- openldap-bugs - openldap.org

(ITS#7893) memberof: bad a_numvals count
by jsoula＠univ-lille2.fr 09 Jul '14

09 Jul '14

Full_Name: julien soula Version: 2.4.39 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.254.117.28) Hi, this is related to ITS#6508. I don't think that the supplied patch is enough to fix the bug. When the last "member" entry is dangling then "( j - i == 1 )" is true and the loop is broken without reducing a_numvals. So I propose this patch : --- servers/slapd/overlays/memberof.c.orig 2014-07-09 21:17:14.487296363 +0200 +++ servers/slapd/overlays/memberof.c 2014-07-09 21:31:44.071565223 +0200 @@ -596,6 +596,7 @@ ber_memfree( a->a_nvals[ i ].bv_val ); BER_BVZERO( &a->a_nvals[ i ] ); } + a->a_numvals--; if ( j - i == 1 ) { break; } @@ -607,7 +608,6 @@ sizeof( struct berval ) * ( j - i ) ); } i--; - a->a_numvals--; } } Best regards, Julien

1 0

Re: (ITS#7351) can not start slapd when enable accesslog relay
by hyc＠symas.com 08 Jul '14

08 Jul '14

bashift(a)gmail.com wrote: > Full_Name: ChenShuJun > Version: 2.4.32 > OS: RHEL5.5(2.6.18-194.el5) > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (218.246.127.3) > Due to lack of cooperation from Oracle, back-ndb is no longer supported. Some info here http://www.openldap.org/lists/openldap-technical/201203/msg00216.html http://www.openldap.org/lists/openldap-devel/201307/msg00018.html This ITS will be closed. > > ####################################################################### > # BDB database definitions > ####################################################################### > > database ndb > suffix "dc=bgctv,dc=net,dc=cn" > rootdn "cn=admin,dc=bgctv,dc=net,dc=cn" > rootpw ghwl > directory /usr/local/openldap/var/openldap-data > dbconnect 172.30.5.20:1186 > dbhost 172.30.5.20 > dbname bgctv > dbuser bgctv > dbpass ghwl_h0 > dbconnections 1 > overlay accesslog > logdb "cn=auditlog" > logops writes > logold (objectclass=*) > > #dbconnect 172.30.5.20:1186 > #dbhost 172.30.5.20 > #dbname auditlog > #dbuser bgctv > #dbpass ghwl_h0 > #dbconnections 1 > > access to attrs=userPassword,shadowLastChange > by anonymous auth > by self write > by * none > access to dn.sub="ou=cm,dc=bgctv,dc=net,dc=cn" > by dn="userid=cmadmin,dc=bgctv,dc=net,dc=cn" write > by anonymous auth > by * none > access to * > by dn="userid=cmadmin,dc=bgctv,dc=net,dc=cn" read > by * none > > database bdb > suffix "cn=auditlog" > index reqStart eq > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7825) LMDB: misleading error message
by hyc＠symas.com 08 Jul '14

08 Jul '14

h.b.furuseth(a)usit.uio.no wrote: > 5) Add field MDB_dbx.md_dbiseq = DBI usage sequence number, > incremented when dbi_open creates (not reuses) a DBI and in > dbi_close. Copy it to a new malloced array txn->mt_dbiseqs[] > in write txns, verify it in at least commit and drop. > This means close()-open(same DB) will also be caught, which > seems a good thing since with (4) it will work unreliably: > Only if open() reuses the same DBI for the same DB. This is now fixed in mdb.master, using basically this approach. There is a master array of DBI sequence numbers in the environment and another array in each write transaction. It is verified anywhere the dbx->md_name would get used. The sequence number is incremented in dbi_open and when a handle is closed. Note - it is only checked in write txns, and only a few places (drop, commit, cursor_touch, page_search) ever check. There is a new error code MDB_BAD_DBI as well. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7789) Unreliable mdb_env_set_mapsize()
by hyc＠symas.com 08 Jul '14

08 Jul '14

Hallvard Breien Furuseth wrote: > Should have enclosed a test program. Here: > http://folk.uio.no/hbf/testsize.c > Output: > process #0: open env > process #1: open env > process #0: write txn, mapsize 204800 > process #1: write txn, mapsize 40960 > process #2: open env, write txn, mapsize 40960 > process #3: open env, write txn, mapsize 204800 > > > Summarizing a reply which got sent privately instead of to ITS: > > On 2014-01-24 00:07, Howard Chu wrote: >> The doc says the caller of set_mapsize is required to make sure there >> are no active transactions when it is called. As such, X failed this >> requirement, and this sequence of events is explicitly unsupported. > > No, I'm talking about X changing the mapsize when there is no txn, > then afterwards doing a write txn so the mapsize gets written. > >> If Y doesn't start its write txn until after X finishes, then Y will >> see the new size. > > It doesn't, that's the point. Only txn_commit pays attention, > and it checks the size which existed in the wrong metapage. > > Come to think of it, set_mapsize(); env_open(); txn begin/end > should do the same. Y will either way not pay attention to > the new mapsize. > Fixed now in mdb.master -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7713) Segmentation fault if the pagesize of the Operating system is not equal to 4096.
by hyc＠symas.com 08 Jul '14

08 Jul '14

hyc(a)symas.com wrote: > sumanth wrote: >> As per ur suggestions,tried changing >> >> 1. MDB_PAGESIZE to 65536 >> 2. changing pb_lower and pb_upper to uint32_t. >> As of now it is running fine for the existing testcases in openldap-2.4.36. >> However there were problems in 2.4.35. Also saw the comments in >> openldap-devel. So whether this will make to openldap 2.4.36? > > The current plan is to fix this in OpenLDAP 2.5, and we are now halting new > development in 2.4. > The fix is now available in mdb.master; currently you must compile with -DMDB_DEVEL to enable it. Since this is an incompatible DB format change, you should backup any existing DBs before using this option. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7892) LMDB OS X build issue: ESECT section attribute
by hyc＠symas.com 08 Jul '14

08 Jul '14

batterseapower(a)hotmail.com wrote: > Full_Name: Max Bolingbroke > Version: HEAD > OS: OS X > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (81.111.197.81) > > > Basically this line of mdb.c doesn't work on OS X: Fixed in mdb.master > > #define ESECT __attribute__ ((section("text_env"))) > > You just get an error: "argument to 'section' attribute is not valid for this > target: mach-o section specifier requires a segment and section separated by a > comma" > > I think you need to use this instead on this platform: > > #define ESECT __attribute__ ((section("__TEXT,text_env"))) > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7892) LMDB OS X build issue: ESECT section attribute
by batterseapower＠hotmail.com 08 Jul '14

08 Jul '14

Full_Name: Max Bolingbroke Version: HEAD OS: OS X URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.111.197.81) Basically this line of mdb.c doesn't work on OS X: #define ESECT __attribute__ ((section("text_env"))) You just get an error: "argument to 'section' attribute is not valid for this target: mach-o section specifier requires a segment and section separated by a comma" I think you need to use this instead on this platform: #define ESECT __attribute__ ((section("__TEXT,text_env")))

1 0

(ITS#7891) checking for SQLDriverConnect in -lodbc
by vbvbrj＠gmail.com 03 Jul '14

03 Jul '14

Full_Name: Mimiko Version: 2.4.39 OS: Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.57-3+deb7u2 x86_64 GNU/Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (77.89.245.38) Can not compile OpenLDAP statically. I get this error: configure:21678: checking for SQLDriverConnect in -lodbc configure:21703: cc -o conftest -fPIC -static-libgcc -static -fPIC -I/opt/openssl/include -I/opt/krb5/include -I/opt/zlib/include -Wl,-R,ORIGIN/../lib/../lib/../lib/../lib../lib:ORIGIN/../lib/x86_64-linux-gnu -L/opt/openssl/lib -L/opt/krb5/lib -L/opt/zlib/lib conftest.c -lodbc -pthread >&5 /usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/libodbc.a(_odbcinst_UserINI.o): In function `_odbcinst_UserINI': (.text+0x3b): warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/libodbc.a(SQLCreateDataSource.o): In function `SQLCreateDataSource': (.text+0x301): undefined reference to `lt_dlinit' /usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/libodbc.a(SQLCreateDataSource.o): In function `SQLCreateDataSource': (.text+0x315): undefined reference to `lt_dlsetsearchpath' /usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/libodbc.a(SQLCreateDataSource.o): In function `SQLCreateDataSource': (.text+0x33d): undefined reference to `lt_dlopen' /usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/libodbc.a(SQLCreateDataSource.o): In function `SQLCreateDataSource': (.text+0x355): undefined reference to `lt_dlsym' /usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/libodbc.a(SQLCreateDataSource.o): In function `SQLCreateDataSource': (.text+0x3ee): undefined reference to `lt_dlopen' .... collect2: error: ld returned 1 exit status configure:21703: $? = 1 To resolve this I must supply LIBS='-lltdl -ldl', but ./configure script does not pass this correctly, as this LIBS must be after -lodbc. In configure line 21684 is the line: LIBS="-lodbc $LIBS" It seems that LIBS which I pass to ./configure script does not get there. So I modify ./configure like this: LIBS="-lodbc -lltdl -ldl $LIBS" Please update ./configure script in git to overcome this error without manually modifying script.

1 0

Re: (ITS#7889) rwm overlay causes incorrect acl parsing
by alexoz66＠gmail.com 03 Jul '14

03 Jul '14

Hi Michael, I tried to enable this setting using the following ldif: dn: olcOverlay={0}rwm,olcDatabase={1}mdb,cn=config changetype: modify add: olcRwmDropUnrequested olcRwmDropUnrequested: FALSE but I get the following error: modifying entry "olcOverlay={0}rwm,olcDatabase={1}mdb,cn=config" ldap_modify: Object class violation (65) additional info: attribute 'olcRwmDropUnrequested' not allowed Looking at the schema it seems that the attribute olcRwmDropUnrequested is not part of the olcRwmConfig object class (or any other object class for that matter). On 02/07/2014 08:48 μμ, Michael Ströder wrote: > alexoz66(a)gmail.com wrote: >> When enabling the rwm overlay on a database, even without setting any rewrite >> rules, in certain cases some access rules are not evaluated correctly. > > I did not look into your posting in detail. > > But could you please check whether this setting helps: > > rwm-drop-unrequested-attrs no > > Ciao, Michael. >

1 0

(ITS#7890) Drop support for BDB 6.0.20 and later
by quanah＠OpenLDAP.org 02 Jul '14

02 Jul '14

Full_Name: Quanah Gibson-Mount Version: 2.4.39 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.58.125) Due to licensing changes made to BerkeleyDB by Oracle, it is now incompatible for use with OpenLDAP. Support for BDB 6.0.20 and later should be rejected by configure.

1 0

Re: (ITS#7889) rwm overlay causes incorrect acl parsing
by michael＠stroeder.com 02 Jul '14

02 Jul '14

This is a cryptographically signed message in MIME format. --------------ms010205050403050104070307 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable alexoz66(a)gmail.com wrote: > When enabling the rwm overlay on a database, even without setting any r= ewrite > rules, in certain cases some access rules are not evaluated correctly. I did not look into your posting in detail. But could you please check whether this setting helps: rwm-drop-unrequested-attrs no Ciao, Michael. --------------ms010205050403050104070307 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIFfzCC BXswggNjoAMCAQICAwxOfTANBgkqhkiG9w0BAQUFADB5MRAwDgYDVQQKEwdSb290IENBMR4w HAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNBIENlcnQgU2lnbmlu ZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZzAeFw0xMjEw MDIyMDE3MDlaFw0xNDEwMDIyMDE3MDlaMD8xGDAWBgNVBAMUD01pY2hhZWwgU3Ry9mRlcjEj MCEGCSqGSIb3DQEJARYUbWljaGFlbEBzdHJvZWRlci5jb20wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDo2SKth5GhtaDrCyfGtyUG+/hAAa/J52L0NFN4SSRvTtdGf9HfWwwd NCtgae0TVGWk2lKDbXA9d5vmyIiRhuwxd90H6FLErhRBeB9G67qtw87E8WUoXt2DwPQEUTWV hqHpPadlmgFw3+i3TGQQTe3O3W9MMMd4GJNhObem2VGRuCD37OXnzBksTcq0FPJgcWAhe3d/ 0ItOkNWBqgq8Mf3p7WFBhaQ0a27BC/mKtH8fI3kPcS305imPRja69Msq3EwUZBc9ToVp6FRQ NYKjfOBybDUzVkmRZl3H8xutQP2w8Zxb8m5f7Q1BfLLrIFScfYvIDgOERxTCd4lab8+/09XH AgMBAAGjggFEMIIBQDAMBgNVHRMBAf8EAjAAMFYGCWCGSAGG+EIBDQRJFkdUbyBnZXQgeW91 ciBvd24gY2VydGlmaWNhdGUgZm9yIEZSRUUgaGVhZCBvdmVyIHRvIGh0dHA6Ly93d3cuQ0Fj ZXJ0Lm9yZzAOBgNVHQ8BAf8EBAMCA6gwQAYDVR0lBDkwNwYIKwYBBQUHAwQGCCsGAQUFBwMC BgorBgEEAYI3CgMEBgorBgEEAYI3CgMDBglghkgBhvhCBAEwMgYIKwYBBQUHAQEEJjAkMCIG CCsGAQUFBzABhhZodHRwOi8vb2NzcC5jYWNlcnQub3JnMDEGA1UdHwQqMCgwJqAkoCKGIGh0 dHA6Ly9jcmwuY2FjZXJ0Lm9yZy9yZXZva2UuY3JsMB8GA1UdEQQYMBaBFG1pY2hhZWxAc3Ry b2VkZXIuY29tMA0GCSqGSIb3DQEBBQUAA4ICAQC9ouXq3p/bDWMM4tBKgD3tl4HY5H0eECl8 q9/nqk0UL6YeWkrCiQdrDtNPW7DcGqNYtzdgtzmyTr1GhiAX+igrOjdk/ge5NRcQOpONK/4b zrmpQEcIUyxSSDKLWh211/kcFfxxLEiJ5teF4GL8Fc1qbrLP4+DCvJXWfYaaR5NLjZMqm2VP yKTv3qpXWnGohiRkGTwS/11QM2XCfIGdRsQT9a8mO4m2fn2tGPp2TEIoCLrDDrbGVeDWaOWB OIeTrp4wa3Q4OI6yCptJhEqKvjhV96IBRYgM76nTBqsqnDzwxExAyhhWiUS5DunRHOr/+NyF pUpD4883RBLO0g9kUEGOhtZNF1u+8zEL0YgMGvifAom9JEklLOXZuqj0MThypKs/3d/OyOQb 4gURnu6oZwcKZ7LskytWnlRKUxF6o0A8grtmyKkqe14TS7cQbg0NTaIYXPkHR+dfFmb3uEqn BBjvpJXFcEtWI2lQXC/ET+au991pK797ExBOmpQwjIn3SjiW80vw/UoL6DMvqY/6JhVhyNTP MJ2W5AX5kc27DIbVtVGZs8J4AYhuNALJUq9N9Ka7rPRj3RcYDrfehDLOkM5iMnarpmtuOpLK d1SvZhqj/0N/JWGIDpPSTkTFOPP6ZN9I9Rqyf+9NGqb2sjo4DkIiZcHxt735/GJLwus5KLBl 2DGCA6EwggOdAgEBMIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93 d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8G CSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMMTn0wCQYFKw4DAhoFAKCCAfUwGAYJ KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTQwNzAyMTc0ODQxWjAj BgkqhkiG9w0BCQQxFgQUE4MHle0RyplcgMVd5hu9mz/RV4MwbAYJKoZIhvcNAQkPMV8wXTAL BglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBkQYJKwYBBAGCNxAEMYGD MIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9y ZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS c3VwcG9ydEBjYWNlcnQub3JnAgMMTn0wgZMGCyqGSIb3DQEJEAILMYGDoIGAMHkxEDAOBgNV BAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNl cnQub3JnAgMMTn0wDQYJKoZIhvcNAQEBBQAEggEAV/EKe7P7+g4bTiu9Rrr+3cxNkzm454+/ bM9YZqssuW1Hgn67KbwDvDn3PydPCa7vtw0XKjgnI+RtaJg3077qva8wCheE0U3c16e4Aj8+ J6llfig38qrU2Jfu3J2MPHIzx5aBdLxst2sr8gaLoPihZQJewspn6PHD6Sorce8JQf1lI2Je 9/Qzb1CvGXQ/2GEfdokx/cA381cYug12yLkYKHexx5x09YKvMKOvC/ZhD9rLtuURS/Bhk/lf 62GMt7aIF2YH8xx5fOKv2pFD9LNqkA/jq3o4iDLxsd4OsQhtjgsMzKfVkRbyGKjA71aoJXCE Z87gtOZ6MVu6oeUk+DneIgAAAAAAAA== --------------ms010205050403050104070307--

1 0

(ITS#7889) rwm overlay causes incorrect acl parsing
by alexoz66＠gmail.com 02 Jul '14

02 Jul '14

Full_Name: John Alex. Version: 2.4.39 OS: FreeBSD 9.2-RELEASE URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (62.1.253.119) When enabling the rwm overlay on a database, even without setting any rewrite rules, in certain cases some access rules are not evaluated correctly. My test configuration (without the cn=schema,cn=config entries): dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf olcConfigDir: slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcLogLevel: stats acl olcPidFile: /var/run/openldap/slapd.pid olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/local/libexec/openldap olcModuleLoad: {0}back_mdb dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by * break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcSchemaDN: cn=Subschema dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage olcAddContentAcl: TRUE olcRootDN: cn=admin,cn=config olcRootPW:: dGVzdDEyMw== dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/db/openldap-data/main olcSuffix: dc=example,dc=com olcRootDN: cn=admin,dc=example,dc=com olcDbIndex: objectClass eq olcDbIndex: ou,uid eq olcDbMaxSize: 4294967296 olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by * break olcAccess: {1}to dn.one="ou=people,dc=example,dc=com" filter="(ou=someunit)" a ttrs=userPassword by * none olcAccess: {2}to dn.subtree="ou=people,dc=example,dc=com" by dn.base="cn=suser ,ou=admins,dc=example,dc=com" read by * break olcAccess: {3}to attrs=userPassword by anonymous auth olcAccess: {4}to dn.base="dc=example,dc=com" by * read olcAccess: {5}to dn.subtree="ou=people,dc=example,dc=com" by * read olcRootPW:: dGVzdDEyMw== dn: olcOverlay={0}rwm,olcDatabase={1}mdb,cn=config objectClass: olcRwmConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}rwm ------------------------------------------------- And the contents of the main db: dn: dc=example,dc=com objectClass: organization objectClass: top objectClass: dcObject dc: example o: example.com dn: ou=admins,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: admins dn: ou=people,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: people dn: cn=suser,ou=admins,dc=example,dc=com sn: - cn: suser objectClass: person objectClass: top userPassword:: dGVzdDEyMw== dn: uid=jdoe,ou=people,dc=example,dc=com uid: jdoe sn: Doe cn: John Doe objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top ou: someunit userPassword:: dGVzdDEyMw== ------------------------------------------------- The above rules should not allow anyone but the local root user access to the userPassword attribute of entries under "ou=people,dc=example,dc=com" that match the filter (ou=someunit). slapacl confirms that for user 'suser': % slapacl -F /usr/local/etc/openldap/slapd.d/ -v -D "cn=suser,ou=admins,dc=example,dc=com" -b "uid=jdoe,ou=people,dc=example,dc=com" authcDN: "cn=suser,ou=admins,dc=example,dc=com" entry: read(=rscxd) children: read(=rscxd) uid=jdoe: read(=rscxd) sn=Doe: read(=rscxd) cn=John Doe: read(=rscxd) objectClass=inetOrgPerson: read(=rscxd) objectClass=organizationalPerson: read(=rscxd) objectClass=person: read(=rscxd) objectClass=top: read(=rscxd) structuralObjectClass=inetOrgPerson: read(=rscxd) entryUUID=a6478f94-80df-1033-8692-c5a9d2143987: read(=rscxd) creatorsName=cn=admin,dc=example,dc=com: read(=rscxd) createTimestamp=20140605092934Z: read(=rscxd) ou=someunit: read(=rscxd) userPassword=****: none(=0) entryCSN=20140605093709.772129Z#000000#000#000000: read(=rscxd) modifiersName=cn=admin,dc=example,dc=com: read(=rscxd) modifyTimestamp=20140605093709Z: read(=rscxd) % slapacl -F /usr/local/etc/openldap/slapd.d/ -v -D "cn=suser,ou=admins,dc=example,dc=com" -b "uid=jdoe,ou=people,dc=example,dc=com" userPassword/read authcDN: "cn=suser,ou=admins,dc=example,dc=com" read access to userPassword: DENIED ------------------------------------------------- Requesting all attributes of the entry "uid=jdoe,ou=people,dc=example,dc=com" yields the expected result: % ldapsearch -LLL -H ldapi:/// -D "cn=suser,ou=admins,dc=example,dc=com" -W -x -b "ou=people,dc=example,dc=com" "uid=jdoe" dn: uid=jdoe,ou=people,dc=example,dc=com uid: jdoe sn: Doe cn: John Doe objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top ou: someunit However, when requesting the userPassword attribute explicitly, the rule that blocks access to that attribute is somehow ignored: % ldapsearch -LLL -H ldapi:/// -D "cn=suser,ou=admins,dc=example,dc=com" -W -x -b "ou=people,dc=example,dc=com" "uid=jdoe" "userPassword" dn: uid=jdoe,ou=people,dc=example,dc=com userPassword:: dGVzdDEyMw== ------------------------------------------------- Removing either the "filter=(ou=someunit)" or the "attrs=userPassword" part of the corresponding rule results in correct parsing of the ACL in the above cases, but in order for the full rule to work, I had to remove the rwm overlay configuration completely (setting "rwm-rewriteEngine off" did not make a difference). # /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.39 (May 9 2014 09:26:03) $

1 0

(ITS#7888) client configuration---openldap n-way multi-master replication
by idpbg-it-dba＠mail.foxconn.com 30 Jun '14

30 Jun '14

Full_Name: Robert.YQ.Feng Version: 2.4.23-31 OS: redhat linux 6.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (218.29.136.228) Hi man: Who can do me a big favor, I has been configuration my LDAP Server with N-way multi-master Mode. The syncronization working good with eachother in 4 masters. My issue is How to right configuration the client's URI and to let my LDAP client have tow ldapservers and to guarantee the authentication have redundancy . Best regards. Robert.YQ.Feng

1 0

Re: (ITS#7877) please make gcrypt optional with newer gnutls
by hyc＠symas.com 30 Jun '14

30 Jun '14

ryan(a)nardis.ca wrote: > On Mon, Jun 30, 2014 at 5:05 AM, Howard Chu <hyc(a)symas.com> wrote: >> The only reason GnuTLS support exists in OpenLDAP is because of Debian. >> Therefore, if Debian no longer uses libgcrypt, I'm happy to rip all of that >> crap out. > > Sounds good to me. So a patch that removes gcrypt entirely looks like: > > ftp://ftp.openldap.org/incoming/20140630_rtandy_0001-ITS-7877-use-nettle-in… > > (I assume the explicit threading setup is important, if not maybe the > gnutls_global_set_mutex part could be removed too...) > > That requires gnutls 2.12.0 or newer, so then I think we can also > remove the compatibility code for older versions: > > ftp://ftp.openldap.org/incoming/20140630_rtandy_0002-assume-gnutls-provides… > ftp://ftp.openldap.org/incoming/20140630_rtandy_0003-assume-gnutls-is-at-le… > >> Just tell us at which version of GnuTLS you switched to nettle and we'll make >> that the minimum supported version. > > Debian builds gnutls with nettle starting from 3.0.0. The API used in > tls_g.c is all backend agnostic though. I tried with 2.12.20 (with > gcrypt backend) and everything looks fine in slapd and clients > including the threading setup. I think 2.12.0 as minimum version would > be fine, and then nettle vs gcrypt only matters for smbk5pwd users. > > Thanks for considering my patches. Committed to master. I've also added a check for 2.12.0 to the configure script. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7877) please make gcrypt optional with newer gnutls
by ryan＠nardis.ca 30 Jun '14

30 Jun '14

On Mon, Jun 30, 2014 at 5:05 AM, Howard Chu <hyc(a)symas.com> wrote: > The only reason GnuTLS support exists in OpenLDAP is because of Debian. > Therefore, if Debian no longer uses libgcrypt, I'm happy to rip all of that > crap out. Sounds good to me. So a patch that removes gcrypt entirely looks like: ftp://ftp.openldap.org/incoming/20140630_rtandy_0001-ITS-7877-use-nettle-in… (I assume the explicit threading setup is important, if not maybe the gnutls_global_set_mutex part could be removed too...) That requires gnutls 2.12.0 or newer, so then I think we can also remove the compatibility code for older versions: ftp://ftp.openldap.org/incoming/20140630_rtandy_0002-assume-gnutls-provides… ftp://ftp.openldap.org/incoming/20140630_rtandy_0003-assume-gnutls-is-at-le… > Just tell us at which version of GnuTLS you switched to nettle and we'll make > that the minimum supported version. Debian builds gnutls with nettle starting from 3.0.0. The API used in tls_g.c is all backend agnostic though. I tried with 2.12.20 (with gcrypt backend) and everything looks fine in slapd and clients including the threading setup. I think 2.12.0 as minimum version would be fine, and then nettle vs gcrypt only matters for smbk5pwd users. Thanks for considering my patches.

1 0

Re: (ITS#7877) please make gcrypt optional with newer gnutls
by hyc＠symas.com 30 Jun '14

30 Jun '14

hyc(a)symas.com wrote: > ryan(a)nardis.ca wrote: >> Full_Name: Ryan Tandy >> Version: HEAD >> OS: Debian unstable >> URL: >> Submission from: (NULL) (142.32.208.235) >> The following changes make gcrypt optional for libldap. For versions where both >> nettle and gcrypt are supported, I assume the default since no mechanism is >> provided for detecting which is actually in use. > > Yet another flaw in GnuTLS design... > >> Tested with GnuTLS 2.8.6 and >> 3.2.15. Just tell us at which version of GnuTLS you switched to nettle and we'll make that the minimum supported version. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7877) please make gcrypt optional with newer gnutls
by hyc＠symas.com 30 Jun '14

30 Jun '14

ryan(a)nardis.ca wrote: > Full_Name: Ryan Tandy > Version: HEAD > OS: Debian unstable > URL: > Submission from: (NULL) (142.32.208.235) > > > Debian bug report: https://bugs.debian.org/745231 > > Quoting Andreas Metzler: > > "given that gmp has been dual-licensed LGPLv3+/GPLv2+ it should be possible to > switch openldap over to the newer version of gnutls. > > Upstream's 0205e83f4670d10ad3c6ae4b8fc5ec1d0c7020c0 lets the Debian package > build successfully (including testsuite). The only reason GnuTLS support exists in OpenLDAP is because of Debian. Therefore, if Debian no longer uses libgcrypt, I'm happy to rip all of that crap out. There's no reason for us to even keep optional support for it because that gives the mistaken impression that we endorse its use. Which we most vehemently do not. > However even with patch there is still some work to be done. > libraries/libldap/tls_g.c has some gcrypt related code that should be simply > unnecessary with gnutls3, therefore it should not link against libgcrypt either. > (Except for contrib/slapd-modules/smbk5pwd/smbk5pwd.c)." > > The following changes make gcrypt optional for libldap. For versions where both > nettle and gcrypt are supported, I assume the default since no mechanism is > provided for detecting which is actually in use. Yet another flaw in GnuTLS design... > Tested with GnuTLS 2.8.6 and > 3.2.15. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7885) [PATCH] wrong RPATH in contrib/passwd/Makefile
by hyc＠symas.com 30 Jun '14

30 Jun '14

ryan(a)nardis.ca wrote: > Full_Name: Ryan Tandy > Version: master > OS: Debian unstable > URL: > Submission from: (NULL) (24.68.121.206) > > > Similar to #7858, another easy patch. Thanks, committed to master. > > >>From 3047469eb717018e5b292352626cd084477faf12 Mon Sep 17 00:00:00 2001 > From: Ryan Tandy <ryan(a)nardis.ca> > Date: Fri, 27 Jun 2014 11:15:26 -0700 > Subject: [PATCH] fix contrib/passwd RPATH > > --- > contrib/slapd-modules/passwd/Makefile | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/contrib/slapd-modules/passwd/Makefile > b/contrib/slapd-modules/passwd/Makefile > index ba41304..c240366 100644 > --- a/contrib/slapd-modules/passwd/Makefile > +++ b/contrib/slapd-modules/passwd/Makefile > @@ -33,19 +33,19 @@ all: $(PROGRAMS) > > pw-kerberos.la: kerberos.lo > $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ > - -rpath $(PREFIX)/lib -module -o $@ $? -lkrb5 > + -rpath $(moduledir) -module -o $@ $? -lkrb5 > > pw-netscape.la: netscape.lo > $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ > - -rpath $(PREFIX)/lib -module -o $@ $? > + -rpath $(moduledir) -module -o $@ $? > > pw-radius.la: radius.lo > $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ > - -rpath $(PREFIX)/lib -module -o $@ $? -lradius > + -rpath $(moduledir) -module -o $@ $? -lradius > > pw-apr1.la: apr1.lo > $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ > - -rpath $(PREFIX)/lib -module -o $@ $? > + -rpath $(moduledir) -module -o $@ $? > > clean: > rm -rf *.o *.lo *.la .libs > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#7884 Not able to communicate with secure ldap
by hyc＠symas.com 30 Jun '14

30 Jun '14

The version of OpenLDAP you're using is 6 years old and no longer supported by the OpenLDAP Project. The configuration you're using is invalid, read the ldap.conf(5) manpage. There is no bug in OpenLDAP Software here, this ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7886) mdb_ovpage_free() can break mdb_copy
by hyc＠symas.com 30 Jun '14

30 Jun '14

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: LMDB_0.9.13 > OS: Linux x86_64 > URL: > Submission from: (NULL) (81.191.45.35) > Submitted by: hallvard > > > Allocate an ovpage from mt_next_pgno, mdb_ovpage_free() it > and commit: The datafile may end before MDB_meta.mm_last_pg > since the ovpage was never written. mdb_env_copyfd() & co > break when they read the file to mm_last_pg. fixed in mdb.master > > Same with loose pages if mdb_page_flush() skipped them, > which it could: ecde3a4008f5080d8264926f49680db27804787f > in my branch mdb/loose3. > > Bug demo: > > rm data.mdb; ./a.out && ./mdb_copy . > copy.mdb > ./mdb_copy: copying failed, error 14 (Bad address) > > (Piping it to /dev/null succeeds on Linux, apparently > it doesn't read anything.) > > #include "lmdb.h" > #include <stdio.h> > #include <stdlib.h> > #define E(expr) CHECK((rc = (expr)) == MDB_SUCCESS, #expr) > #define CHECK(test, msg) ((test) ? (void)0 : ((void)fprintf(stderr, \ > "%s:%d: %s: %s\n", __FILE__, __LINE__, msg, mdb_strerror(rc)), abort())) > > int main(void) > { > int rc; > unsigned sz; > MDB_env *env; > MDB_txn *txn; > MDB_dbi dbi; > static char buf[20000]; > E(mdb_env_create(&env)); > E(mdb_env_open(env, ".", 0, 0664)); > for (sz = 0; sz<=sizeof(buf); sz = (sz==2 ? sizeof(buf) : sz+1)) { > E(mdb_txn_begin(env, NULL, 0, &txn)); > E(mdb_dbi_open(txn, NULL, 0, &dbi)); > E(mdb_put(txn, dbi, &(MDB_val){4,&sz}, &(MDB_val){sz,buf}, 0)); > if (sz) > E(mdb_del(txn, dbi, &(MDB_val){4,&sz}, NULL)); > E(mdb_txn_commit(txn)); > } > mdb_env_close(env); > return 0; > } > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7887) mkrelease breaks on building guide.html
by hyc＠symas.com 30 Jun '14

30 Jun '14

openldap(a)semyon.org wrote: > Full_Name: Semyon Chaichenets > Version: 2.4.39 > OS: Linux 3.2.0-64-generic #97-Ubuntu SMP Wed Jun 4 22:04:21 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux > URL: https://gist.githubusercontent.com/leveche/307be9cb9de55c4085d8/raw/9a1ce68… > Submission from: (NULL) (69.165.226.82) > > > Trivial typo in doc/guide/admin/install.sdf breaks mkrelease in current HEAD > (f6eacdb). Trivial fix included. > > Fixed now in master, thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7887) mkrelease breaks on building guide.html
by openldap＠semyon.org 29 Jun '14

29 Jun '14

Full_Name: Semyon Chaichenets Version: 2.4.39 OS: Linux 3.2.0-64-generic #97-Ubuntu SMP Wed Jun 4 22:04:21 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux URL: https://gist.githubusercontent.com/leveche/307be9cb9de55c4085d8/raw/9a1ce68… Submission from: (NULL) (69.165.226.82) Trivial typo in doc/guide/admin/install.sdf breaks mkrelease in current HEAD (f6eacdb). Trivial fix included.

1 0

(ITS#7886) mdb_ovpage_free() can break mdb_copy
by h.b.furuseth＠usit.uio.no 28 Jun '14

28 Jun '14

Full_Name: Hallvard B Furuseth Version: LMDB_0.9.13 OS: Linux x86_64 URL: Submission from: (NULL) (81.191.45.35) Submitted by: hallvard Allocate an ovpage from mt_next_pgno, mdb_ovpage_free() it and commit: The datafile may end before MDB_meta.mm_last_pg since the ovpage was never written. mdb_env_copyfd() & co break when they read the file to mm_last_pg. Same with loose pages if mdb_page_flush() skipped them, which it could: ecde3a4008f5080d8264926f49680db27804787f in my branch mdb/loose3. Bug demo: rm data.mdb; ./a.out && ./mdb_copy . > copy.mdb ./mdb_copy: copying failed, error 14 (Bad address) (Piping it to /dev/null succeeds on Linux, apparently it doesn't read anything.) #include "lmdb.h" #include <stdio.h> #include <stdlib.h> #define E(expr) CHECK((rc = (expr)) == MDB_SUCCESS, #expr) #define CHECK(test, msg) ((test) ? (void)0 : ((void)fprintf(stderr, \ "%s:%d: %s: %s\n", __FILE__, __LINE__, msg, mdb_strerror(rc)), abort())) int main(void) { int rc; unsigned sz; MDB_env *env; MDB_txn *txn; MDB_dbi dbi; static char buf[20000]; E(mdb_env_create(&env)); E(mdb_env_open(env, ".", 0, 0664)); for (sz = 0; sz<=sizeof(buf); sz = (sz==2 ? sizeof(buf) : sz+1)) { E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_dbi_open(txn, NULL, 0, &dbi)); E(mdb_put(txn, dbi, &(MDB_val){4,&sz}, &(MDB_val){sz,buf}, 0)); if (sz) E(mdb_del(txn, dbi, &(MDB_val){4,&sz}, NULL)); E(mdb_txn_commit(txn)); } mdb_env_close(env); return 0; }

1 0

(ITS#7885) [PATCH] wrong RPATH in contrib/passwd/Makefile
by ryan＠nardis.ca 27 Jun '14

27 Jun '14

Full_Name: Ryan Tandy Version: master OS: Debian unstable URL: Submission from: (NULL) (24.68.121.206) Similar to #7858, another easy patch. >From 3047469eb717018e5b292352626cd084477faf12 Mon Sep 17 00:00:00 2001 From: Ryan Tandy <ryan(a)nardis.ca> Date: Fri, 27 Jun 2014 11:15:26 -0700 Subject: [PATCH] fix contrib/passwd RPATH --- contrib/slapd-modules/passwd/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/contrib/slapd-modules/passwd/Makefile b/contrib/slapd-modules/passwd/Makefile index ba41304..c240366 100644 --- a/contrib/slapd-modules/passwd/Makefile +++ b/contrib/slapd-modules/passwd/Makefile @@ -33,19 +33,19 @@ all: $(PROGRAMS) pw-kerberos.la: kerberos.lo $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ - -rpath $(PREFIX)/lib -module -o $@ $? -lkrb5 + -rpath $(moduledir) -module -o $@ $? -lkrb5 pw-netscape.la: netscape.lo $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ - -rpath $(PREFIX)/lib -module -o $@ $? + -rpath $(moduledir) -module -o $@ $? pw-radius.la: radius.lo $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ - -rpath $(PREFIX)/lib -module -o $@ $? -lradius + -rpath $(moduledir) -module -o $@ $? -lradius pw-apr1.la: apr1.lo $(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \ - -rpath $(PREFIX)/lib -module -o $@ $? + -rpath $(moduledir) -module -o $@ $? clean: rm -rf *.o *.lo *.la .libs -- 2.0.0

1 0

Re: (ITS#7851) [PATCH] buffer overrun in password checkers with malformed hash
by ryan＠nardis.ca 26 Jun '14

26 Jun '14

This is a multi-part message in MIME format. --------------070104060109070008020807 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit I checked the new pw-pbkdf2 module. It doesn't appear to be affected by this problem. On 11/05/14 07:56 PM, Ryan Tandy wrote: > ftp://ftp.openldap.org/incoming/rtandy_20140511_fix-passwd-b64-buffer_v2.pa… You probably know this, but just in case it helps: "git am --keep-cr" is the way to apply that patch, because of apr1.c's line endings. There's a second bug in slapd-sha2.c, a missing cast causing the return value of lutil_b64_pton to be ignored. The built-in checkers already have the appropriate cast. Patch attached. --------------070104060109070008020807 Content-Type: text/x-patch; name="0002-ITS-7851-contrib-pw-sha2-fix-int-size_t-comparison.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename*0="0002-ITS-7851-contrib-pw-sha2-fix-int-size_t-comparison.patc"; filename*1="h" >From 0683ded766e51e0521991fc1a5d2303cf95cc475 Mon Sep 17 00:00:00 2001 From: Ryan Tandy <ryan(a)nardis.ca> Date: Thu, 26 Jun 2014 18:33:29 -0700 Subject: [PATCH 2/2] ITS#7851 contrib pw-sha2 fix int/size_t comparison --- contrib/slapd-modules/passwd/sha2/slapd-sha2.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contrib/slapd-modules/passwd/sha2/slapd-sha2.c b/contrib/slapd-modules/passwd/sha2/slapd-sha2.c index 1ec7989..2e4fcb0 100644 --- a/contrib/slapd-modules/passwd/sha2/slapd-sha2.c +++ b/contrib/slapd-modules/passwd/sha2/slapd-sha2.c @@ -244,7 +244,7 @@ static int chk_ssha256( rc = lutil_b64_pton(passwd->bv_val, orig_pass, decode_len); - if( rc <= sizeof(SHAdigest) ) { + if( rc <= (int)(sizeof(SHAdigest)) ) { ber_memfree(orig_pass); return LUTIL_PASSWD_ERR; } @@ -332,7 +332,7 @@ static int chk_ssha384( rc = lutil_b64_pton(passwd->bv_val, orig_pass, decode_len); - if( rc <= sizeof(SHAdigest) ) { + if( rc <= (int)(sizeof(SHAdigest)) ) { ber_memfree(orig_pass); return LUTIL_PASSWD_ERR; } @@ -420,7 +420,7 @@ static int chk_ssha512( rc = lutil_b64_pton(passwd->bv_val, orig_pass, decode_len); - if( rc <= sizeof(SHAdigest) ) { + if( rc <= (int)(sizeof(SHAdigest)) ) { ber_memfree(orig_pass); return LUTIL_PASSWD_ERR; } -- 2.0.0 --------------070104060109070008020807--

1 0

Re: (ITS#7878) OpenLDAP MinGW Build Problem
by ron＠zytrax.com 26 Jun '14

26 Jun '14

Additional Information re ITS#7878 omitted from original report: The build did not (correctly) auto-detect either Openssl or SASL which may make it a pretty unusual build case. On 20/06/2014 4:44 PM, openldap-its(a)OpenLDAP.org wrote: > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** > > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7878. > > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. > > If you need to provide additional information in regards to your > issue report, you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7878) > in the subject will automatically be attached to the issue report. > > mailto:openldap-its@openldap.org?subject=(ITS#7878) > > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=7878 > > Please remember to retain your issue tracking number (ITS#7878) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. > > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. > > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ > > -------------- > Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved. > > -- Ron Aitchison www.zytrax.com ZYTRAX ron(a)zytrax.com tel: 514-315-4296 Suite 22 6201 Chemin Cote St. Luc Hampstead QC H3X 2H2 Canada Author: Pro DNS and BIND (Apress) ISBN 1-59059-494-0

1 0

Re: (ITS#7877) please make gcrypt optional with newer gnutls
by ryan＠nardis.ca 23 Jun '14

23 Jun '14

On Fri, Jun 20, 2014 at 5:23 PM, Ryan Tandy <ryan(a)nardis.ca> wrote: > This might be a better patch, if the build system change is acceptable. As usual, I can't get anything right on the first try. That one was missing a line (but apparently not one that stopped it from building or working); and besides that I'm not supposed to be attaching these in the first place, right? Proper patch series against current master: ftp://ftp.openldap.org/incoming/20140623-rtandy-0001-ITS-7877-detect-whethe… ftp://ftp.openldap.org/incoming/20140623-rtandy-0002-ITS-7877-support-nettl… Sorry for the noise, administer cluehammer as necessary...

1 0

Re: (ITS#7877) please make gcrypt optional with newer gnutls
by ryan＠nardis.ca 23 Jun '14

23 Jun '14

--047d7bdc8ac419e30c04fc856540 Content-Type: text/plain; charset=UTF-8 And here are the changes for smbk5pwd. Tried to use gnutls' own api since it abstracts gcrypt/nettle, but sadly it doesn't provide md4, so nettle it is. Note this patch assumes the HAVE_GNUTLS_GCRYPT define from the configure addition in the previous patch. --047d7bdc8ac419e30c04fc856540 Content-Type: text/x-patch; charset=US-ASCII; name="0001-ITS-7877-support-nettle-in-smbk5pwd.patch" Content-Disposition: attachment; filename="0001-ITS-7877-support-nettle-in-smbk5pwd.patch" Content-Transfer-Encoding: base64 X-Attachment-Id: f_hws5388e1 RnJvbSAwMTU3Nzc4OTM3NTZiMjEwZGVlN2Q0MDA2ZWM0ZGVmMDEwMTQ0NTE2IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBSeWFuIFRhbmR5IDxyeWFuQG5hcmRpcy5jYT4KRGF0ZTogTW9u LCAyMyBKdW4gMjAxNCAxMToxOToyNiAtMDcwMApTdWJqZWN0OiBbUEFUQ0hdIElUUyM3ODc3IHN1 cHBvcnQgbmV0dGxlIGluIHNtYms1cHdkCgotLS0KIGNvbnRyaWIvc2xhcGQtbW9kdWxlcy9zbWJr NXB3ZC9zbWJrNXB3ZC5jIHwgMzAgKysrKysrKysrKysrKysrKysrKysrKysrKystLS0tCiAxIGZp bGUgY2hhbmdlZCwgMjYgaW5zZXJ0aW9ucygrKSwgNCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQg YS9jb250cmliL3NsYXBkLW1vZHVsZXMvc21iazVwd2Qvc21iazVwd2QuYyBiL2NvbnRyaWIvc2xh cGQtbW9kdWxlcy9zbWJrNXB3ZC9zbWJrNXB3ZC5jCmluZGV4IDA3NWNlODguLjZjMDAzMDEgMTAw NjQ0Ci0tLSBhL2NvbnRyaWIvc2xhcGQtbW9kdWxlcy9zbWJrNXB3ZC9zbWJrNXB3ZC5jCisrKyBi L2NvbnRyaWIvc2xhcGQtbW9kdWxlcy9zbWJrNXB3ZC9zbWJrNXB3ZC5jCkBAIC02Niw4ICs2Niwx NSBAQCBzdGF0aWMgT2JqZWN0Q2xhc3MgKm9jX2tyYjVLRENFbnRyeTsKIAogI2lmZGVmIERPX1NB TUJBCiAjaWZkZWYgSEFWRV9HTlVUTFMKLSNpbmNsdWRlIDxnY3J5cHQuaD4KIHR5cGVkZWYgdW5z aWduZWQgY2hhciBERVNfY2Jsb2NrWzhdOworI2lmZGVmIEhBVkVfR05VVExTX0dDUllQVAorI2lu Y2x1ZGUgPGdjcnlwdC5oPgorI2Vsc2UKKy8qIGFzc3VtZSBnbnV0bHMgJiYgIWdjcnlwdCA9PiBu ZXR0bGUgKi8KKyNkZWZpbmUgSEFWRV9HTlVUTFNfTkVUVExFIDEKKyNpbmNsdWRlIDxuZXR0bGUv ZGVzLmg+CisjaW5jbHVkZSA8bmV0dGxlL21kNC5oPgorI2VuZGlmCiAjZWxpZiBIQVZFX09QRU5T U0wKICNpbmNsdWRlIDxvcGVuc3NsL2Rlcy5oPgogI2luY2x1ZGUgPG9wZW5zc2wvbWQ0Lmg+CkBA IC0xOTIsMTIgKzE5OSwxNCBAQCBzdGF0aWMgdm9pZCBsbWhhc2goCiAJREVTX2NibG9jayBoYnVm WzJdOwogI2lmZGVmIEhBVkVfT1BFTlNTTAogCURFU19rZXlfc2NoZWR1bGUgc2NoZWR1bGU7Ci0j ZWxpZiBkZWZpbmVkKEhBVkVfR05VVExTKQorI2VsaWYgZGVmaW5lZChIQVZFX0dOVVRMU19HQ1JZ UFQpCiAJZ2NyeV9jaXBoZXJfaGRfdCBoID0gTlVMTDsKIAlnY3J5X2Vycm9yX3QgZXJyOwogCiAJ ZXJyID0gZ2NyeV9jaXBoZXJfb3BlbiggJmgsIEdDUllfQ0lQSEVSX0RFUywgR0NSWV9DSVBIRVJf TU9ERV9DQkMsIDAgKTsKIAlpZiAoIGVyciApIHJldHVybjsKKyNlbGlmIGRlZmluZWQoSEFWRV9H TlVUTFNfTkVUVExFKQorCXN0cnVjdCBkZXNfY3R4IGN0eDsKICNlbmRpZgogCiAJc3RybmNweSgg VWNhc2VQYXNzd29yZCwgcGFzc3dkLT5idl92YWwsIDE0ICk7CkBAIC0yMDUsNyArMjE0LDcgQEAg c3RhdGljIHZvaWQgbG1oYXNoKAogCWxkYXBfcHZ0X3N0cjJ1cHBlciggVWNhc2VQYXNzd29yZCAp OwogCiAJbG1QYXNzd2RfdG9fa2V5KCBVY2FzZVBhc3N3b3JkLCAma2V5ICk7Ci0jaWZkZWYgSEFW RV9HTlVUTFMKKyNpZmRlZiBIQVZFX0dOVVRMU19HQ1JZUFQKIAllcnIgPSBnY3J5X2NpcGhlcl9z ZXRrZXkoIGgsICZrZXksIHNpemVvZihrZXkpICk7CiAJaWYgKCBlcnIgPT0gMCApIHsKIAkJZXJy ID0gZ2NyeV9jaXBoZXJfZW5jcnlwdCggaCwgJmhidWZbMF0sIHNpemVvZihrZXkpLCAmU3RkVGV4 dCwgc2l6ZW9mKGtleSkgKTsKQEAgLTIxOSw2ICsyMjgsMTMgQEAgc3RhdGljIHZvaWQgbG1oYXNo KAogCQl9CiAJCWdjcnlfY2lwaGVyX2Nsb3NlKCBoICk7CiAJfQorI2VsaWYgZGVmaW5lZChIQVZF X0dOVVRMU19ORVRUTEUpCisJZGVzX3NldF9rZXkoICZjdHgsICZrZXkgKTsKKwlkZXNfZW5jcnlw dCggJmN0eCwgc2l6ZW9mKGtleSksICZoYnVmWzBdLCAmU3RkVGV4dCApOworCisJbG1QYXNzd2Rf dG9fa2V5KCAmVWNhc2VQYXNzd29yZFs3XSwgJmtleSApOworCWRlc19zZXRfa2V5KCAmY3R4LCAm a2V5ICk7CisJZGVzX2VuY3J5cHQoICZjdHgsIHNpemVvZihrZXkpLCAmaGJ1ZlsxXSwgJlN0ZFRl eHQgKTsKICNlbGlmIGRlZmluZWQoSEFWRV9PUEVOU1NMKQogCWRlc19zZXRfa2V5X3VuY2hlY2tl ZCggJmtleSwgc2NoZWR1bGUgKTsKIAlkZXNfZWNiX2VuY3J5cHQoICZTdGRUZXh0LCAmaGJ1Zlsw XSwgc2NoZWR1bGUgLCBERVNfRU5DUllQVCApOwpAQCAtMjQzLDYgKzI1OSw4IEBAIHN0YXRpYyB2 b2lkIG50aGFzaCgKIAljaGFyIGhidWZbSEFTSExFTl07CiAjaWZkZWYgSEFWRV9PUEVOU1NMCiAJ TUQ0X0NUWCBjdHg7CisjZWxpZiBkZWZpbmVkKEhBVkVfR05VVExTX05FVFRMRSkKKwlzdHJ1Y3Qg bWQ0X2N0eCBjdHg7CiAjZW5kaWYKIAogCWlmIChwYXNzd2QtPmJ2X2xlbiA+IE1BWF9QV0xFTioy KQpAQCAtMjUyLDggKzI3MCwxMiBAQCBzdGF0aWMgdm9pZCBudGhhc2goCiAJTUQ0X0luaXQoICZj dHggKTsKIAlNRDRfVXBkYXRlKCAmY3R4LCBwYXNzd2QtPmJ2X3ZhbCwgcGFzc3dkLT5idl9sZW4g KTsKIAlNRDRfRmluYWwoICh1bnNpZ25lZCBjaGFyICopaGJ1ZiwgJmN0eCApOwotI2VsaWYgZGVm aW5lZChIQVZFX0dOVVRMUykKKyNlbGlmIGRlZmluZWQoSEFWRV9HTlVUTFNfR0NSWVBUKQogCWdj cnlfbWRfaGFzaF9idWZmZXIoR0NSWV9NRF9NRDQsIGhidWYsIHBhc3N3ZC0+YnZfdmFsLCBwYXNz d2QtPmJ2X2xlbiApOworI2VsaWYgZGVmaW5lZChIQVZFX0dOVVRMU19ORVRUTEUpCisJbWQ0X2lu aXQoICZjdHggKTsKKwltZDRfdXBkYXRlKCAmY3R4LCBwYXNzd2QtPmJ2X2xlbiwgcGFzc3dkLT5i dl92YWwgKTsKKwltZDRfZGlnZXN0KCAmY3R4LCBzaXplb2YoaGJ1ZiksICh1bnNpZ25lZCBjaGFy ICopaGJ1ZiApOwogI2VuZGlmCiAKIAloZXhpZnkoIGhidWYsIGhhc2ggKTsKLS0gCjIuMC4wCgo= --047d7bdc8ac419e30c04fc856540--

1 0

Re: (ITS#7878) OpenLDAP MinGW Build Problem
by hyc＠symas.com 23 Jun '14

23 Jun '14

ron(a)zytrax.com wrote: > Full_Name: Ron Aitchison > Version: 2.4.39 > OS: Windows 7/MinGW-w64/MSYS > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (67.230.141.32) > > > Checked the build error reports before submitting > Building OpenLDAP 2.4.39 under MinGW-w64 (Win32 chain) and MSYS > Configure command > ./configure --prefix=/target LIBS='-lpcre -lgdi32 -lpthread' --enable-overlays > --disable-shared CPPFLAGS='-I/target/include' LDFLAGS='-L/target/lib' > make depend - works > make - fails with undefined uint32_t in /servers/slapd/back-mdm/init.c > Since this works on standard systems it is clearly some artifact of MinGW and/or > configure arguments. Fixed by adding #include <stdint.h> in > /servers/slapd/back-mdm/back-mdm.h. Make then ran to completion and slapd > loaded. Since stdint.h is 'double include' safe there is probably no down-side > to this quick fix. What version of MSYS/Mingw64 are you using? It builds cleanly for me here and has done so for years. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7879) liblmdb "mtest" programs do not build on mingw64
by hyc＠symas.com 23 Jun '14

23 Jun '14

batterseapower(a)hotmail.com wrote: > Full_Name: Max Bolingbroke > Version: LMDB HEAD > OS: Windows > URL: ftp://ftp.openldap.org/incoming/max-bolingbroke-20140622.patch > Submission from: (NULL) (81.111.197.81) > > > srandom/random do not appear to be defined on mingw. The trivial patch in > max-bolingbroke-20140622.patch simply defines these functions to the C standard > equivalents on Windows, which lets LMDB build cleanly there. I've committed a different change. There's no real need to use srandom over srand, and the fewer ifdef's the better. > > I, Maximilian Bolingbroke, hereby place the following modifications to liblmdb > (and only these modifications) into the public domain. Hence, these > modifications may be freely used and/or redistributed for any purpose with or > without attribution and/or other notice. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7879) liblmdb "mtest" programs do not build on mingw64
by batterseapower＠hotmail.com 22 Jun '14

22 Jun '14

Full_Name: Max Bolingbroke Version: LMDB HEAD OS: Windows URL: ftp://ftp.openldap.org/incoming/max-bolingbroke-20140622.patch Submission from: (NULL) (81.111.197.81) srandom/random do not appear to be defined on mingw. The trivial patch in max-bolingbroke-20140622.patch simply defines these functions to the C standard equivalents on Windows, which lets LMDB build cleanly there. I, Maximilian Bolingbroke, hereby place the following modifications to liblmdb (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#7877) please make gcrypt optional with newer gnutls
by ryan＠nardis.ca 20 Jun '14

20 Jun '14

This is a multi-part message in MIME format. --------------010505020103090906040401 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit This might be a better patch, if the build system change is acceptable. --------------010505020103090906040401 Content-Type: text/x-patch; name="0001-ITS-7877-detect-whether-gnutls-uses-gcrypt.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0001-ITS-7877-detect-whether-gnutls-uses-gcrypt.patch" >From e904900beb419576abc098e96deda04e53119603 Mon Sep 17 00:00:00 2001 From: Ryan Tandy <ryan(a)nardis.ca> Date: Fri, 20 Jun 2014 14:44:23 -0700 Subject: [PATCH] ITS#7877 detect whether gnutls uses gcrypt --- configure.in | 14 ++++++++++++++ libraries/libldap/tls_g.c | 20 ++++++++++++++++++-- 2 files changed, 32 insertions(+), 2 deletions(-) diff --git a/configure.in b/configure.in index 84bfc8a..27fe13a 100644 --- a/configure.in +++ b/configure.in @@ -1223,6 +1223,20 @@ if test $ol_link_tls = no ; then fi fi +if test $ol_with_tls = gnutls ; then + AC_CHECK_HEADERS(gcrypt.h) + + if test $ac_cv_header_gcrypt_h = yes ; then + AC_CHECK_LIB(gnutls, gcry_cipher_open, + [have_gnutls_gcrypt=yes], [have_gnutls_gcrypt=no]) + + if test $have_gnutls_gcrypt = yes ; then + AC_DEFINE(HAVE_GNUTLS_GCRYPT, 1, + [define if GnuTLS is using GCrypt]) + fi + fi +fi + dnl NOTE: caller must specify -I/path/to/nspr4 and -I/path/to/nss3 dnl and -L/path/to/nspr4 libs and -L/path/to/nss3 libs if those libs dnl are not in the default system location diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c index ee83b5c..417c768 100644 --- a/libraries/libldap/tls_g.c +++ b/libraries/libldap/tls_g.c @@ -43,10 +43,16 @@ #include <gnutls/gnutls.h> #include <gnutls/x509.h> -#include <gcrypt.h> #if LIBGNUTLS_VERSION_NUMBER >= 0x020200 #define HAVE_CIPHERSUITES 1 +#else +#undef HAVE_CIPHERSUITES +#endif + +#ifdef HAVE_GNUTLS_GCRYPT +#include <gcrypt.h> +#if LIBGNUTLS_VERSION_NUMBER >= 0x020200 /* This is a kludge. gcrypt 1.4.x has support. Recent GnuTLS requires gcrypt 1.4.x * but that dependency isn't reflected in their configure script, resulting in * build errors on older gcrypt. So, if they have a working build environment, @@ -54,9 +60,9 @@ */ #define HAVE_GCRYPT_RAND 1 #else -#undef HAVE_CIPHERSUITES #undef HAVE_GCRYPT_RAND #endif +#endif #ifndef HAVE_CIPHERSUITES /* Versions prior to 2.2.0 didn't handle cipher suites, so we had to @@ -143,6 +149,15 @@ tlsg_mutex_unlock( void **lock ) return ldap_pvt_thread_mutex_unlock( *lock ); } +#if GNUTLS_VERSION_NUMBER >= 0x020b00 +tlsg_thr_init( void ) +{ + gnutls_global_set_mutex (tlsg_mutex_init, + tlsg_mutex_destroy, + tlsg_mutex_lock, + tlsg_mutex_unlock); +} +#else static struct gcry_thread_cbs tlsg_thread_cbs = { GCRY_THREAD_OPTION_USER, NULL, @@ -158,6 +173,7 @@ tlsg_thr_init( void ) { gcry_control (GCRYCTL_SET_THREAD_CBS, &tlsg_thread_cbs); } +#endif #endif /* LDAP_R_COMPILE */ /* -- 1.9.1 --------------010505020103090906040401--

1 0

(ITS#7878) OpenLDAP MinGW Build Problem
by ron＠zytrax.com 20 Jun '14

20 Jun '14

Full_Name: Ron Aitchison Version: 2.4.39 OS: Windows 7/MinGW-w64/MSYS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (67.230.141.32) Checked the build error reports before submitting Building OpenLDAP 2.4.39 under MinGW-w64 (Win32 chain) and MSYS Configure command ./configure --prefix=/target LIBS='-lpcre -lgdi32 -lpthread' --enable-overlays --disable-shared CPPFLAGS='-I/target/include' LDFLAGS='-L/target/lib' make depend - works make - fails with undefined uint32_t in /servers/slapd/back-mdm/init.c Since this works on standard systems it is clearly some artifact of MinGW and/or configure arguments. Fixed by adding #include <stdint.h> in /servers/slapd/back-mdm/back-mdm.h. Make then ran to completion and slapd loaded. Since stdint.h is 'double include' safe there is probably no down-side to this quick fix.

1 0

(ITS#7877) please make gcrypt optional with newer gnutls
by ryan＠nardis.ca 20 Jun '14

20 Jun '14

Full_Name: Ryan Tandy Version: HEAD OS: Debian unstable URL: Submission from: (NULL) (142.32.208.235) Debian bug report: https://bugs.debian.org/745231 Quoting Andreas Metzler: "given that gmp has been dual-licensed LGPLv3+/GPLv2+ it should be possible to switch openldap over to the newer version of gnutls. Upstream's 0205e83f4670d10ad3c6ae4b8fc5ec1d0c7020c0 lets the Debian package build successfully (including testsuite). However even with patch there is still some work to be done. libraries/libldap/tls_g.c has some gcrypt related code that should be simply unnecessary with gnutls3, therefore it should not link against libgcrypt either. (Except for contrib/slapd-modules/smbk5pwd/smbk5pwd.c)." The following changes make gcrypt optional for libldap. For versions where both nettle and gcrypt are supported, I assume the default since no mechanism is provided for detecting which is actually in use. Tested with GnuTLS 2.8.6 and 3.2.15. --- a/libraries/libldap/tls_g.c +++ b/libraries/libldap/tls_g.c @@ -43,10 +43,17 @@ #include <gnutls/gnutls.h> #include <gnutls/x509.h> -#include <gcrypt.h> #if LIBGNUTLS_VERSION_NUMBER >= 0x020200 #define HAVE_CIPHERSUITES 1 +#else +#undef HAVE_CIPHERSUITES +#endif + +/* gnutls >= 2.11.1 no longer uses gcrypt by default */ +#if LIBGNUTLS_VERSION_NUMBER < 0x020b01 +#include <gcrypt.h> +#if LIBGNUTLS_VERSION_NUMBER >= 0x020200 /* This is a kludge. gcrypt 1.4.x has support. Recent GnuTLS requires gcrypt 1.4.x * but that dependency isn't reflected in their configure script, resulting in * build errors on older gcrypt. So, if they have a working build environment, @@ -54,9 +61,10 @@ */ #define HAVE_GCRYPT_RAND 1 #else -#undef HAVE_CIPHERSUITES #undef HAVE_GCRYPT_RAND #endif +#endif + #ifndef HAVE_CIPHERSUITES /* Versions prior to 2.2.0 didn't handle cipher suites, so we had to @@ -143,6 +151,7 @@ tlsg_mutex_unlock( void **lock ) return ldap_pvt_thread_mutex_unlock( *lock ); } +#if GNUTLS_VERSION_NUMBER <= 0x020b00 static struct gcry_thread_cbs tlsg_thread_cbs = { GCRY_THREAD_OPTION_USER, NULL, @@ -158,6 +167,16 @@ tlsg_thr_init( void ) { gcry_control (GCRYCTL_SET_THREAD_CBS, &tlsg_thread_cbs); } +#else +static void +tlsg_thr_init( void ) +{ + gnutls_global_set_mutex (tlsg_mutex_init, + tlsg_mutex_destroy, + tlsg_mutex_lock, + tlsg_mutex_unlock); +} +#endif #endif /* LDAP_R_COMPILE */ /* I have not looked at smbk5pwd yet.

1 0

Re: (ITS#5184) pkg-config file for libraries
by bj＠sernet.de 17 Jun '14

17 Jun '14

On 2014-06-17 at 12:36 -0700 Howard Chu sent off: > If you're depending on some unknown OpenLDAP install to provide all > of the features that your Samba package needs, you need more than > luck. You need to know that it was built against a compatible > Kerberos library, a sane Cyrus SASL version, and a working crypto > library. The only way to know that is to build it yourself against > valid packages, in which case, you don't need to go grubbing through > the system looking for them. many people are happy with their own installation of openldap or whatever package. Also I know what we have to check for to have a sufficient ldap implementation for our Samba builds, believe me :-) > If you're depending on some OpenLDAP that was packaged by someone > else, then you should be asking them to provide a pkg-config file > for their package. Installation issues are strictly not our concern, > we distribute source code. That should have already been clear from > http://www.openldap.org/its/index.cgi/Archive.Build?id=5184 Followup okay, I didn't explicitly write that I disagree. I disgree on that statement by the way :-) usually package maintainers don't write .pc files they install the .pc files that the source code ships. We also ship .pc files for all of our libraries we ship in Samba. "make install" puts in the right content. > 1. > > Even if we provided a .pc file, you still have to guess where *that* > got installed - was it in /usr, or in /usr/local, or somewhere else? to get the location of the pkg-config file is really the smallest pain. > I've certainly never seen pkg-config as a standard component of AIX > or Solaris. What difference does it make here if pkg-config is a *standard* component or if it has to be separately installed? > > Is pkg-config even supported on AIX? it is, google "pkg-config aix" shows you. To have a pkg-config files is something openldap *benefits* from because it ensures that people can build agains openldap without big trouble. I'm not sure if you really see how much benefit openldap gets out of those trivial to generate .pc files actually. If people are able to build against mozldap because just because there is a simple .pc file which sets the compile and link flags right, then mozldap might become their prefered library in the future. It's up to you if you want to make it easy or hard for people to use your software. Cheers Björn

1 0

Re: (ITS#5184) pkg-config file for libraries
by hyc＠symas.com 17 Jun '14

17 Jun '14

Björn JACKE wrote: > On 2014-06-17 at 07:04 -0700 Howard Chu sent off: >> bj(a)sernet.de wrote: >>> for Samba we really have some pain to get the right compile and linker flags >>> for different architectures, especially there, where OpenLDAP is not a >>> first-class citizen like on AIX. >>> >>> mozldap offers pkg-config files which we will start to use in Samba soon. It >>> would be great if OpenLDAP would offer a pkg-config file also to not have to >>> make wild guesses which linker/compile flags and which paths to use. >> >> I don't see the problem. There are no special compiler or linker >> flags for applications to use libldap. > > if you build on a system where you don't know what LDAP library you have you > exactly have to test for the existing header files, you have to test for the > libs that you find in the library search paths (and maybe also in > library paths that are not in the search path), you have to look for > existing symbols to know which exact flavor of the lib you have, you > have to use the right include paths. All those things that you have to > look up, have to fit together also. If you are LUCKY they will fit together on > an AIX or on a Solaris box. If not, you use the right header files but the > wrong linker flags, there are many things to screw up. It is a huge bunch of > work to get all this information pieces together and puzzle them right for your > build system. In Samba we had have a hard time to do that in the past and with > the new waf base build system we have to fix a lot that was working before. The > LDAP libaries (also OpenLDAP on Unix systems...) have always been a major pain > for the build system and a pkg-config file, which we can just use to get the > right compiler and linker flags would be a great help for that and it > would make the build agains openldap much more predictable and stable. > If you're depending on some unknown OpenLDAP install to provide all of the features that your Samba package needs, you need more than luck. You need to know that it was built against a compatible Kerberos library, a sane Cyrus SASL version, and a working crypto library. The only way to know that is to build it yourself against valid packages, in which case, you don't need to go grubbing through the system looking for them. If you're depending on some OpenLDAP that was packaged by someone else, then you should be asking them to provide a pkg-config file for their package. Installation issues are strictly not our concern, we distribute source code. That should have already been clear from http://www.openldap.org/its/index.cgi/Archive.Build?id=5184 Followup 1. Even if we provided a .pc file, you still have to guess where *that* got installed - was it in /usr, or in /usr/local, or somewhere else? I've certainly never seen pkg-config as a standard component of AIX or Solaris. Is pkg-config even supported on AIX? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5184) pkg-config file for libraries
by bj＠sernet.de 17 Jun '14

17 Jun '14

On 2014-06-17 at 07:04 -0700 Howard Chu sent off: > bj(a)sernet.de wrote: > >for Samba we really have some pain to get the right compile and linker flags > >for different architectures, especially there, where OpenLDAP is not a > >first-class citizen like on AIX. > > > >mozldap offers pkg-config files which we will start to use in Samba soon. It > >would be great if OpenLDAP would offer a pkg-config file also to not have to > >make wild guesses which linker/compile flags and which paths to use. > > I don't see the problem. There are no special compiler or linker > flags for applications to use libldap. if you build on a system where you don't know what LDAP library you have you exactly have to test for the existing header files, you have to test for the libs that you find in the library search paths (and maybe also in library paths that are not in the search path), you have to look for existing symbols to know which exact flavor of the lib you have, you have to use the right include paths. All those things that you have to look up, have to fit together also. If you are LUCKY they will fit together on an AIX or on a Solaris box. If not, you use the right header files but the wrong linker flags, there are many things to screw up. It is a huge bunch of work to get all this information pieces together and puzzle them right for your build system. In Samba we had have a hard time to do that in the past and with the new waf base build system we have to fix a lot that was working before. The LDAP libaries (also OpenLDAP on Unix systems...) have always been a major pain for the build system and a pkg-config file, which we can just use to get the right compiler and linker flags would be a great help for that and it would make the build agains openldap much more predictable and stable.

1 0

Re: (ITS#5184) pkg-config file for libraries
by hyc＠symas.com 17 Jun '14

17 Jun '14

bj(a)sernet.de wrote: > for Samba we really have some pain to get the right compile and linker flags > for different architectures, especially there, where OpenLDAP is not a > first-class citizen like on AIX. > > mozldap offers pkg-config files which we will start to use in Samba soon. It > would be great if OpenLDAP would offer a pkg-config file also to not have to > make wild guesses which linker/compile flags and which paths to use. I don't see the problem. There are no special compiler or linker flags for applications to use libldap. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5184) pkg-config file for libraries
by bj＠sernet.de 17 Jun '14

17 Jun '14

for Samba we really have some pain to get the right compile and linker flags for different architectures, especially there, where OpenLDAP is not a first-class citizen like on AIX. mozldap offers pkg-config files which we will start to use in Samba soon. It would be great if OpenLDAP would offer a pkg-config file also to not have to make wild guesses which linker/compile flags and which paths to use.

1 0

Re: (ITS#7765) Crash when adding syncrepl configuration in cn=config without search base
by clem.oudot＠gmail.com 16 Jun '14

16 Jun '14

--001a11c3c678534ebd04fbf0f3b5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable 2014-05-23 16:09 GMT+02:00 <hyc(a)symas.com>: > coudot(a)linagora.com wrote: > > Full_Name: Cl=C3=A9ment OUDOT > > Version: 2.4.38 > > OS: GNU/Linux > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (88.173.78.196) > > > > > > When adding an olcSyncrepl attribute in my cn=3Dconfig, OpenLDAP crashe= d. > > > > The syslog output is: > > > > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D0 BIND dn=3D"cn=3Dco= nfig" > method=3D128 > > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D0 BIND dn=3D"cn=3Dco= nfig" > mech=3DSIMPLE > > ssf=3D0 > > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D0 RESULT tag=3D97 er= r=3D0 > text=3D > > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D1 MOD > > dn=3D"olcDatabase=3D{2}mdb,cn=3Dconfig" > > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D1 MOD attr=3Dolcacce= ss > olcdbindex > > olcsyncrepl > > Dec 16 11:56:42 ader slapd[8707]: olcSyncrepl: value #0: Error: Malform= ed > > "syncrepl" line in slapd config file, missing searchbase. > > Dec 16 11:56:42 ader slapd[8707]: failed to add syncinfo > > Dec 16 11:56:42 ader slapd[8707]: ch_calloc of 1 elems of 0 bytes faile= d > > > > > > I have no gdb trace to give for now, if you think it is required, I wil= l > try to > > find time to do it. But it should be easy to reproduce the issue on you= r > side. > > Please provide your exact ldapmodify request and the database config befo= re > the modify attempt, thanks. > Hi, I tried to reproduce with 2.4.39, without success: 539ebd5e conn=3D1000 fd=3D12 ACCEPT from IP=3D127.0.0.1:56063 (IP=3D0.0.0.0= :5389) 539ebd5e conn=3D1000 op=3D0 BIND dn=3D"cn=3Dconfig" method=3D128 539ebd5e conn=3D1000 op=3D0 BIND dn=3D"cn=3Dconfig" mech=3DSIMPLE ssf=3D0 539ebd5e conn=3D1000 op=3D0 RESULT tag=3D97 err=3D0 text=3D 539ebd5e conn=3D1000 op=3D1 MOD dn=3D"olcDatabase=3D{2}mdb,cn=3Dconfig" 539ebd5e conn=3D1000 op=3D1 MOD attr=3DolcSyncrepl 539ebd5e olcSyncrepl: value #0: Error: Malformed "syncrepl" line in slapd config file, missing searchbase. 539ebd5e failed to add syncinfo 539ebd5e conn=3D1000 op=3D1 RESULT tag=3D103 err=3D80 text=3DError: Malform= ed "syncrepl" line in slapd config file, missing searchbase 539ebd5e conn=3D1000 op=3D2 UNBIND 539ebd5e conn=3D1000 fd=3D12 closed So it seems there is no more issue with the latest OpenLDAP version. Cl=C3=A9ment. --001a11c3c678534ebd04fbf0f3b5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><br><div class=3D"gmail= _quote">2014-05-23 16:09 GMT+02:00 <span dir=3D"ltr"><<a href=3D"mailto= :hyc@symas.com" target=3D"_blank">hyc(a)symas.com</a>></span>:<br><blockqu= ote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px= solid rgb(204,204,204);padding-left:1ex"> <a href=3D"mailto:coudot@linagora.com">coudot(a)linagora.com</a> wrote:<br> > Full_Name: Cl=C3=A9ment OUDOT<br> > Version: 2.4.38<br> > OS: GNU/Linux<br> > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_blank">ft= p://ftp.openldap.org/incoming/</a><br> > Submission from: (NULL) (88.173.78.196)<br> ><br> ><br> > When adding an olcSyncrepl attribute in my cn=3Dconfig, OpenLDAP crash= ed.<br> ><br> > The syslog output is:<br> ><br> > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D0 BIND dn=3D"c= n=3Dconfig" method=3D128<br> > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D0 BIND dn=3D"c= n=3Dconfig" mech=3DSIMPLE<br> > ssf=3D0<br> > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D0 RESULT tag=3D97 e= rr=3D0 text=3D<br> > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D1 MOD<br> > dn=3D"olcDatabase=3D{2}mdb,cn=3Dconfig"<br> > Dec 16 11:56:42 ader slapd[8707]: conn=3D1096 op=3D1 MOD attr=3Dolcacc= ess olcdbindex<br> > olcsyncrepl<br> > Dec 16 11:56:42 ader slapd[8707]: olcSyncrepl: value #0: Error: Malfor= med<br> > "syncrepl" line in slapd config file, missing searchbase.<br= > > Dec 16 11:56:42 ader slapd[8707]: failed to add syncinfo<br> > Dec 16 11:56:42 ader slapd[8707]: ch_calloc of 1 elems of 0 bytes fail= ed<br> ><br> ><br> > I have no gdb trace to give for now, if you think it is required, I wi= ll try to<br> > find time to do it. But it should be easy to reproduce the issue on yo= ur side.<br> <br> Please provide your exact ldapmodify request and the database config before= <br> the modify attempt, thanks.<br> <span class=3D""></span></blockquote><div><br><br></div><div>Hi,<br><br></d= iv><div>I tried to reproduce with 2.4.39, without success:<br><br>539ebd5e = conn=3D1000 fd=3D12 ACCEPT from IP=3D<a href=3D"http://127.0.0.1:56063">127= .0.0.1:56063</a> (IP=3D<a href=3D"http://0.0.0.0:5389">0.0.0.0:5389</a>)<br= > 539ebd5e conn=3D1000 op=3D0 BIND dn=3D"cn=3Dconfig" method=3D128<= br>539ebd5e conn=3D1000 op=3D0 BIND dn=3D"cn=3Dconfig" mech=3DSIM= PLE ssf=3D0<br>539ebd5e conn=3D1000 op=3D0 RESULT tag=3D97 err=3D0 text=3D<= br>539ebd5e conn=3D1000 op=3D1 MOD dn=3D"olcDatabase=3D{2}mdb,cn=3Dcon= fig"<br> 539ebd5e conn=3D1000 op=3D1 MOD attr=3DolcSyncrepl<br>539ebd5e olcSyncrepl:= value #0: Error: Malformed "syncrepl" line in slapd config file,= missing searchbase.<br>539ebd5e failed to add syncinfo<br>539ebd5e conn=3D= 1000 op=3D1 RESULT tag=3D103 err=3D80 text=3DError: Malformed "syncrep= l" line in slapd config file, missing searchbase<br> 539ebd5e conn=3D1000 op=3D2 UNBIND<br>539ebd5e conn=3D1000 fd=3D12 closed<b= r><br><br></div><div>So it seems there is no more issue with the latest Ope= nLDAP version.<br><br><br></div><div>Cl=C3=A9ment. <br></div></div></div></= div> --001a11c3c678534ebd04fbf0f3b5--

1 0

Re: (ITS#7876) LMDB compile issue on AIX 6.1
by fkruchio＠gmail.com 13 Jun '14

13 Jun '14

--089e013c62d425a67004fbb3c1e1 Content-Type: text/plain; charset=UTF-8 I installed gmake and lmdb compiled fine. Thank you Howard ! On Fri, Jun 13, 2014 at 5:29 PM, <openldap-its(a)openldap.org> wrote: > > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** > > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7876. > > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. > > If you need to provide additional information in regards to your > issue report, you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7876) > in the subject will automatically be attached to the issue report. > > mailto:openldap-its@openldap.org?subject=(ITS#7876) > > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=7876 > > Please remember to retain your issue tracking number (ITS#7876) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. > > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. > > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ > > -------------- > Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved. > > --089e013c62d425a67004fbb3c1e1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>I installed gmake and lmdb compiled fine.<br><br></di= v>Thank you Howard !<br><div><br></div></div><div class=3D"gmail_extra"><br= ><br><div class=3D"gmail_quote">On Fri, Jun 13, 2014 at 5:29 PM, <span dir= =3D"ltr"><<a href=3D"mailto:openldap-its@openldap.org" target=3D"_blank"= >openldap-its(a)openldap.org</a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"><br> *** THIS IS AN AUTOMATICALLY GENERATED REPLY ***<br> <br> Thanks for your report to the OpenLDAP Issue Tracking System. =C2=A0Your<br= > report has been assigned the tracking number ITS#7876.<br> <br> One of our support engineers will look at your report in due course.<br> Note that this may take some time because our support engineers<br> are volunteers. =C2=A0They only work on OpenLDAP when they have spare<br> time.<br> <br> If you need to provide additional information in regards to your<br> issue report, you may do so by replying to this message. =C2=A0Note that<br= > any mail sent to <a href=3D"mailto:openldap-its@openldap.org">openldap-its@= openldap.org</a> with (ITS#7876)<br> in the subject will automatically be attached to the issue report.<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 mailto:<a href=3D"mailto:openldap-its@openldap.= org">openldap-its(a)openldap.org</a>?subject=3D(ITS#7876)<br> <br> You may follow the progress of this report by loading the following<br> URL in a web browser:<br> =C2=A0 =C2=A0 <a href=3D"http://www.OpenLDAP.org/its/index.cgi?findid=3D787= 6" target=3D"_blank">http://www.OpenLDAP.org/its/index.cgi?findid=3D7876</a= ><br> <br> Please remember to retain your issue tracking number (ITS#7876)<br> on any further messages you send to us regarding this report. =C2=A0If<br> you don't then you'll just waste our time and yours because we<br> won't be able to properly track the report.<br> <br> Please note that the Issue Tracking System is not intended to<br> be used to seek help in the proper use of OpenLDAP Software.<br> Such requests will be closed.<br> <br> OpenLDAP Software is user supported.<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.OpenLDAP.org/support/" ta= rget=3D"_blank">http://www.OpenLDAP.org/support/</a><br> <br> --------------<br> Copyright 1998-2007 The OpenLDAP Foundation, All Rights Reserved.<br> <br> </blockquote></div><br></div> --089e013c62d425a67004fbb3c1e1--

1 0

Re: (ITS#7876) LMDB compile issue on AIX 6.1
by hyc＠symas.com 12 Jun '14

12 Jun '14

fkruchio(a)gmail.com wrote: > Full_Name: Frank Kruchio > Version: LMDB > OS: AIX 6.1 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (203.97.151.51) > > > Looking at cfengine 3.6 deployment on AIX and LMDB is a possible database to > use. > This is the error I receive when running make. > Has anyone managed to compile lmdb on AIX ? Use Gnumake. > > [root@p2aunx002]:/home/unixgrp/m014084/mdb/libraries/liblmdb # pwd > /home/unixgrp/m014084/mdb/libraries/liblmdb > [root@p2aunx002]:/home/unixgrp/m014084/mdb/libraries/liblmdb # make > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast > -fPIC -c mdb.c > mdb.c: In function 'mdb_cursor_put': > mdb.c:6029: warning: dereferencing type-punned pointer will break > strict-aliasing rules > mdb.c:6029: warning: dereferencing type-punned pointer will break > strict-aliasing rules > mdb.c: In function 'mdb_node_shrink': > mdb.c:6691: warning: dereferencing type-punned pointer will break > strict-aliasing rules > mdb.c:6691: warning: dereferencing type-punned pointer will break > strict-aliasing rules > mdb.c: In function 'mdb_xcursor_init1': > mdb.c:6765: warning: dereferencing type-punned pointer will break > strict-aliasing rules > mdb.c:6765: warning: dereferencing type-punned pointer will break > strict-aliasing rules > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast > -fPIC -c midl.c > ar rs liblmdb.a mdb.o midl.o > ar: creating an archive file liblmdb.a > gcc -pthread -shared -o liblmdb.so mdb.o midl.o > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast > -c mdb_stat.c > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast > mdb_stat.c -o mdb_stat > ld: 0711-317 ERROR: Undefined symbol: .mdb_env_create > ld: 0711-317 ERROR: Undefined symbol: .mdb_env_set_maxdbs > ld: 0711-317 ERROR: Undefined symbol: .mdb_env_open > ld: 0711-317 ERROR: Undefined symbol: .mdb_reader_list > ld: 0711-317 ERROR: Undefined symbol: .mdb_reader_check > ld: 0711-317 ERROR: Undefined symbol: .mdb_txn_begin > ld: 0711-317 ERROR: Undefined symbol: .mdb_cursor_open > ld: 0711-317 ERROR: Undefined symbol: .mdb_stat > ld: 0711-317 ERROR: Undefined symbol: .mdb_cursor_get > ld: 0711-317 ERROR: Undefined symbol: .mdb_env_stat > ld: 0711-317 ERROR: Undefined symbol: .mdb_env_info > ld: 0711-317 ERROR: Undefined symbol: .mdb_strerror > ld: 0711-317 ERROR: Undefined symbol: .mdb_env_close > ld: 0711-317 ERROR: Undefined symbol: .mdb_cursor_close > ld: 0711-317 ERROR: Undefined symbol: .mdb_dbi_open > ld: 0711-317 ERROR: Undefined symbol: .mdb_dbi_close > ld: 0711-317 ERROR: Undefined symbol: .mdb_txn_abort > ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more information. > collect2: ld returned 8 exit status > make: The error code from the last command is 1. > > > Stop. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7876) LMDB compile issue on AIX 6.1
by fkruchio＠gmail.com 12 Jun '14

12 Jun '14

Full_Name: Frank Kruchio Version: LMDB OS: AIX 6.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (203.97.151.51) Looking at cfengine 3.6 deployment on AIX and LMDB is a possible database to use. This is the error I receive when running make. Has anyone managed to compile lmdb on AIX ? [root@p2aunx002]:/home/unixgrp/m014084/mdb/libraries/liblmdb # pwd /home/unixgrp/m014084/mdb/libraries/liblmdb [root@p2aunx002]:/home/unixgrp/m014084/mdb/libraries/liblmdb # make gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -fPIC -c mdb.c mdb.c: In function 'mdb_cursor_put': mdb.c:6029: warning: dereferencing type-punned pointer will break strict-aliasing rules mdb.c:6029: warning: dereferencing type-punned pointer will break strict-aliasing rules mdb.c: In function 'mdb_node_shrink': mdb.c:6691: warning: dereferencing type-punned pointer will break strict-aliasing rules mdb.c:6691: warning: dereferencing type-punned pointer will break strict-aliasing rules mdb.c: In function 'mdb_xcursor_init1': mdb.c:6765: warning: dereferencing type-punned pointer will break strict-aliasing rules mdb.c:6765: warning: dereferencing type-punned pointer will break strict-aliasing rules gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -fPIC -c midl.c ar rs liblmdb.a mdb.o midl.o ar: creating an archive file liblmdb.a gcc -pthread -shared -o liblmdb.so mdb.o midl.o gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -c mdb_stat.c gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast mdb_stat.c -o mdb_stat ld: 0711-317 ERROR: Undefined symbol: .mdb_env_create ld: 0711-317 ERROR: Undefined symbol: .mdb_env_set_maxdbs ld: 0711-317 ERROR: Undefined symbol: .mdb_env_open ld: 0711-317 ERROR: Undefined symbol: .mdb_reader_list ld: 0711-317 ERROR: Undefined symbol: .mdb_reader_check ld: 0711-317 ERROR: Undefined symbol: .mdb_txn_begin ld: 0711-317 ERROR: Undefined symbol: .mdb_cursor_open ld: 0711-317 ERROR: Undefined symbol: .mdb_stat ld: 0711-317 ERROR: Undefined symbol: .mdb_cursor_get ld: 0711-317 ERROR: Undefined symbol: .mdb_env_stat ld: 0711-317 ERROR: Undefined symbol: .mdb_env_info ld: 0711-317 ERROR: Undefined symbol: .mdb_strerror ld: 0711-317 ERROR: Undefined symbol: .mdb_env_close ld: 0711-317 ERROR: Undefined symbol: .mdb_cursor_close ld: 0711-317 ERROR: Undefined symbol: .mdb_dbi_open ld: 0711-317 ERROR: Undefined symbol: .mdb_dbi_close ld: 0711-317 ERROR: Undefined symbol: .mdb_txn_abort ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more information. collect2: ld returned 8 exit status make: The error code from the last command is 1. Stop.

1 0

Re: (ITS#7875) lmdb MDB_GET_BOTH unexpected success
by hyc＠symas.com 11 Jun '14

11 Jun '14

mail(a)arnedebruijn.nl wrote: > Full_Name: Arne de Bruijn > Version: mdb.master a93810c > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (94.210.130.16) > > > MDB_GET_BOTH seems to unexpectedly return success if a data-value before the > first data-value for a key is requested. Thanks for the report. This appears to have been broken due to commit 18a07eb7c2dc33372455a6040984cd6b699b41a5 for ITS#7681. Fixed now in mdb.master > > The example program sets 1:b and 1:c and requests 1:a. It prints: > get_both: key=1 val=b > > While I would expect: > get_both: err=MDB_NOTFOUND: No matching key/data pair found > > (curiously it works when it only sets 1:b) > > #include <stdlib.h> > #include <stdio.h> > #include <string.h> > #include <unistd.h> > #include "lmdb.h" > > void set_val(MDB_val *v, char *s) { > v->mv_size = strlen(s); > v->mv_data = s; > } > > int main() { > int rc; > MDB_env *menv = NULL; > MDB_dbi mdbi; > MDB_txn *mtxn = NULL; > MDB_val key, val; > MDB_cursor *mc; > > if ((rc = mdb_env_create(&menv))) > goto err; > if ((rc = unlink("testdb"))) > goto err; > if ((rc = mdb_env_open(menv, "testdb", MDB_NOSUBDIR, 0666))) > goto err; > if ((rc = mdb_txn_begin(menv, NULL, 0, &mtxn))) > goto err; > if ((rc = mdb_dbi_open(mtxn, NULL, MDB_DUPSORT | MDB_CREATE, &mdbi))) > goto err; > set_val(&key, "1"); > set_val(&val, "b"); > if ((rc = mdb_put(mtxn, mdbi, &key, &val, 0))) > goto err; > set_val(&key, "1"); > set_val(&val, "c"); > if ((rc = mdb_put(mtxn, mdbi, &key, &val, 0))) > goto err; > > if ((rc = mdb_cursor_open(mtxn, mdbi, &mc))) > goto err; > > set_val(&key, "1"); > set_val(&val, "a"); > rc = mdb_cursor_get(mc, &key, &val, MDB_GET_BOTH); > if (rc) > printf("get_both: err=%s\n", mdb_strerror(rc)); > else > printf("get_both: key=%.*s val=%.*s\n", key.mv_size, (char *)key.mv_data, > val.mv_size, (char *)val.mv_data); > > mdb_cursor_close(mc); > > if ((rc = mdb_txn_commit(mtxn))) { > mdb_dbi_close(menv, mdbi); > goto err; > } > mdb_env_close(menv); > return 0; > err: > if (mtxn) > mdb_txn_abort(mtxn); > if (menv) > mdb_env_close(menv); > fprintf(stderr, "Error: %s\n", mdb_strerror(rc)); > return 1; > } > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7875) lmdb MDB_GET_BOTH unexpected success
by mail＠arnedebruijn.nl 11 Jun '14

11 Jun '14

Full_Name: Arne de Bruijn Version: mdb.master a93810c OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (94.210.130.16) MDB_GET_BOTH seems to unexpectedly return success if a data-value before the first data-value for a key is requested. The example program sets 1:b and 1:c and requests 1:a. It prints: get_both: key=1 val=b While I would expect: get_both: err=MDB_NOTFOUND: No matching key/data pair found (curiously it works when it only sets 1:b) #include <stdlib.h> #include <stdio.h> #include <string.h> #include <unistd.h> #include "lmdb.h" void set_val(MDB_val *v, char *s) { v->mv_size = strlen(s); v->mv_data = s; } int main() { int rc; MDB_env *menv = NULL; MDB_dbi mdbi; MDB_txn *mtxn = NULL; MDB_val key, val; MDB_cursor *mc; if ((rc = mdb_env_create(&menv))) goto err; if ((rc = unlink("testdb"))) goto err; if ((rc = mdb_env_open(menv, "testdb", MDB_NOSUBDIR, 0666))) goto err; if ((rc = mdb_txn_begin(menv, NULL, 0, &mtxn))) goto err; if ((rc = mdb_dbi_open(mtxn, NULL, MDB_DUPSORT | MDB_CREATE, &mdbi))) goto err; set_val(&key, "1"); set_val(&val, "b"); if ((rc = mdb_put(mtxn, mdbi, &key, &val, 0))) goto err; set_val(&key, "1"); set_val(&val, "c"); if ((rc = mdb_put(mtxn, mdbi, &key, &val, 0))) goto err; if ((rc = mdb_cursor_open(mtxn, mdbi, &mc))) goto err; set_val(&key, "1"); set_val(&val, "a"); rc = mdb_cursor_get(mc, &key, &val, MDB_GET_BOTH); if (rc) printf("get_both: err=%s\n", mdb_strerror(rc)); else printf("get_both: key=%.*s val=%.*s\n", key.mv_size, (char *)key.mv_data, val.mv_size, (char *)val.mv_data); mdb_cursor_close(mc); if ((rc = mdb_txn_commit(mtxn))) { mdb_dbi_close(menv, mdbi); goto err; } mdb_env_close(menv); return 0; err: if (mtxn) mdb_txn_abort(mtxn); if (menv) mdb_env_close(menv); fprintf(stderr, "Error: %s\n", mdb_strerror(rc)); return 1; }

1 0

Re: (ITS#7874) Replication Debian & Ubuntu ( PROBLEM )
by quanah＠zimbra.com 05 Jun '14

05 Jun '14

--On Thursday, June 05, 2014 11:40 AM +0000 lisivoandre(a)gmail.com wrote: > ____________________________________________x____________________________ > ____________ > > Changed: > olcServerID: 001 ldaps://ldap01.example.tld > For: > olcServerID: 001 ldap://<IP> > ________________________________________________________ It was all the > changes i made! a) The URI in olcServerID *must* match the URI used to start slapd (the -h option to slapd) b) ldaps/startTLS do not work with a server IP unless you've added the IP to subjectAltNames c) The Debian/Ubuntu builds are utterly unusable, you need to get a sane build. In any case, this is not a bug report. This ITS will be closed. --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7874) Replication Debian & Ubuntu ( PROBLEM )
by lisivoandre＠gmail.com 05 Jun '14

05 Jun '14

Full_Name: André Campos Version: 2.4.31 OS: Debian URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (193.136.194.93) Hi i am having problems with the replication i am using Ubuntu 12.04 LTS to connect to a Debian, the master. With the help from this tutorial: http://grungelabs.com/guides/2012/06/08/ha-openldap-debian/, i did some changes to the overall. I didn't configure the ssl but i did Import the schemata and add memberof. The commands like: ldapmodify -Y EXTERNAL -H ldapi:/// -D olcDatabase={1}hdb,cn=config -f ./repl_db_slave_auth.ldif For: ldapmodify -f repl_master.ldif -D cn=admin,cn=config -x -W ____________________________________________x________________________________________ Changed: olcServerID: 001 ldaps://ldap01.example.tld For: olcServerID: 001 ldap://<IP> ________________________________________________________ It was all the changes i made! But here is the problem i made all the tutorial in the Debian (master) and the last part mean to Ubuntu (slave or ldap02) and when i restart it's ok in the slave but in the master when i restart slapd it gets an error and when i go to the logs, here's the following: Jun 5 10:56:14 controller slapd[11221]: @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $#012#011root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd Jun 5 10:56:14 controller slapd[11221]: read_config: no serverID / URL match found. Check slapd -h arguments. Jun 5 10:56:14 controller slapd[11221]: slapd stopped. Jun 5 10:56:14 controller slapd[11221]: connections_destroy: nothing to destroy. _______________________________________x____________________________________________ I don't know what to do so what do i do?

1 0

(ITS#7873) slapo-refint interferes with cn=config
by hyc＠OpenLDAP.org 04 Jun '14

04 Jun '14

Full_Name: Howard Chu Version: 2.4.39 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc The refint overlay performs its referential integrity updates in a separately queued thread. On a large database the necessary updates may take a long time, and currently the refint_qtask doesn't check for pending cn=config pause requests. Fix coming shortly.

1 0

(ITS#7872) slapd-mdb memory leak in mdb_entry_get
by hyc＠OpenLDAP.org 04 Jun '14

04 Jun '14

Full_Name: Howard Chu Version: 2.4.39 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc Actually the leak is in dn2entry but it only occurs when called from mdb_entry_get. A fix is coming shortly.

1 0

Re: (ITS#6970) OpenLDAP 2.4.25 MemberOf + AutoGroup user has stale "memberof" attributes for target group after removal from trigger group
by ryan＠nardis.ca 04 Jun '14

04 Jun '14

Hi, The last comments on this ITS mentioned crashes or deadlocks when using autogroup and memberof together. I tried this today with git master on both mdb and hdb backends. Adding a new entry that triggers an autogroup member to be added: I don't get a crash or deadlock, but the new entry doesn't have a memberOf attribute. It looks like the internal Modify adding the member happens before the Add completes, so memberof tries to add memberOf to an entry that doesn't exist yet. Changing autogroup to trigger on an alteration to an existing entry, for example addition of a specific attribute or auxiliary objectClass: with mdb this works and the memberOf attribute is added; with hdb I get the same deadlock Landry Breuil already reported. Looks like a recursive deadlock on the same thread. I think those problems are both different from the one this ITS is about, though. Maybe they should be filed separately. I also confirmed the problem originally reported on current git master, and the analysis sounds right, but I haven't had time to think through the proposed solution fully. I'm not totally sure whether it's autogroup or memberof that actually needs fixing. Maybe both. cheers, Ryan

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs