multiple IPv4/IPv6 socket bind addresses, to be able to route the LDAP traffic via desired network interface. Based on the target IP address type, first matching and valid source IP address will be picked for explicit binding at client side. Work items: 1) LDAP option to set the IPv4/IPv6 socket bind addresses. Format: space separated list of IP addresses New configuration option LDAP_OPT_SOCKET_BIND_ADDRESSES (0x5013) will be introduced (in ldap.h) to be used via ldap_set_option. For example, char* p = 10.24.56.34 2001:0db8:85a3:0000:0000:8a2e:0370:7334; ldap_set_option(NULL, LDAP_OPT_SOCKET_BIND_ADDRESSES, p); Bind addresses can also be provided in ldap.conf file via the option SOCKET_BIND_ADDRESSES, for example, SOCKET_BIND_ADDRESSES 10.24.56.45 10.24.56.46 2001:0db8:85a3:0000:0000:8a2e:0370:7334 Note : Option set to ldap handle will override the global option. Setting the option multiple times will override the previous values but does not append. 2) Parsing & validations Space separated IP addresses will be parsed & validated. IPv4 and IPv6 addresses are stored separately for easy of access during connection. Basic syntax validation will be done for IPv4 or IPv6 addresses, if any error, setting of the option will fail and LDAP client will use the default IP address. ldapoptions structure in ldap-int.h will be modified to add new members "char *ldo_local_IPV4_addresses" -> to hold client local IPv4 bind addresses "char *ldo_local_IPV6_addresses" -> to hold client local IPv6 bind addresses Any new function ldap_options_parseBindAddress () will be introduced in options.c to parse, validate and store the IP addresses to respective variables. This function will be similar to ldap_url_parseHosts. Memory for ldo_local_IPV4_addresses & ldo_local_IPV6_addresses is dynamically allocated in the form of array for easy access. If any validation failure, no new memory will be allocated and existing values will be retained. 3) Using Bind IP addresses during connection File:os-ip.c Function: ldap_connect_to_host - After the connection socket is created (ldap_int_socket) and before it is connected (ldap_pvt_connect). Check if the target address family type, If it is AF_INET, IPv4 bind address list will be used. - If the list is empty and LDAP option was set successfully earlier (IPv6 was set), binding will fail and error is returned. - If the list is not empty and not able to bind to any of the provided IPv4 addresses, connection will fail. - If the list is empty and LDAP option setting failed earlier (during syntax validation), LDAP client will continue to use the kernel provided IPv4 address. If it is AF_INET6, IPv6 bind address list will be used. - If the list is empty and LDAP option was set successfully earlier (IPv4 was set), binding will fail and error is returned. - If the list is not empty and not able to bind to any of the provided IPv6 addresses, connection will fail. - If the list is empty and LDAP option setting failed earlier (during syntax validation), LDAP client will continue to use the kernel provided IPv6 address.

1 0

Re: (ITS#8892) ISC dhcpd cannot start TLS session to 389-DS after updating openldap rpm
by quanah＠symas.com 06 Aug '18

06 Aug '18

--On Monday, August 06, 2018 3:42 PM +0000 krejci(a)i3.cz wrote: > Full_Name: Mira Krejci > Version: 2.4.44-15 > OS: CentOS Linux release 7.5.1804 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (93.99.54.254) Hello, This is likely due to RedHat's customizations to the OpenLDAP libldap library. In their most recent builds, they switched from MozNSS to OpenSSL as the underlying TLS library and wrote their own custom bridging function for this change. It has apparently caused various problems for end users. I would suggest contacting RedHat or using an unmodified version of OpenLDAP. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8892) ISC dhcpd cannot start TLS session to 389-DS after updating openldap rpm
by michael＠stroeder.com 06 Aug '18

06 Aug '18

On 8/6/18 4:42 PM, krejci(a)i3.cz wrote: > ISC dhcp server cannot start TLS session to 389 Directory server after updating > openldap from 2.4.44-5 to newist version. > Error: Cannot start TLS session to 10.0.252.31:389: Connect error > > dhcpd version: 4.2.5-68 > 389-ds-base verson: 1.3.7.5-21 > > When I try manually copy old libraries (liblber, libldap, libslapi) back to > updated system, dhcpd works fine with TLS to 389-DS. > > We can disable TLS by "ldap-ssl off" option at /etc/dhcp/dhcpd.conf as a > workaround. The ITS is only for reporting bugs. Please post your questions on the openldap-technical mailing list: https://www.openldap.org/lists/mm/listinfo/openldap-technical Ciao, Michael.

1 0

(ITS#8892) ISC dhcpd cannot start TLS session to 389-DS after updating openldap rpm
by krejci＠i3.cz 06 Aug '18

06 Aug '18

Full_Name: Mira Krejci Version: 2.4.44-15 OS: CentOS Linux release 7.5.1804 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (93.99.54.254) ISC dhcp server cannot start TLS session to 389 Directory server after updating openldap from 2.4.44-5 to newist version. Error: Cannot start TLS session to 10.0.252.31:389: Connect error dhcpd version: 4.2.5-68 389-ds-base verson: 1.3.7.5-21 When I try manually copy old libraries (liblber, libldap, libslapi) back to updated system, dhcpd works fine with TLS to 389-DS. We can disable TLS by "ldap-ssl off" option at /etc/dhcp/dhcpd.conf as a workaround.

1 0

Re: (ITS#8891) LMDB fails to compile on latest Microsoft Visual Studio
by hyc＠symas.com 06 Aug '18

06 Aug '18

hrissan(a)mail.ru wrote: > Full_Name: Hrissan > Version: commit 86a90cad721cbdc0bb0a9c3bf15396f5c946ae95 > OS: Windows 7 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (5.44.169.206) > > > Sorry this seems to be the only way to report bug in LMDB. No need to apologize for using the documented mechanism. Thanks for the report, fixed now in mdb.master. > > In mdb.c line 55, 68, 77 > > typedef NTSTATUS WINAPI (NtCreateSectionFunc) > > Should be > > typedef NTSTATUS (WINAPI NtCreateSectionFunc) > > Visual Studio Community 2017 version 15.7.6 does not accept the incorrect > typedef any more. > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8891) LMDB fails to compile on latest Microsoft Visual Studio
by hrissan＠mail.ru 05 Aug '18

05 Aug '18

Full_Name: Hrissan Version: commit 86a90cad721cbdc0bb0a9c3bf15396f5c946ae95 OS: Windows 7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (5.44.169.206) Sorry this seems to be the only way to report bug in LMDB. In mdb.c line 55, 68, 77 typedef NTSTATUS WINAPI (NtCreateSectionFunc) Should be typedef NTSTATUS (WINAPI NtCreateSectionFunc) Visual Studio Community 2017 version 15.7.6 does not accept the incorrect typedef any more.

1 0

Re: (ITS#8650) EAGAIN from gnutls_handshake not respected
by subbarao＠computer.org 03 Aug '18

03 Aug '18

On 08/03/2018 12:09 PM, Ryan Tandy wrote: > Thanks for letting me know about this. This patch is running on quite > a few systems by now, I'm sorry the problem wasn't caught sooner. :/ No worries, thanks for responding so quickly on this! >> I'm wondering if there is a better way to handle EAGAIN returned from >> gnutls_handshake(), instead of doing a busywait as in ITS#8650, or my >> simplistic attempt at inserting a sleep() call which doesn't really >> seem to help. I'm wondering how the GnuTLS developers intend for >> people to use gnutls_handshake() properly, so as to gracefully handle >> sessions that involve long packets on the one hand, without opening >> up a vulnerability to chew up lots of system resources on the other >> hand. > > Right. I mean, this is how GnuTLS' own example shows to do it: > > https://gitlab.com/gnutls/gnutls/blob/master/doc/examples/ex-client-dtls.c#… > Hmm, that's a head-scratcher. It doesn't seem very effective to have a non-blocking I/O interface and then recommend wrapping it in a busywait loop :-) > We could place a limit on the number of iterations, though any such > limit would have to be arbitrary. > > There might be an asynchronous GnuTLS API that could be used to avoid > tying up slapd while this is going on. > > I will look at how some other GnuTLS servers deal with this... Cool, thanks Ryan. Regards, -Kartik

1 0

Re: (ITS#8650) EAGAIN from gnutls_handshake not respected
by ryan＠nardis.ca 03 Aug '18

03 Aug '18

Hi Kartik, On Fri, Aug 03, 2018 at 11:19:06AM -0400, Kartik Subbarao wrote: >I'm running into a problem with slapd 2.4.46 hanging on Ubuntu 18.04, >which seems to be a side effect of the ITS#8650 patch: > >https://github.com/openldap/openldap/commit/7b5181da8cdd47a13041f9ee36fa959… > >slapd will run fine for a while, but during some periods of >high-traffic, it'll hang. It'll peg the CPU at 100% and won't respond >to any new LDAP connections. After some time, it'll resume working >again, but overall it's fairly unreliable. Thanks for letting me know about this. This patch is running on quite a few systems by now, I'm sorry the problem wasn't caught sooner. :/ >I'm wondering if there is a better way to handle EAGAIN returned from >gnutls_handshake(), instead of doing a busywait as in ITS#8650, or my >simplistic attempt at inserting a sleep() call which doesn't really >seem to help. I'm wondering how the GnuTLS developers intend for >people to use gnutls_handshake() properly, so as to gracefully handle >sessions that involve long packets on the one hand, without opening up >a vulnerability to chew up lots of system resources on the other hand. Right. I mean, this is how GnuTLS' own example shows to do it: https://gitlab.com/gnutls/gnutls/blob/master/doc/examples/ex-client-dtls.c#… We could place a limit on the number of iterations, though any such limit would have to be arbitrary. There might be an asynchronous GnuTLS API that could be used to avoid tying up slapd while this is going on. I will look at how some other GnuTLS servers deal with this...

1 0

Re: (ITS#8650) EAGAIN from gnutls_handshake not respected
by subbarao＠computer.org 03 Aug '18

03 Aug '18

Hi Ryan, I'm running into a problem with slapd 2.4.46 hanging on Ubuntu 18.04, which seems to be a side effect of the ITS#8650 patch: https://github.com/openldap/openldap/commit/7b5181da8cdd47a13041f9ee36fa959… slapd will run fine for a while, but during some periods of high-traffic, it'll hang. It'll peg the CPU at 100% and won't respond to any new LDAP connections. After some time, it'll resume working again, but overall it's fairly unreliable. strace on slapd during the hang shows that it's constantly making read() calls that return EAGAIN. After doing a gdb stack trace on slapd, I realized that these read() calls are happening as part of the busywait for loop in tlsg_session_accept() that repeatedly calls gnutls_handshake() when it gets EAGAIN. When slapd recovers from this hang state, the first message it prints is a TLS negotiation failure error on the culprit file descriptor. If I back out the ITS#8650 patch, the problem goes away. If I insert sleep(1) in the for loop, slapd no longer pegs the CPU at 100%, but it still becomes unresponsive during these high-traffic periods. I don't know what's happening during these high-traffic periods that causes the TLS negotiation to go astray. Unfortunately it's not easy to reproduce this problem outside of this production environment, given the diversity of clients running different OSes with various versions of SSL libraries. I'm wondering if there is a better way to handle EAGAIN returned from gnutls_handshake(), instead of doing a busywait as in ITS#8650, or my simplistic attempt at inserting a sleep() call which doesn't really seem to help. I'm wondering how the GnuTLS developers intend for people to use gnutls_handshake() properly, so as to gracefully handle sessions that involve long packets on the one hand, without opening up a vulnerability to chew up lots of system resources on the other hand. Regards, -Kartik

1 0

Re: (ITS#8890) Bug fix patches unbreaking the build on x32 systems
by tg＠debian.org 02 Aug '18

02 Aug '18

Hi, > Thanks. Most of these look OK, but the unconditional use of "long > long" instead of "long" will break on machines where "long long" is > not 64 bits. 64 bits is not the requirement for all those, but size of time_t. Each of these instances was changed from outputting a time_t with %ld (without cast to long) to outputting a time_t with %lld after being cast to long long. As long long is either the same size or greater than long, this cannot break any existing scenario. It merely fixes the scenario in which time_t is larger than long but fits into long long. (It also fixes the case where time_t is smaller than long, incidentally, as it was not cast, prior.) Actual bit sizes are of no import here due to the explicit casts, given that time_t can be of various sizes and, in constrast to e.g. size_t with its %zu specifier, does not have a printf specifier of its own. Fixing this is already common practice for me, as MirBSD/i386 is also a platform with 32-bit long and 64-bit time_t, and has been for 14 years and about five weeks or so. bye, //mirabilos -- When he found out that the m68k port was in a pretty bad shape, he did not, like many before him, shrug and move on; instead, he took it upon himself to start compiling things, just so he could compile his shell. How's that for dedication. -- Wouter, about my Debian/m68k revival

1 0

Re: (ITS#8890) Bug fix patches unbreaking the build on x32 systems
by hyc＠symas.com 02 Aug '18

02 Aug '18

tg(a)debian.org wrote: > Full_Name: mirabilos > Version: 2.4.46 > OS: Debian > URL: > Submission from: (NULL) (2a01:4f8:150:946c::42:3) >=20 >=20 > I=C3=A2=E2=82=AC=E2=84=A2ve just managed to unbreak the build of openld= ap on x32 > (basically amd64ilp32: a 64-bit x86 architecture using 32-bit > =C3=A2=E2=82=AC=C5=93long=C3=A2=E2=82=AC=C2=9D and pointers) by fixing = a couple of simple GCC warnings. Thanks. Most of these look OK, but the unconditional use of "long long" i= nstead of "long" will break on machines where "long long" is not 64 bits. >=20 > Original bugreport: https://bugs.debian.org/905237 >=20 > Please find the attached patches (pretty machinal, so not > copyright-relevant) and include them in your next release. > Thanks! >=20 > --- a/clients/tools/common.c > +++ b/clients/tools/common.c > @@ -2326,7 +2326,7 @@ void tool_print_ctrls( > /* known controls */ > for ( j =3D 0; tool_ctrl_response[j].oid !=3D NULL; j++ ) { > if ( strcmp( tool_ctrl_response[j].oid, ctrls[i]->ldctl_oid ) =3D=3D= 0 ) { > - if ( !tool_ctrl_response[j].mask & tool_type ) { > + if ( !(tool_ctrl_response[j].mask & tool_type) ) { > /* this control should not appear > * with this tool; warning? */ > } > --- a/servers/slapd/backend.c > +++ b/servers/slapd/backend.c > @@ -1500,7 +1500,7 @@ fe_acl_group( > * or if filter parsing fails. > * In the latter case, > * we should give up. */ > - if ( ludp->lud_filter !=3D NULL && ludp->lud_filter !=3D '\0') { > + if ( ludp->lud_filter !=3D NULL && ludp->lud_filter[0] !=3D '\0')= { > filter =3D str2filter_x( op, ludp->lud_filter ); > if ( filter =3D=3D NULL ) { > /* give up... */ > --- a/servers/slapd/overlays/constraint.c > +++ b/servers/slapd/overlays/constraint.c > @@ -446,7 +446,7 @@ constraint_cf_gen( ConfigArgs *c ) > } > =20 > if ( ap.restrict_lud->lud_attrs !=3D NULL ) { > - if ( ap.restrict_lud->lud_attrs[0] !=3D '\0' ) { > + if ( ap.restrict_lud->lud_attrs[0] !=3D NULL ) { > snprintf( c->cr_msg, sizeof( c->cr_msg ), > "%s %s: attrs not allowed in restrict URI %s\n", > c->argv[0], c->argv[1], arg); > --- a/servers/slapd/syntax.c > +++ b/servers/slapd/syntax.c > @@ -219,8 +219,8 @@ syn_add( > } > =20 > assert( (*lsei)->lsei_values !=3D NULL ); > - if ( (*lsei)->lsei_values[0] =3D=3D '\0' > - || (*lsei)->lsei_values[1] !=3D '\0' ) > + if ( (*lsei)->lsei_values[0] =3D=3D NULL > + || (*lsei)->lsei_values[1] !=3D NULL ) > { > Debug( LDAP_DEBUG_ANY, "syn_add(%s): exactly one substitute synta= x must be > present\n", > ssyn->ssyn_syn.syn_oid, 0, 0 ); > --- a/tests/progs/slapd-addel.c > +++ b/tests/progs/slapd-addel.c > @@ -173,7 +173,7 @@ main( int argc, char **argv ) > =20 > } > =20 > - if (( attrs =3D=3D NULL ) || ( *attrs =3D=3D '\0' )) { > + if (( attrs =3D=3D NULL ) || ( *attrs =3D=3D NULL )) { > =20 > fprintf( stderr, "%s: invalid attrs in file \"%s\".\n", > argv[0], filename ); > --- a/contrib/slapd-modules/smbk5pwd/smbk5pwd.c > +++ b/contrib/slapd-modules/smbk5pwd/smbk5pwd.c > @@ -605,7 +605,7 @@ static int smbk5pwd_exop_passwd( > keys[0].bv_val =3D ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); > keys[0].bv_len =3D snprintf(keys[0].bv_val, > LDAP_PVT_INTTYPE_CHARS(long), > - "%ld", slap_get_time()); > + "%lld", (long long)slap_get_time()); > BER_BVZERO( &keys[1] ); > =09 > ml->sml_desc =3D ad_sambaPwdLastSet; > @@ -627,7 +627,7 @@ static int smbk5pwd_exop_passwd( > keys[0].bv_val =3D ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); > keys[0].bv_len =3D snprintf(keys[0].bv_val, > LDAP_PVT_INTTYPE_CHARS(long), > - "%ld", slap_get_time() + pi->smb_must_change); > + "%lld", (long long)slap_get_time() + (long long)pi->smb_must_chan= ge); > BER_BVZERO( &keys[1] ); > =20 > ml->sml_desc =3D ad_sambaPwdMustChange; > @@ -650,7 +650,7 @@ static int smbk5pwd_exop_passwd( > keys[0].bv_val =3D ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); > keys[0].bv_len =3D snprintf(keys[0].bv_val, > LDAP_PVT_INTTYPE_CHARS(long), > - "%ld", slap_get_time() + pi->smb_can_change); > + "%lld", (long long)slap_get_time() + (long long)pi->smb_can_chang= e); > BER_BVZERO( &keys[1] ); > =20 > ml->sml_desc =3D ad_sambaPwdCanChange; > --- a/libraries/libldap/os-ip.c > +++ b/libraries/libldap/os-ip.c > @@ -282,8 +282,8 @@ ldap_int_poll( > int rc; > =09 > =20 > - osip_debug(ld, "ldap_int_poll: fd: %d tm: %ld\n", > - s, tvp ? tvp->tv_sec : -1L, 0); > + osip_debug(ld, "ldap_int_poll: fd: %d tm: %lld\n", > + s, tvp ? (long long)tvp->tv_sec : -1LL, 0); > =20 > #ifdef HAVE_POLL > { > @@ -432,8 +432,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t > opt_tv =3D &tv; > } > =20 > - osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %ld async: %d\n", > - s, opt_tv ? tv.tv_sec : -1L, async); > + osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %lld async: %d\n", > + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); > =20 > if ( opt_tv && ldap_pvt_ndelay_on(ld, s) =3D=3D -1 ) > return ( -1 ); > --- a/libraries/libldap/os-local.c > +++ b/libraries/libldap/os-local.c > @@ -176,8 +176,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t > opt_tv =3D &tv; > } > =20 > - oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %ld async: %d\n", > - s, opt_tv ? tv.tv_sec : -1L, async); > + oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %lld async: %d\n"= , > + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); > =20 > if ( ldap_pvt_ndelay_on(ld, s) =3D=3D -1 ) return -1; > =20 > --- a/libraries/libldap/result.c > +++ b/libraries/libldap/result.c > @@ -264,8 +264,8 @@ wait4msg( > Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (infinite timeout= )\n", > (void *)ld, msgid, 0 ); > } else { > - Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %ld usec)= \n", > - (void *)ld, msgid, (long)timeout->tv_sec * 1000000 + timeout->tv_us= ec ); > + Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %lld usec= )\n", > + (void *)ld, msgid, (long long)timeout->tv_sec * 1000000LL + timeout= ->tv_usec > ); > } > #endif /* LDAP_DEBUG */ > =20 > --- a/servers/slapd/back-ldap/bind.c > +++ b/servers/slapd/back-ldap/bind.c > @@ -3008,14 +3008,14 @@ ldap_back_conn2str( const ldapconn_base_ > } > =20 > if ( lc->lcb_create_time !=3D 0 ) { > - len =3D snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_create_time ); > + len =3D snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_cre= ate_time > ); > if ( ptr + sizeof(" created=3D") + len >=3D end ) return -1; > ptr =3D lutil_strcopy( ptr, " created=3D" ); > ptr =3D lutil_strcopy( ptr, tbuf ); > } > =20 > if ( lc->lcb_time !=3D 0 ) { > - len =3D snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_time ); > + len =3D snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_tim= e ); > if ( ptr + sizeof(" modified=3D") + len >=3D end ) return -1; > ptr =3D lutil_strcopy( ptr, " modified=3D" ); > ptr =3D lutil_strcopy( ptr, tbuf ); > --- a/servers/slapd/back-meta/config.c > +++ b/servers/slapd/back-meta/config.c > @@ -1277,8 +1277,8 @@ meta_back_cf_gen( ConfigArgs *c ) > if ( mc->mc_network_timeout =3D=3D 0 ) { > return 1; > } > - bv.bv_len =3D snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld", > - mc->mc_network_timeout ); > + bv.bv_len =3D snprintf( c->cr_msg, sizeof(c->cr_msg), "%lld", > + (long long)mc->mc_network_timeout ); > bv.bv_val =3D c->cr_msg; > value_add_one( &c->rvalue_vals, &bv ); > break; > --- a/servers/slapd/overlays/dds.c > +++ b/servers/slapd/overlays/dds.c > @@ -417,7 +417,7 @@ dds_op_add( Operation *op, SlapReply *rs > assert( ttl <=3D DDS_RF2589_MAX_TTL ); > =20 > bv.bv_val =3D ttlbuf; > - bv.bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl ); > + bv.bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long= )ttl ); > assert( bv.bv_len < sizeof( ttlbuf ) ); > =20 > /* FIXME: apparently, values in op->ora_e are malloc'ed > @@ -695,7 +695,7 @@ dds_op_modify( Operation *op, SlapReply > goto done; > } > =20 > - bv_entryTtl.bv_len =3D snprintf( textbuf, sizeof( textbuf ), "%ld"= , entryTtl > ); > + bv_entryTtl.bv_len =3D snprintf( textbuf, sizeof( textbuf ), "%lld= ", (long > long)entryTtl ); > break; > =20 > default: > @@ -917,7 +917,7 @@ dds_response( Operation *op, SlapReply * > ttl =3D (ttl < 0) ? 0 : ttl; > assert( ttl <=3D DDS_RF2589_MAX_TTL ); > =20 > - len =3D snprintf( ttlbuf, sizeof(ttlbuf), "%ld", ttl ); > + len =3D snprintf( ttlbuf, sizeof(ttlbuf), "%lld", (long long)ttl ); > if ( len < 0 ) > { > goto done; > @@ -1177,7 +1177,7 @@ dds_op_extended( Operation *op, SlapRepl > ttlmod.sml_values =3D ttlvalues; > ttlmod.sml_numvals =3D 1; > ttlvalues[ 0 ].bv_val =3D ttlbuf; > - ttlvalues[ 0 ].bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%ld",= ttl ); > + ttlvalues[ 0 ].bv_len =3D snprintf( ttlbuf, sizeof( ttlbuf ), "%lld"= , (long > long)ttl ); > BER_BVZERO( &ttlvalues[ 1 ] ); > =20 > /* the entryExpireTimestamp is added by modify */ > @@ -1205,8 +1205,8 @@ dds_op_extended( Operation *op, SlapRepl > rs->sr_rspoid =3D ch_strdup( slap_EXOP_REFRESH.bv_val ); > =20 > Log3( LDAP_DEBUG_TRACE, LDAP_LEVEL_INFO, > - "%s REFRESH dn=3D\"%s\" TTL=3D%ld\n", > - op->o_log_prefix, op->o_req_ndn.bv_val, ttl ); > + "%s REFRESH dn=3D\"%s\" TTL=3D%lld\n", > + op->o_log_prefix, op->o_req_ndn.bv_val, (long long)ttl ); > } > =20 > ber_free_buf( ber ); > --- a/servers/slapd/overlays/pcache.c > +++ b/servers/slapd/overlays/pcache.c > @@ -2728,8 +2728,8 @@ pc_bind_search( Operation *op, SlapReply > pbi->bi_flags |=3D BI_HASHED; > } else { > Debug( pcache_debug, "pc_bind_search: cache is stale, " > - "reftime: %ld, current time: %ld\n", > - pbi->bi_cq->bindref_time, op->o_time, 0 ); > + "reftime: %lld, current time: %lld\n", > + (long long)pbi->bi_cq->bindref_time, (long long)op->o_time, 0 ); > } > } else if ( pbi->bi_si ) { > /* This search result is going into the cache */ > @@ -3831,9 +3831,9 @@ pc_cf_gen( ConfigArgs *c ) > struct berval bv; > switch( c->type ) { > case PC_MAIN: > - bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %= d %ld", > + bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %= d %lld", > cm->db.bd_info->bi_type, cm->max_entries, cm->numattrsets, > - cm->num_entries_limit, cm->cc_period ); > + cm->num_entries_limit, (long long)cm->cc_period ); > bv.bv_val =3D c->cr_msg; > value_add_one( &c->rvalue_vals, &bv ); > break; > @@ -3875,12 +3875,12 @@ pc_cf_gen( ConfigArgs *c ) > /* HEADS-UP: always print all; > * if optional =3D=3D 0, ignore */ > bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), > - " %d %ld %ld %ld %ld", > + " %d %lld %lld %lld %lld", > temp->attr_set_index, > - temp->ttl, > - temp->negttl, > - temp->limitttl, > - temp->ttr ); > + (long long)temp->ttl, > + (long long)temp->negttl, > + (long long)temp->limitttl, > + (long long)temp->ttr ); > bv.bv_len +=3D temp->querystr.bv_len + 2; > bv.bv_val =3D ch_malloc( bv.bv_len+1 ); > ptr =3D bv.bv_val; > @@ -3897,9 +3897,9 @@ pc_cf_gen( ConfigArgs *c ) > for (temp=3Dqm->templates; temp; temp=3Dtemp->qmnext) { > if ( !temp->bindttr ) continue; > bv.bv_len =3D snprintf( c->cr_msg, sizeof( c->cr_msg ), > - " %d %ld %s ", > + " %d %lld %s ", > temp->attr_set_index, > - temp->bindttr, > + (long long)temp->bindttr, > ldap_pvt_scope2str( temp->bindscope )); > bv.bv_len +=3D temp->bindbase.bv_len + temp->bindftemp.bv_len + 4= ; > bv.bv_val =3D ch_malloc( bv.bv_len + 1 ); > --- a/servers/slapd/syncrepl.c > +++ b/servers/slapd/syncrepl.c > @@ -2395,8 +2395,8 @@ syncrepl_message_to_op( > op->o_callback =3D &cb; > slap_op_time( &op->o_time, &op->o_tincr ); > =20 > - Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %x\n", > - si->si_ridtxt, op->o_tid, 0 ); > + Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %lx\n", > + si->si_ridtxt, (unsigned long)op->o_tid, 0 ); > =20 > switch( op->o_tag ) { > case LDAP_REQ_ADD: > @@ -2905,8 +2905,8 @@ syncrepl_entry( > int freecsn =3D 1; > =20 > Debug( LDAP_DEBUG_SYNC, > - "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %x\n", > - si->si_ridtxt, syncrepl_state2str( syncstate ), op->o_tid ); > + "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %lx\n", > + si->si_ridtxt, syncrepl_state2str( syncstate ), (unsigned long)op->o= _tid ); > =20 > if (( syncstate =3D=3D LDAP_SYNC_PRESENT || syncstate =3D=3D LDAP_SY= NC_ADD ) ) { > if ( !si->si_refreshPresent && !si->si_refreshDone ) { >=20 >=20 --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8890) Bug fix patches unbreaking the build on x32 systems
by tg＠debian.org 01 Aug '18

01 Aug '18

Full_Name: mirabilos Version: 2.4.46 OS: Debian URL: Submission from: (NULL) (2a01:4f8:150:946c::42:3) I’ve just managed to unbreak the build of openldap on x32 (basically amd64ilp32: a 64-bit x86 architecture using 32-bit “long” and pointers) by fixing a couple of simple GCC warnings. Original bugreport: https://bugs.debian.org/905237 Please find the attached patches (pretty machinal, so not copyright-relevant) and include them in your next release. Thanks! --- a/clients/tools/common.c +++ b/clients/tools/common.c @@ -2326,7 +2326,7 @@ void tool_print_ctrls( /* known controls */ for ( j = 0; tool_ctrl_response[j].oid != NULL; j++ ) { if ( strcmp( tool_ctrl_response[j].oid, ctrls[i]->ldctl_oid ) == 0 ) { - if ( !tool_ctrl_response[j].mask & tool_type ) { + if ( !(tool_ctrl_response[j].mask & tool_type) ) { /* this control should not appear * with this tool; warning? */ } --- a/servers/slapd/backend.c +++ b/servers/slapd/backend.c @@ -1500,7 +1500,7 @@ fe_acl_group( * or if filter parsing fails. * In the latter case, * we should give up. */ - if ( ludp->lud_filter != NULL && ludp->lud_filter != '\0') { + if ( ludp->lud_filter != NULL && ludp->lud_filter[0] != '\0') { filter = str2filter_x( op, ludp->lud_filter ); if ( filter == NULL ) { /* give up... */ --- a/servers/slapd/overlays/constraint.c +++ b/servers/slapd/overlays/constraint.c @@ -446,7 +446,7 @@ constraint_cf_gen( ConfigArgs *c ) } if ( ap.restrict_lud->lud_attrs != NULL ) { - if ( ap.restrict_lud->lud_attrs[0] != '\0' ) { + if ( ap.restrict_lud->lud_attrs[0] != NULL ) { snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %s: attrs not allowed in restrict URI %s\n", c->argv[0], c->argv[1], arg); --- a/servers/slapd/syntax.c +++ b/servers/slapd/syntax.c @@ -219,8 +219,8 @@ syn_add( } assert( (*lsei)->lsei_values != NULL ); - if ( (*lsei)->lsei_values[0] == '\0' - || (*lsei)->lsei_values[1] != '\0' ) + if ( (*lsei)->lsei_values[0] == NULL + || (*lsei)->lsei_values[1] != NULL ) { Debug( LDAP_DEBUG_ANY, "syn_add(%s): exactly one substitute syntax must be present\n", ssyn->ssyn_syn.syn_oid, 0, 0 ); --- a/tests/progs/slapd-addel.c +++ b/tests/progs/slapd-addel.c @@ -173,7 +173,7 @@ main( int argc, char **argv ) } - if (( attrs == NULL ) || ( *attrs == '\0' )) { + if (( attrs == NULL ) || ( *attrs == NULL )) { fprintf( stderr, "%s: invalid attrs in file \"%s\".\n", argv[0], filename ); --- a/contrib/slapd-modules/smbk5pwd/smbk5pwd.c +++ b/contrib/slapd-modules/smbk5pwd/smbk5pwd.c @@ -605,7 +605,7 @@ static int smbk5pwd_exop_passwd( keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); keys[0].bv_len = snprintf(keys[0].bv_val, LDAP_PVT_INTTYPE_CHARS(long), - "%ld", slap_get_time()); + "%lld", (long long)slap_get_time()); BER_BVZERO( &keys[1] ); ml->sml_desc = ad_sambaPwdLastSet; @@ -627,7 +627,7 @@ static int smbk5pwd_exop_passwd( keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); keys[0].bv_len = snprintf(keys[0].bv_val, LDAP_PVT_INTTYPE_CHARS(long), - "%ld", slap_get_time() + pi->smb_must_change); + "%lld", (long long)slap_get_time() + (long long)pi->smb_must_change); BER_BVZERO( &keys[1] ); ml->sml_desc = ad_sambaPwdMustChange; @@ -650,7 +650,7 @@ static int smbk5pwd_exop_passwd( keys[0].bv_val = ch_malloc( LDAP_PVT_INTTYPE_CHARS(long) ); keys[0].bv_len = snprintf(keys[0].bv_val, LDAP_PVT_INTTYPE_CHARS(long), - "%ld", slap_get_time() + pi->smb_can_change); + "%lld", (long long)slap_get_time() + (long long)pi->smb_can_change); BER_BVZERO( &keys[1] ); ml->sml_desc = ad_sambaPwdCanChange; --- a/libraries/libldap/os-ip.c +++ b/libraries/libldap/os-ip.c @@ -282,8 +282,8 @@ ldap_int_poll( int rc; - osip_debug(ld, "ldap_int_poll: fd: %d tm: %ld\n", - s, tvp ? tvp->tv_sec : -1L, 0); + osip_debug(ld, "ldap_int_poll: fd: %d tm: %lld\n", + s, tvp ? (long long)tvp->tv_sec : -1LL, 0); #ifdef HAVE_POLL { @@ -432,8 +432,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t opt_tv = &tv; } - osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %ld async: %d\n", - s, opt_tv ? tv.tv_sec : -1L, async); + osip_debug(ld, "ldap_pvt_connect: fd: %d tm: %lld async: %d\n", + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); if ( opt_tv && ldap_pvt_ndelay_on(ld, s) == -1 ) return ( -1 ); --- a/libraries/libldap/os-local.c +++ b/libraries/libldap/os-local.c @@ -176,8 +176,8 @@ ldap_pvt_connect(LDAP *ld, ber_socket_t opt_tv = &tv; } - oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %ld async: %d\n", - s, opt_tv ? tv.tv_sec : -1L, async); + oslocal_debug(ld, "ldap_connect_timeout: fd: %d tm: %lld async: %d\n", + s, opt_tv ? (long long)tv.tv_sec : -1LL, async); if ( ldap_pvt_ndelay_on(ld, s) == -1 ) return -1; --- a/libraries/libldap/result.c +++ b/libraries/libldap/result.c @@ -264,8 +264,8 @@ wait4msg( Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (infinite timeout)\n", (void *)ld, msgid, 0 ); } else { - Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %ld usec)\n", - (void *)ld, msgid, (long)timeout->tv_sec * 1000000 + timeout->tv_usec ); + Debug( LDAP_DEBUG_TRACE, "wait4msg ld %p msgid %d (timeout %lld usec)\n", + (void *)ld, msgid, (long long)timeout->tv_sec * 1000000LL + timeout->tv_usec ); } #endif /* LDAP_DEBUG */ --- a/servers/slapd/back-ldap/bind.c +++ b/servers/slapd/back-ldap/bind.c @@ -3008,14 +3008,14 @@ ldap_back_conn2str( const ldapconn_base_ } if ( lc->lcb_create_time != 0 ) { - len = snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_create_time ); + len = snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_create_time ); if ( ptr + sizeof(" created=") + len >= end ) return -1; ptr = lutil_strcopy( ptr, " created=" ); ptr = lutil_strcopy( ptr, tbuf ); } if ( lc->lcb_time != 0 ) { - len = snprintf( tbuf, sizeof(tbuf), "%ld", lc->lcb_time ); + len = snprintf( tbuf, sizeof(tbuf), "%lld", (long long)lc->lcb_time ); if ( ptr + sizeof(" modified=") + len >= end ) return -1; ptr = lutil_strcopy( ptr, " modified=" ); ptr = lutil_strcopy( ptr, tbuf ); --- a/servers/slapd/back-meta/config.c +++ b/servers/slapd/back-meta/config.c @@ -1277,8 +1277,8 @@ meta_back_cf_gen( ConfigArgs *c ) if ( mc->mc_network_timeout == 0 ) { return 1; } - bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%ld", - mc->mc_network_timeout ); + bv.bv_len = snprintf( c->cr_msg, sizeof(c->cr_msg), "%lld", + (long long)mc->mc_network_timeout ); bv.bv_val = c->cr_msg; value_add_one( &c->rvalue_vals, &bv ); break; --- a/servers/slapd/overlays/dds.c +++ b/servers/slapd/overlays/dds.c @@ -417,7 +417,7 @@ dds_op_add( Operation *op, SlapReply *rs assert( ttl <= DDS_RF2589_MAX_TTL ); bv.bv_val = ttlbuf; - bv.bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl ); + bv.bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long)ttl ); assert( bv.bv_len < sizeof( ttlbuf ) ); /* FIXME: apparently, values in op->ora_e are malloc'ed @@ -695,7 +695,7 @@ dds_op_modify( Operation *op, SlapReply goto done; } - bv_entryTtl.bv_len = snprintf( textbuf, sizeof( textbuf ), "%ld", entryTtl ); + bv_entryTtl.bv_len = snprintf( textbuf, sizeof( textbuf ), "%lld", (long long)entryTtl ); break; default: @@ -917,7 +917,7 @@ dds_response( Operation *op, SlapReply * ttl = (ttl < 0) ? 0 : ttl; assert( ttl <= DDS_RF2589_MAX_TTL ); - len = snprintf( ttlbuf, sizeof(ttlbuf), "%ld", ttl ); + len = snprintf( ttlbuf, sizeof(ttlbuf), "%lld", (long long)ttl ); if ( len < 0 ) { goto done; @@ -1177,7 +1177,7 @@ dds_op_extended( Operation *op, SlapRepl ttlmod.sml_values = ttlvalues; ttlmod.sml_numvals = 1; ttlvalues[ 0 ].bv_val = ttlbuf; - ttlvalues[ 0 ].bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%ld", ttl ); + ttlvalues[ 0 ].bv_len = snprintf( ttlbuf, sizeof( ttlbuf ), "%lld", (long long)ttl ); BER_BVZERO( &ttlvalues[ 1 ] ); /* the entryExpireTimestamp is added by modify */ @@ -1205,8 +1205,8 @@ dds_op_extended( Operation *op, SlapRepl rs->sr_rspoid = ch_strdup( slap_EXOP_REFRESH.bv_val ); Log3( LDAP_DEBUG_TRACE, LDAP_LEVEL_INFO, - "%s REFRESH dn=\"%s\" TTL=%ld\n", - op->o_log_prefix, op->o_req_ndn.bv_val, ttl ); + "%s REFRESH dn=\"%s\" TTL=%lld\n", + op->o_log_prefix, op->o_req_ndn.bv_val, (long long)ttl ); } ber_free_buf( ber ); --- a/servers/slapd/overlays/pcache.c +++ b/servers/slapd/overlays/pcache.c @@ -2728,8 +2728,8 @@ pc_bind_search( Operation *op, SlapReply pbi->bi_flags |= BI_HASHED; } else { Debug( pcache_debug, "pc_bind_search: cache is stale, " - "reftime: %ld, current time: %ld\n", - pbi->bi_cq->bindref_time, op->o_time, 0 ); + "reftime: %lld, current time: %lld\n", + (long long)pbi->bi_cq->bindref_time, (long long)op->o_time, 0 ); } } else if ( pbi->bi_si ) { /* This search result is going into the cache */ @@ -3831,9 +3831,9 @@ pc_cf_gen( ConfigArgs *c ) struct berval bv; switch( c->type ) { case PC_MAIN: - bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %d %ld", + bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), "%s %d %d %d %lld", cm->db.bd_info->bi_type, cm->max_entries, cm->numattrsets, - cm->num_entries_limit, cm->cc_period ); + cm->num_entries_limit, (long long)cm->cc_period ); bv.bv_val = c->cr_msg; value_add_one( &c->rvalue_vals, &bv ); break; @@ -3875,12 +3875,12 @@ pc_cf_gen( ConfigArgs *c ) /* HEADS-UP: always print all; * if optional == 0, ignore */ bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), - " %d %ld %ld %ld %ld", + " %d %lld %lld %lld %lld", temp->attr_set_index, - temp->ttl, - temp->negttl, - temp->limitttl, - temp->ttr ); + (long long)temp->ttl, + (long long)temp->negttl, + (long long)temp->limitttl, + (long long)temp->ttr ); bv.bv_len += temp->querystr.bv_len + 2; bv.bv_val = ch_malloc( bv.bv_len+1 ); ptr = bv.bv_val; @@ -3897,9 +3897,9 @@ pc_cf_gen( ConfigArgs *c ) for (temp=qm->templates; temp; temp=temp->qmnext) { if ( !temp->bindttr ) continue; bv.bv_len = snprintf( c->cr_msg, sizeof( c->cr_msg ), - " %d %ld %s ", + " %d %lld %s ", temp->attr_set_index, - temp->bindttr, + (long long)temp->bindttr, ldap_pvt_scope2str( temp->bindscope )); bv.bv_len += temp->bindbase.bv_len + temp->bindftemp.bv_len + 4; bv.bv_val = ch_malloc( bv.bv_len + 1 ); --- a/servers/slapd/syncrepl.c +++ b/servers/slapd/syncrepl.c @@ -2395,8 +2395,8 @@ syncrepl_message_to_op( op->o_callback = &cb; slap_op_time( &op->o_time, &op->o_tincr ); - Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %x\n", - si->si_ridtxt, op->o_tid, 0 ); + Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s tid %lx\n", + si->si_ridtxt, (unsigned long)op->o_tid, 0 ); switch( op->o_tag ) { case LDAP_REQ_ADD: @@ -2905,8 +2905,8 @@ syncrepl_entry( int freecsn = 1; Debug( LDAP_DEBUG_SYNC, - "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %x\n", - si->si_ridtxt, syncrepl_state2str( syncstate ), op->o_tid ); + "syncrepl_entry: %s LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_%s) tid %lx\n", + si->si_ridtxt, syncrepl_state2str( syncstate ), (unsigned long)op->o_tid ); if (( syncstate == LDAP_SYNC_PRESENT || syncstate == LDAP_SYNC_ADD ) ) { if ( !si->si_refreshPresent && !si->si_refreshDone ) {

1 0

RE: (ITS#8847) New LDAP URL syntax to support binding to specific IP address at client side
by sudhir.singam＠nokia.com 01 Aug '18

01 Aug '18

Hi, >From NOKIA, we are picking up this patch -> to add new ldap option, to be a= ble to set specific IPv4/IPv6 bind address. We will come back with design d= etails soon. Regards, Sudhir Singam DELIVERING BEST-IN-CLASS PLATFORM is our vision -----Original Message----- From: Ryan Tandy <ryan(a)openldap.org>=20 Sent: Sunday, May 06, 2018 10:25 PM To: openldap-its(a)OpenLDAP.org; Singam, Sudhir (Nokia - IN/Bangalore) <sudhi= r.singam(a)nokia.com> Cc: arekkusu(a)r42.ch Subject: Re: (ITS#8847) New LDAP URL syntax to support binding to specific = IP address at client side On Sun, May 06, 2018 at 01:50:23PM +0000, arekkusu(a)r42.ch wrote: >Adding a source IP to an URI feels wrong to it. > >I have not read RFC dealing with URI, however having a quick look [1] seem= s to >indicate that using the at sign in this way is non-standard. I agree. @ in URIs is already defined as separating credentials (or just=20 username) from the host. I don't recall whether OpenLDAP supports that=20 usage but in any case we shouldn't re-define it. I believe ITS#8654 is about the same feature? That one implemented this=20 by copying a Microsoft option, LDAP_OPT_SOCKET_BIND_ADDRESSES. I would=20 think that's probably a better approach. Maybe you could pick up where=20 the author of that one left off? He disappeared after posting his patch=20 for review... thanks Ryan

1 0

(ITS#8889) debugging/logging
by dpa-bugs＠aegee.org 01 Aug '18

01 Aug '18

Full_Name: &#1044;&#1080;&#1083;&#1103;&#1085; &#1055;&#1072;&#1083;&#1072;&#1091;&#1079;&#1086;&#1074; Version: 2.4 OS: Linux URL: Submission from: (NULL) (103.252.202.53) Debugging and logging are different things: logging is more used to avoid problems, that could have happened in the past, while debugging is for reproducing problems in order to resolve them. https://www.openldap.org/doc/admin24/runningslapd.html#Command-Line%20Optio… says -d sets the debug level, and 'Note: slapd must have been compiled with --enable-debug defined for any debugging information beyond the two stats levels to be available (the default).' Is --enable-debug passed by default, unless one calls --disable-debug, or are the two stats levels combined as 256 | 512 the default debug level? https://www.openldap.org/doc/admin24/troubleshooting.html#Debugging%20{{sla… that 256 is a good firstlevel, not stating whether this is the default or needs to be set explicitly. https://www.openldap.org/doc/admin24/tuning.html#Logging says the default log level is 256, but does not state how to change it. https://www.openldap.org/doc/admin24/slapdconfig.html#Global%20Directives presents the same table, as the first link I mentioned here, but calls it 'logging debugging statements' and while the directive is 'loglevel', the table is called 'debugging levels'. It says further: Default: loglevel stats Basic stats logging is configured by default. However, if no loglevel is defined, no logging occurs (equivalent to a 0 level). - Does this mean, that no logging occurs, when the loglevel directive is missing, and when it is present without value, the value is stats/256? Likewise for https://www.openldap.org/doc/admin24/slapdconf2.html#cn=config . - Please clarify on every place, where loglevel is mentioned, that the default is 256/stats. - Either use only the term debugging in the whole documentation, or only the term logging, or if both terms are used, clarify the difference between them

1 0

(ITS#8888) doc: sdf number disorder
by dpa-bugs＠aegee.org 01 Aug '18

01 Aug '18

Full_Name: &#1044;&#1080;&#1083;&#1103;&#1085; &#1055;&#1072;&#1083;&#1072;&#1091;&#1079;&#1086;&#1074; Version: 2.4 OS: Linux URL: Submission from: (NULL) (103.252.202.53) https://www.openldap.org/doc/admin24/overlays.html#Dynamic%20List%20Configu… says: In slapd.conf(5): include /path/to/dyngroup.schema ... overlay dynlist dynlist-attrset groupOfURLs labeledURI member 1. 2. Note: We must include the dyngroup.schema file that defines the 3. groupOfURLs objectClass used in this example. This isn't rendered very good in https://www.openldap.org/doc/admin24/OpenLDAP-Admin-Guide.pdf on page 111-113: Before Note is shows overlapping digits 1 and 2. Remove the numbering before 'Note:'.

1 0

(ITS#8887) doc/guide/admin/backends.sdf: is is
by dpa-bugs＠aegee.org 01 Aug '18

01 Aug '18

Full_Name: &#1044;&#1080;&#1083;&#1103;&#1085; &#1055;&#1072;&#1083;&#1072;&#1091;&#1079;&#1086;&#1074; Version: 2.4 documentation OS: Linux URL: Submission from: (NULL) (103.252.202.53) Consider this change (remove doubled " is is " diff --git a/doc/guide/admin/backends.sdf b/doc/guide/admin/backends.sdf --- a/doc/guide/admin/backends.sdf +++ b/doc/guide/admin/backends.sdf @@ -444,7 +444,7 @@ a new Perl object that handles all the requests for that particular instance of The Shell backend to {{slapd}}(8) executes external programs to implement operations, and is designed to make it easy to tie an existing database to the -slapd front-end. This backend is is primarily intended to be used in prototypes. +slapd front-end. This backend is primarily intended to be used in prototypes. H3: back-perl/back-shell Configuration

1 0

Re: (ITS#8886) slapadd does not remove spaces when adding manager attribute value
by hyc＠symas.com 31 Jul '18

31 Jul '18

mhonek(a)redhat.com wrote: > Full_Name: Matus Honek > Version: 2.4.46 > OS: Fedora 28 > URL: ftp://ftp.openldap.org/incoming/Matus-Honek-180731.sh > Submission from: (NULL) (213.175.37.10) > > > Since commit d2d534b, slapadd does not remove spaces from the 'manager' > attribute value any more. Reverting the commit makes the slapadd work as before. > Please, see attached script for a reproducer. If this is an expected behaviour > feel free to close this ticket. slapadd's job is to load data exactly as provided. Primarily, loading data that was dumped by slapcat. As such, it's not intended to do any cleanup of the input data; the input is expected to be clean already. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8886) slapadd does not remove spaces when adding manager attribute value
by mhonek＠redhat.com 31 Jul '18

31 Jul '18

Full_Name: Matus Honek Version: 2.4.46 OS: Fedora 28 URL: ftp://ftp.openldap.org/incoming/Matus-Honek-180731.sh Submission from: (NULL) (213.175.37.10) Since commit d2d534b, slapadd does not remove spaces from the 'manager' attribute value any more. Reverting the commit makes the slapadd work as before. Please, see attached script for a reproducer. If this is an expected behaviour feel free to close this ticket. Thanks.

1 0

Re: (ITS#8866) RFE: slapo-constraint to return filter used in diagnostic message
by michael＠stroeder.com 30 Jul '18

30 Jul '18

Can someone correct the subject line of the ticket? Should of course mention slapo-unique instead of slapo-constraint.

1 0

Re: (ITS#8866) RFE: slapo-constraint to return filter used in diagnostic message
by michael＠stroeder.com 30 Jul '18

30 Jul '18

see also ITS#7738

1 0

Re: (ITS#7738) RFE slapo-constraint: List non-unique attrs in diagnostic message
by michael＠stroeder.com 30 Jul '18

30 Jul '18

Related to ITS#8866.

1 0

Re: (ITS#8885) hdb_generate_key_set_password prototype check for smbk5pwd
by manu＠netbsd.org 30 Jul '18

30 Jul '18

Ryan Tandy <ryan(a)nardis.ca> wrote: > Copypasta from the paragraph below? Looks off topic for this hunk. I just updated the patch. -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

Re: (ITS#8885) hdb_generate_key_set_password prototype check for smbk5pwd
by ryan＠nardis.ca 30 Jul '18

30 Jul '18

On Mon, Jul 30, 2018 at 01:44:31AM +0000, manu(a)netbsd.org wrote: >--- a/configure.in >+++ b/configure.in >@@ -1312,6 +1312,14 @@ if test $ol_enable_lmpasswd != no; then > AC_DEFINE(SLAPD_LMHASH, 1, [define to support LAN Manager passwords]) > fi > >+dnl ---------------------------------------------------------------- >+dnl Threads? Copypasta from the paragraph below? Looks off topic for this hunk.

1 0

(ITS#8885) hdb_generate_key_set_password prototype check for smbk5pwd
by manu＠netbsd.org 30 Jul '18

30 Jul '18

Full_Name: Emmanuel Dreyfus Version: HEAD OS: NetBSD URL: ftp://ftp.openldap.org/incoming/manu-180729.patch Submission from: (NULL) (213.41.141.172) contrib/slapd-modules/smbk5pwd uses hdb_generate_key_set_password() from Heimdal, which was shortly turned from a 5 arguments function to a 7 arguments function before the prototype change was rolled back to address API incompatibility. Unfortunately, the 7 arguments hdb_generate_key_set_password() made it into released NetBSD 8.0, causing a build break in contrib/slapd-modules/smbk5pwd. The attached patch adds a configure test for 7 arguments prototype so that contrib/slapd-modules/smbk5pwd build again on NetBSD 8.0, and other OS that would include the 7 arguments hdb_generate_key_set_password().

1 0

Re: (ITS#8884) enabling overlay slapo-rwm makes 'entryDN' invisible
by michael＠stroeder.com 29 Jul '18

29 Jul '18

I really wonder why function rwm_attrs() is called with stripEntryDN = 1. A comment indicates the front-end generates 'entryDN'. BTW: The database uses back-mdb. I did not test whether it behaves differently with back-hdb yet.

1 0

(ITS#8884) enabling overlay slapo-rwm makes 'entryDN' invisible
by michael＠stroeder.com 29 Jul '18

29 Jul '18

Full_Name: Version: 2.4.46 OS: URL: Submission from: (NULL) (213.240.182.45) Enabling slapo-rwm for a database makes operational attribute 'entryDN' invisible (tested with rootdn). It's sufficient to add this line to the database section: overlay rwm IMO this is a serious bug.

1 0

Re: (ITS#8882) Null Attribute Value Overlay
by hyc＠symas.com 25 Jul '18

25 Jul '18

hyc(a)symas.com wrote: > tamim.ziai(a)daasi.de wrote: >> Full_Name: Tamim Ziai >> Version: 2.4.46 >> OS: linux >> URL: https://storage.daasi.de/s/piQ3WQxgYDSDkKZ >> Submission from: (NULL) (37.24.13.226) >> >> >> As requested by Matthew Hardin I'm submitting the overlay "Empty Directory >> String" (eds) as contrib software. It can be downloaded form the URL below. > > Thanks Tamim, but please also provide an IPR notice as documented in > http://www.openldap.org/devel/contributing.html#submitting > Still waiting for the IPR notice. We cannot add it to the OpenLDAP git repo without it. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8882) Null Attribute Value Overlay
by michael＠stroeder.com 24 Jul '18

24 Jul '18

This is a cryptographically signed message in MIME format. --------------ms030107030309090109010404 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 07/24/2018 11:17 AM, tamim.ziai(a)daasi.de wrote: > The eds overlay eliminates empty values of type directory string > (OID 1.3.6.1.4.1.1466.115.121.1.15) from the list of the values in the > following manner: >=20 > =C3=82=C2=A0=C3=82=C2=A0=C3=82 ^^^^^ (Jitterbug has big deficiencies processing Unicode chars in e-mails.=20 I've reformatted what came through.) Sorry, for nit-picking a bit: > - add: All empty attribute values will be removed before the add reque= st > is executed What happens if after removing all empty values there are no attributes=20 at all anymore? Is the add operation still processed or just internally=20 abandoned/canceled? > - mod-replace: A replace with empty values will be modified to a repla= ce > without values. As result the attribute will be deleted Maybe it's just a wording issue. But I understand "As result the=20 attribute will be deleted" that the attribute in the target entry is=20 removed. What happens exactly if all empty values are removed from a MOD_REPLACE=20 attribute list? Is the MOD_REPLACE for this attribute removed from the=20 modify operation? This would mean no change to the target entry. Or do you remove the attribute in the entry? > - mod-add: All empty attribute values will be removed before the mod-a= dd > request is executed "mod-add request" is a bit blurry: What happens exactly if all empty values are removed from a MOD_ADD=20 attribute list? Is the MOD_ADD for this attribute removed from the=20 modify operation? > - mod-delete: All empty attribute values will be removed before the > mod-delete request is executed Again: What happens exactly if all empty values are removed from a=20 MOD_DEL attribute list? Is the MOD_DEL for this attribute removed from the modify operation? Or is the MOD_DEL processed with empty attribute list? IMO this would be harmful because it would alter the processing in a way = probably not intended by the client. I vaguely remember that this is meant to deal with broken clients and=20 I'm concerned that following the README all clients are affected by this = special processing. Wouldn't it make sense to limit the functionality to = a defined group of broken LDAP clients (by group membership, peer=20 address check or similar)? Ciao, Michael. --------------ms030107030309090109010404 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CucwggT9MIID5aADAgECAhBFRleVrRF8X5GwbV0tcLCgMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwOTE2MDcxNjUxWhcNMTkxMjE2MDcxNjUxWjBEMR0wGwYDVQQDDBRtaWNo YWVsQHN0cm9lZGVyLmNvbTEjMCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20w ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChMBt5jtuLXsNQ5U7rBbZit8sknIwz hfaousT3d/fssQ6qZwe9l1yklILSXVMqI7/bxbiqcd3zrz+imdSlZPrFBHGfh04DZHCfss2F RwSswGejqP1qE3hPvZi96wFfOMqenpN+pSXqNJ1OPBCJ8a+8ZEioFKoEj3HkCCXjbmezAgms FuA7aFE9BfjJ2eQKw8B9G8X1FjvOTinYSZ2F+qHpKgywl4HTx0dMnYy+Pwu4DDIHkEaVH+uj K1/ed76WUEH51mX9m2Xu0onfQlSM3me6EvAAZiIDsCEbF9WttRuJbpfCFo0m2uW7BBugS7EG Jro1nRSQVnpJyTFgHb5EGMVVAgMBAAGjggG4MIIBtDAOBgNVHQ8BAf8EBAMCBLAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFh1801TSuxT Nltnv9rOjrZzUUgNMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUF BwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUF BzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYD VR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3Js MB8GA1UdEQQYMBaBFG1pY2hhZWxAc3Ryb2VkZXIuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tLzBHBgNVHSAEQDA+MDwGCysGAQQBgbU3AQIFMC0wKwYIKwYBBQUH AgEWH2h0dHBzOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggEB AKiJ9wpjJeHdEzHDZyqmhn4cHcRj9Ag7ZQK0meq1N3oQ9M1YeVge6vZe20LXojgXsNUQGLSt 1lW2s7fABkL9CF+/RtWznHxlp4YpWX/RgbHBo3uXKNA5JUOjbxQ2+1b1jaTp/FUrSIISAxgd RpeYAODJ0db1x8Q+l66DtIVjj7ktWISdJWE2Opn4QnaRwdj6n35Rul4S2ikUsmxtGrHLpjRR XJqbsGa0RZdJyUKlZ2ZRAoRz4jKHOogQcig937sR5Ut2pGOhrScEhgARY2c8Gs2olRTL3pue mE4vjY0g1Nwr9RzeFwMuasiFh4yD34i6jIRfoNzuLPgydjsJ0grw0akwggXiMIIDyqADAgEC AhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAklMMRYwFAYD VQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0 ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17Ake fMyUGwrQdvwObhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzL A84J6Ws5T4NfXZ0qn4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmC S+kICslYYWgXOMt2xlsSslxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6my Su8j8BWWHpChNNeTrFuhVfrOAyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR 9t4APXGzAgMBAAGjggFkMIIBYDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0 cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEF BQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDAGCCsGAQUFBzAChiRodHRwOi8vYWlh LnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0OBBYEFCSBbDlhvkkPj7cbRivJKLUn SG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMD8GA1UdIAQ4MDYwNAYEVR0g ADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZI hvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh2NCXTq7im61g7F1L IiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw5kG3DN8pd1hS EUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07v29MdhaP v3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Yklue /quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6 UpVDo/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHM zcwk3EV2B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuK KwHNL8F4GGp6jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ 8j6y6S9p0xE/Ga0peVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMYIDzDCCA8gCAQEwgYkw dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx IENsaWVudCBDQQIQRUZXla0RfF+RsG1dLXCwoDANBglghkgBZQMEAgEFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTgwNzI0MTEyNTU3WjAvBgkq hkiG9w0BCQQxIgQgne4rsOQgjeXt+t99byzWt3RKks04f4dXzIQsExmIfgEwbAYJKoZIhvcN AQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3 DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBmgYJKwYB BAGCNxAEMYGMMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkw JwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3Rh cnRDb20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwgZwGCyqGSIb3DQEJ EAILMYGMoIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYD VQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRD b20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwDQYJKoZIhvcNAQEBBQAE ggEAd0kJvr65eT7iEdY8y6SlY80aWYkV8mA46FhaCSPfqyfiYXe/7Ydqy+6Y1TPGpnC4rUEi pVqIh4UAkVazZxrCZ/c3TWUoGc9AIDzYla3zOAA+AwgfNeoXZW+HcI7p+Oo4t1axWm23ScWO y5pV2FNzabujmZlCMAUcGJi3g78Bw8VR+sod3VAZtuG0KNFgXe6gAVfxWTaoyIiKEjbkDBd6 L2rwfmLQDOpODir6yVuQ8UW1Urv/koLHkpXKyPfC6vfcMiiUffwnBBb/PG+tuHWrNqSzm/D7 DbUBZTUMrgDqrlsByvXHwPGj+zJeLQ2UmTsaokuKPTYrewC9erBVSg1kbQAAAAAAAA== --------------ms030107030309090109010404--

1 0

Re: (ITS#8882) Null Attribute Value Overlay
by tamim.ziai＠daasi.de 24 Jul '18

24 Jul '18

The eds overlay eliminates empty values of type directory string (OID 1.3.6.1.4.1.1466.115.121.1.15) from the list of the values in the following manner: - add: All empty attribute values will be removed before the add request is executed - mod-replace: A replace with empty values will be modified to a replace without values. As result the attribute will be deleted - mod-add: All empty attribute values will be removed before the mod-add request is executed - mod-delete: All empty attribute values will be removed before the mod-delete request is executed On 23.07.2018 17:59, Howard Chu wrote: > tamim.ziai(a)daasi.de wrote: >> Full_Name: Tamim Ziai >> Version: 2.4.46 >> OS: linux >> URL: https://storage.daasi.de/s/piQ3WQxgYDSDkKZ >> Submission from: (NULL) (37.24.13.226) >> >> >> As requested by Matthew Hardin I'm submitting the overlay "Empty >> Directory >> String" (eds) as contrib software. It can be downloaded form the URL >> below. > > Thanks Tamim, but please also provide an IPR notice as documented in > http://www.openldap.org/devel/contributing.html#submitting >

1 0

Re: (ITS#8882) Null Attribute Value Overlay
by michael＠stroeder.com 24 Jul '18

24 Jul '18

On 07/24/2018 10:09 AM, tamim.ziai(a)daasi.de wrote: > I miserably lost the fight against your ticket system! No way to modify > anything as guest user and no way to create/register a new user as > described in the Jitterbug help pages. Could you please tell me how I > can modify an issue or where I can find a description how to proceed? You can only add new messages to tickets, mainly by a simple follow-up e-mail preserving the e-mail subject. From my understanding this is also the accepted way to add an IPR notice after initial submission. Ciao, Michael.

1 0

Re: (ITS#8882) Null Attribute Value Overlay
by tamim.ziai＠daasi.de 24 Jul '18

24 Jul '18

I miserably lost the fight against your ticket system! No way to modify anything as guest user and no way to create/register a new user as described in the Jitterbug help pages. Could you please tell me how I can modify an issue or where I can find a description how to proceed? Thanks, Tamim On 23.07.2018 17:59, Howard Chu wrote: > tamim.ziai(a)daasi.de wrote: >> Full_Name: Tamim Ziai >> Version: 2.4.46 >> OS: linux >> URL: https://storage.daasi.de/s/piQ3WQxgYDSDkKZ >> Submission from: (NULL) (37.24.13.226) >> >> >> As requested by Matthew Hardin I'm submitting the overlay "Empty >> Directory >> String" (eds) as contrib software. It can be downloaded form the URL >> below. > > Thanks Tamim, but please also provide an IPR notice as documented in > http://www.openldap.org/devel/contributing.html#submitting >

1 0

Re: (ITS#8882) Null Attribute Value Overlay
by hyc＠symas.com 23 Jul '18

23 Jul '18

tamim.ziai(a)daasi.de wrote: > Full_Name: Tamim Ziai > Version: 2.4.46 > OS: linux > URL: https://storage.daasi.de/s/piQ3WQxgYDSDkKZ > Submission from: (NULL) (37.24.13.226) > > > As requested by Matthew Hardin I'm submitting the overlay "Empty Directory > String" (eds) as contrib software. It can be downloaded form the URL below. Thanks Tamim, but please also provide an IPR notice as documented in http://www.openldap.org/devel/contributing.html#submitting -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8882) Null Attribute Value Overlay
by tamim.ziai＠daasi.de 23 Jul '18

23 Jul '18

Full_Name: Tamim Ziai Version: 2.4.46 OS: linux URL: https://storage.daasi.de/s/piQ3WQxgYDSDkKZ Submission from: (NULL) (37.24.13.226) As requested by Matthew Hardin I'm submitting the overlay "Empty Directory String" (eds) as contrib software. It can be downloaded form the URL below.

1 0

(ITS#8881) slapd.access(5) state BDB and HDB are not primary backens
by dpa-bugs＠aegee.org 21 Jul '18

21 Jul '18

Full_Name: &#1044;&#1080;&#1083;&#1103;&#1085; &#1055;&#1072;&#1083;&#1072;&#1091;&#1079;&#1086;&#1074; Version: online manual OS: Any URL: Submission from: (NULL) (92.192.99.60) https://www.openldap.org/software/man.cgi?query=slapd.access&sektion=5&apro… says: OPERATION REQUIREMENTS > The following summary applies to primary database backends such as the BDB and HDB backends. Provided that BDB and HDB are going soon to be deprecated, as stated at https://www.openldap.org/doc/admin24/backends.html , the information above shall either state something about MDB: if it is not related to MDB, this must be stated; if MDB is not primary database backend, needs also to be stated.

1 0

(ITS#8880) back-sql: Support deferencing aliases
by hibethy73＠gmail.com 18 Jul '18

18 Jul '18

Full_Name: Younghee Bae Version: 2.4.45 OS: Linux URL: ftp://ftp.openldap.org/incoming/Younghee-Bae-180718.patch Submission from: (NULL) (222.112.181.231) I added alias handling for back-sql.

1 0

Re: (ITS#8879) remove stale link in admin guide
by hyc＠symas.com 18 Jul '18

18 Jul '18

michael(a)stroeder.com wrote: > Full_Name: > Version: > OS: > URL: > Submission from: (NULL) (213.240.182.26) > > > There is a stale link in this section of the admin guide: > https://www.openldap.org/doc/admin24/overlays.html#Password%20Policy%20Conf… > > Points to https://symas.com/blog/?page_id=66 which says "No Results Found" > > In general the admin guide should IMO not point to volatile external resources. Agreed. The material there is on the web archive https://web.archive.org/web/20110613062549/https://symas.com/blog/?page_id=… but we should probably copy it over to a more accessible location. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8879) remove stale link in admin guide
by michael＠stroeder.com 17 Jul '18

17 Jul '18

Full_Name: Version: OS: URL: Submission from: (NULL) (213.240.182.26) There is a stale link in this section of the admin guide: https://www.openldap.org/doc/admin24/overlays.html#Password%20Policy%20Conf… Points to https://symas.com/blog/?page_id=66 which says "No Results Found" In general the admin guide should IMO not point to volatile external resources.

1 0

(ITS#8878) PBKDF2 Is Broken (1 in 64 hashes)
by jroose＠gmail.com 17 Jul '18

17 Jul '18

Full_Name: Jon Roose Version: HEAD OS: Linux URL: Submission from: (NULL) (68.134.180.197) The b64_to_ab64 function within the pbkdf2 password module is incorrect. When str[0] == '+' this function fails to convert that first character to a '.' The file in question is here: contrib/slapd-modules/passwd/pbkdf2/pw-pbkdf2.c and occurs at line 62 in the current version of the file. This occurs because when you write while (*p++), it changes the pointer and skips over the first character of str. This needs to be replaced with a for loop such as: for(char* p = str; *p; p++) This is a significant bug in this module, because it causes the hash algorithm to fail to be replicable by outside hash implementations 1 out of every 64 hashes on average.

1 0

Re: (ITS#8877) Issue while setting up openLDAP 2.4.44 with mdb
by ryan＠openldap.org 11 Jul '18

11 Jul '18

Hello, On Wed, Jul 11, 2018 at 02:16:16AM +0000, sakshi311(a)gmail.com wrote: >Issue while setting up openLDAP 2.4.44 with mdb. Getting following error when >trying to setup up mdb database instead of hdb using ansible - >fatal: [tokyo-ldap1]: FAILED! => {"changed": true, "cmd": ["ldapmodify", "-Y", >"EXTERNAL", "-H", "ldapi:///", "-f", "/tmp/db.ldif"], "delta": "0:00:00.009641", >"end": "2018-07-11 02:02:47.684653", "msg": "non-zero return code", "rc": 32, >"start": "2018-07-11 02:02:47.675012", "stderr": "SASL/EXTERNAL authentication >started\nSASL username: >gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: >0\nldap_modify: No such object (32)\n\tmatched DN: cn=config", "stderr_lines": >["SASL/EXTERNAL authentication started", "SASL username: >gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", "SASL SSF: 0", >"ldap_modify: No such object (32)", "\tmatched DN: cn=config"], "stdout": >"modifying entry \"olcDatabase={2}mdb,cn=config\"", "stdout_lines": ["modifying >entry \"olcDatabase={2}mdb,cn=config\""]} The ITS is for reporting bugs in the software, not for user support. The command output clearly shows that you are attempting to modify an entity that does not exist. If you need assistance with configuring OpenLDAP, please contact the openldap-technical(a)openldap.org mailing list, or one of the support services listed at <https://www.openldap.org/support/>. This ITS will be closed.

1 0

(ITS#8877) Issue while setting up openLDAP 2.4.44 with mdb
by sakshi311＠gmail.com 11 Jul '18

11 Jul '18

Full_Name: Sakshi Mittal Version: 2.4.44 OS: Centos7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (110.161.122.132) Issue while setting up openLDAP 2.4.44 with mdb. Getting following error when trying to setup up mdb database instead of hdb using ansible - fatal: [tokyo-ldap1]: FAILED! => {"changed": true, "cmd": ["ldapmodify", "-Y", "EXTERNAL", "-H", "ldapi:///", "-f", "/tmp/db.ldif"], "delta": "0:00:00.009641", "end": "2018-07-11 02:02:47.684653", "msg": "non-zero return code", "rc": 32, "start": "2018-07-11 02:02:47.675012", "stderr": "SASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_modify: No such object (32)\n\tmatched DN: cn=config", "stderr_lines": ["SASL/EXTERNAL authentication started", "SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", "SASL SSF: 0", "ldap_modify: No such object (32)", "\tmatched DN: cn=config"], "stdout": "modifying entry \"olcDatabase={2}mdb,cn=config\"", "stdout_lines": ["modifying entry \"olcDatabase={2}mdb,cn=config\""]}

1 0

Re: (ITS#8876) Problems About LMDB
by hyc＠symas.com 10 Jul '18

10 Jul '18

wisbyme(a)gmail.com wrote: > Full_Name: Daniel.L > Version: LMDB 0.9.70 > OS: macOS or WIN10 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (113.109.207.158) > > > Hello, > > I found some problems about LMDB from github. > Some problems in windows, I have posted the code behind. > The same code in macOS, getting data often fails. It always returns > MDB_NOTFOUND. > But I can't find the reason at all, is it not available in macOS? > > Thank you. No idea what the below means. Learn to use git, learn to use diff. > ------CODES MODIFIED---------------------------------------------------------------------- > > typedef LONG NTSTATUS, *PNTSTATUS; /// LJJ added 2018.07.10 > typedef NTSTATUS WINAPI NtCreateSectionFunc /// LJJ modified 2018.07.10 > (OUT PHANDLE sh, IN ACCESS_MASK acc, > IN void * oa OPTIONAL, > IN PLARGE_INTEGER ms OPTIONAL, > IN ULONG pp, IN ULONG aa, IN HANDLE fh OPTIONAL); > > static NtCreateSectionFunc *NtCreateSection; > > typedef enum _SECTION_INHERIT { > ViewShare = 1, > ViewUnmap = 2 > } SECTION_INHERIT; > > typedef NTSTATUS WINAPI NtMapViewOfSectionFunc /// LJJ modified 2018.07.10 > (IN PHANDLE sh, IN HANDLE ph, > IN OUT PVOID *addr, IN ULONG_PTR zbits, > IN SIZE_T cs, IN OUT PLARGE_INTEGER off OPTIONAL, > IN OUT PSIZE_T vs, IN SECTION_INHERIT ih, > IN ULONG at, IN ULONG pp); > > static NtMapViewOfSectionFunc *NtMapViewOfSection; /// LJJ modified 2018.07.10 > > > HMODULE h = GetModuleHandleA("NTDLL.DLL"); /// LJJ modified 2018.07.10 > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8876) Problems About LMDB
by wisbyme＠gmail.com 10 Jul '18

10 Jul '18

Full_Name: Daniel.L Version: LMDB 0.9.70 OS: macOS or WIN10 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (113.109.207.158) Hello, I found some problems about LMDB from github. Some problems in windows, I have posted the code behind. The same code in macOS, getting data often fails. It always returns MDB_NOTFOUND. But I can't find the reason at all, is it not available in macOS? Thank you. ------CODES MODIFIED---------------------------------------------------------------------- typedef LONG NTSTATUS, *PNTSTATUS; /// LJJ added 2018.07.10 typedef NTSTATUS WINAPI NtCreateSectionFunc /// LJJ modified 2018.07.10 (OUT PHANDLE sh, IN ACCESS_MASK acc, IN void * oa OPTIONAL, IN PLARGE_INTEGER ms OPTIONAL, IN ULONG pp, IN ULONG aa, IN HANDLE fh OPTIONAL); static NtCreateSectionFunc *NtCreateSection; typedef enum _SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 } SECTION_INHERIT; typedef NTSTATUS WINAPI NtMapViewOfSectionFunc /// LJJ modified 2018.07.10 (IN PHANDLE sh, IN HANDLE ph, IN OUT PVOID *addr, IN ULONG_PTR zbits, IN SIZE_T cs, IN OUT PLARGE_INTEGER off OPTIONAL, IN OUT PSIZE_T vs, IN SECTION_INHERIT ih, IN ULONG at, IN ULONG pp); static NtMapViewOfSectionFunc *NtMapViewOfSection; /// LJJ modified 2018.07.10 HMODULE h = GetModuleHandleA("NTDLL.DLL"); /// LJJ modified 2018.07.10

1 0

Re: (ITS#8875) [Patch] Performance problems in back-mdb with large DITs and many aliases
by hyc＠symas.com 09 Jul '18

09 Jul '18

quanah(a)symas.com wrote: > --On Friday, July 06, 2018 11:20 PM +0000 hbohnenkamp(a)united-internet.de > wrote: > >> Full_Name: Henrik Bohnenkamp >> Version: >= 2.4.44, HEAD >> OS: Ubuntu 18.04, Coreos 7.5 >> URL: https://github.com/hbo/openldap-mdb-deref-problem >> Submission from: (NULL) (77.176.95.241) >> >> >> This is a followup to >> http://www.openldap.org/lists/openldap-technical/201805/msg00065.html > > Note that this is duplicate of ITS#7657. We may have to consider this for 2.5; since it changes the format of the dn2id index it's not something we can easily put in at this late stage of 2.4. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8875) [Patch] Performance problems in back-mdb with large DITs and many aliases
by quanah＠symas.com 07 Jul '18

07 Jul '18

--On Friday, July 06, 2018 11:20 PM +0000 hbohnenkamp(a)united-internet.de wrote: > Full_Name: Henrik Bohnenkamp > Version: >= 2.4.44, HEAD > OS: Ubuntu 18.04, Coreos 7.5 > URL: https://github.com/hbo/openldap-mdb-deref-problem > Submission from: (NULL) (77.176.95.241) > > > This is a followup to > http://www.openldap.org/lists/openldap-technical/201805/msg00065.html Note that this is duplicate of ITS#7657. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8875) [Patch] Performance problems in back-mdb with large DITs and many aliases
by hbohnenkamp＠united-internet.de 07 Jul '18

07 Jul '18

Full_Name: Henrik Bohnenkamp Version: >= 2.4.44, HEAD OS: Ubuntu 18.04, Coreos 7.5 URL: https://github.com/hbo/openldap-mdb-deref-problem Submission from: (NULL) (77.176.95.241) This is a followup to http://www.openldap.org/lists/openldap-technical/201805/msg00065.html When MDB is used as backend database and with large DITs (O(10^6)) with many alias entries (O(10^5)), search requests with deref=always and scope=sub will take prohibitively long. Servers with a high request rate might become utterly unresponsive. This problem is not present in the HDB backend. In this issue I want to contribute two things: - a means to demonstrate the problem; this in the form of two scripts (bash/python) which set up a large test DIT and start two slapds (one HDB, one MDB) to allow easy comparisons of the performance - a patch to fix the problem The patch is certainly not production ready (or, if it is, it needs still exhaustive testing to inspire confidence), however, I think it is far enough to at least discuss the approach. Both the scripts and the patch, together with instructions how to use the former can be found here: https://github.com/hbo/openldap-mdb-deref-problem I am looking forward to discuss the patch.

1 0

Re: (ITS#8874) --with-fetch incorrectly links libcom_err
by hyc＠symas.com 06 Jul '18

06 Jul '18

quanah(a)openldap.org wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.4.46 > OS: FreeBSD 11 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (47.208.148.239) > > > When building OpenLDAP on FreeBSD where the fetch library is available, slapd > picks up a dependency on libcom_err which shouldn't exist. > > This comes in from lines 934 and 944 of build/openldap.m4: > 934 LIBS="-lfetch -lcom_err $LIBS" > 944 ol_link_fetch="-lfetch -lcom_err" > > These should be updated appropriately and configure regenerated Careful here. There may still be releases of FreeBSD that linked libfetch against com_err, for whatever reason. You'd need to check that libfetch exists, and then check that linking against libfetch by itself succeeds or fails. (And if it fails, put com_err back in and try again.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8874) --with-fetch incorrectly links libcom_err
by quanah＠openldap.org 06 Jul '18

06 Jul '18

Full_Name: Quanah Gibson-Mount Version: 2.4.46 OS: FreeBSD 11 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) When building OpenLDAP on FreeBSD where the fetch library is available, slapd picks up a dependency on libcom_err which shouldn't exist. This comes in from lines 934 and 944 of build/openldap.m4: 934 LIBS="-lfetch -lcom_err $LIBS" 944 ol_link_fetch="-lfetch -lcom_err" These should be updated appropriately and configure regenerated

1 0

Re: (ITS#8759) mixed overlay nops & memberof cause segfault
by hyc＠symas.com 06 Jul '18

06 Jul '18

zhixu.liu(a)gmail.com wrote: > Full_Name: Z. Liu > Version: 2.4.44 > OS: Gentoo > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (221.218.169.84) > > > if we enable overlay nops & memberof together, then doing a member MODDN > operation, slapd will segfault and exit immediately. > > Example operation: > > dn: uid=test,ou=People,dc=example,dc=dc=com > changetype: moddn > newrdn: uid=chenln > deleteoldrdn: 1 > newsuperior: ou=Leave,dc=example,dc=com > > The reason is: in servers/slapd/overlays/memberof.c, function > memberof_value_modify define mod/values/nvalues in the stack, which will be > passed to other overlays, nops will try to free them if no attribute is changed. Note that code in contrib is unsupported and is not actually part of OpenLDAP Software. You can either contact the nops author and ask them for a fix, or you're welcome to submit a fix yourself. Nobody in the OpenLDAP Project is going to investigate this issue. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs