- openldap-bugs - openldap.org

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 30 Aug '17

30 Aug '17

RGVhciBIb3dhcmQtc2FuLA0KDQoNClRoYW5rIHlvdSBzbyBtdWNoIGZvciB5b3VyIHByb21wdCBh ZHZpY2UuDQoNCkFzIHlvdSB0b2xkLCBJIG5lZWQgdG8gY2hlY2sgd2hldGhlciBvciBub3QgY3J5 cHRfcigpIGV4aXN0cy4NCkkgYW0gZ29pbmcgdG8gY29uc2lkZXIgaW5jbHVkaW5nIHRoZSBjaGVj ay4NCg0KV291bGQgaXQgYmUgcG9zc2libGUgdG8gbGV0IG1lIGtub3cgd2hldGhlciB0aGVyZSBh cmUgYW55IG90aGVyIGNvbmNlcm5zIA0KYWJvdXQgdGhlIGZpeCBpZiB3ZSBjYW4gdXNlIGNyeXB0 X3IoKT8NCg0KVGhlIGltcGxlbWVudGF0aW9uIHRoYXQgImJvdGggY2FsbG9jKCkgYW5kIGZyZWUo KSBvY2N1ciBldmVyeSB0aW1lIA0Kc2xhcGRfY3J5cHQoKSBpcyBjYWxsZWQiIGRvZXMgbm90IHNl ZW0gdG8gbG9vayBnb29kLg0KVGhlIGNhbGxlcnMgb2Ygc2xhcGRfY3J5cHQoKSBtaWdodCBiZSBh YmxlIHRvIGdldCB0aGUgbWVtb3J5IGZvciAic3RydWN0IA0KY3J5cHRfZGF0YSIgYmVmb3JlIHRo ZXkgY2FsbCBpdC4NCkhvd2V2ZXIsIEkgdGhpbmsgaXQgY2F1c2VzIHRoZSBjaGFuZ2VzIG9mIG90 aGVyIHNvdXJjZSBjb2Rlcy4NClNvLCBJIHRoaW5rIHRoZSBhZm9yZW1lbnRpb25lZCBpbXBsZW1l bnRhdGlvbiBpcyBhIHdvcmthcm91bmQgZm9yIHRoZSANCnNsb3dkb3duIGlmIHRoZSByaXNrIG9m IG1lbW9yeSBmcmFnbWVudGF0aW9uIGNhbiBiZSBhY2NlcHRhYmxlLg0KDQpPbiB0aGUgb3RoZXIg aGFuZHMsIEkgdGhpbmsgd2UgZG8gbm90IG5lZWQgdG8gY2FyZSBhYm91dCBzdHJjbXAoKSANCmJl Y2F1c2UgaXQgaXMgdGhyZWFkLXNhZmUuDQoNCg0KQmVzdCBSZWdhcmRzLA0KLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KT24gMjAxNy8wOC8zMCAxOToyNiwgSG93YXJk IENodSB3cm90ZToNCj4geW9zLW5pc2hpbm9AeXMuanAubmVjLmNvbSB3cm90ZToNCj4+IEZ1bGxf TmFtZTogWW9zaGlub3JpIE5pc2hpbm8NCj4+IFZlcnNpb246IDIuNC40NQ0KPj4gT1M6IENlbnRP UyA3DQo+PiBVUkw6IGZ0cDovL2Z0cC5vcGVubGRhcC5vcmcvaW5jb21pbmcvDQo+PiBTdWJtaXNz aW9uIGZyb206IChOVUxMKSAoMjEwLjE0My4zNS4yMCkNCj4+DQo+Pg0KPj4gRGVhciBzaXIsDQo+ Pg0KPj4gVGhlIGZ1bmN0aW9uIHNsYXBkX2NyeXB0KCkgaW4gc2VydmVycy9zbGFwZC9wYXNzd2Qu YyBzZWVtcyB0byBiZWNvbWUgDQo+PiBzbG93IHdoZW4NCj4+IG1hbnkgbGRhcCBjbGllbnQgY29u bmVjdGlvbnMgb2NjdXIuDQo+PiBJdCBzZWVtcyBpdCBpcyBiZWNhdXNlIHRoZSBmdW5jdGlvbiB1 c2VzIGNyeXB0KCkobm9uIHRocmVhZC1zYWZlIA0KPj4gZnVuY3Rpb24pIGFuZA0KPj4gcHRocmVh ZF9tdXRleF9sb2NrKCksIHdoaWNoIHJlc3VsdHMgaW4gdGhlIHNsb3dkb3duLg0KPj4gI0Jlc2lk ZXMsIHdlIG5lZWQgdG8gdXNlIHtDUllQVH0gaGFzaCBhcyB1c2VycycgcGFzc3dvcmQgaGFzaC4N Cj4+DQo+PiBTbywgSSBtb2RpZmllZCBzZXJ2ZXJzL3NsYXBkL3Bhc3N3ZC5jIGxpa2UgdGhlIGZv bGxvd2luZy4NCj4+IEFzIGEgcmVzdWx0LCBzbGFwZF9jcnlwdCgpIGJlY29tZXMgbXVjaCBmYXN0 ZXIgdW5kZXIgdGhlIHNhbWUgY29uZGl0aW9uLg0KPj4gV291bGQgeW91IGxldCBtZSBrbm93IHdo ZXRoZXIgb3Igbm90IHRoZSBmaXggaXMgYXBwcm9wcmlhdGUgZm9yIHNsYXBkPw0KPiANCj4gTm8g aXQgaXMgbm90IGFuIGFwcHJvcHJpYXRlIGZpeC4NCj4gDQo+IFlvdSBzaG91bGQgYWRkIGFuIGF1 dG9jb25mIHRlc3QgdG8gY2hlY2sgZm9yIHRoZSBleGlzdGVuY2Ugb2YgdGhlIA0KPiBjcnlwdF9y IGZ1bmN0aW9uLCBhbmQgdXNlIGFuICNpZmRlZiBoZXJlIGJhc2VkIG9uIHRoZSByZXN1bHQgb2Yg dGhhdCANCj4gdGVzdCwgc2luY2UgY3J5cHRfciBpcyBhIG5vbi1zdGFuZGFyZCBmdW5jdGlvbi4N Cj4+DQo+PiA9PT09PQ0KPj4gc3RhdGljIGludCBzbGFwZF9jcnlwdCggY29uc3QgY2hhciAqa2V5 LCBjb25zdCBjaGFyICpzYWx0LCBjaGFyICoqaGFzaCApDQo+PiB7DQo+PiDCoMKgwqDCoGNoYXIg KmNyOw0KPj4gwqDCoMKgwqBpbnQgcmM7DQo+PiDCoMKgwqDCoMKgwqDCoMKgIHN0cnVjdCBjcnlw dF9kYXRhICpkYXRhOw0KPj4NCj4+IMKgwqDCoMKgwqDCoMKgwqAgZGF0YSA9IChzdHJ1Y3QgY3J5 cHRfZGF0YSAqKWNhbGxvYygxLCBzaXplb2Yoc3RydWN0IA0KPj4gY3J5cHRfZGF0YSkpOw0KPj4g wqDCoMKgwqAvKiBsZGFwX3B2dF90aHJlYWRfbXV0ZXhfbG9jayggJnBhc3N3ZF9tdXRleCApOyAq Lw0KPj4NCj4+IMKgwqDCoMKgLyogY3IgPSBjcnlwdCgga2V5LCBzYWx0ICk7ICovDQo+PiDCoMKg wqDCoGNyID0gY3J5cHRfcigga2V5LCBzYWx0LCBkYXRhICk7DQo+PiDCoMKgwqDCoGlmICggY3Ig PT0gTlVMTCB8fCBjclswXSA9PSAnXDAnICkgew0KPj4gwqDCoMKgwqDCoMKgwqAgLyogc2FsdCBt dXN0IGhhdmUgYmVlbiBpbnZhbGlkICovDQo+PiDCoMKgwqDCoMKgwqDCoCByYyA9IExVVElMX1BB U1NXRF9FUlI7DQo+PiDCoMKgwqDCoH0gZWxzZSB7DQo+PiDCoMKgwqDCoMKgwqDCoCBpZiAoIGhh c2ggKSB7DQo+PiDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIGxkYXBfcHZ0X3RocmVhZF9tdXRleF9s b2NrKCAmcGFzc3dkX211dGV4ICk7DQo+PiDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgICpoYXNoID0g YmVyX3N0cmR1cCggY3IgKTsNCj4+IMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgbGRhcF9wdnRfdGhy ZWFkX211dGV4X3VubG9jayggJnBhc3N3ZF9tdXRleCApOw0KPj4gwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCByYyA9IExVVElMX1BBU1NXRF9PSzsNCj4+DQo+PiDCoMKgwqDCoMKgwqDCoCB9IGVsc2Ug ew0KPj4gwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCByYyA9IHN0cmNtcCggc2FsdCwgY3IgKSA/IExV VElMX1BBU1NXRF9FUlIgOiBMVVRJTF9QQVNTV0RfT0s7DQo+PiDCoMKgwqDCoMKgwqDCoCB9DQo+ PiDCoMKgwqDCoH0NCj4+DQo+PiDCoMKgwqDCoMKgwqDCoMKgIGZyZWUoZGF0YSk7DQo+PiDCoMKg wqDCoC8qIGxkYXBfcHZ0X3RocmVhZF9tdXRleF91bmxvY2soICZwYXNzd2RfbXV0ZXggKTsgKi8N Cj4+IMKgwqDCoMKgcmV0dXJuIHJjOw0KPj4gfQ0KPj4NCj4+ID09PT0NCj4+DQo+PiAjICIjZGVm aW5lIF9fVVNFX0dOVSIgaXMgYWxzbyByZXF1aXJlZCB0byBidWlsZCBzbGFwZC4NCj4+DQo+Pg0K Pj4gQmVzdCBSZWdhcmRzLA0KPj4NCj4+DQo+Pg0KPiANCj4gDQoNCi0tIA0KKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqDQpZb3NoaW5vcmkgTmlzaGlubw0K DQpORUMgU29sdXRpb24gSW5ub3ZhdG9ycywgTHRkLg0KMS0xOC03IFNoaW5raWJhLCBLb3RvLWt1 LCBUb2t5bywgMTM2LTg2MjcgSmFwYW4NCkUtTUFJTDogeW9zLW5pc2hpbm9AeXMuanAubmVjLmNv bQ0KKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq

1 0

Re: (ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by hyc＠symas.com 30 Aug '17

30 Aug '17

yos-nishino(a)ys.jp.nec.com wrote: > Full_Name: Yoshinori Nishino > Version: 2.4.45 > OS: CentOS 7 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (210.143.35.20) > > > Dear sir, > > The function slapd_crypt() in servers/slapd/passwd.c seems to become slow when > many ldap client connections occur. > It seems it is because the function uses crypt()(non thread-safe function) and > pthread_mutex_lock(), which results in the slowdown. > #Besides, we need to use {CRYPT} hash as users' password hash. > > So, I modified servers/slapd/passwd.c like the following. > As a result, slapd_crypt() becomes much faster under the same condition. > Would you let me know whether or not the fix is appropriate for slapd? No it is not an appropriate fix. You should add an autoconf test to check for the existence of the crypt_r function, and use an #ifdef here based on the result of that test, since crypt_r is a non-standard function. > > ===== > static int slapd_crypt( const char *key, const char *salt, char **hash ) > { > char *cr; > int rc; > struct crypt_data *data; > > data = (struct crypt_data *)calloc(1, sizeof(struct crypt_data)); > /* ldap_pvt_thread_mutex_lock( &passwd_mutex ); */ > > /* cr = crypt( key, salt ); */ > cr = crypt_r( key, salt, data ); > if ( cr == NULL || cr[0] == '\0' ) { > /* salt must have been invalid */ > rc = LUTIL_PASSWD_ERR; > } else { > if ( hash ) { > ldap_pvt_thread_mutex_lock( &passwd_mutex ); > *hash = ber_strdup( cr ); > ldap_pvt_thread_mutex_unlock( &passwd_mutex ); > rc = LUTIL_PASSWD_OK; > > } else { > rc = strcmp( salt, cr ) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK; > } > } > > free(data); > /* ldap_pvt_thread_mutex_unlock( &passwd_mutex ); */ > return rc; > } > > ==== > > # "#define __USE_GNU" is also required to build slapd. > > > Best Regards, > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8719) slapd_crypt() become slow when many ldap cliant connections occur.
by yos-nishino＠ys.jp.nec.com 30 Aug '17

30 Aug '17

Full_Name: Yoshinori Nishino Version: 2.4.45 OS: CentOS 7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (210.143.35.20) Dear sir, The function slapd_crypt() in servers/slapd/passwd.c seems to become slow when many ldap client connections occur. It seems it is because the function uses crypt()(non thread-safe function) and pthread_mutex_lock(), which results in the slowdown. #Besides, we need to use {CRYPT} hash as users' password hash. So, I modified servers/slapd/passwd.c like the following. As a result, slapd_crypt() becomes much faster under the same condition. Would you let me know whether or not the fix is appropriate for slapd? ===== static int slapd_crypt( const char *key, const char *salt, char **hash ) { char *cr; int rc; struct crypt_data *data; data = (struct crypt_data *)calloc(1, sizeof(struct crypt_data)); /* ldap_pvt_thread_mutex_lock( &passwd_mutex ); */ /* cr = crypt( key, salt ); */ cr = crypt_r( key, salt, data ); if ( cr == NULL || cr[0] == '\0' ) { /* salt must have been invalid */ rc = LUTIL_PASSWD_ERR; } else { if ( hash ) { ldap_pvt_thread_mutex_lock( &passwd_mutex ); *hash = ber_strdup( cr ); ldap_pvt_thread_mutex_unlock( &passwd_mutex ); rc = LUTIL_PASSWD_OK; } else { rc = strcmp( salt, cr ) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK; } } free(data); /* ldap_pvt_thread_mutex_unlock( &passwd_mutex ); */ return rc; } ==== # "#define __USE_GNU" is also required to build slapd. Best Regards,

1 0

Re: (ITS#8485) [PATCH] Adding support for encrypted server private keys
by ahnolds＠gmail.com 28 Aug '17

28 Aug '17

--94eb2c0477b011a5720557daad8c Content-Type: text/plain; charset="UTF-8" I take it that this enhancement on the client side API isn't something you think would be useful. If that's the case, feel free to close this ticket, and best of luck with your ongoing development! On Wed, Feb 22, 2017 at 8:49 PM, Alec C <ahnolds(a)gmail.com> wrote: > I completely agree that this doesn't add any security when running slapd. > However, when I originally wrote this patch, I was more targeting API > usage, and in particular, client-side API usage. My goal was to allow a > user to present an encrypted key (stored on disk) and a password (only held > in memory), and use these to query a secure LDAP server. The issue of how > the password got into memory is certainly beyond the scope of OpenLDAP in > this case, but it certainly could be done securely in a way that wouldn't > leave it exposed to a third-party with file-system access. > > For example (in the use case that motivated me originally), an sysadmin > could input the password through an online form, submit said form to a > Python webserver over HTTPS, the Python code could pass the password to > OpenLDAP through a Python interface like python-ldap ( > https://www.python-ldap.org/), and then use the LDAPS or STARTTLS > connection to talk securely to some LDAP server elsewhere. All without an > unencrypted keyfile or a password ever existing on disk, hence the added > security. > > If you feel that supporting encrypted keyfiles in slapd is a bad design > choice, I'm willing to rework the patch to drop that part and only keep the > API-level support. Personally, I would argue that it doesn't hurt to > support the feature, although perhaps my documentation changes could do a > better job emphasizing the inherent security limitations. Let me know what > you think (or if this discussion should take place on a list, let me know > which/where). > > > On Wed, Feb 22, 2017 at 1:11 PM, Howard Chu <hyc(a)symas.com> wrote: > >> ahnolds(a)gmail.com wrote: >> >>> Full_Name: Alec Cooper >>> Version: HEAD of master branch >>> OS: Ubuntu Linux 16.04 >>> URL: ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch >>> Submission from: (NULL) (73.134.243.211) >>> >>> >>> Adding support for encrypted server private keys. >>> >> >> Thank you for your submission. I must compliment you on providing such a >> comprehensive and well-written contribution. Unfortunately the feature >> itself is clearly not useful. Perhaps you should have raised this topic on >> the openldap-devel list for discussion before spending your time writing it. >> >> All your feature does is embed the encryption key in the filesystem, so >> an encrypted private key is still no more secure than an unencrypted one. >> It still just depends on setting proper file access permissions, and the >> current documentation already makes that point. >> >> Indeed, all it does is give the false illusion of enhancing security, and >> followups like balmerpeak92(a)gmail.com's shows that people will easily >> fall for such illusions. >> >> I regret having to reject such a well written contribution, but we cannot >> in good conscience accept a security feature that doesn't actually improve >> security. >> >>> >>> The meat of this patch is changes to tls2.c, tls_g.c, tls_m.c, and >>> tls_o.c to >>> send a password to the underlying TLS library. >>> >>> Changes to ldap.h, init.c and ldap-int.h expose the new >>> LDAP_OPT_X_TLS_KEYPASSWORD in the main API. >>> >>> Changes in the contrib/ldapc++ directory expose the corresponding >>> TlsOptions::KEYPASSWORD option in the C++ API. >>> >>> Changes in the servers directory expose equivalent options for servers as >>> configuration file entries or environment variables. >>> >>> Changes in the doc directory add documentation about the new options and >>> remove >>> statements that indicated that encrypted keyfiles are not supported. >>> >>> New files in the test directory are for testing TLS connections, both in >>> general >>> and with encrypted keyfiles. Tests pass for OpenSSL and GnuTLS using PEM >>> formatted certs and keys, and for MozNSS using cert/key databases. The >>> new unit >>> test (test065-tls) has been written to detect when using NSS, and use the >>> cert/key databases in this case. I have been unable to get a working >>> version of >>> libnsspem, so I cannot test MozNSS with (or without) encrypted keyfiles - >>> testing for this case would be welcome! >>> >>> Notice of origin: The attached patch file is derived from OpenLDAP >>> Software. All >>> of the modifications to OpenLDAP Software represented in the following >>> patch >>> were developed by Alec Cooper ahnolds(a)gmail.com. I have not assigned >>> rights >>> and/or interest in this work to any party. >>> Rights statement: I, Alec Cooper, hereby place the following >>> modifications to >>> OpenLDAP Software (and only these modifications) into the public domain. >>> Hence, >>> these modifications may be freely used and/or redistributed for any >>> purpose with >>> or without attribution and/or other notice. >>> >>> The patch has been uploaded to the OpenLDAP FTP server and can be found >>> at >>> ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch >>> >>> >>> >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ >> > > --94eb2c0477b011a5720557daad8c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I take it that this enhancement on the client side API isn= 't something you think would be useful. If that's the case, feel fr= ee to close this ticket, and best of luck with your ongoing development!</d= iv><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Wed, Feb 22= , 2017 at 8:49 PM, Alec C <span dir=3D"ltr"><<a href=3D"mailto:ahnolds@g= mail.com" target=3D"_blank">ahnolds(a)gmail.com</a>></span> wrote:<br><blo= ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c= cc solid;padding-left:1ex"><div dir=3D"ltr">I completely agree that this do= esn't add any security when running slapd. However, when I originally w= rote this patch, I was more targeting API usage, and in particular, client-= side API usage. My goal was to allow a user to present an encrypted key (st= ored on disk) and a password (only held in memory), and use these to query = a secure LDAP server. The issue of how the password got into memory is cert= ainly beyond the scope of OpenLDAP in this case, but it certainly could be = done securely in a way that wouldn't leave it exposed to a third-party = with file-system access.<div><br></div><div>For example (in the use case th= at motivated me originally), an sysadmin could input the password through a= n online form, submit said form to a Python webserver over HTTPS, the Pytho= n code could pass the password to OpenLDAP through a Python interface like = python-ldap (<a href=3D"https://www.python-ldap.org/" target=3D"_blank">htt= ps://www.python-ldap.org/</a>)<wbr>, and then use the LDAPS or STARTTLS con= nection to talk securely to some LDAP server elsewhere. All without an unen= crypted keyfile or a password ever existing on disk, hence the added securi= ty.<div><br></div><div>If you feel that supporting encrypted keyfiles in sl= apd is a bad design choice, I'm willing to rework the patch to drop tha= t part and only keep the API-level support. Personally, I would argue that = it doesn't hurt to support the feature, although perhaps my documentati= on changes could do a better job emphasizing the inherent security limitati= ons. Let me know what you think (or if this discussion should take place on= a list, let me know which/where).=C2=A0</div></div><div><br></div></div><d= iv class=3D"HOEnZb"><div class=3D"h5"><div class=3D"gmail_extra"><br><div c= lass=3D"gmail_quote">On Wed, Feb 22, 2017 at 1:11 PM, Howard Chu <span dir= =3D"ltr"><<a href=3D"mailto:hyc@symas.com" target=3D"_blank">hyc(a)symas.c= om</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"marg= in:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><a href=3D"mailt= o:ahnolds@gmail.com" target=3D"_blank">ahnolds(a)gmail.com</a> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> Full_Name: Alec Cooper<br> Version: HEAD of master branch<br> OS: Ubuntu Linux 16.04<br> URL: <a href=3D"ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch" r= el=3D"noreferrer" target=3D"_blank">ftp://ftp.openldap.org/incomin<wbr>g/Al= ec-Cooper-160827.patch</a><br> Submission from: (NULL) (73.134.243.211)<br> <br> <br> Adding support for encrypted server private keys.<br> </blockquote> <br> Thank you for your submission. I must compliment you on providing such a co= mprehensive and well-written contribution. Unfortunately the feature itself= is clearly not useful. Perhaps you should have raised this topic on the op= enldap-devel list for discussion before spending your time writing it.<br> <br> All your feature does is embed the encryption key in the filesystem, so an = encrypted private key is still no more secure than an unencrypted one. It s= till just depends on setting proper file access permissions, and the curren= t documentation already makes that point.<br> <br> Indeed, all it does is give the false illusion of enhancing security, and f= ollowups like <a href=3D"mailto:balmerpeak92@gmail.com" target=3D"_blank">b= almerpeak92(a)gmail.com</a>'s shows that people will easily fall for such= illusions.<br> <br> I regret having to reject such a well written contribution, but we cannot i= n good conscience accept a security feature that doesn't actually impro= ve security.<br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> <br> The meat of this patch is changes to tls2.c, tls_g.c, tls_m.c, and tls_o.c = to<br> send a password to the underlying TLS library.<br> <br> Changes to ldap.h, init.c and ldap-int.h expose the new<br> LDAP_OPT_X_TLS_KEYPASSWORD in the main API.<br> <br> Changes in the contrib/ldapc++ directory expose the corresponding<br> TlsOptions::KEYPASSWORD option in the C++ API.<br> <br> Changes in the servers directory expose equivalent options for servers as<b= r> configuration file entries or environment variables.<br> <br> Changes in the doc directory add documentation about the new options and re= move<br> statements that indicated that encrypted keyfiles are not supported.<br> <br> New files in the test directory are for testing TLS connections, both in ge= neral<br> and with encrypted keyfiles. Tests pass for OpenSSL and GnuTLS using PEM<br= > formatted certs and keys, and for MozNSS using cert/key databases. The new = unit<br> test (test065-tls) has been written to detect when using NSS, and use the<b= r> cert/key databases in this case. I have been unable to get a working versio= n of<br> libnsspem, so I cannot test MozNSS with (or without) encrypted keyfiles -<b= r> testing for this case would be welcome!<br> <br> Notice of origin: The attached patch file is derived from OpenLDAP Software= . All<br> of the modifications to OpenLDAP Software represented in the following patc= h<br> were developed by Alec Cooper <a href=3D"mailto:ahnolds@gmail.com" target= =3D"_blank">ahnolds(a)gmail.com</a>. I have not assigned rights<br> and/or interest in this work to any party.<br> Rights statement: I, Alec Cooper, hereby place the following modifications = to<br> OpenLDAP Software (and only these modifications) into the public domain. He= nce,<br> these modifications may be freely used and/or redistributed for any purpose= with<br> or without attribution and/or other notice.<br> <br> The patch has been uploaded to the OpenLDAP FTP server and can be found at<= br> <a href=3D"ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch" rel=3D= "noreferrer" target=3D"_blank">ftp://ftp.openldap.org/incomin<wbr>g/Alec-Co= oper-160827.patch</a><br> <br> <br><span class=3D"m_-1938021547848690298HOEnZb"><font color=3D"#888888"> </font></span></blockquote><span class=3D"m_-1938021547848690298HOEnZb"><fo= nt color=3D"#888888"> <br> <br> -- <br> =C2=A0 -- Howard Chu<br> =C2=A0 CTO, Symas Corp.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"= http://www.symas.com" rel=3D"noreferrer" target=3D"_blank">http://www.symas= .com</a><br> =C2=A0 Director, Highland Sun=C2=A0 =C2=A0 =C2=A0<a href=3D"http://highland= sun.com/hyc/" rel=3D"noreferrer" target=3D"_blank">http://highlandsun.com/h= yc/</a><br> =C2=A0 Chief Architect, OpenLDAP=C2=A0 <a href=3D"http://www.openldap.org/p= roject/" rel=3D"noreferrer" target=3D"_blank">http://www.openldap.org/proje= c<wbr>t/</a><br> </font></span></blockquote></div><br></div> </div></div></blockquote></div><br></div> --94eb2c0477b011a5720557daad8c--

1 0

Re: (ITS#8701) account usability control for password less logins
by benjamin.chang＠oracle.com 28 Aug '17

28 Aug '17

This is a multi-part message in MIME format. --------------6CCE37E19DCAC5B8EF15AF2F Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Please disregard the previous workaround proposal, it was incorrect. The corrected workaround proposal: The idea is to determine the account/password state on the client side (since there's no easy way to get the server to provide the state without using the user's password). This was accomplished in a prototype by retrieving the /pwdPolicySubentry/, the policy setting, other operational attributes such as /pwdChangedTime/, /pwdAccountLockedTime/, /pwdFailureTime/, and /pwdGraceUseTime/. These were used to determine the account/password state. Is this reasonable and safe to do? On 08/02/2017 07:31 AM, Ben Chang wrote: > Question about a proposed workaround: > > Would it be possible to use slapo-ppolicy to set the pwdPolicySubentry > attribute for each user to provide the desired > 1.3.6.1.4.1.42.2.27.9.5.8 control response (see > http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control), > i.e., can pwdPolicySubentry be used supply the sub-entry and related > operational attributes needed to validate users for password-less logins? > --------------6CCE37E19DCAC5B8EF15AF2F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> <p>Please disregard the previous workaround proposal, it was incorrect. The corrected workaround proposal:</p> <p> The idea is to determine the account/password state on the client side (since there's no easy way to get the server to provide the state without using the user's password). This was accomplished in a prototype by retrieving the <i>pwdPolicySubentry</i>, the policy setting, other operational attributes such as <i>pwdChangedTime</i>, <i>pwdAccountLockedTime</i>, <i>pwdFailureTime</i>, and <i>pwdGraceUseTime</i>. These were used to determine the account/password state.</p> <p>Is this reasonable and safe to do? </p> <br> <div class="moz-cite-prefix">On 08/02/2017 07:31 AM, Ben Chang wrote:<br> </div> <blockquote type="cite" cite="mid:52bb394d-41f9-746e-28d9-200370b94fbe@oracle.com">Question about a proposed workaround: <br> <br> Would it be possible to use slapo-ppolicy to set the pwdPolicySubentry attribute for each user to provide the desired 1.3.6.1.4.1.42.2.27.9.5.8 control response (see <a class="moz-txt-link-freetext" href="http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control">http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control</a>), i.e., can pwdPolicySubentry be used supply the sub-entry and related operational attributes needed to validate users for password-less logins? <br> <br> </blockquote> <br> </body> </html> --------------6CCE37E19DCAC5B8EF15AF2F--

1 0

Re: (ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by hyc＠symas.com 27 Aug '17

27 Aug '17

Michael Str=C3=B6der wrote: > Howard Chu wrote: >> michael(a)stroeder.com wrote: >>> + /* write out the request to the extended process */ >>> + fprintf( fp, "EXTENDED\n" ); >>> + fprintf( fp, "msgid: %ld\n", (long) op->o_msgid ); >>> + sock_print_conn( fp, op->o_conn, si ); >>> + sock_print_suffixes( fp, op->o_bd ); >>> + fprintf( fp, "oid: %s\n", op->ore_reqoid.bv_val ); >>> + if (op->ore_reqdata) { >>> + fprintf( fp, "valuelen: %lu\n", op->ore_reqdata->bv_len ); >>> + fprintf( fp, "value: %s\n", op->ore_reqdata->bv_val ); >>> + } >>> + fprintf( fp, "\n" ); >> >> This isn't safe. The reqdata is binary, not a nul-terminated C string.= I suppose you >> could hex or base64-encode it instead. >=20 > Frankly I don't understand. >=20 > I considered using base64 but I wanted to stick to what's already done = in back-sock. >=20 > See openldap/servers/slapd/back-sock/bind.c for the password value whic= h is also an > arbitrary OctetString: >=20 > /* write out the request to the bind process */ > [..] > fprintf( fp, "credlen: %lu\n", op->oq_bind.rb_cred.bv_len ); > fprintf( fp, "cred: %s\n", op->oq_bind.rb_cred.bv_val ); /* XXX */ > fprintf( fp, "\n" ); >=20 > The above should also work with null-bytes, shoudn't it? No, it's a bug. Probably a benign bug because it's difficult for users to= =20 create passwords with embedded NULs. --=20 -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by michael＠stroeder.com 27 Aug '17

27 Aug '17

Howard Chu wrote: > michael(a)stroeder.com wrote: >> + /* write out the request to the extended process */ >> + fprintf( fp, "EXTENDED\n" ); >> + fprintf( fp, "msgid: %ld\n", (long) op->o_msgid ); >> + sock_print_conn( fp, op->o_conn, si ); >> + sock_print_suffixes( fp, op->o_bd ); >> + fprintf( fp, "oid: %s\n", op->ore_reqoid.bv_val ); >> + if (op->ore_reqdata) { >> + fprintf( fp, "valuelen: %lu\n", op->ore_reqdata->bv_len ); >> + fprintf( fp, "value: %s\n", op->ore_reqdata->bv_val ); >> + } >> + fprintf( fp, "\n" ); > > This isn't safe. The reqdata is binary, not a nul-terminated C string. I suppose you > could hex or base64-encode it instead. Frankly I don't understand. I considered using base64 but I wanted to stick to what's already done in back-sock. See openldap/servers/slapd/back-sock/bind.c for the password value which is also an arbitrary OctetString: /* write out the request to the bind process */ [..] fprintf( fp, "credlen: %lu\n", op->oq_bind.rb_cred.bv_len ); fprintf( fp, "cred: %s\n", op->oq_bind.rb_cred.bv_val ); /* XXX */ fprintf( fp, "\n" ); The above should also work with null-bytes, shoudn't it? Ciao, Michael.

1 0

RE: (ITS#8717) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by ipuleston＠SonicWALL.com 25 Aug '17

25 Aug '17

I have uploaded the patch to ftp.openldap.org/incoming as ian-puleston-1708= 25.patch, and included it below. The code that it adds is pretty much copied from ldap_free_connection: diff --git libraries/libldap/open.c libraries/libldap/open.c index 11564f9..251289d 100644 --- libraries/libldap/open.c +++ libraries/libldap/open.c @@ -450,6 +450,31 @@ ldap_int_open_connection( --conn->lconn_refcnt; =20 if (rc !=3D LDAP_SUCCESS) { + /* report the failure to the connection callbacks *= / + { + struct ldapoptions *lo; + ldaplist *ll; + ldap_conncb *cb; + + lo =3D &ld->ld_options; + LDAP_MUTEX_LOCK( &lo->ldo_mutex ); + if ( lo->ldo_conn_cbs ) { + for ( ll=3Dlo->ldo_conn_cbs; ll; ll= =3Dll->ll_next ) { + cb =3D ll->ll_data; + cb->lc_del( ld, conn->lconn= _sb, cb ); + } + } + LDAP_MUTEX_UNLOCK( &lo->ldo_mutex ); + lo =3D LDAP_INT_GLOBAL_OPT(); + LDAP_MUTEX_LOCK( &lo->ldo_mutex ); + if ( lo->ldo_conn_cbs ) { + for ( ll=3Dlo->ldo_conn_cbs; ll; ll= =3Dll->ll_next ) { + cb =3D ll->ll_data; + cb->lc_del( ld, conn->lconn= _sb, cb ); + } + } + LDAP_MUTEX_UNLOCK( &lo->ldo_mutex ); + } return -1; } }

1 0

RE: (ITS#8718) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by ipuleston＠SonicWALL.com 25 Aug '17

25 Aug '17

Sorry, I refreshed my browser after creating #8717 and it re-posted and cre= ated this one. Please close it as a duplicate of #8717. > -----Original Message----- > From: openldap-its(a)OpenLDAP.org [mailto:openldap-its@OpenLDAP.org] > Sent: Friday, August 25, 2017 1:30 PM > To: Ian Puleston > Subject: Re: (ITS#8718) Connection delete callback registreed with > LDAP_OPT_CONNECT_CB is not called on TLS failure >=20 >=20 > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** >=20 > Thanks for your report to the OpenLDAP Issue Tracking System. Your repor= t > has been assigned the tracking number ITS#8718. >=20 > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers are > volunteers. They only work on OpenLDAP when they have spare time. >=20 > If you need to provide additional information in regards to your issue > report, you may do so by replying to this message. Note that any mail se= nt > to openldap-its(a)openldap.org with (ITS#8718) in the subject will > automatically be attached to the issue report. >=20 > mailto:openldap-its@openldap.org?subject=3D(ITS#8718) >=20 > You may follow the progress of this report by loading the following URL i= n > a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=3D8718 >=20 > Please remember to retain your issue tracking number (ITS#8718) on any > further messages you send to us regarding this report. If you don't then > you'll just waste our time and yours because we won't be able to properly > track the report. >=20 > Please note that the Issue Tracking System is not intended to be used to > seek help in the proper use of OpenLDAP Software. > Such requests will be closed. >=20 > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ >=20 > -------------- > Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved.

1 0

(ITS#8718) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by ipuleston＠sonicwall.com 25 Aug '17

25 Aug '17

Full_Name: Ian Puleston Version: 2.4.40 OS: VxWorks URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (204.118.31.9) If connect and delete callbacks are registered via LDAP_OPT_CONNECT_CB, then the lc_add callback is called when the TCP connects, but if TLS then fails to connect the lc_del does not get called. If these callbacks are doing something like allocating/freeing resources this can lead to a resource leak. When I am seeing this, the sequence of calls leading to the lc_add callback is as follows: ldap_new_connection -> ldap_int_open_connection -> ldap_connect_to_host -> ldap_int_connect_cbs() Then if ldap_connect_to_host returned 0 for synchronous success this call happens: ldap_new_connection -> ldap_int_open_connection -> ldap_int_tls_start And if that fails and returns something other than LDAP_SUCCESS then ldap_int_open_connection exits. So we got a call to lc_add but no corresponding call to lc_del. And note that there is not call to ldap_free_connection, presumably because ldap-new-connection did not succeed, hence the lc_del callback does not get called from there. In my case when I see this it is on a referral with the above calls made from ldap_chase_v3referrals, hence it is happening synchronously. Whether the same would happen with an asynchronous connect I don't know. I do have a working fix which is to make the lc_del callbacks directly from ldap_int_open_connection if ldap_int_tls_start fails. I will supply a patch for that shortly.

1 0

Re: (ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by hyc＠symas.com 25 Aug '17

25 Aug '17

michael(a)stroeder.com wrote: > + /* write out the request to the extended process */ > + fprintf( fp, "EXTENDED\n" ); > + fprintf( fp, "msgid: %ld\n", (long) op->o_msgid ); > + sock_print_conn( fp, op->o_conn, si ); > + sock_print_suffixes( fp, op->o_bd ); > + fprintf( fp, "oid: %s\n", op->ore_reqoid.bv_val ); > + if (op->ore_reqdata) { > + fprintf( fp, "valuelen: %lu\n", op->ore_reqdata->bv_len ); > + fprintf( fp, "value: %s\n", op->ore_reqdata->bv_val ); > + } > + fprintf( fp, "\n" ); This isn't safe. The reqdata is binary, not a nul-terminated C string. I suppose you could hex or base64-encode it instead. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8637) OpenLDAP crashing when defining multiple olcDbURI for chaining
by okuznik＠symas.com 25 Aug '17

25 Aug '17

This configuration should have been rejected by back-config just like it is rejected by slapd.conf. Patch to have this happen is at: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170825-ITS8637.patch This doesn't reject online modifications just touching olcDBURI, but I think back ldap has no idea when it's configured as a slave to the chain overlay, so it can't do much. --=20 Ond=C5=99ej Kuzn=C3=ADk Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#8444) Out-of-sync issue with memberOf overlay, Delta-syncrepl MMR and >2 nodes
by okuznik＠symas.com 25 Aug '17

25 Aug '17

On Thu, Aug 24, 2017 at 03:55:32PM +0100, Ond=C5=99ej Kuzn=C3=ADk wrote: > I think it looks like this: syncproc_checkpoint modifies the suffix > entry, that calls slap_graduate_commit_csn and the csn is removed from > be_pending_csn_list. accesslog_response then can't find the CSN there > and has nothing to insert into its own pending csn list. Strange that > changing the overlay order (accesslog vs. syncprov) doesn't change this > behaviour, something I'd expect if the above is the reason this happens= . In any case, having the checkpoint modification get its own CSN entry lets the main operation CSN entry persist, which fixes this issue and all operations that need a CSN seem to get it. Patch is available at: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170825-ITS8444.patch --=20 Ond=C5=99ej Kuzn=C3=ADk Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

(ITS#8717) Connection delete callback registreed with LDAP_OPT_CONNECT_CB is not called on TLS failure
by ipuleston＠sonicwall.com 24 Aug '17

24 Aug '17

Full_Name: Ian Puleston Version: 2.4.40 OS: VxWorks URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (204.118.31.9) If connect and delete callbacks are registered via LDAP_OPT_CONNECT_CB, then the lc_add callback is called when the TCP connects, but if TLS then fails to connect the lc_del does not get called. If these callbacks are doing something like allocating/freeing resources this can lead to a resource leak. When I am seeing this, the sequence of calls leading to the lc_add callback is as follows: ldap_new_connection -> ldap_int_open_connection -> ldap_connect_to_host -> ldap_int_connect_cbs() Then if ldap_connect_to_host returned 0 for synchronous success this call happens: ldap_new_connection -> ldap_int_open_connection -> ldap_int_tls_start And if that fails and returns something other than LDAP_SUCCESS then ldap_int_open_connection exits. So we got a call to lc_add but no corresponding call to lc_del. And note that there is not call to ldap_free_connection, presumably because ldap-new-connection did not succeed, hence the lc_del callback does not get called from there. In my case when I see this it is on a referral with the above calls made from ldap_chase_v3referrals, hence it is happening synchronously. Whether the same would happen with an asynchronous connect I don't know. I do have a working fix which is to make the lc_del callbacks directly from ldap_int_open_connection if ldap_int_tls_start fails. I will supply a patch for that shortly.

1 0

Re: (ITS#8444) Out-of-sync issue with memberOf overlay, Delta-syncrepl MMR and >2 nodes
by okuznik＠symas.com 24 Aug '17

24 Aug '17

On Wed, Aug 23, 2017 at 02:42:29PM +0100, Ond=C5=99ej Kuzn=C3=ADk wrote: > It is caused by the cookie not containing CSN and a race between the > syncCookie check in do_syncrep2 and syncrepl_message_to_op. >=20 > This race is probably fine with plain syncrepl which is idempotent, but > deltasync changes get their own dn in each accesslog instance and some > can be applied twice unless we know how to find out we've already seen > them - they need to mention the CSN. >=20 > The CSN itself gets lost on at least one occasion - when there's a > checkpoint triggered. Not 100 % sure why the cookie gets eaten because > of it, the op pointer is different between the syncprov_op_response tha= t > calls syncprov_checkpoint and the one that decides CSN hasn't changed. Yes, whenever a checkpoint happens, the syncCookie in cn=3Daccesslog only contains rid=3DXXX,sid=3DYYY. I thought that was because the checkpoint results in a new accesslog entry and that would be transmitted first, but that's not the case, there is no accesslog entry nor anything sent to the client (as observed by ldapsearch -E sync=3Drp). I think it looks like this: syncproc_checkpoint modifies the suffix entry, that calls slap_graduate_commit_csn and the csn is removed from be_pending_csn_list. accesslog_response then can't find the CSN there and has nothing to insert into its own pending csn list. Strange that changing the overlay order (accesslog vs. syncprov) doesn't change this behaviour, something I'd expect if the above is the reason this happens. --=20 Ond=C5=99ej Kuzn=C3=ADk Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#8444) Out-of-sync issue with memberOf overlay, Delta-syncrepl MMR and >2 nodes
by okuznik＠symas.com 23 Aug '17

23 Aug '17

It is caused by the cookie not containing CSN and a race between the syncCookie check in do_syncrep2 and syncrepl_message_to_op. This race is probably fine with plain syncrepl which is idempotent, but deltasync changes get their own dn in each accesslog instance and some can be applied twice unless we know how to find out we've already seen them - they need to mention the CSN. The CSN itself gets lost on at least one occasion - when there's a checkpoint triggered. Not 100 % sure why the cookie gets eaten because of it, the op pointer is different between the syncprov_op_response that calls syncprov_checkpoint and the one that decides CSN hasn't changed. --=20 Ond=C5=99ej Kuzn=C3=ADk Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: (ITS#8716) Install error
by quanah＠symas.com 21 Aug '17

21 Aug '17

--On Monday, August 21, 2017 4:45 PM +0000 germinouz(a)gmail.com wrote: Hello, The ITS system is for reporting bugs in the software, not for asking question on how to do things such as build software. Please redirect your question to openldap-technical(a)openldap.org if you need help with how to set up a proper environment for building software. I would note the error is rather obvious from the config.log you supplied: > configure:5786: cc -I /usr/local/BerkeleyDB/6.2.32/include > -L/usr/local/lib -L/usr/local/BerkeleyDB/6.2.32/lib > -R/data/BerkeleyDB/6.2.32/lib conftest.c >> &5 > cc: error: unrecognized command line option '-R' Hope that helps! This ITS will be closed. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8716) Install error
by germinouz＠gmail.com 21 Aug '17

21 Aug '17

Full_Name: Frank Vincent Version: 2.4.45 OS: RedHat7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.93.27.65) When I install on RH7, I get an error. [root@localhost openldap-2.4.45]# ./configure --prefix=/data/openldap Configuring OpenLDAP 2.4.45-Release ... checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking target system type... x86_64-unknown-linux-gnu checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking configure arguments... done checking for cc... cc checking for ar... ar checking for style of include used by make... GNU checking whether the C compiler works... no configure: error: in `/root/data/openldap-2.4.45': configure: error: C compiler cannot create executables See `config.log' for more details. [root@localhost openldap-2.4.45]# cat config.log This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by configure, which was generated by GNU Autoconf 2.65. Invocation command line was $ ./configure --prefix=/data/openldap ## --------- ## ## Platform. ## ## --------- ## hostname = localhost.localdomain uname -m = x86_64 uname -r = 3.10.0-514.el7.x86_64 uname -s = Linux uname -v = #1 SMP Wed Oct 19 11:24:13 EDT 2016 /usr/bin/uname -p = x86_64 /bin/uname -X = unknown /bin/arch = x86_64 /usr/bin/arch -k = unknown /usr/convex/getsysinfo = unknown /usr/bin/hostinfo = unknown /bin/machine = unknown /usr/bin/oslevel = unknown /bin/universe = unknown PATH: /usr/local/sbin PATH: /usr/local/bin PATH: /usr/sbin PATH: /usr/bin PATH: /root/bin PATH: /usr/java/jdk1.8.0_131/bin PATH: /opt/apache-tomcat-8.0.36/bin ## ----------- ## ## Core tests. ## ## ----------- ## configure:2890: checking build system type configure:2904: result: x86_64-unknown-linux-gnu configure:2924: checking host system type configure:2937: result: x86_64-unknown-linux-gnu configure:2957: checking target system type configure:2970: result: x86_64-unknown-linux-gnu configure:3012: checking for a BSD-compatible install configure:3080: result: /usr/bin/install -c configure:3091: checking whether build environment is sane configure:3128: result: yes configure:3190: checking for gawk configure:3206: found /usr/bin/gawk configure:3217: result: gawk configure:3228: checking whether make sets $(MAKE) configure:3250: result: yes configure:3467: checking configure arguments configure:5060: result: done configure:5232: checking for cc configure:5248: found /usr/bin/cc configure:5259: result: cc configure:5282: checking for ar configure:5298: found /usr/bin/ar configure:5309: result: ar configure:5367: checking for style of include used by make configure:5395: result: GNU configure:5724: checking for C compiler version configure:5733: cc --version >&5 cc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-11) Copyright (C) 2015 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. configure:5744: $? = 0 configure:5733: cc -v >&5 Using built-in specs. COLLECT_GCC=cc COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-redhat-linux/4.8.5/lto-wrapper Target: x86_64-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-bootstrap --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-gnu-unique-object --enable-linker-build-id --with-linker-hash-style=gnu --enable-languages=c,c++,objc,obj-c++,java,fortran,ada,go,lto --enable-plugin --enable-initfini-array --disable-libgcj --with-isl=/builddir/build/BUILD/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/isl-install --with-cloog=/builddir/build/BUILD/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/cloog-install --enable-gnu-indirect-function --with-tune=generic --with-arch_32=x86-64 --build=x86_64-redhat-linux Thread model: posix gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) configure:5744: $? = 0 configure:5733: cc -V >&5 cc: error: unrecognized command line option '-V' cc: fatal error: no input files compilation terminated. configure:5744: $? = 4 configure:5733: cc -qversion >&5 cc: error: unrecognized command line option '-qversion' cc: fatal error: no input files compilation terminated. configure:5744: $? = 4 configure:5764: checking whether the C compiler works configure:5786: cc -I /usr/local/BerkeleyDB/6.2.32/include -L/usr/local/lib -L/usr/local/BerkeleyDB/6.2.32/lib -R/data/BerkeleyDB/6.2.32/lib conftest.c >&5 cc: error: unrecognized command line option '-R' configure:5790: $? = 1 configure:5828: result: no configure: failed program was: | /* confdefs.h */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define PACKAGE_URL "" | #define OPENLDAP_PACKAGE "OpenLDAP" | #define OPENLDAP_VERSION "2.4.45" | #define LDAP_VENDOR_VERSION 20445 | #define LDAP_VENDOR_VERSION_MAJOR 2 | #define LDAP_VENDOR_VERSION_MINOR 4 | #define LDAP_VENDOR_VERSION_PATCH 45 | #define HAVE_MKVERSION 1 | /* end confdefs.h. */ | | int | main () | { | | ; | return 0; | } configure:5833: error: in `/root/data/openldap-2.4.45': configure:5837: error: C compiler cannot create executables See `config.log' for more details. ## ---------------- ## ## Cache variables. ## ## ---------------- ## ac_cv_build=x86_64-unknown-linux-gnu ac_cv_env_CC_set= ac_cv_env_CC_value= ac_cv_env_CFLAGS_set= ac_cv_env_CFLAGS_value= ac_cv_env_CPPFLAGS_set=set ac_cv_env_CPPFLAGS_value='-I /usr/local/BerkeleyDB/6.2.32/include' ac_cv_env_CPP_set= ac_cv_env_CPP_value= ac_cv_env_LDFLAGS_set=set ac_cv_env_LDFLAGS_value='-L/usr/local/lib -L/usr/local/BerkeleyDB/6.2.32/lib -R/data/BerkeleyDB/6.2.32/lib' ac_cv_env_LIBS_set= ac_cv_env_LIBS_value= ac_cv_env_build_alias_set= ac_cv_env_build_alias_value= ac_cv_env_host_alias_set= ac_cv_env_host_alias_value= ac_cv_env_target_alias_set= ac_cv_env_target_alias_value= ac_cv_host=x86_64-unknown-linux-gnu ac_cv_path_install='/usr/bin/install -c' ac_cv_prog_AR=ar ac_cv_prog_AWK=gawk ac_cv_prog_CC=cc ac_cv_prog_make_make_set=yes ac_cv_shtool=build/shtool ac_cv_target=x86_64-unknown-linux-gnu ## ----------------- ## ## Output variables. ## ## ----------------- ## ACLOCAL='${SHELL} /root/data/openldap-2.4.45/build/missing --run aclocal-1.9' AMDEPBACKSLASH='\' AMDEP_FALSE='#' AMDEP_TRUE='' AMTAR='${SHELL} /root/data/openldap-2.4.45/build/missing --run tar' AR='ar' AS='' AUTH_LIBS='' AUTOCONF='${SHELL} /root/data/openldap-2.4.45/build/missing --run autoconf' AUTOHEADER='${SHELL} /root/data/openldap-2.4.45/build/missing --run autoheader' AUTOMAKE='${SHELL} /root/data/openldap-2.4.45/build/missing --run automake-1.9' AWK='gawk' BDB_LIBS='' BUILD_ACCESSLOG='no' BUILD_AUDITLOG='no' BUILD_BDB='no' BUILD_COLLECT='' BUILD_CONSTRAINT='no' BUILD_DDS='no' BUILD_DENYOP='no' BUILD_DEREF='no' BUILD_DNSSRV='no' BUILD_DYNGROUP='no' BUILD_DYNLIST='no' BUILD_HDB='no' BUILD_LASTMOD='no' BUILD_LDAP='no' BUILD_LIBS_DYNAMIC='' BUILD_MDB='no' BUILD_MEMBEROF='no' BUILD_META='no' BUILD_MONITOR='no' BUILD_NDB='no' BUILD_NULL='no' BUILD_PASSWD='no' BUILD_PERL='no' BUILD_PPOLICY='no' BUILD_PROXYCACHE='no' BUILD_REFINT='no' BUILD_RELAY='no' BUILD_RETCODE='no' BUILD_RWM='no' BUILD_SEQMOD='no' BUILD_SHELL='no' BUILD_SLAPD='no' BUILD_SLAPI='no' BUILD_SOCK='no' BUILD_SQL='no' BUILD_SSSVLV='no' BUILD_SYNCPROV='no' BUILD_THREAD='no' BUILD_TRANSLUCENT='no' BUILD_UNIQUE='no' BUILD_VALSORT='no' CC='cc' CCDEPMODE='' CFLAGS='' CPP='' CPPFLAGS='-I /usr/local/BerkeleyDB/6.2.32/include' CYGPATH_W='echo' DEFS='' DEPDIR='.deps' DLLTOOL='' ECHO='echo' ECHO_C='' ECHO_N='-n' ECHO_T='' EGREP='' EXEEXT='' GREP='' ICU_LIBS='' INSTALL_DATA='${INSTALL} -m 644' INSTALL_PROGRAM='${INSTALL}' INSTALL_SCRIPT='${INSTALL}' INSTALL_STRIP_PROGRAM='${SHELL} $(install_sh) -c -s' KRB4_LIBS='' KRB5_LIBS='' LDAP_LIBS='' LDFLAGS='-L/usr/local/lib -L/usr/local/BerkeleyDB/6.2.32/lib -R/data/BerkeleyDB/6.2.32/lib' LIBOBJS='' LIBS='' LIBSLAPI='' LIBSRCS='' LIBTOOL='' LN_S='' LTHREAD_LIBS='' LTLIBOBJS='' LTSTATIC='' LUTIL_LIBS='' MAKEINFO='${SHELL} /root/data/openldap-2.4.45/build/missing --run makeinfo' MODULES_LIBS='' MOD_PERL_LDFLAGS='' MYSQL='' OBJDUMP='' OBJEXT='' OL_MKDEP='' OL_MKDEP_FLAGS='' OPENLDAP_LIBRELEASE='2.4' OPENLDAP_LIBVERSION='12:8:10' OPENLDAP_RELEASE_DATE='2017/06/01' PACKAGE='OpenLDAP' PACKAGE_BUGREPORT='' PACKAGE_NAME='' PACKAGE_STRING='' PACKAGE_TARNAME='' PACKAGE_URL='' PACKAGE_VERSION='' PATH_SEPARATOR=':' PERLBIN='' PERL_CPPFLAGS='' PLAT='' RANLIB='' SASL_LIBS='' SET_MAKE='' SHELL='/bin/sh' SLAPD_DYNAMIC_BACKENDS='' SLAPD_DYNAMIC_OVERLAYS='' SLAPD_GMP_LIBS='' SLAPD_LIBS='' SLAPD_MODULES_CPPFLAGS='' SLAPD_MODULES_LDFLAGS='' SLAPD_NDB_INCS='' SLAPD_NDB_LIBS='' SLAPD_NO_STATIC='' SLAPD_PERL_LDFLAGS='' SLAPD_SLAPI_DEPEND='' SLAPD_SLP_LIBS='' SLAPD_SQL_INCLUDES='' SLAPD_SQL_LDFLAGS='' SLAPD_SQL_LIBS='' SLAPD_STATIC_BACKENDS='back-ldif' SLAPD_STATIC_OVERLAYS='' SLAPI_LIBS='' STRIP='' TLS_LIBS='' VERSION='2.4.45' WITH_ACI_ENABLED='' WITH_MODULES_ENABLED='' WITH_SASL='' WITH_TLS='' WRAP_LIBS='' ac_ct_CC='' am__fastdepCC_FALSE='' am__fastdepCC_TRUE='' am__include='include' am__leading_dot='.' am__quote='' am__tar='${AMTAR} chof - "$$tardir"' am__untar='${AMTAR} xf -' bindir='${exec_prefix}/bin' build='x86_64-unknown-linux-gnu' build_alias='' build_cpu='x86_64' build_os='linux-gnu' build_vendor='unknown' datadir='${datarootdir}' datarootdir='${prefix}/share' docdir='${datarootdir}/doc/${PACKAGE}' dvidir='${docdir}' exec_prefix='NONE' host='x86_64-unknown-linux-gnu' host_alias='' host_cpu='x86_64' host_os='linux-gnu' host_vendor='unknown' htmldir='${docdir}' includedir='${prefix}/include' infodir='${datarootdir}/info' install_sh='/root/data/openldap-2.4.45/build/install-sh' ldap_subdir='/openldap' libdir='${exec_prefix}/lib' libexecdir='${exec_prefix}/libexec' localedir='${datarootdir}/locale' localstatedir='${prefix}/var' mandir='${datarootdir}/man' mkdir_p='mkdir -p --' oldincludedir='/usr/include' pdfdir='${docdir}' prefix='/data/openldap' program_transform_name='s,x,x,' psdir='${docdir}' sbindir='${exec_prefix}/sbin' sharedstatedir='${prefix}/com' sysconfdir='${prefix}/etc' target='x86_64-unknown-linux-gnu' target_alias='' target_cpu='x86_64' target_os='linux-gnu' target_vendor='unknown' top_builddir='/root/data/openldap-2.4.45' ## ----------- ## ## confdefs.h. ## ## ----------- ## /* confdefs.h */ #define PACKAGE_NAME "" #define PACKAGE_TARNAME "" #define PACKAGE_VERSION "" #define PACKAGE_STRING "" #define PACKAGE_BUGREPORT "" #define PACKAGE_URL "" #define OPENLDAP_PACKAGE "OpenLDAP" #define OPENLDAP_VERSION "2.4.45" #define LDAP_VENDOR_VERSION 20445 #define LDAP_VENDOR_VERSION_MAJOR 2 #define LDAP_VENDOR_VERSION_MINOR 4 #define LDAP_VENDOR_VERSION_PATCH 45 #define HAVE_MKVERSION 1 configure: exit 77

1 0

(ITS#8715) Typo in man page description of olcTLSCipherSuite?
by james＠turnersoft.co.uk 19 Aug '17

19 Aug '17

Full_Name: James Turner Version: 2.4 OS: Ubuntu 16.04 LTS URL: Submission from: (NULL) (81.86.27.193) File: /doc/man/man5/slapd-config.5 The following example is given at line 832 (correct for Git master branch at time of writing): TLSCiphersuite SECURE256:!AES-128-CBC Shouldn't this read: olcTLSCiphersuite: SECURE256:!AES-128-CBC

1 0

Re: (ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by michael＠stroeder.com 18 Aug '17

18 Aug '17

This is a multi-part message in MIME format. --------------4BA376E6A3936AB8C247B47A Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The attached patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Michael Ströder <michael(a)stroeder.com>. I have not assigned rights and/or interest in this work to any party. I, Michael Ströder, hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. This patch can also be found here: ftp://ftp.openldap.org/incoming/0001-ITS-8714-Send-out-EXTENDED-operation-m… --------------4BA376E6A3936AB8C247B47A Content-Type: text/x-patch; name="0001-ITS-8714-Send-out-EXTENDED-operation-message-from-back-sock.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename*0="0001-ITS-8714-Send-out-EXTENDED-operation-message-from-back-"; filename*1="sock.patch" =46rom 732c5646e0a03be8b58e52527b25742f0495807e Mon Sep 17 00:00:00 2001 From: =3D?UTF-8?q?Michael=3D20Str=3DC3=3DB6der?=3D <michael(a)stroeder.com>= Date: Fri, 18 Aug 2017 18:47:41 +0200 Subject: [PATCH] ITS#8714 Send out EXTENDED operation message from back-s= ock to external program --- doc/man/man5/slapd-sock.5 | 19 +++++++++++- servers/slapd/back-sock/Makefile.in | 4 +-- servers/slapd/back-sock/config.c | 12 ++++++-- servers/slapd/back-sock/extended.c | 58 ++++++++++++++++++++++++++++++= ++++++ servers/slapd/back-sock/init.c | 2 +- servers/slapd/back-sock/proto-sock.h | 2 ++ 6 files changed, 91 insertions(+), 6 deletions(-) create mode 100644 servers/slapd/back-sock/extended.c diff --git a/doc/man/man5/slapd-sock.5 b/doc/man/man5/slapd-sock.5 index 1ac4f7fdd..0c4fc3fdd 100644 --- a/doc/man/man5/slapd-sock.5 +++ b/doc/man/man5/slapd-sock.5 @@ -49,7 +49,7 @@ be sent and from which replies are received. =20 When used as an overlay, these additional directives are defined: .TP -.B sockops [ bind | unbind | search | compare | modify | modrdn | add | = delete ]* +.B sockops [ bind | unbind | search | compare | modify | modrdn | add | = delete | extended ]* Specify which request types to send to the external program. The default= is empty (no requests are sent). .TP @@ -115,6 +115,18 @@ dn: <DN> .PP .RS .nf +EXTENDED +msgid: <message id> +<repeat { "suffix:" <database suffix DN> }> +oid: <OID> +valuelen: <length of <value>> +value: <credentials> +<blank line> +.fi +.RE +.PP +.RS +.nf MODIFY msgid: <message id> <repeat { "suffix:" <database suffix DN> }> @@ -292,6 +304,11 @@ access to the pseudo_attribute of the searchBase; .B search (=3Ds) access to the attributes and values used in the filter is not checked. +.LP +The +.B extended +operation does not require any access special rights. +The external program has to implement any sort of access control. =20 .SH EXAMPLE There is an example script in the slapd/back\-sock/ directory diff --git a/servers/slapd/back-sock/Makefile.in b/servers/slapd/back-soc= k/Makefile.in index 3e527e545..efb916246 100644 --- a/servers/slapd/back-sock/Makefile.in +++ b/servers/slapd/back-sock/Makefile.in @@ -18,9 +18,9 @@ ## in OpenLDAP Software. =20 SRCS =3D init.c config.c opensock.c search.c bind.c unbind.c add.c \ - delete.c modify.c modrdn.c compare.c result.c + delete.c modify.c modrdn.c compare.c result.c extended.c OBJS =3D init.lo config.lo opensock.lo search.lo bind.lo unbind.lo add.l= o \ - delete.lo modify.lo modrdn.lo compare.lo result.lo + delete.lo modify.lo modrdn.lo compare.lo result.lo extended.lo =20 LDAP_INCDIR=3D ../../../include =20 LDAP_LIBDIR=3D ../../../libraries diff --git a/servers/slapd/back-sock/config.c b/servers/slapd/back-sock/c= onfig.c index dc3f1365c..2dcf68bf6 100644 --- a/servers/slapd/back-sock/config.c +++ b/servers/slapd/back-sock/config.c @@ -106,6 +106,7 @@ static ConfigOCs osocs[] =3D { #define SOCK_OP_MODRDN 0x020 #define SOCK_OP_ADD 0x040 #define SOCK_OP_DELETE 0x080 +#define SOCK_OP_EXTENDED 0x100 =20 #define SOCK_REP_RESULT 0x001 #define SOCK_REP_SEARCH 0x002 @@ -127,6 +128,7 @@ static slap_verbmasks ov_ops[] =3D { { BER_BVC("modrdn"), SOCK_OP_MODRDN }, { BER_BVC("add"), SOCK_OP_ADD }, { BER_BVC("delete"), SOCK_OP_DELETE }, + { BER_BVC("extended"), SOCK_OP_EXTENDED }, { BER_BVNULL, 0 } }; =20 @@ -249,7 +251,9 @@ static BI_op_bind *sockfuncs[] =3D { sock_back_modify, sock_back_modrdn, sock_back_add, - sock_back_delete + sock_back_delete, + 0, /* abandon not supported */ + sock_back_extended }; =20 static const int sockopflags[] =3D { @@ -260,7 +264,9 @@ static const int sockopflags[] =3D { SOCK_OP_MODIFY, SOCK_OP_MODRDN, SOCK_OP_ADD, - SOCK_OP_DELETE + SOCK_OP_DELETE, + 0, /* abandon not supported */ + SOCK_OP_EXTENDED }; =20 static int sock_over_op( @@ -283,6 +289,7 @@ static int sock_over_op( case LDAP_REQ_MODRDN: which =3D op_modrdn; break; case LDAP_REQ_ADD: which =3D op_add; break; case LDAP_REQ_DELETE: which =3D op_delete; break; + case LDAP_REQ_EXTENDED: which =3D op_extended; break; default: return SLAP_CB_CONTINUE; } @@ -365,6 +372,7 @@ sock_over_setup() sockover.on_bi.bi_op_modrdn =3D sock_over_op; sockover.on_bi.bi_op_add =3D sock_over_op; sockover.on_bi.bi_op_delete =3D sock_over_op; + sockover.on_bi.bi_extended =3D sock_over_op; sockover.on_response =3D sock_over_response; =20 sockover.on_bi.bi_cf_ocs =3D osocs; diff --git a/servers/slapd/back-sock/extended.c b/servers/slapd/back-sock= /extended.c new file mode 100644 index 000000000..15493ea98 --- /dev/null +++ b/servers/slapd/back-sock/extended.c @@ -0,0 +1,58 @@ +/* extended.c - sock backend extended routines */ +/* $OpenLDAP$ */ +/* This work is part of OpenLDAP Software <http://www.openldap.org/>. + * + * Copyright 2000-2017 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * <http://www.OpenLDAP.org/license.html>. + */ + +#include "portable.h" + +#include <stdio.h> +#include <ac/string.h> + +#include "slap.h" +#include "back-sock.h" + +int +sock_back_extended( Operation *op, SlapReply *rs ) +{ + int rc; + struct sockinfo *si =3D (struct sockinfo *) op->o_bd->be_private; + FILE *fp; + + Debug( LDAP_DEBUG_ARGS, "=3D=3D> sock_back_extended(%s)\n", + op->ore_reqoid.bv_val, op->o_req_dn.bv_val, 0 ); + + if ( (fp =3D opensock( si->si_sockpath )) =3D=3D NULL ) { + send_ldap_error( op, rs, LDAP_OTHER, + "could not open socket" ); + return( -1 ); + } + + /* write out the request to the extended process */ + fprintf( fp, "EXTENDED\n" ); + fprintf( fp, "msgid: %ld\n", (long) op->o_msgid ); + sock_print_conn( fp, op->o_conn, si ); + sock_print_suffixes( fp, op->o_bd ); + fprintf( fp, "oid: %s\n", op->ore_reqoid.bv_val ); + if (op->ore_reqdata) { + fprintf( fp, "valuelen: %lu\n", op->ore_reqdata->bv_len ); + fprintf( fp, "value: %s\n", op->ore_reqdata->bv_val ); + } + fprintf( fp, "\n" ); + + /* read in the results and send them along */ + rc =3D sock_read_and_send_results( op, rs, fp ); + fclose( fp ); + + return( rc ); +} diff --git a/servers/slapd/back-sock/init.c b/servers/slapd/back-sock/ini= t.c index dcfe61a44..92e68782f 100644 --- a/servers/slapd/back-sock/init.c +++ b/servers/slapd/back-sock/init.c @@ -53,7 +53,7 @@ sock_back_initialize( bi->bi_op_delete =3D sock_back_delete; bi->bi_op_abandon =3D 0; =20 - bi->bi_extended =3D 0; + bi->bi_extended =3D sock_back_extended; =20 bi->bi_chk_referrals =3D 0; =20 diff --git a/servers/slapd/back-sock/proto-sock.h b/servers/slapd/back-so= ck/proto-sock.h index fa02ab896..8b3b5f3ef 100644 --- a/servers/slapd/back-sock/proto-sock.h +++ b/servers/slapd/back-sock/proto-sock.h @@ -40,6 +40,8 @@ extern BI_op_modrdn sock_back_modrdn; extern BI_op_add sock_back_add; extern BI_op_delete sock_back_delete; =20 +extern BI_op_extended sock_back_extended; + extern int sock_back_init_cf( BackendInfo *bi ); =20 LDAP_END_DECL --=20 2.14.0 --------------4BA376E6A3936AB8C247B47A--

1 0

(ITS#8714) RFE: Sendout EXTENDED operation message in back-sock
by michael＠stroeder.com 18 Aug '17

18 Aug '17

Full_Name: Michael Str.der Version: master / RE24 OS: irrelevant URL: Submission from: (NULL) (213.240.182.101) back-sock should also send extended operations to external listener. Patch will follow.

1 0

(ITS#8713) Delete slapd-ldbm.5 man page
by quanah＠openldap.org 16 Aug '17

16 Aug '17

Full_Name: Quanah Gibson-Mount Version: HEAD OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) We should delete the stub man page for slapd-ldbm(5) from our repository, as it died with OpenLDAP 2.3.

1 0

Re: (ITS#8712) haproxy
by michael＠stroeder.com 16 Aug '17

16 Aug '17

dup of ITS#8711

1 0

Re: (ITS#8711) haproxy
by michael＠stroeder.com 16 Aug '17

16 Aug '17

This is a cryptographically signed message in MIME format. --------------ms000008090101090902090203 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable marceloandril(a)yahoo.com.br wrote: > Full_Name: marcelo > Version: 2.4.44 > OS: centos 7.2 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (177.69.83.5) >=20 >=20 > Good morning, I'm having a problem using syncrepl by haproxy. The serve= r can not > re-create the database. I am using mdb. 1. The ITS is for reporting bugs to the OpenLDAP team, not for asking usa= ge questions. Please post those to openldap-technical mailing list: https://www.openldap.org/lists/mm/listinfo/openldap-technical 2. I'd recommend against pointing to a HA address in syncrepl config stat= ements. You can have more than one syncrepl statement within a database configuration and= let slapd do the fail-over to another available provider internally. Ciao, Michael. --------------ms000008090101090902090203 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CucwggT9MIID5aADAgECAhBFRleVrRF8X5GwbV0tcLCgMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwOTE2MDcxNjUxWhcNMTkxMjE2MDcxNjUxWjBEMR0wGwYDVQQDDBRtaWNo YWVsQHN0cm9lZGVyLmNvbTEjMCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20w ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChMBt5jtuLXsNQ5U7rBbZit8sknIwz hfaousT3d/fssQ6qZwe9l1yklILSXVMqI7/bxbiqcd3zrz+imdSlZPrFBHGfh04DZHCfss2F RwSswGejqP1qE3hPvZi96wFfOMqenpN+pSXqNJ1OPBCJ8a+8ZEioFKoEj3HkCCXjbmezAgms FuA7aFE9BfjJ2eQKw8B9G8X1FjvOTinYSZ2F+qHpKgywl4HTx0dMnYy+Pwu4DDIHkEaVH+uj K1/ed76WUEH51mX9m2Xu0onfQlSM3me6EvAAZiIDsCEbF9WttRuJbpfCFo0m2uW7BBugS7EG Jro1nRSQVnpJyTFgHb5EGMVVAgMBAAGjggG4MIIBtDAOBgNVHQ8BAf8EBAMCBLAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFh1801TSuxT Nltnv9rOjrZzUUgNMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUF BwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUF BzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYD VR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3Js MB8GA1UdEQQYMBaBFG1pY2hhZWxAc3Ryb2VkZXIuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tLzBHBgNVHSAEQDA+MDwGCysGAQQBgbU3AQIFMC0wKwYIKwYBBQUH AgEWH2h0dHBzOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggEB AKiJ9wpjJeHdEzHDZyqmhn4cHcRj9Ag7ZQK0meq1N3oQ9M1YeVge6vZe20LXojgXsNUQGLSt 1lW2s7fABkL9CF+/RtWznHxlp4YpWX/RgbHBo3uXKNA5JUOjbxQ2+1b1jaTp/FUrSIISAxgd RpeYAODJ0db1x8Q+l66DtIVjj7ktWISdJWE2Opn4QnaRwdj6n35Rul4S2ikUsmxtGrHLpjRR XJqbsGa0RZdJyUKlZ2ZRAoRz4jKHOogQcig937sR5Ut2pGOhrScEhgARY2c8Gs2olRTL3pue mE4vjY0g1Nwr9RzeFwMuasiFh4yD34i6jIRfoNzuLPgydjsJ0grw0akwggXiMIIDyqADAgEC AhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAklMMRYwFAYD VQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0 ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17Ake fMyUGwrQdvwObhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzL A84J6Ws5T4NfXZ0qn4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmC S+kICslYYWgXOMt2xlsSslxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6my Su8j8BWWHpChNNeTrFuhVfrOAyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR 9t4APXGzAgMBAAGjggFkMIIBYDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0 cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEF BQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDAGCCsGAQUFBzAChiRodHRwOi8vYWlh LnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0OBBYEFCSBbDlhvkkPj7cbRivJKLUn SG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMD8GA1UdIAQ4MDYwNAYEVR0g ADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZI hvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh2NCXTq7im61g7F1L IiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw5kG3DN8pd1hS EUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07v29MdhaP v3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Yklue /quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6 UpVDo/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHM zcwk3EV2B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuK KwHNL8F4GGp6jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ 8j6y6S9p0xE/Ga0peVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMYIDzDCCA8gCAQEwgYkw dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx IENsaWVudCBDQQIQRUZXla0RfF+RsG1dLXCwoDANBglghkgBZQMEAgEFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwODE2MTQ1NjE2WjAvBgkq hkiG9w0BCQQxIgQgjUYirXwB1vZ8ZgRUkmA7Vma22C9NdA0dwIExgTvCSPAwbAYJKoZIhvcN AQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3 DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBmgYJKwYB BAGCNxAEMYGMMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkw JwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3Rh cnRDb20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwgZwGCyqGSIb3DQEJ EAILMYGMoIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYD VQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRD b20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwDQYJKoZIhvcNAQEBBQAE ggEACOKnuhh5CM7f4xCZlgoANk4aov5w0qSDFFj5t8MkTa0lD17Ik2/yuVPP1Q3SqYg3pfDX 1RyhQ7cAQpcHjU3p+cjcTh9zHGkNekVzzrHpZn73NpAxJtvnawXQpW4uUQiywp1iBbaFRBPV VePCPXnkLq6uWdh4Ihx/FSBBa1cb0Mt8r+I6xIO/nTrHDDrPvv7KtgKac9KhFanhNDC6xk5t vjGhyXnHuc4vvWUCh7qshPTDWO2rabVGCLaJ0zZA2Q/5Me8WJ5GVEHHCqZqLt0PbP+pQa11B Lxpbrpnjw4alcSVvZ1JCvVbQKeBXYGKvQNYN+J6zzSujIs7I/C4QhPn6rgAAAAAAAA== --------------ms000008090101090902090203--

1 0

(ITS#8712) haproxy
by marceloandril＠yahoo.com.br 16 Aug '17

16 Aug '17

Full_Name: marcelo Version: 2.4.44 OS: centos 7.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (177.69.83.5) Good morning, I'm having a problem using syncrepl by haproxy. The server can not re-create the database. I am using mdb. Log: slapd[22501]: dn_callback : entries have identical CSN slapd[22501]: syncrepl_entry: rid=001 entry unchanged, ignored slapd[22501]: do_syncrep2: rid=001 (-1) Can't contact LDAP server slapd[22501]: do_syncrepl: rid=001 rc -1 retrying

1 0

(ITS#8711) haproxy
by marceloandril＠yahoo.com.br 16 Aug '17

16 Aug '17

Full_Name: marcelo Version: 2.4.44 OS: centos 7.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (177.69.83.5) Good morning, I'm having a problem using syncrepl by haproxy. The server can not re-create the database. I am using mdb. Log: slapd[22501]: dn_callback : entries have identical CSN slapd[22501]: syncrepl_entry: rid=001 entry unchanged, ignored slapd[22501]: do_syncrep2: rid=001 (-1) Can't contact LDAP server slapd[22501]: do_syncrepl: rid=001 rc -1 retrying

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 13 Aug '17

13 Aug '17

On Sat, 12 Aug 2017 02:58:20 +0900, Ryan Tandy wrote: > > I've added slapd.service file. Please check. > > Looks good to me. Thanks again for working on this! :) > > Just minor comments: > > > - $(srcdir)/slapd.conf > slapd.conf.tmp ; \ > > + $(srcdir)/slapd.conf > slapd.conf.tmp || exit $$?; \ > > > - $(srcdir)/slapd.ldif > slapd.ldif.tmp ; \ > > + $(srcdir)/slapd.ldif > slapd.ldif.tmp || exit $$? > > Is there any difference between this and using && instead of ;? (Not asking for any change, I just want to make sure I understand.) In Makefile, /bin/sh is invoked without -e option. > > + if test -n "$(systemdsystemunitdir)"; then \ > > This is echoed while the rest aren't; maybe it could be either appended to the above command, or change to @if. Fixed. Thanks! -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

Re: (ITS#8710) mdb_copy wait for writer to complete
by hyc＠symas.com 11 Aug '17

11 Aug '17

muthukumardce(a)gmail.com wrote: > Full_Name: Muthukumar > Version: LMDB 0.82 > OS: OSX > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (49.207.184.177) > > > # Writer > > ``` > import lmdb > > db_path = "test.db" > DB_MAX_SIZE = 40 * 1000 * 1000 * 1000 > env = lmdb.Environment(db_path, DB_MAX_SIZE, sync=True) > txn = env.begin(write=True, buffers=True) > for i in xrange(5000000): > value = "*" * 100 > txn.put("i="+str(i), value) > txn.commit() > ``` > > I ran the above python program in my machine which took almost 8 secs to > complete. Simultaneously i try to copy the database using mdb_copy, but it > started copying only after the write program completes its execution. > > Please note: First i run the writer program then the mdb_copy, if i start > mdb_copy first it runs smoothly. > > Please help. The ITS is for bug reports, not help requests. Use the openldap-technical mailing list for assistance. The mdb_copy program needs to acquire the DB write mutex before executing, to ensure it gets a consistent snapshot. It obviously can't do that until any other active writer finishes. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8710) mdb_copy wait for writer to complete
by muthukumardce＠gmail.com 11 Aug '17

11 Aug '17

Full_Name: Muthukumar Version: LMDB 0.82 OS: OSX URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (49.207.184.177) # Writer ``` import lmdb db_path = "test.db" DB_MAX_SIZE = 40 * 1000 * 1000 * 1000 env = lmdb.Environment(db_path, DB_MAX_SIZE, sync=True) txn = env.begin(write=True, buffers=True) for i in xrange(5000000): value = "*" * 100 txn.put("i="+str(i), value) txn.commit() ``` I ran the above python program in my machine which took almost 8 secs to complete. Simultaneously i try to copy the database using mdb_copy, but it started copying only after the write program completes its execution. Please note: First i run the writer program then the mdb_copy, if i start mdb_copy first it runs smoothly. Please help.

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 11 Aug '17

11 Aug '17

On Fri, Aug 11, 2017 at 08:10:09PM +0900, SATOH Fumiyasu wrote: >I've added slapd.service file. Please check. Looks good to me. Thanks again for working on this! :) Just minor comments: >- $(srcdir)/slapd.conf > slapd.conf.tmp ; \ >+ $(srcdir)/slapd.conf > slapd.conf.tmp || exit $$?; \ >- $(srcdir)/slapd.ldif > slapd.ldif.tmp ; \ >+ $(srcdir)/slapd.ldif > slapd.ldif.tmp || exit $$? Is there any difference between this and using && instead of ;? (Not asking for any change, I just want to make sure I understand.) >+ if test -n "$(systemdsystemunitdir)"; then \ This is echoed while the rest aren't; maybe it could be either appended to the above command, or change to @if.

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 11 Aug '17

11 Aug '17

Hi, I've added slapd.service file. Please check. * https://github.com/osstech-jp/openldap/pull/4 * https://patch-diff.githubusercontent.com/raw/osstech-jp/openldap/pull/4.pat… On Thu, 10 Aug 2017 19:26:48 +0900, fumiyas wrote: > > > I've revised the patch for master to check if the listener initialization > > > suceeds or not. With this patch, `slapd -d0` can return non-zero exit code > > > if the listener initialization fails, thus systemd can detect slapd.service > > > startup failure. > > > > Nice catch! That change looks correct to me, but I hope Howard will check it too. Actually it's probably relevant for any init system; possibly worth splitting out as its own commit? > > This patch does NOT affect SysV-init system because an init script > for slapd normally does NOT use the -d option. > > > Just checking, do you plan to add the service file and its installation (conditional on enabled systemd support) in this branch as well, or should I work on that myself if I want it? > > Yes, I'll do that later. -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 10 Aug '17

10 Aug '17

On Thu, 10 Aug 2017 02:16:56 +0900, Ryan Tandy wrote: > > I've revised the patch for master to check if the listener initialization > > suceeds or not. With this patch, `slapd -d0` can return non-zero exit code > > if the listener initialization fails, thus systemd can detect slapd.service > > startup failure. > > Nice catch! That change looks correct to me, but I hope Howard will check it too. Actually it's probably relevant for any init system; possibly worth splitting out as its own commit? This patch does NOT affect SysV-init system because an init script for slapd normally does NOT use the -d option. > Just checking, do you plan to add the service file and its installation (conditional on enabled systemd support) in this branch as well, or should I work on that myself if I want it? Yes, I'll do that later. Thank you. -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

(ITS#8709) pw-totp: OpenSSL 1.1 compatibility
by fumiyas＠osstech.co.jp 10 Aug '17

10 Aug '17

Full_Name: SATOH Fumiyasu Version: master OS: URL: Submission from: (NULL) (118.240.43.13) Current contrib/slapd-modules/passwd/totp is not compatible with OpenSSL 1.1+. I've created a patch to fix that. Please see the following patch I post: * https://patch-diff.githubusercontent.com/raw/osstech-jp/openldap/pull/5.pat… * https://github.com/osstech-jp/openldap/pull/5

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 09 Aug '17

09 Aug '17

On Wed, Aug 09, 2017 at 05:13:44PM +0900, SATOH Fumiyasu wrote: >I've revised the patch for master to check if the listener initialization >suceeds or not. With this patch, `slapd -d0` can return non-zero exit code >if the listener initialization fails, thus systemd can detect slapd.service >startup failure. Nice catch! That change looks correct to me, but I hope Howard will check it too. Actually it's probably relevant for any init system; possibly worth splitting out as its own commit? Just checking, do you plan to add the service file and its installation (conditional on enabled systemd support) in this branch as well, or should I work on that myself if I want it? Thanks!

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 09 Aug '17

09 Aug '17

On Tue, 08 Aug 2017 04:23:27 +0900, Ryan Tandy wrote: > > + rc = sd_notifyf( 1, > > + "READY=1\n" > > + "STATUS=slapd: ready to serve connections...\n" > > + "MAINPID=%lu", > > + (unsigned long) getpid() ); > I see you've placed this call later than the parent's exit point. Any comments about the timing of this relative to the parent's exit, and to the listener startup and so on? Are the listeners more likely to be ready to serve connections at this point? I seem to recall that in the past there was opposition to moving the parent's exit later, but I can't remember why. (and I still wish we could do that, and dispense with the ldapsearch-loop hacks...) I've revised the patch for master to check if the listener initialization suceeds or not. With this patch, `slapd -d0` can return non-zero exit code if the listener initialization fails, thus systemd can detect slapd.service startup failure. * https://github.com/osstech-jp/openldap/pull/4 * https://patch-diff.githubusercontent.com/raw/osstech-jp/openldap/pull/4.pat… -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

(ITS#8708) SASL EXTERNAL binds and sasl-secprops minssf
by dhawes＠gmail.com 08 Aug '17

08 Aug '17

Full_Name: David Hawes Version: 2.4.45 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:468:c80:2103:0:523:da5e:da5e) With ITS #8568 [1], I notice that the first SASL EXTERNAL (using TLS client auth) bind on a connection succeeds, but subsequent SASL EXTERNAL binds on the same connection fail with: slapd[31088]: conn=1009 op=3 RESULT tag=97 err=48 text=SASL(-15): mechanism too weak for this user: mech EXTERNAL is too weak when: sasl-secprops minssf=128 In previous OpenLDAP versions, both the initial and subsequent SASL EXTERNAL binds succeed due to the bug in #8568. This was a misconfiguration on my part (I should have kept the default of 0), but I wonder if the initial SASL bind should also fail. It seems to succeed because tls_ssf is used in connection.c: slap_sasl_external( c, c->c_tls_ssf, &authid ); [1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8568;selectid=8568

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 08 Aug '17

08 Aug '17

On Tue, Aug 08, 2017 at 03:10:35PM +0900, SATOH Fumiyasu wrote: >My slapd.service file: > >[Unit] >Description=OpenLDAP Server >After=syslog.target network-online.target >Documentation=man:slapd >Documentation=man:slapd.conf >Documentation=man:slapd-config >Documentation=man:slapd-bdb >Documentation=man:slapd-hdb >Documentation=man:slapd-mdb > >[Service] >Type=notify >ExecStart=%LIBEXECDIR%/slapd -d 0 -h "ldapi:/// ldap:///" > >[Install] >WantedBy=multi-user.target > >Any comment? No comment, looks good to me. :)

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 07 Aug '17

07 Aug '17

Hi, Sorry, I'm not good at English. :-) On Tue, 08 Aug 2017 05:12:02 +0900, Ryan Tandy wrote: > > I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of > > whether we set Type=forking or Type=notify. Not exactly "needed", but better to > > have it than not. > > I experimented a bit with a service file. It seems to work well with either Type=forking and NotifyAccess=all, or Type=notify and ExecStart=slapd -d none. The latter (disabling forking) is definitely what systemd upstream recommends. I think so too. I don't like forking, thus I use "Type=notify" and "ExecStart=slapd -d0 ..." in my slapd.service file. > In either case, MAINPID= didn't actually seem to help anything. Yes. > NotifyAccess=main has a chicken-and-egg problem, because systemd needs to know the main PID in order for us to send it the message containing the PID! :) I think the only reasonable way to leave forking enabled would be to also require a PIDFile= setting, which solves that problem. But I'd rather sidestep the entire thing, omit MAINPID= as well, and > Looking at the systemctl output I still think STATUS= is redundant and could be omitted. > > So I guess my recommendation for the notify call boils down to: > > rc = sd_notify( 1, "READY=1" ); Agreed. I'll fix servers/slapd/daemon.c later. Thank you. > and a slapd.service along the lines of: > > [Unit] > Description=OpenLDAP server > > [Service] > Type=notify > ExecStart=%LIBEXECDIR%/slapd -h 'ldap:/// ldapi:///' -d0 > > [Install] > WantedBy=multi-user.target > > (basically identical to the example in systemd.service(5).) My slapd.service file: [Unit] Description=OpenLDAP Server After=syslog.target network-online.target Documentation=man:slapd Documentation=man:slapd.conf Documentation=man:slapd-config Documentation=man:slapd-bdb Documentation=man:slapd-hdb Documentation=man:slapd-mdb [Service] Type=notify ExecStart=%LIBEXECDIR%/slapd -d 0 -h "ldapi:/// ldap:///" [Install] WantedBy=multi-user.target Any comment? -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 07 Aug '17

07 Aug '17

On Mon, Aug 07, 2017 at 01:12:02PM -0700, Ryan Tandy wrote: >Side note: the version message from slapd appears in the journal >twice, once with the timestamp and once without... not sure exactly >why! Sorry, meant to delete this paragraph before sending. The difference between "-dnone" and "-d0" is precisely an extra log to stderr :)

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 07 Aug '17

07 Aug '17

On Mon, Aug 07, 2017 at 12:23:27PM -0700, Ryan Tandy wrote: >I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of >whether we set Type=forking or Type=notify. Not exactly "needed", but better to >have it than not. I experimented a bit with a service file. It seems to work well with either Type=forking and NotifyAccess=all, or Type=notify and ExecStart=slapd -d none. The latter (disabling forking) is definitely what systemd upstream recommends. In either case, MAINPID= didn't actually seem to help anything. NotifyAccess=main has a chicken-and-egg problem, because systemd needs to know the main PID in order for us to send it the message containing the PID! :) I think the only reasonable way to leave forking enabled would be to also require a PIDFile= setting, which solves that problem. But I'd rather sidestep the entire thing, omit MAINPID= as well, and Looking at the systemctl output I still think STATUS= is redundant and could be omitted. So I guess my recommendation for the notify call boils down to: rc = sd_notify( 1, "READY=1" ); and a slapd.service along the lines of: [Unit] Description=OpenLDAP server [Service] Type=notify ExecStart=%LIBEXECDIR%/slapd -h 'ldap:/// ldapi:///' -d0 [Install] WantedBy=multi-user.target (basically identical to the example in systemd.service(5).) Side note: the version message from slapd appears in the journal twice, once with the timestamp and once without... not sure exactly why!

1 0

Re: (ITS#8707) slapd: Add systemd service notification support
by ryan＠nardis.ca 07 Aug '17

07 Aug '17

On Mon, Aug 07, 2017 at 01:30:44PM +0000, fumiyas(a)osstech.co.jp wrote: >I've created patches for slapd to add systemd service notification >(sd_notify(3)) support. Thanks for working on this! I'm also interested in having this feature. What do you think about including a slapd.service file? I know OpenLDAP has traditionally not included an init script, but systemd units are intended to be distro-agnostic as far as possible, and shipped by upstream projects in most cases, unlike init scripts. Ideally I'd like to include a template in the source and have the build system fill in the autoconf'ed path (i.e. to slapd) and have 'make install' install it to the right place. Autoconf bits look fine to me. >+ rc = sd_notifyf( 1, >+ "READY=1\n" >+ "STATUS=slapd: ready to serve connections...\n" >+ "MAINPID=%lu", >+ (unsigned long) getpid() ); unset_environment=1 seems reasonable, it's a little unfortunate that we can't call (for example) sd_notify("STOPPING=1") afterward, but it feels worthwhile compared to having to sanitize the environment when forking a child process. I'm not sure the STATUS= message adds value compared to just the basic readiness notification; can you comment on why you included it? I guess MAINPID= is actually needed, unless we run slapd with -d, regardless of whether we set Type=forking or Type=notify. Not exactly "needed", but better to have it than not. I see you've placed this call later than the parent's exit point. Any comments about the timing of this relative to the parent's exit, and to the listener startup and so on? Are the listeners more likely to be ready to serve connections at this point? I seem to recall that in the past there was opposition to moving the parent's exit later, but I can't remember why. (and I still wish we could do that, and dispense with the ldapsearch-loop hacks...) cheers, Ryan

1 0

(ITS#8707) slapd: Add systemd service notification support
by fumiyas＠osstech.co.jp 07 Aug '17

07 Aug '17

Full_Name: SATOH Fumiyasu Version: master OS: URL: Submission from: (NULL) (118.240.43.13) I've created patches for slapd to add systemd service notification (sd_notify(3)) support. Please see the following URLs: * Patch for master * https://github.com/osstech-jp/openldap/commit/4313f8685ac3365fe71639d378740… * Patch for 2.4.x (OPENLDAP_REL_ENG_2_4) * https://github.com/osstech-jp/openldap/commit/977d4483470d150839714cece64ae…

1 0

Re: (ITS#8706) illogical return from ldap_search_ext_s()
by hyc＠symas.com 04 Aug '17

04 Aug '17

kurt.w.heberlein(a)hpe.com wrote: > Full_Name: Kurt Heberlein > Version: 2.4.40+patches > OS: Debian Wheezy > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (66.168.54.228) > > > Using simple binding with TLS, i have a successfully bound (authenticated) user, > and using the same LDAP*, i experience intermittent failures attempting to > retrieve the user's memberOf list. The failure manifests itself as a return > from ldap_search_ext_s() with a return code of LDAP_SUCCESS but a NULL results > pointer. > > Most of the time this call correctly returns the list of groups the user is a > member of, but intermittently it returns a NULL list even though the return code > is LDAP_SUCCESS. There is no other error indication. What am i missing? Read RFC 4511. The ITS is for bug reports, not technical questions. There's no bug here. Closing this ITS. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#8706) illogical return from ldap_search_ext_s()
by kurt.w.heberlein＠hpe.com 04 Aug '17

04 Aug '17

Full_Name: Kurt Heberlein Version: 2.4.40+patches OS: Debian Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.168.54.228) Using simple binding with TLS, i have a successfully bound (authenticated) user, and using the same LDAP*, i experience intermittent failures attempting to retrieve the user's memberOf list. The failure manifests itself as a return from ldap_search_ext_s() with a return code of LDAP_SUCCESS but a NULL results pointer. Most of the time this call correctly returns the list of groups the user is a member of, but intermittently it returns a NULL list even though the return code is LDAP_SUCCESS. There is no other error indication. What am i missing? The call looks like this: ret = ldap_search_ext_s(lp, base, scope, filter, attrs, 0, NULL, NULL, NULL, -1, &res); if(ret != LDAP_SUCCESS) { ... } else { assert(res != NULL); for(msg = ldap_first_message(lp, res); msg != NULL; msg = ldap_next_message(lp, msg)) { ... Where lp is the LDAP* pointer of for the successful bind of user base = "DC=EMEA,DC=AD,DC=SOMECOMPANY,DC=COM" scope = LDAP_SCOPE_SUBTREE filter = "(&(objectClass=user)(sAMAccountName=someusername))" attrs = attrs[0] = "memberOf" attrs[0] = NULL i dont find any documentation that indicates that res could be NULL after LDAP_SUCCESS is returned from the search. Thanks

1 0

Re: (ITS#8690) syncprov memory leak
by quanah＠symas.com 03 Aug '17

03 Aug '17

--On Tuesday, August 01, 2017 8:33 PM +0000 quanah(a)symas.com wrote: > With the patch applied, test019 sporadically segfaults after doing a > delete op on an entry. Took me 12/50 iterations with back-mdb, 2/50 > with back-bdb. But just 1/1 on two other occasions, so while it's not > every iteration, it's fairly repeatable. I will work on getting a > backtrace as well. With the current code, test050 sporadically fails (Took me 8/50 iterations): 5983d09b do_syncrep2: rid=012 cookie=rid=012,sid=002,csn=20170804014043.003558Z#000000#003#000000 5983d09b bdb_delete: deleted id=00000018 dn="cn=To be deleted by server 3,dc=example,dc=com" 5983d09b send_ldap_result: conn=-1 op=0 p=0 5983d09b send_ldap_result: err=0 matched="" text="" 5983d09b syncprov_sendresp: to=002, cookie=rid=011,sid=001,csn=20170804014043.003558Z#000000#003#000000 5983d09b => send_search_entry: conn 1012 dn="cn=To be deleted by server 3,dc=example,dc=com" ber_flush2: 175 bytes to sd 26 5983d09b <= send_search_entry: conn 1012 exit. 5983d09b slap_graduate_commit_csn: removing 0x7f93ac113800 20170804014043.003558Z#000000#003#000000 5983d09b syncrepl_entry: rid=013 be_delete cn=To be deleted by server 3,dc=example,dc=com (0) 5983d09b slap_queue_csn: queueing 0x7f93ac107860 20170804014043.003558Z#000000#003#000000 5983d09b bdb_modify: dc=example,dc=com 5983d09b bdb_modify: txn1 id: 8000004e 5983d09b bdb_dn2entry("dc=example,dc=com") 5983d09b bdb_modify: txn2 id: 8000004f 5983d09b bdb_modify_internal: 0x00000001: dc=example,dc=com 5983d09b bdb_modify_internal: replace contextCSN 5983d09b => entry_encode(0x00000001): dc=example,dc=com 5983d09b <= entry_encode(0x00000001): dc=example,dc=com 5983d09b syncprov_sendresp: to=004, cookie=rid=011,sid=001,csn= 5983d09b slap_build_sync_ctrl: ber_flatten2 failed (-1) 5983d09b send_ldap_result: conn=1013 op=1 p=3 5983d09b send_ldap_result: err=80 matched="" text="internal error" 5983d09b send_ldap_response: msgid=2 tag=101 err=80 ber_flush2: 146 bytes to sd 30 5983d09b conn=1013 op=1 SEARCH RESULT tag=101 err=80 duration=-1427710511.244ms nentries=0 text=internal error Aug 3 18:40:43 ub16 kernel: [42374.949965] slapd[30897]: segfault at 8000004e ip 00007f93bccb5cc0 sp 00007f93ba1aaa10 error 4 in libc-2.23.so[7f93bcc67000+1c0000] --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8705) Windows registry key creation incorrect
by quanah＠openldap.org 02 Aug '17

02 Aug '17

Full_Name: Quanah Gibson-Mount Version: 2.4.45 OS: Windows 10 64-bit URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.239) When installing OpenLDAP on windows, it creates a registry key for the Eventlog to map startup/shutdown events. There was an attempt to fix the problem with the key value back in 2003, 6e8adce9d94ffff125d6acce669c35245d73d0df. However, the fix is incorrect. Without 6e8adce9d94ffff125d6acce669c35245d73d0df, the key value is set to (on a 64-bit install): "C:\Program Files\OpenLDAP\slapd.exe service" With 6e8adce9d94ffff125d6acce669c35245d73d0df, the key value is set to (on a 64-bit install): "C:\Program" The value that works is: "C:\Program Files\OpenLDAP\slapd.exe" The goal of 6e8adce9d94ffff125d6acce669c35245d73d0df was to strip of " service", but since it simply parses on a single space, if the install path has a space elsewhere in it, you end up with the incorrect value noted above.

1 0

Re: (ITS#8701) account usability control for password less logins
by benjamin.chang＠oracle.com 02 Aug '17

02 Aug '17

Question about a proposed workaround: Would it be possible to use slapo-ppolicy to set the pwdPolicySubentry attribute for each user to provide the desired 1.3.6.1.4.1.42.2.27.9.5.8 control response (see http://ldapwiki.com/wiki/Account%20Usability%20Request%20Control), i.e., can pwdPolicySubentry be used supply the sub-entry and related operational attributes needed to validate users for password-less logins?

1 0

Re: (ITS#8690) syncprov memory leak
by quanah＠symas.com 01 Aug '17

01 Aug '17

--On Tuesday, July 11, 2017 9:17 PM +0000 quanah(a)symas.com wrote: > --On Tuesday, July 11, 2017 1:25 AM +0000 quanah(a)openldap.org wrote: > >> Full_Name: Quanah Gibson-Mount >> Version: 2.4.45 >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (47.208.148.239) With the patch applied, test019 sporadically segfaults after doing a delete op on an entry. Took me 12/50 iterations with back-mdb, 2/50 with back-bdb. But just 1/1 on two other occasions, so while it's not every iteration, it's fairly repeatable. I will work on getting a backtrace as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8702) SLAPD_MAX_DAEMON_THREADS is too small
by quanah＠symas.com 01 Aug '17

01 Aug '17

--On Friday, July 28, 2017 5:56 PM +0000 hyc(a)openldap.org wrote: > Was benchmarking on an Oracle M8 box with 2048 SPARC VCPUs. With 1024 > slapd threads configured, we needed 64 listener threads and 64 > threadqueues to eliminate slapd bottlenecks, but the current default in > daemon.c only allows up to 16 listener threads. > > It's a #ifndef so easily overridable at compile time, but 16 is probably > too small in this age of processors with more and more cores. It would be nice if instead of something hard coded, it was instead configurable by switching its usage to dynamically allocated arrays. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8704) LMDB add option to use prev meta page
by hyc＠openldap.org 31 Jul '17

31 Jul '17

Full_Name: Howard Chu Version: LMDB 0.9 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.136.45.220) Submitted by: hyc Generally, running LMDB in NOSYNC mode means all integrity guarantees are gone, in even of a system crash. However, if some other thread runs mdb_env_sync periodically it's possible that the older DB state is still consistent, even if slightly out of date. I have always intended to add an env flag for using the older meta page, to potentially access a DB even after the latest txn snapshot was corrupted. A patch for this has been contributed, although support in the command-line tools still needs to be added.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs