- openldap-bugs - openldap.org

Re: (ITS#8485) [PATCH] Adding support for encrypted server private keys
by hyc＠symas.com 22 Feb '17

22 Feb '17

ahnolds(a)gmail.com wrote: > Full_Name: Alec Cooper > Version: HEAD of master branch > OS: Ubuntu Linux 16.04 > URL: ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch > Submission from: (NULL) (73.134.243.211) > > > Adding support for encrypted server private keys. Thank you for your submission. I must compliment you on providing such a comprehensive and well-written contribution. Unfortunately the feature itself is clearly not useful. Perhaps you should have raised this topic on the openldap-devel list for discussion before spending your time writing it. All your feature does is embed the encryption key in the filesystem, so an encrypted private key is still no more secure than an unencrypted one. It still just depends on setting proper file access permissions, and the current documentation already makes that point. Indeed, all it does is give the false illusion of enhancing security, and followups like balmerpeak92(a)gmail.com's shows that people will easily fall for such illusions. I regret having to reject such a well written contribution, but we cannot in good conscience accept a security feature that doesn't actually improve security. > > The meat of this patch is changes to tls2.c, tls_g.c, tls_m.c, and tls_o.c to > send a password to the underlying TLS library. > > Changes to ldap.h, init.c and ldap-int.h expose the new > LDAP_OPT_X_TLS_KEYPASSWORD in the main API. > > Changes in the contrib/ldapc++ directory expose the corresponding > TlsOptions::KEYPASSWORD option in the C++ API. > > Changes in the servers directory expose equivalent options for servers as > configuration file entries or environment variables. > > Changes in the doc directory add documentation about the new options and remove > statements that indicated that encrypted keyfiles are not supported. > > New files in the test directory are for testing TLS connections, both in general > and with encrypted keyfiles. Tests pass for OpenSSL and GnuTLS using PEM > formatted certs and keys, and for MozNSS using cert/key databases. The new unit > test (test065-tls) has been written to detect when using NSS, and use the > cert/key databases in this case. I have been unable to get a working version of > libnsspem, so I cannot test MozNSS with (or without) encrypted keyfiles - > testing for this case would be welcome! > > Notice of origin: The attached patch file is derived from OpenLDAP Software. All > of the modifications to OpenLDAP Software represented in the following patch > were developed by Alec Cooper ahnolds(a)gmail.com. I have not assigned rights > and/or interest in this work to any party. > Rights statement: I, Alec Cooper, hereby place the following modifications to > OpenLDAP Software (and only these modifications) into the public domain. Hence, > these modifications may be freely used and/or redistributed for any purpose with > or without attribution and/or other notice. > > The patch has been uploaded to the OpenLDAP FTP server and can be found at > ftp://ftp.openldap.org/incoming/Alec-Cooper-160827.patch > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8574) bconfig support for DNs that need escaping
by hyc＠symas.com 22 Feb '17

22 Feb '17

okuznik(a)symas.com wrote: > Full_Name: Ondrej Kuznik > Version: master > OS: > URL: ftp://ftp.openldap.org/incoming/Ondrej-Kuznik-20170125-Deal-with-rDN-correc… > Submission from: (NULL) (151.228.185.198) > > > When an rdn under cn=config needs escaping, incorrect value gets passed to the > attribute and, if the attribute is single-value, the entry is rejected by > entry_naming_check(). > > Patch against master is attached. Why are you running the normalizer in a for-loop: + for ( cnt = 0; rDN[cnt]; cnt++ ) { but always setting value #0? + free( a->a_vals[0].bv_val ); + ber_dupbv( &a->a_vals[0], &ava->la_value ); If the RDN is actually a compound with multiple AVAs you need to concatenate them into a single value. Otherwise, if you don't intend to support compound RDNs, there's no point in using a for-loop. Just return an error if there's more than one AVA. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8592) Double free in sssvlv.c
by kevinanties＠gmail.com 22 Feb '17

22 Feb '17

--f403045e36642e33f305491978d4 Content-Type: text/plain; charset=UTF-8 Sorry for that. ftp://ftp.openldap.org/incoming/kevin-170221-sssvlv.patch The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by YW. YW has not assigned rights and/or interest in this work to any party. I, Kevin, am authorized by YW, my employer, to release this work under the following terms. YW hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. On Wed, Feb 22, 2017 at 12:09 AM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Tuesday, February 21, 2017 4:20 AM +0000 kevinanties(a)gmail.com wrote: > > --f403045e3462d25e8f054902b3a3 >> Content-Type: text/plain; charset=UTF-8 >> >> I have submitted to ftp/incoming. The filename is >> kevin-170221-sssvlv.patch. >> > > Please carefully read the contribution web page. Your submission is > clearly missing the IPR notice: > > <http://www.openldap.org/devel/contributing.html#notice> > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > --f403045e36642e33f305491978d4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Sorry for that.<br><br><pre><a rel=3D"nofollow" href=3D"ft= p://ftp.openldap.org/incoming/kevin-170221-sssvlv.patch">ftp://ftp.openldap= .org/incoming/kevin-170221-sssvlv.patch</a></pre><br><font face=3D"Arial,Ve= rdana,Helvetica">The attached file is derived from OpenLDAP Software. All o= f the modifications to OpenLDAP Software represented in the following patch= (es) were developed by YW. YW has not assigned rights and/or interest in th= is work to any party. I, Kevin, am authorized by YW, my employer, to releas= e this work under the following terms. <br></font><font face=3D"Arial,Verda= na,Helvetica"><br>YW hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice. </font><br><br><br></div><div class=3D"gmail_extra"><br><div class=3D"gmail= _quote">On Wed, Feb 22, 2017 at 12:09 AM, Quanah Gibson-Mount <span dir=3D"= ltr"><<a href=3D"mailto:quanah@symas.com" target=3D"_blank">quanah@symas= .com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"ma= rgin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">--On Tuesday, = February 21, 2017 4:20 AM +0000 <a href=3D"mailto:kevinanties@gmail.com" ta= rget=3D"_blank">kevinanties(a)gmail.com</a> wrote:<br> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> --f403045e3462d25e8f054902b3a3<br> Content-Type: text/plain; charset=3DUTF-8<span class=3D""><br> <br> I have submitted to ftp/incoming. The filename is<br> kevin-170221-sssvlv.patch.<br> </span></blockquote> <br> Please carefully read the contribution web page.=C2=A0 Your submission is c= learly missing the IPR notice:<br> <br> <<a href=3D"http://www.openldap.org/devel/contributing.html#notice" rel= =3D"noreferrer" target=3D"_blank">http://www.openldap.org/devel<wbr>/contri= buting.html#notice</a>><div class=3D"HOEnZb"><div class=3D"h5"><br> <br> Regards,<br> Quanah<br> <br> --<br> <br> Quanah Gibson-Mount<br> Product Architect<br> Symas Corporation<br> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:<br> <<a href=3D"http://www.symas.com" rel=3D"noreferrer" target=3D"_blank">h= ttp://www.symas.com</a>><br> <br> </div></div></blockquote></div><br></div> --f403045e36642e33f305491978d4--

1 0

Re: (ITS#8592) Double free in sssvlv.c
by quanah＠symas.com 21 Feb '17

21 Feb '17

--On Tuesday, February 21, 2017 4:20 AM +0000 kevinanties(a)gmail.com wrote: > --f403045e3462d25e8f054902b3a3 > Content-Type: text/plain; charset=UTF-8 > > I have submitted to ftp/incoming. The filename is > kevin-170221-sssvlv.patch. Please carefully read the contribution web page. Your submission is clearly missing the IPR notice: <http://www.openldap.org/devel/contributing.html#notice> Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8592) Double free in sssvlv.c
by kevinanties＠gmail.com 21 Feb '17

21 Feb '17

--f403045e3462d25e8f054902b3a3 Content-Type: text/plain; charset=UTF-8 I have submitted to ftp/incoming. The filename is kevin-170221-sssvlv.patch. On Tue, Feb 21, 2017 at 12:25 AM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, February 20, 2017 7:45 AM +0000 kevinanties(a)gmail.com wrote: > > > I have fixed this problem by adding one boolean flag to sort_op struct to >> indicate whether this is occupied or not . >> >> What is the best way to submit my patch? >> > > Hi Kevin, > > Submission requiresments are documented at <http://www.openldap.org/devel > /contributing.html> > > Regards, > > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > --f403045e3462d25e8f054902b3a3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I have submitted to ftp/incoming. The filename is kevin-17= 0221-sssvlv.patch.=C2=A0 <br></div><div class=3D"gmail_extra"><br><div clas= s=3D"gmail_quote">On Tue, Feb 21, 2017 at 12:25 AM, Quanah Gibson-Mount <sp= an dir=3D"ltr"><<a href=3D"mailto:quanah@symas.com" target=3D"_blank">qu= anah(a)symas.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" s= tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><spa= n class=3D"">--On Monday, February 20, 2017 7:45 AM +0000 <a href=3D"mailto= :kevinanties@gmail.com" target=3D"_blank">kevinanties(a)gmail.com</a> wrote:<= br> <br> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> I have fixed this problem by adding one boolean flag to sort_op struct to<b= r> indicate whether this is occupied or not .<br> <br> What is the best way to submit my patch?<br> </blockquote> <br></span> Hi Kevin,<br> <br> Submission requiresments are documented at <<a href=3D"http://www.openld= ap.org/devel/contributing.html" rel=3D"noreferrer" target=3D"_blank">http:/= /www.openldap.org/devel<wbr>/contributing.html</a>><br> <br> Regards,<div class=3D"HOEnZb"><div class=3D"h5"><br> Quanah<br> <br> --<br> <br> Quanah Gibson-Mount<br> Product Architect<br> Symas Corporation<br> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:<br> <<a href=3D"http://www.symas.com" rel=3D"noreferrer" target=3D"_blank">h= ttp://www.symas.com</a>><br> <br> </div></div></blockquote></div><br></div> --f403045e3462d25e8f054902b3a3--

1 0

Re: (ITS#8592) Double free in sssvlv.c
by quanah＠symas.com 20 Feb '17

20 Feb '17

--On Monday, February 20, 2017 7:45 AM +0000 kevinanties(a)gmail.com wrote: > I have fixed this problem by adding one boolean flag to sort_op struct to > indicate whether this is occupied or not . > > What is the best way to submit my patch? Hi Kevin, Submission requiresments are documented at <http://www.openldap.org/devel/contributing.html> Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8603) [PATCH] adds ldif_open_mem()
by brett＠gladserv.com 20 Feb '17

20 Feb '17

Full_Name: Brett Sheffield Version: master OS: Gentoo GNU/Linux URL: http://www.brettsheffield.com/patches/openldap/brett-sheffield-170220-ldif_… Submission from: (NULL) (2001:470:6e0d:0:96de:80ff:fe2d:3aa9) Patch[0] to add ldif_open_mem() function to ldif API. ldif_open_mem() is the fmemopen(3) equivalent of ldif_open() which opens an ldif steam from memory, rather than from a file. I originally added a similar function to my project libgladdb in 2014[1], but it really belongs in openldap itself as it is generally useful. The attached modifications to OpenLDAP Software are subject to the following notice: Copyright 2014, 2017 Brett Sheffield Redistribution and use in source and binary forms, with or without modification, are permitted only as authorized by the OpenLDAP Public License. [0] http://www.brettsheffield.com/patches/openldap/brett-sheffield-170220-ldif_… [1] https://github.com/brettsheffield/gladdb/blob/master/src/ldif.c

1 0

Re: (ITS#8592) Double free in sssvlv.c
by kevinanties＠gmail.com 20 Feb '17

20 Feb '17

--f403045d9e2209c2250548f17338 Content-Type: text/plain; charset=UTF-8 I have found the cause of the problem. This bug is hard to reproduce unless we make some change to the source codes. (e.g put sleep(1) to send_result function of sssvlv.c) illustrate steps: 1. A client sends two requests with "server side sort" control flag to search some entries. 2. The server dispatches two threads (A and B) to handle. 3. Thread A allocate the "so" struct and puts the "so" pointer to the static array, sort_conns. 4. Thread A can not find any entry. free_sort_op is going to call at the end of send_result function. 5. At the same time, before free_sort_op is called, Thread B acquires the "so" pointer in sssvlv_op_search. It is because the ps_cookie is always zero for new initialized "so" . 6. free_sort_op is called at Thread A. 7. For thread B, due to op->o_conn->c_pagedresults_state.ps_cookie != ps->ps_cookie, ok become 0. 8. free_sort_op is called at Thread B. Double free error occurs. Server dead. This bug will cause all slpad server to dead if the sssvlv overlay is enabled. I have fixed this problem by adding one boolean flag to sort_op struct to indicate whether this is occupied or not . What is the best way to submit my patch? On Sat, Feb 18, 2017 at 2:02 AM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, February 16, 2017 5:06 AM +0000 kevinanties(a)gmail.com > wrote: > > Full_Name: Kevin >> Version: 2.40 >> OS: Debian 7 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (218.188.214.98) >> > > Please do not file new ITSes for existing issue. Please follow up to the > original ITS with your additional information. > > Thanks. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > --f403045d9e2209c2250548f17338 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div><br></div><div>I have found the cause of the problem.= This bug is hard to reproduce unless we make some change to the source cod= es. (e.g=C2=A0 put sleep(1) to send_result function of sssvlv.c)<br><br>ill= ustrate steps:<br></div><div><br></div><div>1. A client sends two requests = with "server side sort" control flag to search some entries. <br>= <br></div><div>2. The server dispatches two threads (A and B) to handle.<br= ><br></div><div>3. Thread A allocate the "so" struct and puts the= "so" pointer to the static array, sort_conns.<br></div><div><br>= </div><div>4. Thread A can not find any entry.=C2=A0 <span class=3D"gmail-p= l-en">free_sort_op is going to call at the end of send_result function.<br>= <br></span></div><div><span class=3D"gmail-pl-en">5. At the same time, befo= re </span><span class=3D"gmail-pl-en">free_sort_op is called, Thread B acqu= ires the "so" pointer in sssvlv_op_search. It is because the ps_c= ookie is always zero for new initialized "so" .<br></span></div><= div><br></div><div>6. <span class=3D"gmail-pl-en">free_sort_op is called a= t </span>Thread A.<br><br></div><div>7. For thread B, due to op->o_conn-= >c_pagedresults_state.<span class=3D"gmail-pl-smi">ps_cookie !=3D ps-&gt= ;ps_cookie, ok become 0.<br><br>8. </span><span class=3D"gmail-pl-en">free_= sort_op is called at </span>Thread B. Double free error occurs. Server dead= .<br><br></div><div>This bug will cause all slpad server to dead if the sss= vlv overlay is enabled.<br><br></div><div>I have fixed this problem by addi= ng one boolean flag to sort_op struct to indicate whether this is occupied = or not . <br><br>What is the best way to submit my patch?<br></div><div><br= ></div><div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Sa= t, Feb 18, 2017 at 2:02 AM, Quanah Gibson-Mount <span dir=3D"ltr"><<a hr= ef=3D"mailto:quanah@symas.com" target=3D"_blank">quanah(a)symas.com</a>></= span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">--On Thur= sday, February 16, 2017 5:06 AM +0000 <a href=3D"mailto:kevinanties@gmail.c= om" target=3D"_blank">kevinanties(a)gmail.com</a> wrote:<br> <br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-= left:1px solid rgb(204,204,204);padding-left:1ex"> Full_Name: Kevin<br> Version: 2.40<br> OS: Debian 7<br> URL: <a href=3D"ftp://ftp.openldap.org/incoming/" rel=3D"noreferrer" target= =3D"_blank">ftp://ftp.openldap.org/incomin<wbr>g/</a><br> Submission from: (NULL) (218.188.214.98)<br> </blockquote> <br> Please do not file new ITSes for existing issue.=C2=A0 Please follow up to = the original ITS with your additional information.<br> <br> Thanks.<br> <br> --Quanah<br> <br> <br> --<br> <br> Quanah Gibson-Mount<br> Product Architect<br> Symas Corporation<br> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:<br> <<a href=3D"http://www.symas.com" rel=3D"noreferrer" target=3D"_blank">h= ttp://www.symas.com</a>><br> <br> </blockquote></div><br></div></div></div> --f403045d9e2209c2250548f17338--

1 0

Re: (ITS#8593) test039 deadlocks
by quanah＠symas.com 17 Feb '17

17 Feb '17

--On Friday, February 17, 2017 5:53 PM +0000 quanah(a)openldap.org wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.4.44 > OS: Solaris 10 > URL: ftp://ftp.openldap.org/incoming/test039-solaris-testrun.tgz > Submission from: (NULL) (47.208.148.26) Howard notes this is common behavior on Solaris because it has too few file descriptors with which to run the test suite. One needs to raise the FD limit prior to executing the tests. Default from ulimit -n shows 256 Should raise it to something reasonable like 1024 prior to execution --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: (ITS#8592) Double free in sssvlv.c
by quanah＠symas.com 17 Feb '17

17 Feb '17

--On Thursday, February 16, 2017 5:06 AM +0000 kevinanties(a)gmail.com wrote: > Full_Name: Kevin > Version: 2.40 > OS: Debian 7 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (218.188.214.98) Please do not file new ITSes for existing issue. Please follow up to the original ITS with your additional information. Thanks. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8593) test039 deadlocks
by quanah＠openldap.org 17 Feb '17

17 Feb '17

Full_Name: Quanah Gibson-Mount Version: 2.4.44 OS: Solaris 10 URL: ftp://ftp.openldap.org/incoming/test039-solaris-testrun.tgz Submission from: (NULL) (47.208.148.26) SunOS unknown 5.10 Generic_147148-26 i86pc i386 i86pc test039 sporadically locks up when running on Solaris 10. It took my system some 150 or so passes to trigger. On another system, it took only 16, so YMMV. What I see from the logs in the testrun is that slapd.3.log sends a response, and then halts: 58a723cf <<< dnPrettyNormal: <cn=All Staff,ou=Groups,o=Example,c=US>, <cn=all staff,ou=groups,o=example,c=us> 58a723cf => send_search_entry: conn 1003 dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=Example,c=US" slapd.2.log shows that the last thing it did was send a result, and then all the open connections to it from slapd-mtester timed out: 58a723cf send_ldap_result: conn=1008 op=15 p=3 58a723cf send_ldap_result: r=3D0 matched="" text="" 58a723cf send_ldap_response: msgid=16 tag=101 err=0 ber_flush2: 14 bytes to sd 24 58a723cf conn=1008 op=15 SEARCH RESULT tag=101 err=0 duration=0.298ms nentries=0 text= 58a723d5 connection_close: conn=1002 sd=15 58a723d5 conn=1002 fd=15 closed (idletimeout) 58a723d5 connection_close: conn=1003 sd=19 58a723d5 conn=1003 fd=19 closed (idletimeout) 58a723d5 connection_close: conn=1004 sd=20 (etc) slapd.1.log Also shows the last thing it did was return a result: 58a723cf bdb_search_candidates: id=1 first=9 last=9 58a723cf => send_search_entry: conn 1005 dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" ber_flush2: 704 bytes to sd 22 58a723cf <= send_search_entry: conn 1005 exit. 58a723cf send_ldap_result: conn=1005 op=20 p=3 58a723cf send_ldap_result: err=0 matched="" text="" 58a723cf send_ldap_response: msgid=21 tag=101 err=0 ber_flush2: 14 bytes to sd 22 58a723cf conn=1005 op=20 SEARCH RESULT tag=101 err=0 duration=0.300ms nentries=1 text= A tarfile with full backtraces on all slapd and tester programs has been uploaded to the FTP server

1 0

(ITS#8592) Double free in sssvlv.c
by kevinanties＠gmail.com 16 Feb '17

16 Feb '17

Full_Name: Kevin Version: 2.40 OS: Debian 7 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (218.188.214.98) This bug was reported but still havent been fixed in recent version. See (ITS#8368). Link: http://www.openldap.org/lists/openldap-bugs/201602/msg00005.html When one of my outlook client sends an email with more than 300 recipients, the slapd server crashes. The problem is caused by double free_sort_op function called in sssvlv.c. In my scenarios, the sssvlv_op_search function will call free_sort_op at line 955. However, the so pointer has already freed by the preivous free_sort_op call at send_result function at line 706. I guess there is a chance the so pointer can be occupied at sssvlv_op_search before the send_result get completed. Here is my gdb result: I set two break points. One is free_sort_op and the other one is send_result. It is clearly show that the free_sort_op was called twice . One is from send_result and the other is sssvlv_op_search. Breakpoint 2, send_result (op=op@entry=0x7fffdc0028e0, rs=rs@entry=0x7fffea8baae0, so=so@entry=0x7fffdc002670) at sssvlv.c:682 58a52415 conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Breakpoint 1, free_sort_op (so=0x7fffdc002670, conn=<optimized out>) at sssvlv.c:396 396 in sssvlv.c Breakpoint 1, free_sort_op (so=0x7fffdc002670, conn=<optimized out>) at sssvlv.c:396 396 in sssvlv.c Program received signal SIGABRT, Aborted. 0x00007ffff6628067 in raise () from /lib/x86_64-linux-gnu/libc.so.6 (gdb) backtrace #0 0x00007ffff6628067 in raise () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007ffff6629448 in abort () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007ffff66661b4 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007ffff666b98e in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00007ffff666c696 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #5 0000007ffff4381abb in free_sort_op (so=0x7fffdc002670, conn=<optimized out>) at sssvlv.c:406 #6 0x00007ffff43825ad in sssvlv_op_search (op=0x7fffd8000ae0, rs=0x7fffe3ffeae0) at sssvlv.c:954 #7 0x00000000004a324a in overlay_op_walk () #8 0x00000000004a33b5 in ?? () #9 0x000000000043fa01 in fe_op_search () #10 0x000000000043f39c in do_search () #11 0x000000000043d1c5 in ?? () #12 0x000000000043d4ae in ?? () #13 0x0000000000527c18 in ?? () #14 0x00007ffff69a6064 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #15 0x00007ffff66db62d in clone () from /lib/x86_64-linux-gnu/libc.so.6

1 0

(ITS#8591) segmentation fault when loading SampleLDAP.pl
by hark＠puscii.nl 15 Feb '17

15 Feb '17

Full_Name: hark Version: commit 9773f43b11aa8fac51407694bbdcd17830f206d5 OS: debian 9.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.169.146.71) openldap is build with: CFLAGS='-g' ./configure --enable-debug --enable-perl --enable-modules --enable-passwd LTCFLAGS='-g' export LTCFLAGS make depend make mkdir /root/openldapdebug/ make install STRIP='' DESTDIR='/root/openldapdebug' started with: gdb --args /root/openldapdebug/usr/local/libexec/slapd -d1 -h "ldap:/// ldapi:///var/run/slapd/ldapi" -F /etc/ldap/slapd.d then when trying to do: ldapadd -x -w $PW -D cn=admin,cn=config -H ldap:"F2F -f /root/src/ldapcrash/slapd-add-perl.ldif cat slapd-add-perl.ldif dn: olcDatabase=perl,cn=config objectClass: olcDatabaseConfig objectClass: olcDbPerlConfig olcDatabase: perl olcSuffix: dc=perl-example,dc=com olcPerlModulePath: /root/src/perlldap/ olcPerlModule: SampleLDAP olcPerlFilterSearchResults: FALSE #olcPerlModuleConfig: something dn: dc=perl-example,dc=com objectClass: top objectClass: dcObject objectClass: organizationalUnit dc: perl-example ou: perl-example-ou it crashes: 58a4ca92 >>> dnNormalize: <olcDatabase={2}perl> 58a4ca92 <<< dnNormalize: <olcDatabase={2}perl> 58a4ca92 >>> dnPrettyNormal: <dc=perl-example,dc=com> 58a4ca92 <<< dnPrettyNormal: <dc=perl-example,dc=com>, <dc=perl-example,dc=com> 58a4ca92 perl backend db init Thread 3 "slapd" received signal SIGSEGV, Segmentation fault. [Switching to LWP 7204] 0x00006a7b721f64f3 in ?? () (gdb) bt #0 0x00006a7b721f64f3 in ?? () #1 0x00006a7b721a23af in ?? () #2 0x000003ad6f16fd18 in ?? () #3 0x000003ad6f16fd48 in ?? () #4 0x000003ad00000018 in ?? () #5 0x00006a7b2d663930 in ?? () #6 0x00006a7b2d6638c0 in ?? () #7 0xb0ac74c0fb38d600 in ?? () #8 0x000003ad6f16fd48 in ?? () #9 0x000003ad6f16fd48 in ?? () #10 0x0000000000000000 in ?? () When trying that multiple times, the backtraces are different: Thread 3 "slapd" received signal SIGSEGV, Segmentation fault. [Switching to LWP 7258] 0x00007cd6f62984f3 in ?? () (gdb) bt #0 0x00007cd6f62984f3 in ?? () #1 0x00007cd6f62443af in ?? () #2 0x00000229299536c8 in ?? () #3 0x00000229299536f8 in ?? () #4 0x0000022900000018 in ?? () #5 0x00007cd6b16e4930 in ?? () #6 0x00007cd6b16e48c0 in ?? () #7 0x5c084850684a2100 in ?? () #8 0x00000229299536f8 in ?? () #9 0x00000229299536fin % ?? () #10 0x0000000000000000 in ?? () [Switching to LWP 7270] 0x00006adbabc534f3 in ?? () (gdb) bt #0 0x00006adbabc534f3 in ?? () #1 0x00006adbabbff3af in ?? () #2 0x00000442aef9d2c8 in ?? () #3 0x00000442aef9d2f8 in ?? () #4 0x0000044200000018 in ?? () #5 0x00006adb670f3930 in ?? () #6 0x00006adb670f38c0 in ?? () #7 0x918aaeeca7964a00 in ?? () #8 0x00000442aef9d2f8 in ?? () #9 0x00000442aef9d2f8 in ?? () #10 0x0000000000000000 in ?? () perl --version This is perl 5, version 24, subversion 1 (v5.24.1) built for x86_64-linux-gnu-thread-multi (with 63 registered patches, see perl -V for more detail)

1 0

(ITS#8590) LMDB: Suppress SIGPIPE in mdb_env_copythr on OS X
by lmb＠cloudflare.com 15 Feb '17

15 Feb '17

Full_Name: Lorenz Bauer Version: mdb.master OS: OS X URL: https://gist.github.com/lmb/a35e7b9566fa79e7bf971ac21bbb9efb Submission from: (NULL) (2a06:98c0:1000:8200:b860:273:d664:7f97) It seems like OS X is not standards compliant wrt SIGPIPE, which breaks mdb_env_copyfd1. On mdb.master, I can see the following behaviour on OS X 10.11: (gdb) r Starting program: /Users/lorenz/dev/openldap/libraries/liblmdb/mtest8 returning Broken pipe[Inferior 1 (process 6180) exited with code 040] (gdb) r Starting program: /Users/lorenz/dev/openldap/libraries/liblmdb/mtest8 returning Broken pipe[Inferior 1 (process 6182) exited with code 040] (gdb) r Starting program: /Users/lorenz/dev/openldap/libraries/liblmdb/mtest8 [New Thread 0x1513 of process 6184] Thread 1 received signal SIGPIPE, Broken pipe. 0x00007fff91eb7db6 in __psynch_cvwait () from /usr/lib/system/libsystem_kernel.dylib (gdb) info th Id Target Id Frame * 1 Thread 0x1323 of process 6184 0x00007fff91eb7db6 in __psynch_cvwait () from /usr/lib/system/libsystem_kernel.dylib 2 Thread 0x1513 of process 6184 0x00007fff91eb83c2 in __sigwait () from /usr/lib/system/libsystem_kernel.dylib mtest8 creates a pipe, closes one end and then calls mdb_env_copyfd2 with CP_COMPACT. Apparently OS X delivers the signal to the entire process. It seems like the sigwait in the current code sometimes races the notification, and therefore prevents SIGPIPE. I found an OS X specific fcntl which fixes this issue. I've attached a patch. The attached file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Cloudflare, Inc. Cloudflare, Inc. has not assigned rights and/or interest in this work to any party. I, Lorenz Bauer am authorized by Cloudflare, Inc., my employer, to release this work under the following terms. Cloudflare, Inc. hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#8589) cn=config replication plus DB replication can break replication
by quanah＠openldap.org 15 Feb '17

15 Feb '17

Full_Name: Quanah Gibson-Mount Version: 2.4.44 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.26) Test059 can expose an interesting bug in OpenLDAP when replication is configured for both cn=config and an underlying data DB. I wouldn't call it a critical issue for this scenario, but it's possible it could be critical in other scenarios I'm not aware of. The basic problem breaks down like this: a) A modification to the schema is made in cn=config b) An entry is added or modified to the data DB that makes use of the new schema changes The majority of the time, this is not an issue, as the change to the schema gets replicated /before/ the change to the entry is honored. However, if the modification to the entry is done *before* the schema changes get replicated, the following happens: a) The replica pauses cn=config replication b) The replica attempts to replicate the changed entry c) The replica fails to replicate the change due to the fact the schema is not yet updated d) The replica goes into an endless REFRESH loop Because cn=config replication is never "unpaused", the REFRESH operation can never succeed. It essentially takes manual intervention to fix the replica.

1 0

Re: (ITS#8588) microsecods in pwdFailureTime and .net Framework
by quanah＠symas.com 14 Feb '17

14 Feb '17

--On Tuesday, February 14, 2017 7:37 PM +0000 iovchelupoff(a)live.com wrote: > Full_Name: Ilya Ovchelupov > Version: 2.4.42 > OS: Windows Server 2008R2 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (143.112.32.4) > > > Hi, > We are testing 2.4.42 in our environment and found an issue with > pwdFailureTime attribute. > > It seems to me that it started after the new enhancement in 2.4.40 > (Fixed slapo-ppolicy timestamp resolution to use microseconds (ITS#7161)) > .net DirectorySearcher class doesn't support microseconds in the new > format and we're not able to receive the attribute value. > > I'm thinking about different options how to resolve it. > > Do you know any idea how to resolve it? Hello Ilya, The ITS system is for reporting bugs in OpenLDAP. Help requests are better directed to the openldap-technical(a)openldap.org list. I would note that microsecond timestamps are per the RFC, so I would suggest filing a bug with .NET to support the RFC. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8588) microsecods in pwdFailureTime and .net Framework
by iovchelupoff＠live.com 14 Feb '17

14 Feb '17

Full_Name: Ilya Ovchelupov Version: 2.4.42 OS: Windows Server 2008R2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (143.112.32.4) Hi, We are testing 2.4.42 in our environment and found an issue with pwdFailureTime attribute. It seems to me that it started after the new enhancement in 2.4.40 (Fixed slapo-ppolicy timestamp resolution to use microseconds (ITS#7161)) .net DirectorySearcher class doesn't support microseconds in the new format and we're not able to receive the attribute value. I'm thinking about different options how to resolve it. Do you know any idea how to resolve it? Thank you, Ilya

1 0

Re: (ITS#8335) MDB_MULTIPLE issues
by h.b.furuseth＠usit.uio.no 14 Feb '17

14 Feb '17

I wrote: > datacount*datasize (passed to page_spill) can overflow on 32-bit, I > thought that's what you meant. That is, I thought you meant checking data[1].mv_size <= UINT_MAX will stop the multiply from overflowon on 64-bit, but that doesn't help on 32-bit.

1 0

Re: (ITS#8335) MDB_MULTIPLE issues
by h.b.furuseth＠usit.uio.no 14 Feb '17

14 Feb '17

On 14/02/17 03:09, hyc(a)symas.com wrote: > Hallvard Breien Furuseth wrote: >> On 13/02/17 13:16, hyc(a)symas.com wrote: >>> We should probably check if mv_size is greater than UINT_MAX and return >>> EINVAL. (Or ERANGE.) >> >> If you mean check for overflow, that doesn't work on 32-bit hosts. > > It's not possible to pass in a datacount > UINT_MAX on 32bit so there's no > need for such a check. It's only needed on 64bit where uint is smaller than > size_t. I don't get it. You want to add this check for the sake of avoiding to change dcount,mcount from unsigned to double? Why? datacount*datasize (passed to page_spill) can overflow on 32-bit, I thought that's what you meant. But come to think of it, page_spill() itself more than doubles mv_size which can also overflow on 32-bit or with 64-bit MDB_MULTIPLE, it needs some tweaks.

1 0

Re: (ITS#8586) load cert+chain from TLSCertificateFile
by ryan＠nardis.ca 14 Feb '17

14 Feb '17

FWIW, tls_g already has the behaviour that (I think) this ticket asks for: if you set TLSCertificateFile to a file containing concatenated server and intermediate certs, it sends the chain of both. I found that useful in a setup very similar to what Andreas and Michael describe: slapd with a server certificate issued by an external/public CA, but trusting only a specific internal CA to authenticate clients. The comparison to mod_ssl is apt. Note that in recent versions httpd also supports loading the entire chain from SSLCertificateFile.

1 0

Re: (ITS#8335) MDB_MULTIPLE issues
by hyc＠symas.com 14 Feb '17

14 Feb '17

Hallvard Breien Furuseth wrote: > On 13/02/17 13:16, hyc(a)symas.com wrote: >> h.b.furuseth(a)usit.uio.no wrote: >>> (...) >>> datacount > UINT_MAX is truncated to unsigned int: >>> data[1].mv_size = 0x100000002 puts 2 items. >> >>> datacount * datasize can exceed UINT_MAX, which mdb_page_spill() >>> truncates to unsigned int. Such a massive put() will likely >>> fail anyway, but it should at least try to spill properly first. >> >> We should probably check if mv_size is greater than UINT_MAX and return >> EINVAL. (Or ERANGE.) > > If you mean check for overflow, that doesn't work on 32-bit hosts. It's not possible to pass in a datacount > UINT_MAX on 32bit so there's no need for such a check. It's only needed on 64bit where uint is smaller than size_t. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8335) MDB_MULTIPLE issues
by h.b.furuseth＠usit.uio.no 13 Feb '17

13 Feb '17

On 13/02/17 13:16, hyc(a)symas.com wrote: > h.b.furuseth(a)usit.uio.no wrote: >> (...) >> datacount > UINT_MAX is truncated to unsigned int: >> data[1].mv_size = 0x100000002 puts 2 items. > >> datacount * datasize can exceed UINT_MAX, which mdb_page_spill() >> truncates to unsigned int. Such a massive put() will likely >> fail anyway, but it should at least try to spill properly first. > > We should probably check if mv_size is greater than UINT_MAX and return > EINVAL. (Or ERANGE.) If you mean check for overflow, that doesn't work on 32-bit hosts. We can do a general overflow check (assuming dcount i size_t here) xdata.mv_size = data[0].mv_size * dcount; if (xdata.mv_size / dcount != data[0].mv_size) return <error>; or if you want a compile-time max safe dcount on 32-bit, that's EVEN((size_t)-1 / (MAX_PAGESIZE/MDB_MINKEYS)) So - MDB_BAD_VALSIZE or a new MDB_* code: Not EINVAL, that should be reserved for obvious error conditions. And not ERANGE, we should not add new errno.h codes.

1 0

Re: (ITS#8586) load cert+chain from TLSCertificateFile
by michael＠stroeder.com 13 Feb '17

13 Feb '17

Howard Chu wrote: > It's pretty much unheard of for an LDAP server to trust TLS client certs issued by a CA > different from the LDAP server's own CA. Since client certs are usually issued only to > allow authentication, an LDAP server will only trust its own CA to issue identities to > clients. Not sure what you consider to be "pretty much unheard of". But I vaguely remember having already described this use case: 1. Assume *all* clients have to authenticate to the LDAP server to get properly authorized to even see data (no anon access). 2. Furthermore there is a config management system available at the site which already issues client certs for its own internal use (e.g. puppet with master and CA). In this case you want to (re)use the config mgmt client certs to simple authenticate those particular LDAP clients but not want to use the config mgmt CA to be trusted also to issue server certs which ensures MITM protection for all other LDAP clients probably sending bind requests with clear-text passwords. => OpenLDAP's configuration should it possible to define different root CA chains for the local server cert and accepted client certs validation. Ciao, Michael. P.S.: You might have guessed: I'm using this in Æ-DIR to avoid having to set server passwords for thousands of servers.

1 0

Re: (ITS#8586) load cert+chain from TLSCertificateFile
by hyc＠symas.com 13 Feb '17

13 Feb '17

michael(a)stroeder.com wrote: > sca+openldap(a)andreasschulze.de wrote: >> as discussed on the technical ML it's uncommon to put chain certificates in >> TLSCACertificateFile or TLSCACertificatePath. In case of a intermediate CA like >> "Let's Encrypt Authority X3" it may be wrong becaus the user is forced to >> /TRUST/ that intermediate for a unrelated purpose. > > We should be more precise here - especially regarding the term "user". > > IMO it is common to put the whole CA cert chain in the cert configuration of a TLS > server. This is required so that the TLS *client* only has to know the root CA cert > (trust anchor) and the TLS server sends the intermediate certs. Note that some TLS > implementations like GnuTLS require the CA cert chain to be "in order" (bottom-up). > > The real issue here is that TLSCACertificateFile and TLSCACertificatePath are also used > to specify the set of trusted CA certs to validate TLS client certs used by the TLS > client to authenticate. It's pretty much unheard of for an LDAP server to trust TLS client certs issued by a CA different from the LDAP server's own CA. Since client certs are usually issued only to allow authentication, an LDAP server will only trust its own CA to issue identities to clients. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8586) load cert+chain from TLSCertificateFile
by hyc＠symas.com 13 Feb '17

13 Feb '17

sca+openldap(a)andreasschulze.de wrote: > Full_Name: Andreas Schulze > Version: RE24 testing call (2.4.45) > OS: Linux > URL: ftp://ftp.openldap.org/incoming/andreas-schulze-20170211.patch > Submission from: (NULL) (2001:a60:f0b4:e502:80b6:610b:8fc2:abfe) > > as discussed on the technical ML it's uncommon to put chain certificates in > TLSCACertificateFile or TLSCACertificatePath. It is explicitly documented. http://www.openldap.org/doc/admin24/tls.html Section 16.2.1.1. You may argue that it is uncommon for people to read the docs but that doesn't constitute a software bug. > In case of a intermediate CA like > "Let's Encrypt Authority X3" it may be wrong becaus the user is forced to > /TRUST/ that intermediate for a unrelated purpose. That doesn't follow. The file used by slapd is only used to authenticate LDAP clients. There is no bug here, this ITS is invalid. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8335) MDB_MULTIPLE issues
by hyc＠symas.com 13 Feb '17

13 Feb '17

h.b.furuseth(a)usit.uio.no wrote: > On 07/12/15 10:14, h.b.furuseth(a)usit.uio.no wrote: >> Put(0 data items, MDB_MULTIPLE) stores 1 item. The doc does >> not warn against 0 items. I suggest supporting 0 items, it >> is a commonly supported convenience elsewhere (e.g. memcpy). > > I.e. supporting it as a no-op. But on second thought I think > that's misleading and EINVAL is better: If the key doesn't exist, > this is an attempt to create a key with no data. Unsupported. > Bryan Matsuo just posted a test case to openldap-technical. EINVAL makes sense here. > datacount > UINT_MAX is truncated to unsigned int: > data[1].mv_size = 0x100000002 puts 2 items. > datacount * datasize can exceed UINT_MAX, which mdb_page_spill() > truncates to unsigned int. Such a massive put() will likely > fail anyway, but it should at least try to spill properly first. We should probably check if mv_size is greater than UINT_MAX and return EINVAL. (Or ERANGE.) >> Why does MDB_MULTIPLE require a cursor? mdb_put() rejects it. Because get only works with a cursor. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8586) load cert+chain from TLSCertificateFile
by sca＠andreasschulze.de 12 Feb '17

12 Feb '17

Am 12.02.2017 um 12:04 schrieb Michael Ströder: > sca+openldap(a)andreasschulze.de wrote: >> as discussed on the technical ML it's uncommon to put chain certificates in >> TLSCACertificateFile or TLSCACertificatePath. In case of a intermediate CA like >> "Let's Encrypt Authority X3" it may be wrong becaus the user is forced to >> /TRUST/ that intermediate for a unrelated purpose. > > We should be more precise here - especially regarding the term "user". agree > IMO it is common to put the whole CA cert chain in the cert configuration of a TLS > server. This is required so that the TLS *client* only has to know the root CA cert > (trust anchor) and the TLS server sends the intermediate certs. Note that some TLS > implementations like GnuTLS require the CA cert chain to be "in order" (bottom-up). As I don't use GnuTLS I can't tell something about it's internals > The real issue here is that TLSCACertificateFile and TLSCACertificatePath are also used > to specify the set of trusted CA certs to validate TLS client certs used by the TLS > client to authenticate. correct. That's also what "man 3 SSL_CTX_use_certificate" mention. > So I'm not sure whether your patch breaks the use-case of having more than one trusted > root CA cert for validating TLS client certs issued by independent CAs. I may imagine a setup with RSA and EC certificates. Two certs are more complex then one. But if an admin decide to use diferent CAs it's his decision for more complexity > I think we might need different directives for trusted CA certs for client cert > validation and the server cert chain (similar what's done on Apache mod_ssl with > SSLCertificateChainFile and SSLCACertificateFile/SSLCACertificatePath). also: I don't us apache, can't tell if that way is is the best. Postfix,dovecot, nginx for example don't require a "SSLCertificateChainFile" directive. > It could be sufficient to simply add the server CA cert chain to TLSCertificateFile and > only add the trusted root CA certs to TLSCACertificateFile/TLSCACertificatePath (and no C > code patch needed for that, maybe review/clarification of the docs). that's what the patch try. currently I tried to add cert+chain to a file used as TLSCertificateFile The chain is ignored as expected and documented in "man 3 SSL_CTX_use_certificate_file" simply replacing SSL_CTX_use_certificate_file by SSL_CTX_use_certificate_chain_file fix that. I now can put cert+chain (excluding a root) ti the file used as TLSCertificateFile. as simple as it could be. But: I'm aware there are other use cases that will break stuff, years old. So my ITS it more intended to point out a problem then simply changing openldap to my needs. Andreas

1 0

Re: (ITS#8335) MDB_MULTIPLE issues
by h.b.furuseth＠usit.uio.no 12 Feb '17

12 Feb '17

On 07/12/15 10:14, h.b.furuseth(a)usit.uio.no wrote: > Put(0 data items, MDB_MULTIPLE) stores 1 item. The doc does > not warn against 0 items. I suggest supporting 0 items, it > is a commonly supported convenience elsewhere (e.g. memcpy). I.e. supporting it as a no-op. But on second thought I think that's misleading and EINVAL is better: If the key doesn't exist, this is an attempt to create a key with no data. Unsupported. Bryan Matsuo just posted a test case to openldap-technical. datacount > UINT_MAX is truncated to unsigned int: data[1].mv_size = 0x100000002 puts 2 items. datacount * datasize can exceed UINT_MAX, which mdb_page_spill() truncates to unsigned int. Such a massive put() will likely fail anyway, but it should at least try to spill properly first. > Why does MDB_MULTIPLE require a cursor? mdb_put() rejects it.

1 0

Re: (ITS#8586) load cert+chain from TLSCertificateFile
by michael＠stroeder.com 12 Feb '17

12 Feb '17

sca+openldap(a)andreasschulze.de wrote: > as discussed on the technical ML it's uncommon to put chain certificates in > TLSCACertificateFile or TLSCACertificatePath. In case of a intermediate CA like > "Let's Encrypt Authority X3" it may be wrong becaus the user is forced to > /TRUST/ that intermediate for a unrelated purpose. We should be more precise here - especially regarding the term "user". IMO it is common to put the whole CA cert chain in the cert configuration of a TLS server. This is required so that the TLS *client* only has to know the root CA cert (trust anchor) and the TLS server sends the intermediate certs. Note that some TLS implementations like GnuTLS require the CA cert chain to be "in order" (bottom-up). The real issue here is that TLSCACertificateFile and TLSCACertificatePath are also used to specify the set of trusted CA certs to validate TLS client certs used by the TLS client to authenticate. So I'm not sure whether your patch breaks the use-case of having more than one trusted root CA cert for validating TLS client certs issued by independent CAs. I think we might need different directives for trusted CA certs for client cert validation and the server cert chain (similar what's done on Apache mod_ssl with SSLCertificateChainFile and SSLCACertificateFile/SSLCACertificatePath). It could be sufficient to simply add the server CA cert chain to TLSCertificateFile and only add the trusted root CA certs to TLSCACertificateFile/TLSCACertificatePath (and no C code patch needed for that, maybe review/clarification of the docs). Ciao, Michael.

1 0

Re: (ITS#8485) [PATCH] Adding support for encrypted server private keys
by balmerpeak92＠gmail.com 12 Feb '17

12 Feb '17

--f403045f155e1c46d105484cea3d Content-Type: text/plain; charset=UTF-8 This would be a very helpful feature for me - I have a web server that has to regularly interact with a corporately maintained secure LDAP server. I'd love to be able to store the certs for this interaction encrypted for added security. --f403045f155e1c46d105484cea3d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">This would be a very helpful feature for me - I have a web= server that has to regularly interact with a corporately maintained secure= LDAP server. I'd love to be able to store the certs for this interacti= on encrypted for added security.<br></div> --f403045f155e1c46d105484cea3d--

1 0

(ITS#8587) correct spelling errors: wrong: emtpy, correct: empty
by sca+openldap＠andreasschulze.de 11 Feb '17

11 Feb '17

Full_Name: Andreas Schulze Version: RE24 testing call (2.4.45) OS: Linux URL: ftp://ftp.openldap.org/incoming/andreas-schulze-20170211-2.patch Submission from: (NULL) (2001:a60:f0b4:e502:80b6:610b:8fc2:abfe) there are 4 occurrence of "emtpy" which are supposed to be written as "empty"

1 0

(ITS#8586) load cert+chain from TLSCertificateFile
by sca+openldap＠andreasschulze.de 11 Feb '17

11 Feb '17

Full_Name: Andreas Schulze Version: RE24 testing call (2.4.45) OS: Linux URL: ftp://ftp.openldap.org/incoming/andreas-schulze-20170211.patch Submission from: (NULL) (2001:a60:f0b4:e502:80b6:610b:8fc2:abfe) as discussed on the technical ML it's uncommon to put chain certificates in TLSCACertificateFile or TLSCACertificatePath. In case of a intermediate CA like "Let's Encrypt Authority X3" it may be wrong becaus the user is forced to /TRUST/ that intermediate for a unrelated purpose. from https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_use_certificate.html#NOTES: SSL_CTX_use_certificate_chain_file() should be used instead of the SSL_CTX_use_certificate_file() function in order to allow the use of complete certificate chains even when no trusted CA storage is used or when the CA issuing the certificate shall not be added to the trusted CA storage. The patch andreas-schulze-20170211.patch only apply for openssl.

1 0

Re: (ITS#8581) slapd-meta backend SSL negociation timeout
by louis.chanouha＠test.univ-toulouse.fr 10 Feb '17

10 Feb '17

I tried with ltb's latest Jessie builds but same problem occurs. I fast-checked tls_o.c, i can't find any code relative to handshake timeout (https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries…), but as i never handle any ssl lib code, i can be completely mistaken. On Jessie, default timeout on gnuTLS seems to be 3600 secs, I will try to wait. /usr/local/openldap/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.44 (Feb 8 2016 17:34:53) $ root@debian8:/opt/paquet-openldap-debian/openldap-ltb-2.4.44/servers/slapd

1 0

Re: (ITS#8582) LMDB lockfile/mutex arch dependency
by hyc＠symas.com 09 Feb '17

09 Feb '17

hyc(a)openldap.org wrote: > Full_Name: Howard Chu > Version: HEAD > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (195.235.15.200) > Submitted by: hyc > > > I ran into some corruption problems when running a 64bit LMDB process concurrent > with a 32bit one using MDB_VL32. While LMDB's own structures are all 64bit clean > in a VL32 build, unfortunately pthread_mutex_t structures are not. In > particular, in glibc a pthread_mutex_t can be one of 3 different sizes - 24 > bytes for 32bit runtime on 32bit processor, 32 bytes for 32bit runtime on > x86-64, and 40 bytes for 64bit runtime on x86-64. As such, we cannot safely > share an LMDB environment between 32 and 64bit Linux processes, even when using > MDB_VL32. > > This problem doesn't affect Windows, platforms using SysV semaphores, or > platforms using POSIX named semaphores. I don't currently know whether this is a > problem on other platforms that support POSIX process-shared mutexes. For glibc, I've submitted an enhancement request regarding mutex sizes: https://sourceware.org/bugzilla/show_bug.cgi?id=21119 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8584) reloadhint for syncprov overlay should default to TRUE
by quanah＠symas.com 07 Feb '17

07 Feb '17

> On Feb 7, 2017, at 10:25 AM, hyc(a)symas.com wrote: >=20 > Quanah Gibson-Mount wrote: >> --On Tuesday, February 07, 2017 8:53 AM +0000 Howard Chu <hyc(a)symas.com> w= rote: >>=20 >>=20 >>> The relevant part of the doc is "It must be set TRUE when using the >>> accesslog overlay for delta-based syncrepl support." Otherwise it has no= >>> effect, so there is no reason to change it in the default case. >>=20 >> Actually, what the manpage says is: >>=20 >> This option should be set TRUE when working with >> newer releases that properly support this flag. It must be set >> TRUE when using the accesslog overlay for delta-based syncrepl >> replication support. >>=20 >> So, that clearly states it should *always* be TRUE unless you have a 2.3.= 11 or >> earlier consumer, which is technically not allowable. There is zero reas= on >> for this tunable to exist. It should be deprecated and the internal code= >> changed to simply set the flag to TRUE. One less item for anyone to have= to >> ever deal with is a win. >=20 > "when working with newer releases that properly support this flag." >=20 > The syncrepl consumer only pays attention to this flag in delta-sync. Ther= e is=20 > no reason to use reloadhint in regular syncrepl. Turning it on by default o= nly=20 > slows down the refresh negotiation in regular syncrepl. >=20 > --=20 > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >=20 Then the man page needs updating since the information on it is blatantly wr= ong. The "newer releases" is clearly indicated to be anything later than 2.= 3.11. --Quanah=

1 0

Re: (ITS#8584) reloadhint for syncprov overlay should default to TRUE
by hyc＠symas.com 07 Feb '17

07 Feb '17

Quanah Gibson-Mount wrote: > --On Tuesday, February 07, 2017 8:53 AM +0000 Howard Chu <hyc(a)symas.com> wrote: > > >> The relevant part of the doc is "It must be set TRUE when using the >> accesslog overlay for delta-based syncrepl support." Otherwise it has no >> effect, so there is no reason to change it in the default case. > > Actually, what the manpage says is: > > This option should be set TRUE when working with > newer releases that properly support this flag. It must be set > TRUE when using the accesslog overlay for delta-based syncrepl > replication support. > > So, that clearly states it should *always* be TRUE unless you have a 2.3.11 or > earlier consumer, which is technically not allowable. There is zero reason > for this tunable to exist. It should be deprecated and the internal code > changed to simply set the flag to TRUE. One less item for anyone to have to > ever deal with is a win. "when working with newer releases that properly support this flag." The syncrepl consumer only pays attention to this flag in delta-sync. There is no reason to use reloadhint in regular syncrepl. Turning it on by default only slows down the refresh negotiation in regular syncrepl. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8584) reloadhint for syncprov overlay should default to TRUE
by quanah＠symas.com 07 Feb '17

07 Feb '17

--On Tuesday, February 07, 2017 8:53 AM +0000 Howard Chu <hyc(a)symas.com> wrote: > The relevant part of the doc is "It must be set TRUE when using the > accesslog overlay for delta-based syncrepl support." Otherwise it has no > effect, so there is no reason to change it in the default case. Actually, what the manpage says is: This option should be set TRUE when working with newer releases that properly support this flag. It must be set TRUE when using the accesslog overlay for delta-based syncrepl replication support. So, that clearly states it should *always* be TRUE unless you have a 2.3.11 or earlier consumer, which is technically not allowable. There is zero reason for this tunable to exist. It should be deprecated and the internal code changed to simply set the flag to TRUE. One less item for anyone to have to ever deal with is a win. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8585) assert in ber_get_next after connection error
by hyc＠openldap.org 07 Feb '17

07 Feb '17

Full_Name: Howard Chu Version: any OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.235.15.200) Submitted by: hyc 1) ldap_result() returns -1 with ld_errno = LDAP_LOCAL_ERROR because it read an unrecognizable message from the network. 2) ldap_result() is called again on the same LDAP*. During (1) the lc->lconn_ber was not zeroed out so it is used again in (2). But ber_get_next() already fully parsed its input during (1) so this assert fails on the 2nd call: 513 if (ber->ber_rwptr == NULL) { 514 assert( ber->ber_buf == NULL ); 515 ber->ber_rwptr = (char *) &ber->ber_len-1; 516 ber->ber_ptr = ber->ber_ptr%r; 517 ber->ber_tag = 0; 518 } ldap_result() should clear lconn_ber before returning with an error. The LDAP* session probably should not be used again after (1) anyway but this is still messy.

1 0

Re: (ITS#8584) reloadhint for syncprov overlay should default to TRUE
by hyc＠symas.com 07 Feb '17

07 Feb '17

quanah(a)openldap.org wrote: > Full_Name: Quanah Gibson-Mount > Version: 2.4.44 > OS: N/A > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (47.208.148.26) > > > The "reloadhint" option for the syncprov overlay currently defaults to FALSE. > However, the documentation clearly notes that you want to set it to true for any > release > 2.3.11. Given that 2.3 has been obsolete for years and it has been > over 11 years since the release of 2.3.11, we should really fix the default > value, and note that it should be changed if and only if there is a consumer > running 2.3.11 or prior. The relevant part of the doc is "It must be set TRUE when using the accesslog overlay for delta-based syncrepl support." Otherwise it has no effect, so there is no reason to change it in the default case. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#8584) reloadhint for syncprov overlay should default to TRUE
by quanah＠symas.com 07 Feb '17

07 Feb '17

--On Monday, February 06, 2017 11:54 PM +0000 quanah(a)openldap.org wrote: > The "reloadhint" option for the syncprov overlay currently defaults to > FALSE. However, the documentation clearly notes that you want to set it > to true for any release > 2.3.11. Given that 2.3 has been obsolete for > years and it has been over 11 years since the release of 2.3.11, we > should really fix the default value, and note that it should be changed > if and only if there is a consumer running 2.3.11 or prior. Actually, since it is not a valid configuration scenario to have a 2.4 provider and a 2.3 consumer, it seems that the configuration option should be deprecated entirely, and the internal code simply default to TRUE. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8584) reloadhint for syncprov overlay should default to TRUE
by quanah＠openldap.org 07 Feb '17

07 Feb '17

Full_Name: Quanah Gibson-Mount Version: 2.4.44 OS: N/A URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (47.208.148.26) The "reloadhint" option for the syncprov overlay currently defaults to FALSE. However, the documentation clearly notes that you want to set it to true for any release > 2.3.11. Given that 2.3 has been obsolete for years and it has been over 11 years since the release of 2.3.11, we should really fix the default value, and note that it should be changed if and only if there is a consumer running 2.3.11 or prior.

1 0

(ITS#8583) LDAPCtrl::LDAPCtrl(const LDAPControl* ctrl) issue
by jim.rooks＠neustar.biz 06 Feb '17

06 Feb '17

Full_Name: Jim Rooks Version: 2.4.44 OS: RedHat 6.8 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (104.129.194.54) The following code in contrib/ldapc++/src/LDAPControl.cpp needs to be corrected: LDAPCtrl::LDAPCtrl(const LDAPControl* ctrl){ DEBUG(LDAP_DEBUG_CONSTRUCT,"LDAPCtrl::LDAPCtrl()" << endl); m_oid = string(ctrl->ldctl_oid); m_oid = ctrl->ldctl_iscritical ? true : false; m_oid = string(ctrl->ldctl_value.bv_val, ctrl->ldctl_value.bv_len ); } to something like: LDAPCtrl::LDAPCtrl(const LDAPControl* ctrl){ DEBUG(LDAP_DEBUG_CONSTRUCT,"LDAPCtrl::LDAPCtrl()" << endl); m_oid = string(ctrl->ldctl_oid); m_isCritical = ctrl->ldctl_iscritical ? true : false; m_data = string(ctrl->ldctl_value.bv_val, ctrl->ldctl_value.bv_len ); m_noData = ctrl->ldctl_value.bv_len ? false : true; }

1 0

Re: [Spam?] (ITS#8577) Accesslog overlay hangs slapd depending on module loading order
by quanah＠symas.com 06 Feb '17

06 Feb '17

--On Wednesday, February 01, 2017 6:38 PM +0000 mj(a)netauth.com wrote: > Full_Name: Mike Jackson > Version: 2.4.44 > OS: Oracle Linux Server release 7.2 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (194.157.185.162) > > > Same issue as Stroeder mentioned here: > > http://www.openldap.org/lists/openldap-bugs/201111/msg00027.html > > If accesslog.la is loaded before syncprov.la, slapd will stop accepting > connections immediately after accesslog overlay is added. To note, this was a configuration error where accesslog overlay was being configured to write ops back onto itself. We should probably check for this and reject it (vs allowing it to lock up slapd). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(ITS#8582) LMDB lockfile/mutex arch dependency
by hyc＠openldap.org 06 Feb '17

06 Feb '17

Full_Name: Howard Chu Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (195.235.15.200) Submitted by: hyc I ran into some corruption problems when running a 64bit LMDB process concurrent with a 32bit one using MDB_VL32. While LMDB's own structures are all 64bit clean in a VL32 build, unfortunately pthread_mutex_t structures are not. In particular, in glibc a pthread_mutex_t can be one of 3 different sizes - 24 bytes for 32bit runtime on 32bit processor, 32 bytes for 32bit runtime on x86-64, and 40 bytes for 64bit runtime on x86-64. As such, we cannot safely share an LMDB environment between 32 and 64bit Linux processes, even when using MDB_VL32. This problem doesn't affect Windows, platforms using SysV semaphores, or platforms using POSIX named semaphores. I don't currently know whether this is a problem on other platforms that support POSIX process-shared mutexes. Hallvard has suggested that we add some additional LOCK_FORMAT bits to protect against incompatible accesses. This would primarily be useful for the mdb_stat command, which can still safely retrieve some useful information from an environment without acquiring any mutexes. E.g., an MDB_VL32 build of mdb_stat could retrieve most envinfo, statinfo, and readerinfo from a running 64bit environment. It could not scan the freelist, scan all the names of named DBs, or clean the reader list, since these operations all require taking the reader mutex.

1 0

Re: (ITS#8581) slapd-meta backend SSL negociation timeout
by michael＠stroeder.com 05 Feb '17

05 Feb '17

This is a cryptographically signed message in MIME format. --------------ms020706080404060907060004 Content-Type: text/plain; charset=ISO-8859-2 Content-Transfer-Encoding: quoted-printable louis.chanouha(a)univ-toulouse.fr wrote: > OS: Debian 8 Jessie x64 > slapd: 2.4.40+dfsg-1+deb8u2 > gnutls: 3.3.8-6+deb8u4 Note that the Debian builds are an older version and AFAICS the GnuTLS wr= apping code does not receive much love. Try again release 2.4.44 linked to OpenSSL e.g. by using the ltb-project = builds or your own custom build. Ciao, Michael. --------------ms020706080404060907060004 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CucwggT9MIID5aADAgECAhBFRleVrRF8X5GwbV0tcLCgMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwOTE2MDcxNjUxWhcNMTkxMjE2MDcxNjUxWjBEMR0wGwYDVQQDDBRtaWNo YWVsQHN0cm9lZGVyLmNvbTEjMCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20w ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChMBt5jtuLXsNQ5U7rBbZit8sknIwz hfaousT3d/fssQ6qZwe9l1yklILSXVMqI7/bxbiqcd3zrz+imdSlZPrFBHGfh04DZHCfss2F RwSswGejqP1qE3hPvZi96wFfOMqenpN+pSXqNJ1OPBCJ8a+8ZEioFKoEj3HkCCXjbmezAgms FuA7aFE9BfjJ2eQKw8B9G8X1FjvOTinYSZ2F+qHpKgywl4HTx0dMnYy+Pwu4DDIHkEaVH+uj K1/ed76WUEH51mX9m2Xu0onfQlSM3me6EvAAZiIDsCEbF9WttRuJbpfCFo0m2uW7BBugS7EG Jro1nRSQVnpJyTFgHb5EGMVVAgMBAAGjggG4MIIBtDAOBgNVHQ8BAf8EBAMCBLAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFh1801TSuxT Nltnv9rOjrZzUUgNMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUF BwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUF BzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYD VR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3Js MB8GA1UdEQQYMBaBFG1pY2hhZWxAc3Ryb2VkZXIuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tLzBHBgNVHSAEQDA+MDwGCysGAQQBgbU3AQIFMC0wKwYIKwYBBQUH AgEWH2h0dHBzOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggEB AKiJ9wpjJeHdEzHDZyqmhn4cHcRj9Ag7ZQK0meq1N3oQ9M1YeVge6vZe20LXojgXsNUQGLSt 1lW2s7fABkL9CF+/RtWznHxlp4YpWX/RgbHBo3uXKNA5JUOjbxQ2+1b1jaTp/FUrSIISAxgd RpeYAODJ0db1x8Q+l66DtIVjj7ktWISdJWE2Opn4QnaRwdj6n35Rul4S2ikUsmxtGrHLpjRR XJqbsGa0RZdJyUKlZ2ZRAoRz4jKHOogQcig937sR5Ut2pGOhrScEhgARY2c8Gs2olRTL3pue mE4vjY0g1Nwr9RzeFwMuasiFh4yD34i6jIRfoNzuLPgydjsJ0grw0akwggXiMIIDyqADAgEC AhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAklMMRYwFAYD VQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0 ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe Fw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv cml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17Ake fMyUGwrQdvwObhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzL A84J6Ws5T4NfXZ0qn4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmC S+kICslYYWgXOMt2xlsSslxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6my Su8j8BWWHpChNNeTrFuhVfrOAyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR 9t4APXGzAgMBAAGjggFkMIIBYDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUH AwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0 cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEF BQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDAGCCsGAQUFBzAChiRodHRwOi8vYWlh LnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0OBBYEFCSBbDlhvkkPj7cbRivJKLUn SG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMD8GA1UdIAQ4MDYwNAYEVR0g ADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kwDQYJKoZI hvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh2NCXTq7im61g7F1L IiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw5kG3DN8pd1hS EUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07v29MdhaP v3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Yklue /quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6 UpVDo/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHM zcwk3EV2B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuK KwHNL8F4GGp6jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ 8j6y6S9p0xE/Ga0peVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMYIDzDCCA8gCAQEwgYkw dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx IENsaWVudCBDQQIQRUZXla0RfF+RsG1dLXCwoDANBglghkgBZQMEAgEFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwMjA1MTczNTMzWjAvBgkq hkiG9w0BCQQxIgQg4NQP+omZGvsJczulvAUBlhaYlRBt9N6eXp48/EjfOKswbAYJKoZIhvcN AQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3 DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBmgYJKwYB BAGCNxAEMYGMMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkw JwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3Rh cnRDb20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwgZwGCyqGSIb3DQEJ EAILMYGMoIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYD VQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRD b20gQ2xhc3MgMSBDbGllbnQgQ0ECEEVGV5WtEXxfkbBtXS1wsKAwDQYJKoZIhvcNAQEBBQAE ggEARdz6AM0G9ncIBAk7l8ii/QR/W3Ovn0S97sRUobDoRu26k6byIsAl7vSgQSKAx2ExQL73 UjZtSaQQ3Bd99nPPAxGIMFIjZ/D55eB8t6+W61rTI7jhzuHifdG/XmLp4ELM0i+wfjFYMiiJ hkGm8bpBIVlfh4rwZscrmfrTOwbJJT6/tCtH185mynXP8vxCA/31M78E3L01436GI6LtaJ8z Z7HpkbKANlae4f7AIHv+aFU+tgkGbzFWcb6abDHYqANfxAeuKn6cRBEN/5mvhio7LjAM4qcU xIxGb2aA5uySOtNdLtVh3hj9q3OXhZkM20/dCQU5PZxaThl4HpqbZH2QbwAAAAAAAA== --------------ms020706080404060907060004--

1 0

(ITS#8581) slapd-meta backend SSL negociation timeout
by louis.chanouha＠univ-toulouse.fr 04 Feb '17

04 Feb '17

Full_Name: Louis Chanouha Version: 2.4.40 OS: Debian 8 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (90.76.56.40) Hello, I experience some problems with slapd-meta with ldaps backend. gnuTLS (or openssl) negociation timeout seems not to be handled, and i can't find any reference to modify this timeout on docs. My server becames unresponsive (too many connexion slots) when a ssl-secured backend server time out after TCP connexion establishment. To reproduce the error, i have an meta directory configured like this: database meta suffix "dc=localauth" rootdn "%n=Manager,dc=localauth" rootpw XXX uri "ldaps://localhost:666/ou=UT,dc=localauth" lastmod off suffixmassage "ou=UT,dc=localauth" "ou=people,dc=example,dc=fr" timeout 1 conn-ttl 1 network-timeout 1 And i launch a netcat to listen to the 666 port: nc -l -p 666 Then, this command never time out: ldapwhoami -H ldap://YYYY:9009 -D uid=me,ou=UT,dc=localauth -W Error does not happen when no ssl used ("timeout 1" option works well) OS: Debian 8 Jessie x64 slapd: 2.4.40+dfsg-1+deb8u2 gnutls: 3.3.8-6+deb8u4 Sorry for my english, and thanks for the help, Regards, Louis Chanouha University of Toulouse

1 0

(ITS#8580) force openssl use the server side cipher preference
by sca+openldap＠andreasschulze.de 03 Feb '17

03 Feb '17

Full_Name: Andreas Schulze Version: RE24 OS: Linux URL: ftp://ftp.openldap.org/incoming/andreas-schulze-20170203.patch Submission from: (NULL) (2001:a60:f0b4:e502:758b:b0b2:3fc:f121) In OpenSSL client and Server may select a cipher. The patch force the cipher preference is force by the server and not by the client, which is a openssl default Let the server select ciphers is best practice for webservers for example.

1 0

(ITS#8579) LMDB: me_fd should be O_CLOEXEC on POSIX systems
by lmb＠cloudflare.com 03 Feb '17

03 Feb '17

Full_Name: Lorenz Bauer Version: OS: Linux URL: Submission from: (NULL) (2a06:98c0:1000:8200:18fd:e772:495e:6163) This is in some ways a follow up to ITS#8505. In the issue I argued that LMDB did not deal well with fork/exec. Hallvard committed a fix in 04acac634a7b276332e2. I think the fix still has one major weakness: me_fd does not have O_CLOEXEC set. Now, Hallvard omitted this change on purpose. mdb_env_get_fd() exposes me_fd to the user, so there could conceivably be client code out there which expects the fd to persist across exec(). (Please correct my if I misunderstood your argument.) I believe that the correct action is to set O_CLOEXEC on me_fd by default, and break such client code. 1. Using mdb_env_get_fd this way is Undefined Behaviour (according to the doc) Before ITS#8505, the documentation made it sound like ANY use after fork() / exec() is disallowed. At the same time, mdb_env_get_fd made no mention / promises wrt exec() behaviour. Adopting O_CLOEXEC in my opinion does not violate the API set out so far. We can, in the opposite, clarify what is acceptable use (as Hallvard already has done). 2. mdb_env_get_fd has inconsistent semantics across OSs When creating file handles on Windows we pass NULL as the lpSecurityAttributes argument to CreateFileW: If this parameter is NULL, the handle returned by CreateFile cannot be inherited by any child processes the application may create [...] me_fd already has O_CLOEXEC on Windows. 3. Manually closing me_fd after fork() is not possible in all environments Hallvard suggests calling fork(), close(mdb_env_get_fd()) and then exec() for users which do not want to leak me_fd to child processes. We use LMDB from the Go platform, which does not expose fork and exec separately (due to the well-known pitfalls they have). We can't use Hallvard's suggestion therefore. 4. me_fd can still be passed around by dup()ing the handle If there are legitimate uses of passing the handle around, users can explicitly dup the handle and then pass it on to child processes. I hope my arguments are convincing enough to make the change before the next release. The benefits are * Consistent semantics between OS * (In my view) saner defaults * and a solution which works well across environments. The downside is that we might break unknown client code. I can'c come up with a use case of passing me_fd to children, so I suspect the risk is low. The patch itself is trivial, and I'm happy to contribute it if desired. Lorenz

1 0

(ITS#8578) remove unused-variables in RE24 testing call (2.4.45)
by sca+openldap＠andreasschulze.de 01 Feb '17

01 Feb '17

Full_Name: A. Schulze Version: RE24 testing call (2.4.45) OS: URL: ftp://ftp.openldap.org/incoming/andreas-schulze-20170201.patch Submission from: (NULL) (2001:a60:f0b4:e502:758b:b0b2:3fc:f121) the patch remove variables that are declared but unused.

1 0

(ITS#8577) Accesslog overlay hangs slapd depending on module loading order
by mj＠netauth.com 01 Feb '17

01 Feb '17

Full_Name: Mike Jackson Version: 2.4.44 OS: Oracle Linux Server release 7.2 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.157.185.162) Same issue as Stroeder mentioned here: http://www.openldap.org/lists/openldap-bugs/201111/msg00027.html If accesslog.la is loaded before syncprov.la, slapd will stop accepting connections immediately after accesslog overlay is added. olcModuleLoad: {0}ppolicy.la olcModuleLoad: {1}auditlog.la olcModuleLoad: {2}back_ldap.la olcModuleLoad: {3}unique.la olcModuleLoad: {4}accesslog.la olcModuleLoad: {5}syncprov.la ldapadd -f dn: oDatatabase={4}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {4}mdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=log olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart olcDbMaxSize: 1073741824 olcDbMode: 0600 olcAccess: {0}to * by dn.children="ou=global-admins,ou=admin-users,dc=foo,dc=net" read dn: olcOverlay=accesslog,olcDatabase={4}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olccccessLogDB<ncn=log olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 7+00:00 1+00:00

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs