- openldap-bugs - openldap.org

Re: (ITS#8349) fix ppolicy issue
by quanah＠symas.com 07 Sep '17

07 Sep '17

--On Tuesday, January 12, 2016 7:28 AM +0000 hamano(a)osstech.co.jp wrote: > Full_Name: HAMANO Tsukasa > Version: 2.4.43 > OS: Linux > URL: > https://www.osstech.co.jp/download/hamano/openldap/ppolicy_fix_pwdInHisto > ry.patch Submission from: (NULL) (240b:10:2640:bf0:290:4cff:fe0d:f43e) > > > We fixed several issue around ppolicy. > > 1) reduce pwdInHistory > If set pwdInHistory to 5 then reduce pwdInHistory to 3, > We expect to check password with three history, but ppolicy check > password with all pwdHistory attribute. > > 2) reduce pwdInHistory to zero > If set pwdInHistory to 5 then reduce pwdInHistory to 0, > We expect that ppolicy password checking will be disbale. but the > pwdHistory attribute are remains, so password checking is still > enabled. > We need to remove pwdHistory attribute. Hi, I'm working on catching up on old ITS submissions. This submission is missing an IPR and cannot be included until it is provided. Please see <http://www.openldap.org/devel/contributing.html> for information on the IPR requirements. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8724) slapo-pcache truncates remote results
by adam＠brainfood.com 07 Sep '17

07 Sep '17

Cool. I've looked at pcache.c, and realized I'm a noob with this code. Basically, my thoughts, is that pcache should ignore the incoming search request, and recreate it's own with it's own options, always asking for paging. Then page through all the results from the backend, then store the full set in the backing store. While that is going on, the cache entry should be marked with a bit flag saying that it's in the process of being built, but otherwise can still store the entries fetched thus far. Meanwhile, the frontend request can begin to return results from this partially resolved backend entry stored in the cache, utilizing whatever pagination value(and or offset/limit) has been requested. Of course, that's just the high-level description, not even really pseudo-code ready. As an aside, and this s/b a separate bug, if an error occurs from the backend this does *not* get cached. Aka, during this investigation, my backend is returning 2000 entries, err=4. This takes 7s each time(I'm in Dallas, while the backend is in California, and I'm communicating over a tunnel). It's not cached, so the request is passed through each time. I've configured the templates correctly, and the debug shows that the request is CACHEABLE. On Wed, Sep 6, 2017 at 6:22 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, September 06, 2017 7:06 PM -0500 Adam Heath > <adam(a)brainfood.com> wrote: > > >> Well, then since you are confirming the bug, I would say this ticket >> should *not* be closed. > > > I already reopened it. ;) > >> I might just have to patch this to make it work. > > > Make sure you follow the contribution guidelines: > > <https://www.openldap.org/devel/contributing.html> > > Thanks, > > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: (ITS#7996) Global initialisation race in ldap_int_initialize
by quanah＠symas.com 07 Sep '17

07 Sep '17

--On Tuesday, December 09, 2014 6:14 PM +0000 a.cudbardb(a)freeradius.org wrote: > Full_Name: Arran Cudbard-Bell > Version: 2.4.40 > OS: OSX 10.10.1 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (69.196.165.104) Hi Arran, Thanks for the report and sorry for the delay on getting to this issue. I would note that for the fix to be included in the OpenLDAP project, we need an IPR statement, as noted at <https://www.openldap.org/devel/contributing.html>. If you can provide that, and (if possible) submit the patch as git format-patch via the project FTP server (include the URL in your email), then I can pull it in. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8436) slapadd hang in bdb_tool_entry_close / ldap_pvt_thread_cond_wait
by quanah＠symas.com 07 Sep '17

07 Sep '17

Hi Mark, I would note that no patch for this issue has ever been submitted to the tracker, nor is there any IPR, etc. I did track down your suggested fix via the mailing list thread. However, that is not sufficient for it to be included in the OpenLDAP project. Please see <http://www.openldap.org/devel/contributing.html> for the correct procedure for submitting your fix if you would like it to be included. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8674) Leak in ldap_create_assertion_control
by come＠opensides.be 07 Sep '17

07 Sep '17

--nextPart2367739.nNEjSNJblS Content-Type: multipart/mixed; boundary="nextPart4704199.6R7aSYJDEk" Content-Transfer-Encoding: quoted-printable This is a multi-part message in MIME format. --nextPart4704199.6R7aSYJDEk Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Hello, I encountered this bug as well while adding controls support into php-ldap (see https://github.com/php/php-src/pull/2640 - WIP) I used the work-around but it would still be better to fix this in openldap. Please consider merging the attached patch. --nextPart4704199.6R7aSYJDEk Content-Disposition: attachment; filename="0001-Fixing-8674-Leak-in-ldap_create_assertion_control.patch" Content-Transfer-Encoding: 7Bit Content-Type: text/x-patch; charset="UTF-8"; name="0001-Fixing-8674-Leak-in-ldap_create_assertion_control.patch" From=2059e15d7cd5217312fcc6e3343476416a39cdc739 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come(a)opensides.be> Date: Thu, 7 Sep 2017 17:11:57 +0200 Subject: [PATCH] Fixing #8674 Leak in ldap_create_assertion_control ldap_create_assertion_control_value was returning ld->ld_errno upon success without reseting it to LDAP_SUCCESS first --- libraries/libldap/assertion.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libraries/libldap/assertion.c b/libraries/libldap/assertion.c index 8ccd5c188..e736d59eb 100644 --- a/libraries/libldap/assertion.c +++ b/libraries/libldap/assertion.c @@ -31,6 +31,8 @@ ldap_create_assertion_control_value( BerElement *ber = NULL; int err; + ld->ld_errno = LDAP_SUCCESS; + if ( assertion == NULL || assertion[ 0 ] == '\0' ) { ld->ld_errno = LDAP_PARAM_ERROR; return ld->ld_errno; -- 2.11.0 --nextPart4704199.6R7aSYJDEk-- This is a multi-part message in MIME format. --nextPart4704199.6R7aSYJDEk Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Hello, I encountered this bug as well while adding controls support into php-ldap (see https://github.com/php/php-src/pull/2640 - WIP) I used the work-around but it would still be better to fix this in openldap. Please consider merging the attached patch. --nextPart4704199.6R7aSYJDEk Content-Disposition: attachment; filename="0001-Fixing-8674-Leak-in-ldap_create_assertion_control.patch" Content-Transfer-Encoding: 7Bit Content-Type: text/x-patch; charset="UTF-8"; name="0001-Fixing-8674-Leak-in-ldap_create_assertion_control.patch" >From 59e15d7cd5217312fcc6e3343476416a39cdc739 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come(a)opensides.be> Date: Thu, 7 Sep 2017 17:11:57 +0200 Subject: [PATCH] Fixing #8674 Leak in ldap_create_assertion_control ldap_create_assertion_control_value was returning ld->ld_errno upon success without reseting it to LDAP_SUCCESS first --- libraries/libldap/assertion.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libraries/libldap/assertion.c b/libraries/libldap/assertion.c index 8ccd5c188..e736d59eb 100644 --- a/libraries/libldap/assertion.c +++ b/libraries/libldap/assertion.c @@ -31,6 +31,8 @@ ldap_create_assertion_control_value( BerElement *ber = NULL; int err; + ld->ld_errno = LDAP_SUCCESS; + if ( assertion == NULL || assertion[ 0 ] == '\0' ) { ld->ld_errno = LDAP_PARAM_ERROR; return ld->ld_errno; -- 2.11.0 --nextPart4704199.6R7aSYJDEk-- --nextPart2367739.nNEjSNJblS Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEnJSNrcx2T3JL/3cLqGTYw87LDgAFAlmxaNcACgkQqGTYw87L DgAVJA/+IlrkY3qAMDWe3CqrX4XDwFcA2C3BNzLuPvsymVl2vWNjwn/t7HmpWR2v Hs+mLeTZwe/Z7+zej5H0FujRzHnzaEm3OsGf26mPZeeIRkC1PvE9CLUZzn4M9Mak fejbb2a4EcQnPy7aAD/3Ux2mjJgF2Bl3zc8K0rQO9VSxjpNErt8U2aKgKB+t1QFb /rV4+p/ovRbFydz+RweLBI4+5kuEkWxwfc1JesbjpFNZoEJFv8oCqaRZ3RdU4KQr 6v6+Ku5O9NWp325tXcZ7aW1DQ7BhoVnYAHMl0aLLWvNF95I2yAHaWJAJJ09DooBd 43kLxqcITLuuMg3fIzSeqQs8SEWl5/p3Km64iuAhg4px8+A9Zy//I3mwCI7Qhui8 ZNTrC3cDVBE0Jy5o5QNH1YYEVq65jVvpsm95RhS0PAtN7XsSjRDnvbdinyhdV2oD vtEHivK9B66KcKAxe+c9vluaQB3VImzX2Ji5ceLipGwesHOs6Qj8uaXcYZvopRPz ffbeFFYWDLWJvBZmG/9C1AvPGKEThli8gtsO1JGcFwnv0Wnf1ClBSy8W3qcUtugh pKtBvrUG1aUKogwNZOeg7hdv0nS5joNHRjQT7apD+z1zA0u/uZ8FHn1j/XkQxyXv ArP/jEWsxMRNIaxmZJsVViEFnQNsNoJq7+Z9LBee86cl+IpwNik= =Hdb1 -----END PGP SIGNATURE----- --nextPart2367739.nNEjSNJblS--

1 0

Re: (ITS#8724) slapo-pcache truncates remote results
by quanah＠symas.com 06 Sep '17

06 Sep '17

--On Wednesday, September 06, 2017 7:06 PM -0500 Adam Heath <adam(a)brainfood.com> wrote: > Well, then since you are confirming the bug, I would say this ticket > should *not* be closed. I already reopened it. ;) > I might just have to patch this to make it work. Make sure you follow the contribution guidelines: <https://www.openldap.org/devel/contributing.html> Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8724) slapo-pcache truncates remote results
by adam＠brainfood.com 06 Sep '17

06 Sep '17

I just cloned the source, and found where it removes the paging control. == /* NOTE: this is a quick workaround to let pcache minimally interact * with pagedResults. A more articulated solutions would be to * perform the remote query without control and cache all results, * performing the pagedResults search only within the client * and the proxy. This requires pcache to understand pagedResults. */ static int pcache_chk_controls( Operation *op, SlapReply *rs ) == Well, then since you are confirming the bug, I would say this ticket should *not* be closed. I might just have to patch this to make it work. The client software I'm actually working with is nextcloud, and it is *very* *very* *very* ldap chatty. And with 2900+ objectclass=group, and 3300 objectclass=person, it runs super dog slow. Their suggestion is to install a local ldap instance configured as a caching proxy, which has led us to here. I've already fixed several issues in nextcloud locally(the first one I ran into was $limit=400 hard-coded in the group search function). This kind of paged result handling needs to be dealt the same way an http proxy would deal with partial content caches. On Wed, Sep 6, 2017 at 4:22 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Hi Adam, > > I would note that pcache is not back-ldap, so their behavior is not the > same. > > slapo-pcache strips out the paged results control, and has since 2005 > (ec532ce88590c5454025cbc030d9df65d2df634f). So in the 12 years since then, > you're the first to have an issue with the behavior. If you'd like to see a > change in relation to this, patches welcome. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: (ITS#8724) slapo-pcache truncates remote results (fwd)
by quanah＠symas.com 06 Sep '17

06 Sep '17

Hi Adam, I would note that pcache is not back-ldap, so their behavior is not the same. slapo-pcache strips out the paged results control, and has since 2005 (ec532ce88590c5454025cbc030d9df65d2df634f). So in the 12 years since then, you're the first to have an issue with the behavior. If you'd like to see a change in relation to this, patches welcome. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com> -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8717) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by hyc＠symas.com 06 Sep '17

06 Sep '17

ipuleston(a)SonicWALL.com wrote: > I have uploaded the patch to ftp.openldap.org/incoming as ian-puleston-1708= > 25.patch, and included it below. > > The code that it adds is pretty much copied from ldap_free_connection: Thanks for the report, added in master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 06 Sep '17

06 Sep '17

yos-nishino(a)ys.jp.nec.com wrote: > Dear Howard-san, > >> That comment only applies when using LDAP_MEMORY_DEBUG and is irrelevant. > > I saw memory.c again.=20 > As you told, I confirmed the comment was available only when LDAP_MEMORY_DE= > BUG was used(from line 27 to line 119). > > I am sorry to bother you, and I am grateful for your help. > I am going to use "case2" patch, which I expect slapd_crypt() becomes much = > faster. Thanks for the patch, now in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8724) slapo-pcache truncates remote results
by adam＠brainfood.com 06 Sep '17

06 Sep '17

I'll say it another way. ldapsearch is asking for 200 items at a time. But it gets 2000 from the local slapd, when pcache is enabled. What the local client is asking of slapd should be separate from how it talks to the back-ldap. If the back-ldap returns more results then the requested page size, then slapd should handle that. On Wed, Sep 6, 2017 at 12:59 PM, Adam Heath <adam(a)brainfood.com> wrote: > No, it's a pcache bug. > > 10.10.55.128(remote active directory) works > localhost(without pcache) works > localhost(with pcache) breaks. > > Paging of the results *does* work with AD. And works with back-ldap, > pointed at AD. It's only when pcache is added that the paging options > are ignored. > > On Wed, Sep 6, 2017 at 12:48 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: >> --On Wednesday, September 06, 2017 6:15 PM +0000 adam(a)brainfood.com wrote: >> >>> Full_Name: Adam Heath >>> Version: 2.4.44 >>> OS: debian stretch >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (99.146.168.62) >>> >>> >>> I have configured slapd to proxy to a remote server. >>> >>> Using ldapsearch, I can talk directly to that remote server, and using the >>> pr=200/noprompt option, I get back 2900 results. >>> >>> Pointing ldapsearch at localhost, *without* pcache, I get the same set of >>> results(pages, and the final count is correct). >>> >>> When I enabled slapo-pcache, with *no* attribute sets, then the paging >>> options are removed, and I get only 2000 results(the max-size from the >>> remote server). >> >> >> Hi Adam, >> >> slapo-pcahce is acting in the correct fashion. It would appear that your >> remote system is Active Directory, which in typical Microsoft fashion, >> deliberately mis-implements paged results so that it incorrectly ignores the >> maxsize setting when paged results are in use (contrary to specifications). >> I would generally suggest talking to the AD administrator so that the bind >> identity of the pcache database is not subject to the maxsize limitation. >> >> This ITS will be closed. >> >> Regards, >> Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Product Architect >> Symas Corporation >> Packaged, certified, and supported LDAP solutions powered by OpenLDAP: >> <http://www.symas.com> >>

1 0

Re: (ITS#8724) slapo-pcache truncates remote results
by adam＠brainfood.com 06 Sep '17

06 Sep '17

No, it's a pcache bug. 10.10.55.128(remote active directory) works localhost(without pcache) works localhost(with pcache) breaks. Paging of the results *does* work with AD. And works with back-ldap, pointed at AD. It's only when pcache is added that the paging options are ignored. On Wed, Sep 6, 2017 at 12:48 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, September 06, 2017 6:15 PM +0000 adam(a)brainfood.com wrote: > >> Full_Name: Adam Heath >> Version: 2.4.44 >> OS: debian stretch >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (99.146.168.62) >> >> >> I have configured slapd to proxy to a remote server. >> >> Using ldapsearch, I can talk directly to that remote server, and using the >> pr=200/noprompt option, I get back 2900 results. >> >> Pointing ldapsearch at localhost, *without* pcache, I get the same set of >> results(pages, and the final count is correct). >> >> When I enabled slapo-pcache, with *no* attribute sets, then the paging >> options are removed, and I get only 2000 results(the max-size from the >> remote server). > > > Hi Adam, > > slapo-pcahce is acting in the correct fashion. It would appear that your > remote system is Active Directory, which in typical Microsoft fashion, > deliberately mis-implements paged results so that it incorrectly ignores the > maxsize setting when paged results are in use (contrary to specifications). > I would generally suggest talking to the AD administrator so that the bind > identity of the pcache database is not subject to the maxsize limitation. > > This ITS will be closed. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: (ITS#8724) slapo-pcache truncates remote results
by quanah＠symas.com 06 Sep '17

06 Sep '17

--On Wednesday, September 06, 2017 6:15 PM +0000 adam(a)brainfood.com wrote: > Full_Name: Adam Heath > Version: 2.4.44 > OS: debian stretch > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (99.146.168.62) > > > I have configured slapd to proxy to a remote server. > > Using ldapsearch, I can talk directly to that remote server, and using the > pr=200/noprompt option, I get back 2900 results. > > Pointing ldapsearch at localhost, *without* pcache, I get the same set of > results(pages, and the final count is correct). > > When I enabled slapo-pcache, with *no* attribute sets, then the paging > options are removed, and I get only 2000 results(the max-size from the > remote server). Hi Adam, slapo-pcahce is acting in the correct fashion. It would appear that your remote system is Active Directory, which in typical Microsoft fashion, deliberately mis-implements paged results so that it incorrectly ignores the maxsize setting when paged results are in use (contrary to specifications). I would generally suggest talking to the AD administrator so that the bind identity of the pcache database is not subject to the maxsize limitation. This ITS will be closed. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8724) slapo-pcache truncates remote results
by adam＠brainfood.com 06 Sep '17

06 Sep '17

Full_Name: Adam Heath Version: 2.4.44 OS: debian stretch URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (99.146.168.62) I have configured slapd to proxy to a remote server. Using ldapsearch, I can talk directly to that remote server, and using the pr=200/noprompt option, I get back 2900 results. Pointing ldapsearch at localhost, *without* pcache, I get the same set of results(pages, and the final count is correct). When I enabled slapo-pcache, with *no* attribute sets, then the paging options are removed, and I get only 2000 results(the max-size from the remote server). Command: docker exec -ti caching-ad ldapsearch -E pr=200/noprompt -o ldif-wrap=no -z none -w 'XXXX' -b 'XXXX' -D 'XXXX' '(objectclass=group)' dn -h localhost|grep -A 5 '# search result' slapd.conf: == egrep -v '^(#|$)' ../app-hosting/brainfood-docker-image-recipes/openldap/files/caching-slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_ldap.la moduleload back_hdb.la moduleload back_bdb.la moduleload rwm moduleload pcache.la moduleload memberof.la sizelimit 5000 tool-threads 1 backend ldap readonly yes database ldap protocol-version 3 rebind-as-user norefs yes chase-referrals no uri "ldap://192.168.178.2:389" suffix "dc=ldap01,dc=com" rootdn "cn=admin,dc=ldap01,dc=com" rootpw "foobar" overlay memberof overlay pcache proxyCache hdb 100000 3 1000 100 pcachePersist TRUE cachesize 200 directory /var/lib/ldap == I expect pcache to not truncate the results from the remote server.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by hyc＠symas.com 06 Sep '17

06 Sep '17

michael(a)orlitzky.com wrote: > On 09/06/2017 09:29 AM, Howard Chu wrote: >> >> Learn something about Unix, please. >> >> Use the ps command to verify that the process at least has the correct name. >> The init script should know it's looking for a process named slapd, not init. >> > > Supposing we want to copy/paste two or more "ps" calls into every slapd > init script, this still lets a hacker prevent his own hacked process > from being killed by writing junk into the file. > > If the standard practice was to write the PID file as an unprivileged > user, we would need to not only copy/paste those "ps" calls into every > slapd init script, but literally every init script for every daemon. > Apparently my predecessors didn't want to do that, so the standard > practice is to write the PID file as root. Do with that information what > you will. Apparently your predecessors also didn't understand that PIDs get recycled. If your init scripts are just blindly trusting the contents of PID files they're all broken already. But none of that is of any concern of the OpenLDAP Project. Closing this ITS as Invalid. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 06 Sep '17

06 Sep '17

On 09/06/2017 09:29 AM, Howard Chu wrote: > > Learn something about Unix, please. > > Use the ps command to verify that the process at least has the correct name. > The init script should know it's looking for a process named slapd, not init. > Supposing we want to copy/paste two or more "ps" calls into every slapd init script, this still lets a hacker prevent his own hacked process from being killed by writing junk into the file. If the standard practice was to write the PID file as an unprivileged user, we would need to not only copy/paste those "ps" calls into every slapd init script, but literally every init script for every daemon. Apparently my predecessors didn't want to do that, so the standard practice is to write the PID file as root. Do with that information what you will.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by hyc＠symas.com 06 Sep '17

06 Sep '17

michael(a)orlitzky.com wrote: > On 09/06/2017 08:29 AM, Howard Chu wrote: >>> 6. I run "/etc/init.d/slapd stop" to stop the daemon while I investigate >>> the weird behavior resulting from the hack. >> >> Even if that were possible, it's clearly a bug in the init script, which >> failed to check that the process with that PID was the process it was >> expecting to find. Note that this is something any init script needs to do >> anyway, since PID files can go stale and some other process may be using the >> PID by the time you reference the file. > > Have you ever seen such an init script? > > How should the init system know what process it was expecting to find, > if not by reading that process's PID from the PID file? Learn something about Unix, please. Use the ps command to verify that the process at least has the correct name. The init script should know it's looking for a process named slapd, not init. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 06 Sep '17

06 Sep '17

On 09/06/2017 08:29 AM, Howard Chu wrote: > >> 4. Someone compromises the daemon, which sits on the open network. > > Nobody compromises slapd from the network. There are no buffer overflow > vulnerabilities, there are no RCE vulnerabilities. > Oh, it's one of /those/ daemons. >> >> 6. I run "/etc/init.d/slapd stop" to stop the daemon while I investigate >> the weird behavior resulting from the hack. > > Even if that were possible, it's clearly a bug in the init script, which > failed to check that the process with that PID was the process it was > expecting to find. Note that this is something any init script needs to do > anyway, since PID files can go stale and some other process may be using the > PID by the time you reference the file. Have you ever seen such an init script? How should the init system know what process it was expecting to find, if not by reading that process's PID from the PID file? If you decide not to write the PID file as root, that's of course up to you, but I still have to tell something to the people who ship OpenLDAP as part of their distributions. I can tell them "Howard says it should be easy," but considering that no one has ever done it, that's not real helpful advice. There are only two requirements really: it needs to be portable POSIX sh, and the stop() function must only kill the one process created by start(). If you give that a shot, you might see why I suggested that this be fixed in slapd.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by hyc＠symas.com 06 Sep '17

06 Sep '17

michael(a)orlitzky.com wrote: > On 09/05/2017 05:38 PM, Ryan Tandy wrote: >> >> If you would like to propose a patch, we could review that. For myself I >> don't think I would attach a high priority to this. > > I understand that it's a low priority, I'm just trying to clean up the > hundred or so cases of this that we have in Gentoo. In a few, it's > impossible to do so because of the way the daemon creates the PID file > (like it is here), so I'm doing bugs/CVEs to keep track of them. This > way that distribution maintainers have something to watch and will know > when they can fix their init scripts. Your problem scenario is still unrealistic. > 4. Someone compromises the daemon, which sits on the open network. Nobody compromises slapd from the network. There are no buffer overflow vulnerabilities, there are no RCE vulnerabilities. > 5. The attacker is generally limited in what he can do because the > daemon doesn't run as root. However, he can write "1" into the > slapd.pid file, and he does. > > 6. I run "/etc/init.d/slapd stop" to stop the daemon while I investigate > the weird behavior resulting from the hack. Even if that were possible, it's clearly a bug in the init script, which failed to check that the process with that PID was the process it was expecting to find. Note that this is something any init script needs to do anyway, since PID files can go stale and some other process may be using the PID by the time you reference the file. > 7. Oops, the machine reboots, because I killed PID 1. > Big deal, you caused a temporary service outage. No remote code was injected, no data was leaked, no actual lasting damage was done. I'm inclined to close this ticket. It presupposes a class of bug that doesn't exist in OpenLDAP code, and it relies on an additional bug in a script that isn't part of OpenLDAP code. At best, this ticket has been mis-filed and the submitter needs to submit it to somewhere relevant, like whoever authored the broken init script. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 06 Sep '17

06 Sep '17

On 09/05/2017 05:38 PM, Ryan Tandy wrote: > > If you would like to propose a patch, we could review that. For myself I > don't think I would attach a high priority to this. I understand that it's a low priority, I'm just trying to clean up the hundred or so cases of this that we have in Gentoo. In a few, it's impossible to do so because of the way the daemon creates the PID file (like it is here), so I'm doing bugs/CVEs to keep track of them. This way that distribution maintainers have something to watch and will know when they can fix their init scripts. > Howard pointed out on IRC that if the directory containing the pid file > is sticky, making it owned by root means slapd can no longer remove it > on exit. I'm not sure how common that is but it's a setup that works > right now. Typically the PID file would go directly in /run (or /var/run) and be owned by root. That means that you can't clean it up when the daemon exits, but no one expects a daemon to do that. Practically, the PID file exists solely for the benefit of init systems. Given the choice between, 1. How do I determine if I can trust the contents of this file owned by an untrusted user? 2. How do I remove the PID file after killing the daemon? the second is much easier to do. The first is next to impossible to get right; so if we have to pick one, that's the way to go IMO.

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

michael(a)stroeder.com wrote: > If you don't mind I just produce another follow-up patch for the > man-page. Find this man-page patch here: https://www.stroeder.com/temp/0001-ITS-8714-man-page-corrections-regarding-… Ciao, Michael.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by ryan＠openldap.org 05 Sep '17

05 Sep '17

On Fri, Jul 28, 2017 at 07:35:47PM +0000, michael(a)orlitzky.com wrote: >The slapd daemon should create its PID file before dropping privileges. This >represents a minor security issue; additional factors are needed to make it >exploitable. If I understood you correctly, "Additional factors are needed" basically means you have to find a code execution vulnerability in slapd? At that point I think you can do much more interesting things - pretending that your user is uid 0, or in various admin groups are only the first ideas that come to mind. If you would like to propose a patch, we could review that. For myself I don't think I would attach a high priority to this. Howard pointed out on IRC that if the directory containing the pid file is sticky, making it owned by root means slapd can no longer remove it on exit. I'm not sure how common that is but it's a setup that works right now.

1 0

Re: (ITS#8703) slapd should create its PID file before dropping privileges
by michael＠orlitzky.com 05 Sep '17

05 Sep '17

This has been assigned CVE-2017-14159.

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

Howard Chu wrote: > You could add a LIMITATIONS section, as slapd-monitor.5 and > slapd-shell.5 does. The manpage now needs an update to note that > the exop value is base64 encoded. Also, since it is encoded, I > don't believe it's necessary to explicitly send the valuelen. Ah, yes. Forgot to update the message format in the man-page. If you don't mind I just produce another follow-up patch for the man-page. Ok? Ciao, Michael.

1 0

Re: (ITS#8714)
by hyc＠symas.com 05 Sep '17

05 Sep '17

Michael Str=C3=B6der wrote: > hyc(a)symas.com wrote: >> There's a weird indent at extended.c:50 or so, the if() >> statement. >> >> Would be better to use op->o_tmpalloc instead of ber_memalloc >> since you'r=3D e=3D20 immediately freeing the buffer again anyway. >> >> I can fix those here if you don't care. >=20 > Yes, I'd highly appreciate if you simply adjust it to your coding style= . >=20 > One additional point: > Currently the external program is not able to produce a custom extended= =20 > operation response. Mainly it should always return CONTINUE or an error= =20 > response. I wanted to make this limitation clear in the man-page but wa= s=20 > unsure about the appropriate section. You could add a LIMITATIONS section, as slapd-monitor.5 and slapd-shell.5= =20 does. The manpage now needs an update to note that the exop value is base= 64=20 encoded. Also, since it is encoded, I don't believe it's necessary to=20 explicitly send the valuelen. --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

hyc(a)symas.com wrote: > There's a weird indent at extended.c:50 or so, the if() > statement. > > Would be better to use op->o_tmpalloc instead of ber_memalloc > since you'r= e=20 immediately freeing the buffer again anyway. > > I can fix those here if you don't care. Yes, I'd highly appreciate if you simply adjust it to your coding style. One additional point: Currently the external program is not able to produce a custom extended operation response. Mainly it should always return CONTINUE or an error response. I wanted to make this limitation clear in the man-page but was unsure about the appropriate section. Ciao, Michael.

1 0

Re: (ITS#8714)
by hyc＠symas.com 05 Sep '17

05 Sep '17

Michael Str=C3=B6der wrote: > Howard Chu wrote: >> Your patch is missing extended.c >=20 > Aargh! Corrected herein: >=20 > https://www.stroeder.com/temp/0001-ITS-8714-Send-out-EXTENDED-operation= -message-from-back-sock_rev3.patch=20 There's a weird indent at extended.c:50 or so, the if() statement. Would be better to use op->o_tmpalloc instead of ber_memalloc since you'r= e=20 immediately freeing the buffer again anyway. I can fix those here if you don't care. --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

This is a cryptographically signed message in MIME format. --------------ms020207030808080005010306 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable Howard Chu wrote: > Your patch is missing extended.c Aargh! Corrected herein: https://www.stroeder.com/temp/0001-ITS-8714-Send-out-EXTENDED-operation-m= essage-from-back-sock_rev3.patch Ciao, Michael. --------------ms020207030808080005010306 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CucwggT9MIID5aADAgECAhBFRleVrRF8X5GwbV0tcLCgMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwOTE2MDcxNjUxWhcNMTkxMjE2MDcxNjUxWjBEMR0wGwYDVQQDDBRtaWNo YWVsQHN0cm9lZGVyLmNvbTEjMCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20w ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChMBt5jtuLXsNQ5U7rBbZit8sknIwz hfaousT3d/fssQ6qZwe9l1yklILSXVMqI7/bxbiqcd3zrz+imdSlZPrFBHGfh04DZHCfss2F RwSswGejqP1qE3hPvZi96wFfOMqenpN+pSXqNJ1OPBCJ8a+8ZEioFKoEj3HkCCXjbmezAgms FuA7aFE9BfjJ2eQKw8B9G8X1FjvOTinYSZ2F+qHpKgywl4HTx0dMnYy+Pwu4DDIHkEaVH+uj K1/ed76WUEH51mX9m2Xu0onfQlSM3me6EvAAZiIDsCEbF9WttRuJbpfCFo0m2uW7BBugS7EG Jro1nRSQVnpJyTFgHb5EGMVVAgMBAAGjggG4MIIBtDAOBgNVHQ8BAf8EBAMCBLAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFh1801TSuxT Nltnv9rOjrZzUUgNMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUF BwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUF BzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYD VR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3Js MB8GA1UdEQQYMBaBFG1pY2hhZWxAc3Ryb2VkZXIuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tLzBHBgNVHSAEQDA+MDwGCysGAQQBgbU3AQIFMC0wKwYIKwYBBQUH AgEWH2h0dHBzOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggEB AKiJ9wpjJeHdEzHDZyqmhn4cHcRj9Ag7ZQK0meq1N3oQ9M1YeVge6vZe20LXojgXsNUQGLSt 1lW2s7fABkL9CF+/RtWznHxlp4YpWX/RgbHBo3uXKNA5JUOjbxQ2+1b1jaTp/FUrSIISAxgd RpeYAODJ0db1x8Q+l66DtIVjj7ktWISdJWE2Opn4QnaRwdj6n35Rul4S2ikUsmxtGrHLpjRR XJqbsGa0RZdJyUKlZ2ZRAoRz4jKHOogQcig937sR5Ut2pGOhrScEhgARY2c8Gs2olRTL3pue mE4vjY0g1Nwr9RzeFwMuasiFh4yD34i6jIRfoNzuLPgydjsJ0grw0akwggXiMIIDyqADAgEC AhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAklMMRYwFAYD VQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0 ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17Ake fMyUGwrQdvwObhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzL A84J6Ws5T4NfXZ0qn4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmC S+kICslYYWgXOMt2xlsSslxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6my Su8j8BWWHpChNNeTrFuhVfrOAyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR 9t4APXGzAgMBAAGjggFkMIIBYDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0 cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEF BQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDAGCCsGAQUFBzAChiRodHRwOi8vYWlh LnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0OBBYEFCSBbDlhvkkPj7cbRivJKLUn SG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMD8GA1UdIAQ4MDYwNAYEVR0g ADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZI hvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh2NCXTq7im61g7F1L IiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw5kG3DN8pd1hS EUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07v29MdhaP v3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Yklue /quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6 UpVDo/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHM zcwk3EV2B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuK KwHNL8F4GGp6jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ 8j6y6S9p0xE/Ga0peVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMYIDzDCCA8gCAQEwgYkw dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx IENsaWVudCBDQQIQRUZXla0RfF+RsG1dLXCwoDANBglghkgBZQMEAgEFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwOTA1MTM1NjA1WjAvBgkq hkiG9w0BCQQxIgQg8GCP1w5NtTSxcpwIYyPNKa+KPNyCIiZ5C20j5QlpXN0wbAYJKoZIhvcN AQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3 DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBmgYJKwYB BAGCNxAEMYGMMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkw JwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3Rh cnRDb20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwgZwGCyqGSIb3DQEJ EAILMYGMoIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYD VQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRD b20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwDQYJKoZIhvcNAQEBBQAE ggEAQWsqReIlurKEhbkx577vMfgCmQaZVpXF0KGu367xj9DvBl9zN676ewWNz+H8r9bowUsX BvW5CocLPm0AyLAnsxgtIyyGX2OWci4da3dJs0Du1yjh1mjArfi/zmRVSFtKJEJgE7/dtWLF Vi/hVggifhJ/2vvvh4zQFGpi7pBeF+mv2YeUk9nrcOhVV6jr7rDyzRWXF2tvs+qv8BILtg+n vc4CnBTRL388vLzIreOAcORrUnJagh6IvRlydZyG4S2zXCBEOLwRzBkUADLqo5MmODiGuD8m X4Cnp0awozR+DYIrx6AhjzIpaCuWqoj6l3HG+6S2oNvY3ifwyH5Uj9cUHgAAAAAAAA== --------------ms020207030808080005010306--

1 0

Re: (ITS#8714)
by hyc＠symas.com 05 Sep '17

05 Sep '17

michael(a)stroeder.com wrote: > This is a multi-part message in MIME format. > --------------E329EF3D834E0A798BAC2EBC > Content-Type: text/plain; charset=UTF-8; format=flowed > Content-Transfer-Encoding: 7bit > > Find attached a new patch which base64-encoded the extended > operation request value before sending it to the socket. > > You can also download patch file here: Your patch is missing extended.c -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8714)
by michael＠stroeder.com 05 Sep '17

05 Sep '17

This is a multi-part message in MIME format. --------------E329EF3D834E0A798BAC2EBC Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Find attached a new patch which base64-encoded the extended operation request value before sending it to the socket. You can also download patch file here: https://www.stroeder.com/temp/0001-ITS-8714-Send-out-EXTENDED-operation-mes… Ciao, Michael. --------------E329EF3D834E0A798BAC2EBC Content-Type: text/x-patch; name="0001-ITS-8714-Send-out-EXTENDED-operation-message-from-back-sock_rev2.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename*0="0001-ITS-8714-Send-out-EXTENDED-operation-message-from-back-"; filename*1="sock_rev2.patch" >From 7e584ffc4235f7e120b69acbd0b41cac9fe47ba3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michael=20Str=C3=B6der?= <michael(a)stroeder.com> Date: Tue, 5 Sep 2017 15:30:28 +0200 Subject: [PATCH] ITS#8714 Send out EXTENDED operation message from back-sock --- doc/man/man5/slapd-sock.5 | 19 ++++++++++++++++++- servers/slapd/back-sock/Makefile.in | 4 ++-- servers/slapd/back-sock/config.c | 12 ++++++++++-- servers/slapd/back-sock/init.c | 2 +- servers/slapd/back-sock/proto-sock.h | 2 ++ 5 files changed, 33 insertions(+), 6 deletions(-) diff --git a/doc/man/man5/slapd-sock.5 b/doc/man/man5/slapd-sock.5 index 1ac4f7fdd..b2fb21cc1 100644 --- a/doc/man/man5/slapd-sock.5 +++ b/doc/man/man5/slapd-sock.5 @@ -49,7 +49,7 @@ be sent and from which replies are received. When used as an overlay, these additional directives are defined: .TP -.B sockops [ bind | unbind | search | compare | modify | modrdn | add | delete ]* +.B sockops [ bind | unbind | search | compare | modify | modrdn | add | delete | extended ]* Specify which request types to send to the external program. The default is empty (no requests are sent). .TP @@ -115,6 +115,18 @@ dn: <DN> .PP .RS .nf +EXTENDED +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +oid: <OID> +valuelen: <length of <value>> +value: <value> +<blank line> +.fi +.RE +.PP +.RS +.nf MODIFY msgid: <message id> <repeat { "suffix:" <database suffix DN> }> @@ -292,6 +304,11 @@ access to the pseudo_attribute of the searchBase; .B search (=s) access to the attributes and values used in the filter is not checked. +.LP +The +.B extended +operation does not require any access special rights. +The external program has to implement any sort of access control. .SH EXAMPLE There is an example script in the slapd/back\-sock/ directory diff --git a/servers/slapd/back-sock/Makefile.in b/servers/slapd/back-sock/Makefile.in index 3e527e545..efb916246 100644 --- a/servers/slapd/back-sock/Makefile.in +++ b/servers/slapd/back-sock/Makefile.in @@ -18,9 +18,9 @@ ## in OpenLDAP Software. SRCS = init.c config.c opensock.c search.c bind.c unbind.c add.c \ - delete.c modify.c modrdn.c compare.c result.c + delete.c modify.c modrdn.c compare.c result.c extended.c OBJS = init.lo config.lo opensock.lo search.lo bind.lo unbind.lo add.lo \ - delete.lo modify.lo modrdn.lo compare.lo result.lo + delete.lo modify.lo modrdn.lo compare.lo result.lo extended.lo LDAP_INCDIR= ../../../include LDAP_LIBDIR= ../../../libraries diff --git a/servers/slapd/back-sock/config.c b/servers/slapd/back-sock/config.c index dc3f1365c..2dcf68bf6 100644 --- a/servers/slapd/back-sock/config.c +++ b/servers/slapd/back-sock/config.c @@ -106,6 +106,7 @@ static ConfigOCs osocs[] = { #define SOCK_OP_MODRDN 0x020 #define SOCK_OP_ADD 0x040 #define SOCK_OP_DELETE 0x080 +#define SOCK_OP_EXTENDED 0x100 #define SOCK_REP_RESULT 0x001 #define SOCK_REP_SEARCH 0x002 @@ -127,6 +128,7 @@ static slap_verbmasks ov_ops[] = { { BER_BVC("modrdn"), SOCK_OP_MODRDN }, { BER_BVC("add"), SOCK_OP_ADD }, { BER_BVC("delete"), SOCK_OP_DELETE }, + { BER_BVC("extended"), SOCK_OP_EXTENDED }, { BER_BVNULL, 0 } }; @@ -249,7 +251,9 @@ static BI_op_bind *sockfuncs[] = { sock_back_modify, sock_back_modrdn, sock_back_add, - sock_back_delete + sock_back_delete, + 0, /* abandon not supported */ + sock_back_extended }; static const int sockopflags[] = { @@ -260,7 +264,9 @@ static const int sockopflags[] = { SOCK_OP_MODIFY, SOCK_OP_MODRDN, SOCK_OP_ADD, - SOCK_OP_DELETE + SOCK_OP_DELETE, + 0, /* abandon not supported */ + SOCK_OP_EXTENDED }; static int sock_over_op( @@ -283,6 +289,7 @@ static int sock_over_op( case LDAP_REQ_MODRDN: which = op_modrdn; break; case LDAP_REQ_ADD: which = op_add; break; case LDAP_REQ_DELETE: which = op_delete; break; + case LDAP_REQ_EXTENDED: which = op_extended; break; default: return SLAP_CB_CONTINUE; } @@ -365,6 +372,7 @@ sock_over_setup() sockover.on_bi.bi_op_modrdn = sock_over_op; sockover.on_bi.bi_op_add = sock_over_op; sockover.on_bi.bi_op_delete = sock_over_op; + sockover.on_bi.bi_extended = sock_over_op; sockover.on_response = sock_over_response; sockover.on_bi.bi_cf_ocs = osocs; diff --git a/servers/slapd/back-sock/init.c b/servers/slapd/back-sock/init.c index dcfe61a44..92e68782f 100644 --- a/servers/slapd/back-sock/init.c +++ b/servers/slapd/back-sock/init.c @@ -53,7 +53,7 @@ sock_back_initialize( bi->bi_op_delete = sock_back_delete; bi->bi_op_abandon = 0; - bi->bi_extended = 0; + bi->bi_extended = sock_back_extended; bi->bi_chk_referrals = 0; diff --git a/servers/slapd/back-sock/proto-sock.h b/servers/slapd/back-sock/proto-sock.h index fa02ab896..8b3b5f3ef 100644 --- a/servers/slapd/back-sock/proto-sock.h +++ b/servers/slapd/back-sock/proto-sock.h @@ -40,6 +40,8 @@ extern BI_op_modrdn sock_back_modrdn; extern BI_op_add sock_back_add; extern BI_op_delete sock_back_delete; +extern BI_op_extended sock_back_extended; + extern int sock_back_init_cf( BackendInfo *bi ); LDAP_END_DECL -- 2.14.1 --------------E329EF3D834E0A798BAC2EBC--

1 0

Re: (ITS#8723) slaptest reports success status in stderr
by hyc＠symas.com 05 Sep '17

05 Sep '17

arun(a)gluu.org wrote: > Full_Name: Arunmozhi > Version: 2.4 > OS: Ubuntu 14.04.5 x64 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (103.52.54.225) > > > slaptest when run with -f and -F arguments for slapd.conf to slapd.d conversion > returns all the messages only in stderr instead of returning success messages in > stdout. > > I am developing a tool which sends commands over SSH and catches the replies > using the Python Library Paramiko. It clearly captures stdin, stdout and stderr > when a command is run and returns to the user > (http://docs.paramiko.org/en/2.2/api/client.html#paramiko.client.SSHClient.e…) > > I noticed that the message "config file testing succeeded" is returned back in > the channel stderr and not stdout. > > Kindly take a look. It might be a one line fix. :) This is not a bug. slaptest doesn't produce any actual output, only diagnostic messages and an exit code. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8723) slaptest reports success status in stderr
by arun＠gluu.org 05 Sep '17

05 Sep '17

Full_Name: Arunmozhi Version: 2.4 OS: Ubuntu 14.04.5 x64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (103.52.54.225) slaptest when run with -f and -F arguments for slapd.conf to slapd.d conversion returns all the messages only in stderr instead of returning success messages in stdout. I am developing a tool which sends commands over SSH and catches the replies using the Python Library Paramiko. It clearly captures stdin, stdout and stderr when a command is run and returns to the user (http://docs.paramiko.org/en/2.2/api/client.html#paramiko.client.SSHClient.e…) I noticed that the message "config file testing succeeded" is returned back in the channel stderr and not stdout. Kindly take a look. It might be a one line fix. :) Thanks and Regards, Arunmozhi

1 0

Re: (ITS#8722) MDB_LAST_DUP/FIRST_DUP return item beyond last item
by h.b.furuseth＠usit.uio.no 05 Sep '17

05 Sep '17

On 05/09/17 08:46, h.b.furuseth(a)usit.uio.no wrote: > Happens with the test program without arguments. When run with > arguments so it uses a sub-page, it returns some other garbage. > Er, happens with the test program, period. With arguments it runs some other garbage than the program's "designed" garbage. Commit 8498c6cba2d78de420e626245a49db4705e5a6f6 "ITS#7913 mdb_cursor_get(*_DUP) cleanup" changed how the test program breaks: Before that, it said EINVAL when run without args (no sub-page).

1 0

(ITS#8722) MDB_LAST_DUP/FIRST_DUP return item beyond last item
by h.b.furuseth＠usit.uio.no 04 Sep '17

04 Sep '17

Full_Name: Hallvard B Furuseth Version: LMDB_0.9.21, mdb.master, master2 OS: Linux x86_64 URL: ftp://ftp.openldap.org/incoming/Hallvard-Furuseth-170905.c Submission from: (NULL) (81.191.45.31) Submitted by: hallvard mdb_cursor_get(MDB_LAST_DUP/MDB_FIRST_DUP) can return a deleted item when mc_ki[] == NUMKEYS(), i.e. an "ack!" cursor in mdb_cursor_chk(). Happens with the test program without arguments. When run with arguments so it uses a sub-page, it returns some other garbage. $ ./a.out mc {flags 0x4b, ki-numkeys 0}; mx {flags 0x4, ki 0} cursor_get() = Successful return: 0 node: dsize 0x68686c6c, flags 0x6161, ksize 0x7a7a key "kkkkkkkkk...", data "<garbage>". Segmentation fault (core dumped) It should return MDB_NOTFOUND or last key:data item, not sure which. It should return the same when run with and without an argument.

1 0

(ITS#8721) Quarantine in meta backend
by michele.lugli＠unife.it 04 Sep '17

04 Sep '17

Full_Name: Michele Lugli Version: 2.4.45 OS: Linux Ubuntu server 16.04 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (192.167.209.10) Quarantine function in back-meta will permanently disable a target if a query is received while the quarantine has been imposed. Same problem reported in ITS#5592 and marked as "solved": still exists under some circustances. To reproduce: use config below, assume the first target works correctly and the second is unavailable. Send a query and the quarantine will be set. Sending more queries, with searchbase "dc=example,dc=com" and within 20 seconds, the quarantine will never lift. Tested on latest release available (commit bb62d9cb732c894023c5c9f5893acf40add7376c - Aug 31 16:53:45 2017). ---- slapd.conf ---- database meta suffix dc=example,dc=com quarantine 20,+ uri ldap://itworks.example.com/dc=subtree1,dc=example,dc=com uri ldap://afakeaddress/dc=subtree2,dc=example,dc=com ---- slapd logs ---- 59ad1507 conn=1000 op=1 meta_back_quarantine[1]: enter. 59ad1519 conn=1001 op=1: meta_back_getconn[1] quarantined 59ad1527 conn=1002 op=1: meta_back_getconn[1] quarantined 59ad1539 conn=1003 op=1: meta_back_getconn[1] quarantined 59ad154b conn=1004 op=1: meta_back_getconn[1] quarantined ....

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 03 Sep '17

03 Sep '17

Dear Howard-san, >That comment only applies when using LDAP_MEMORY_DEBUG and is irrelevant. I saw memory.c again.=20 As you told, I confirmed the comment was available only when LDAP_MEMORY_DE= BUG was used(from line 27 to line 119). I am sorry to bother you, and I am grateful for your help. I am going to use "case2" patch, which I expect slapd_crypt() becomes much = faster. Best Reagrds, ************************************************ Yoshinori Nishino NEC Solution Innovators, Ltd. 1-18-7 Shinkiba, Koto-ku, Tokyo, 136-8627 Japan E-MAIL: yos-nishino(a)ys.jp.nec.com ************************************************

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 03 Sep '17

03 Sep '17

Yoshinori Nishino wrote: > Dear Howard-san, > >> There is no issue with thread-safety for ber_strdup. What exact line of memory.c are you talking about? > > I think ber_strdup(), which uses ber_memalloc_x(), is non thread-safe because of the following comment at around line 69 of memory.c: > > /* Note sequence and ber_int_meminuse are counters, but are not > * thread safe. If you want to use these values for multithreaded applications, > * you must put mutexes around them, otherwise they will have incorrect values. > * When debugging, if you sort the debug output, the sequence number will > * put allocations/frees together. It is then a simple matter to write a script > * to find any allocations that don't have a buffer free function. > */ That comment only applies when using LDAP_MEMORY_DEBUG and is irrelevant. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 03 Sep '17

03 Sep '17

Dear Howard-san, >There is no issue with thread-safety for ber_strdup. What exact line of me= mory.c are you talking about? I think ber_strdup(), which uses ber_memalloc_x(), is non thread-safe becau= se of the following comment at around line 69 of memory.c: /* Note sequence and ber_int_meminuse are counters, but are not * thread safe. If you want to use these values for multithreaded applicat= ions, * you must put mutexes around them, otherwise they will have incorrect val= ues. * When debugging, if you sort the debug output, the sequence number will=20 * put allocations/frees together. It is then a simple matter to write a s= cript * to find any allocations that don't have a buffer free function. */ Best Regards, ************************************************ Yoshinori Nishino NEC Solution Innovators, Ltd. 1-18-7 Shinkiba, Koto-ku, Tokyo, 136-8627 Japan E-MAIL: yos-nishino(a)ys.jp.nec.com ************************************************

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 03 Sep '17

03 Sep '17

Yoshinori Nishino wrote: > I decide to use passwd_mutex only for ber_strdup(), which seems to be non thread-safe according to ./libraries/liblber/memory.c. There is no issue with thread-safety for ber_strdup. What exact line of memory.c are you talking about? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 02 Sep '17

02 Sep '17

--_003_282E583D7ED52C4FA3C4CC199465868B02804CD4BPXM04GPgispnec_ Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable Dear Howard-san, >I created two patches for passwd.c. I am sorry. The patches I sent before were wrong because free(data) is left= . I send the fixed patches again. Best Regards, ************************************************ Yoshinori Nishino NEC Solution Innovators, Ltd. 1-18-7 Shinkiba, Koto-ku, Tokyo, 136-8627 Japan E-MAIL: yos-nishino(a)ys.jp.nec.com ************************************************ --_003_282E583D7ED52C4FA3C4CC199465868B02804CD4BPXM04GPgispnec_ Content-Type: application/octet-stream; name="openldap-slapd_crypt_case2.patch" Content-Description: openldap-slapd_crypt_case2.patch Content-Disposition: attachment; filename="openldap-slapd_crypt_case2.patch"; size=1382; creation-date="Sun, 03 Sep 2017 01:05:35 GMT"; modification-date="Sun, 03 Sep 2017 02:11:42 GMT" Content-Transfer-Encoding: base64 bW9kaWZ5IHBhc3N3ZC5jIHNvIHRoYXQgc2xhcGRfY3J5cHQoKSB1c2VzIGNyeXB0X3IoKS4KCmRp ZmYgLS1naXQgYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3ZC5jIGIvc2VydmVycy9zbGFwZC9wYXNzd2Qu YwppbmRleCBkZmEzNzBjLi5lY2UwNWZiIDEwMDY0NAotLS0gYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3 ZC5jCisrKyBiL3NlcnZlcnMvc2xhcGQvcGFzc3dkLmMKQEAgLTIzLDggKzIzLDExIEBACiAjaW5j bHVkZSA8YWMvdW5pc3RkLmg+CiAKICNpZmRlZiBTTEFQRF9DUllQVAorI2lmZGVmIEhBVkVfQ1JZ UFRfUgorI2RlZmluZSBfX1VTRV9HTlUKKyNlbmRpZiAvKiBIQVZFX0NSWVBUX1IgKi8KICNpbmNs dWRlIDxhYy9jcnlwdC5oPgotI2VuZGlmCisjZW5kaWYgLyogU0xBUERfQ1JZUFQgKi8KIAogI2lu Y2x1ZGUgInNsYXAuaCIKIApAQCAtNTkwLDYgKzU5MywzMCBAQCBzbGFwX3Bhc3N3ZF9oYXNoKAog c3RhdGljIGxkYXBfcHZ0X3RocmVhZF9tdXRleF90IHBhc3N3ZF9tdXRleDsKIHN0YXRpYyBsdXRp bF9jcnlwdGZ1bmMgc2xhcGRfY3J5cHQ7CiAKKyNpZmRlZiBIQVZFX0NSWVBUX1IKK3N0YXRpYyBp bnQgc2xhcGRfY3J5cHQoIGNvbnN0IGNoYXIgKmtleSwgY29uc3QgY2hhciAqc2FsdCwgY2hhciAq Kmhhc2ggKQoreworCWNoYXIgKmNyOworCWludCByYzsKKwlzdHJ1Y3QgY3J5cHRfZGF0YSBkYXRh OworICAgIAorCWRhdGEuaW5pdGlhbGl6ZWQgPSAwOworCWNyID0gY3J5cHRfcigga2V5LCBzYWx0 LCAmZGF0YSApOworCWlmICggY3IgPT0gTlVMTCB8fCBjclswXSA9PSAnXDAnICkgeworCQkvKiBz YWx0IG11c3QgaGF2ZSBiZWVuIGludmFsaWQgKi8KKwkJcmMgPSBMVVRJTF9QQVNTV0RfRVJSOwor CX0gZWxzZSB7CisJCWlmICggaGFzaCApIHsKKwkJCSpoYXNoID0gYmVyX3N0cmR1cCggY3IgKTsK KwkJCXJjID0gTFVUSUxfUEFTU1dEX09LOworCQl9IGVsc2UgeworCQkJcmMgPSBzdHJjbXAoIHNh bHQsIGNyICkgPyBMVVRJTF9QQVNTV0RfRVJSIDogTFVUSUxfUEFTU1dEX09LOworCQl9CisJfQor CisgICAgcmV0dXJuIHJjOworfQorI2Vsc2UKIHN0YXRpYyBpbnQgc2xhcGRfY3J5cHQoIGNvbnN0 IGNoYXIgKmtleSwgY29uc3QgY2hhciAqc2FsdCwgY2hhciAqKmhhc2ggKQogewogCWNoYXIgKmNy OwpAQCAtNjE0LDYgKzY0MSw4IEBAIHN0YXRpYyBpbnQgc2xhcGRfY3J5cHQoIGNvbnN0IGNoYXIg KmtleSwgY29uc3QgY2hhciAqc2FsdCwgY2hhciAqKmhhc2ggKQogCWxkYXBfcHZ0X3RocmVhZF9t dXRleF91bmxvY2soICZwYXNzd2RfbXV0ZXggKTsKIAlyZXR1cm4gcmM7CiB9CisjZW5kaWYgLyog SEFWRV9DUllQVF9SICovCisKICNlbmRpZiAvKiBTTEFQRF9DUllQVCAqLwogCiB2b2lkIHNsYXBf cGFzc3dkX2luaXQoKQo= --_003_282E583D7ED52C4FA3C4CC199465868B02804CD4BPXM04GPgispnec_ Content-Type: application/octet-stream; name="openldap-slapd_crypt_case1.patch" Content-Description: openldap-slapd_crypt_case1.patch Content-Disposition: attachment; filename="openldap-slapd_crypt_case1.patch"; size=1482; creation-date="Sun, 03 Sep 2017 01:05:32 GMT"; modification-date="Sun, 03 Sep 2017 02:10:39 GMT" Content-Transfer-Encoding: base64 bW9kaWZ5IHBhc3N3ZC5jIHNvIHRoYXQgc2xhcGRfY3J5cHQoKSB1c2VzIGNyeXB0X3IoKS4KCmRp ZmYgLS1naXQgYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3ZC5jIGIvc2VydmVycy9zbGFwZC9wYXNzd2Qu YwppbmRleCBkZmEzNzBjLi40OTcwNWY4IDEwMDY0NAotLS0gYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3 ZC5jCisrKyBiL3NlcnZlcnMvc2xhcGQvcGFzc3dkLmMKQEAgLTIzLDggKzIzLDExIEBACiAjaW5j bHVkZSA8YWMvdW5pc3RkLmg+CiAKICNpZmRlZiBTTEFQRF9DUllQVAorI2lmZGVmIEhBVkVfQ1JZ UFRfUgorI2RlZmluZSBfX1VTRV9HTlUKKyNlbmRpZiAvKiBIQVZFX0NSWVBUX1IgKi8KICNpbmNs dWRlIDxhYy9jcnlwdC5oPgotI2VuZGlmCisjZW5kaWYgLyogU0xBUERfQ1JZUFQgKi8KIAogI2lu Y2x1ZGUgInNsYXAuaCIKIApAQCAtNTkwLDYgKzU5MywzMiBAQCBzbGFwX3Bhc3N3ZF9oYXNoKAog c3RhdGljIGxkYXBfcHZ0X3RocmVhZF9tdXRleF90IHBhc3N3ZF9tdXRleDsKIHN0YXRpYyBsdXRp bF9jcnlwdGZ1bmMgc2xhcGRfY3J5cHQ7CiAKKyNpZmRlZiBIQVZFX0NSWVBUX1IKK3N0YXRpYyBp bnQgc2xhcGRfY3J5cHQoIGNvbnN0IGNoYXIgKmtleSwgY29uc3QgY2hhciAqc2FsdCwgY2hhciAq Kmhhc2ggKQoreworCWNoYXIgKmNyOworCWludCByYzsKKwlzdHJ1Y3QgY3J5cHRfZGF0YSBkYXRh OworICAgIAorCWRhdGEuaW5pdGlhbGl6ZWQgPSAwOworCWNyID0gY3J5cHRfcigga2V5LCBzYWx0 LCAmZGF0YSApOworCWlmICggY3IgPT0gTlVMTCB8fCBjclswXSA9PSAnXDAnICkgeworCQkvKiBz YWx0IG11c3QgaGF2ZSBiZWVuIGludmFsaWQgKi8KKwkJcmMgPSBMVVRJTF9QQVNTV0RfRVJSOwor CX0gZWxzZSB7CisJCWlmICggaGFzaCApIHsKKwkJCWxkYXBfcHZ0X3RocmVhZF9tdXRleF9sb2Nr KCAmcGFzc3dkX211dGV4ICk7CisJCQkqaGFzaCA9IGJlcl9zdHJkdXAoIGNyICk7CisJCQlsZGFw X3B2dF90aHJlYWRfbXV0ZXhfdW5sb2NrKCAmcGFzc3dkX211dGV4ICk7CisJCQlyYyA9IExVVElM X1BBU1NXRF9PSzsKKwkJfSBlbHNlIHsKKwkJCXJjID0gc3RyY21wKCBzYWx0LCBjciApID8gTFVU SUxfUEFTU1dEX0VSUiA6IExVVElMX1BBU1NXRF9PSzsKKwkJfQorCX0KKworICAgIHJldHVybiBy YzsKK30KKyNlbHNlCiBzdGF0aWMgaW50IHNsYXBkX2NyeXB0KCBjb25zdCBjaGFyICprZXksIGNv bnN0IGNoYXIgKnNhbHQsIGNoYXIgKipoYXNoICkKIHsKIAljaGFyICpjcjsKQEAgLTYxNCw2ICs2 NDMsOCBAQCBzdGF0aWMgaW50IHNsYXBkX2NyeXB0KCBjb25zdCBjaGFyICprZXksIGNvbnN0IGNo YXIgKnNhbHQsIGNoYXIgKipoYXNoICkKIAlsZGFwX3B2dF90aHJlYWRfbXV0ZXhfdW5sb2NrKCAm cGFzc3dkX211dGV4ICk7CiAJcmV0dXJuIHJjOwogfQorI2VuZGlmIC8qIEhBVkVfQ1JZUFRfUiAq LworCiAjZW5kaWYgLyogU0xBUERfQ1JZUFQgKi8KIAogdm9pZCBzbGFwX3Bhc3N3ZF9pbml0KCkK --_003_282E583D7ED52C4FA3C4CC199465868B02804CD4BPXM04GPgispnec_--

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 02 Sep '17

02 Sep '17

--_003_282E583D7ED52C4FA3C4CC199465868B02801BECBPXM04GPgispnec_ Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable Dear Howard-san, I appreciate your many valuable advices. >Never use calloc/malloc/free directly in slapd code. Always use ch_calloc/= ch_malloc/ch_free. > >In this particular case, there's no reason to allocate at all. Just define= "struct crypt_data data" as a local variable. You are right. There is no need to allocate memory for "data" because using= a local variable is also thread-safe in this case. >Also there's no reason to lock the passwd_mutex at all. That would complet= ely defeat the purpose of using crypt_r() in the first place. I decide to use passwd_mutex only for ber_strdup(), which seems to be non = thread-safe according to ./libraries/liblber/memory.c. I created two patches for passwd.c. Both patches uses "data" as a local variable. =20 "case1" uses passwd_mutex for ber_strdup(), "case2" dose not so. For the time being , I am going to use "case1" due to the aforementioned th= read-safe concern about ber_strdup(). Best Regards, ************************************************ Yoshinori Nishino NEC Solution Innovators, Ltd. 1-18-7 Shinkiba, Koto-ku, Tokyo, 136-8627 Japan E-MAIL: yos-nishino(a)ys.jp.nec.com ************************************************ --_003_282E583D7ED52C4FA3C4CC199465868B02801BECBPXM04GPgispnec_ Content-Type: application/octet-stream; name="openldap-slapd_crypt_case1.patch" Content-Description: openldap-slapd_crypt_case1.patch Content-Disposition: attachment; filename="openldap-slapd_crypt_case1.patch"; size=1345; creation-date="Sun, 03 Sep 2017 01:05:32 GMT"; modification-date="Sun, 03 Sep 2017 01:08:20 GMT" Content-Transfer-Encoding: base64 bW9kaWZ5IHBhc3N3ZC5jIHNvIHRoYXQgc2xhcGRfY3J5cHQoKSB1c2VzIGNyeXB0X3IoKS4KCmRp ZmYgLS1naXQgYS9wYXNzd2QuYy4gYi9wYXNzd2QuYwppbmRleCBkZmEzNzBjLi5hYzA3ZGQyIDEw MDY0NAotLS0gYS9wYXNzd2QuYworKysgYi9wYXNzd2QuYwpAQCAtMjMsOCArMjMsMTEgQEAKICNp bmNsdWRlIDxhYy91bmlzdGQuaD4KIAogI2lmZGVmIFNMQVBEX0NSWVBUCisjaWZkZWYgSEFWRV9D UllQVF9SCisjZGVmaW5lIF9fVVNFX0dOVQorI2VuZGlmIC8qIEhBVkVfQ1JZUFRfUiAqLwogI2lu Y2x1ZGUgPGFjL2NyeXB0Lmg+Ci0jZW5kaWYKKyNlbmRpZiAvKiBTTEFQRF9DUllQVCAqLwogCiAj aW5jbHVkZSAic2xhcC5oIgogCkBAIC01OTAsNiArNTkzLDMxIEBAIHNsYXBfcGFzc3dkX2hhc2go CiBzdGF0aWMgbGRhcF9wdnRfdGhyZWFkX211dGV4X3QgcGFzc3dkX211dGV4Owogc3RhdGljIGx1 dGlsX2NyeXB0ZnVuYyBzbGFwZF9jcnlwdDsKIAorI2lmZGVmIEhBVkVfQ1JZUFRfUgorc3RhdGlj IGludCBzbGFwZF9jcnlwdCggY29uc3QgY2hhciAqa2V5LCBjb25zdCBjaGFyICpzYWx0LCBjaGFy ICoqaGFzaCApCit7CisJY2hhciAqY3I7CisJaW50IHJjOworCXN0cnVjdCBjcnlwdF9kYXRhIGRh dGE7CisgICAgCisJZGF0YS5pbml0aWFsaXplZCA9IDA7CisJY3IgPSBjcnlwdF9yKCBrZXksIHNh bHQsICZkYXRhICk7CisJaWYgKCBjciA9PSBOVUxMIHx8IGNyWzBdID09ICdcMCcgKSB7CisJCS8q IHNhbHQgbXVzdCBoYXZlIGJlZW4gaW52YWxpZCAqLworCQlyYyA9IExVVElMX1BBU1NXRF9FUlI7 CisJfSBlbHNlIHsKKwkJaWYgKCBoYXNoICkgeworCQkJKmhhc2ggPSBiZXJfc3RyZHVwKCBjciAp OworCQkJcmMgPSBMVVRJTF9QQVNTV0RfT0s7CisJCX0gZWxzZSB7CisJCQlyYyA9IHN0cmNtcCgg c2FsdCwgY3IgKSA/IExVVElMX1BBU1NXRF9FUlIgOiBMVVRJTF9QQVNTV0RfT0s7CisJCX0KKwl9 CisgCisgICAgZnJlZShkYXRhKTsKKyAgICByZXR1cm4gcmM7Cit9CisjZWxzZQogc3RhdGljIGlu dCBzbGFwZF9jcnlwdCggY29uc3QgY2hhciAqa2V5LCBjb25zdCBjaGFyICpzYWx0LCBjaGFyICoq aGFzaCApCiB7CiAJY2hhciAqY3I7CkBAIC02MTQsNiArNjQyLDggQEAgc3RhdGljIGludCBzbGFw ZF9jcnlwdCggY29uc3QgY2hhciAqa2V5LCBjb25zdCBjaGFyICpzYWx0LCBjaGFyICoqaGFzaCAp CiAJbGRhcF9wdnRfdGhyZWFkX211dGV4X3VubG9jayggJnBhc3N3ZF9tdXRleCApOwogCXJldHVy biByYzsKIH0KKyNlbmRpZiAvKiBIQVZFX0NSWVBUX1IgKi8KKwogI2VuZGlmIC8qIFNMQVBEX0NS WVBUICovCiAKIHZvaWQgc2xhcF9wYXNzd2RfaW5pdCgpCg== --_003_282E583D7ED52C4FA3C4CC199465868B02801BECBPXM04GPgispnec_ Content-Type: application/octet-stream; name="openldap-slapd_crypt_case2.patch" Content-Description: openldap-slapd_crypt_case2.patch Content-Disposition: attachment; filename="openldap-slapd_crypt_case2.patch"; size=1444; creation-date="Sun, 03 Sep 2017 01:05:35 GMT"; modification-date="Sun, 03 Sep 2017 01:08:20 GMT" Content-Transfer-Encoding: base64 bW9kaWZ5IHBhc3N3ZC5jIHNvIHRoYXQgc2xhcGRfY3J5cHQoKSB1c2VzIGNyeXB0X3IoKS4KCmRp ZmYgLS1naXQgYS9wYXNzd2QuYyBiL3Bhc3N3ZC5jCmluZGV4IGRmYTM3MGMuLjM1ZDg3ZTUgMTAw NjQ0Ci0tLSBhL3Bhc3N3ZC5jCisrKyBiL3Bhc3N3ZC5jCkBAIC0yMyw4ICsyMywxMSBAQAogI2lu Y2x1ZGUgPGFjL3VuaXN0ZC5oPgogCiAjaWZkZWYgU0xBUERfQ1JZUFQKKyNpZmRlZiBIQVZFX0NS WVBUX1IKKyNkZWZpbmUgX19VU0VfR05VCisjZW5kaWYgLyogSEFWRV9DUllQVF9SICovCiAjaW5j bHVkZSA8YWMvY3J5cHQuaD4KLSNlbmRpZgorI2VuZGlmIC8qIFNMQVBEX0NSWVBUICovCiAKICNp bmNsdWRlICJzbGFwLmgiCiAKQEAgLTU5MCw2ICs1OTMsMzMgQEAgc2xhcF9wYXNzd2RfaGFzaCgK IHN0YXRpYyBsZGFwX3B2dF90aHJlYWRfbXV0ZXhfdCBwYXNzd2RfbXV0ZXg7CiBzdGF0aWMgbHV0 aWxfY3J5cHRmdW5jIHNsYXBkX2NyeXB0OwogCisjaWZkZWYgSEFWRV9DUllQVF9SCitzdGF0aWMg aW50IHNsYXBkX2NyeXB0KCBjb25zdCBjaGFyICprZXksIGNvbnN0IGNoYXIgKnNhbHQsIGNoYXIg KipoYXNoICkKK3sKKwljaGFyICpjcjsKKwlpbnQgcmM7CisJc3RydWN0IGNyeXB0X2RhdGEgZGF0 YTsKKyAgICAKKwlkYXRhLmluaXRpYWxpemVkID0gMDsKKwljciA9IGNyeXB0X3IoIGtleSwgc2Fs dCwgJmRhdGEgKTsKKwlpZiAoIGNyID09IE5VTEwgfHwgY3JbMF0gPT0gJ1wwJyApIHsKKwkJLyog c2FsdCBtdXN0IGhhdmUgYmVlbiBpbnZhbGlkICovCisJCXJjID0gTFVUSUxfUEFTU1dEX0VSUjsK Kwl9IGVsc2UgeworCQlpZiAoIGhhc2ggKSB7CisJCQlsZGFwX3B2dF90aHJlYWRfbXV0ZXhfbG9j ayggJnBhc3N3ZF9tdXRleCApOworCQkJKmhhc2ggPSBiZXJfc3RyZHVwKCBjciApOworCQkJbGRh cF9wdnRfdGhyZWFkX211dGV4X3VubG9jayggJnBhc3N3ZF9tdXRleCApOworCQkJcmMgPSBMVVRJ TF9QQVNTV0RfT0s7CisJCX0gZWxzZSB7CisJCQlyYyA9IHN0cmNtcCggc2FsdCwgY3IgKSA/IExV VElMX1BBU1NXRF9FUlIgOiBMVVRJTF9QQVNTV0RfT0s7CisJCX0KKwl9CisgCisgICAgZnJlZShk YXRhKTsKKyAgICByZXR1cm4gcmM7Cit9CisjZWxzZQogc3RhdGljIGludCBzbGFwZF9jcnlwdCgg Y29uc3QgY2hhciAqa2V5LCBjb25zdCBjaGFyICpzYWx0LCBjaGFyICoqaGFzaCApCiB7CiAJY2hh ciAqY3I7CkBAIC02MTQsNiArNjQ0LDggQEAgc3RhdGljIGludCBzbGFwZF9jcnlwdCggY29uc3Qg Y2hhciAqa2V5LCBjb25zdCBjaGFyICpzYWx0LCBjaGFyICoqaGFzaCApCiAJbGRhcF9wdnRfdGhy ZWFkX211dGV4X3VubG9jayggJnBhc3N3ZF9tdXRleCApOwogCXJldHVybiByYzsKIH0KKyNlbmRp ZiAvKiBIQVZFX0NSWVBUX1IgKi8KKwogI2VuZGlmIC8qIFNMQVBEX0NSWVBUICovCiAKIHZvaWQg c2xhcF9wYXNzd2RfaW5pdCgpCg== --_003_282E583D7ED52C4FA3C4CC199465868B02801BECBPXM04GPgispnec_--

1 0

Re: (ITS#8350) lmdb SIGBUS error on full partition and possible double free issue
by vladimir.cunat＠nic.cz 01 Sep '17

01 Sep '17

On 09/01/2017 02:38 PM, Howard Chu wrote: > vladimir.cunat(a)nic.cz wrote: >> The documentation of txn_commit did confuse me (as well). >> https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/lmdb.h#L994 >> >> Would you consider adding a line stressing that the txn gets released >> even in case any error is returned? (or something similar) I'm >> personally used to failing operations not "having externally observable >> effects" unless explicitly stated. > > The very first words on the line you highlight are "The transaction > handle is freed." I don't know how to state that any more explicitly. Well, okay. (I knew the line stated it and still it somehow didn't make me sure, but it's perhaps just me.)

1 0

Re: (ITS#8350) lmdb SIGBUS error on full partition and possible double free issue
by hyc＠symas.com 01 Sep '17

01 Sep '17

vladimir.cunat(a)nic.cz wrote: > Hello! > >> The docs say quite clearly, after txn_commit the txn must not be used > again. > > The documentation of txn_commit did confuse me (as well). > https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/lmdb.h#L994 > Would you consider adding a line stressing that the txn gets released > even in case any error is returned? (or something similar) I'm > personally used to failing operations not "having externally observable > effects" unless explicitly stated. The very first words on the line you highlight are "The transaction handle is freed." I don't know how to state that any more explicitly. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 01 Sep '17

01 Sep '17

Howard Chu wrote: > Yoshinori Nishino wrote: >> Dear Howard-san, >> >> >> Thanks to your advice, I could create the attached tentative patches. >=20 > Thanks, this looks much better. >> >> They modifies servers/slapd/passwd.c and configure.in >> so that running "./configure" can check whether or not crypt_r() exist= s >> and use the function in slapd_crypt() if possible. >> >> I am going to check whether or not "calloc()/free()" causes >> unacceptable=E3=80=80memory fragmentation. >=20 > Never use calloc/malloc/free directly in slapd code. Always use=20 > ch_calloc/ch_malloc/ch_free. >=20 > In this particular case, there's no reason to allocate at all. Just def= ine=20 > "struct crypt_data data" as a local variable. Also there's no reason to lock the passwd_mutex at all. That would comple= tely=20 defeat the purpose of using crypt_r() in the first place. >> >> >> Best Regards, >> ------------------------------------------------ >> On 2017/09/01 20:23, Yoshinori Nishino wrote: >>> >>> >>> On 2017/08/30 20:46, Yoshinori Nishino wrote: >>>> Dear Howard-san, >>>> >>>> >>>> Thank you so much for your prompt advice. >>>> >>>> As you told, I need to check whether or not crypt_r() exists. >>>> I am going to consider including the check. >>>> >>>> Would it be possible to let me know whether there are any other >>>> concerns about the fix if we can use crypt_r()? >>>> >>>> The implementation that "both calloc() and free() occur every time >>>> slapd_crypt() is called" does not seem to look good. >>>> The callers of slapd_crypt() might be able to get the memory for >>>> "struct crypt_data" before they call it. >>>> However, I think it causes the changes of other source codes. >>>> So, I think the aforementioned implementation is a workaround for th= e >>>> slowdown if the risk of memory fragmentation can be acceptable. >>>> >>>> On the other hands, I think we do not need to care about strcmp() >>>> because it is thread-safe. >>>> >>>> >>>> Best Regards, >>>> ---------------------------------------- >>>> On 2017/08/30 19:26, Howard Chu wrote: >>>>> yos-nishino(a)ys.jp.nec.com wrote: >>>>>> Full_Name: Yoshinori Nishino >>>>>> Version: 2.4.45 >>>>>> OS: CentOS 7 >>>>>> URL: ftp://ftp.openldap.org/incoming/ >>>>>> Submission from: (NULL) (210.143.35.20) >>>>>> >>>>>> >>>>>> Dear sir, >>>>>> >>>>>> The function slapd_crypt() in servers/slapd/passwd.c seems to beco= me >>>>>> slow when >>>>>> many ldap client connections occur. >>>>>> It seems it is because the function uses crypt()(non thread-safe >>>>>> function) and >>>>>> pthread_mutex_lock(), which results in the slowdown. >>>>>> #Besides, we need to use {CRYPT} hash as users' password hash. >>>>>> >>>>>> So, I modified servers/slapd/passwd.c like the following. >>>>>> As a result, slapd_crypt() becomes much faster under the same >>>>>> condition. >>>>>> Would you let me know whether or not the fix is appropriate for sl= apd? >>>>> >>>>> No it is not an appropriate fix. >>>>> >>>>> You should add an autoconf test to check for the existence of the >>>>> crypt_r function, and use an #ifdef here based on the result of tha= t >>>>> test, since crypt_r is a non-standard function. >>>>>> >> >> >=20 >=20 --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 01 Sep '17

01 Sep '17

Yoshinori Nishino wrote: > Dear Howard-san, >=20 >=20 > Thanks to your advice, I could create the attached tentative patches. Thanks, this looks much better. >=20 > They modifies servers/slapd/passwd.c and configure.in > so that running "./configure" can check whether or not crypt_r() exists > and use the function in slapd_crypt() if possible. >=20 > I am going to check whether or not "calloc()/free()" causes > unacceptable=E3=80=80memory fragmentation. Never use calloc/malloc/free directly in slapd code. Always use=20 ch_calloc/ch_malloc/ch_free. In this particular case, there's no reason to allocate at all. Just defin= e=20 "struct crypt_data data" as a local variable. >=20 >=20 > Best Regards, > ------------------------------------------------ > On 2017/09/01 20:23, Yoshinori Nishino wrote: >> >> >> On 2017/08/30 20:46, Yoshinori Nishino wrote: >>> Dear Howard-san, >>> >>> >>> Thank you so much for your prompt advice. >>> >>> As you told, I need to check whether or not crypt_r() exists. >>> I am going to consider including the check. >>> >>> Would it be possible to let me know whether there are any other >>> concerns about the fix if we can use crypt_r()? >>> >>> The implementation that "both calloc() and free() occur every time >>> slapd_crypt() is called" does not seem to look good. >>> The callers of slapd_crypt() might be able to get the memory for >>> "struct crypt_data" before they call it. >>> However, I think it causes the changes of other source codes. >>> So, I think the aforementioned implementation is a workaround for the >>> slowdown if the risk of memory fragmentation can be acceptable. >>> >>> On the other hands, I think we do not need to care about strcmp() >>> because it is thread-safe. >>> >>> >>> Best Regards, >>> ---------------------------------------- >>> On 2017/08/30 19:26, Howard Chu wrote: >>>> yos-nishino(a)ys.jp.nec.com wrote: >>>>> Full_Name: Yoshinori Nishino >>>>> Version: 2.4.45 >>>>> OS: CentOS 7 >>>>> URL: ftp://ftp.openldap.org/incoming/ >>>>> Submission from: (NULL) (210.143.35.20) >>>>> >>>>> >>>>> Dear sir, >>>>> >>>>> The function slapd_crypt() in servers/slapd/passwd.c seems to becom= e >>>>> slow when >>>>> many ldap client connections occur. >>>>> It seems it is because the function uses crypt()(non thread-safe >>>>> function) and >>>>> pthread_mutex_lock(), which results in the slowdown. >>>>> #Besides, we need to use {CRYPT} hash as users' password hash. >>>>> >>>>> So, I modified servers/slapd/passwd.c like the following. >>>>> As a result, slapd_crypt() becomes much faster under the same >>>>> condition. >>>>> Would you let me know whether or not the fix is appropriate for sla= pd? >>>> >>>> No it is not an appropriate fix. >>>> >>>> You should add an autoconf test to check for the existence of the >>>> crypt_r function, and use an #ifdef here based on the result of that >>>> test, since crypt_r is a non-standard function. >>>>> >=20 >=20 --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8350) lmdb SIGBUS error on full partition and possible double free issue
by vladimir.cunat＠nic.cz 01 Sep '17

01 Sep '17

Hello! > The docs say quite clearly, after txn_commit the txn must not be used again. The documentation of txn_commit did confuse me (as well). https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/lmdb.h#L994 Would you consider adding a line stressing that the txn gets released even in case any error is returned? (or something similar) I'm personally used to failing operations not "having externally observable effects" unless explicitly stated. Thanks. --Vladimir

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 01 Sep '17

01 Sep '17

--_003_ae98b5ab2c831747beb16297218b350eysjpneccom_ Content-Type: text/plain; charset="utf-8" Content-ID: <514C194789057D4F9AD83D779D27265A(a)gisp.nec.co.jp> Content-Transfer-Encoding: base64 RGVhciBIb3dhcmQtc2FuLA0KDQoNClRoYW5rcyB0byB5b3VyIGFkdmljZSwgSSBjb3VsZCBjcmVh dGUgdGhlIGF0dGFjaGVkIHRlbnRhdGl2ZSBwYXRjaGVzLg0KDQpUaGV5IG1vZGlmaWVzIHNlcnZl cnMvc2xhcGQvcGFzc3dkLmMgYW5kIGNvbmZpZ3VyZS5pbg0Kc28gdGhhdCBydW5uaW5nICIuL2Nv bmZpZ3VyZSIgY2FuIGNoZWNrIHdoZXRoZXIgb3Igbm90IGNyeXB0X3IoKSBleGlzdHMNCmFuZCB1 c2UgdGhlIGZ1bmN0aW9uIGluIHNsYXBkX2NyeXB0KCkgaWYgcG9zc2libGUuDQoNCkkgYW0gZ29p bmcgdG8gY2hlY2sgd2hldGhlciBvciBub3QgImNhbGxvYygpL2ZyZWUoKSIgY2F1c2VzIA0KdW5h Y2NlcHRhYmxl44CAbWVtb3J5IGZyYWdtZW50YXRpb24uDQoNCg0KQmVzdCBSZWdhcmRzLA0KLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpPbiAyMDE3LzA5 LzAxIDIwOjIzLCBZb3NoaW5vcmkgTmlzaGlubyB3cm90ZToNCj4gDQo+IA0KPiBPbiAyMDE3LzA4 LzMwIDIwOjQ2LCBZb3NoaW5vcmkgTmlzaGlubyB3cm90ZToNCj4+IERlYXIgSG93YXJkLXNhbiwN Cj4+DQo+Pg0KPj4gVGhhbmsgeW91IHNvIG11Y2ggZm9yIHlvdXIgcHJvbXB0IGFkdmljZS4NCj4+ DQo+PiBBcyB5b3UgdG9sZCwgSSBuZWVkIHRvIGNoZWNrIHdoZXRoZXIgb3Igbm90IGNyeXB0X3Io KSBleGlzdHMuDQo+PiBJIGFtIGdvaW5nIHRvIGNvbnNpZGVyIGluY2x1ZGluZyB0aGUgY2hlY2su DQo+Pg0KPj4gV291bGQgaXQgYmUgcG9zc2libGUgdG8gbGV0IG1lIGtub3cgd2hldGhlciB0aGVy ZSBhcmUgYW55IG90aGVyIA0KPj4gY29uY2VybnMgYWJvdXQgdGhlIGZpeCBpZiB3ZSBjYW4gdXNl IGNyeXB0X3IoKT8NCj4+DQo+PiBUaGUgaW1wbGVtZW50YXRpb24gdGhhdCAiYm90aCBjYWxsb2Mo KSBhbmQgZnJlZSgpIG9jY3VyIGV2ZXJ5IHRpbWUgDQo+PiBzbGFwZF9jcnlwdCgpIGlzIGNhbGxl ZCIgZG9lcyBub3Qgc2VlbSB0byBsb29rIGdvb2QuDQo+PiBUaGUgY2FsbGVycyBvZiBzbGFwZF9j cnlwdCgpIG1pZ2h0IGJlIGFibGUgdG8gZ2V0IHRoZSBtZW1vcnkgZm9yIA0KPj4gInN0cnVjdCBj cnlwdF9kYXRhIiBiZWZvcmUgdGhleSBjYWxsIGl0Lg0KPj4gSG93ZXZlciwgSSB0aGluayBpdCBj YXVzZXMgdGhlIGNoYW5nZXMgb2Ygb3RoZXIgc291cmNlIGNvZGVzLg0KPj4gU28sIEkgdGhpbmsg dGhlIGFmb3JlbWVudGlvbmVkIGltcGxlbWVudGF0aW9uIGlzIGEgd29ya2Fyb3VuZCBmb3IgdGhl IA0KPj4gc2xvd2Rvd24gaWYgdGhlIHJpc2sgb2YgbWVtb3J5IGZyYWdtZW50YXRpb24gY2FuIGJl IGFjY2VwdGFibGUuDQo+Pg0KPj4gT24gdGhlIG90aGVyIGhhbmRzLCBJIHRoaW5rIHdlIGRvIG5v dCBuZWVkIHRvIGNhcmUgYWJvdXQgc3RyY21wKCkgDQo+PiBiZWNhdXNlIGl0IGlzIHRocmVhZC1z YWZlLg0KPj4NCj4+DQo+PiBCZXN0IFJlZ2FyZHMsDQo+PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tDQo+PiBPbiAyMDE3LzA4LzMwIDE5OjI2LCBIb3dhcmQgQ2h1IHdy b3RlOg0KPj4+IHlvcy1uaXNoaW5vQHlzLmpwLm5lYy5jb20gd3JvdGU6DQo+Pj4+IEZ1bGxfTmFt ZTogWW9zaGlub3JpIE5pc2hpbm8NCj4+Pj4gVmVyc2lvbjogMi40LjQ1DQo+Pj4+IE9TOiBDZW50 T1MgNw0KPj4+PiBVUkw6IGZ0cDovL2Z0cC5vcGVubGRhcC5vcmcvaW5jb21pbmcvDQo+Pj4+IFN1 Ym1pc3Npb24gZnJvbTogKE5VTEwpICgyMTAuMTQzLjM1LjIwKQ0KPj4+Pg0KPj4+Pg0KPj4+PiBE ZWFyIHNpciwNCj4+Pj4NCj4+Pj4gVGhlIGZ1bmN0aW9uIHNsYXBkX2NyeXB0KCkgaW4gc2VydmVy cy9zbGFwZC9wYXNzd2QuYyBzZWVtcyB0byBiZWNvbWUgDQo+Pj4+IHNsb3cgd2hlbg0KPj4+PiBt YW55IGxkYXAgY2xpZW50IGNvbm5lY3Rpb25zIG9jY3VyLg0KPj4+PiBJdCBzZWVtcyBpdCBpcyBi ZWNhdXNlIHRoZSBmdW5jdGlvbiB1c2VzIGNyeXB0KCkobm9uIHRocmVhZC1zYWZlIA0KPj4+PiBm dW5jdGlvbikgYW5kDQo+Pj4+IHB0aHJlYWRfbXV0ZXhfbG9jaygpLCB3aGljaCByZXN1bHRzIGlu IHRoZSBzbG93ZG93bi4NCj4+Pj4gI0Jlc2lkZXMsIHdlIG5lZWQgdG8gdXNlIHtDUllQVH0gaGFz aCBhcyB1c2VycycgcGFzc3dvcmQgaGFzaC4NCj4+Pj4NCj4+Pj4gU28sIEkgbW9kaWZpZWQgc2Vy dmVycy9zbGFwZC9wYXNzd2QuYyBsaWtlIHRoZSBmb2xsb3dpbmcuDQo+Pj4+IEFzIGEgcmVzdWx0 LCBzbGFwZF9jcnlwdCgpIGJlY29tZXMgbXVjaCBmYXN0ZXIgdW5kZXIgdGhlIHNhbWUgDQo+Pj4+ IGNvbmRpdGlvbi4NCj4+Pj4gV291bGQgeW91IGxldCBtZSBrbm93IHdoZXRoZXIgb3Igbm90IHRo ZSBmaXggaXMgYXBwcm9wcmlhdGUgZm9yIHNsYXBkPw0KPj4+DQo+Pj4gTm8gaXQgaXMgbm90IGFu IGFwcHJvcHJpYXRlIGZpeC4NCj4+Pg0KPj4+IFlvdSBzaG91bGQgYWRkIGFuIGF1dG9jb25mIHRl c3QgdG8gY2hlY2sgZm9yIHRoZSBleGlzdGVuY2Ugb2YgdGhlIA0KPj4+IGNyeXB0X3IgZnVuY3Rp b24sIGFuZCB1c2UgYW4gI2lmZGVmIGhlcmUgYmFzZWQgb24gdGhlIHJlc3VsdCBvZiB0aGF0IA0K Pj4+IHRlc3QsIHNpbmNlIGNyeXB0X3IgaXMgYSBub24tc3RhbmRhcmQgZnVuY3Rpb24uDQo+Pj4+ DQoNCg0KLS0gDQoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioNCllvc2hpbm9yaSBOaXNoaW5vDQoNCk5FQyBTb2x1dGlvbiBJbm5vdmF0b3JzLCBMdGQuDQox LTE4LTcgU2hpbmtpYmEsIEtvdG8ta3UsIFRva3lvLCAxMzYtODYyNyBKYXBhbg0KRS1NQUlMOiB5 b3MtbmlzaGlub0B5cy5qcC5uZWMuY29tDQoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioNCg== --_003_ae98b5ab2c831747beb16297218b350eysjpneccom_ Content-Type: text/plain; name="openldap-slapd_crypt.patch" Content-Description: openldap-slapd_crypt.patch Content-Disposition: attachment; filename="openldap-slapd_crypt.patch"; size=1542; creation-date="Fri, 01 Sep 2017 11:42:36 GMT"; modification-date="Fri, 01 Sep 2017 11:42:36 GMT" Content-ID: <529021D243717746A9BA512F0ED0DA1A(a)gisp.nec.co.jp> Content-Transfer-Encoding: base64 bW9kaWZ5IHBhc3N3ZC5jIHNvIHRoYXQgc2xhcGRfY3J5cHQoKSB1c2VzIGNyeXB0X3IoKS4KCmRp ZmYgLS1naXQgYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3ZC5jIGIvc2VydmVycy9zbGFwZC9wYXNzd2Qu YwppbmRleCBkZmEzNzBjLi45YTUyM2VlIDEwMDY0NAotLS0gYS9zZXJ2ZXJzL3NsYXBkL3Bhc3N3 ZC5jCisrKyBiL3NlcnZlcnMvc2xhcGQvcGFzc3dkLmMKQEAgLTIzLDggKzIzLDExIEBACiAjaW5j bHVkZSA8YWMvdW5pc3RkLmg+CiAKICNpZmRlZiBTTEFQRF9DUllQVAorI2lmZGVmIEhBVkVfQ1JZ UFRfUgorI2RlZmluZSBfX1VTRV9HTlUKKyNlbmRpZiAvKiBIQVZFX0NSWVBUX1IgKi8KICNpbmNs dWRlIDxhYy9jcnlwdC5oPgotI2VuZGlmCisjZW5kaWYgLyogU0xBUERfQ1JZUFQgKi8KIAogI2lu Y2x1ZGUgInNsYXAuaCIKIApAQCAtNTkwLDYgKzU5MywzNCBAQCBzbGFwX3Bhc3N3ZF9oYXNoKAog c3RhdGljIGxkYXBfcHZ0X3RocmVhZF9tdXRleF90IHBhc3N3ZF9tdXRleDsKIHN0YXRpYyBsdXRp bF9jcnlwdGZ1bmMgc2xhcGRfY3J5cHQ7CiAKKyNpZmRlZiBIQVZFX0NSWVBUX1IKK3N0YXRpYyBp bnQgc2xhcGRfY3J5cHQoIGNvbnN0IGNoYXIgKmtleSwgY29uc3QgY2hhciAqc2FsdCwgY2hhciAq Kmhhc2ggKQoreworCWNoYXIgKmNyOworCWludCByYzsKKwlzdHJ1Y3QgY3J5cHRfZGF0YSAqZGF0 YTsKKworCWRhdGEgPSAoc3RydWN0IGNyeXB0X2RhdGEgKiljYWxsb2MoMSwgc2l6ZW9mKHN0cnVj dCBjcnlwdF9kYXRhKSk7CisKKwljciA9IGNyeXB0X3IoIGtleSwgc2FsdCwgZGF0YSApOworCWlm ICggY3IgPT0gTlVMTCB8fCBjclswXSA9PSAnXDAnICkgeworCQkvKiBzYWx0IG11c3QgaGF2ZSBi ZWVuIGludmFsaWQgKi8KKwkJcmMgPSBMVVRJTF9QQVNTV0RfRVJSOworCX0gZWxzZSB7CisJCWlm ICggaGFzaCApIHsKKwkJCWxkYXBfcHZ0X3RocmVhZF9tdXRleF9sb2NrKCAmcGFzc3dkX211dGV4 ICk7CisJCQkqaGFzaCA9IGJlcl9zdHJkdXAoIGNyICk7CisJCQlsZGFwX3B2dF90aHJlYWRfbXV0 ZXhfdW5sb2NrKCAmcGFzc3dkX211dGV4ICk7CisJCQlyYyA9IExVVElMX1BBU1NXRF9PSzsKKwkJ fSBlbHNlIHsKKwkJCXJjID0gc3RyY21wKCBzYWx0LCBjciApID8gTFVUSUxfUEFTU1dEX0VSUiA6 IExVVElMX1BBU1NXRF9PSzsKKwkJfQorCX0KKyAKKyAgICBmcmVlKGRhdGEpOworICAgIHJldHVy biByYzsKK30KKyNlbHNlCiBzdGF0aWMgaW50IHNsYXBkX2NyeXB0KCBjb25zdCBjaGFyICprZXks IGNvbnN0IGNoYXIgKnNhbHQsIGNoYXIgKipoYXNoICkKIHsKIAljaGFyICpjcjsKQEAgLTYxNCw2 ICs2NDUsOCBAQCBzdGF0aWMgaW50IHNsYXBkX2NyeXB0KCBjb25zdCBjaGFyICprZXksIGNvbnN0 IGNoYXIgKnNhbHQsIGNoYXIgKipoYXNoICkKIAlsZGFwX3B2dF90aHJlYWRfbXV0ZXhfdW5sb2Nr KCAmcGFzc3dkX211dGV4ICk7CiAJcmV0dXJuIHJjOwogfQorI2VuZGlmIC8qIEhBVkVfQ1JZUFRf UiAqLworCiAjZW5kaWYgLyogU0xBUERfQ1JZUFQgKi8KIAogdm9pZCBzbGFwX3Bhc3N3ZF9pbml0 KCkK --_003_ae98b5ab2c831747beb16297218b350eysjpneccom_ Content-Type: text/plain; name="openldap-slapd_crypt-configure.patch" Content-Description: openldap-slapd_crypt-configure.patch Content-Disposition: attachment; filename="openldap-slapd_crypt-configure.patch"; size=756; creation-date="Fri, 01 Sep 2017 11:42:36 GMT"; modification-date="Fri, 01 Sep 2017 11:42:36 GMT" Content-ID: <4C143CD72661D741AAEA56FC06DE3DE1(a)gisp.nec.co.jp> Content-Transfer-Encoding: base64 bW9kaWZ5IGNvbmZpZ3VyZS5pbiBzbyB0aGF0IHNsYXBkX2NyeXB0KCkgdXNlcyBjcnlwdF9yKCku CgoKZGlmZiAtLWdpdCBhL2NvbmZpZ3VyZS5pbiBiL2NvbmZpZ3VyZS5pbgppbmRleCAzYzE4MTU0 Li5iZDc1M2U1IDEwMDY0NAotLS0gYS9jb25maWd1cmUuaW4KKysrIGIvY29uZmlndXJlLmluCkBA IC0yMTk3LDEwICsyMTk3LDE2IEBAIGlmIHRlc3QgJG9sX2VuYWJsZV9jcnlwdCAhPSBubyA7IHRo ZW4KIAkJQUNfQ0hFQ0tfTElCKGNyeXB0LCBjcnlwdCwgW0xVVElMX0xJQlM9IiRMVVRJTF9MSUJT IC1sY3J5cHQiCiAJCQloYXZlX2NyeXB0PXllc10sIFtoYXZlX2NyeXB0PW5vXSldKQogCisJTElC Uz0iJFRMU19MSUJTICRMSUJTIgorCUFDX0NIRUNLX0xJQihjcnlwdCwgY3J5cHRfciwgW2hhdmVf Y3J5cHRfcj15ZXNdLCBbaGF2ZV9jcnlwdF9yPW5vXSkKKwogCUxJQlM9IiRzYXZlX0xJQlMiCiAK IAlpZiB0ZXN0ICRoYXZlX2NyeXB0ID0geWVzIDsgdGhlbgogCQlBQ19ERUZJTkUoSEFWRV9DUllQ VCwxLCBbZGVmaW5lIGlmIGNyeXB0KDMpIGlzIGF2YWlsYWJsZV0pCisJCWlmIHRlc3QgJGhhdmVf Y3J5cHRfciA9IHllcyA7IHRoZW4KKwkJCUFDX0RFRklORShIQVZFX0NSWVBUX1IsIDEsIFtkZWZp bmUgaWYgY3J5cHRfcigpIGlzIGFsc28gYXZhaWxhYmxlXSkKKwkJZmkKIAllbHNlCiAJCUFDX01T R19XQVJOKFtjb3VsZCBub3QgZmluZCBjcnlwdF0pCiAJCWlmIHRlc3QgJG9sX2VuYWJsZV9jcnlw dCA9IHllcyA7IHRoZW4K --_003_ae98b5ab2c831747beb16297218b350eysjpneccom_--

1 0

Re: (ITS#8720) back_ldap result timeout failure on high latency connections (TLS ONLY)
by hyc＠symas.com 31 Aug '17

31 Aug '17

mikedotjackson(a)gmail.com wrote: > Full_Name: Mike Jackson > Version: 2.4.45 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (194.157.185.162) > > > Push replication via TLS fails to remote servers where the TCP/IP round-trip > time is greater than 100ms. When the return packets finally arrive, the > initiating server will close the connection with RST RST RST, which results in > TLS NEGOTIATION FAILURE. If TLS is not used, then the high-latency connection > will function normally and replication will occur. > > The 100ms time limit comes from here: > > servers/slapd/back-ldap/back-ldap.h: #define LDAP_BACK_RESULT_UTIMEOUT > (100000) > > Reference commit 112be0118e43c161d44de6e852cca9f517bb653d from 2005. > > HYC: "Ando ported timeout code from back-meta into back-ldap but he never ported > the config keyword that sets the timeout number of retries" > > In addition, the back_ldap man page is not up to date. > > > My temporary workaround was to set LDAP_BACK_RESULT_UTIMEOUT (900000) (900ms) > and recompile. Problem immediately went away, but this is not a correct approach > and the retry counter should be runtime configurable. back-ldap has been fixed to use the configured timeout for exops here. Fix is in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8720) back_ldap result timeout failure on high latency connections (TLS ONLY)
by mikedotjackson＠gmail.com 31 Aug '17

31 Aug '17

Full_Name: Mike Jackson Version: 2.4.45 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.157.185.162) Push replication via TLS fails to remote servers where the TCP/IP round-trip time is greater than 100ms. When the return packets finally arrive, the initiating server will close the connection with RST RST RST, which results in TLS NEGOTIATION FAILURE. If TLS is not used, then the high-latency connection will function normally and replication will occur. The 100ms time limit comes from here: servers/slapd/back-ldap/back-ldap.h: #define LDAP_BACK_RESULT_UTIMEOUT (100000) Reference commit 112be0118e43c161d44de6e852cca9f517bb653d from 2005. HYC: "Ando ported timeout code from back-meta into back-ldap but he never ported the config keyword that sets the timeout number of retries" In addition, the back_ldap man page is not up to date. My temporary workaround was to set LDAP_BACK_RESULT_UTIMEOUT (900000) (900ms) and recompile. Problem immediately went away, but this is not a correct approach and the retry counter should be runtime configurable.

1 0

Re: (ITS#6835) extend pwFailureTime timestamp to microsecond resolution to improve pwdMaxFailure enforcement
by quanah＠symas.com 30 Aug '17

30 Aug '17

Hi Brian, I just wanted to follow up and let you know this was taken care of in ITS#7161 and the fix was part of the OpenLDAP 2.4.40 release. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs