- openldap-bugs - openldap.org

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by ck＠cksoft.de 27 May '13

27 May '13

Hi Howard, On Mon, 27 May 2013, Howard Chu wrote: > Christian Kratzer wrote: >> Hi Howard, > > Never mind, this was actually a bug in the handling of proxied attributes. > Fixed now in master, your test case should work fine there. great. Will the changes be automatically included in 2.4.36 when its released ? I'll test against master and deploy a workaround with an acl to the customer site in the meantime. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

1 0

Re: reference through null pointer and memory leak (related to ITS#7588)
by hyc＠symas.com 27 May '13

27 May '13

John Hardin wrote: > My previous email to ITS is unreadable. Here is a repeat of what I posted. Thanks, fixed now in master. > > -John > > > Configuration: > > CFLAGS="-g -O0" ./configure --exec-prefix=/usr --prefix=/ --enable-overlays=yes --enable-slapd --enable-debug > > Start server: > > valgrind --leak-check=full openldap/servers/slapd/slapd > > Perform search with sorted, paged results. Repeating the command will cause the leaked memory to grow. I'm using: > > ldapsearch -H ldap://10.10.9.85 -x -b ou=people,dc=example,dc=com -s one -E'!sss=sn:2.5.13.3' -E'!pr=10/prompt' > > At the prompt, type ctrl-C. > > Kill the slapd process. The output of valgrind shows the following: > > ==486== > ==486== HEAP SUMMARY: > ==486== in use at exit: 95,262 bytes in 1,984 blocks > ==486== total heap usage: 34,975 allocs, 32,991 frees, 22,150,370 bytes allocated > ==486== > ==486== 394 (16 direct, 378 indirect) bytes in 1 blocks are definitely lost in loss record 7 of 10 > ==486== at 0x4027282: malloc (vg_replace_malloc.c:270) > ==486== by 0x82228BF: ber_memalloc_x (memory.c:228) > ==486== by 0x822290C: ber_memalloc (memory.c:244) > ==486== by 0x81EAC29: tavl_insert (tavl.c:94) > ==486== by 0x81C7FE9: sssvlv_op_response (sssvlv.c:760) > ==486== by 0x8084184: slap_response_play (result.c:491) > ==486== by 0x80859AE: slap_send_search_entry (result.c:995) > ==486== by 0x810BDD6: bdb_search (search.c:1014) > ==486== by 0x80F11DB: overlay_op_walk (backover.c:671) > ==486== by 0x80F138B: over_op_func (backover.c:723) > ==486== by 0x80F1443: over_op_search (backover.c:750) > ==486== by 0x80748AE: fe_op_search (search.c:402) > ==486== > ==486== 94,753 (16 direct, 94,737 indirect) bytes in 1 blocks are definitely lost in loss record 10 of 10 > ==486== at 0x4027282: malloc (vg_replace_malloc.c:270) > ==486== by 0x82228BF: ber_memalloc_x (memory.c:228) > ==486== by 0x822290C: ber_memalloc (memory.c:244) > ==486== by 0x81EAB3A: tavl_insert (tavl.c:69) > ==486== by 0x81C7FE9: sssvlv_op_response (sssvlv.c:760) > ==486== by 0x8084184: slap_response_play (result.c:491) > ==486== by 0x80859AE: slap_send_search_entry (result.c:995) > ==486== by 0x810BDD6: bdb_search (search.c:1014) > ==486== by 0x80F11DB: overlay_op_walk (backover.c:671) > ==486== by 0x80F138B: over_op_func (backover.c:723) > ==486== by 0x80F1443: over_op_search (backover.c:750) > ==486== by 0x80748AE: fe_op_search (search.c:402) > ==486== > ==486== LEAK SUMMARY: > ==486== definitely lost: 32 bytes in 2 blocks > ==486== indirectly lost: 95,115 bytes in 1,976 blocks > ==486== possibly lost: 0 bytes in 0 blocks > ==486== still reachable: 115 bytes in 6 blocks > ==486== suppressed: 0 bytes in 0 blocks > ==486== Reachable blocks (those to which a pointer was found) are not shown. > ==486== To see them, rerun with: --leak-check=full --show-reachable=yes > ==486== > ==486== For counts of detected and suppressed errors, rerun with: -v > ==486== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 71 from 13) > > > > > > ----- Original Message ----- > From: Howard Chu <hyc(a)symas.com> > To: jdhgit(a)yahoo.com; openldap-its(a)openldap.org > Cc: > Sent: Friday, May 24, 2013 8:10 AM > Subject: Re: reference through null pointer and memory leak (related to ITS#7588) > > jdhgit(a)yahoo.com wrote: >> Full_Name: John Hardin >> Version: master >> OS: Centos 6.4 >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (50.23.115.111) >> >> >> The commit for ITS#7588 causes a crash if next_node is NULL: >> >> /* Set the first entry to send for the next page */ >> so->so_tree = next_node; >> + next_node->avl_left = NULL; >> >> next_node will be NULL if all entries have been sent, or if slapd_shutdown is >> true. > > Thanks for pointing this out, will fix it shortly. > >> Another issue related to ITS#7588 is a memory leak when a sorted search with >> paged results is aborted. This may be because so->so_tree is not the root of the >> tree when free_sort_op() calls tavl_free(). > > Not being root of the tree is irrelevant. The tree is threaded, and every remaining node is connected by its preceding node's right child pointer. The tavl_free() function recurses over all of the right and left children, so this should not be a problem. > > Can you post a test case that demonstrates the leak? > > -- -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by hyc＠symas.com 27 May '13

27 May '13

Christian Kratzer wrote: > Hi Howard, Never mind, this was actually a bug in the handling of proxied attributes. Fixed now in master, your test case should work fine there. > > On Mon, 27 May 2013, hyc(a)symas.com wrote: >> ck(a)cksoft.de wrote: >>> Hi, >>> >>> Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. >> >> Yeah, using DNs other than the cn=config rootDN is frequently a problem. This >> is why when cn=config was introduced in 2.3 only the cn=config rootDN was >> allowed access to the tree. >> >> In this particular case, there's a simpler solution - add schema definitions >> for the missing RDN attributes directly to the cn=config entry. In your case, >> move the "ou" definition from the cn=core schema entry. >> >> There's nothing dirty about this solution - it has always been valid to define >> schema elements in the top-level slapd.conf file as well as in the top >> cn=config global config entry. The feature doesn't get used much because most >> 3rd party schemas are distributed as their own files, so it's simpler to just >> use the include directive to reference them. But for your current situation, >> you need to define these schema elements as early as possible, so that they >> can be processed as valid later on. > > Thanks for the feedback. > > As my sample had modifiersName: cn=Alice,ou=People,dc=test I added definitions for 'ou' and 'dc' to cn=config. > > It seems this helps for modifiersNames of entries below cn=config but not for cn=config itself. > > I have uploaded following three configs that illustrate the remaining problem: > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-1-fail.l… > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-2-ok.ldif > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-3-fail.l… > > The original failure with config-1 because of a modifiersName on cn=module{0},cn=config: > > [root@test-centos64 test]# slapadd -v -n0 -F config-1 -l config-1-fail.ldif > added: "cn=config" (00000001) > 51a32d4b str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) > slapadd: could not parse entry (line=42) > _# 7.41% eta none elapsed none spd 1.5 M/s > Closing DB... > [root@test-centos64 test]# > > Workaround applied in config-2 with attribute definitions in cn=config > > [root@test-centos64 test]# diff -u config-1-fail.ldif config-2-ok.ldif > --- config-1-fail.ldif 2013-05-27 11:50:35.368253951 +0200 > +++ config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 > @@ -28,6 +28,12 @@ > olcTLSVerifyClient: never > olcToolThreads: 1 > olcWriteTimeout: 0 > +olcAttributeTypes: ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' > + RFC2256: organizational unit this object belongs to' SUP name ) > +olcAttributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone > + nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST > + R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA > + LUE ) > structuralObjectClass: olcGlobal > entryUUID: 3b1e9034-58d9-1032-8161-d3a3b8e342e7 > creatorsName: cn=config > @@ -86,8 +92,6 @@ > ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) > olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 > : organization this object belongs to' SUP name ) > -olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' > - RFC2256: organizational unit this object belongs to' SUP name ) > olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated > with the entity' SUP name ) > olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui > @@ -193,10 +197,6 @@ > olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbo > x' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR ca > seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) > -olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone > - nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST > - R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA > - LUE ) > olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DE > SC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBST > R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) > [root@test-centos64 test]# > > [root@test-centos64 test]# slapadd -v -n0 -F config-2 -l config-2-ok.ldif > added: "cn=config" (00000001) > added: "cn=module{0},cn=config" (00000001) > added: "cn=schema,cn=config" (00000001) > added: "cn={0}core,cn=schema,cn=config" (00000001) > added: "olcDatabase={-1}frontend,cn=config" (00000001) > added: "olcDatabase={0}config,cn=config" (00000001) > added: "olcDatabase={1}mdb,cn=config" (00000001) > _#################### 100.00% eta none elapsed none fast! > Closing DB... > [root@test-centos64 test]# > > Breaks again after a modifiersname is added to cn=config > > [root@test-centos64 test]# diff -u config-2-ok.ldif config-3-fail.ldif > --- config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 > +++ config-3-fail.ldif 2013-05-27 11:52:57.346255334 +0200 > @@ -42,7 +42,7 @@ > olcLogLevel: Stats > olcLogLevel: Stats2 > entryCSN: 20130524161850.764209Z#000000#000#000000 > -modifiersName: cn=config > +modifiersName: cn=Alice,ou=People,dc=test > modifyTimestamp: 20130524161850Z > > dn: cn=module{0},cn=config > [root@test-centos64 test]# > > [root@test-centos64 test]# slapadd -v -n0 -F config-3 -l config-3-fail.ldif > 51a32daf str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) > slapadd: could not parse entry (line=1) > _# 7.35% eta none elapsed none spd 3.0 M/s > Closing DB... > [root@test-centos64 test]# > > Sorry if I do not see the obvious. Is there any possibility to get this to work for cn=config as well as entries below cn=config. > > How much freedom would we have to rearrange the entries und cn=config so we could have the schema defintions read before olcGlobal ? > > Greetings > Christian > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by ck＠cksoft.de 27 May '13

27 May '13

Hi Howard, On Mon, 27 May 2013, hyc(a)symas.com wrote: > ck(a)cksoft.de wrote: >> Hi, >> >> Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. > > Yeah, using DNs other than the cn=config rootDN is frequently a problem. This > is why when cn=config was introduced in 2.3 only the cn=config rootDN was > allowed access to the tree. > > In this particular case, there's a simpler solution - add schema definitions > for the missing RDN attributes directly to the cn=config entry. In your case, > move the "ou" definition from the cn=core schema entry. > > There's nothing dirty about this solution - it has always been valid to define > schema elements in the top-level slapd.conf file as well as in the top > cn=config global config entry. The feature doesn't get used much because most > 3rd party schemas are distributed as their own files, so it's simpler to just > use the include directive to reference them. But for your current situation, > you need to define these schema elements as early as possible, so that they > can be processed as valid later on. Thanks for the feedback. As my sample had modifiersName: cn=Alice,ou=People,dc=test I added definitions for 'ou' and 'dc' to cn=config. It seems this helps for modifiersNames of entries below cn=config but not for cn=config itself. I have uploaded following three configs that illustrate the remaining problem: http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-1-fail.l… http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-2-ok.ldif http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config-3-fail.l… The original failure with config-1 because of a modifiersName on cn=module{0},cn=config: [root@test-centos64 test]# slapadd -v -n0 -F config-1 -l config-1-fail.ldif added: "cn=config" (00000001) 51a32d4b str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=42) _# 7.41% eta none elapsed none spd 1.5 M/s Closing DB... [root@test-centos64 test]# Workaround applied in config-2 with attribute definitions in cn=config [root@test-centos64 test]# diff -u config-1-fail.ldif config-2-ok.ldif --- config-1-fail.ldif 2013-05-27 11:50:35.368253951 +0200 +++ config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 @@ -28,6 +28,12 @@ olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 +olcAttributeTypes: ( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' + RFC2256: organizational unit this object belongs to' SUP name ) +olcAttributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone + nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST + R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA + LUE ) structuralObjectClass: olcGlobal entryUUID: 3b1e9034-58d9-1032-8161-d3a3b8e342e7 creatorsName: cn=config @@ -86,8 +92,6 @@ ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 : organization this object belongs to' SUP name ) -olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' - RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui @@ -193,10 +197,6 @@ olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbo x' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR ca seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) -olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone - nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST - R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA - LUE ) olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DE SC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) [root@test-centos64 test]# [root@test-centos64 test]# slapadd -v -n0 -F config-2 -l config-2-ok.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) added: "olcDatabase={0}config,cn=config" (00000001) added: "olcDatabase={1}mdb,cn=config" (00000001) _#################### 100.00% eta none elapsed none fast! Closing DB... [root@test-centos64 test]# Breaks again after a modifiersname is added to cn=config [root@test-centos64 test]# diff -u config-2-ok.ldif config-3-fail.ldif --- config-2-ok.ldif 2013-05-27 11:49:17.691253291 +0200 +++ config-3-fail.ldif 2013-05-27 11:52:57.346255334 +0200 @@ -42,7 +42,7 @@ olcLogLevel: Stats olcLogLevel: Stats2 entryCSN: 20130524161850.764209Z#000000#000#000000 -modifiersName: cn=config +modifiersName: cn=Alice,ou=People,dc=test modifyTimestamp: 20130524161850Z dn: cn=module{0},cn=config [root@test-centos64 test]# [root@test-centos64 test]# slapadd -v -n0 -F config-3 -l config-3-fail.ldif 51a32daf str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=1) _# 7.35% eta none elapsed none spd 3.0 M/s Closing DB... [root@test-centos64 test]# Sorry if I do not see the obvious. Is there any possibility to get this to work for cn=config as well as entries below cn=config. How much freedom would we have to rearrange the entries und cn=config so we could have the schema defintions read before olcGlobal ? Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

1 0

Re: (ITS#7582) Access to uninitialized memory when sending cldap packet
by stefw＠redhat.com 27 May '13

27 May '13

On 23.05.2013 21:34, Howard Chu wrote: > Your patch doesn't fix the issue. The behavior under valgrind is > unchanged either way. Seems you're missing a '!' in your test. Indeed, thank you for fixing this and applying the patch. Cheers, Stef

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by hyc＠symas.com 26 May '13

26 May '13

ck(a)cksoft.de wrote: > Hi, > > Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. Yeah, using DNs other than the cn=config rootDN is frequently a problem. This is why when cn=config was introduced in 2.3 only the cn=config rootDN was allowed access to the tree. In this particular case, there's a simpler solution - add schema definitions for the missing RDN attributes directly to the cn=config entry. In your case, move the "ou" definition from the cn=core schema entry. There's nothing dirty about this solution - it has always been valid to define schema elements in the top-level slapd.conf file as well as in the top cn=config global config entry. The feature doesn't get used much because most 3rd party schemas are distributed as their own files, so it's simpler to just use the include directive to reference them. But for your current situation, you need to define these schema elements as early as possible, so that they can be processed as valid later on. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7609) back-meta enhancement: filter patterns for target selection
by hyc＠OpenLDAP.org 26 May '13

26 May '13

Full_Name: Howard Chu Version: 2.4.35 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc Since a lot of applications perform DN lookups using a search filter, it would be useful to allow specifying a regex pattern match on filters to select a target. This would avoid broadcasting a suffix-level search to all targets unnecessarily. The intended use case is for a system where the DIT is sharded across multiple servers, and entries are distributed across each target using some regular pattern. (e.g., uid=a.* on target1, uid=b.* on target2, etc...)

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by ck＠cksoft.de 26 May '13

26 May '13

Hi, Summary: it seems having a modifiersdn outside of cn=config in cn=config breaks replication once slapd is restarted. I have a more elaborate test setup with four servers. Two masters ldaptest1, ldaptest2 using syncrepl in mirrormode . Two slaves ldaptest3, ldaptest4 that use syncrepl to slave from the masters. The masters and the slaves also replicate cn=config between themselves. Replication config is as follows: on ldaptest1 and ldaptest2: dn: cn=config ... olcServerID: 1 ldap://ldaptest1.cksoft.de olcServerID: 2 ldap://ldaptest2.cksoft.de olcServerID: 3 ldap://ldaptest3.cksoft.de olcServerID: 4 ldap://ldaptest4.cksoft.de dn: olcDatabase={1}mdb,cn=config ... olcSyncrepl: rid=001 provider=ldap://ldaptest1.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcSyncrepl: rid=002 provider=ldap://ldaptest2.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcMirrorMode: TRUE on ldaptest3 and ldaptest4: dn: cn=config ... olcServerID: 1 ldap://ldaptest1.cksoft.de olcServerID: 2 ldap://ldaptest2.cksoft.de olcServerID: 3 ldap://ldaptest3.cksoft.de olcServerID: 4 ldap://ldaptest4.cksoft.de dn: olcDatabase={1}mdb,cn=config ... olcSyncrepl: rid=001 provider=ldap://ldaptest1.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcSyncrepl: rid=002 provider=ldap://ldaptest2.cksoft.de bindmethod=simple binddn="cn=replica,ou=system,dc=test" credentials="secret" keepalive=0:0:0 starttls=yes tls_cert="/usr/local/etc/openldap/certs/server.cert" tls_key="/usr/local/etc/openldap/certs/server.key" tls_cacert="/usr/local/etc/openldap/certs/cksoftware-gmbh-ca-2011-2031.cert" tls_reqcert=demand tls_crlcheck=none filter="(objectclass=*)" searchbase="dc=test" scope=sub type=refreshAndPersist retry="60 10 300 +" olcMirrorMode: FALSE Once I modify something trivial like olcLogLevel on the slaves using my personal dn, cn=config will have following operational attributes: # config dn: cn=config structuralObjectClass: olcGlobal entryUUID: dc78e00a-461a-1032-9454-cd151c72b364 creatorsName: cn=config createTimestamp: 20130430194949Z entryCSN: 20130526075059.867187Z#000000#004#000000 modifiersName: uid=ckratzer,ou=people,dc=test modifyTimestamp: 20130526075059Z contextCSN: 20130526074631.636527Z#000000#003#000000 contextCSN: 20130526075059.867187Z#000000#004#000000 entryDN: cn=config subschemaSubentry: cn=Subschema I then restart slapd on the first slave ldaptest3 and leave it running on ldaptest4. A change replicated from the masters will appear on ldaptest4 just fine. The restarted master on ldaptest3 fails to apply the change May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_message_to_entry: rid=001 DN: cn=test,dc=test, UUID: 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 inserted UUID 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 be_search (0) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 cn=test,dc=test May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=001 entry unchanged, ignored (cn=test,dc=test,) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_updateCookie: rid=001 be_modify failed (17) May 26 10:06:13 ldaptest3 slapd[2410]: do_syncrepl: rid=001 rc 17 retrying May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_message_to_entry: rid=002 DN: cn=test,dc=test, UUID: 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 inserted UUID 3e48a550-4dd1-1032-9f9f-47169a206073 May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 be_search (0) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 cn=test,dc=test, May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_entry: rid=002 entry unchanged, ignored (cn=test,dc=test,) May 26 10:06:13 ldaptest3 slapd[2410]: syncrepl_updateCookie: rid=002 be_modify failed (17) May 26 10:06:13 ldaptest3 slapd[2410]: do_syncrepl: rid=002 rc 17 retrying I currently have customer data in above test setup so I had to do some obfuscation in above samples and logs. If required I can setup maximally stripped down case that illustrates the problem. Would it be possible to mask modifiersName inside cn=config to either a fixed value just append something like cn=proxied,cn=config to dns outside of cn=config. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

1 0

Re: (ITS#7607) Assertion triggers during many sequential transaction commits
by hyc＠symas.com 24 May '13

24 May '13

Howard Chu wrote: > éÌØÑ ìÕËØÑÎÏ× wrote: >> What can i do to help investigating this issue? >> I'm not very familliar with lmdb sources so any suggestions on where to look >> would be appreciated! > > I've installed a Win7 x64 VM here and compiled with gcc 4.8.0 and it works fine. > I've also installed Visual Studio 2012 Express and compiled with that, it's also working fine. Doesn't seem like there's an OpenLDAP bug here, must be a problem with your machine. >> ó Õ×ÁÖÅÎÉÅÍ, éÌØÑ >> >> >> 2013/5/24 Howard Chu <hyc(a)symas.com <mailto:hyc@symas.com>> >> >> ilya.lukyanov(a)gmail.com <mailto:ilya.lukyanov@gmail.com> wrote: >> >> Full_Name: Ilya Lukyanov >> Version: 2.4.35 >> OS: Windows 7 x64 >> URL: ftp://ftp.openldap.org/__incoming/ <ftp://ftp.openldap.org/incoming/> >> Submission from: (NULL) (95.25.254.250) >> >> >> I've built lmdb from source distribution of OpenLDAP 2.4.35 under >> Windows 7 x64 >> under Visual Studio 2012. All tests included into source distribution pass >> successfully. >> >> Then i'm executing my own test with code as follows: >> https://gist.github.com/__ilyalukyanov/5644971 >> <https://gist.github.com/ilyalukyanov/5644971> >> And i'm allways get an asserion when executing near 32500-th >> mdb_txn_commit >> (line 2231 - assert(oldpg_txnid <= env->me_pglast);) >> I think this is a bug because if consider the scenario with separate >> usage of >> LightningDB under high write-load scenario, 32k commits is not enough. >> >> >> Your test runs fine on my Linux box. I don't currently have a Windows 7 >> x64 test machine, won't be able to investigate this any time soon. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7606) reference through null pointer and memory leak
by quanah＠zimbra.com 24 May '13

24 May '13

--On Friday, May 24, 2013 9:06 PM +0000 jdhgit(a)yahoo.com wrote: Please don't send garbage to the ITS. I advise finding an email client that can actually generate proper email. --Quanah > --1665047788-1800616979-1369429529=:40525 > Content-Type: text/plain; charset=iso-8859-1 > Content-Transfer-Encoding: quoted-printable > > Configuration:=0A=0A=A0 CFLAGS=3D"-g -O0" ./configure > --exec-prefix=3D/usr = --prefix=3D/ --enable-overlays=3Dyes > --enable-slapd --enable-debug=0A=0ASta= rt server: =0A=0A=A0 valgrind > --leak-check=3Dfull openldap/servers/slapd/sl= apd=0A=0APerform search > with sorted, paged results. Repeating the command w= ill cause the leaked > memory to grow. I'm using:=0A=0A=A0 ldapsearch -H ldap= ://10.10.9.85 -x > -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one -E'!sss=3Dsn:2= .5.13.3' > -E'!pr=3D10/prompt'=0A=0AAt the prompt, type ctrl-C.=0A=0AKill the= > slapd process. The output of valgrind shows the > following:=0A=0A=3D=3D486= =3D=3D =0A=3D=3D486=3D=3D HEAP > SUMMARY:=0A=3D=3D486=3D=3D=A0=A0=A0=A0 in us= e at exit: 95,262 bytes in > 1,984 blocks=0A=3D=3D486=3D=3D=A0=A0 total heap = usage: 34,975 allocs, > 32,991 frees, 22,150,370 bytes allocated=0A=3D=3D486= =3D=3D > =0A=3D=3D486=3D=3D 394 (16 direct, 378 indirect) bytes in 1 blocks a= re > definitely lost in loss record 7 of 10=0A=3D=3D486=3D=3D=A0=A0=A0 at 0x4= > 027282: malloc (vg_replace_malloc.c:270)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x82= 228BF: ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x822290= C: ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x81EAC29: tav= l_insert (tavl.c:94)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x81C7FE9: sssvlv_op_res= ponse (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 > by 0x8084184: slap_response= _play > (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80859AE: slap_send_sea= > rch_entry (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x810BDD6: > bdb_searc= h (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F11DB: > overlay_op_walk = (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x80F138B: over_op_func (bac= kover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x80F1443: over_op_search (backo= ver.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 > by 0x80748AE: fe_op_search (search.c:= 402)=0A=3D=3D486=3D=3D > =0A=3D=3D486=3D=3D 94,753 (16 direct, 94,737 indirec= t) bytes in 1 > blocks are definitely lost in loss record 10 of 10=0A=3D=3D48= > 6=3D=3D=A0=A0=A0 at 0x4027282: malloc > (vg_replace_malloc.c:270)=0A=3D=3D486= =3D=3D=A0=A0=A0 by 0x82228BF: > ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D= =3D=A0=A0=A0 by 0x822290C: > ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0= =A0=A0 by 0x81EAB3A: > tavl_insert (tavl.c:69)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x81C7FE9: > sssvlv_op_response (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 by = > 0x8084184: slap_response_play (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 > by = 0x80859AE: slap_send_search_entry > (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0= by 0x810BDD6: bdb_search > (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x8= 0F11DB: > overlay_op_walk (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80= > F138B: over_op_func (backover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by > 0x80F144= 3: over_op_search (backover.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 > by 0x80748AE:= fe_op_search (search.c:402)=0A=3D=3D486=3D=3D > =0A=3D=3D486=3D=3D LEAK SUMM= ARY:=0A=3D=3D486=3D=3D=A0=A0=A0 definitely > lost: 32 bytes in 2 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0 indirectly lost: > 95,115 bytes in 1,976 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0=A0=A0 possibly > lost: 0 bytes in 0 blocks=0A=3D=3D486= =3D=3D=A0=A0=A0 still reachable: > 115 bytes in 6 blocks=0A=3D=3D486=3D=3D=A0= =A0=A0=A0=A0=A0=A0=A0 > suppressed: 0 bytes in 0 blocks=0A=3D=3D486=3D=3D Rea= chable blocks > (those to which a pointer was found) are not shown.=0A=3D=3D4= 86=3D=3D > To see them, rerun with: --leak-check=3Dfull --show-reachable=3Dye= > s=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D For counts of detected and > suppresse= d errors, rerun with: -v=0A=3D=3D486=3D=3D ERROR SUMMARY: 2 > errors from 2 c= ontexts (suppressed: 71 from 13) > --1665047788-1800616979-1369429529=:40525 > Content-Type: text/html; charset=iso-8859-1 > Content-Transfer-Encoding: quoted-printable > > <html><body><div style=3D"color:#000; background-color:#fff; > font-family:ti= mes new roman, new york, times, > serif;font-size:12pt">Configuration: <br= >>   CFLAGS=3D"-g -O0" ./configure --exec-prefix=3D/usr --prefix=3D/ >> --e= > nable-overlays=3Dyes --enable-slapd --enable-debug Start server: > <br= >>   valgrind --leak-check=3Dfull >> openldap/servers/slapd/slapd <b= > r>Perform search with sorted, paged results. Repeating the command will > cau= se the leaked memory to grow. I'm using:   ldapsearch -H > ldap:/= /10.10.9.85 -x -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one > -E'!sss=3Dsn:2.5= .13.3' -E'!pr=3D10/prompt' At the prompt, type > ctrl-C. Kill t= he slapd process. The output of valgrind shows the > following: =3D=3D= 486=3D=3D =3D=3D486=3D=3D HEAP > SUMMARY: =3D=3D486=3D=3D  &= nbsp;  in use at exit: > 95,262 bytes in 1,984 blocks =3D=3D486=3D=3D=    total heap > usage: 34,975 allocs, 32,991 frees, 22,150,370 byte= s > allocated =3D=3D486=3D=3D =3D=3D486=3D=3D 394 (16 > direct, 378 indirect) bytes in 1 blocks are definitely lost in loss > record= 7 of 10 =3D=3D486=3D=3D    at 0x4027282: > malloc (vg_repl= ace_malloc.c:270) =3D=3D486=3D=3D    > by 0x82228BF: ber_me= malloc_x > (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: = > ber_memalloc (memory.c:244) =3D=3D486=3D=3D    by > 0x81EAC= 29: tavl_insert (tavl.c:94) =3D=3D486=3D=3D    > by 0x81C7F= E9: sssvlv_op_response > (sssvlv.c:760) =3D=3D486=3D=3D    = by 0x8084184: > slap_response_play (result.c:491) =3D=3D486=3D=3D &nb= sp;  > by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486= > =3D=3D    by 0x810BDD6: bdb_search > (search.c:1014) =3D=3D= 486=3D=3D    by 0x80F11DB: > overlay_op_walk (backover.c:671)<= br>=3D=3D486=3D=3D    > by 0x80F138B: over_op_func (backover.c= > :723) =3D=3D486=3D=3D    by 0x80F1443: over_op_search > (ba= ckover.c:750) =3D=3D486=3D=3D    by 0x80748AE: > fe_op_sear= ch > (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D 94,753 (16 direct, > 9= 4,737 indirect) bytes in 1 blocks are definitely lost in loss record > 10 of = 10 =3D=3D486=3D=3D    at 0x4027282: malloc > (vg_replace_ma= lloc.c:270) =3D=3D486=3D=3D    by > 0x82228BF: ber_memalloc= _x > (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: ber_me= > malloc (memory.c:244) =3D=3D486=3D=3D    by 0x81EAB3A: > ta= vl_insert (tavl.c:69) =3D=3D486=3D=3D    by > 0x81C7FE9: ss= svlv_op_response > (sssvlv.c:760) =3D=3D486=3D=3D    by 0x8= 084184: > slap_response_play (result.c:491) =3D=3D486=3D=3D  &nb= sp; > by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486=3D=3D&= > nbsp;   by 0x810BDD6: bdb_search > (search.c:1014) =3D=3D486=3D= =3D    by 0x80F11DB: > overlay_op_walk (backover.c:671) =3D= =3D486=3D=3D    > by 0x80F138B: over_op_func (backover.c:723)<= > br>=3D=3D486=3D=3D    by 0x80F1443: over_op_search > (backover.c:750) =3D=3D486=3D=3D    by 0x80748AE: > fe_op_= search (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D LEAK > SUMMARY:<= br>=3D=3D486=3D=3D    definitely lost: 32 bytes > in 2 blocks<= br>=3D=3D486=3D=3D    indirectly lost: > 95,115 bytes in 1,976= > blocks =3D=3D486=3D=3D      possibly lost: 0 > b= ytes in 0 blocks =3D=3D486=3D=3D    still reachable: > 115 = bytes in 6 > blocks =3D=3D486=3D=3D      &nb= > sp;  suppressed: 0 bytes in 0 blocks =3D=3D486=3D=3D Reachable > bloc= ks (those to which a pointer was found) are not > shown. =3D=3D486=3D=3D T= o see them, rerun with: --leak-check=3Dfull > --show-reachable=3Dyes =3D= =3D486=3D=3D =3D=3D486=3D=3D For > counts of detected and suppressed erro= rs, rerun with: > -v =3D=3D486=3D=3D ERROR SUMMARY: 2 errors from 2 contex= ts > (suppressed: 71 from 13) <div style=3D"font-family: times new= > roman, new york, times, serif; font-size: 12pt;"><div > style=3D"font-family= : times new roman, new york, > times, serif; font-size: 12pt;"> </div> </div> </div></body></html> > --1665047788-1800616979-1369429529=:40525-- > > -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7606) reference through null pointer and memory leak
by jdhgit＠yahoo.com 24 May '13

24 May '13

--1665047788-1800616979-1369429529=:40525 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Configuration:=0A=0A=A0 CFLAGS=3D"-g -O0" ./configure --exec-prefix=3D/usr = --prefix=3D/ --enable-overlays=3Dyes --enable-slapd --enable-debug=0A=0ASta= rt server: =0A=0A=A0 valgrind --leak-check=3Dfull openldap/servers/slapd/sl= apd=0A=0APerform search with sorted, paged results. Repeating the command w= ill cause the leaked memory to grow. I'm using:=0A=0A=A0 ldapsearch -H ldap= ://10.10.9.85 -x -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one -E'!sss=3Dsn:2= .5.13.3' -E'!pr=3D10/prompt'=0A=0AAt the prompt, type ctrl-C.=0A=0AKill the= slapd process. The output of valgrind shows the following:=0A=0A=3D=3D486= =3D=3D =0A=3D=3D486=3D=3D HEAP SUMMARY:=0A=3D=3D486=3D=3D=A0=A0=A0=A0 in us= e at exit: 95,262 bytes in 1,984 blocks=0A=3D=3D486=3D=3D=A0=A0 total heap = usage: 34,975 allocs, 32,991 frees, 22,150,370 bytes allocated=0A=3D=3D486= =3D=3D =0A=3D=3D486=3D=3D 394 (16 direct, 378 indirect) bytes in 1 blocks a= re definitely lost in loss record 7 of 10=0A=3D=3D486=3D=3D=A0=A0=A0 at 0x4= 027282: malloc (vg_replace_malloc.c:270)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x82= 228BF: ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x822290= C: ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x81EAC29: tav= l_insert (tavl.c:94)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x81C7FE9: sssvlv_op_res= ponse (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x8084184: slap_response= _play (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80859AE: slap_send_sea= rch_entry (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x810BDD6: bdb_searc= h (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F11DB: overlay_op_walk = (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F138B: over_op_func (bac= kover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F1443: over_op_search (backo= ver.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80748AE: fe_op_search (search.c:= 402)=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D 94,753 (16 direct, 94,737 indirec= t) bytes in 1 blocks are definitely lost in loss record 10 of 10=0A=3D=3D48= 6=3D=3D=A0=A0=A0 at 0x4027282: malloc (vg_replace_malloc.c:270)=0A=3D=3D486= =3D=3D=A0=A0=A0 by 0x82228BF: ber_memalloc_x (memory.c:228)=0A=3D=3D486=3D= =3D=A0=A0=A0 by 0x822290C: ber_memalloc (memory.c:244)=0A=3D=3D486=3D=3D=A0= =A0=A0 by 0x81EAB3A: tavl_insert (tavl.c:69)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x81C7FE9: sssvlv_op_response (sssvlv.c:760)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x8084184: slap_response_play (result.c:491)=0A=3D=3D486=3D=3D=A0=A0=A0 by = 0x80859AE: slap_send_search_entry (result.c:995)=0A=3D=3D486=3D=3D=A0=A0=A0= by 0x810BDD6: bdb_search (search.c:1014)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x8= 0F11DB: overlay_op_walk (backover.c:671)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80= F138B: over_op_func (backover.c:723)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80F144= 3: over_op_search (backover.c:750)=0A=3D=3D486=3D=3D=A0=A0=A0 by 0x80748AE:= fe_op_search (search.c:402)=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D LEAK SUMM= ARY:=0A=3D=3D486=3D=3D=A0=A0=A0 definitely lost: 32 bytes in 2 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0 indirectly lost: 95,115 bytes in 1,976 blocks=0A=3D= =3D486=3D=3D=A0=A0=A0=A0=A0 possibly lost: 0 bytes in 0 blocks=0A=3D=3D486= =3D=3D=A0=A0=A0 still reachable: 115 bytes in 6 blocks=0A=3D=3D486=3D=3D=A0= =A0=A0=A0=A0=A0=A0=A0 suppressed: 0 bytes in 0 blocks=0A=3D=3D486=3D=3D Rea= chable blocks (those to which a pointer was found) are not shown.=0A=3D=3D4= 86=3D=3D To see them, rerun with: --leak-check=3Dfull --show-reachable=3Dye= s=0A=3D=3D486=3D=3D =0A=3D=3D486=3D=3D For counts of detected and suppresse= d errors, rerun with: -v=0A=3D=3D486=3D=3D ERROR SUMMARY: 2 errors from 2 c= ontexts (suppressed: 71 from 13) --1665047788-1800616979-1369429529=:40525 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable <html><body><div style=3D"color:#000; background-color:#fff; font-family:ti= mes new roman, new york, times, serif;font-size:12pt">Configuration: <br= >  CFLAGS=3D"-g -O0" ./configure --exec-prefix=3D/usr --prefix=3D/ --e= nable-overlays=3Dyes --enable-slapd --enable-debug Start server: <br= >   valgrind --leak-check=3Dfull openldap/servers/slapd/slapd <b= r>Perform search with sorted, paged results. Repeating the command will cau= se the leaked memory to grow. I'm using:   ldapsearch -H ldap:/= /10.10.9.85 -x -b ou=3Dpeople,dc=3Dexample,dc=3Dcom -s one -E'!sss=3Dsn:2.5= .13.3' -E'!pr=3D10/prompt' At the prompt, type ctrl-C. Kill t= he slapd process. The output of valgrind shows the following: =3D=3D= 486=3D=3D =3D=3D486=3D=3D HEAP SUMMARY: =3D=3D486=3D=3D  &= nbsp;  in use at exit: 95,262 bytes in 1,984 blocks =3D=3D486=3D=3D=    total heap usage: 34,975 allocs, 32,991 frees, 22,150,370 byte= s allocated =3D=3D486=3D=3D =3D=3D486=3D=3D 394 (16 direct, 378 indirect) bytes in 1 blocks are definitely lost in loss record= 7 of 10 =3D=3D486=3D=3D    at 0x4027282: malloc (vg_repl= ace_malloc.c:270) =3D=3D486=3D=3D    by 0x82228BF: ber_me= malloc_x (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: = ber_memalloc (memory.c:244) =3D=3D486=3D=3D    by 0x81EAC= 29: tavl_insert (tavl.c:94) =3D=3D486=3D=3D    by 0x81C7F= E9: sssvlv_op_response (sssvlv.c:760) =3D=3D486=3D=3D    = by 0x8084184: slap_response_play (result.c:491) =3D=3D486=3D=3D &nb= sp;  by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486= =3D=3D    by 0x810BDD6: bdb_search (search.c:1014) =3D=3D= 486=3D=3D    by 0x80F11DB: overlay_op_walk (backover.c:671)<= br>=3D=3D486=3D=3D    by 0x80F138B: over_op_func (backover.c= :723) =3D=3D486=3D=3D    by 0x80F1443: over_op_search (ba= ckover.c:750) =3D=3D486=3D=3D    by 0x80748AE: fe_op_sear= ch (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D 94,753 (16 direct, 9= 4,737 indirect) bytes in 1 blocks are definitely lost in loss record 10 of = 10 =3D=3D486=3D=3D    at 0x4027282: malloc (vg_replace_ma= lloc.c:270) =3D=3D486=3D=3D    by 0x82228BF: ber_memalloc= _x (memory.c:228) =3D=3D486=3D=3D    by 0x822290C: ber_me= malloc (memory.c:244) =3D=3D486=3D=3D    by 0x81EAB3A: ta= vl_insert (tavl.c:69) =3D=3D486=3D=3D    by 0x81C7FE9: ss= svlv_op_response (sssvlv.c:760) =3D=3D486=3D=3D    by 0x8= 084184: slap_response_play (result.c:491) =3D=3D486=3D=3D  &nb= sp; by 0x80859AE: slap_send_search_entry (result.c:995) =3D=3D486=3D=3D&= nbsp;   by 0x810BDD6: bdb_search (search.c:1014) =3D=3D486=3D= =3D    by 0x80F11DB: overlay_op_walk (backover.c:671) =3D= =3D486=3D=3D    by 0x80F138B: over_op_func (backover.c:723)<= br>=3D=3D486=3D=3D    by 0x80F1443: over_op_search (backover.c:750) =3D=3D486=3D=3D    by 0x80748AE: fe_op_= search (search.c:402) =3D=3D486=3D=3D =3D=3D486=3D=3D LEAK SUMMARY:<= br>=3D=3D486=3D=3D    definitely lost: 32 bytes in 2 blocks<= br>=3D=3D486=3D=3D    indirectly lost: 95,115 bytes in 1,976= blocks =3D=3D486=3D=3D      possibly lost: 0 b= ytes in 0 blocks =3D=3D486=3D=3D    still reachable: 115 = bytes in 6 blocks =3D=3D486=3D=3D      &nb= sp;  suppressed: 0 bytes in 0 blocks =3D=3D486=3D=3D Reachable bloc= ks (those to which a pointer was found) are not shown. =3D=3D486=3D=3D T= o see them, rerun with: --leak-check=3Dfull --show-reachable=3Dyes =3D= =3D486=3D=3D =3D=3D486=3D=3D For counts of detected and suppressed erro= rs, rerun with: -v =3D=3D486=3D=3D ERROR SUMMARY: 2 errors from 2 contex= ts (suppressed: 71 from 13) <div style=3D"font-family: times new= roman, new york, times, serif; font-size: 12pt;"><div style=3D"font-family= : times new roman, new york, times, serif; font-size: 12pt;"> </div> </div> </div></body></html> --1665047788-1800616979-1369429529=:40525--

1 0

Re: (ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by pierangelo.masarati＠polimi.it 24 May '13

24 May '13

On 05/24/2013 09:41 PM, ck(a)cksoft.de wrote: > Full_Name: Christian Kratzer > Version: 2.4.35 > OS: CentOS 6.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (37.80.52.67) > > > Hi, > > I have setup an acl to allow write access to cn=config for users in the main > directory. > > This is mainly to have a clean audit trail of config changes using auditlog so > changes can be tracked back to who did them. > > We also backup config with slapcat -n0 and data with slapcat. > > When restoring configs and data I ran into two spefific problems when cn=config > entries have a modifiersdn outside of cn=config as in: > > dn: cn=config > objectClass: olcGlobal > ... > modifiersName: cn=Alice,ou=People,dc=test > modifyTimestamp: 20130524161850Z > > This is on openldap-2.4.35 on centos-6.4. > > I have built a simple test case to illustrate the problem. Should be easily > reproducible using after editing a few paths in below configs. > > We setup a new openldap server by using slapadd -n0 of below config and slapadd > of below data in test.ldif. > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config.ldif > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/test.ldif > > After starting slapd I modify the configuration as cn=Alice,ou=People,dc=test > using below scripts > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.sh > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.ldif > > I then extract following two backups from cn=config using slapcat -n0 and > dc=test using slapcat > > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-cn=conf… > http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-dc=test… > > First problem: An attempt to to restore slapcat-dc=test.ldif after deleting data > using "rm -f /var/lib/ldap/*" fails as follows: > > [root@test-centos64 openldap]# slapadd -v -F slapd.d -l slapcat-dc\=test.ldif > 519f93a8 PROXIED attributeDescription "OU" inserted. > 519f93a8 PROXIED attributeDescription "DC" inserted. > 519f93a8 => mdb_tool_entry_put: id2entry_add failed: err=17 > 519f93a8 => mdb_tool_entry_put: txn_aborted! File exists (17) > slapadd: could not add entry dn="dc=test" (line=1): txn_aborted! File exists This is a chicken and egg problem. OU is not built-in, so it cannot be used until it is configured. Configuration data must only use schema items whose definition is already loaded. I don't see a clear way out of this issue, so I'd pass the ball to Howard. My (humble) suggestion is: delegate modifications to identities whose DN is made of hardcoded attribute types: CN, UID (you can find what attribute types are hardcoded in schema_prep.c). p. > (17) > _#### 24.55% eta none elapsed none spd 2.0 > M/s > Closing DB... > [root@test-centos64 openldap]# > > I can successfully import the data if I edit cn=config.ldif and manuelly fix the > modifiersName to cn=config and reimport configuration using slapadd -n0. > > This also kills our disaster recovery scenario of deleting data and letting > syncrepl handle the recovery. > > Second problem: Recovery of the configuration fails as after "rm -fr slapd.d" > > [root@test-centos64 openldap]# slapadd -v -n0 -F slapd.d -l > slapcat-cn\=config.ldif > 519f95c2 str2entry: invalid value for attributeType modifiersName #0 (syntax > 1.3.6.1.4.1.1466.115.121.1.12) > slapadd: could not parse entry (line=1) > _# 5.39% eta none elapsed none spd 3.2 > M/s > Closing DB... > [root@test-centos64 openldap]# > > Again I am able to work around the problem by fixing the modifiersdn of the > cn=config dump before slapadding with slapadd -n0. > > Any chance of getting above use cases working ? I would like to provide the > customer in question with a straight forward recovery process for both data and > cn=config. > > They would like to avoid using the cn=config rootDN for regular administration > in order to have a clean audit trail of changes using auditlog on cn=config. > > Greetings > Christian > > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7608) cn=config with modifiersdn outside cn=config breaks recovery using slapadd
by ck＠cksoft.de 24 May '13

24 May '13

Full_Name: Christian Kratzer Version: 2.4.35 OS: CentOS 6.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (37.80.52.67) Hi, I have setup an acl to allow write access to cn=config for users in the main directory. This is mainly to have a clean audit trail of config changes using auditlog so changes can be tracked back to who did them. We also backup config with slapcat -n0 and data with slapcat. When restoring configs and data I ran into two spefific problems when cn=config entries have a modifiersdn outside of cn=config as in: dn: cn=config objectClass: olcGlobal ... modifiersName: cn=Alice,ou=People,dc=test modifyTimestamp: 20130524161850Z This is on openldap-2.4.35 on centos-6.4. I have built a simple test case to illustrate the problem. Should be easily reproducible using after editing a few paths in below configs. We setup a new openldap server by using slapadd -n0 of below config and slapadd of below data in test.ldif. http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/config.ldif http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/test.ldif After starting slapd I modify the configuration as cn=Alice,ou=People,dc=test using below scripts http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.sh http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/olcLoglevel.ldif I then extract following two backups from cn=config using slapcat -n0 and dc=test using slapcat http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-cn=conf… http://www.cksoft.de/paste/374f18f905d53f8e6e158702e686b563/slapcat-dc=test… First problem: An attempt to to restore slapcat-dc=test.ldif after deleting data using "rm -f /var/lib/ldap/*" fails as follows: [root@test-centos64 openldap]# slapadd -v -F slapd.d -l slapcat-dc\=test.ldif 519f93a8 PROXIED attributeDescription "OU" inserted. 519f93a8 PROXIED attributeDescription "DC" inserted. 519f93a8 => mdb_tool_entry_put: id2entry_add failed: err=17 519f93a8 => mdb_tool_entry_put: txn_aborted! File exists (17) slapadd: could not add entry dn="dc=test" (line=1): txn_aborted! File exists (17) _#### 24.55% eta none elapsed none spd 2.0 M/s Closing DB... [root@test-centos64 openldap]# I can successfully import the data if I edit cn=config.ldif and manuelly fix the modifiersName to cn=config and reimport configuration using slapadd -n0. This also kills our disaster recovery scenario of deleting data and letting syncrepl handle the recovery. Second problem: Recovery of the configuration fails as after "rm -fr slapd.d" [root@test-centos64 openldap]# slapadd -v -n0 -F slapd.d -l slapcat-cn\=config.ldif 519f95c2 str2entry: invalid value for attributeType modifiersName #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=1) _# 5.39% eta none elapsed none spd 3.2 M/s Closing DB... [root@test-centos64 openldap]# Again I am able to work around the problem by fixing the modifiersdn of the cn=config dump before slapadding with slapadd -n0. Any chance of getting above use cases working ? I would like to provide the customer in question with a straight forward recovery process for both data and cn=config. They would like to avoid using the cn=config rootDN for regular administration in order to have a clean audit trail of changes using auditlog on cn=config. Greetings Christian

1 0

Re: (ITS#7607) Assertion triggers during many sequential transaction commits
by hyc＠symas.com 24 May '13

24 May '13

ilya.lukyanov(a)gmail.com wrote: > Full_Name: Ilya Lukyanov > Version: 2.4.35 > OS: Windows 7 x64 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (95.25.254.250) > > > I've built lmdb from source distribution of OpenLDAP 2.4.35 under Windows 7 x64 > under Visual Studio 2012. All tests included into source distribution pass > successfully. > > Then i'm executing my own test with code as follows: > https://gist.github.com/ilyalukyanov/5644971 > And i'm allways get an asserion when executing near 32500-th mdb_txn_commit > (line 2231 - assert(oldpg_txnid <= env->me_pglast);) > I think this is a bug because if consider the scenario with separate usage of > LightningDB under high write-load scenario, 32k commits is not enough. Your test runs fine on my Linux box. I don't currently have a Windows 7 x64 test machine, won't be able to investigate this any time soon. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7607) Assertion triggers during many sequential transaction commits
by ilya.lukyanov＠gmail.com 24 May '13

24 May '13

Full_Name: Ilya Lukyanov Version: 2.4.35 OS: Windows 7 x64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (95.25.254.250) I've built lmdb from source distribution of OpenLDAP 2.4.35 under Windows 7 x64 under Visual Studio 2012. All tests included into source distribution pass successfully. Then i'm executing my own test with code as follows: https://gist.github.com/ilyalukyanov/5644971 And i'm allways get an asserion when executing near 32500-th mdb_txn_commit (line 2231 - assert(oldpg_txnid <= env->me_pglast);) I think this is a bug because if consider the scenario with separate usage of LightningDB under high write-load scenario, 32k commits is not enough.

1 0

Re: reference through null pointer and memory leak (related to ITS#7588)
by hyc＠symas.com 24 May '13

24 May '13

jdhgit(a)yahoo.com wrote: > Full_Name: John Hardin > Version: master > OS: Centos 6.4 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (50.23.115.111) > > > The commit for ITS#7588 causes a crash if next_node is NULL: > > /* Set the first entry to send for the next page */ > so->so_tree = next_node; > + next_node->avl_left = NULL; > > next_node will be NULL if all entries have been sent, or if slapd_shutdown is > true. Thanks for pointing this out, will fix it shortly. > Another issue related to ITS#7588 is a memory leak when a sorted search with > paged results is aborted. This may be because so->so_tree is not the root of the > tree when free_sort_op() calls tavl_free(). Not being root of the tree is irrelevant. The tree is threaded, and every remaining node is connected by its preceding node's right child pointer. The tavl_free() function recurses over all of the right and left children, so this should not be a problem. Can you post a test case that demonstrates the leak? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by pa＠marcelot.net 24 May '13

24 May '13

On 23 mai 2013, at 19:41, Michael Ströder <michael(a)stroeder.com> wrote: > pa(a)marcelot.net wrote: >> On 23 mai 2013, at 16:31, Howard Chu <hyc(a)symas.com> wrote: >>> Don't do that. >> >> Sure, that's why I have a *bad* workaround to not update the 'objectClass' >> attribute even if the original and my generated one don't match. > > IMO this is not a *bad* workaround. I think it's good practice in a UI client > to *not* automagically modify attribute 'objectClass' without explicit user > interaction asking for modification. In the case of our UI, we don't even present the entries or attributes as is to the user but in an "abstracted" way. They may not even know it's read/stored internally from/as attributes or entries. So, yeah, so it's not so *bad*. It's more of an implementation tuning I wish would have not been required, because the modification seemed harmless and legit (according to LDAP standards). > Ciao, Michael. Regards, Pierre-Arnaud

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by pa＠marcelot.net 24 May '13

24 May '13

On 23 mai 2013, at 19:26, Michael Ströder <michael(a)stroeder.com> wrote: > pa(a)marcelot.net wrote: >> It looks like it's not possible to modify the 'objectClass' attribute of >> configuration entries. >> >> I have some code generating entries for OpenLDAP configuration from a UI utility >> and updating existing configuration entries in DIT. >> This code generates entries with the 'objectClass' attribute containing the full >> object class hierarchy (all the way to 'top') and not only the highest >> structural object class (which is the case of default OpenLDAP configuration). >> >> When updating the configuration in the DIT, the code then tries to complete the >> 'objectClass' attribute with the full list of object classes. >> That operations ends with "error code 53- UnwillingToPerform". >> >> >> Here's an example on the "cn=config" entry: >> #!RESULT ERROR >> #!CONNECTION ldap://10.211.55.13:389 >> #!DATE 2013-05-22T14:56:03.039 >> #!ERROR [LDAP: error code 53 - UnwillingToPerform] >> dn: cn=config >> changetype: modify >> replace: objectClass >> objectClass: olcConfig >> objectClass: olcGlobal >> objectClass: top > > It's not necessarily a bug. > > I think LDAP clients should not act too "smart" and therefore should not > automagically add object classes from the structural object class chain if > they are not already present. You will run into issues with various LDAP > server implementations - at least according to experiences I made with > conducting interop testing with web2ldap and several server implementations. Right, it's just that this kind of modifications is perfectly valid. I mean, I'm not breaking any LDAP rule or concept and if I add the same entry (as a new entry) with the full object class hierarchy, the server is allowing it without a hitch. I still think it should be possible to modify the objectclass but I'll take into account that the implementation does not allow it (yet? ;-)). > A schema-aware client could auto-complete structural object class chain if > adding a new entry though. But again: Don't be too smart. Exactly, that's why I updated my code to do. Let's be dumb, sometimes... > May I ask which UI utility you're using? Sure, that's an internal application we wrote to edit some parts of the OpenLDAP configuration. > Ciao, Michael. Regards, Pierre-Arnaud

1 0

Re: (ITS#7448) "assertion failed" in MDB
by dhawes＠vt.edu 23 May '13

23 May '13

On Wed, May 22, 2013 at 5:49 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > This is ITS#7536. There were more fixes for it in RE24 after 2.4.35 was > released. I just wanted to verify that RE24 does indeed fix this issue.

1 0

reference through null pointer and memory leak (related to ITS#7588)
by jdhgit＠yahoo.com 23 May '13

23 May '13

Full_Name: John Hardin Version: master OS: Centos 6.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (50.23.115.111) The commit for ITS#7588 causes a crash if next_node is NULL: /* Set the first entry to send for the next page */ so->so_tree = next_node; + next_node->avl_left = NULL; next_node will be NULL if all entries have been sent, or if slapd_shutdown is true. Another issue related to ITS#7588 is a memory leak when a sorted search with paged results is aborted. This may be because so->so_tree is not the root of the tree when free_sort_op() calls tavl_free().

1 0

Re: (ITS#7583) ldap_init_fd() does not work with LDAP_PROTO_UDP
by hyc＠symas.com 23 May '13

23 May '13

stefw(a)redhat.com wrote: > Full_Name: Stef Walter > Version: 2.4.35 > OS: Fedora 18 > URL: http://fedorapeople.org/~stefw/patches/openldap-02/0001-Make-ldap_init_fd-w… > Submission from: (NULL) (77.3.95.123) > > > The ldap_init_fd() function does not work with UDP sockets (ie: LDAP_PROTO_UDP > passed in as the proto argument). Later uses of the LDAP connection returned > fail unceremoniously. > > This patch fixes the issue: Thanks, patch applied to git master. > > http://fedorapeople.org/~stefw/patches/openldap-02/0001-Make-ldap_init_fd-w… > > Some test code to exercise and demonstrate the problem. The code does not > actually wait for a UDP response, but should exit with a zero return code when > successful. > > http://fedorapeople.org/~stefw/patches/openldap-02/frob-cldap-initfd.c > > $ gcc -o frob-cldap-initfd -Wall -lldap -llber frob-cldap-initfd.c > $ ./frob-cldap-initfd > frob-cldap-initfd: ldap_search_ext: -1 > > The above result occurs before the patch is applied. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7582) Access to uninitialized memory when sending cldap packet
by hyc＠symas.com 23 May '13

23 May '13

stefw(a)redhat.com wrote: > Full_Name: Stef Walter > Version: 2.4.35 > OS: Fedora 18 > URL: http://fedorapeople.org/~stefw/patches/openldap-01/0001-Fix-usage-of-uninit… > Submission from: (NULL) (77.3.95.123) > > > When sending a cldap (UDP) packet, like a search request, uninitialized memory > is accessed. This shows up in valgrind like this: > > ==31445== Conditional jump or move depends on uninitialised value(s) > ==31445== at 0x36632244E6: ldap_send_server_request (request.c:377) > ==31445== by 0x36632247C2: ldap_send_initial_request (request.c:166) > ==31445== by 0x36632142F8: ldap_pvt_search (search.c:128) > ==31445== by 0x366321454F: ldap_search_ext (search.c:69) > ==31445== by 0x400838: main (in /data/projects/openldap/frob-cldap-search) > ==31445== > > This is due to parsing the resulting packet to pull out a requestDN. UDP packets > have different BER layout, and therefore the assumptions made when parsing the > outgoing request are invalid. > > It does not seem necessary to track the request DN for UDP packets. The linked > patch disables this code path for UDP packets. > > Patch which fixes the issue: > http://fedorapeople.org/~stefw/patches/openldap-01/0001-Fix-usage-of-uninit… > > Test code for the issue: > http://fedorapeople.org/~stefw/patches/openldap-01/frob-cldap-search.c > > Note that the test code doesn't detect the issue on its own (or do anything > useful). Use valgrind to detect the issue: > > $ gcc -o frob-cldap-search -Wall -lldap -llber frob-cldap-search.c > $ valgrind ./frob-cldap-search Your patch doesn't fix the issue. The behavior under valgrind is unchanged either way. Seems you're missing a '!' in your test. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7594) incomplete MDB subdb cursor cleanup
by hyc＠symas.com 23 May '13

23 May '13

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: mdb.master 0cdd9dffddf66c730a35f48db2bb02d8bb3e5731 > OS: Linux x86_64 > URL: > Submission from: (NULL) (193.69.163.163) > Submitted by: hallvard > > > If a cursor is at a clean subDB page, and its current item is deleted > by another cursor, then MDB_GET_CURRENT returns the deleted item. Fixed now in mdb.master. The subcursor on the clean page will be invalidated when the page is touched. > Test program below, run with no args, the "m2/del" output line. > > If the page was dirty, I instead got (key = old, data = size 0). > I don't know if it should give MDB_NOTFOUND instead. > That's the test program run with one arg. > I did not check what happens if the other cursor rearranged > the pages, e.g. split the item off to another page. > > #include "lmdb.h" > #include <assert.h> > #include <stdio.h> > #include <stdlib.h> > > int main(int argc, char **argv) > { > char *fname = "test.mdb"; > MDB_env *env; > MDB_txn *txn; > MDB_dbi dbi; > MDB_cursor *mc, *m2; > MDB_val key, data; > int rc; > # define STR2VAL(s) (&(MDB_val){sizeof(s), s}) /* includes final \0 */ > # define SHOW(name) printf("%s:\t%s[%zd] -> %s[%zd]\n", name, \ > (char*)key.mv_data, key.mv_size, (char*)data.mv_data, data.mv_size) > # define E(e) { rc = (e); if (rc) { fprintf(stderr, "%s:%d: %s: %s\n",\ > __FILE__, __LINE__, #e, mdb_strerror(rc)); abort(); } } > > remove(fname); > E(mdb_env_create(&env)); > E(mdb_env_open(env, fname, MDB_NOSUBDIR, 0666)); > E(mdb_txn_begin(env, NULL, 0, &txn)); > E(mdb_dbi_open(txn, NULL, MDB_DUPSORT, &dbi)); > > E(mdb_cursor_open(txn, dbi, &mc)); > E(mdb_cursor_put(mc, STR2VAL("a"), STR2VAL("x"), 0)); > E(mdb_cursor_put(mc, STR2VAL("a"), STR2VAL("y"), 0)); > > if (argc < 2) { > E(mdb_txn_commit(txn)); > E(mdb_txn_begin(env, NULL, 0, &txn)); > E(mdb_cursor_open(txn, dbi, &mc)); > puts("With clean page:"); > } > E(mdb_cursor_open(txn, dbi, &m2)); > > E(mdb_cursor_get(mc, &key, &data, MDB_FIRST)); > E(mdb_cursor_get(m2, &key, &data, MDB_FIRST)); > SHOW("Name:\tKey -> Data (mv_data[mv_len]):\n" "m2"); > > E(mdb_cursor_del(mc, 0)); > E(mdb_cursor_get(m2, &key, &data, MDB_GET_CURRENT)); > SHOW("m2/del"); /* Should output the same as... */ > E(mdb_cursor_get(mc, &key, &data, MDB_GET_CURRENT)); > SHOW("mc/del"); /* ...this: "a[2] -> [0]". */ > > mdb_txn_abort(txn); > mdb_env_close(env); > return 0; > } > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7581) adding meta backend in cn=config with ldapadd / ldapmodify
by hyc＠symas.com 23 May '13

23 May '13

hyc(a)symas.com wrote: > dcoutadeur(a)linagora.com wrote: >> Full_Name: dcoutadeur >> Version: 2.4.35 / git >> OS: openSuse 11.3 x86_64 >> URL: >> Submission from: (NULL) (80.67.162.201) >> >> >> I apologize in advance if this is not considered as a bug, but I thought this >> ticket should help the community anyway... >> >> The problem is that it seems impossible to add meta backend in cn=config thanks >> to ldapadd / ldapmodify clients. I thought the major interest for cn=config was >> precisely to let administrators change the configuration in a remote way, but >> maybe new database configuration is an exception ? > > Seems we need some rework here to allow this case. Currently bconfig assumes > that the olcDatabaseConfig entry is sufficient by itself, and any child > entries underneath are just optional. It doesn't handle the case where the > olcDatabaseConfig entry is basically an incomplete config. Should work now in git master, please test. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by michael＠stroeder.com 23 May '13

23 May '13

pa(a)marcelot.net wrote: > On 23 mai 2013, at 16:31, Howard Chu <hyc(a)symas.com> wrote: >> Don't do that. > > Sure, that's why I have a *bad* workaround to not update the 'objectClass' > attribute even if the original and my generated one don't match. IMO this is not a *bad* workaround. I think it's good practice in a UI client to *not* automagically modify attribute 'objectClass' without explicit user interaction asking for modification. Ciao, Michael.

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by michael＠stroeder.com 23 May '13

23 May '13

This is a cryptographically signed message in MIME format. --------------ms090403020009030408070805 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable pa(a)marcelot.net wrote: > It looks like it's not possible to modify the 'objectClass' attribute o= f > configuration entries. >=20 > I have some code generating entries for OpenLDAP configuration from a U= I utility > and updating existing configuration entries in DIT. > This code generates entries with the 'objectClass' attribute containing= the full > object class hierarchy (all the way to 'top') and not only the highest > structural object class (which is the case of default OpenLDAP configur= ation). >=20 > When updating the configuration in the DIT, the code then tries to comp= lete the > 'objectClass' attribute with the full list of object classes. > That operations ends with "error code 53- UnwillingToPerform". >=20 >=20 > Here's an example on the "cn=3Dconfig" entry: > #!RESULT ERROR > #!CONNECTION ldap://10.211.55.13:389 > #!DATE 2013-05-22T14:56:03.039 > #!ERROR [LDAP: error code 53 - UnwillingToPerform] > dn: cn=3Dconfig > changetype: modify > replace: objectClass > objectClass: olcConfig > objectClass: olcGlobal > objectClass: top It's not necessarily a bug. I think LDAP clients should not act too "smart" and therefore should not automagically add object classes from the structural object class chain i= f they are not already present. You will run into issues with various LDAP server implementations - at least according to experiences I made with conducting interop testing with web2ldap and several server implementatio= ns. A schema-aware client could auto-complete structural object class chain i= f adding a new entry though. But again: Don't be too smart. May I ask which UI utility you're using? Ciao, Michael. --------------ms090403020009030408070805 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTMwNTIzMTcyNjAwWjAjBgkq hkiG9w0BCQQxFgQUigp5LllXS15xuHzQioG6nuOqOi0wbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAKbzYGPYLZcAWjv0/WTjtlgavVd5dN7dbpT+jLvQpMT32iabw4pq+S4R1giJFoTpmy9PT bhM6G4EI2k0G62FScEMTYSrARYtm4S6MafnNOqntIYFqEY0VrSzK7Zc0Xpcw49SIoNrSQ8zT PlqtPVzvSMOLHFwYJSzdmvYgw2SYUGsibYaeG0VqlWzL693QVSDIb2Mn9jaCBvd7LHFwuOlN stfl7ITPkm6eJ79LcA9l6NVx/bWnDx/sgSDFciFz3NvA5NCyzLmJq1ObFukvI3qPYUS2xtLY glQ4lTiM7EbfGrXwKDO72J6FueGj6PLQ831+hh6gZr9PMKBvazoPhUvSEQAAAAAAAA== --------------ms090403020009030408070805--

1 0

Re: (ITS#7581) adding meta backend in cn=config with ldapadd / ldapmodify
by hyc＠symas.com 23 May '13

23 May '13

dcoutadeur(a)linagora.com wrote: > Full_Name: dcoutadeur > Version: 2.4.35 / git > OS: openSuse 11.3 x86_64 > URL: > Submission from: (NULL) (80.67.162.201) > > > I apologize in advance if this is not considered as a bug, but I thought this > ticket should help the community anyway... > > The problem is that it seems impossible to add meta backend in cn=config thanks > to ldapadd / ldapmodify clients. I thought the major interest for cn=config was > precisely to let administrators change the configuration in a remote way, but > maybe new database configuration is an exception ? Seems we need some rework here to allow this case. Currently bconfig assumes that the olcDatabaseConfig entry is sufficient by itself, and any child entries underneath are just optional. It doesn't handle the case where the olcDatabaseConfig entry is basically an incomplete config. > > Here are the technical elements : > > Content of meta.ldif : > > dn: olcDatabase={2}meta,cn=config > objectClass: olcDatabaseConfig > objectClass: olcMetaConfig > olcDatabase: {2}meta > olcSuffix: dc=foo,dc=com > > debug information in slapd, after the command : > ldapadd -H "ldap://localhost:389" -D "cn=config" -W -f meta.ldif > > 518220f1 conn=1002 op=1 ADD dn="olcDatabase={2}meta,cn=config" > 518220f1 meta_back_db_open: no targets defined > 518220f1 backend_startup_one (type=meta, suffix="dc=foo,dc=com"): bi_db_open > failed! (1) > 518220f1 olcSuffix: value #0: <olcSuffix> failed startup (dc=foo,dc=com)! > > However, I can add this entry via slapadd : > > dn: olcDatabase={2}meta,cn=config > objectClass: olcDatabaseConfig > objectClass: olcMetaConfig > olcDatabase: {2}meta > olcSuffix: dc=foo,dc=com > olcAddContentAcl: FALSE > olcLastMod: TRUE > olcMaxDerefDepth: 15 > olcReadOnly: FALSE > olcSyncUseSubentry: FALSE > olcMonitoring: FALSE > olcDbOnErr: continue > olcDbPseudoRootBindDefer: TRUE > olcDbSingleConn: FALSE > olcDbUseTemporaryConn: FALSE > olcDbConnectionPoolMax: 16 > olcDbBindTimeout: 100000 > olcDbCancel: abandon > olcDbChaseReferrals: FALSE > olcDbNoRefs: FALSE > olcDbNoUndefFilter: FALSE > olcDbNretries: 10 > olcDbProtocolVersion: 3 > olcDbRebindAsUser: FALSE > olcDbSessionTrackingRequest: FALSE > olcDbTFSupport: no > structuralObjectClass: olcMetaConfig > entryUUID: cf8afa3a-a284-4ac8-b60e-9431b0807ed4 > creatorsName: cn=config > createTimestamp: 20130430162302Z > entryCSN: 20130430162302.509672Z#000000#000#000000 > modifiersName: cn=config > modifyTimestamp: 20130430162302Z > > The fact is I don't have a metatarget configuration, because this is a subentry > of olcDatabase={2}meta,cn=config, thus I must add the latter entry first. > > > Also notice that I can't do a slapadd with just the meta configuration. (the > ldif above). If I do this, I have an error : > slapadd: could not add entry dn="olcDatabase={2}meta,cn=config" (line=1): > autocreation of "olcDatabase={-1}frontend" failed > > I had to make a backup of the full configuration, and then add the meta > configuration and import the resulting file. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by pa＠marcelot.net 23 May '13

23 May '13

On 23 mai 2013, at 16:31, Howard Chu <hyc(a)symas.com> wrote: > pa(a)marcelot.net wrote: >> Full_Name: Pierre-Arnaud Marcelot >> Version: 2.4.35 >> OS: Linux Mint >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (78.226.4.211) >> >> >> Hi, >> >> It looks like it's not possible to modify the 'objectClass' attribute of >> configuration entries. > > Correct. The config DIT has very rigid schema and layout rules. Indeed. >> I have some code generating entries for OpenLDAP configuration from a UI utility >> and updating existing configuration entries in DIT. >> This code generates entries with the 'objectClass' attribute containing the full >> object class hierarchy (all the way to 'top') and not only the highest >> structural object class (which is the case of default OpenLDAP configuration). >> >> When updating the configuration in the DIT, the code then tries to complete the >> 'objectClass' attribute with the full list of object classes. >> That operations ends with "error code 53- UnwillingToPerform". > > Don't do that. Sure, that's why I have a *bad* workaround to not update the 'objectClass' attribute even if the original and my generated one don't match. Still, looking at LDAP standards, that doesn't seem to be a naughty operation at all and nothing is really wrong with the resulting entry. Regards, Pierre-Arnaud >> Here's an example on the "cn=config" entry: >> #!RESULT ERROR >> #!CONNECTION ldap://10.211.55.13:389 >> #!DATE 2013-05-22T14:56:03.039 >> #!ERROR [LDAP: error code 53 - UnwillingToPerform] >> dn: cn=config >> changetype: modify >> replace: objectClass >> objectClass: olcConfig >> objectClass: olcGlobal >> objectClass: top >> - >> >> > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by hyc＠symas.com 23 May '13

23 May '13

pa(a)marcelot.net wrote: > Full_Name: Pierre-Arnaud Marcelot > Version: 2.4.35 > OS: Linux Mint > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (78.226.4.211) > > > Hi, > > It looks like it's not possible to modify the 'objectClass' attribute of > configuration entries. Correct. The config DIT has very rigid schema and layout rules. > I have some code generating entries for OpenLDAP configuration from a UI utility > and updating existing configuration entries in DIT. > This code generates entries with the 'objectClass' attribute containing the full > object class hierarchy (all the way to 'top') and not only the highest > structural object class (which is the case of default OpenLDAP configuration). > > When updating the configuration in the DIT, the code then tries to complete the > 'objectClass' attribute with the full list of object classes. > That operations ends with "error code 53- UnwillingToPerform". Don't do that. > Here's an example on the "cn=config" entry: > #!RESULT ERROR > #!CONNECTION ldap://10.211.55.13:389 > #!DATE 2013-05-22T14:56:03.039 > #!ERROR [LDAP: error code 53 - UnwillingToPerform] > dn: cn=config > changetype: modify > replace: objectClass > objectClass: olcConfig > objectClass: olcGlobal > objectClass: top > - > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7605) Configuration entries (under cn=config) does not allow 'objectclass' attribute modification to include full object classes hierarchy
by pa＠marcelot.net 23 May '13

23 May '13

Full_Name: Pierre-Arnaud Marcelot Version: 2.4.35 OS: Linux Mint URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.226.4.211) Hi, It looks like it's not possible to modify the 'objectClass' attribute of configuration entries. I have some code generating entries for OpenLDAP configuration from a UI utility and updating existing configuration entries in DIT. This code generates entries with the 'objectClass' attribute containing the full object class hierarchy (all the way to 'top') and not only the highest structural object class (which is the case of default OpenLDAP configuration). When updating the configuration in the DIT, the code then tries to complete the 'objectClass' attribute with the full list of object classes. That operations ends with "error code 53- UnwillingToPerform". Here's an example on the "cn=config" entry: #!RESULT ERROR #!CONNECTION ldap://10.211.55.13:389 #!DATE 2013-05-22T14:56:03.039 #!ERROR [LDAP: error code 53 - UnwillingToPerform] dn: cn=config changetype: modify replace: objectClass objectClass: olcConfig objectClass: olcGlobal objectClass: top -

1 0

(ITS#7596)
by nzipsi＠gmail.com 22 May '13

22 May '13

--bcaec53af1e4a1ae7704dd5c4ab8 Content-Type: text/plain; charset=UTF-8 Tested my idea about patching it, and it didn't work. There's something, somewhere, that doesn't like values of 0, and so doesn't include the graceAuthN warning in the returned password control if ngut is 0. I still believe what I have described above is an error, but I don't know enough about C or the internal structure of OpenLDAP to figure out why it's not working, and how (or even if) it can be fixed. --bcaec53af1e4a1ae7704dd5c4ab8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Tested my idea about patching it, and it didn't work. = There's something, somewhere, that doesn't like values of 0, and so= doesn't include the graceAuthN warning in the returned password contro= l if ngut is 0. I still believe what I have described above is an error, bu= t I don't know enough about C or the internal structure of OpenLDAP to = figure out why it's not working, and how (or even if) it can be fixed.<= /div> --bcaec53af1e4a1ae7704dd5c4ab8--

1 0

Re: (ITS#7597) migration of sunone 5.2 to openldap 2.4
by quanah＠zimbra.com 22 May '13

22 May '13

--On Tuesday, May 21, 2013 8:38 AM +0000 univadisitisteam(a)hcl.com wrote: > Full_Name: venkatesh > Version: 2.4 > OS: RH5.6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (155.91.28.231) > > > HI Team, > > We have a requirement for migrating existing Sun One 5.2 DS to open ldap > 2.4 Authentication.Please guide me how to do this migration. The ITS system is for reporting bugs with OpenLDAP. For migration help, I would advise you contact a company such as Symas (http://www.symas.com) that specializes in helping people with such migrations. You could also try asking for general help on -technical, but results may vary. This ITS will be closed. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7604) back-mdb abort after searching modrdn'd enry
by quanah＠OpenLDAP.org 22 May '13

22 May '13

Full_Name: Quanah Gibson-Mount Version: RE24 5/14/2013 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.58.125) Searching on an entry that has been renamed via modrdn can trigger an abort. It appears that modrdn periodically fails causing random corruption in the db.

1 0

Re: (ITS#7448) "assertion failed" in MDB
by quanah＠zimbra.com 22 May '13

22 May '13

--On Wednesday, May 22, 2013 9:39 PM +0000 dhawes(a)vt.edu wrote: > On Wed, Nov 21, 2012 at 1:16 PM, <hyc(a)symas.com> wrote: >> More information is needed than this. Your stack traces aren't even >> complete. What was the workload leading up to this? Give us a sample >> configuration that reproduces the assert. > > I came across what looks like this issue today. Let's see if I can > provide more info. > > I noticed one of my test machines (2.4.35) had crashed overnight. > Unfortunately, I had neglected to set ulimit -c, so I had no core dump > to work with. Upon restarting, however, I got the following: > > slapd: ./../../../libraries/liblmdb/mdb.c:4025: mdb_page_search_root: > Assertion `(((mp)->mp_pb.pb.pb_lower - ((unsigned) __builtin_offsetof > (MDB_page, mp_ptrs))) >> 1) > 1' failed. > > A backtrace shows that this occurred during an accesslog_purge(). The > backtrace is at the end of this email. This is ITS#7536. There were more fixes for it in RE24 after 2.4.35 was released. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7448) "assertion failed" in MDB
by dhawes＠vt.edu 22 May '13

22 May '13

On Wed, Nov 21, 2012 at 1:16 PM, <hyc(a)symas.com> wrote: > More information is needed than this. Your stack traces aren't even complete. > What was the workload leading up to this? Give us a sample configuration that > reproduces the assert. I came across what looks like this issue today. Let's see if I can provide more info. I noticed one of my test machines (2.4.35) had crashed overnight. Unfortunately, I had neglected to set ulimit -c, so I had no core dump to work with. Upon restarting, however, I got the following: slapd: ./../../../libraries/liblmdb/mdb.c:4025: mdb_page_search_root: Assertion `(((mp)->mp_pb.pb.pb_lower - ((unsigned) __builtin_offsetof (MDB_page, mp_ptrs))) >> 1) > 1' failed. A backtrace shows that this occurred during an accesslog_purge(). The backtrace is at the end of this email. The setup I have is a simple accesslog that records binds: ##### slapd.conf ##### ... database mdb suffix "cn=authstats" directory /apps/local/openldap-2.4.35/var/openldap-data/authstats maxsize 17179869184 dbnosync rootdn cn=manager,dc=vt,dc=edu index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart checkpoint 1024 10 overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE ... # dc=vt,dc=edu overlay accesslog logdb "cn=authstats" logops bind logpurge 01+00:00 0+08:00 ... ##### If I comment out the logpurge line, slapd starts without incident, cn=authstats is queryable, and new entries are logged. If I slapcat cn=authstats, remove the cn=authstats .mdb files, and slapadd everything back, upon startup the logpurge works as expected. If I move the original .mdb files back, the assert fails again. I'm attempting to reproduce this starting with an empty accesslog. I have so far been unsuccessful. I do have the original .mdb files if they may be helpful (though they are around 1G). One thing to note with the following backtrace is that the accesslog_purge() line number will be incorrect, as I have patched it to record connection info (like ITS#7345). None of this affects accesslog_purge(), though I can run these tests without the patch if necessary. ##### backtrace ##### Program received signal SIGABRT, Aborted. [Switching to Thread 0x7ff7f1722700 (LWP 1576)] 0x00007ffff66b28a5 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install db4-4.7.25-17.el6.x86_64 glibc-2.12-1.107.el6.x86_64 keyutils-libs-1.4-4.el6.x86_64 krb5-libs-1.10.3-10.el6_4.2.x86_64 libcom_err-1.41.12-14.el6.x86_64 libselinux-2.0.94-5.3.el6.x86_64 libtool-ltdl-2.2.6-15.5.el6.x86_64 nss-softokn-freebl-3.12.9-11.el6.x86_64 openssl-1.0.0-27.el6_4.2.x86_64 zlib-1.2.3-29.el6.x86_64 #0 0x00007ffff66b28a5 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x00007ffff66b4085 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x00007ffff66aba1e in __assert_fail_base () from /lib64/libc.so.6 No symbol table info available. #3 0x00007ffff66abae0 in __assert_fail () from /lib64/libc.so.6 No symbol table info available. #4 0x0000000000511836 in mdb_page_search_root (mc=0x7ff7e01023f8, key=0x0, modify=0) at ./../../../libraries/liblmdb/mdb.c:4025 node = 0x8 i = 0 mp = 0x7ff7e03c9000 rc = 0 __PRETTY_FUNCTION__ = "mdb_page_search_root" #5 0x0000000000517839 in mdb_node_move (csrc=0x7ff7f1720750, cdst=0x7ff7e01023f8) at ./../../../libraries/liblmdb/mdb.c:5988 snum = 3 s2 = 0x7ffff31270c0 bkey = {mv_size = 4294967304, mv_data = 0x0} srcnode = 0x7ff7e03ccc18 key = {mv_size = 80, mv_data = 0x7ff7e03ccc20} data = {mv_size = 111622, mv_data = 0x7ff7e03ccc70} srcpg = 111622 mn = {mc_next = 0x7ff7f1720530, mc_orig = 0x51cb38, mc_xcursor = 0x7ff7f1720740, mc_txn = 0x7ffff31270c0, mc_dbi = 4050782896, mc_db = 0x800000008, mc_dbx = 0x7ff700000063, mc_dbflag = 0x40 <Address 0x40 out of bounds>, mc_snum = 8, mc_top = 0, mc_flags = 0, mc_pg = {0x1030, 0x0, 0x0, 0x1, 0x7000000101, 0x44ab4, 0x7ffff31270c0, 0x7ff7f1720860, 0x800000c12, 0x100000009, 0x0, 0x7ff7f17205d0, 0x51cb38, 0x7ff7f17207e0, 0x7ffff31270c0, 0xc12, 0x900000009, 0x7ff7f17208b0, 0x50ca2c, 0x300000003, 0x7ff7f17208e0, 0x11013f9a8, 0x7ff7f1720a00, 0x7ff7e01025f0, 0x0, 0x7ff7e03c0b48, 0x50cb83, 0x24188, 0x7ff7f1720ab0, 0x7ffc2a2f6000, 0xe03bfd40, 0x1}, mc_ki = {64832, 57403, 32759, 0, 1696, 61810, 32759, 0, 5899, 81, 1, 0, 9648, 57360, 32759, 0, 2736, 61810, 32759, 0, 16776, 2, 0, 0, 57296, 57403, 32759, 0, 64832, 57403, 32759, 0}} rc = 0 flags = 0 __PRETTY_FUNCTION__ = "mdb_node_move" #6 0x00000000005191b9 in mdb_rebalance (mc=0x7ff7e01023f8) at ./../../../libraries/liblmdb/mdb.c:6391 node = 0x7ff7e03c8fe8 rc = 0 minkeys = 2 ptop = 1 mn = {mc_next = 0x7ff7e03bdfd0, mc_orig = 0x7ff7e03ca010, mc_xcursor = 0x0, mc_txn = 0x7ff7e03bdfd0, mc_dbi = 4, mc_db = 0x7ff7e0102580, mc_dbx = 0x7ff7e01025b0, mc_dbflag = 0x7ff7f1720e70 "", mc_snum = 3, mc_top = 2, mc_flags = 5, mc_pg = {0x7ff7e03c6fe0, 0x7ff7e03c7ff0, 0x7ff7e03cc030, 0x7ff7e01025f0, 0x0, 0x7ff7e03cabda, 0x50cb83, 0x0, 0x100000000000, 0x44ab4, 0x7ff7e03cb020, 0x7ff7e03bdfd0, 0x7ff7e03cb020, 0x44ab4, 0x0, 0x7ff7f17208a0, 0x50cc73, 0x7ff7f1720dcc, 0x7ff7e01023f8, 0x7ffc37bf9000, 0x7ff7e03c5fd0, 0x7ff7e03ca010, 0x7ff7e03ca010, 0x7ff7e01025f0, 0xf1720b00, 0x7ff7e03cbc58, 0x50cb83, 0x3f17208b0, 0x100000024188, 0x7ffc34e0d000, 0x7ff7e03cb020, 0x7ff7e03cb884}, mc_ki = {0, 0, 12, 0, 12616, 185, 0, 0, 3090, 0, 0, 0, 2368, 61810, 0, 0, 0, 0, 0, 0, 2400, 61810, 32759, 0, 2416, 61810, 32759, 0, 0, 0, 21, 0}} __PRETTY_FUNCTION__ = "mdb_rebalance" #7 0x000000000051880d in mdb_page_merge (csrc=0x7ff7e01023f8, cdst=0x7ff7f1720a00) at ./../../../libraries/liblmdb/mdb.c:6220 rc = 0 i = 11 j = 22 srcnode = 0x7ff7e03cac8c key = {mv_size = 81, mv_data = 0x7ff7e03cac94} data = {mv_size = 0, mv_data = 0x7ff7e03cace5} nkeys = 11 __PRETTY_FUNCTION__ = "mdb_page_merge" #8 0x000000000051920f in mdb_rebalance (mc=0x7ff7e01023f8) at ./../../../libraries/liblmdb/mdb.c:6396 node = 0x7ff7e03c9c3c rc = 0 minkeys = 1 ptop = 2 mn = {mc_next = 0x7ffc2ff89ff8, mc_orig = 0x5114df, mc_xcursor = 0x0, mc_txn = 0x7ff7e03bdfd0, mc_dbi = 4, mc_db = 0x7ff7e0102580, mc_dbx = 0x7ff7e01025b0, mc_dbflag = 0x7ff7e03bfd40 "\210A\002", mc_snum = 4, mc_top = 3, mc_flags = 5, mc_pg = {0x7ff7e03c6fe0, 0x7ff7e03c7ff0, 0x7ff7e03c9000, 0x7ff7e03cb020, 0x51117c, 0x7ff7f1720c70, 0x511cf4, 0x7ff7f1720ae0, 0x200b5ca30, 0x0, 0x7ff7e01025f0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff7e03bdfd0, 0x7ff700000001, 0x7ff7e03be068, 0xb5c9d0, 0x7ff7e03bfca9, 0x1, 0x7ff7e03bfd40, 0x7ff7f1720cb0, 0x0, 0x0, 0x7ff7e03bdfd0, 0x7ff700000001, 0x7ff7e03be068, 0xb5c9d0, 0x7ff7e03bfca9, 0x1}, mc_ki = {0, 1, 0, 10, 3072, 61810, 32759, 0, 44982, 57404, 32759, 0, 45072, 57404, 32759, 0, 44084, 57404, 32759, 0, 988, 0, 0, 0, 15065, 63088, 32767, 0, 3008, 61810, 32759, 0}} __PRETTY_FUNCTION__ = "mdb_rebalance" #9 0x00000000005193cb in mdb_cursor_del0 (mc=0x7ff7e01023f8, leaf=0x7ff7e03cafb6) at ./../../../libraries/liblmdb/mdb.c:6424 rc = 15 #10 0x0000000000515b10 in mdb_cursor_del (mc=0x7ff7e01023f8, flags=0) at ./../../../libraries/liblmdb/mdb.c:5305 leaf = 0x7ff7e03cafb6 rc = 0 #11 0x00000000005159d1 in mdb_cursor_del (mc=0x7ff7e0102270, flags=0) at ./../../../libraries/liblmdb/mdb.c:5278 leaf = 0x7ff7e03c6f24 rc = 0 #12 0x000000000056e5ee in mdb_dn2id_delete (op=0x7ff7f17213c0, mc=0x7ff7e0102270, id=1087351, nsubs=1) at dn2id.c:217 nid = 73 ptr = 0x7ffc37bf9f0a "" rc = 0 #13 0x000000000056d058 in mdb_delete (op=0x7ff7f17213c0, rs=0x7ff7f1721350) at delete.c:335 mdb = 0x7ffff7f2a010 pdn = {bv_len = 12, bv_val = 0x7ff7e010347f "cn=authstats"} e = 0x7ff7e0000be0 p = 0x7ff7e00009b0 manageDSAit = 0 children = 0x935970 entry = 0x9356d0 txn = 0x7ff7e03bdfd0 mc = 0x7ff7e0102270 opinfo = {moi_oe = {oe_next = {sle_next = 0x0}, oe_key = 0x7ffff7f2a010}, moi_txn = 0x7ff7e03bdfd0, moi_ref = 1, moi_flag = 0 '\000'} moi = 0x7ff7f1720e70 preread_ctrl = 0x0 ctrls = {0x0, 0x7ff7f172127e, 0x7ff7e0000908, 0x7ff7f1721281, 0x7ff7f172127e, 0x88} num_ctrls = 0 parent_is_glue = 0 parent_is_leaf = 0 __PRETTY_FUNCTION__ = "mdb_delete" #14 0x00000000004d8b1d in overlay_op_walk (op=0x7ff7f17213c0, rs=0x7ff7f1721350, which=op_delete, oi=0x9b7e60, on=0x0) at backover.c:671 func = 0x85d558 rc = 32768 #15 0x00000000004d8d34 in over_op_func (op=0x7ff7f17213c0, rs=0x7ff7f1721350, which=op_delete) at backover.c:723 oi = 0x9b7e60 on = 0x9b8040 be = 0x9b7190 db = {bd_info = 0x85d500, bd_self = 0x9b7190, be_ctrls = "\000\001\001\001\000\001\000\000\001\000\000\001\001\000\001\000\000\001", '\000' <repeats 14 times>, "\001", be_flags = 2312, be_restrictops = 0, be_requires = 0, be_ssf_set = {sss_ssf = 0, sss_transport = 0, sss_tls = 0, sss_sasl = 0, sss_update_ssf = 0, sss_update_transport = 0, sss_update_tls = 0, sss_update_sasl = 0, sss_simple_bind = 128}, be_suffix = 0x9b79e0, be_nsuffix = 0x9b7a10, be_schemadn = {bv_len = 0, bv_val = 0x0}, be_schemandn = {bv_len = 0, bv_val = 0x0}, be_rootdn = {bv_len = 23, bv_val = 0x9b7c50 "cn=manager,dc=vt,dc=edu"}, be_rootndn = { bv_len = 23, bv_val = 0x9b7ca0 "cn=manager,dc=vt,dc=edu"}, be_rootpw = {bv_len = 0, bv_val = 0x0}, be_max_deref_depth = 15, be_def_limit = {lms_t_soft = 3600, lms_t_hard = 0, lms_s_soft = 500, lms_s_hard = 0, lms_s_unchecked = -1, lms_s_pr = 0, lms_s_pr_hide = 0, lms_s_pr_total = 0}, be_limits = 0x9b7cf0, be_acl = 0x9b84c0, be_dfltaccess = ACL_READ, be_extra_anlist = 0x0, be_update_ndn = {bv_len = 0, bv_val = 0x0}, be_update_refs = 0x0, be_pending_csn_list = 0xb5f2d0, be_pcl_mutex = {__data = { __lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, be_syncinfo = 0x0, be_pb = 0x0, be_cf_ocs = 0x864500, be_private = 0x7ffff7f2a010, be_next = {stqe_next = 0x9b8760}} cb = {sc_next = 0x7ffff35e5fe0, sc_response = 0x4d7afa <over_back_response>, sc_cleanup = 0, sc_private = 0x9b7e60} sc = 0x7ff7f1721354 rc = 32768 __PRETTY_FUNCTION__ = "over_op_func" #16 0x00000000004d8eee in over_op_delete (op=0x7ff7f17213c0, rs=0x7ff7f1721350) at backover.c:780 No locals. #17 0x00007ffff33dcb46 in accesslog_purge (ctx=0x7ff7f1721aa0, arg=0xa1e4e0) at accesslog.c:707 i = 0 rtask = 0xa1e4e0 li = 0xa1f300 conn = {c_struct_state = SLAP_C_UNINITIALIZED, c_conn_state = SLAP_C_INVALID, c_conn_idx = -1, c_sd = 0, c_close_reason = 0x0, c_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = { __prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_sb = 0x0, c_starttime = 0, c_activitytime = 0, c_connid = 18446744073709551615, c_peer_domain = {bv_len = 0, bv_val = 0x5d1370 ""}, c_peer_name = {bv_len = 0, bv_val = 0x5d1370 ""}, c_listener = 0x5d92a0, c_sasl_bind_mech = { bv_len = 0, bv_val = 0x0}, c_sasl_dn = {bv_len = 0, bv_val = 0x0}, c_sasl_authz_dn = {bv_len = 0, bv_val = 0x0}, c_authz_backend = 0x0, c_authz_cookie = 0x0, c_authz = {sai_method = 0, sai_mech = { bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn = {bv_len = 0, bv_val = 0x0}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, c_protocol = 0, c_ops = {stqh_first = 0x0, stqh_last = 0x0}, c_pending_ops = {stqh_first = 0x0, stqh_last = 0x0}, c_write1_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_write1_cv = {__data = {__lock = 0, __futex = 0, __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 times>, __align = 0}, c_write2_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_write2_cv = {__data = {__lock = 0, __futex = 0, __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 times>, __align = 0}, c_currentber = 0x0, c_writers = 0, c_writing = 0 '\000', c_sasl_bind_in_progress = 0 '\000', c_writewaiter = 0 '\000', c_is_tls = 0 '\000', c_needs_tls_accept = 0 '\000', c_sasl_layers = 0 '\000', c_sasl_done = 0 '\000', c_sasl_authctx = 0x0, c_sasl_sockctx = 0x0, c_sasl_extra = 0x0, c_sasl_bindop = 0x0, c_pagedresults_state = {ps_be = 0x0, ps_size = 0, ps_count = 0, ps_cookie = 0, ps_cookieval = { bv_len = 0, bv_val = 0x0}}, c_n_ops_received = 0, c_n_ops_executing = 0, c_n_ops_pending = 0, c_n_ops_completed = 0, c_n_get = 0, c_n_read = 0, c_n_write = 0, c_extensions = 0x0, c_clientfunc = 0, c_clientarg = 0x0, c_send_ldap_result = 0x45be00 <slap_send_ldap_result>, c_send_search_entry = 0x45cb08 <slap_send_search_entry>, c_send_search_reference = 0x45ebb8 <slap_send_search_reference>, c_send_ldap_extended = 0x45c667 <slap_send_ldap_extended>, c_send_ldap_intermediate = 0x45c8e5 <slap_send_ldap_intermediate>} opbuf = {ob_op = {o_hdr = 0x7ff7f1721530, o_tag = 74, o_time = 1369246130, o_tincr = 2, o_bd = 0x7ff7f1720fe0, o_req_dn = {bv_len = 44, bv_val = 0x7ff7e0103420 "reqStart=20130520202434.000180Z,cn=authstats"}, o_req_ndn = {bv_len = 43, bv_val = 0x7ff7e0103460 "reqStart=20130520202434.00018Z,cn=authstats"}, o_request = {oq_add = {rs_modlist = 0x1, rs_e = 0xffffffffffffffff}, oq_bind = {rb_method = 1, rb_cred = { bv_len = 18446744073709551615, bv_val = 0x0}, rb_edn = { bv_len = 1, bv_val = 0x861740 "\003"}, rb_ssf = 4050785040, rb_mech = {bv_len = 27, bv_val = 0x7ff7e0000908 "\300\017r\361\367\177"}}, oq_compare = {rs_ava = 0x1}, oq_modify = {rs_mods = { rs_modlist = 0x1, rs_no_opattrs = -1 '\377'}, rs_increment = 0}, oq_modrdn = {rs_mods = {rs_modlist = 0x1, rs_no_opattrs = -1 '\377'}, rs_deleteoldrdn = 0, rs_newrdn = {bv_len = 1, bv_val = 0x861740 "\003"}, rs_nnewrdn = {bv_len = 140702884434704, bv_val = 0x1b <Address 0x1b out of bounds>}, rs_newSup = 0x7ff7e0000908, rs_nnewSup = 0x0}, oq_search = { rs_scope = 1, rs_deref = 0, rs_slimit = -1, rs_tlimit = -1, rs_limit = 0x0, rs_attrsonly = 1, rs_attrs = 0x861740, rs_filter = 0x7ff7f1721310, rs_filterstr = {bv_len = 27, bv_val = 0x7ff7e0000908 "\300\017r\361\367\177"}}, oq_abandon = {rs_msgid = 1}, oq_cancel = {rs_msgid = 1}, oq_extended = {rs_reqoid = {bv_len = 1, bv_val = 0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>}, rs_flags = 0, rs_reqdata = 0x1}, oq_pwdexop = {rs_extended = { rs_reqoid = {bv_len = 1, bv_val = 0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>}, rs_flags = 0, rs_reqdata = 0x1}, rs_old = {bv_len = 8787776, bv_val = 0x7ff7f1721310 "\246"}, rs_new = {bv_len = 27, bv_val = 0x7ff7e0000908 "\300\017r\361\367\177"}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon = 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', o_is_auth_check = 0 '\000', o_dont_replicate = 1 '\001', o_acl_priv = ACL_NONE, o_nocaching = 0 '\000', o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000', o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 31 times>, o_controls = 0x7ff7f1721678, o_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 23, bv_val = 0x9b7c50 "cn=manager,dc=vt,dc=edu"}, sai_ndn = { bv_len = 23, bv_val = 0x9b7ca0 "cn=manager,dc=vt,dc=edu"}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x7ff7e0000908, o_ctrls = 0x0, o_csn = {bv_len = 40, bv_val = 0x7ff7f1721260 "20130521180706.125179Z#000000#000#000000"}, o_private = 0x0, o_extra = {slh_first = 0x7ff7f1720e70}, o_next = { stqe_next = 0x0}}, ob_hdr = {oh_opid = 0, oh_connid = 18446744073709551615, oh_conn = 0x7ff7f1721780, oh_msgid = 0, oh_protocol = 0, oh_tid = 140702884439808, oh_threadctx = 0x7ff7f1721aa0, oh_tmpmemctx = 0x7ff7e00008c0, oh_tmpmfuncs = 0x861ce0, oh_counters = 0x8b7d40, oh_log_prefix = "conn=-1 op=0", '\000' <repeats 243 times>}, ob_controls = {0x0 <repeats 32 times>}} op = 0x7ff7f17213c0 rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = -30798, sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}, sru_sasl = {r_sasldata = 0x0}, sru_extended = { r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} cb = {sc_next = 0x0, sc_response = 0x7ffff33dc4f0 <log_old_lookup>, sc_cleanup = 0, sc_private = 0x7ff7f17212c0} f = {f_choice = 166, f_un = {f_un_result = -244182288, f_un_desc = 0x7ff7f17212f0, f_un_ava = 0x7ff7f17212f0, f_un_ssa = 0x7ff7f17212f0, f_un_mra = 0x7ff7f17212f0, f_un_complex = 0x7ff7f17212f0}, f_next = 0x0} ava = {aa_desc = 0x9ad600, aa_value = {bv_len = 15, bv_val = 0x7ff7f17212a0 "20130521180850Z"}} pd = {slots = 22700, used = 22689, dn = 0x7ff7e04cab30, ndn = 0x7ff7e0523600, csn = {bv_len = 40, bv_val = 0x7ff7f1721260 "20130521180706.125179Z#000000#000#000000"}} timebuf = "20130521180850Z\000\000\000\000\000\000" csnbuf = "20130521180706.125179Z#000000#000#000000", '\000' <repeats 23 times> old = 1369159730 __PRETTY_FUNCTION__ = "accesslog_purge" #18 0x0000000000595639 in ldap_int_thread_pool_wrapper (xpool=0x93a270) at tpool.c:688 pool = 0x93a270 task = 0x7ff7ec000a20 work_list = 0x93a308 ctx = {ltu_id = 140702884439808, ltu_key = {{ltk_key = 0x4b8d8b, ltk_data = 0x7ff7e00008c0, ltk_free = 0x4b8bb0 <slap_sl_mem_destroy>}, { ltk_key = 0x7ffff3127010, ltk_data = 0x7ff7e0100910, ltk_free = 0x5746dc <mdb_reader_free>}, {ltk_key = 0x525df8, ltk_data = 0x7ff7ea7fe010, ltk_free = 0x525dd5 <search_stack_free>}, {ltk_key = 0x52329d, ltk_data = 0x7ff7f0420010, ltk_free = 0x523255 <scope_chunk_free>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 25 times>, { ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0x80}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0}}} kctx = 0x0 i = 32 keyslot = 672 hash = 284303008 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #19 0x00007ffff764a851 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #20 0x00007ffff676890d in clone () from /lib64/libc.so.6 No symbol table info available. #####

1 0

Re: (ITS#7595) OpenLDAP lacks a ECDHE key generation callback
by hyc＠symas.com 22 May '13

22 May '13

crest(a)tzi.de wrote: > Full_Name: Jan Bramkamp > Version: 2.4.35 > OS: FreeBSD 9.1 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (79.230.127.217) > > > OpenLDAP supports PFS TLS cipher suites using DHE with the > DH *tlso_tmp_dh_cb(SSL*,int,int) callback in libraries/libldap/tls_o.c. > DHE-RSA/DSS cipher suites are very CPU intensive and noticeably increase latency > on low-power hardware. While OpenLDAP supports ECDH-ECDSA cipher suites these > lack the PFS offered by DHE-RSA/DSS cipher suites. > >>From my initial search it looks like the correct API to register such a callback > would be SSL_CTX_set_tmp_ecdh_callback(), but im not familiar the OpenLDAP code > base so patching it my self could have unintended consequences. > > This how the CA was generated: > CURVE=secp384r1 > > openssl ecparam -out private/ca-key.pem -name $CURVE -genkey && > openssl req -new -x509 -days 365 -key private/ca-key.pem -out > certs/ca-cert.pem > > openssl ecparam -out private/auth1-key.pem -name $CURVE -genkey && > openssl req -new -key private/auth1-key.pem -out newcerts/auth1-csr.pem && > openssl ca -config /usr/local/openssl/openssl.cnf -out certs/auth1-cert.pem > -infiles newcerts/auth1-csr.pem > > The (EC)DH paramter file was generated with: > openssl ecparam -name $CURVE > > This was tested with slapd linked against OpenSSL 1.0.1e from ports on FreeBSD > 9.1/amd64. > > Some background info in this thread http://openssl.6102.n7.nabble.com/Problem-with-cipher-suite-ECDHE-ECDSA-AES… -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7598) Named MDB database incompatible with some flags
by h.b.furuseth＠usit.uio.no 21 May '13

21 May '13

> mdb_dbi_open(named database) and thus "mdb_stat -a" > crash if the main database has the MDB_DUPSORT flag: > It hits assert(mx != NULL) in mdb_cursor_init(). > > Fixing to reject mdb_dbi_open(named database) in this > case, (...) But then mdb_stat crashes anyway when calling: mdb_cursor_get(cursor, &key, NULL, MDB_NEXT) if a key has several data values. mdb_cursor_get(,,,MDB_NEXT) expects a non-NULL data argument for an MDB_DUPSORT database. It works with MDB_NEXT_NODUP. I think we can drop the doc which says MDB_<NEXT,PREV>_NODUP is only for DUPSORT databases. mdb.c will need no changes that I can see. Or, it works to pass a pointer to an otherwise unused data. But that leaves mdb_stat doing more work than it needs. Another mdb_stat nitpick: It exits with failure after mdb_cursor_get returns an expected MDB_NOTFOUND. Fixing. -- Hallvard

1 0

(ITS#7598) Named MDB database incompatible with some flags
by h.b.furuseth＠usit.uio.no 21 May '13

21 May '13

Full_Name: Hallvard B Furuseth Version: mdb.master, a2ce25482a60e516d1d9b417ed666dac6fdebb93 OS: Linux x86_64 URL: Submission from: (NULL) (193.69.163.163) Submitted by: hallvard mdb_dbi_open(named database) and thus "mdb_stat -a" crash if the main database has the MDB_DUPSORT flag: It hits assert(mx != NULL) in mdb_cursor_init(). Fixing to reject mdb_dbi_open(named database) in this case, and also with MDB_INTEGERKEY which would expect the char* database name to be a binary integer.

1 0

(ITS#7597) migration of sunone 5.2 to openldap 2.4
by univadisitisteam＠hcl.com 21 May '13

21 May '13

Full_Name: venkatesh Version: 2.4 OS: RH5.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (155.91.28.231) HI Team, We have a requirement for migrating existing Sun One 5.2 DS to open ldap 2.4 Authentication.Please guide me how to do this migration. Regards, Venkatesh

1 0

(ITS#7596) OpenLDAP returning incorrect value for "graceAuthNsRemaining"
by nzipsi＠gmail.com 21 May '13

21 May '13

Full_Name: Andrew Thorburn Version: 2.4.35 OS: N/A URL: Submission from: (NULL) (203.97.178.157) The problem is very simple: According to the Behera Password Policy Draft (http://tools.ietf.org/html/draft-behera-ldap-password-policy-10), the attribute graceAuthNsRemaining should be set to the number of grace authentications remaining. However, with the following policy extract: pwdMaxAge: 1 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: TRUE pwdGraceAuthNLimit: 2 Running ldapwhoami results in the following: ldap_bind: Success (0) (Password expired, 2 grace logins remain) dn:uid=ANDREWT,ou=People,dc=example,dc=com That is not correct - there is only a single grace login remaining. I have used up one of the two grace logins provided by binding to OpenLDAP to execute the ldapwhoami command. Executing the same command twice more results in the following: $ ldapwhoami -h remotehost -e ppolicy -D uid=ANDREWT,ou=People,dc=example,dc=com -w andrew10 ldap_bind: Success (0) (Password expired, 1 grace logins remain) dn:uid=ANDREWT,ou=People,dc=example,dc=com $ ldapwhoami -h remotehost -e ppolicy -D uid=ANDREWT,ou=People,dc=example,dc=com -w andrew10 ldap_bind: Invalid credentials (49); Password expired Whereas I would have assumed, both from the message returned and from the language in the draft, that the first invocation would have said "(Password expired, 1 grace logins remain)", followed by then denying access for the next two invocations. Well, actually, what I would *expect* to happen is the first would return "1 remains", the second "0 remain" and the third would deny access, but the draft policy is pretty explicit, IMO, that the former is what should happen (which is daft). Now, according to the spec: "If there are remaining grace authentications as per Section 7.4, the server adds a new value with the current time in pwdGraceUseTime. Then it sends to the client a response with an appropriate successful resultCode (i.e. success (0), compareTrue (6), etc.), and includes the passwordPolicyResponse in the controls field of the response message with the warning: graceAuthNsRemaining choice set to the number of grace authentications left." This suggests, at least to me, that a new value should be added to pwdGraceUseTime *before* calculating the number of remaining grace logins. Admittedly, that wouldn't actually fix the issue, as it would result in the final grace login failing. Oops. This looks a lot like a bug to me, but at the same time, it also seems to be trying to adhere to the letter of the policy while also doing what is expected (e.g. if pwdGraceAuthNLimit is 1, I should be able to login once, while according to the letter of the policy pwdGraceAuthNLimit: 1 == pwdGraceAuthNLimit: 0...) The simplest fix, at least that I can see, would be to add the statement "ngut--;" at some point after the statement if (ngut < 1) { ppb->pErr = PP_passwordExpired; rs->sr_err = LDAP_INVALID_CREDENTIALS; goto done; } e.g. if (ngut < 1) { ppb->pErr = PP_passwordExpired; rs->sr_err = LDAP_INVALID_CREDENTIALS; goto done; } ngut--; Or perhaps after we've created the grace user time attribute modification. This would be done to account for the fact that we are, right now, using up a single one of the pwdGraceUseTime values, and that once we're done, ngut should indeed be one less than it currently is - there will be (ngut - 1) grace logins *remaining* after this method invocation finishes. This may seem like a really small thing, but it's causing problems for me...

1 0

RE: (ITS#7591) back-meta modify operation not sending result to client
by jorge.perez.burgos＠ericsson.com 20 May '13

20 May '13

Hi, At the end, meta_back_op_result() will map inside the error returned by ldap_modify_ext to LDAP_OTHER, since we don't call it with LDAP_BACK_SENDERR, nothing is sent. Since the error is not LDAP_UNAVAILABLE there will be no retries. I think this happens too in add and delete. BR -----Original Message----- From: Pierangelo Masarati [mailto:pierangelo.masarati@polimi.it] Sent: lunes, 20 de mayo de 2013 21:41 To: Jorge Perez Burgos Cc: openldap-its(a)openldap.org Subject: Re: (ITS#7591) back-meta modify operation not sending result to client On 05/15/2013 08:57 AM, jorge.perez.burgos(a)ericsson.com wrote: > kludge fix for the problem > > --- servers/slapd/back-meta/modify.c 2012-07-31 18:39:26.000000000 +0200 > +++ servers/slapd/back-meta/modify.c 2013-05-14 12:45:39.273333000 +0200 > @@ -176,6 +176,7 @@ > } > modv[ i ] = 0; > > + rs->sr_type = -1; > retry:; > ctrls = op->o_ctrls; > rc = meta_back_controls_add( op, rs, mc, candidate, &ctrls ); @@ > -198,6 +200,10 @@ > } > > cleanup:; > + if (rs->sr_type != REP_RESULT) { > + send_ldap_error(op, rs, LDAP_OTHER, "connection problem trying to reach the other node"); > + } > + > (void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls ); > > if ( mdn.bv_val != op->o_req_dn.bv_val ) { Thanks for the feedback; I am under the impression that a result should have been returned by meta_back_op_result(). Before applying the suggested fix, I would like to understand whether that function was called and in case why it did not send a result. p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7595) OpenLDAP lacks a ECDHE key generation callback
by crest＠tzi.de 20 May '13

20 May '13

Full_Name: Jan Bramkamp Version: 2.4.35 OS: FreeBSD 9.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (79.230.127.217) OpenLDAP supports PFS TLS cipher suites using DHE with the DH *tlso_tmp_dh_cb(SSL*,int,int) callback in libraries/libldap/tls_o.c. DHE-RSA/DSS cipher suites are very CPU intensive and noticeably increase latency on low-power hardware. While OpenLDAP supports ECDH-ECDSA cipher suites these lack the PFS offered by DHE-RSA/DSS cipher suites. >From my initial search it looks like the correct API to register such a callback would be SSL_CTX_set_tmp_ecdh_callback(), but im not familiar the OpenLDAP code base so patching it my self could have unintended consequences. This how the CA was generated: CURVE=secp384r1 openssl ecparam -out private/ca-key.pem -name $CURVE -genkey && openssl req -new -x509 -days 365 -key private/ca-key.pem -out certs/ca-cert.pem openssl ecparam -out private/auth1-key.pem -name $CURVE -genkey && openssl req -new -key private/auth1-key.pem -out newcerts/auth1-csr.pem && openssl ca -config /usr/local/openssl/openssl.cnf -out certs/auth1-cert.pem -infiles newcerts/auth1-csr.pem The (EC)DH paramter file was generated with: openssl ecparam -name $CURVE This was tested with slapd linked against OpenSSL 1.0.1e from ports on FreeBSD 9.1/amd64.

1 0

Re: (ITS#7591) back-meta modify operation not sending result to client
by pierangelo.masarati＠polimi.it 20 May '13

20 May '13

On 05/15/2013 08:57 AM, jorge.perez.burgos(a)ericsson.com wrote: > kludge fix for the problem > > --- servers/slapd/back-meta/modify.c 2012-07-31 18:39:26.000000000 +0200 > +++ servers/slapd/back-meta/modify.c 2013-05-14 12:45:39.273333000 +0200 > @@ -176,6 +176,7 @@ > } > modv[ i ] = 0; > > + rs->sr_type = -1; > retry:; > ctrls = op->o_ctrls; > rc = meta_back_controls_add( op, rs, mc, candidate, &ctrls ); > @@ -198,6 +200,10 @@ > } > > cleanup:; > + if (rs->sr_type != REP_RESULT) { > + send_ldap_error(op, rs, LDAP_OTHER, "connection problem trying to reach the other node"); > + } > + > (void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls ); > > if ( mdn.bv_val != op->o_req_dn.bv_val ) { Thanks for the feedback; I am under the impression that a result should have been returned by meta_back_op_result(). Before applying the suggested fix, I would like to understand whether that function was called and in case why it did not send a result. p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7594) incomplete MDB subdb cursor cleanup
by h.b.furuseth＠usit.uio.no 18 May '13

18 May '13

Full_Name: Hallvard B Furuseth Version: mdb.master 0cdd9dffddf66c730a35f48db2bb02d8bb3e5731 OS: Linux x86_64 URL: Submission from: (NULL) (193.69.163.163) Submitted by: hallvard If a cursor is at a clean subDB page, and its current item is deleted by another cursor, then MDB_GET_CURRENT returns the deleted item. Test program below, run with no args, the "m2/del" output line. If the page was dirty, I instead got (key = old, data = size 0). I don't know if it should give MDB_NOTFOUND instead. That's the test program run with one arg. I did not check what happens if the other cursor rearranged the pages, e.g. split the item off to another page. #include "lmdb.h" #include <assert.h> #include <stdio.h> #include <stdlib.h> int main(int argc, char **argv) { char *fname = "test.mdb"; MDB_env *env; MDB_txn *txn; MDB_dbi dbi; MDB_cursor *mc, *m2; MDB_val key, data; int rc; # define STR2VAL(s) (&(MDB_val){sizeof(s), s}) /* includes final \0 */ # define SHOW(name) printf("%s:\t%s[%zd] -> %s[%zd]\n", name, \ (char*)key.mv_data, key.mv_size, (char*)data.mv_data, data.mv_size) # define E(e) { rc = (e); if (rc) { fprintf(stderr, "%s:%d: %s: %s\n",\ __FILE__, __LINE__, #e, mdb_strerror(rc)); abort(); } } remove(fname); E(mdb_env_create(&env)); E(mdb_env_open(env, fname, MDB_NOSUBDIR, 0666)); E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_dbi_open(txn, NULL, MDB_DUPSORT, &dbi)); E(mdb_cursor_open(txn, dbi, &mc)); E(mdb_cursor_put(mc, STR2VAL("a"), STR2VAL("x"), 0)); E(mdb_cursor_put(mc, STR2VAL("a"), STR2VAL("y"), 0)); if (argc < 2) { E(mdb_txn_commit(txn)); E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_cursor_open(txn, dbi, &mc)); puts("With clean page:"); } E(mdb_cursor_open(txn, dbi, &m2)); E(mdb_cursor_get(mc, &key, &data, MDB_FIRST)); E(mdb_cursor_get(m2, &key, &data, MDB_FIRST)); SHOW("Name:\tKey -> Data (mv_data[mv_len]):\n" "m2"); E(mdb_cursor_del(mc, 0)); E(mdb_cursor_get(m2, &key, &data, MDB_GET_CURRENT)); SHOW("m2/del"); /* Should output the same as... */ E(mdb_cursor_get(mc, &key, &data, MDB_GET_CURRENT)); SHOW("mc/del"); /* ...this: "a[2] -> [0]". */ mdb_txn_abort(txn); mdb_env_close(env); return 0; }

1 0

Re: (ITS#7589) MDB nodesize issues
by h.b.furuseth＠usit.uio.no 17 May '13

17 May '13

Another issue: This breaks because liblmdb does not change the node size when overwriting an overflow page: mdb_put(txn, dbi, &key, &(MDB_val){9000, val}, 0); mdb_put(txn, dbi, &key, &(MDB_val){1, val}, 0); mdb_get(txn, dbi, &key, &data); assert(data.mv_size != 9000); Fixed by 0cdd9dffddf66c730a35f48db2bb02d8bb3e5731. mdb_cursor_put() said: /* yes, overwrite it. Note in this case we don't * bother to try shrinking the node if the new data * is smaller than the overflow threshold. */ It's number of pages which does not need to shrink. -- Hallvard

1 0

Re: (ITS#7577) hdb and mdb derefere aliases differently
by hyc＠symas.com 17 May '13

17 May '13

Juergen.Sprenger(a)swisscom.com wrote: > tried the fix fb537d747c6fd43e08986e99b1fe7781660feaf3 There was a followup commit also needed. 201ddbe3e4d8eb39830b96eefa559900952bc022 Just get the latest. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7577) hdb and mdb derefere aliases differently
by Juergen.Sprenger＠swisscom.com 17 May '13

17 May '13

tried the fix fb537d747c6fd43e08986e99b1fe7781660feaf3 but behavior did not change. Juergen Sprenger

1 0

(ITS#7593) Openldap - MySQL | Issue with displaying list of users from same domain
by sandeeps＠rediff-inc.com 15 May '13

15 May '13

Full_Name: Sandeep Singh Version: openldap-2.4.35 OS: CentOS Linux release 6.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (202.137.232.113) Hello, We have configured an openldap server with mysql as the backend. It is working fine as well. We have a scenario where we feel it is not behaving the way it is required. We have multiple domains say:- 1) abc.com 2) xyz.com Have mapped user as:- 1) mail=man1(a)red.com,dc=abc,dc=com with password=man1r 2) mail=man2(a)red.com,dc=abc,dc=com with password=man2r 3) mail=man1(a)sad.com,dc=xyz,dc=com with password=man1s 4) mail=man2(a)sad.com,dc=xyz,dc=com with password=man2s When we search for result using:- ldapsearch -x -D "mail=man1(a)red.com,dc=abc,dc=com" -W -b "dc=abc,dc=com" It gives us output / result shown is of domains abc.com i.e. mail=man1(a)red.com,dc=abc,dc=com & mail=man1@red.com,dc=abc,dc=com Which is correct But when we search for results using:- ldapsearch -x -D "mail=man1(a)red.com,dc=abc,dc=com" -W -b "dc=xyz,dc=com" Then the output / result shown is of domain xyz.com i.e. mail=man1(a)sad.com,dc=xyz,dc=com & mail=man2@sad.com,dc=xyz,dc=com because the base search is dc=xyz,dc=com Which is not correct as mail=man1(a)red.com,dc=abc,dc=com does not belong to xyz.com domain So we want to authenticate and display user along with the list of other users from the same domain and not from the other domain. Please suggest how to overcome / solve the issue.

1 0

Re: (ITS#7591) back-meta modify operation not sending result to client
by jorge.perez.burgos＠ericsson.com 14 May '13

14 May '13

kludge fix for the problem --- servers/slapd/back-meta/modify.c 2012-07-31 18:39:26.000000000 +0200 +++ servers/slapd/back-meta/modify.c 2013-05-14 12:45:39.273333000 +0200 @@ -176,6 +176,7 @@ } modv[ i ] = 0; + rs->sr_type = -1; retry:; ctrls = op->o_ctrls; rc = meta_back_controls_add( op, rs, mc, candidate, &ctrls ); @@ -198,6 +200,10 @@ } cleanup:; + if (rs->sr_type != REP_RESULT) { + send_ldap_error(op, rs, LDAP_OTHER, "connection problem trying to reach the other node"); + } + (void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls ); if ( mdn.bv_val != op->o_req_dn.bv_val ) {

1 0

(ITS#7592) LMDB corruption
by hyc＠OpenLDAP.org 14 May '13

14 May '13

Full_Name: Howard Chu Version: 2.4.33+ OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc Already fixed in mdb.master commit 7233bc295bb3e40b2758158ae2de6f42516962f8 In mdb_page_split, if updating the parent's separator triggers a split in the parent, and the current cursor position happens to point to the split index, the cursor will be left pointing to the old parent page instead of the correct page.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs